@openclaw/codex 2026.7.2-beta.7 → 2026.7.34

package/dist/{web-search-provider.runtime-CCFhg2z5.js → .setup/web-search-provider.runtime-Ce2zOHxW.mjs}

@@ -1,6 +1,6 @@
-import { W as isJsonObject } from "./shared-client-DTbvH-XV.js";
-import { h as buildCodexNativeWebSearchThreadConfig } from "./thread-lifecycle-DF53ogiA.js";
-import { t as runBoundedCodexAppServerTurn } from "./bounded-turn-D2ZAgZVz.js";
+import { r as isJsonObject } from "./protocol-2POPqAY4.mjs";
+import { _ as buildCodexNativeWebSearchThreadConfig } from "./thread-lifecycle-u6CZdOOH.mjs";
+import { n as runBoundedCodexAppServerTurn } from "./media-understanding-provider-EbJCyDqe.mjs";
 import { readStringParam, resolveSearchTimeoutSeconds, wrapWebContent } from "openclaw/plugin-sdk/provider-web-search";
 //#region extensions/codex/src/web-search-provider.runtime.ts
 async function executeCodexWebSearchProviderTool(ctx, args, executionContext, options) {

package/dist/doctor-contract-api.js

@@ -1,13 +1,10 @@
-import { n as CODEX_APP_SERVER_BINDING_NAMESPACE, t as CODEX_APP_SERVER_BINDING_MAX_ENTRIES } from "./session-binding-meta-B7aEMU7g.js";
+import { n as CODEX_APP_SERVER_BINDING_NAMESPACE, t as CODEX_APP_SERVER_BINDING_MAX_ENTRIES } from "./.setup/session-binding-meta-B7aEMU7g.mjs";
 import fs from "node:fs/promises";
 import path from "node:path";
 import { listAgentIds, resolveAgentDir, resolveSessionAgentIds } from "openclaw/plugin-sdk/agent-runtime";
 import { isDeepStrictEqual } from "node:util";
-import { isRecord } from "openclaw/plugin-sdk/string-coerce-runtime";
-import { patchSessionEntry, resolveStorePath } from "openclaw/plugin-sdk/session-store-runtime";
-import { canonicalPathFromExistingAncestor, isPathInside, pathExists } from "openclaw/plugin-sdk/security-runtime";
+import { listSessionEntries, resolveSessionFilePath, resolveStorePath, updateSessionStoreEntry } from "openclaw/plugin-sdk/session-store-runtime";
 import { withFileLock } from "openclaw/plugin-sdk/file-lock";
-import { archiveLegacyStateSource, legacyStateFileExists } from "openclaw/plugin-sdk/runtime-doctor";
 //#region extensions/codex/src/migration/session-binding-sidecars.ts
 const LEGACY_BINDING_SUFFIX = ".codex-app-server.json";
 const CODEX_AGENT_HARNESS_ID = "codex";
@@ -23,9 +20,9 @@ const LEGACY_BINDING_LOCK_OPTIONS = {
 };
 async function collectSessionSurfaces(params) {
 	const surfaces = /* @__PURE__ */ new Map();
-	const stateRoot = await canonicalPathFromExistingAncestor(params.stateDir);
+	const stateRoot = await canonicalizePath(params.stateDir);
 	const add = async (root, storePath, agentId, scan) => {
-		const canonicalRoot = await canonicalPathFromExistingAncestor(root);
+		const canonicalRoot = await canonicalizePath(root);
 		const surface = surfaces.get(canonicalRoot) ?? {
 			root: canonicalRoot,
 			scan: false,
@@ -55,7 +52,7 @@ async function collectSessionSurfaces(params) {
 			env: params.env
 		});
 		const root = path.dirname(storePath);
-		await add(root, storePath, agentId, isPathInside(stateRoot, await canonicalPathFromExistingAncestor(root)));
+		await add(root, storePath, agentId, isPathWithin(stateRoot, await canonicalizePath(root)));
 	}
 	const legacyRoot = path.join(params.stateDir, "sessions");
 	const defaultAgentId = resolveSessionAgentIds({ config: params.config }).defaultAgentId;
@@ -66,7 +63,7 @@ async function collectLegacyBindingSources(params, options = {}) {
 	const surfaces = await collectSessionSurfaces(params);
 	const sources = /* @__PURE__ */ new Map();
 	const addSource = async (sidecarPath, surface) => {
-		const canonicalSidecar = await canonicalPathFromExistingAncestor(sidecarPath);
+		const canonicalSidecar = await canonicalizePath(sidecarPath);
 		const source = sources.get(canonicalSidecar) ?? {
 			sidecarPath: canonicalSidecar,
 			transcriptPath: sidecarPath.slice(0, -22),
@@ -77,7 +74,7 @@ async function collectLegacyBindingSources(params, options = {}) {
 		return source;
 	};
 	for (const surface of surfaces) {
-		const sidecars = surface.scan ? walkSidecars(surface.root) : iterateIndexedSidecars(surface);
+		const sidecars = surface.scan ? walkSidecars(surface.root) : iterateIndexedSidecars(surface, params);
 		for await (const sidecarPath of sidecars) {
 			const source = await addSource(sidecarPath, surface);
 			if (options.firstOnly) return {
@@ -106,42 +103,59 @@ async function readLegacySessionIndex(storePath) {
 		return { failure: `session index ${storePath} could not be read (invalid JSON)` };
 	}
 	if (!isRecord(raw)) return { failure: `session index ${storePath} has invalid entries` };
+	let normalizedEntries;
+	try {
+		normalizedEntries = listSessionEntries({
+			storePath,
+			hydrateSkillPromptRefs: false
+		});
+	} catch {
+		return { failure: `session index ${storePath} could not be normalized` };
+	}
+	const normalizedByKey = new Map(normalizedEntries.map(({ sessionKey, entry }) => [sessionKey, entry]));
 	const entries = [];
 	for (const [sessionKey, value] of Object.entries(raw)) {
 		if (!isRecord(value)) return { failure: `session index ${storePath} has invalid entries` };
 		if (value.sessionId === void 0) continue;
-		const sessionId = typeof value.sessionId === "string" ? value.sessionId.trim() : "";
+		const rawSessionId = typeof value.sessionId === "string" ? value.sessionId.trim() : "";
+		const sessionId = normalizedByKey.get(sessionKey)?.sessionId?.trim() ?? "";
 		const sessionFile = value.sessionFile;
 		const lifecycleRevision = value.lifecycleRevision;
 		const agentHarnessId = value.agentHarnessId;
-		if (!isSafeLegacySessionId(value.sessionId) || sessionFile !== void 0 && typeof sessionFile !== "string" || lifecycleRevision !== void 0 && typeof lifecycleRevision !== "string" || agentHarnessId !== void 0 && typeof agentHarnessId !== "string") return { failure: `session index ${storePath} has invalid entries` };
+		if (!sessionId || sessionId !== rawSessionId || sessionFile !== void 0 && typeof sessionFile !== "string" || lifecycleRevision !== void 0 && typeof lifecycleRevision !== "string" || agentHarnessId !== void 0 && typeof agentHarnessId !== "string") return { failure: `session index ${storePath} has invalid entries` };
 		entries.push({
 			sessionKey,
 			entry: {
 				sessionId,
 				...typeof sessionFile === "string" ? { sessionFile } : {},
 				...typeof lifecycleRevision === "string" ? { lifecycleRevision } : {},
-				...typeof agentHarnessId === "string" ? { agentHarnessId } : {},
-				...typeof value.updatedAt === "number" && Number.isFinite(value.updatedAt) && value.updatedAt >= 0 ? { updatedAt: value.updatedAt } : {}
+				...typeof agentHarnessId === "string" ? { agentHarnessId } : {}
 			}
 		});
 	}
 	return { entries };
 }
-async function* iterateIndexedSidecars(surface) {
+async function* iterateIndexedSidecars(surface, params) {
 	for (const storePath of surface.storePaths) {
 		const index = await readLegacySessionIndex(storePath);
 		if ("failure" in index) continue;
-		for (const { entry } of index.entries) {
-			if ((entry.sessionFile?.trim() ?? "").startsWith("sqlite:")) continue;
+		for (const { sessionKey, entry } of index.entries) {
+			const agentId = resolveLegacyBindingOwnerAgentId({
+				sessionKey,
+				config: params.config,
+				storeAgentIds: surface.agentIds
+			});
 			let transcriptPath;
 			try {
-				transcriptPath = await resolveLegacySessionFileLocator(path.dirname(storePath), entry, entry.sessionId);
+				transcriptPath = resolveSessionFilePath(entry.sessionId, entry, {
+					sessionsDir: path.dirname(storePath),
+					agentId
+				});
 			} catch {
 				continue;
 			}
 			const sidecarPath = `${transcriptPath}${LEGACY_BINDING_SUFFIX}`;
-			if (await legacyStateFileExists(sidecarPath)) yield sidecarPath;
+			if (await isRegularFile(sidecarPath)) yield sidecarPath;
 		}
 	}
 }
@@ -164,7 +178,7 @@ async function* walkSidecars(root) {
 	}
 }
 async function collectBindingOwners(sources, surfaces, params) {
-	const sourcePaths = new Set(await Promise.all(sources.map((source) => canonicalPathFromExistingAncestor(source.transcriptPath))));
+	const sourcePaths = new Set(await Promise.all(sources.map((source) => canonicalizePath(source.transcriptPath))));
 	const owners = /* @__PURE__ */ new Map();
 	const storePaths = new Set(surfaces.flatMap((surface) => [...surface.storePaths]));
 	const storeAgentIds = /* @__PURE__ */ new Map();
@@ -175,7 +189,7 @@ async function collectBindingOwners(sources, surfaces, params) {
 	}
 	const failures = [];
 	for (const storePath of storePaths) {
-		const canonicalStorePath = await canonicalPathFromExistingAncestor(storePath);
+		const canonicalStorePath = await canonicalizePath(storePath);
 		const index = await readLegacySessionIndex(storePath);
 		if ("failure" in index) {
 			failures.push(index.failure);
@@ -189,34 +203,35 @@ async function collectBindingOwners(sources, surfaces, params) {
 				config: params.config,
 				storeAgentIds: storeAgentIds.get(storePath)
 			});
-			let legacyTranscriptPath;
-			let canonicalLegacyTranscriptPath;
+			let effectiveTranscriptPath;
 			try {
-				legacyTranscriptPath = await resolveLegacySessionFileLocator(sessionsDir, entry, sessionId);
-				canonicalLegacyTranscriptPath = await canonicalPathFromExistingAncestor(legacyTranscriptPath);
+				effectiveTranscriptPath = resolveSessionFilePath(sessionId, entry, {
+					sessionsDir,
+					agentId
+				});
 			} catch {
 				failures.push(`session index ${storePath} has an invalid locator for ${sessionKey}`);
 				continue;
 			}
-			if (!sourcePaths.has(canonicalLegacyTranscriptPath)) continue;
+			const transcriptPath = await canonicalizePath(effectiveTranscriptPath);
+			if (!sourcePaths.has(transcriptPath)) continue;
 			const owner = {
 				agentId,
 				sessionId,
 				sessionKey,
 				storePath,
-				transcriptPath: legacyTranscriptPath,
+				transcriptPath: effectiveTranscriptPath,
 				...entry.lifecycleRevision ? { lifecycleRevision: entry.lifecycleRevision } : {},
-				...entry.agentHarnessId?.trim() ? { agentHarnessId: entry.agentHarnessId.trim() } : {},
-				...entry.updatedAt !== void 0 ? { updatedAt: entry.updatedAt } : {}
+				...entry.agentHarnessId?.trim() ? { agentHarnessId: entry.agentHarnessId.trim() } : {}
 			};
-			const candidates = owners.get(canonicalLegacyTranscriptPath) ?? /* @__PURE__ */ new Map();
+			const candidates = owners.get(transcriptPath) ?? /* @__PURE__ */ new Map();
 			const ownerKey = `${agentId}\0${sessionId}\0${sessionKey}\0${canonicalStorePath}`;
 			const configuredStorePath = resolveStorePath(params.config.session?.store, {
 				agentId,
 				env: params.env
 			});
 			if (!candidates.has(ownerKey) || storePath === configuredStorePath) candidates.set(ownerKey, owner);
-			owners.set(canonicalLegacyTranscriptPath, candidates);
+			owners.set(transcriptPath, candidates);
 		}
 	}
 	return {
@@ -224,16 +239,6 @@ async function collectBindingOwners(sources, surfaces, params) {
 		failures
 	};
 }
-async function resolveLegacySessionFileLocator(sessionsDir, entry, sessionId) {
-	const base = path.resolve(sessionsDir);
-	const fallback = path.join(base, `${sessionId}.jsonl`);
-	const sessionFile = entry.sessionFile?.trim();
-	if (!sessionFile) return fallback;
-	const candidate = path.resolve(base, sessionFile);
-	const [canonicalBase, canonicalCandidate] = await Promise.all([canonicalPathFromExistingAncestor(base), canonicalPathFromExistingAncestor(candidate)]);
-	if (!isPathInside(canonicalBase, canonicalCandidate)) throw new Error("legacy session file locator escapes its session directory");
-	return candidate;
-}
 function resolveLegacyBindingOwnerAgentId(params) {
 	if (params.sessionKey.trim().toLowerCase().startsWith("agent:")) return resolveSessionAgentIds({
 		sessionKey: params.sessionKey,
@@ -276,7 +281,7 @@ async function migrateSource(source, candidates, params, store) {
 		return await withFileLock(source.sidecarPath, LEGACY_BINDING_LOCK_OPTIONS, async () => {
 			const [contents, stat] = await Promise.all([fs.readFile(source.sidecarPath, "utf8"), fs.stat(source.sidecarPath)]);
 			const raw = JSON.parse(contents);
-			const [{ bindingStoreKey, createStoredCodexAppServerBinding, normalizeStoredCodexAppServerBindingFingerprints, readStoredCodexAppServerBinding }, { legacyCodexConversationBindingId }] = await Promise.all([import("./session-binding-BXpo9ymA.js").then((n) => n.f), import("./conversation-binding-data-BHRpYbX3.js").then((n) => n.t)]);
+			const [{ bindingStoreKey, createStoredCodexAppServerBinding, normalizeStoredCodexAppServerBindingFingerprints, readStoredCodexAppServerBinding }, { legacyCodexConversationBindingId }] = await Promise.all([import("./.setup/session-binding-DuihlMJc.mjs").then((n) => n.c), import("./.setup/conversation-binding-data-CrRxtDBu.mjs").then((n) => n.t)]);
 			const agentId = owner?.agentId ?? (source.agentIds.size === 1 ? [...source.agentIds][0] : void 0);
 			const baseStored = createStoredCodexAppServerBinding(raw, {
 				now: stat.mtime.toISOString(),
@@ -354,7 +359,7 @@ async function migrateSource(source, candidates, params, store) {
 				if (!hasExpected(await store.lookup(entry.key), entry.value)) return retain(`canonical plugin state changed at ${entry.key}`);
 			}
 			if (owner) {
-				const ownershipWarning = await recordSessionOwner(owner, params.env);
+				const ownershipWarning = await recordSessionOwner(owner);
 				if (ownershipWarning) {
 					if (sessionEntry?.value.state === "active") {
 						const update = store.update;
@@ -372,18 +377,11 @@ async function migrateSource(source, candidates, params, store) {
 						});
 						if (hasExpected(await store.lookup(sessionEntry.key), sessionEntry.value)) return retain(`${ownershipWarning}; its stale session binding could not be retired`);
 					}
-					return retainNotice(ownershipWarning);
+					return retain(ownershipWarning);
 				}
 				for (const entry of entries) if (!hasExpected(await store.lookup(entry.key), entry.value)) return retain(`canonical plugin state changed at ${entry.key}`);
 			}
-			const archiveWarnings = [];
-			await archiveLegacyStateSource({
-				filePath: source.sidecarPath,
-				label: "Codex app-server binding",
-				changes: [],
-				warnings: archiveWarnings
-			});
-			if (archiveWarnings.length > 0 && await pathExists(source.sidecarPath)) return retain(archiveWarnings.join("; "));
+			await archiveBindingSidecar(source.sidecarPath);
 			return {
 				archived: true,
 				importedKeys
@@ -397,39 +395,18 @@ async function migrateSource(source, candidates, params, store) {
 		return retain(`migration or archiving failed: ${String(error)}`);
 	}
 }
-async function recordSessionOwner(owner, env) {
-	const currentIndex = await readLegacySessionIndex(owner.storePath);
-	if ("failure" in currentIndex) return "its legacy session owner could not be revalidated";
-	const currentOwner = currentIndex.entries.find(({ sessionKey }) => sessionKey === owner.sessionKey);
-	if (!currentOwner || currentOwner.entry.sessionId !== owner.sessionId) return "its session owner changed before Codex ownership could be recorded";
-	let currentTranscriptPath;
-	try {
-		currentTranscriptPath = await resolveLegacySessionFileLocator(path.dirname(owner.storePath), currentOwner.entry, currentOwner.entry.sessionId);
-	} catch {
-		return "its session owner changed before Codex ownership could be recorded";
-	}
-	if (await canonicalPathFromExistingAncestor(currentTranscriptPath) !== await canonicalPathFromExistingAncestor(owner.transcriptPath) || currentOwner.entry.lifecycleRevision !== owner.lifecycleRevision) return "its session owner changed before Codex ownership could be recorded";
-	const legacyHarnessId = currentOwner.entry.agentHarnessId?.trim();
-	if (currentOwner.entry.agentHarnessId !== void 0 && !legacyHarnessId) return "its session owner changed before Codex ownership could be recorded";
-	if (legacyHarnessId && legacyHarnessId !== CODEX_AGENT_HARNESS_ID) return `its session is owned by agent harness ${legacyHarnessId}`;
+async function recordSessionOwner(owner) {
 	let observedForeignHarness;
-	const updated = await patchSessionEntry({
-		agentId: owner.agentId,
-		env,
-		fallbackEntry: {
-			sessionId: owner.sessionId,
-			updatedAt: currentOwner.entry.updatedAt ?? owner.updatedAt ?? 0,
-			...owner.lifecycleRevision ? { lifecycleRevision: owner.lifecycleRevision } : {}
-		},
-		preserveActivity: true,
-		requireWriteSuccess: true,
-		skipMaintenance: true,
+	const updated = await updateSessionStoreEntry({
 		storePath: owner.storePath,
 		sessionKey: owner.sessionKey,
+		skipMaintenance: true,
+		requireWriteSuccess: true,
 		update: (entry) => {
-			if (entry.sessionId.trim() !== owner.sessionId || entry.lifecycleRevision !== owner.lifecycleRevision) return null;
+			const transcriptPath = resolveOwnerTranscriptPath(owner, entry);
+			if (entry.sessionId.trim() !== owner.sessionId || transcriptPath !== owner.transcriptPath || entry.lifecycleRevision !== owner.lifecycleRevision) return null;
 			const harnessId = typeof entry.agentHarnessId === "string" ? entry.agentHarnessId.trim() : void 0;
-			if (entry.agentHarnessId !== void 0 && !harnessId) return null;
+			if (entry.agentHarnessId !== void 0 && harnessId === void 0) return null;
 			if (harnessId && harnessId !== CODEX_AGENT_HARNESS_ID) {
 				observedForeignHarness = harnessId;
 				return null;
@@ -438,10 +415,21 @@ async function recordSessionOwner(owner, env) {
 		}
 	});
 	if (!updated) return observedForeignHarness ? `its session is owned by agent harness ${observedForeignHarness}` : "its session owner changed before Codex ownership could be recorded";
-	if (updated.sessionId.trim() !== owner.sessionId || updated.lifecycleRevision !== owner.lifecycleRevision) return "its session owner changed before Codex ownership could be recorded";
+	const transcriptPath = resolveOwnerTranscriptPath(owner, updated);
+	if (updated.sessionId.trim() !== owner.sessionId || transcriptPath !== owner.transcriptPath || updated.lifecycleRevision !== owner.lifecycleRevision) return "its session owner changed before Codex ownership could be recorded";
 	const harnessId = updated.agentHarnessId?.trim();
 	return harnessId === CODEX_AGENT_HARNESS_ID ? void 0 : harnessId ? `its session is owned by agent harness ${harnessId}` : "Codex harness ownership could not be recorded on its session";
 }
+function resolveOwnerTranscriptPath(owner, entry) {
+	try {
+		return resolveSessionFilePath(entry.sessionId, entry, {
+			sessionsDir: path.dirname(owner.storePath),
+			agentId: owner.agentId
+		});
+	} catch {
+		return;
+	}
+}
 async function readDirectoryEntries(directory) {
 	try {
 		return await fs.readdir(directory, { withFileTypes: true });
@@ -455,10 +443,53 @@ async function readDirectoryEntries(directory) {
 		throw error;
 	}
 }
-function isSafeLegacySessionId(value) {
-	if (typeof value !== "string") return false;
-	const trimmed = value.trim();
-	return trimmed.length > 0 && trimmed.length <= 255 && /^[A-Za-z0-9][A-Za-z0-9._:@-]*$/.test(trimmed);
+async function isRegularFile(filePath) {
+	try {
+		return (await fs.stat(filePath)).isFile();
+	} catch {
+		return false;
+	}
+}
+function isRecord(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function isPathWithin(root, candidate) {
+	const relative = path.relative(root, candidate);
+	return relative === "" || relative !== ".." && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative);
+}
+async function canonicalizePath(filePath) {
+	try {
+		return await fs.realpath(filePath);
+	} catch {
+		return path.resolve(filePath);
+	}
+}
+async function pathExists(filePath) {
+	try {
+		await fs.access(filePath);
+		return true;
+	} catch {
+		return false;
+	}
+}
+async function firstFreeArchivePath(sourcePath) {
+	for (let index = 2;; index++) {
+		const candidate = `${sourcePath}.migrated.${index}`;
+		if (!await pathExists(candidate)) return candidate;
+	}
+}
+async function archiveBindingSidecar(sourcePath) {
+	const archivePath = `${sourcePath}.migrated`;
+	if (await pathExists(archivePath)) {
+		const [sourceBytes, archiveBytes] = await Promise.all([fs.readFile(sourcePath), fs.readFile(archivePath)]);
+		if (sourceBytes.equals(archiveBytes)) {
+			await fs.rm(sourcePath, { force: true });
+			return;
+		}
+		await fs.rename(sourcePath, await firstFreeArchivePath(sourcePath));
+		return;
+	}
+	await fs.rename(sourcePath, archivePath);
 }
 const stateMigrations = [{
 	id: "codex-app-server-sidecars-to-plugin-state",
@@ -492,7 +523,7 @@ const stateMigrations = [{
 		let migrated = 0;
 		let partialImports = 0;
 		for (const source of sources) {
-			const result = await migrateSource(source, ownerCollection.owners.get(await canonicalPathFromExistingAncestor(source.transcriptPath)) ?? [], params, store);
+			const result = await migrateSource(source, ownerCollection.owners.get(await canonicalizePath(source.transcriptPath)) ?? [], params, store);
 			if (result.warning) warnings.push(result.warning);
 			if (result.notice) notices.push(result.notice);
 			if (result.archived) migrated++;
@@ -500,10 +531,13 @@ const stateMigrations = [{
 		}
 		if (migrated > 0) changes.push(`Migrated ${migrated} Codex app-server binding sidecar(s) to plugin state and archived the legacy sources`);
 		if (partialImports > 0) changes.push(`Migrated ${partialImports} safe Codex app-server binding row(s) to plugin state; retained legacy sidecars needing review`);
-		return {
+		return notices.length > 0 ? {
 			changes,
 			warnings,
-			...notices.length > 0 ? { notices } : {}
+			notices
+		} : {
+			changes,
+			warnings
 		};
 	}
 }];

package/dist/harness.js

@@ -1,6 +1,5 @@
 //#region extensions/codex/harness.ts
 const DEFAULT_CODEX_HARNESS_PROVIDER_IDS = /* @__PURE__ */ new Set(["codex", "openai"]);
-const SHARED_CODEX_APP_SERVER_CLIENT_DISPOSER = Symbol.for("openclaw.codexAppServerClientDisposer");
 const CODEX_APP_SERVER_CONTEXT_ENGINE_HOST_CAPABILITIES = [
 	"bootstrap",
 	"assemble-before-prompt",
@@ -10,108 +9,38 @@ const CODEX_APP_SERVER_CONTEXT_ENGINE_HOST_CAPABILITIES = [
 	"runtime-llm-complete",
 	"thread-bootstrap-projection"
 ];
-async function disposeSharedCodexAppServerClients() {
-	const dispose = globalThis[SHARED_CODEX_APP_SERVER_CLIENT_DISPOSER];
-	await dispose?.();
-}
 /**
 * Creates the Codex app-server harness used for attempts, side questions,
 * compaction, reset, and disposal.
 */
 function createCodexAppServerAgentHarness(options) {
-	const harnessRuntimeId = options?.id ?? "codex";
-	const normalizedHarnessRuntimeId = harnessRuntimeId.trim().toLowerCase();
 	const providerIds = new Set([...options?.providerIds ?? DEFAULT_CODEX_HARNESS_PROVIDER_IDS].map((id) => id.trim().toLowerCase()));
-	const sessionCatalogControl = options.sessionCatalogControl;
-	const sessionRuntime = options.runtime;
 	return {
-		id: harnessRuntimeId,
+		id: options?.id ?? "codex",
 		label: options?.label ?? "Codex agent harness",
-		autoSelection: { providerIds: [...providerIds] },
-		delegatedExecutionPluginIds: ["voice-call"],
 		contextEngineHostCapabilities: CODEX_APP_SERVER_CONTEXT_ENGINE_HOST_CAPABILITIES,
-		deliveryDefaults: { visibleReplies: "message_tool" },
-		authBootstrap: "harness",
-		...sessionCatalogControl && sessionRuntime ? { sessionFork: {
-			upstreamKinds: ["codex-app-server"],
-			fork: async (params) => {
-				const { forkCodexUpstreamSession } = await import("./upstream-session-fork-Dy4Xvuoj.js");
-				return await forkCodexUpstreamSession(params, {
-					bindingStore: options.bindingStore,
-					control: sessionCatalogControl,
-					harnessRuntimeId,
-					resolveConfig: options.resolveConfig,
-					runtime: sessionRuntime
-				});
-			}
-		} } : {},
-		authBinding: { fingerprint: async (params) => {
-			const { fingerprintCodexAppServerAuthBinding } = await import("./auth-binding-B4FfbcCg.js").then((n) => n.t);
-			return fingerprintCodexAppServerAuthBinding(params);
-		} },
-		runtimeArtifact: { validate: async (binding) => {
-			const { validateCodexAppServerRuntimeArtifact } = await import("./runtime-artifact-CmtG_t1L.js");
-			return validateCodexAppServerRuntimeArtifact(binding);
-		} },
-		fetchUsageSnapshot: async (ctx) => {
-			const { fetchCodexAppServerUsageSnapshot } = await import("./usage-CQ6GhD5-.js");
-			return await fetchCodexAppServerUsageSnapshot(ctx, { pluginConfig: options?.resolvePluginConfig?.() ?? options?.pluginConfig });
-		},
-		loadMcpToolCatalog: async (params) => {
-			const { loadCodexEffectiveMcpCatalog } = await import("./effective-mcp-catalog-Bbd98Inw.js");
-			return await loadCodexEffectiveMcpCatalog(params, { bindingStore: options.bindingStore });
-		},
+		deliveryDefaults: { sourceVisibleReplies: "message_tool" },
 		supports: (ctx) => {
 			const provider = ctx.provider.trim().toLowerCase();
-			if (!providerIds.has(provider)) return {
-				supported: false,
-				reason: `provider is not one of: ${[...providerIds].toSorted().join(", ")}`
-			};
-			if (ctx.modelProvider?.requestTransportOverrides === "present") return {
-				supported: false,
-				reason: "Codex cannot reproduce authored request transport overrides"
-			};
-			const preparedAuth = ctx.modelProvider?.preparedAuth;
-			const runtimePolicy = ctx.modelProvider?.runtimePolicy;
-			if (runtimePolicy) {
-				if (!runtimePolicy.compatibleIds.some((id) => id.trim().toLowerCase() === normalizedHarnessRuntimeId)) return {
-					supported: false,
-					reason: "Codex cannot reproduce the prepared provider route"
-				};
-			} else if (ctx.modelProvider && provider !== "codex") return {
-				supported: false,
-				reason: "provider route compatibility with Codex is not declared"
-			};
-			if (preparedAuth?.requirement === "subscription") {
-				if (!(preparedAuth.source === "profile" && (preparedAuth.mode === "oauth" || preparedAuth.mode === "token"))) return {
-					supported: false,
-					reason: "Codex subscription auth requires a prepared OAuth or token profile"
-				};
-			} else if (preparedAuth?.requirement === "api-key") {
-				if (!(preparedAuth.source !== "none" && preparedAuth.source !== "harness" && (preparedAuth.mode === "api-key" || preparedAuth.mode === "api_key"))) return {
-					supported: false,
-					reason: "Codex Platform auth requires a prepared API key"
-				};
-			}
-			return {
+			if (providerIds.has(provider)) return {
 				supported: true,
 				priority: 100
 			};
+			return {
+				supported: false,
+				reason: `provider is not one of: ${[...providerIds].toSorted().join(", ")}`
+			};
 		},
 		runAttempt: async (params) => {
-			const { runCodexAppServerAttempt } = await import("./run-attempt-CY9WlDLc.js");
+			const { runCodexAppServerAttempt } = await import("./.setup/run-attempt-C7xEKFVB.mjs");
 			return runCodexAppServerAttempt(params, {
 				bindingStore: options.bindingStore,
 				pluginConfig: options?.resolvePluginConfig?.() ?? options?.pluginConfig,
 				nativeHookRelay: { enabled: true }
 			});
 		},
-		finalizeSettledTurn: async (params) => {
-			const { runCodexSettledTurnFinalization } = await import("./settled-turn-finalizer-CXY2Z9dT.js");
-			return runCodexSettledTurnFinalization(params, { pluginConfig: options?.resolvePluginConfig?.() ?? options?.pluginConfig });
-		},
 		runSideQuestion: async (params) => {
-			const { runCodexAppServerSideQuestion } = await import("./side-question-_ulBk1AL.js");
+			const { runCodexAppServerSideQuestion } = await import("./.setup/side-question-Cv6JXWCS.mjs");
 			return runCodexAppServerSideQuestion(params, {
 				bindingStore: options.bindingStore,
 				pluginConfig: options?.resolvePluginConfig?.() ?? options?.pluginConfig,
@@ -119,14 +48,14 @@ function createCodexAppServerAgentHarness(options) {
 			});
 		},
 		compact: async (params) => {
-			const { maybeCompactCodexAppServerSession } = await import("./compact-D_uvHurS.js");
+			const { maybeCompactCodexAppServerSession } = await import("./.setup/compact-BNgh7I4t.mjs");
 			return maybeCompactCodexAppServerSession(params, {
 				bindingStore: options.bindingStore,
 				pluginConfig: options?.resolvePluginConfig?.() ?? options?.pluginConfig
 			});
 		},
 		compactAfterContextEngine: async (params) => {
-			const { maybeCompactCodexAppServerSession } = await import("./compact-D_uvHurS.js");
+			const { maybeCompactCodexAppServerSession } = await import("./.setup/compact-BNgh7I4t.mjs");
 			return maybeCompactCodexAppServerSession(params, {
 				bindingStore: options.bindingStore,
 				pluginConfig: options?.resolvePluginConfig?.() ?? options?.pluginConfig,
@@ -135,25 +64,27 @@ function createCodexAppServerAgentHarness(options) {
 		},
 		reset: async (params) => {
 			if (params.sessionId) {
-				const { reclaimCurrentCodexSessionGeneration, sessionBindingIdentity } = await import("./session-binding-BXpo9ymA.js").then((n) => n.f);
+				const { reclaimCurrentCodexSessionGeneration, sessionBindingIdentity } = await import("./.setup/session-binding-DuihlMJc.mjs").then((n) => n.c);
 				const identity = sessionBindingIdentity({
 					agentId: params.agentId,
 					sessionId: params.sessionId,
 					sessionKey: params.sessionKey
 				});
-				const resetGeneration = params.reason === "deleted" ? options.bindingStore.retireSessionGeneration.bind(options.bindingStore) : options.bindingStore.resetSessionGeneration.bind(options.bindingStore);
-				let reset = await resetGeneration(identity);
-				if (reset === "conflict") {
+				let retired = await options.bindingStore.retireSessionGeneration(identity);
+				if (retired === "conflict") {
 					if (await reclaimCurrentCodexSessionGeneration({
 						bindingStore: options.bindingStore,
 						identity,
 						config: options.resolveConfig?.()
-					})) reset = await resetGeneration(identity);
+					})) retired = await options.bindingStore.retireSessionGeneration(identity);
 				}
-				if (reset === "conflict") throw new Error(`Codex binding generation changed before session ${params.sessionId} could reset`);
+				if (retired === "conflict") throw new Error(`Codex binding generation changed before session ${params.sessionId} could reset`);
 			}
 		},
-		dispose: disposeSharedCodexAppServerClients
+		dispose: async () => {
+			const { clearSharedCodexAppServerClientAndWait } = await import("./.setup/shared-client-B2KmLPRw.mjs").then((n) => n.c);
+			await clearSharedCodexAppServerClientAndWait();
+		}
 	};
 }
 //#endregion