@openclaw/codex 2026.7.2-beta.7 → 2026.8.1-beta.2

package/dist/{session-catalog-DyOgR4WH.js → session-catalog-xwNi_SDM.js}

@@ -1,30 +1,31 @@
-import { B as CODEX_INTERACTIVE_CUSTOM_THREAD_SOURCES, D as resolveCodexAppServerClientInstanceId, V as CODEX_INTERACTIVE_THREAD_SOURCE_KINDS, W as isJsonObject, a as getLeasedSharedCodexAppServerClient, g as withTimeout, l as releaseLeasedSharedCodexAppServerClient, v as CodexAppServerRpcError } from "./shared-client-DTbvH-XV.js";
-import { c as reclaimCurrentCodexSessionGeneration, d as sessionBindingIdentity, g as resolveCodexAppServerRuntimeOptions, y as resolveCodexSupervisionAppServerRuntimeOptions } from "./session-binding-BXpo9ymA.js";
-import { m as assertCodexThreadForkParams, r as importCodexThreadHistoryToTranscript } from "./transcript-mirror-DzsdNCf5.js";
-import { n as listCodexAppServerModels } from "./models-BBMKU4jA.js";
-import { t as buildCodexAppServerConnectionFingerprint } from "./plugin-app-cache-key-DztPafOA.js";
-import { n as describeControlFailure, t as CODEX_CONTROL_METHODS } from "./capabilities-BFDTVYr4.js";
-import { r as formatCodexDisplayText } from "./command-formatters-C336eRVS.js";
-import { n as createCodexCliNodeConversationBindingData } from "./conversation-binding-data-BHRpYbX3.js";
-import { n as requestCodexAppServerClientJson, r as requestCodexAppServerJson } from "./request-qKh331yu.js";
-import { i as createImportedCodexSession, n as codexUpstreamBaseline, r as codexUpstreamContinueResult, t as codexLastTerminalTurnId } from "./session-upstream-marker-B6U7tLw5.js";
+import { c as reclaimCurrentCodexSessionGeneration, d as sessionBindingIdentity, g as resolveCodexAppServerRuntimeOptions, y as resolveCodexSupervisionAppServerRuntimeOptions } from "./session-binding-DPxIvMgE.js";
+import { R as resolveCodexAppServerClientInstanceId, _ as withTimeout, a as getLeasedSharedCodexAppServerClient, at as CODEX_INTERACTIVE_THREAD_SOURCE_KINDS, ct as isJsonObject, dt as resolveCodexAppServerLocalHomeDir, it as CODEX_INTERACTIVE_CUSTOM_THREAD_SOURCES, l as releaseLeasedSharedCodexAppServerClient, z as CodexAppServerRpcError } from "./shared-client-kIBbGjk4.js";
+import { n as assertCodexThreadForkParams } from "./protocol-validators-B4F7L8Rf.js";
+import { n as listCodexAppServerModels } from "./models-BFlpn1Ex.js";
+import { t as buildCodexAppServerConnectionFingerprint } from "./plugin-app-cache-key-C3H2CVp6.js";
+import { r as importCodexThreadHistoryToTranscript } from "./transcript-mirror-B9gGgnJS.js";
+import { n as describeControlFailure, t as CODEX_CONTROL_METHODS } from "./capabilities-CybGI1oz.js";
+import { r as formatCodexDisplayText } from "./command-formatters-B1AEz8ZA.js";
+import { n as createCodexCliNodeConversationBindingData } from "./conversation-binding-data-CW2GuupV.js";
+import { i as withCodexAppServerJsonClient, n as requestCodexAppServerClientJson, r as requestCodexAppServerJson } from "./request-BRl5_UfX.js";
+import { i as createImportedCodexSession, n as codexUpstreamBaseline, r as codexUpstreamContinueResult, t as codexLastTerminalTurnId } from "./session-upstream-marker-CrIFX06J.js";
+import { asFiniteNumber, isRecord, normalizeBoundedOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
 import fs from "node:fs/promises";
 import path from "node:path";
 import { timestampMsToIsoString } from "openclaw/plugin-sdk/number-runtime";
 import { resolvePreferredOpenClawTmpDir } from "openclaw/plugin-sdk/temp-path";
 import { createHash } from "node:crypto";
-import { listAgentIds, resolveAllowedModelRef, resolveDefaultAgentDir, resolveDefaultAgentId, resolveDefaultModelForAgent } from "openclaw/plugin-sdk/agent-runtime";
 import os from "node:os";
+import { listAgentIds, resolveAllowedModelRef, resolveDefaultAgentDir, resolveDefaultAgentId, resolveDefaultModelForAgent } from "openclaw/plugin-sdk/agent-runtime";
 import { parseAgentSessionKey } from "openclaw/plugin-sdk/routing";
-import { isRecord } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { materializeWindowsSpawnProgram, resolveWindowsSpawnProgram } from "openclaw/plugin-sdk/windows-spawn";
 import { resolveStorePath } from "openclaw/plugin-sdk/session-store-runtime";
 import { spawn } from "node:child_process";
 import { truncateUtf16Safe } from "openclaw/plugin-sdk/text-utility-runtime";
 import { expectDefined } from "openclaw/plugin-sdk/expect-runtime";
+import { sanitizeTerminalText } from "openclaw/plugin-sdk/text-chunking";
 import process$1 from "node:process";
 import { listSessionCatalogEntries } from "openclaw/plugin-sdk/session-catalog";
-import { sanitizeTerminalText } from "openclaw/plugin-sdk/text-chunking";
 import { decodeNodePtyResumeParams, resolveNodeHostExecutable, runNodePtyCommand } from "openclaw/plugin-sdk/node-host";
 //#region extensions/codex/src/jsonl-lines.ts
 const JSONL_STREAM_THRESHOLD_BYTES = 4 * 1024 * 1024;
@@ -578,61 +579,6 @@ function formatNodeLabel(node) {
 	].filter(Boolean).join(" / ") || "node";
 }
 //#endregion
-//#region extensions/codex/src/app-server/thread-archive-guard.ts
-const DESCENDANT_PAGE_LIMIT = 100;
-const MAX_DESCENDANT_PAGES = 100;
-const MAX_THREAD_ID_LENGTH = 256;
-const MAX_CURSOR_LENGTH$1 = 4096;
-function readBoundedId(value) {
-	if (typeof value !== "string") return;
-	const normalized = value.trim();
-	return normalized && normalized.length <= MAX_THREAD_ID_LENGTH ? normalized : void 0;
-}
-function readNextCursor(value) {
-	if (value === void 0 || value === null) return;
-	if (typeof value !== "string" || !value.trim() || value.length > MAX_CURSOR_LENGTH$1) throw new Error("Codex app-server returned an invalid descendant-list cursor");
-	return value;
-}
-/**
-* Native archive includes the spawned subtree. Enumerate that same subtree first so an
-* OpenClaw-owned descendant cannot be stopped as an undocumented side effect.
-*/
-async function assertCodexArchiveDescendantsUnowned(params) {
-	const ancestorThreadId = readBoundedId(params.threadId);
-	if (!ancestorThreadId) throw new Error("cannot verify Codex archive descendants for an invalid thread id");
-	const seenCursors = /* @__PURE__ */ new Set();
-	const seenThreadIds = /* @__PURE__ */ new Set([ancestorThreadId]);
-	let cursor;
-	for (let pageIndex = 0; pageIndex < MAX_DESCENDANT_PAGES; pageIndex += 1) {
-		const response = await params.listPage({
-			ancestorThreadId,
-			archived: false,
-			limit: DESCENDANT_PAGE_LIMIT,
-			sortKey: "created_at",
-			sortDirection: "desc",
-			useStateDbOnly: true,
-			...cursor ? { cursor } : {}
-		});
-		if (!isJsonObject(response) || !Array.isArray(response.data)) throw new Error("Codex app-server returned an invalid descendant-list response");
-		if (response.data.length > DESCENDANT_PAGE_LIMIT) throw new Error("Codex app-server exceeded the descendant-list page limit");
-		for (const value of response.data) {
-			if (!isJsonObject(value)) throw new Error("Codex app-server returned an invalid descendant thread");
-			const descendantThreadId = readBoundedId(value.id);
-			if (!descendantThreadId) throw new Error("Codex app-server returned a descendant without a valid thread id");
-			if (seenThreadIds.has(descendantThreadId)) throw new Error("Codex app-server returned a cyclic descendant thread list");
-			seenThreadIds.add(descendantThreadId);
-			await params.assertDescendantIdle(descendantThreadId);
-			if (await params.bindingStore.hasOtherThreadOwner(descendantThreadId)) throw new Error("cannot archive a Codex thread while a spawned descendant is owned by an OpenClaw session");
-		}
-		const nextCursor = readNextCursor(response.nextCursor);
-		if (!nextCursor) return;
-		if (seenCursors.has(nextCursor)) throw new Error("Codex app-server returned a repeated descendant-list cursor");
-		seenCursors.add(nextCursor);
-		cursor = nextCursor;
-	}
-	throw new Error("Codex descendant enumeration exceeded its safety limit");
-}
-//#endregion
 //#region extensions/codex/src/command-rpc.ts
 function requestOptions(pluginConfig, limit, config, agentDir) {
 	const runtime = resolveCodexAppServerRuntimeOptions({ pluginConfig });
@@ -645,10 +591,8 @@ function requestOptions(pluginConfig, limit, config, agentDir) {
 	};
 }
 async function codexControlRequest(pluginConfig, method, requestParams, options = {}) {
-	const runtime = resolveCodexAppServerRuntimeOptions({ pluginConfig });
-	return await requestCodexAppServerJson({
-		method,
-		requestParams,
+	const runtime = options.startOptions ? resolveCodexSupervisionAppServerRuntimeOptions({ pluginConfig }) : resolveCodexAppServerRuntimeOptions({ pluginConfig });
+	const controlRequestOptions = {
 		timeoutMs: options.timeoutMs ?? runtime.requestTimeoutMs,
 		startOptions: options.startOptions ?? runtime.start,
 		config: options.config,
@@ -657,6 +601,19 @@ async function codexControlRequest(pluginConfig, method, requestParams, options
 		authProfileId: options.authProfileId,
 		agentDir: options.agentDir,
 		isolated: options.isolated
+	};
+	if (options.onResponse) return await withCodexAppServerJsonClient(controlRequestOptions, async (request, client) => {
+		const response = await request({
+			method,
+			requestParams
+		});
+		await options.onResponse(response, client);
+		return response;
+	});
+	return await requestCodexAppServerJson({
+		method,
+		requestParams,
+		...controlRequestOptions
 	});
 }
 async function safeCodexControlRequest(pluginConfig, method, requestParams, options = {}) {
@@ -707,6 +664,56 @@ async function safeValue(read) {
 	}
 }
 //#endregion
+//#region extensions/codex/src/app-server/thread-archive-guard.ts
+const DESCENDANT_PAGE_LIMIT = 100;
+const MAX_DESCENDANT_PAGES = 100;
+const MAX_THREAD_ID_LENGTH = 256;
+const MAX_CURSOR_LENGTH$1 = 4096;
+function readNextCursor(value) {
+	if (value === void 0 || value === null) return;
+	if (typeof value !== "string" || !value.trim() || value.length > MAX_CURSOR_LENGTH$1) throw new Error("Codex app-server returned an invalid descendant-list cursor");
+	return value;
+}
+/**
+* Native archive includes the spawned subtree. Enumerate that same subtree first so an
+* OpenClaw-owned descendant cannot be stopped as an undocumented side effect.
+*/
+async function assertCodexArchiveDescendantsUnowned(params) {
+	const ancestorThreadId = normalizeBoundedOptionalString(params.threadId, MAX_THREAD_ID_LENGTH);
+	if (!ancestorThreadId) throw new Error("cannot verify Codex archive descendants for an invalid thread id");
+	const seenCursors = /* @__PURE__ */ new Set();
+	const seenThreadIds = /* @__PURE__ */ new Set([ancestorThreadId]);
+	let cursor;
+	for (let pageIndex = 0; pageIndex < MAX_DESCENDANT_PAGES; pageIndex += 1) {
+		const response = await params.listPage({
+			ancestorThreadId,
+			archived: false,
+			limit: DESCENDANT_PAGE_LIMIT,
+			sortKey: "created_at",
+			sortDirection: "desc",
+			useStateDbOnly: true,
+			...cursor ? { cursor } : {}
+		});
+		if (!isJsonObject(response) || !Array.isArray(response.data)) throw new Error("Codex app-server returned an invalid descendant-list response");
+		if (response.data.length > DESCENDANT_PAGE_LIMIT) throw new Error("Codex app-server exceeded the descendant-list page limit");
+		for (const value of response.data) {
+			if (!isJsonObject(value)) throw new Error("Codex app-server returned an invalid descendant thread");
+			const descendantThreadId = normalizeBoundedOptionalString(value.id, MAX_THREAD_ID_LENGTH);
+			if (!descendantThreadId) throw new Error("Codex app-server returned a descendant without a valid thread id");
+			if (seenThreadIds.has(descendantThreadId)) throw new Error("Codex app-server returned a cyclic descendant thread list");
+			seenThreadIds.add(descendantThreadId);
+			await params.assertDescendantIdle(descendantThreadId);
+			if (await params.bindingStore.hasOtherThreadOwner(descendantThreadId)) throw new Error("cannot archive a Codex thread while a spawned descendant is owned by an OpenClaw session");
+		}
+		const nextCursor = readNextCursor(response.nextCursor);
+		if (!nextCursor) return;
+		if (seenCursors.has(nextCursor)) throw new Error("Codex app-server returned a repeated descendant-list cursor");
+		seenCursors.add(nextCursor);
+		cursor = nextCursor;
+	}
+	throw new Error("Codex descendant enumeration exceeded its safety limit");
+}
+//#endregion
 //#region extensions/codex/src/session-catalog-create.ts
 const CODEX_AGENT_RUNTIME_ID = "codex";
 const CODEX_CATALOG_DEFAULT_MODEL_REF = "openai/gpt-5.6-sol";
@@ -813,7 +820,7 @@ function normalizeLimit(value, key) {
 	if (!Number.isInteger(value) || value < 1 || value > 100) throw new CatalogParamsError(`${key} must be an integer from 1 to 100`);
 	return value;
 }
-function readOptionalString(params, key, maxLength) {
+function readBoundedOptionalString(params, key, maxLength) {
 	const value = params[key];
 	if (value === void 0) return;
 	if (typeof value !== "string") throw new CatalogParamsError(`${key} must be a string`);
@@ -835,9 +842,9 @@ function readPageParams(value) {
 		"searchTerm",
 		"cwd"
 	]));
-	const cursor = readOptionalString(params, "cursor", MAX_CURSOR_LENGTH);
-	const searchTerm = readOptionalString(params, "searchTerm", MAX_SEARCH_LENGTH);
-	const cwd = readOptionalString(params, "cwd", MAX_CWD_LENGTH);
+	const cursor = readBoundedOptionalString(params, "cursor", MAX_CURSOR_LENGTH);
+	const searchTerm = readBoundedOptionalString(params, "searchTerm", MAX_SEARCH_LENGTH);
+	const cwd = readBoundedOptionalString(params, "cwd", MAX_CWD_LENGTH);
 	return {
 		limit: normalizeLimit(params.limit, "limit"),
 		...cursor ? { cursor } : {},
@@ -854,7 +861,7 @@ function readGatewayParams(value) {
 		"hostIds",
 		"cursors"
 	]));
-	const search = readOptionalString(params, "search", MAX_SEARCH_LENGTH);
+	const search = readBoundedOptionalString(params, "search", MAX_SEARCH_LENGTH);
 	let hostIds;
 	if (params.hostIds !== void 0) {
 		if (!Array.isArray(params.hostIds) || params.hostIds.length > 100) throw new CatalogParamsError(`hostIds must contain at most 100 host ids`);
@@ -894,9 +901,6 @@ function parseJsonParams(paramsJSON) {
 		throw new Error("Codex session catalog parameters must be valid JSON", { cause: error });
 	}
 }
-function readFiniteNumber(value) {
-	return typeof value === "number" && Number.isFinite(value) ? value : void 0;
-}
 function parseOptionalCatalogString(value, field, maxLength) {
 	if (value === void 0) return;
 	if (typeof value !== "string" || value.length > maxLength) throw new Error(`Codex session catalog returned an invalid ${field}`);
@@ -922,9 +926,9 @@ function parseCatalogSession(value, options = {}) {
 	const cliVersion = parseOptionalCatalogString(value.cliVersion, "CLI version", MAX_METADATA_LENGTH);
 	const gitBranch = parseOptionalCatalogString(value.gitBranch, "Git branch", MAX_METADATA_LENGTH);
 	const sessionKey = options.allowSessionKey ? parseOptionalCatalogString(value.sessionKey, "OpenClaw session key", MAX_SESSION_KEY_LENGTH) : void 0;
-	const createdAt = readFiniteNumber(value.createdAt);
-	const updatedAt = readFiniteNumber(value.updatedAt);
-	const recencyAt = value.recencyAt === null ? null : readFiniteNumber(value.recencyAt);
+	const createdAt = asFiniteNumber(value.createdAt);
+	const updatedAt = asFiniteNumber(value.updatedAt);
+	const recencyAt = value.recencyAt === null ? null : asFiniteNumber(value.recencyAt);
 	return {
 		threadId: value.threadId,
 		status,
@@ -1415,6 +1419,12 @@ async function continueNodeCodexSession(params) {
 //#endregion
 //#region extensions/codex/src/session-catalog-terminal.ts
 const CODEX_TERMINAL_RESUME_COMMAND = "codex.terminal.resume.v1";
+function resolveCodexCatalogTerminalHome(sources) {
+	const runtimeConfig = sources.getRuntimeConfig();
+	if (!runtimeConfig) throw new Error("OpenClaw runtime config is unavailable");
+	const startOptions = resolveCodexSupervisionAppServerRuntimeOptions({ pluginConfig: sources.getPluginConfig() }).start;
+	return resolveCodexAppServerLocalHomeDir(startOptions, resolveDefaultAgentDir(runtimeConfig));
+}
 function resolveLocalCodexTerminalExecutable(env = process.env) {
 	return resolveLocalCodexTerminalResolution(env)?.executable;
 }
@@ -1458,7 +1468,7 @@ async function findCatalogEligibleThread(control, threadId, forceRefresh) {
 	}
 	throw new CatalogParamsError("Codex session eligibility could not be verified");
 }
-function createCodexTerminalNodeHostCommand(control) {
+function createCodexTerminalNodeHostCommand(control, configSources) {
 	return {
 		command: CODEX_TERMINAL_RESUME_COMMAND,
 		cap: CODEX_APP_SERVER_THREADS_CAPABILITY,
@@ -1486,6 +1496,7 @@ function createCodexTerminalNodeHostCommand(control) {
 				file: resolution.executable,
 				args: ["resume", resume.threadId],
 				cwd: record.cwd,
+				env: { CODEX_HOME: resolveCodexCatalogTerminalHome(configSources) },
 				cols: resume.cols,
 				rows: resume.rows
 			}, io));
@@ -1533,6 +1544,7 @@ async function openCodexCatalogTerminal(params) {
 				params.threadId
 			],
 			...record.cwd ? { cwd: record.cwd } : {},
+			env: { CODEX_HOME: resolveCodexCatalogTerminalHome(params) },
 			...resolution.pathEnv ? { pathEnv: resolution.pathEnv } : {},
 			title
 		};
@@ -1558,6 +1570,19 @@ async function openCodexCatalogTerminal(params) {
 		title
 	};
 }
+async function startCodexCatalogTerminal(params) {
+	if (params.nodeId) throw new CatalogParamsError("Paired-node Codex terminal start is unavailable; omit hostId to start on the gateway host");
+	const resolution = resolveLocalCodexTerminalResolution();
+	if (!resolution) throw new CatalogParamsError("Codex CLI is unavailable; install Codex or add codex to PATH, then try again");
+	return {
+		kind: "local",
+		argv: [resolution.executable, ...params.initialMessage !== void 0 ? ["--", params.initialMessage] : []],
+		cwd: params.cwd,
+		env: { CODEX_HOME: resolveCodexCatalogTerminalHome(params) },
+		...resolution.pathEnv ? { pathEnv: resolution.pathEnv } : {},
+		title: "codex"
+	};
+}
 //#endregion
 //#region extensions/codex/src/session-catalog-transcript-item.ts
 const CODEX_MESSAGE_TYPES = /* @__PURE__ */ new Map([
@@ -2044,7 +2069,7 @@ async function listGatewayHost(params) {
 async function listCodexSessionCatalog(params) {
 	const query = readGatewayParams(params.query);
 	const requestedHostIds = query.hostIds ? new Set(query.hostIds) : void 0;
-	const localHosts = !requestedHostIds || requestedHostIds.has("gateway:local") ? [listGatewayHost({
+	const localHosts = params.includeLocal !== false && (!requestedHostIds || requestedHostIds.has("gateway:local")) ? [listGatewayHost({
 		bindingStore: params.bindingStore,
 		config: params.config,
 		control: params.control,
@@ -2087,7 +2112,7 @@ async function listCodexSessionCatalog(params) {
 	return { hosts: await Promise.all([...localHosts, ...nodeHosts]) };
 }
 /** Builds the node-local read-only Codex app-server catalog command. */
-function createCodexSessionCatalogNodeHostCommands(control) {
+function createCodexSessionCatalogNodeHostCommands(control, configSources) {
 	return [
 		{
 			command: CODEX_APP_SERVER_THREADS_LIST_COMMAND,
@@ -2125,7 +2150,7 @@ function createCodexSessionCatalogNodeHostCommands(control) {
 				}
 			}
 		},
-		createCodexTerminalNodeHostCommand(control)
+		createCodexTerminalNodeHostCommand(control, configSources)
 	];
 }
 function readNodeTranscriptParams(value) {
@@ -2135,9 +2160,9 @@ function readNodeTranscriptParams(value) {
 		"cursor",
 		"limit"
 	]));
-	const threadId = readOptionalString(value, "threadId", 256);
+	const threadId = readBoundedOptionalString(value, "threadId", 256);
 	if (!threadId) throw new CatalogParamsError("threadId is required");
-	const cursor = readOptionalString(value, "cursor", MAX_CURSOR_LENGTH);
+	const cursor = readBoundedOptionalString(value, "cursor", MAX_CURSOR_LENGTH);
 	return {
 		threadId,
 		limit: readBoundedLimit(value.limit, "limit", 20, 50),
@@ -2239,7 +2264,6 @@ async function listAdoptedSessionEntries(params) {
 async function findAdoptedSessionEntry(params) {
 	return (await listAdoptedSessionEntries(params)).get(params.threadId);
 }
-var CodexAdoptionBindingCleanupError = class extends AggregateError {};
 async function clearCreatedAdoptionBinding(params) {
 	let cleared = false;
 	let clearError;
@@ -2257,14 +2281,14 @@ async function clearCreatedAdoptionBinding(params) {
 	try {
 		current = await params.bindingStore.read(params.identity);
 	} catch (readError) {
-		throw new CodexAdoptionBindingCleanupError([
+		throw new AggregateError([
 			params.cause,
 			...clearError ? [clearError] : [],
 			readError
-		], `OpenClaw session creation failed and the Codex binding could not be verified for ${params.sourceThreadId}`);
+		], `OpenClaw session creation failed and the Codex binding could not be verified for ${params.sourceThreadId}`, { cause: readError });
 	}
 	if (!matchesPendingSupervisionOwner(current, params.expectedPending)) return;
-	throw new CodexAdoptionBindingCleanupError([params.cause, ...clearError ? [clearError] : []], `OpenClaw session creation failed and the Codex binding could not be cleared for ${params.sourceThreadId}`);
+	throw new AggregateError([params.cause, ...clearError ? [clearError] : []], `OpenClaw session creation failed and the Codex binding could not be cleared for ${params.sourceThreadId}`, { cause: params.cause });
 }
 function matchesPendingAdoptionBinding(binding, expected) {
 	const historyCoveredThrough = binding?.historyCoveredThrough;
@@ -2576,13 +2600,22 @@ function toGenericCatalogHost(host, localTerminalAvailable) {
 	};
 }
 function registerCodexSessionCatalog(params) {
-	const provider = {
+	const usesProcessHomeFallback = () => {
+		const start = resolveCodexSupervisionAppServerRuntimeOptions({ pluginConfig: params.getPluginConfig() }).start;
+		return start.transport === "stdio" && start.homeScope === "user" && !process.env.CODEX_HOME?.trim();
+	};
+	const assertLocalAccess = (hostId, allowProcessHomeFallback) => {
+		if (hostId === "gateway:local" && allowProcessHomeFallback === false && usesProcessHomeFallback()) throw new CatalogParamsError("local Codex sessions are unavailable in isolated state");
+	};
+	const checkUpstreamActivity = createChecker(params);
+	params.api.registerSessionCatalog({
 		id: "codex",
 		label: "Codex",
+		supportsProcessHomeIsolation: true,
 		resolveCreateSession: ({ agentId }) => resolveCodexCatalogCreateSession(params.getRuntimeConfig() ?? params.api.config, agentId),
 		list: async (query) => {
 			const localTerminalAvailable = resolveLocalCodexTerminalExecutable() !== void 0;
-			const { listNodes, onHost, sessionEntries, ...gatewayQuery } = query;
+			const { allowProcessHomeFallback, listNodes, onHost, sessionEntries, ...gatewayQuery } = query;
 			const mapHost = (host) => toGenericCatalogHost(host, localTerminalAvailable);
 			return (await listCodexSessionCatalog({
 				bindingStore: params.bindingStore,
@@ -2592,17 +2625,20 @@ function registerCodexSessionCatalog(params) {
 				query: gatewayQuery,
 				listNodes,
 				sessionEntries,
+				includeLocal: allowProcessHomeFallback !== false || !usesProcessHomeFallback(),
 				...onHost ? { onHost: (host) => onHost(mapHost(host)) } : {}
 			})).hosts.map(mapHost);
 		},
 		read: async (request) => {
+			const { allowProcessHomeFallback, ...catalogRequest } = request;
+			assertLocalAccess(catalogRequest.hostId, allowProcessHomeFallback);
 			const page = await readCodexSessionTranscript({
 				runtime: params.api.runtime,
 				control: params.control,
-				hostId: request.hostId,
-				threadId: request.threadId,
-				cursor: request.cursor,
-				limit: request.limit ?? 20
+				hostId: catalogRequest.hostId,
+				threadId: catalogRequest.threadId,
+				cursor: catalogRequest.cursor,
+				limit: catalogRequest.limit ?? 20
 			});
 			return {
 				...page,
@@ -2610,6 +2646,7 @@ function registerCodexSessionCatalog(params) {
 			};
 		},
 		continueSession: async (request) => {
+			assertLocalAccess(request.hostId, request.allowProcessHomeFallback);
 			const config = params.getRuntimeConfig();
 			if (!config) throw new Error("OpenClaw runtime config is unavailable");
 			if (request.hostId.startsWith("node:")) return await continueNodeCodexSession({
@@ -2632,8 +2669,9 @@ function registerCodexSessionCatalog(params) {
 				}
 			})).sessionKey, request.threadId, upstreamBaseline);
 		},
-		checkUpstreamActivity: createChecker(params),
+		checkUpstreamActivity: (probes, policy) => checkUpstreamActivity(probes.filter((probe) => probe.hostId !== "gateway:local" || policy?.allowProcessHomeFallback !== false || !usesProcessHomeFallback())),
 		archive: async (request) => {
+			assertLocalAccess(request.hostId, request.allowProcessHomeFallback);
 			if (request.confirmNoOtherRunner !== true) throw new CatalogParamsError("archive requires confirmation that no other runner is active");
 			if (request.hostId !== "gateway:local") throw new CatalogParamsError("paired-node Codex sessions are view-only");
 			const config = params.getRuntimeConfig();
@@ -2647,14 +2685,26 @@ function registerCodexSessionCatalog(params) {
 			});
 			return { ok: true };
 		},
-		openTerminal: (request) => openCodexCatalogTerminal({
-			api: params.api,
-			control: params.control,
-			parseCatalogPage,
-			...request
-		})
-	};
-	params.api.registerSessionCatalog(provider);
+		openTerminal: async (request) => {
+			assertLocalAccess(request.hostId, request.allowProcessHomeFallback);
+			return await openCodexCatalogTerminal({
+				api: params.api,
+				control: params.control,
+				getPluginConfig: params.getPluginConfig,
+				getRuntimeConfig: params.getRuntimeConfig,
+				parseCatalogPage,
+				...request
+			});
+		},
+		startTerminalSession: async (request) => {
+			assertLocalAccess(request.nodeId ? `node:${request.nodeId}` : CODEX_LOCAL_SESSION_HOST_ID, request.allowProcessHomeFallback);
+			return await startCodexCatalogTerminal({
+				getPluginConfig: params.getPluginConfig,
+				getRuntimeConfig: params.getRuntimeConfig,
+				...request
+			});
+		}
+	});
 }
 const codexSessionCatalogRuntime = {
 	register: registerCodexSessionCatalog,
@@ -2665,4 +2715,4 @@ const codexSessionCatalogRuntime = {
 	archiveLocal: archiveLocalCodexSession
 };
 //#endregion
-export { CODEX_LOCAL_SESSION_HOST_ID as a, requestOptions as c, createCodexCliSessionNodeHostCommands as d, createCodexCliSessionNodeInvokePolicies as f, resumeCodexCliSessionOnNode as g, resolveCodexCliSessionForBindingOnNode as h, createCodexSessionCatalogNodeInvokePolicies as i, safeCodexControlRequest as l, listCodexCliSessionsOnNode as m, createCodexSessionCatalogControl as n, codexControlRequest as o, formatCodexCliSessions as p, createCodexSessionCatalogNodeHostCommands as r, readCodexStatusProbes as s, codexSessionCatalogRuntime as t, assertCodexArchiveDescendantsUnowned as u };
+export { CODEX_LOCAL_SESSION_HOST_ID as a, readCodexStatusProbes as c, createCodexCliSessionNodeHostCommands as d, createCodexCliSessionNodeInvokePolicies as f, resumeCodexCliSessionOnNode as g, resolveCodexCliSessionForBindingOnNode as h, createCodexSessionCatalogNodeInvokePolicies as i, requestOptions as l, listCodexCliSessionsOnNode as m, createCodexSessionCatalogControl as n, assertCodexArchiveDescendantsUnowned as o, formatCodexCliSessions as p, createCodexSessionCatalogNodeHostCommands as r, codexControlRequest as s, codexSessionCatalogRuntime as t, safeCodexControlRequest as u };

package/dist/{session-cli-2PZaFLRh.js → session-cli-7hgXZDV7.js}

@@ -1,4 +1,4 @@
-import { a as CODEX_LOCAL_SESSION_HOST_ID } from "./session-catalog-DyOgR4WH.js";
+import { a as CODEX_LOCAL_SESSION_HOST_ID } from "./session-catalog-xwNi_SDM.js";
 import { isRecord } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { truncateUtf16Safe } from "openclaw/plugin-sdk/text-utility-runtime";
 import { sanitizeTerminalText } from "openclaw/plugin-sdk/text-chunking";

package/dist/session-retirement-DoMMJFKm.js

@@ -0,0 +1,36 @@
+import { K as releaseCodexAppServerLiveThread, d as retainSharedCodexAppServerClientByInstanceId } from "./shared-client-kIBbGjk4.js";
+import { a as closeCodexStartupClientBestEffort, d as unsubscribeCodexThreadBestEffort, r as CodexAppServerUnsafeSubscriptionError } from "./attempt-client-cleanup-DMLXUfa8.js";
+import { t as isIncognitoSessionKey } from "./incognito-session-ET_ufDH-.js";
+import { t as codexNativeSubagentMonitorRuntime } from "./native-subagent-monitor-DyTGmTUx.js";
+//#region extensions/codex/src/app-server/session-retirement.ts
+/** Retire binding and native subscription under the same generation/physical-client ownership fence. */
+async function retireCodexAppServerSessionGeneration(params) {
+	const retireGeneration = () => params.mode === "reset" ? params.bindingStore.resetSessionGeneration(params.identity) : params.bindingStore.retireSessionGeneration(params.identity);
+	const expectedBinding = await params.bindingStore.read(params.identity);
+	if (!expectedBinding) return await retireGeneration();
+	return await params.bindingStore.withLease(params.identity, async () => {
+		const binding = await params.bindingStore.read(params.identity);
+		if (binding?.threadId !== expectedBinding.threadId) return "conflict";
+		const result = await retireGeneration();
+		if (result !== "applied" || !binding?.clientId) return result;
+		const clientLease = retainSharedCodexAppServerClientByInstanceId(binding.clientId);
+		if (!clientLease) return result;
+		try {
+			codexNativeSubagentMonitorRuntime.retireParent(clientLease.client, binding.threadId);
+			if (!await releaseCodexAppServerLiveThread(clientLease.client, binding.threadId) && isIncognitoSessionKey(params.identity.sessionKey)) {
+				if (!await unsubscribeCodexThreadBestEffort(clientLease.client, {
+					threadId: binding.threadId,
+					timeoutMs: 5e3
+				})) {
+					await closeCodexStartupClientBestEffort(clientLease.client);
+					throw new CodexAppServerUnsafeSubscriptionError(`Codex retired session subscription could not be released: ${binding.threadId}`);
+				}
+			}
+		} finally {
+			clientLease.release();
+		}
+		return result;
+	});
+}
+//#endregion
+export { retireCodexAppServerSessionGeneration };

package/dist/{session-upstream-marker-B6U7tLw5.js → session-upstream-marker-CrIFX06J.js}

@@ -1,4 +1,4 @@
-import { r as importCodexThreadHistoryToTranscript } from "./transcript-mirror-DzsdNCf5.js";
+import { r as importCodexThreadHistoryToTranscript } from "./transcript-mirror-B9gGgnJS.js";
 import { resolveStorePath } from "openclaw/plugin-sdk/session-store-runtime";
 //#region extensions/codex/src/app-server/session-history-import.ts
 /** Creates a session whose transcript is derived from one verified Codex thread snapshot. */

package/dist/{settled-turn-finalizer-CXY2Z9dT.js → settled-turn-finalizer-BRWBO4MO.js}

@@ -1,8 +1,9 @@
-import { W as isJsonObject } from "./shared-client-DTbvH-XV.js";
-import { c as fingerprintCodexMirrorSourceMessage, d as attachCodexMirrorIdentity, f as readMirrorIdentity, l as readCodexMirrorSourceFingerprint, p as readUpstreamUserText, t as codexTranscriptMirrorRuntime } from "./transcript-mirror-DzsdNCf5.js";
-import { t as runBoundedCodexAppServerTurn } from "./bounded-turn-D2ZAgZVz.js";
-import { n as createAssistantMessage } from "./event-projector-assistant-message-DTgnPPVF.js";
-import { isRecord } from "openclaw/plugin-sdk/string-coerce-runtime";
+import { ct as isJsonObject } from "./shared-client-kIBbGjk4.js";
+import { i as readUpstreamUserText, r as readMirrorIdentity, t as attachCodexMirrorIdentity } from "./upstream-prompt-provenance-ClRBije0.js";
+import { c as readCodexMirrorSourceFingerprint, s as fingerprintCodexMirrorSourceMessage, t as codexTranscriptMirrorRuntime } from "./transcript-mirror-B9gGgnJS.js";
+import { t as runBoundedCodexAppServerTurn } from "./bounded-turn-qgZmzy_4.js";
+import { n as createAssistantMessage } from "./event-projector-assistant-message-BwxV4d6N.js";
+import { isRecord, normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { Buffer } from "node:buffer";
 import { isSilentReplyText } from "openclaw/plugin-sdk/reply-runtime";
 //#region extensions/codex/src/app-server/settled-turn-projection.ts
@@ -11,9 +12,6 @@ const MAX_PROJECTION_BYTES = 512 * 1024;
 const MAX_TEXT_BYTES = 64 * 1024;
 const TOOL_NAME_PATTERN = /^[a-zA-Z0-9_-]{1,128}$/u;
 const TOOL_ERROR_STATUS_PREFIX = "[Tool result status: error]\n";
-function readNonEmptyString(value) {
-	return typeof value === "string" ? value.trim() || void 0 : void 0;
-}
 function readBoundedText(value, label, maxBytes = MAX_TEXT_BYTES) {
 	if (typeof value !== "string" || !value.trim()) return;
 	if (Buffer.byteLength(value, "utf8") > maxBytes) throw new Error(`Codex settled-turn projection found oversized ${label}`);
@@ -28,12 +26,12 @@ function responseItemBytes(item) {
 	return Buffer.byteLength(JSON.stringify(item), "utf8");
 }
 function requireCallId(value) {
-	const callId = readNonEmptyString(value);
+	const callId = normalizeOptionalString(value);
 	if (!callId || callId.length > 256) throw new Error("Codex settled-turn projection found an invalid tool call id");
 	return callId;
 }
 function requireToolName(value) {
-	const name = readNonEmptyString(value);
+	const name = normalizeOptionalString(value);
 	if (!name || !TOOL_NAME_PATTERN.test(name)) throw new Error("Codex settled-turn projection found an invalid tool name");
 	return name;
 }
@@ -152,7 +150,7 @@ function projectToolResult(message) {
 	for (const value of message.content) {
 		if (!isRecord(value)) throw new Error("Codex settled-turn projection found malformed tool result content");
 		if (value.type === "image") {
-			const mimeType = readNonEmptyString(value.mimeType) ?? "unknown type";
+			const mimeType = normalizeOptionalString(value.mimeType) ?? "unknown type";
 			parts.push(`[Image tool result: ${mimeType}]`);
 			continue;
 		}
@@ -246,6 +244,7 @@ async function runCodexSettledTurnFinalization(operation, options) {
 			mode: "required",
 			id: attempt.modelId
 		},
+		modelProvider: "openai",
 		profile: attempt.authProfileId,
 		timeoutMs: attempt.runTimeoutOverrideMs ?? attempt.timeoutMs,
 		signal: attempt.abortSignal,
@@ -262,7 +261,8 @@ async function runCodexSettledTurnFinalization(operation, options) {
 		requiredModalities: ["text"],
 		isolation: "private-stdio",
 		historyItems,
-		requireNoExternalCapabilities: true
+		requireNoExternalCapabilities: true,
+		allowEmptyText: true
 	});
 	let promptEchoSeen = false;
 	let unexpectedItem;
@@ -281,7 +281,15 @@ async function runCodexSettledTurnFinalization(operation, options) {
 	}
 	if (unexpectedItem) throw new Error(`Codex settled-turn finalization returned unexpected native item: ${unexpectedItem.type}`);
 	const text = bounded.text.trim();
-	if (!text || isSilentReplyText(text)) throw new Error("Codex settled-turn finalization completed without a visible answer");
+	if (!text) return {
+		assistant: createAssistantMessage(attempt, "", {
+			tokenUsage: bounded.usage,
+			aborted: false,
+			promptError: null
+		}),
+		...bounded.usage ? { usage: bounded.usage } : {}
+	};
+	if (isSilentReplyText(text)) throw new Error("Codex settled-turn finalization completed without a visible answer");
 	const mirrorIdentity = `settled-finalizer:${attempt.runId}`;
 	const assistant = attachCodexMirrorIdentity(createAssistantMessage(attempt, text, {
 		tokenUsage: bounded.usage,