@openclaw/codex 2026.7.2-beta.7 → 2026.8.1-beta.2

package/dist/{command-handlers-DAHUSry9.js → command-handlers-Db8pu_ds.js}

@@ -1,25 +1,29 @@
-import { I as resolveCodexAppServerAuthProfileIdForAgent, W as isJsonObject } from "./shared-client-DTbvH-XV.js";
-import { c as reclaimCurrentCodexSessionGeneration, d as sessionBindingIdentity, i as createCodexSessionGenerationSupersededError, j as isCodexFastServiceTier, n as assertCodexBindingMayBeReplaced, r as bindingStoreKey, s as normalizeCodexAppServerBindingModelProvider } from "./session-binding-BXpo9ymA.js";
-import { g as assertCodexThreadResumeResponse } from "./transcript-mirror-DzsdNCf5.js";
-import { t as listAllCodexAppServerModels } from "./models-BBMKU4jA.js";
-import { t as CODEX_CONTROL_METHODS } from "./capabilities-BFDTVYr4.js";
-import { s as summarizeCodexAccountUsage } from "./rate-limits-CU-gVCCS.js";
-import { a as formatComputerUseStatus, c as formatSkills, i as formatCodexStatus, l as formatThreads, n as formatAccount, o as formatList, r as formatCodexDisplayText, s as formatModels, t as buildHelp, u as readString$1 } from "./command-formatters-C336eRVS.js";
-import { n as resolveCodexNativeExecutionBlock, r as resolveCodexNativeSandboxBlock } from "./sandbox-guard-NuhpXmPB.js";
-import { a as setCodexConversationFastMode, c as steerCodexConversationTurn, d as CODEX_NATIVE_EXECUTION_AUTH_ERROR, f as canMutateCodexHost, i as readCodexConversationActiveTurn, l as stopCodexConversationTurn, n as parseCodexFastModeArg, o as setCodexConversationModel, r as parseCodexPermissionsModeArg, s as setCodexConversationPermissions, t as formatPermissionsMode } from "./conversation-control-xsIeXbo4.js";
-import { i as readCodexConversationBindingData, n as createCodexCliNodeConversationBindingData, o as resolveCodexDefaultWorkspaceDir, r as createCodexConversationBindingData } from "./conversation-binding-data-BHRpYbX3.js";
-import { a as resolveCodexBindingAppServerConnection } from "./notification-correlation-CU6_AnOb.js";
-import { c as requestOptions, l as safeCodexControlRequest, o as codexControlRequest, p as formatCodexCliSessions, s as readCodexStatusProbes } from "./session-catalog-DyOgR4WH.js";
-import { n as installCodexComputerUse, r as readCodexComputerUseStatus } from "./computer-use-CYEc8U3w.js";
+import { D as CODEX_PLUGINS_MARKETPLACE_NAME, P as isCodexFastServiceTier, c as reclaimCurrentCodexSessionGeneration, d as sessionBindingIdentity, g as resolveCodexAppServerRuntimeOptions, i as createCodexSessionGenerationSupersededError, n as assertCodexBindingMayBeReplaced, r as bindingStoreKey, s as normalizeCodexAppServerBindingModelProvider } from "./session-binding-DPxIvMgE.js";
+import { Q as resolveCodexAppServerAuthAccountCacheKey, V as consumeCodexAppServerLiveThread, a as getLeasedSharedCodexAppServerClient, ct as isJsonObject, et as resolveCodexAppServerAuthProfileIdForAgent, l as releaseLeasedSharedCodexAppServerClient, tt as resolveCodexAppServerFallbackApiKeyCacheKey } from "./shared-client-kIBbGjk4.js";
+import { i as assertCodexThreadResumeResponse } from "./protocol-validators-B4F7L8Rf.js";
+import { t as listAllCodexAppServerModels } from "./models-BFlpn1Ex.js";
+import { i as defaultCodexAppInventoryCache, r as buildCodexPluginAppCacheKey } from "./plugin-app-cache-key-C3H2CVp6.js";
+import { Y as isOpenAiCuratedMarketplaceName, q as refreshCodexPluginRuntimeState } from "./thread-lifecycle-Bu1BTDXr.js";
+import { t as isIncognitoSessionKey } from "./incognito-session-ET_ufDH-.js";
+import { t as CODEX_CONTROL_METHODS } from "./capabilities-CybGI1oz.js";
+import { s as summarizeCodexAccountUsage } from "./rate-limits-DZXmOL8-.js";
+import { a as formatComputerUseStatus, c as formatSkills, i as formatCodexStatus, l as formatThreads, n as formatAccount, o as formatList, r as formatCodexDisplayText, s as formatModels, t as buildHelp } from "./command-formatters-B1AEz8ZA.js";
+import { n as resolveCodexNativeExecutionBlock, r as resolveCodexNativeSandboxBlock } from "./sandbox-guard-Cmwc9eIk.js";
+import { a as rollbackCodexAppServerBindingSubscription, i as retireCodexConversationThreadBinding, n as releaseCodexAppServerBindingSubscription, o as withCodexConversationThreadActivity, r as retainCodexAppServerBindingSubscription, s as withExclusiveCodexAppServerThread, t as isSameCodexAppServerThreadOwner } from "./thread-ownership-6kOQHlyC.js";
+import { a as parseCodexPermissionsModeArg, c as setCodexConversationModel, d as stopCodexConversationTurn, i as parseCodexFastModeArg, l as setCodexConversationPermissions, m as canMutateCodexHost, n as parseCodexPluginMarketplaceId, o as readCodexConversationActiveTurn, p as CODEX_NATIVE_EXECUTION_AUTH_ERROR, r as formatPermissionsMode, s as setCodexConversationFastMode, t as discoverCodexMarketplacePlugins, u as steerCodexConversationTurn } from "./plugin-marketplace-discovery-CzrGJdCR.js";
+import { i as readCodexConversationBindingData, n as createCodexCliNodeConversationBindingData, o as resolveCodexDefaultWorkspaceDir, r as createCodexConversationBindingData } from "./conversation-binding-data-CW2GuupV.js";
+import { n as resolveCodexBindingAppServerConnection } from "./binding-connection-I5Bo-AsX.js";
+import { c as readCodexStatusProbes, l as requestOptions, p as formatCodexCliSessions, s as codexControlRequest, u as safeCodexControlRequest } from "./session-catalog-xwNi_SDM.js";
+import { i as readCodexComputerUseStatus, r as installCodexComputerUse, t as defaultCodexPluginMetadataCache } from "./plugin-metadata-cache-CNJPj4_b.js";
+import { normalizeOptionalString, normalizeUniqueStringEntries } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { parseStrictPositiveInteger } from "openclaw/plugin-sdk/number-runtime";
 import crypto from "node:crypto";
 import { ensureAuthProfileStore, findNormalizedProviderValue, resolveAgentDir, resolveAuthProfileEligibility, resolveAuthProfileOrder, resolveProfileUnusableUntilForDisplay, resolveSessionAgentIds } from "openclaw/plugin-sdk/agent-runtime";
 import { parseAgentSessionKey } from "openclaw/plugin-sdk/routing";
-import { normalizeOptionalString, normalizeUniqueStringEntries } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { getSessionEntry, resolveStorePath } from "openclaw/plugin-sdk/session-store-runtime";
 import { truncateUtf16Safe } from "openclaw/plugin-sdk/text-utility-runtime";
 import { expectDefined } from "openclaw/plugin-sdk/expect-runtime";
-import { MODEL_SELECTION_LOCKED_MESSAGE, isModelSelectionLocked } from "openclaw/plugin-sdk/model-session-runtime";
+import { MODEL_SELECTION_LOCKED_MESSAGE, isModelSelectionLocked, resolvePersistedSessionRuntimeId } from "openclaw/plugin-sdk/model-session-runtime";
 //#region extensions/codex/src/command-account.ts
 const OPENAI_PROVIDER_ID = "openai";
 const OPENAI_CODEX_PROVIDER_ID = OPENAI_PROVIDER_ID;
@@ -148,9 +152,9 @@ function isActiveProfileCandidate(params, profileId) {
 function resolveLiveAccountProfileId(params) {
 	if (!params.account.ok || !isJsonObject(params.account.value)) return;
 	const account = isJsonObject(params.account.value.account) ? params.account.value.account : params.account.value;
-	const type = readString(account, "type")?.toLowerCase();
+	const type = normalizeOptionalString(account.type)?.toLowerCase();
 	if (type === "chatgpt") {
-		const email = readString(account, "email")?.toLowerCase();
+		const email = normalizeOptionalString(account.email)?.toLowerCase();
 		const firstSubscription = params.order.find((profileId) => isChatGptSubscriptionProfile(params.store.profiles[profileId]));
 		if (!email) return firstSubscription;
 		return params.order.find((profileId) => {
@@ -231,10 +235,6 @@ function formatSubscriptionUsageLine(usage) {
 function formatUsageLineForDisplay(value) {
 	return value.replace(/^weekly\b/u, "Weekly").replace(/\bshort-term\b/u, "Short-term");
 }
-function readString(record, key) {
-	const value = record[key];
-	return typeof value === "string" && value.trim() ? value.trim() : void 0;
-}
 function isChatGptSubscriptionProfile(credential) {
 	return credential?.type === "oauth" || credential?.type === "token";
 }
@@ -1276,7 +1276,7 @@ async function sendCodexDiagnosticsFeedbackForTargets(deps, ctx, pluginConfig, n
 			});
 			continue;
 		}
-		const responseThreadId = isJsonObject(response.value) ? readString$1(response.value, "threadId") : void 0;
+		const responseThreadId = isJsonObject(response.value) ? normalizeOptionalString(response.value.threadId) : void 0;
 		sent.push({
 			...target,
 			threadId: responseThreadId ?? target.threadId
@@ -1442,10 +1442,35 @@ async function bindConversation(deps, ctx, pluginConfig, args) {
 async function detachConversation(deps, ctx) {
 	if (isCurrentSessionModelSelectionLocked(ctx)) return MODEL_SELECTION_LOCKED_MESSAGE;
 	const data = readCodexConversationBindingData(await ctx.getCurrentConversationBinding());
-	if (data?.kind === "codex-app-server-session") assertCodexBindingMayBeReplaced(await deps.bindingStore.read(conversationBindingIdentity(data.bindingId)), "detaching its conversation binding");
-	const detached = await ctx.detachConversationBinding();
-	if (data?.kind === "codex-app-server-session") await deps.bindingStore.mutate(conversationBindingIdentity(data.bindingId), { kind: "clear" });
-	return detached.removed ? "Detached this conversation from Codex." : "No Codex conversation binding was attached.";
+	const identity = data?.kind === "codex-app-server-session" ? conversationBindingIdentity(data.bindingId) : void 0;
+	const sourceSessionKey = data?.kind === "codex-app-server-session" ? data.source?.sessionKey : void 0;
+	let expectedThreadId;
+	let expectedStartId;
+	if (data?.kind === "codex-app-server-session") {
+		const binding = await deps.bindingStore.read(identity);
+		assertCodexBindingMayBeReplaced(binding, "detaching its conversation binding");
+		if (deps.readCodexConversationActiveTurn(identity)) return "This Codex conversation has an active run; use /codex stop before detaching it.";
+		expectedThreadId = binding?.threadId;
+		expectedStartId = binding?.conversationStartId;
+	}
+	const detachPublicConversation = async () => {
+		return (await ctx.detachConversationBinding()).removed ? "Detached this conversation from Codex." : "No Codex conversation binding was attached.";
+	};
+	if (identity && expectedThreadId) return await withCodexConversationThreadActivity(identity.bindingId, async () => {
+		let detachedPublicConversation;
+		if (!await retireCodexConversationThreadBinding({
+			bindingStore: deps.bindingStore,
+			identity,
+			expectedThreadId,
+			...expectedStartId ? { expectedStartId } : {},
+			...isIncognitoSessionKey(sourceSessionKey) ? { allowUntracked: true } : {},
+			afterClear: async () => {
+				detachedPublicConversation = await detachPublicConversation();
+			}
+		})) return "This Codex conversation binding changed while detaching; try again.";
+		return detachedPublicConversation;
+	});
+	return await detachPublicConversation();
 }
 async function describeConversationBinding(deps, ctx) {
 	const current = await ctx.getCurrentConversationBinding();
@@ -1507,52 +1532,83 @@ async function resumeThread(deps, ctx, pluginConfig, args) {
 		agentId: scope.agentId,
 		config: ctx.config
 	});
-	return await deps.bindingStore.withLease(identity, async () => {
-		if (!await reclaimCurrentCodexSessionGeneration({
-			bindingStore: deps.bindingStore,
-			identity,
-			config: ctx.config
-		})) throw createCodexSessionGenerationSupersededError(identity.sessionId);
-		const currentBinding = await deps.bindingStore.read(identity);
-		assertCodexBindingMayBeReplaced(currentBinding, "attaching a different resumed thread");
-		const authProfileId = resolveCodexAppServerAuthProfileIdForAgent({
-			authProfileId: currentBinding?.authProfileId,
-			agentDir: scope.agentDir,
-			config: ctx.config
-		});
-		const response = assertCodexThreadResumeResponse(await deps.codexControlRequest(pluginConfig, CODEX_CONTROL_METHODS.resumeThread, {
-			threadId: normalizedThreadId,
-			excludeTurns: true
-		}, {
-			config: ctx.config,
-			agentDir: scope.agentDir,
-			authProfileId,
-			sessionKey: ctx.sessionKey,
-			sessionId: ctx.sessionId
-		}));
-		const effectiveThreadId = response.thread.id;
-		if (effectiveThreadId !== normalizedThreadId) throw new Error(`Codex thread/resume returned ${effectiveThreadId} for ${normalizedThreadId}`);
-		const resumedCwd = response.thread.cwd;
-		if (typeof resumedCwd !== "string") throw new Error(`Codex thread/resume returned no cwd for ${normalizedThreadId}`);
-		const modelProvider = normalizeCodexAppServerBindingModelProvider({
-			authProfileId,
-			modelProvider: response.modelProvider ?? void 0,
-			agentDir: scope.agentDir,
-			config: ctx.config
-		});
-		assertCodexBindingMayBeReplaced(await deps.bindingStore.read(identity), "committing a different resumed thread");
-		if (!await deps.bindingStore.mutate(identity, {
-			kind: "set",
-			binding: {
-				threadId: effectiveThreadId,
-				cwd: resumedCwd,
+	return await withExclusiveCodexAppServerThread({
+		bindingStore: deps.bindingStore,
+		identity,
+		threadId: normalizedThreadId,
+		run: async () => await deps.bindingStore.withLease(identity, async () => {
+			if (!await reclaimCurrentCodexSessionGeneration({
+				bindingStore: deps.bindingStore,
+				identity,
+				config: ctx.config
+			})) throw createCodexSessionGenerationSupersededError(identity.sessionId);
+			const currentBinding = await deps.bindingStore.read(identity);
+			assertCodexBindingMayBeReplaced(currentBinding, "attaching a different resumed thread");
+			const authProfileId = resolveCodexAppServerAuthProfileIdForAgent({
+				authProfileId: currentBinding?.authProfileId,
+				agentDir: scope.agentDir,
+				config: ctx.config
+			});
+			let committedResponse = false;
+			const commitResumedThread = async (value, client) => {
+				const response = assertCodexThreadResumeResponse(value);
+				const effectiveThreadId = response.thread.id;
+				if (effectiveThreadId !== normalizedThreadId) throw new Error(`Codex thread/resume returned ${effectiveThreadId} for ${normalizedThreadId}`);
+				const resumedCwd = response.thread.cwd;
+				if (typeof resumedCwd !== "string") throw new Error(`Codex thread/resume returned no cwd for ${normalizedThreadId}`);
+				const modelProvider = normalizeCodexAppServerBindingModelProvider({
+					authProfileId,
+					modelProvider: response.modelProvider ?? void 0,
+					agentDir: scope.agentDir,
+					config: ctx.config
+				});
+				const bindingBeforeCommit = await deps.bindingStore.read(identity);
+				assertCodexBindingMayBeReplaced(bindingBeforeCommit, "committing a different resumed thread");
+				const clientId = client?.getInstanceId();
+				const sameOwner = client ? isSameCodexAppServerThreadOwner(bindingBeforeCommit, {
+					threadId: effectiveThreadId,
+					clientId
+				}) : bindingBeforeCommit?.threadId === effectiveThreadId;
+				let retained = false;
+				try {
+					if (client) {
+						retained = await retainCodexAppServerBindingSubscription(client, effectiveThreadId, sameOwner ? await consumeCodexAppServerLiveThread(client, effectiveThreadId) : void 0);
+						if (!retained) throw new Error("Codex resumed thread lost its native subscription owner.");
+					}
+					if (bindingBeforeCommit && !sameOwner) await releaseCodexAppServerBindingSubscription(bindingBeforeCommit);
+					if (!await deps.bindingStore.mutate(identity, {
+						kind: "set",
+						binding: {
+							...bindingBeforeCommit?.threadId === effectiveThreadId ? bindingBeforeCommit : {},
+							threadId: effectiveThreadId,
+							...clientId ? { clientId } : {},
+							cwd: resumedCwd,
+							authProfileId,
+							model: response.model,
+							modelProvider,
+							historyCoveredThrough: (/* @__PURE__ */ new Date()).toISOString()
+						}
+					})) throw new Error("Codex thread binding changed while attaching the resumed thread.");
+				} catch (error) {
+					if (client && !sameOwner) await rollbackCodexAppServerBindingSubscription(client, effectiveThreadId, retained);
+					throw error;
+				}
+				committedResponse = true;
+			};
+			const response = await deps.codexControlRequest(pluginConfig, CODEX_CONTROL_METHODS.resumeThread, {
+				threadId: normalizedThreadId,
+				excludeTurns: true
+			}, {
+				config: ctx.config,
+				agentDir: scope.agentDir,
 				authProfileId,
-				model: response.model,
-				modelProvider,
-				historyCoveredThrough: (/* @__PURE__ */ new Date()).toISOString()
-			}
-		})) throw new Error("Codex thread binding changed while attaching the resumed thread.");
-		return `Attached this OpenClaw session to Codex thread ${formatCodexDisplayText(effectiveThreadId)}.`;
+				sessionKey: ctx.sessionKey,
+				sessionId: ctx.sessionId,
+				onResponse: commitResumedThread
+			});
+			if (!committedResponse) await commitResumedThread(response);
+			return `Attached this OpenClaw session to Codex thread ${formatCodexDisplayText(normalizedThreadId)}.`;
+		})
 	});
 }
 async function bindCodexCliNodeSession(deps, ctx, parsed) {
@@ -1717,8 +1773,8 @@ async function handleNativeGoal(deps, ctx, pluginConfig, args) {
 function formatNativeGoal(response) {
 	const goal = isJsonObject(response) && isJsonObject(response.goal) ? response.goal : void 0;
 	if (!goal) return "No Codex goal is active.";
-	const objective = readString$1(goal, "objective") ?? "unknown";
-	const status = readString$1(goal, "status") ?? "unknown";
+	const objective = normalizeOptionalString(goal.objective) ?? "unknown";
+	const status = normalizeOptionalString(goal.status) ?? "unknown";
 	const tokensUsed = typeof goal.tokensUsed === "number" ? goal.tokensUsed : 0;
 	const tokenBudget = typeof goal.tokenBudget === "number" ? goal.tokenBudget : void 0;
 	return [
@@ -1758,8 +1814,16 @@ async function setConversationModel(deps, ctx, pluginConfig, args) {
 	const target = await resolveControlTarget(ctx);
 	if (!target) return "Cannot set Codex model because this command did not include a stable binding identity.";
 	if (!normalized) {
+		const currentSession = ctx.sessionId && ctx.sessionKey ? getSessionEntry({
+			storePath: resolveStorePath(ctx.config.session?.store, { agentId: target.agentId }),
+			sessionKey: ctx.sessionKey,
+			hydrateSkillPromptRefs: false,
+			readConsistency: "latest"
+		}) : void 0;
+		const selectedModel = currentSession && currentSession.sessionId === ctx.sessionId ? currentSession.modelOverride : void 0;
 		const binding = await deps.bindingStore.read(target.identity);
-		return binding?.model ? `Codex model: ${formatCodexDisplayText(binding.model)}` : "Usage: /codex model <model>";
+		const activeModel = selectedModel ?? binding?.model;
+		return activeModel ? `Codex model: ${formatCodexDisplayText(activeModel)}` : "Usage: /codex model <model>";
 	}
 	return await deps.setCodexConversationModel({
 		identity: target.identity,
@@ -1767,7 +1831,12 @@ async function setConversationModel(deps, ctx, pluginConfig, args) {
 		pluginConfig,
 		model: normalized,
 		agentDir: target.agentDir,
-		config: ctx.config
+		config: ctx.config,
+		...ctx.sessionId && ctx.sessionKey ? { session: {
+			agentId: target.agentId,
+			sessionId: ctx.sessionId,
+			sessionKey: ctx.sessionKey
+		} } : {}
 	});
 }
 async function setConversationFastMode(deps, ctx, args) {
@@ -1797,32 +1866,54 @@ async function setConversationPermissions(deps, ctx, args) {
 	});
 }
 async function startThreadAction(deps, ctx, pluginConfig, kind, args) {
-	const label = kind === "compact" ? "compaction" : "review";
-	if (args.length > 0) return `Usage: /codex ${label === "compaction" ? "compact" : label}`;
+	if (args.length > 0) return `Usage: /codex ${kind}`;
 	const target = await resolveControlTarget(ctx);
-	if (!target) return `Cannot start Codex ${label} because this command did not include a stable binding identity.`;
+	if (!target) return `Cannot start Codex ${kind === "compact" ? "compaction" : "review"} because this command did not include a stable binding identity.`;
 	const binding = await deps.bindingStore.read(target.identity);
 	if (!binding?.threadId) return `No Codex thread is attached to this OpenClaw session yet.`;
+	if (kind === "compact") {
+		const sessionTarget = ctx.sessionTarget;
+		if (!ctx.sessionId || !ctx.sessionKey || !sessionTarget || sessionTarget.sessionId !== ctx.sessionId || sessionTarget.sessionKey !== ctx.sessionKey) return "Codex compaction is unavailable because this command is not bound to a complete session identity.";
+		const currentSession = getSessionEntry({
+			storePath: sessionTarget.storePath,
+			sessionKey: ctx.sessionKey,
+			hydrateSkillPromptRefs: false,
+			readConsistency: "latest"
+		});
+		if (currentSession?.sessionId !== ctx.sessionId || resolvePersistedSessionRuntimeId(currentSession) !== "codex") return "Codex compaction is unavailable because the current OpenClaw session is not using the Codex runtime.";
+		if (target.identity.kind === "conversation") {
+			if (!isSameCodexAppServerThreadOwner(binding, ctx.sessionId ? await deps.bindingStore.read(sessionBindingIdentity({
+				sessionId: ctx.sessionId,
+				sessionKey: ctx.sessionKey,
+				agentId: sessionTarget.agentId,
+				config: ctx.config
+			})) : void 0)) return "Codex compaction is unavailable because the conversation-bound thread differs from the current session binding. Resume that thread into the session first.";
+		}
+		const compactCurrent = ctx.runtimeContext?.compactCurrent;
+		if (!compactCurrent) return "Codex compaction is unavailable because this command is not bound to a session.";
+		const result = await compactCurrent();
+		return result.compacted ? `Compacted Codex session (${result.tokensAfter ?? "unknown"} tokens after).` : `Codex compaction did not complete: ${formatCodexDisplayText(result.reason ?? "no reason returned")}.`;
+	}
 	const connection = resolveCodexBindingAppServerConnection({
 		binding,
 		authProfileId: binding.authProfileId,
 		pluginConfig
 	});
-	await deps.codexControlRequest(pluginConfig, kind === "compact" ? CODEX_CONTROL_METHODS.compact : CODEX_CONTROL_METHODS.review, kind === "review" ? {
+	await deps.codexControlRequest(pluginConfig, CODEX_CONTROL_METHODS.review, {
 		threadId: binding.threadId,
 		target: { type: "uncommittedChanges" }
-	} : { threadId: binding.threadId }, {
+	}, {
 		agentDir: target.agentDir,
 		authProfileId: connection.clientAuthProfileId,
 		config: ctx.config,
 		...connection.usesSupervisionConnection ? { startOptions: connection.appServer.start } : {}
 	});
-	return `Started Codex ${label} for thread ${formatCodexDisplayText(binding.threadId)}.`;
+	return `Started Codex review for thread ${formatCodexDisplayText(binding.threadId)}.`;
 }
 //#endregion
 //#region extensions/codex/src/command-plugins-management.ts
 const POLICY_REFRESH_HINT = "New Codex conversations pick this up automatically. Use /new or /reset to refresh the current one.";
-async function handleCodexPluginsSubcommand(ctx, rest, io) {
+async function handleCodexPluginsSubcommand(ctx, rest, io, runtime) {
 	const [verb = "list", ...args] = rest;
 	const normalized = verb.toLowerCase();
 	if (normalized === "menu") {
@@ -1838,22 +1929,51 @@ async function handleCodexPluginsSubcommand(ctx, rest, io) {
 		const current = await io.readConfig();
 		return { text: formatPluginList(current.plugins ?? {}, { globalEnabled: current.enabled === true }) };
 	}
+	if (normalized === "available") {
+		if (args.length > 0) return { text: "Usage: /codex plugins available" };
+		if (!canMutateCodexHost(ctx)) return { text: "Only an owner or operator.admin gateway client can list available Codex plugins." };
+		if (!runtime) return { text: "Codex plugin discovery is unavailable for this command." };
+		try {
+			const discovered = await discoverCodexMarketplacePlugins({
+				request: runtime.list,
+				workspaceDir: await runtime.workspaceDir()
+			});
+			return { text: formatAvailablePlugins(discovered.plugins, discovered.warnings) };
+		} catch (error) {
+			return { text: `Could not list Codex plugins: ${formatCodexDisplayText(errorMessage(error))}` };
+		}
+	}
+	if (normalized === "install") {
+		if (args.length !== 1 || !args[0]) return { text: "Usage: /codex plugins install <plugin>@<marketplace>" };
+		if (!canMutateCodexHost(ctx)) return { text: "Only an owner or operator.admin gateway client can run /codex plugins install." };
+		if (!runtime) return { text: "Codex plugin installation is unavailable for this command." };
+		return await installCodexPlugin(args[0], io, runtime);
+	}
 	const target = args[0];
 	if (normalized === "enable" || normalized === "disable") {
 		if (args.length === 0) return buildPluginNamePickerReply(normalized, await io.readConfig());
 		if (!target || args.length > 1) return { text: `Usage: /codex plugins ${normalized} <name>` };
 		if (!canMutateCodexHost(ctx)) return { text: `Only an owner or operator.admin gateway client can run /codex plugins ${normalized}.` };
 		const wantEnabled = normalized === "enable";
-		if (!((await io.readConfig()).plugins ?? {})[target]) return { text: `Codex sub-plugin '${formatCodexDisplayText(target)}' is not configured. Run '/codex plugins list' to see configured plugins.` };
+		const current = (await io.readConfig()).plugins ?? {};
+		const exact = current[target];
+		const requested = parseCodexPluginMarketplaceId(target);
+		const configured = exact && requested && !matchesConfiguredPluginIdentity(exact, requested, target) ? {
+			status: "matched",
+			configKey: target
+		} : resolveConfiguredPluginKey(current, target);
+		if (configured.status === "ambiguous" || configured.status === "mismatched") return { text: describeConfiguredPluginIdentityConflict(target, configured.status) };
+		if (configured.status === "missing") return { text: `Codex sub-plugin '${formatCodexDisplayText(target)}' is not configured. Run '/codex plugins list' to see configured plugins.` };
+		const configKey = configured.configKey;
 		await io.mutate((block) => {
 			if (wantEnabled) block.enabled = true;
 			block.plugins ??= {};
-			block.plugins[target] = {
-				...block.plugins[target],
+			block.plugins[configKey] = {
+				...block.plugins[configKey],
 				enabled: wantEnabled
 			};
 		});
-		return { text: `${formatCodexDisplayText(target)}: ${wantEnabled ? "enabled" : "disabled"} in openclaw.json. ${POLICY_REFRESH_HINT}` };
+		return { text: `${formatCodexDisplayText(configKey)}: ${wantEnabled ? "enabled" : "disabled"} in openclaw.json. ${POLICY_REFRESH_HINT}` };
 	}
 	return { text: `Unknown /codex plugins subcommand: ${formatCodexDisplayText(verb)}\n\n${buildPluginsHelp()}` };
 }
@@ -1863,9 +1983,10 @@ function buildPluginsMenuReply() {
 			"Codex sub-plugins. Pick a sub-action or type:",
 			"",
 			"  1. /codex plugins list",
-			"  2. /codex plugins enable",
-			"  3. /codex plugins disable",
-			"  4. /codex plugins help",
+			"  2. /codex plugins available",
+			"  3. /codex plugins enable",
+			"  4. /codex plugins disable",
+			"  5. /codex plugins help",
 			"",
 			"Type '/codex' to go back to the main menu."
 		].join("\n"),
@@ -1874,6 +1995,10 @@ function buildPluginsMenuReply() {
 				label: "list",
 				command: "/codex plugins list"
 			},
+			{
+				label: "available",
+				command: "/codex plugins available"
+			},
 			{
 				label: "enable",
 				command: "/codex plugins enable"
@@ -1935,13 +2060,195 @@ function buildPluginNamePickerReply(verb, current) {
 }
 function buildPluginsHelp() {
 	return [
-		"Codex sub-plugin management (writes only to ~/.openclaw/openclaw.json, never to ~/.codex/config.toml):",
-		"- /codex plugins                  (alias for list)",
-		"- /codex plugins list             show all configured Codex sub-plugins",
-		"- /codex plugins enable <name>    enable a configured sub-plugin",
-		"- /codex plugins disable <name>   disable a configured sub-plugin"
+		"Codex plugin discovery and owner-approved installation:",
+		"- /codex plugins                            (alias for list)",
+		"- /codex plugins list                       show explicitly configured plugins",
+		"- /codex plugins available                  list discoverable Codex marketplaces",
+		"- /codex plugins install <name>@<marketplace>  install and authorize one plugin",
+		"- /codex plugins enable <name>              enable a configured plugin",
+		"- /codex plugins disable <name>             disable a configured plugin",
+		"Only an owner or operator.admin can discover, install, enable, or disable plugins."
 	].join("\n");
 }
+async function installCodexPlugin(requestedId, io, runtime) {
+	const requested = parseCodexPluginMarketplaceId(requestedId);
+	if (!requested) return { text: "Invalid plugin identifier. Use /codex plugins install <plugin>@<marketplace> with ASCII letters, digits, underscores, or hyphens." };
+	let plugin;
+	let workspaceDir;
+	try {
+		workspaceDir = await runtime.workspaceDir();
+		const matching = (await discoverCodexMarketplacePlugins({
+			request: runtime.list,
+			workspaceDir
+		})).plugins.filter((candidate) => candidate.pluginName === requested.pluginName && marketplaceNamesRepresentSameCatalog(candidate.marketplaceName, requested.marketplaceName));
+		if (matching.length > 1) {
+			plugin = resolveCuratedMarketplaceAliases(matching, requested.marketplaceName);
+			if (!plugin) return { text: `Multiple available Codex plugins match '${formatCodexDisplayText(requestedId)}'; the marketplace identity must be unique.` };
+		} else plugin = matching[0];
+	} catch (error) {
+		return { text: `Could not verify the requested Codex plugin: ${formatCodexDisplayText(errorMessage(error))}` };
+	}
+	if (!plugin) return { text: `${formatCodexDisplayText(requestedId)} was not found. Run /codex plugins available to inspect the current marketplaces.` };
+	if (!plugin.available) return { text: `${formatCodexDisplayText(requestedId)} is unavailable or disabled by its marketplace administrator.` };
+	const alreadyInstalled = plugin.installed && plugin.enabled;
+	if (!alreadyInstalled && !plugin.marketplacePath && plugin.remotePluginId) {
+		if (plugin.mustShowInstallationInterstitial === true) return { text: `${formatCodexDisplayText(requestedId)} requires a Codex installation confirmation that OpenClaw cannot display. Install it in Codex first, then rerun this command to authorize it here.` };
+		if (plugin.mustShowInstallationInterstitial !== false) return { text: `${formatCodexDisplayText(requestedId)} cannot be installed because Codex did not provide its required installation-confirmation policy. Install it in Codex first, then rerun this command to authorize it here.` };
+	}
+	try {
+		const configured = resolveInstalledPluginKey((await io.readConfig()).plugins ?? {}, plugin);
+		if (configured.status === "ambiguous" || configured.status === "mismatched") return { text: describeConfiguredPluginIdentityConflict(requestedId, configured.status) };
+	} catch (error) {
+		return { text: `Could not verify existing Codex plugin authorization: ${formatCodexDisplayText(errorMessage(error))}` };
+	}
+	let result;
+	if (!alreadyInstalled) {
+		const requestParams = plugin.marketplacePath ? {
+			marketplacePath: plugin.marketplacePath,
+			pluginName: plugin.pluginName
+		} : plugin.remotePluginId ? {
+			remoteMarketplaceName: plugin.marketplaceName,
+			pluginName: plugin.remotePluginId
+		} : void 0;
+		if (!requestParams) return { text: `${formatCodexDisplayText(requestedId)} cannot be installed because its marketplace did not provide a trusted local path or remote plugin identifier.` };
+		try {
+			result = await runtime.install(requestParams);
+		} catch (error) {
+			return { text: `Could not install ${formatCodexDisplayText(requestedId)}: ${formatCodexDisplayText(errorMessage(error))}` };
+		}
+	}
+	const selectedPlugin = plugin;
+	try {
+		await io.mutate((block) => {
+			block.plugins ??= {};
+			const configured = resolveInstalledPluginKey(block.plugins, selectedPlugin);
+			if (configured.status === "ambiguous" || configured.status === "mismatched") throw new Error(describeConfiguredPluginIdentityConflict(selectedPlugin.id, configured.status));
+			const curated = isOpenAiCuratedMarketplaceName(selectedPlugin.marketplaceName);
+			const canonicalId = curated ? `${selectedPlugin.pluginName}@${CODEX_PLUGINS_MARKETPLACE_NAME}` : selectedPlugin.id;
+			const configKey = configured.status === "matched" ? configured.configKey : canonicalId;
+			const existing = block.plugins[configKey];
+			block.enabled = true;
+			const updated = {
+				...existing,
+				enabled: true,
+				marketplaceName: existing?.marketplaceName ?? (curated ? "openai-curated" : selectedPlugin.marketplaceName),
+				pluginName: existing?.pluginName ?? (curated ? selectedPlugin.pluginName : persistedPluginName(selectedPlugin))
+			};
+			block.plugins[configKey] = updated;
+		});
+	} catch (error) {
+		return { text: `${formatCodexDisplayText(requestedId)} was installed in Codex but could not be authorized in OpenClaw and will not be exposed: ${formatCodexDisplayText(errorMessage(error))}` };
+	}
+	let refreshWarning = "";
+	if (runtime.refresh) try {
+		refreshWarning = (await runtime.refresh(workspaceDir)).diagnostics.map((diagnostic) => ` ${formatCodexDisplayText(diagnostic.message)}`).join("");
+	} catch (error) {
+		refreshWarning = ` Runtime refresh requires a new conversation: ${formatCodexDisplayText(errorMessage(error))}`;
+	}
+	const appsNeedingAuth = result?.appsNeedingAuth ?? [];
+	if (appsNeedingAuth.length > 0) {
+		const apps = appsNeedingAuth.map((app) => formatCodexDisplayText(app.name)).slice(0, 5).join(", ");
+		return { text: `${formatCodexDisplayText(requestedId)} was installed and authorized, but ${apps} still require connector authentication. Complete sign-in before using those apps.${refreshWarning} ${POLICY_REFRESH_HINT}` };
+	}
+	const status = alreadyInstalled ? "was already installed in Codex and is now authorized" : "was installed and authorized";
+	return { text: `${formatCodexDisplayText(requestedId)} ${status}.${refreshWarning} ${POLICY_REFRESH_HINT}` };
+}
+/** Merge historical curated wire aliases only when they identify the same install source. */
+function resolveCuratedMarketplaceAliases(plugins, requestedMarketplaceName) {
+	if (!isOpenAiCuratedMarketplaceName(requestedMarketplaceName)) return;
+	const sourceIdentities = new Set(plugins.map((plugin) => plugin.marketplacePath ? `local:${plugin.marketplacePath}` : plugin.remotePluginId ? `remote:${plugin.remotePluginId}` : void 0));
+	if (sourceIdentities.size !== 1 || sourceIdentities.has(void 0)) return;
+	const selected = plugins.find((plugin) => plugin.marketplaceName === requestedMarketplaceName) ?? plugins[0];
+	if (!selected) return;
+	return {
+		...selected,
+		installed: plugins.some((plugin) => plugin.installed),
+		enabled: plugins.some((plugin) => plugin.installed && plugin.enabled),
+		available: plugins.every((plugin) => plugin.available),
+		...selected.remotePluginId ? { mustShowInstallationInterstitial: plugins.some((plugin) => plugin.mustShowInstallationInterstitial === true) ? true : plugins.every((plugin) => plugin.mustShowInstallationInterstitial === false) ? false : null } : {},
+		...plugins.some((plugin) => plugin.installPolicy === "NOT_AVAILABLE") ? { installPolicy: "NOT_AVAILABLE" } : {}
+	};
+}
+function persistedPluginName(plugin) {
+	return !plugin.marketplacePath && plugin.summaryId.endsWith(`@${plugin.marketplaceName}`) ? plugin.summaryId : plugin.pluginName;
+}
+function resolveConfiguredPluginKey(plugins, target) {
+	const requested = parseCodexPluginMarketplaceId(target);
+	const direct = plugins[target];
+	if (!requested) {
+		if (!direct) return { status: "missing" };
+		const qualifiedName = direct.pluginName ? parseCodexPluginMarketplaceId(direct.pluginName) : void 0;
+		if (qualifiedName && direct.marketplaceName && !marketplaceNamesRepresentSameCatalog(qualifiedName.marketplaceName, direct.marketplaceName)) return { status: "mismatched" };
+		const identity = resolveConfiguredPluginIdentity(direct);
+		if (!identity) return {
+			status: "matched",
+			configKey: target
+		};
+		const marketplaceName = isOpenAiCuratedMarketplaceName(identity.marketplaceName) ? CODEX_PLUGINS_MARKETPLACE_NAME : identity.marketplaceName;
+		const canonicalId = `${identity.pluginName}@${marketplaceName}`;
+		const canonical = plugins[canonicalId];
+		if (canonical && !matchesConfiguredPluginIdentity(canonical, identity, canonicalId)) return { status: "mismatched" };
+		return Object.values(plugins).filter((entry) => matchesConfiguredPluginIdentity(entry, identity, canonicalId)).length > 1 ? { status: "ambiguous" } : {
+			status: "matched",
+			configKey: target
+		};
+	}
+	if (direct && !matchesConfiguredPluginIdentity(direct, requested, target)) return { status: "mismatched" };
+	const matching = Object.entries(plugins).filter(([, entry]) => matchesConfiguredPluginIdentity(entry, requested, target));
+	if (matching.length > 1) return { status: "ambiguous" };
+	const configKey = matching[0]?.[0];
+	return configKey ? {
+		status: "matched",
+		configKey
+	} : { status: "missing" };
+}
+function resolveInstalledPluginKey(plugins, plugin) {
+	const discovered = resolveConfiguredPluginKey(plugins, plugin.id);
+	if (discovered.status === "ambiguous" || discovered.status === "mismatched") return discovered;
+	if (!isOpenAiCuratedMarketplaceName(plugin.marketplaceName)) return discovered;
+	const canonical = resolveConfiguredPluginKey(plugins, `${plugin.pluginName}@${CODEX_PLUGINS_MARKETPLACE_NAME}`);
+	if (canonical.status === "ambiguous" || canonical.status === "mismatched") return canonical;
+	if (discovered.status === "matched" && canonical.status === "matched" && discovered.configKey !== canonical.configKey) return { status: "ambiguous" };
+	return canonical.status === "matched" ? canonical : discovered;
+}
+function resolveConfiguredPluginIdentity(entry) {
+	if (!entry.pluginName || !entry.marketplaceName) return;
+	const qualified = parseCodexPluginMarketplaceId(entry.pluginName);
+	if (qualified) return marketplaceNamesRepresentSameCatalog(qualified.marketplaceName, entry.marketplaceName) ? {
+		pluginName: qualified.pluginName,
+		marketplaceName: entry.marketplaceName
+	} : void 0;
+	return parseCodexPluginMarketplaceId(`${entry.pluginName}@${entry.marketplaceName}`);
+}
+function matchesConfiguredPluginIdentity(entry, requested, target) {
+	const configuredName = entry.pluginName ? parseCodexPluginMarketplaceId(entry.pluginName) : void 0;
+	return typeof entry.marketplaceName === "string" && marketplaceNamesRepresentSameCatalog(entry.marketplaceName, requested.marketplaceName) && (entry.pluginName === requested.pluginName || entry.pluginName === target || configuredName?.pluginName === requested.pluginName && marketplaceNamesRepresentSameCatalog(configuredName.marketplaceName, requested.marketplaceName));
+}
+function marketplaceNamesRepresentSameCatalog(left, right) {
+	return left === right || isOpenAiCuratedMarketplaceName(left) && isOpenAiCuratedMarketplaceName(right);
+}
+function describeConfiguredPluginIdentityConflict(target, status) {
+	const identity = formatCodexDisplayText(target);
+	return status === "ambiguous" ? `Multiple configured Codex plugins match '${identity}'; resolve duplicate plugin policies first.` : `Configured Codex plugin key '${identity}' points to a different plugin identity; resolve the configuration conflict first.`;
+}
+function formatAvailablePlugins(plugins, warnings) {
+	if (plugins.length === 0) return ["No Codex plugins were discovered for the current workspace.", ...warnings.map((warning) => `Warning: ${formatCodexDisplayText(warning)}`)].join("\n");
+	return [
+		"Discoverable Codex plugins:",
+		...plugins.slice(0, 30).map((plugin) => {
+			const state = plugin.installed ? plugin.enabled ? "installed" : "installed, disabled" : plugin.available ? "available" : "unavailable";
+			const description = plugin.description ? ` - ${formatCodexDisplayText(plugin.description)}` : "";
+			return `- ${plugin.id} (${state})${description}`;
+		}),
+		...plugins.length > 30 ? ["- Additional plugins omitted."] : [],
+		...warnings.map((warning) => `Warning: ${formatCodexDisplayText(warning)}`),
+		"To authorize one plugin, an owner or operator.admin must send:",
+		"/codex plugins install <plugin>@<marketplace>"
+	].join("\n");
+}
+function errorMessage(error) {
+	return error instanceof Error ? error.message : String(error);
+}
 function formatPluginList(plugins, options = {}) {
 	const globalEnabled = options.globalEnabled === true;
 	const keys = Object.keys(plugins).toSorted();
@@ -1981,7 +2288,76 @@ async function handleCodexSubcommand(ctx, options) {
 	if (sandboxBlock) return { text: sandboxBlock };
 	if (normalized === "plugins") {
 		if (!deps.codexPluginsManagementIo) return { text: "Codex sub-plugin management is not wired up (codexPluginsManagementIo dep is undefined). Edit ~/.openclaw/openclaw.json or use `openclaw config patch` until the runtime exposes the IO." };
-		return await handleCodexPluginsSubcommand(ctx, rest, deps.codexPluginsManagementIo);
+		let appServerScope;
+		const getAppServerScope = () => appServerScope ??= resolveCommandAppServerScope(deps, ctx, options.pluginConfig);
+		return await handleCodexPluginsSubcommand(ctx, rest, deps.codexPluginsManagementIo, {
+			workspaceDir: async () => {
+				const data = readCodexConversationBindingData(await ctx.getCurrentConversationBinding());
+				return (data?.kind === "codex-app-server-session" ? data.workspaceDir : void 0)?.trim() || deps.resolveCodexDefaultWorkspaceDir(options.pluginConfig);
+			},
+			list: async (requestParams) => {
+				const scope = await getAppServerScope();
+				return await deps.codexControlRequest(options.pluginConfig, CODEX_CONTROL_METHODS.listPlugins, requestParams, {
+					...scope,
+					config: ctx.config
+				});
+			},
+			install: async (requestParams) => {
+				const scope = await getAppServerScope();
+				return await deps.codexControlRequest(options.pluginConfig, CODEX_CONTROL_METHODS.installPlugin, requestParams, {
+					...scope,
+					config: ctx.config
+				});
+			},
+			refresh: async (workspaceDir) => {
+				const scope = await getAppServerScope();
+				const configuredAppServer = resolveCodexAppServerRuntimeOptions({ pluginConfig: options.pluginConfig });
+				const appServer = scope.startOptions ? {
+					...configuredAppServer,
+					start: scope.startOptions
+				} : configuredAppServer;
+				const authProfileId = scope.authProfileId ?? void 0;
+				const accountId = await resolveCodexAppServerAuthAccountCacheKey({
+					authProfileId,
+					agentDir: scope.agentDir,
+					config: ctx.config
+				});
+				const client = await getLeasedSharedCodexAppServerClient({
+					startOptions: appServer.start,
+					pluginConfig: options.pluginConfig,
+					authProfileId: scope.authProfileId,
+					agentDir: scope.agentDir,
+					config: ctx.config
+				});
+				try {
+					const appCacheKey = buildCodexPluginAppCacheKey({
+						appServer,
+						agentDir: scope.agentDir,
+						authProfileId,
+						accountId,
+						envApiKeyFingerprint: authProfileId ? void 0 : resolveCodexAppServerFallbackApiKeyCacheKey({ startOptions: appServer.start }),
+						appServerVersion: client.getServerVersion(),
+						runtimeIdentity: client.getRuntimeIdentity()
+					});
+					defaultCodexPluginMetadataCache.invalidate(appCacheKey);
+					return await refreshCodexPluginRuntimeState({
+						configCwd: workspaceDir,
+						appCache: defaultCodexAppInventoryCache,
+						appCacheKey,
+						metadataCache: defaultCodexPluginMetadataCache,
+						request: async (method, requestParams) => {
+							const requestMethod = resolvePluginRuntimeRefreshMethod(method);
+							return await deps.codexControlRequest(options.pluginConfig, requestMethod, requestParams, {
+								...scope,
+								config: ctx.config
+							});
+						}
+					});
+				} finally {
+					releaseLeasedSharedCodexAppServerClient(client);
+				}
+			}
+		});
 	}
 	if (normalized === "status") {
 		if (rest.length > 0) return { text: "Usage: /codex status" };
@@ -2062,5 +2438,18 @@ async function handleCodexSubcommand(ctx, options) {
 	}
 	return { text: `Unknown Codex command: ${formatCodexDisplayText(subcommand)}\n\n${buildHelp()}` };
 }
+function resolvePluginRuntimeRefreshMethod(method) {
+	const recognized = [
+		CODEX_CONTROL_METHODS.listPlugins,
+		CODEX_CONTROL_METHODS.listSkills,
+		CODEX_CONTROL_METHODS.listHooks,
+		CODEX_CONTROL_METHODS.reloadMcpServers,
+		CODEX_CONTROL_METHODS.installedApps,
+		CODEX_CONTROL_METHODS.listApps,
+		CODEX_CONTROL_METHODS.readApps
+	].find((candidate) => candidate === method);
+	if (!recognized) throw new Error(`Unexpected Codex plugin refresh method: ${method}`);
+	return recognized;
+}
 //#endregion
 export { handleCodexSubcommand };