@openclaw/codex 2026.8.1-beta.2 → 2026.8.1

package/dist/{command-handlers-Db8pu_ds.js → command-handlers-BvOAHTrA.js}

@@ -1,28 +1,30 @@
-import { D as CODEX_PLUGINS_MARKETPLACE_NAME, P as isCodexFastServiceTier, c as reclaimCurrentCodexSessionGeneration, d as sessionBindingIdentity, g as resolveCodexAppServerRuntimeOptions, i as createCodexSessionGenerationSupersededError, n as assertCodexBindingMayBeReplaced, r as bindingStoreKey, s as normalizeCodexAppServerBindingModelProvider } from "./session-binding-DPxIvMgE.js";
-import { Q as resolveCodexAppServerAuthAccountCacheKey, V as consumeCodexAppServerLiveThread, a as getLeasedSharedCodexAppServerClient, ct as isJsonObject, et as resolveCodexAppServerAuthProfileIdForAgent, l as releaseLeasedSharedCodexAppServerClient, tt as resolveCodexAppServerFallbackApiKeyCacheKey } from "./shared-client-kIBbGjk4.js";
-import { i as assertCodexThreadResumeResponse } from "./protocol-validators-B4F7L8Rf.js";
-import { t as listAllCodexAppServerModels } from "./models-BFlpn1Ex.js";
-import { i as defaultCodexAppInventoryCache, r as buildCodexPluginAppCacheKey } from "./plugin-app-cache-key-C3H2CVp6.js";
-import { Y as isOpenAiCuratedMarketplaceName, q as refreshCodexPluginRuntimeState } from "./thread-lifecycle-Bu1BTDXr.js";
-import { t as isIncognitoSessionKey } from "./incognito-session-ET_ufDH-.js";
-import { t as CODEX_CONTROL_METHODS } from "./capabilities-CybGI1oz.js";
-import { s as summarizeCodexAccountUsage } from "./rate-limits-DZXmOL8-.js";
-import { a as formatComputerUseStatus, c as formatSkills, i as formatCodexStatus, l as formatThreads, n as formatAccount, o as formatList, r as formatCodexDisplayText, s as formatModels, t as buildHelp } from "./command-formatters-B1AEz8ZA.js";
-import { n as resolveCodexNativeExecutionBlock, r as resolveCodexNativeSandboxBlock } from "./sandbox-guard-Cmwc9eIk.js";
-import { a as rollbackCodexAppServerBindingSubscription, i as retireCodexConversationThreadBinding, n as releaseCodexAppServerBindingSubscription, o as withCodexConversationThreadActivity, r as retainCodexAppServerBindingSubscription, s as withExclusiveCodexAppServerThread, t as isSameCodexAppServerThreadOwner } from "./thread-ownership-6kOQHlyC.js";
-import { a as parseCodexPermissionsModeArg, c as setCodexConversationModel, d as stopCodexConversationTurn, i as parseCodexFastModeArg, l as setCodexConversationPermissions, m as canMutateCodexHost, n as parseCodexPluginMarketplaceId, o as readCodexConversationActiveTurn, p as CODEX_NATIVE_EXECUTION_AUTH_ERROR, r as formatPermissionsMode, s as setCodexConversationFastMode, t as discoverCodexMarketplacePlugins, u as steerCodexConversationTurn } from "./plugin-marketplace-discovery-CzrGJdCR.js";
+import { i as resolveCodexAppServerRuntimeOptions, j as CODEX_PLUGINS_MARKETPLACE_NAME, k as isCodexFastServiceTier } from "./config-Cxw3Cl3k.js";
+import { Ft as resolveCodexAppServerFallbackApiKeyCacheKey, Ht as isJsonObject, Nt as resolveCodexAppServerAuthProfileIdForAgent, c as getLeasedSharedCodexAppServerClient, gt as consumeCodexAppServerLiveThread, h as releaseLeasedSharedCodexAppServerClient, jt as resolveCodexAppServerAuthAccountCacheKey, vt as hasCodexAppServerLiveThread } from "./shared-client-kNkljY-R.js";
+import { c as reclaimCurrentCodexSessionGeneration, d as sessionBindingIdentity, i as createCodexSessionGenerationSupersededError, n as assertCodexBindingMayBeReplaced, r as bindingStoreKey, s as normalizeCodexAppServerBindingModelProvider } from "./session-binding-q2WSTVmC.js";
+import { o as assertCodexThreadResumeResponse, r as assertCodexThreadAcceptsDirectInput } from "./protocol-validators-Bg5rpNxk.js";
+import { a as closeCodexStartupClientBestEffort } from "./attempt-client-cleanup-CVPvp9dL.js";
+import { t as listAllCodexAppServerModels } from "./models-DgFWSuxA.js";
+import { i as buildCodexPluginAppCacheKey, s as defaultCodexAppInventoryCache } from "./thread-resume-DF54hagX.js";
+import { dt as isOpenAiCuratedMarketplaceName, lt as refreshCodexPluginRuntimeState } from "./thread-lifecycle-Ss-uwnC4.js";
+import { a as rollbackCodexAppServerBindingSubscription, c as withExclusiveCodexAppServerThread, i as retireCodexConversationThreadBinding, l as isIncognitoSessionKey, n as releaseCodexAppServerBindingSubscription, r as retainCodexAppServerBindingSubscription, s as withCodexConversationThreadActivity, t as isSameCodexAppServerThreadOwner } from "./thread-ownership-CeYBqg_4.js";
+import { c as resolveCodexNativeSandboxBlock, s as resolveCodexNativeExecutionBlock } from "./request-CCm4LaED.js";
+import { t as CODEX_CONTROL_METHODS } from "./capabilities-CGm_94eL.js";
+import { s as summarizeCodexAccountUsage } from "./rate-limits-hFtzt2Up.js";
+import { a as formatComputerUseStatus, c as formatSkills, i as formatCodexStatus, l as formatThreads, n as formatAccount, o as formatList, r as formatCodexDisplayText, s as formatModels, t as buildHelp } from "./command-formatters-C54Yg3eA.js";
+import { _ as hasCodexAdminScope, a as parseCodexPermissionsModeArg, c as setCodexConversationModel, d as stopCodexConversationTurn, g as canMutateCodexHost, h as CODEX_NATIVE_EXECUTION_AUTH_ERROR, i as parseCodexFastModeArg, l as setCodexConversationPermissions, m as CODEX_HOST_INSPECTION_AUTH_ERROR, n as parseCodexPluginMarketplaceId, o as readCodexConversationActiveTurn, p as CODEX_FULL_PERMISSIONS_AUTH_ERROR, r as formatPermissionsMode, s as setCodexConversationFastMode, t as discoverCodexMarketplacePlugins, u as steerCodexConversationTurn } from "./plugin-marketplace-discovery-mdmScYOj.js";
 import { i as readCodexConversationBindingData, n as createCodexCliNodeConversationBindingData, o as resolveCodexDefaultWorkspaceDir, r as createCodexConversationBindingData } from "./conversation-binding-data-CW2GuupV.js";
-import { n as resolveCodexBindingAppServerConnection } from "./binding-connection-I5Bo-AsX.js";
-import { c as readCodexStatusProbes, l as requestOptions, p as formatCodexCliSessions, s as codexControlRequest, u as safeCodexControlRequest } from "./session-catalog-xwNi_SDM.js";
-import { i as readCodexComputerUseStatus, r as installCodexComputerUse, t as defaultCodexPluginMetadataCache } from "./plugin-metadata-cache-CNJPj4_b.js";
+import { n as resolveCodexBindingAppServerConnection } from "./binding-connection-CCQFs8lf.js";
+import { c as readCodexStatusProbes, l as requestOptions, p as formatCodexCliSessions, s as codexControlRequest, u as safeCodexControlRequest } from "./session-catalog-C2Tae4rI.js";
+import { i as readCodexComputerUseStatus, r as installCodexComputerUse, t as defaultCodexPluginMetadataCache } from "./plugin-metadata-cache-CulOABwu.js";
 import { normalizeOptionalString, normalizeUniqueStringEntries } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { parseStrictPositiveInteger } from "openclaw/plugin-sdk/number-runtime";
 import crypto from "node:crypto";
-import { ensureAuthProfileStore, findNormalizedProviderValue, resolveAgentDir, resolveAuthProfileEligibility, resolveAuthProfileOrder, resolveProfileUnusableUntilForDisplay, resolveSessionAgentIds } from "openclaw/plugin-sdk/agent-runtime";
-import { parseAgentSessionKey } from "openclaw/plugin-sdk/routing";
+import { ensureAuthProfileStore, findNormalizedProviderValue, resolveAgentDir, resolveAuthProfileEligibility, resolveAuthProfileOrder, resolveProfileUnusableUntilForDisplay } from "openclaw/plugin-sdk/agent-runtime";
+import { resolveSessionAgentIdsStrict } from "openclaw/plugin-sdk/agent-scope-runtime";
 import { getSessionEntry, resolveStorePath } from "openclaw/plugin-sdk/session-store-runtime";
 import { truncateUtf16Safe } from "openclaw/plugin-sdk/text-utility-runtime";
 import { expectDefined } from "openclaw/plugin-sdk/expect-runtime";
+import { parseAgentSessionKey } from "openclaw/plugin-sdk/routing";
 import { MODEL_SELECTION_LOCKED_MESSAGE, isModelSelectionLocked, resolvePersistedSessionRuntimeId } from "openclaw/plugin-sdk/model-session-runtime";
 //#region extensions/codex/src/command-account.ts
 const OPENAI_PROVIDER_ID = "openai";
@@ -49,8 +51,8 @@ async function readCodexAccountAuthOverview(params) {
 		limits: params.limits,
 		now
 	});
-	const subscriptionProfileId = order.find((profileId) => isChatGptSubscriptionProfile(store.profiles[profileId]));
 	const activeIsSubscription = activeProfileId !== void 0 && isChatGptSubscriptionProfile(store.profiles[activeProfileId]);
+	const subscriptionProfileId = activeIsSubscription ? activeProfileId : order.find((profileId) => isChatGptSubscriptionProfile(store.profiles[profileId]));
 	const activeUsage = activeIsSubscription && params.limits.ok ? summarizeCodexAccountUsage(params.limits.value, now) : void 0;
 	const subscriptionUsage = subscriptionProfileId && (!activeIsSubscription || subscriptionProfileId !== activeProfileId) ? await readSubscriptionUsage({
 		...params,
@@ -155,13 +157,20 @@ function resolveLiveAccountProfileId(params) {
 	const type = normalizeOptionalString(account.type)?.toLowerCase();
 	if (type === "chatgpt") {
 		const email = normalizeOptionalString(account.email)?.toLowerCase();
-		const firstSubscription = params.order.find((profileId) => isChatGptSubscriptionProfile(params.store.profiles[profileId]));
-		if (!email) return firstSubscription;
-		return params.order.find((profileId) => {
-			const credential = params.store.profiles[profileId];
-			if (!credential || !isChatGptSubscriptionProfile(credential)) return false;
-			return (credential.email?.trim().toLowerCase() ?? extractEmailFromProfileId(profileId))?.toLowerCase() === email;
-		}) ?? firstSubscription;
+		const accountId = normalizeOptionalString(account.accountId ?? account.chatgptAccountId);
+		const subscriptionProfiles = params.order.filter((profileId) => isChatGptSubscriptionProfile(params.store.profiles[profileId]));
+		if (accountId) {
+			const exactWorkspace = subscriptionProfiles.find((profileId) => {
+				const credential = params.store.profiles[profileId];
+				return credential && "accountId" in credential && credential.accountId === accountId;
+			});
+			if (exactWorkspace) return exactWorkspace;
+		}
+		const matchingProfiles = email ? subscriptionProfiles.filter((profileId) => {
+			return (params.store.profiles[profileId]?.email?.trim().toLowerCase() ?? extractEmailFromProfileId(profileId))?.toLowerCase() === email;
+		}) : subscriptionProfiles;
+		const lastGood = params.store.lastGood?.[OPENAI_PROVIDER_ID];
+		return (lastGood && matchingProfiles.includes(lastGood) ? lastGood : void 0) ?? matchingProfiles[0] ?? subscriptionProfiles[0];
 	}
 	if (type === "apikey" || type === "api_key") return params.order.find((profileId) => params.store.profiles[profileId]?.type === "api_key");
 }
@@ -1103,7 +1112,7 @@ function conversationBindingIdentity(bindingId) {
 	};
 }
 function resolveCodexConversationControlScope(ctx) {
-	const { sessionAgentId } = resolveSessionAgentIds({
+	const { sessionAgentId } = resolveSessionAgentIdsStrict({
 		sessionKey: ctx.sessionKey,
 		agentId: ctx.agentId,
 		config: ctx.config
@@ -1487,13 +1496,23 @@ async function describeConversationBinding(deps, ctx) {
 	const identity = conversationBindingIdentity(data.bindingId);
 	const threadBinding = await deps.bindingStore.read(identity);
 	const active = deps.readCodexConversationActiveTurn(identity);
+	const sessionKey = ctx.sessionKey?.trim();
+	const { agentId } = resolveCodexConversationControlScope(ctx);
+	const sessionEntry = sessionKey ? getSessionEntry({
+		agentId,
+		storePath: resolveStorePath(ctx.config.session?.store, { agentId }),
+		sessionKey,
+		hydrateSkillPromptRefs: false,
+		readConsistency: "latest"
+	}) : void 0;
+	const permissionMode = !ctx.sessionId || sessionEntry?.sessionId === ctx.sessionId ? sessionEntry?.permissionMode : void 0;
 	return [
 		"Codex conversation binding:",
 		`- Thread: ${formatCodexDisplayText(threadBinding?.threadId ?? "unknown")}`,
 		`- Workspace: ${formatCodexDisplayText(data.workspaceDir)}`,
 		`- Model: ${formatCodexDisplayText(threadBinding?.model ?? "default")}`,
 		`- Fast: ${isCodexFastServiceTier(threadBinding?.serviceTier) ? "on" : "off"}`,
-		`- Permissions: ${threadBinding ? formatPermissionsMode(threadBinding) : "default"}`,
+		`- Permissions: ${formatPermissionsMode(permissionMode)}`,
 		`- Active run: ${formatCodexDisplayText(active ? active.turnId : "none")}`,
 		`- Binding: ${formatCodexDisplayText(data.bindingId)}`
 	].join("\n");
@@ -1544,13 +1563,8 @@ async function resumeThread(deps, ctx, pluginConfig, args) {
 			})) throw createCodexSessionGenerationSupersededError(identity.sessionId);
 			const currentBinding = await deps.bindingStore.read(identity);
 			assertCodexBindingMayBeReplaced(currentBinding, "attaching a different resumed thread");
-			const authProfileId = resolveCodexAppServerAuthProfileIdForAgent({
-				authProfileId: currentBinding?.authProfileId,
-				agentDir: scope.agentDir,
-				config: ctx.config
-			});
-			let committedResponse = false;
-			const commitResumedThread = async (value, client) => {
+			let pendingResumeConfiguration = false;
+			const commitResumedThread = async (value, client, { authProfileId, assertCurrent }) => {
 				const response = assertCodexThreadResumeResponse(value);
 				const effectiveThreadId = response.thread.id;
 				if (effectiveThreadId !== normalizedThreadId) throw new Error(`Codex thread/resume returned ${effectiveThreadId} for ${normalizedThreadId}`);
@@ -1562,52 +1576,73 @@ async function resumeThread(deps, ctx, pluginConfig, args) {
 					agentDir: scope.agentDir,
 					config: ctx.config
 				});
-				const bindingBeforeCommit = await deps.bindingStore.read(identity);
-				assertCodexBindingMayBeReplaced(bindingBeforeCommit, "committing a different resumed thread");
-				const clientId = client?.getInstanceId();
-				const sameOwner = client ? isSameCodexAppServerThreadOwner(bindingBeforeCommit, {
-					threadId: effectiveThreadId,
-					clientId
-				}) : bindingBeforeCommit?.threadId === effectiveThreadId;
+				const clientId = client.getInstanceId();
 				let retained = false;
+				let sameOwner = false;
+				let knownOwnership;
 				try {
-					if (client) {
-						retained = await retainCodexAppServerBindingSubscription(client, effectiveThreadId, sameOwner ? await consumeCodexAppServerLiveThread(client, effectiveThreadId) : void 0);
-						if (!retained) throw new Error("Codex resumed thread lost its native subscription owner.");
-					}
+					const bindingBeforeCommit = await deps.bindingStore.read(identity);
+					assertCodexBindingMayBeReplaced(bindingBeforeCommit, "committing a different resumed thread");
+					sameOwner = isSameCodexAppServerThreadOwner(bindingBeforeCommit, {
+						threadId: effectiveThreadId,
+						clientId
+					});
+					const sameThreadBinding = bindingBeforeCommit?.threadId === effectiveThreadId ? bindingBeforeCommit : void 0;
+					pendingResumeConfiguration = sameThreadBinding?.preserveNativeModel !== true && (!sameThreadBinding?.dynamicToolsFingerprint || !sameThreadBinding.webSearchThreadConfigFingerprint || sameThreadBinding.pendingResumeConfiguration === true);
+					assertCurrent();
+					assertCodexThreadAcceptsDirectInput(response.thread);
+					knownOwnership = sameOwner ? await consumeCodexAppServerLiveThread(client, effectiveThreadId) : void 0;
+					assertCurrent();
+					retained = await retainCodexAppServerBindingSubscription(client, effectiveThreadId, knownOwnership);
+					assertCurrent();
+					if (!retained) throw new Error("Codex resumed thread lost its native subscription owner.");
 					if (bindingBeforeCommit && !sameOwner) await releaseCodexAppServerBindingSubscription(bindingBeforeCommit);
+					assertCurrent();
 					if (!await deps.bindingStore.mutate(identity, {
 						kind: "set",
 						binding: {
-							...bindingBeforeCommit?.threadId === effectiveThreadId ? bindingBeforeCommit : {},
+							...sameThreadBinding,
 							threadId: effectiveThreadId,
-							...clientId ? { clientId } : {},
+							clientId,
 							cwd: resumedCwd,
+							rolloutPath: response.thread.path ?? sameThreadBinding?.rolloutPath,
+							pendingResumeConfiguration: pendingResumeConfiguration ? true : void 0,
 							authProfileId,
 							model: response.model,
 							modelProvider,
 							historyCoveredThrough: (/* @__PURE__ */ new Date()).toISOString()
 						}
-					})) throw new Error("Codex thread binding changed while attaching the resumed thread.");
+					}, assertCurrent)) throw new Error("Codex thread binding changed while attaching the resumed thread.");
 				} catch (error) {
-					if (client && !sameOwner) await rollbackCodexAppServerBindingSubscription(client, effectiveThreadId, retained);
+					if (sameOwner && knownOwnership && !retained) {
+						if (!await retainCodexAppServerBindingSubscription(client, effectiveThreadId, knownOwnership)) await closeCodexStartupClientBestEffort(client);
+					} else if (retained && !sameOwner || !hasCodexAppServerLiveThread(client, effectiveThreadId)) await rollbackCodexAppServerBindingSubscription(client, effectiveThreadId, retained);
 					throw error;
 				}
-				committedResponse = true;
 			};
-			const response = await deps.codexControlRequest(pluginConfig, CODEX_CONTROL_METHODS.resumeThread, {
+			await deps.codexControlRequest(pluginConfig, CODEX_CONTROL_METHODS.resumeThread, {
 				threadId: normalizedThreadId,
 				excludeTurns: true
 			}, {
 				config: ctx.config,
+				agentId: scope.agentId,
 				agentDir: scope.agentDir,
-				authProfileId,
+				authProfileId: currentBinding?.authProfileId,
 				sessionKey: ctx.sessionKey,
 				sessionId: ctx.sessionId,
+				beforeRequest: async (request) => {
+					const { thread } = await request({
+						method: "thread/read",
+						requestParams: {
+							threadId: normalizedThreadId,
+							includeTurns: false
+						}
+					});
+					assertCodexThreadAcceptsDirectInput(thread);
+				},
 				onResponse: commitResumedThread
 			});
-			if (!committedResponse) await commitResumedThread(response);
-			return `Attached this OpenClaw session to Codex thread ${formatCodexDisplayText(normalizedThreadId)}.`;
+			return `Attached this OpenClaw session to Codex thread ${formatCodexDisplayText(normalizedThreadId)}.${pendingResumeConfiguration ? " The next turn will validate its tools and apply this session's configuration before continuing." : ""}`;
 		})
 	});
 }
@@ -1820,9 +1855,9 @@ async function setConversationModel(deps, ctx, pluginConfig, args) {
 			hydrateSkillPromptRefs: false,
 			readConsistency: "latest"
 		}) : void 0;
-		const selectedModel = currentSession && currentSession.sessionId === ctx.sessionId ? currentSession.modelOverride : void 0;
+		const selectedModel = currentSession && currentSession.sessionId === ctx.sessionId ? currentSession.modelOverride ?? currentSession.model : void 0;
 		const binding = await deps.bindingStore.read(target.identity);
-		const activeModel = selectedModel ?? binding?.model;
+		const activeModel = target.identity.kind === "conversation" ? binding?.model : selectedModel ?? binding?.model;
 		return activeModel ? `Codex model: ${formatCodexDisplayText(activeModel)}` : "Usage: /codex model <model>";
 	}
 	return await deps.setCodexConversationModel({
@@ -1831,12 +1866,7 @@ async function setConversationModel(deps, ctx, pluginConfig, args) {
 		pluginConfig,
 		model: normalized,
 		agentDir: target.agentDir,
-		config: ctx.config,
-		...ctx.sessionId && ctx.sessionKey ? { session: {
-			agentId: target.agentId,
-			sessionId: ctx.sessionId,
-			sessionKey: ctx.sessionKey
-		} } : {}
+		config: ctx.config
 	});
 }
 async function setConversationFastMode(deps, ctx, args) {
@@ -1855,14 +1885,19 @@ async function setConversationFastMode(deps, ctx, args) {
 async function setConversationPermissions(deps, ctx, args) {
 	if (args.length > 1) return "Usage: /codex permissions [default|yolo|status]";
 	const target = await resolveControlTarget(ctx);
-	if (!target) return "Cannot set Codex permissions because this command did not include a stable binding identity.";
+	if (!target || !ctx.sessionId || !ctx.sessionKey) return "Cannot set Codex permissions because this command did not include a complete session identity.";
 	const value = args[0];
 	const parsed = parseCodexPermissionsModeArg(value);
 	if (value && !parsed && value.trim().toLowerCase() !== "status") return "Usage: /codex permissions [default|yolo|status]";
+	if (parsed === "yolo" && !hasCodexAdminScope(ctx)) return CODEX_FULL_PERMISSIONS_AUTH_ERROR;
 	return await deps.setCodexConversationPermissions({
-		identity: target.identity,
-		bindingStore: deps.bindingStore,
-		mode: parsed
+		mode: parsed,
+		config: ctx.config,
+		session: {
+			agentId: target.agentId,
+			sessionId: ctx.sessionId,
+			sessionKey: ctx.sessionKey
+		}
 	});
 }
 async function startThreadAction(deps, ctx, pluginConfig, kind, args) {
@@ -2276,6 +2311,14 @@ function formatPluginList(plugins, options = {}) {
 }
 //#endregion
 //#region extensions/codex/src/command-handlers.ts
+const CODEX_HOST_INSPECTION_SUBCOMMANDS = /* @__PURE__ */ new Set([
+	"account",
+	"mcp",
+	"sessions",
+	"skills",
+	"status",
+	"threads"
+]);
 async function handleCodexSubcommand(ctx, options) {
 	const deps = resolveCodexCommandDeps(options.deps);
 	const args = splitArgs(ctx.args);
@@ -2283,6 +2326,7 @@ async function handleCodexSubcommand(ctx, options) {
 	const [subcommand = "status", ...rest] = args;
 	const normalized = subcommand.toLowerCase();
 	if (normalized === "help") return { text: buildHelp() };
+	if (CODEX_HOST_INSPECTION_SUBCOMMANDS.has(normalized) && !canMutateCodexHost(ctx)) return { text: CODEX_HOST_INSPECTION_AUTH_ERROR };
 	if (CODEX_NATIVE_CONTROL_SUBCOMMANDS.has(normalized) && !returnsBeforeNativeCodexExecution(normalized, rest) && !isReadOnlyCodexGoalCommand(normalized, rest) && !canMutateCodexHost(ctx)) return { text: CODEX_NATIVE_EXECUTION_AUTH_ERROR };
 	const sandboxBlock = resolveCodexNativeCommandSandboxBlock(ctx, normalized, rest);
 	if (sandboxBlock) return { text: sandboxBlock };

package/dist/{compact-LspQaGfl.js → compact-Hd7SAc0N.js}

@@ -1,16 +1,17 @@
-import { d as sessionBindingIdentity, t as CODEX_APP_SERVER_BINDING_GUARDED_REQUEST_TIMEOUT_MS } from "./session-binding-DPxIvMgE.js";
-import { V as consumeCodexAppServerLiveThread, a as getLeasedSharedCodexAppServerClient, ct as isJsonObject, l as releaseLeasedSharedCodexAppServerClient, q as retainCodexAppServerLiveThread, z as CodexAppServerRpcError } from "./shared-client-kIBbGjk4.js";
-import { _ as readCodexNotificationTurnId, a as closeCodexStartupClientBestEffort, d as unsubscribeCodexThreadBestEffort, g as readCodexNotificationThreadId, r as CodexAppServerUnsafeSubscriptionError, s as isCodexAlreadyTerminalInterruptError } from "./attempt-client-cleanup-DMLXUfa8.js";
-import { i as readCodexThreadContextSnapshot, x as readCodexNotificationItem } from "./event-projector-usage-e5huIQWu.js";
-import { t as isIncognitoSessionKey } from "./incognito-session-ET_ufDH-.js";
-import { t as resumeCodexAppServerThread } from "./thread-resume-CPrJNQVM.js";
-import { n as resolveCodexNativeExecutionBlock } from "./sandbox-guard-Cmwc9eIk.js";
-import { t as isSameCodexAppServerThreadOwner } from "./thread-ownership-6kOQHlyC.js";
-import { n as resolveCodexBindingAppServerConnection } from "./binding-connection-I5Bo-AsX.js";
+import { $ as CodexAppServerRpcError, Ct as retainCodexAppServerLiveThread, Ht as isJsonObject, c as getLeasedSharedCodexAppServerClient, gt as consumeCodexAppServerLiveThread, h as releaseLeasedSharedCodexAppServerClient } from "./shared-client-kNkljY-R.js";
+import { d as sessionBindingIdentity, t as CODEX_APP_SERVER_BINDING_GUARDED_REQUEST_TIMEOUT_MS } from "./session-binding-q2WSTVmC.js";
+import { _ as readCodexNotificationThreadId, a as closeCodexStartupClientBestEffort, f as unsubscribeCodexThreadBestEffort, r as CodexAppServerUnsafeSubscriptionError, s as isCodexAlreadyTerminalInterruptError, v as readCodexNotificationTurnId } from "./attempt-client-cleanup-CVPvp9dL.js";
+import { i as readCodexThreadContextSnapshot, x as readCodexNotificationItem } from "./event-projector-usage-D3PHFFXh.js";
+import { t as resumeCodexAppServerThread } from "./thread-resume-DF54hagX.js";
+import { l as isIncognitoSessionKey, t as isSameCodexAppServerThreadOwner } from "./thread-ownership-CeYBqg_4.js";
+import { s as resolveCodexNativeExecutionBlock } from "./request-CCm4LaED.js";
+import { n as resolveCodexBindingAppServerConnection } from "./binding-connection-CCQFs8lf.js";
+import { t as persistCodexContextCompactionActivity } from "./context-compaction-activity-BOeJf7yo.js";
 import { asOptionalRecord } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { createDeferred } from "openclaw/plugin-sdk/extension-shared";
 import { embeddedAgentLog, resolveCompactionTimeoutMs } from "openclaw/plugin-sdk/agent-harness-runtime";
-import { resolveAgentDir as resolveAgentDir$1, resolveDefaultAgentId } from "openclaw/plugin-sdk/agent-runtime";
+import { resolveAgentDir as resolveAgentDir$1 } from "openclaw/plugin-sdk/agent-runtime";
+import { resolveDefaultAgentId as resolveDefaultAgentId$1 } from "openclaw/plugin-sdk/agent-scope-runtime";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { coerceErrorMessage } from "openclaw/plugin-sdk/error-runtime";
 import { KeyedAsyncQueue } from "openclaw/plugin-sdk/keyed-async-queue";
@@ -54,6 +55,8 @@ function watchCodexNativeCompactionCompletion(params) {
 	};
 	const complete = () => finish({
 		completed: true,
+		...compactionTurnId ? { turnId: compactionTurnId } : {},
+		...compactionItemId ? { itemId: compactionItemId } : {},
 		...tokensAfter !== void 0 ? { tokensAfter } : {}
 	});
 	const fail = (reason) => finish({
@@ -235,11 +238,9 @@ function readIgnoredCompactionOverridePaths(params) {
 	const ignored = /* @__PURE__ */ new Set();
 	for (const entry of readCompactionOverrideEntries(params)) {
 		const localProvider = typeof entry.record.provider === "string" ? entry.record.provider.trim() : "";
-		const inheritedProvider = !localProvider && typeof entry.inheritedRecord?.provider === "string" ? entry.inheritedRecord.provider.trim() : "";
-		const providerPath = localProvider ? `${entry.path}.compaction.provider` : inheritedProvider && entry.inheritedPath ? `${entry.inheritedPath}.compaction.provider` : void 0;
 		if (typeof entry.record.model === "string" && entry.record.model.trim()) ignored.add(`${entry.path}.compaction.model`);
 		if (typeof entry.record.thinkingLevel === "string" && entry.record.thinkingLevel.trim()) ignored.add(`${entry.path}.compaction.thinkingLevel`);
-		if (providerPath) ignored.add(providerPath);
+		if (localProvider) ignored.add(`${entry.path}.compaction.provider`);
 	}
 	return [...ignored];
 }
@@ -250,17 +251,6 @@ function readCompactionOverrideEntries(params) {
 		path: "agents.defaults",
 		record: defaultRecord
 	});
-	const agentId = readAgentIdFromSessionKey(params.sessionKey ?? params.sandboxSessionKey);
-	if (!agentId) return entries;
-	const agentRecord = asOptionalRecord((Array.isArray(params.config?.agents?.list) ? params.config.agents.list : []).find((agent) => {
-		return (typeof agent?.id === "string" ? agent.id.trim().toLowerCase() : "") === agentId;
-	})?.compaction);
-	if (agentRecord) entries.push({
-		path: `agents.list.${agentId}`,
-		record: agentRecord,
-		inheritedRecord: defaultRecord,
-		inheritedPath: "agents.defaults"
-	});
 	return entries;
 }
 function readAgentIdFromSessionKey(sessionKey) {
@@ -291,6 +281,7 @@ async function compactCodexNativeThread(params, options) {
 		config: params.config,
 		sessionKey: params.sandboxSessionKey ?? params.sessionKey,
 		sessionId: params.sessionId,
+		agentId: params.agentId,
 		sandbox,
 		surface: "native compaction"
 	});
@@ -325,7 +316,7 @@ async function compactCodexNativeThread(params, options) {
 	let connection;
 	try {
 		const config = params.config ?? {};
-		const agentId = params.agentId ?? readAgentIdFromSessionKey(params.sessionKey) ?? resolveDefaultAgentId(config);
+		const agentId = params.agentId ?? readAgentIdFromSessionKey(params.sessionKey) ?? resolveDefaultAgentId$1(config);
 		connection = resolveCodexBindingAppServerConnection({
 			binding,
 			authProfileId: requestedAuthProfileId ?? binding.authProfileId,
@@ -431,27 +422,30 @@ async function compactCodexNativeThread(params, options) {
 							result: skippedCodexNativeCompactionResult(params, {
 								reason: "codex app-server compaction aborted before native compaction",
 								code: "aborted_before_native_compaction",
+								request: options.nativeCompactionRequest ?? "after_context_engine",
 								expectedThreadId: binding.threadId,
 								currentThreadId: currentBinding?.threadId
 							})
 						};
 					}
 					if (!currentBinding || !isSameNativeCompactionBinding(currentBinding, binding)) {
-						embeddedAgentLog.warn("skipping codex app-server compaction because the thread binding changed", {
+						embeddedAgentLog.warn("codex app-server compaction could not use the thread binding because it changed", {
 							sessionId: params.sessionId,
 							sessionKey: params.sessionKey,
 							expectedThreadId: binding.threadId,
 							currentThreadId: currentBinding?.threadId
 						});
+						const isRequiredPreflight = options.nativeCompactionRequest === "required_preflight";
 						return {
 							started: false,
-							result: options.allowNonManualNativeRequest ? skippedCodexNativeCompactionResult(params, {
+							result: options.allowNonManualNativeRequest && !isRequiredPreflight ? skippedCodexNativeCompactionResult(params, {
 								reason: "codex app-server binding changed before native compaction",
 								code: "binding_changed_before_native_compaction",
+								request: options.nativeCompactionRequest ?? "after_context_engine",
 								expectedThreadId: binding.threadId,
 								currentThreadId: currentBinding?.threadId
 							}) : failedCodexThreadBindingCompactionResult(params, {
-								threadId: binding.threadId,
+								threadId: currentBinding?.threadId ?? binding.threadId,
 								reason: "codex app-server binding changed before native compaction",
 								recovery: "stale_thread_binding"
 							})
@@ -502,6 +496,16 @@ async function compactCodexNativeThread(params, options) {
 				const completion = await completionWatch.completion;
 				if (!completion.completed) throw new Error(completion.reason);
 				tokensAfter = completion.tokensAfter;
+				if (completion.turnId && completion.itemId) await persistCodexContextCompactionActivity({
+					sessionTarget: params.sessionTarget,
+					config: params.config,
+					cwd: params.workspaceDir,
+					runId: params.runId,
+					threadId: binding.threadId,
+					turnId: completion.turnId,
+					itemId: completion.itemId,
+					timestamp: Date.now()
+				});
 				embeddedAgentLog.info("completed codex app-server compaction", {
 					sessionId: params.sessionId,
 					threadId: binding.threadId
@@ -545,7 +549,7 @@ async function compactCodexNativeThread(params, options) {
 				pending: false,
 				completed: true,
 				...options.allowNonManualNativeRequest ? {
-					request: "after_context_engine",
+					request: options.nativeCompactionRequest ?? "after_context_engine",
 					trigger: params.trigger ?? "unknown"
 				} : {}
 			};
@@ -560,6 +564,7 @@ async function compactCodexNativeThread(params, options) {
 			if (options.allowNonManualNativeRequest) return skippedCodexNativeCompactionResult(params, {
 				reason: "codex app-server compaction aborted before native compaction",
 				code: "aborted_before_native_compaction",
+				request: options.nativeCompactionRequest ?? "after_context_engine",
 				expectedThreadId: initialBinding.threadId,
 				currentThreadId: binding.threadId
 			});
@@ -594,7 +599,7 @@ function skippedCodexNativeCompactionResult(params, skipped) {
 			backend: "codex-app-server",
 			skipped: true,
 			reason: skipped.code,
-			request: "after_context_engine",
+			request: skipped.request ?? "after_context_engine",
 			trigger: params.trigger ?? "unknown",
 			...skipped.expectedThreadId ? { expectedThreadId: skipped.expectedThreadId } : {},
 			...skipped.currentThreadId ? { currentThreadId: skipped.currentThreadId } : {}