@openclaw/codex 2026.8.1-beta.3 → 2026.8.1

package/dist/api.js

@@ -1,12 +1,11 @@
-import { a as resolveCodexAppServerStartOptionsForAgent, i as resolveCodexAppServerRuntimeOptions } from "./config-CpNeo5AE.js";
-import { a as CODEX_APP_SERVER_VERSION, n as resolveManagedCodexAppServerStartOptions, r as resolveManagedCodexNativeCommand, t as isManagedCodexDesktopCommand } from "./managed-binary-By4FZC6i.js";
+import { a as resolveCodexAppServerStartOptionsForAgent, i as resolveCodexAppServerRuntimeOptions } from "./config-Cxw3Cl3k.js";
+import { a as CODEX_APP_SERVER_VERSION, n as resolveManagedCodexAppServerStartOptions, r as resolveManagedCodexNativeCommand, t as isManagedCodexDesktopCommand } from "./managed-binary-ZkGodW19.js";
 import path from "node:path";
 import { resolveDefaultModelForAgent } from "openclaw/plugin-sdk/agent-runtime";
 import { listAgentIds as listAgentIds$1, resolveAgentDir as resolveAgentDir$1 } from "openclaw/plugin-sdk/agent-scope-runtime";
 import { execFile } from "node:child_process";
 import { fileURLToPath } from "node:url";
 import { resolveEffectiveAgentRuntime } from "openclaw/plugin-sdk/command-auth-native";
-import { getHealthCheck } from "openclaw/plugin-sdk/health";
 //#region extensions/codex/src/doctor.ts
 const CODEX_MANAGED_APP_SERVER_CHECK_ID = "codex/managed-app-server";
 const CODEX_VERSION_TIMEOUT_MS = 5e3;
@@ -117,7 +116,7 @@ function createCodexManagedAppServerHealthCheck(params) {
 				})];
 			}
 			const detectedVersion = parseCodexVersion(`${output.stdout}\n${output.stderr}`);
-			if (detectedVersion !== "0.149.1") return [managedCodexFinding({
+			if (detectedVersion !== "0.151.0") return [managedCodexFinding({
 				message: detectedVersion ? `Managed Codex app-server version mismatch: expected ${CODEX_APP_SERVER_VERSION}, detected ${detectedVersion}.` : `Managed Codex app-server did not report a parseable version; expected ${CODEX_APP_SERVER_VERSION}.`,
 				path: nativeCommand,
 				requirement: `the exact OpenClaw-pinned Codex version ${CODEX_APP_SERVER_VERSION}`,
@@ -128,7 +127,7 @@ function createCodexManagedAppServerHealthCheck(params) {
 	};
 }
 function registerCodexManagedAppServerDoctorChecks$1(host, deps) {
-	if (getHealthCheck("codex/managed-app-server")) return;
+	if (host.getHealthCheck("codex/managed-app-server")) return;
 	host.registerHealthCheck(createCodexManagedAppServerHealthCheck({
 		pluginRoot: host.pluginRoot,
 		deps

package/dist/{attempt-client-cleanup-URjUlCHg.js → attempt-client-cleanup-CVPvp9dL.js}

@@ -1,4 +1,4 @@
-import { B as CodexAppServerRpcError, X as unsubscribeCodexAppServerLiveThread, p as retireSharedCodexAppServerClientIfCurrent, ut as isJsonObject } from "./shared-client-Dw-rzii0.js";
+import { $ as CodexAppServerRpcError, Ht as isJsonObject, wt as unsubscribeCodexAppServerLiveThread, y as retireSharedCodexAppServerClientIfCurrent } from "./shared-client-kNkljY-R.js";
 import { asFiniteNumber, normalizeOptionalString, normalizeOptionalString as normalizeOptionalString$1, readStringField } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { createDeferred } from "openclaw/plugin-sdk/extension-shared";
 import { embeddedAgentLog } from "openclaw/plugin-sdk/agent-harness-runtime";
@@ -259,6 +259,7 @@ var CodexProjectionDiagnostics = class {
 //#region extensions/codex/src/app-server/turn-router.ts
 /** Keyed routing for all turn traffic on one shared Codex app-server client. */
 const DEFAULT_PREBIND_NOTIFICATION_LIMIT = 256;
+const DEFAULT_GLOBAL_WARNING_LIMIT = 32;
 const CODEX_APP_SERVER_NATIVE_TURN_WAIT_TIMEOUT_MS = 3e4;
 const routers = /* @__PURE__ */ new WeakMap();
 /** Returns the sole router installed on a physical app-server client. */
@@ -272,6 +273,7 @@ function getCodexAppServerTurnRouter(client) {
 var ClientTurnRouter = class {
 	constructor(client) {
 		this.routes = /* @__PURE__ */ new Map();
+		this.globalWarnings = [];
 		this.nativeTurnCompletionWatchers = /* @__PURE__ */ new Map();
 		this.disposed = false;
 		client.addNotificationHandler((notification) => this.routeNotification(notification));
@@ -290,7 +292,11 @@ var ClientTurnRouter = class {
 			ended: createDeferred(),
 			activated: createDeferred(),
 			gate: "open",
-			pending: [],
+			pending: this.globalWarnings.map((notification) => ({
+				notification,
+				receivedAtMs: Date.now(),
+				scope: { threadId }
+			})),
 			notificationTail: Promise.resolve(),
 			completedNativeTurnIds: /* @__PURE__ */ new Set(),
 			ignoredTurnNotificationKeys: /* @__PURE__ */ new Set()
@@ -412,6 +418,15 @@ var ClientTurnRouter = class {
 	routeNotification(notification) {
 		if (this.disposed) return;
 		const scope = readScope(notification.params);
+		if (!scope.threadId && (notification.method === "configWarning" || notification.method === "warning")) {
+			if (this.globalWarnings.length === DEFAULT_GLOBAL_WARNING_LIMIT) this.globalWarnings.shift();
+			this.globalWarnings.push(notification);
+			for (const route of this.routes.values()) {
+				this.bufferNotification(route, notification, { threadId: route.threadId }, Date.now());
+				if (route.gate === "bound") this.flushNotifications(route);
+			}
+			return Promise.all([...this.routes.values()].map((route) => route.notificationTail)).then(() => void 0);
+		}
 		const watchers = scope.threadId ? this.nativeTurnCompletionWatchers.get(scope.threadId) : void 0;
 		const route = scope.threadId ? this.routes.get(scope.threadId) : void 0;
 		if (!watchers && !route) return;
@@ -489,6 +504,10 @@ var ClientTurnRouter = class {
 		const handler = route.handlers?.onNotification;
 		if (!handler) return;
 		for (const pending of route.pending.splice(0)) {
+			if (route.gate !== "bound" && (pending.notification.method === "configWarning" || pending.notification.method === "warning" && !readScope(pending.notification.params).threadId)) {
+				route.pending.push(pending);
+				continue;
+			}
 			if (route.gate === "bound" && pending.scope.turnId && pending.scope.turnId !== route.turnId) {
 				this.warnDroppedStaleTurnNotification(route, pending.notification, pending.scope);
 				continue;
@@ -541,7 +560,7 @@ var ClientTurnRouter = class {
 		await Promise.race([route.notificationTail, route.ended.promise]);
 	}
 	async drainNotifications(route) {
-		await route.notificationTail;
+		await Promise.race([route.notificationTail, route.ended.promise]);
 	}
 	release(route, error = /* @__PURE__ */ new Error("codex app-server thread route is released")) {
 		if (route.released) return;
@@ -677,12 +696,35 @@ async function interruptCodexTurnAndWaitBestEffort(client, params) {
 		completion?.cancel();
 	}
 }
+/** Stops native terminals on the cancelled thread without retiring peer threads. */
+async function terminateCodexBackgroundTerminals(client, threadId) {
+	const options = {
+		timeoutMs: CODEX_APP_SERVER_INTERRUPT_TIMEOUT_MS,
+		signal: AbortSignal.timeout(CODEX_APP_SERVER_INTERRUPT_TIMEOUT_MS)
+	};
+	try {
+		const { data } = await client.request("thread/backgroundTerminals/list", { threadId }, options);
+		for (const { processId } of data) await client.request("thread/backgroundTerminals/terminate", {
+			threadId,
+			processId
+		}, options);
+		if (data.length > 0) {
+			if ((await client.request("thread/backgroundTerminals/list", {
+				threadId,
+				limit: 1
+			}, options)).data.length > 0) throw new Error("native background terminals remain running");
+		}
+	} catch (cause) {
+		throw new Error("Codex background-terminal cleanup failed; inspect the thread's running terminals before starting more work.", { cause });
+	}
+}
 /** Unsubscribes from a thread while swallowing cleanup-only failures. */
 async function unsubscribeCodexThreadBestEffort(client, params) {
 	try {
-		await unsubscribeCodexAppServerLiveThread(client, params.threadId, params.timeoutMs);
+		await unsubscribeCodexAppServerLiveThread(client, params.threadId, params.timeoutMs, params.assertCurrent);
 		return true;
 	} catch (error) {
+		params.assertCurrent?.();
 		embeddedAgentLog.debug("codex app-server thread unsubscribe cleanup failed", {
 			threadId: params.threadId,
 			error
@@ -732,4 +774,4 @@ async function retireCodexAppServerClientAfterTimedOutTurn(client, params) {
 	});
 }
 //#endregion
-export { shouldSynthesizeToolProgressForItem as A, readNullableString as B, isSideEffectingNativeToolItem as C, itemTitle as D, itemStatus as E, readItem as F, readItemString as I, readNonEmptyString as L, normalizeOptionalString$1 as M, readCodexErrorNotificationMessage as N, shouldClearTerminalPresentationForNativeItem as O, readHookOutputEntries as P, readNonEmptyStringArray as R, isNonSuccessItemStatus as S, itemName as T, splitPlanText as V, readCodexNotificationTurnId as _, closeCodexStartupClientBestEffort as a, auditNativeToolUnfinishedStatus as b, isCodexAppServerUnsafeSubscriptionError as c, unsubscribeCodexThreadBestEffort as d, CODEX_APP_SERVER_NATIVE_TURN_WAIT_TIMEOUT_MS as f, readCodexNotificationThreadId as g, isCodexNotificationForTurn as h, assertCodexThreadResumeSubscription as i, extractRawAssistantText as j, shouldRecordNativeToolTranscript as k, retireCodexAppServerClientAfterTimedOutTurn as l, CodexProjectionDiagnostics as m, CODEX_APP_SERVER_UNSUBSCRIBE_TIMEOUT_MS as n, interruptCodexTurnAndWaitBestEffort as o, getCodexAppServerTurnRouter as p, CodexAppServerUnsafeSubscriptionError as r, isCodexAlreadyTerminalInterruptError as s, CODEX_APP_SERVER_INTERRUPT_TIMEOUT_MS as t, retireUnsafeCodexTurnClientBestEffort as u, auditNativeToolName as v, itemKind as w, isMutatingNativeToolItem as x, auditNativeToolTerminalStatus as y, readNonNegativeInteger as z };
+export { shouldRecordNativeToolTranscript as A, readNonNegativeInteger as B, isNonSuccessItemStatus as C, itemStatus as D, itemName as E, readHookOutputEntries as F, splitPlanText as H, readItem as I, readItemString as L, extractRawAssistantText as M, normalizeOptionalString$1 as N, itemTitle as O, readCodexErrorNotificationMessage as P, readNonEmptyString as R, isMutatingNativeToolItem as S, itemKind as T, readNullableString as V, readCodexNotificationThreadId as _, closeCodexStartupClientBestEffort as a, auditNativeToolTerminalStatus as b, isCodexAppServerUnsafeSubscriptionError as c, terminateCodexBackgroundTerminals as d, unsubscribeCodexThreadBestEffort as f, isCodexNotificationForTurn as g, CodexProjectionDiagnostics as h, assertCodexThreadResumeSubscription as i, shouldSynthesizeToolProgressForItem as j, shouldClearTerminalPresentationForNativeItem as k, retireCodexAppServerClientAfterTimedOutTurn as l, getCodexAppServerTurnRouter as m, CODEX_APP_SERVER_UNSUBSCRIBE_TIMEOUT_MS as n, interruptCodexTurnAndWaitBestEffort as o, CODEX_APP_SERVER_NATIVE_TURN_WAIT_TIMEOUT_MS as p, CodexAppServerUnsafeSubscriptionError as r, isCodexAlreadyTerminalInterruptError as s, CODEX_APP_SERVER_INTERRUPT_TIMEOUT_MS as t, retireUnsafeCodexTurnClientBestEffort as u, readCodexNotificationTurnId as v, isSideEffectingNativeToolItem as w, auditNativeToolUnfinishedStatus as x, auditNativeToolName as y, readNonEmptyStringArray as z };

package/dist/{auth-binding-B4FfbcCg.js → auth-binding-Ds_QVm-X.js}

@@ -1,6 +1,7 @@
 import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
 import { fingerprintResolvedAuthProfileCredential } from "openclaw/plugin-sdk/agent-harness-runtime";
 import { resolveApiKeyForProfile } from "openclaw/plugin-sdk/agent-runtime";
+import { resolveOpenAICodexAuthIdentity } from "openclaw/plugin-sdk/provider-auth";
 //#region extensions/codex/src/app-server/auth-binding.ts
 var auth_binding_exports = /* @__PURE__ */ __exportAll({
 	fingerprintCodexAppServerAuthBinding: () => fingerprintCodexAppServerAuthBinding,
@@ -26,14 +27,28 @@ function withMaterializedCredential(params) {
 /** Resolves one forwarded profile once so attestation and execution share exact material. */
 async function prepareCodexAppServerAuthBinding(params) {
 	const credential = params.authProfileStore.profiles[params.authProfileId];
-	if (!credential || credential.type === "oauth") return;
+	if (!credential) return;
+	if (credential.type === "oauth") {
+		const fingerprint = fingerprintResolvedAuthProfileCredential({
+			profileId: params.authProfileId,
+			credential: {
+				...credential,
+				accountId: resolveOpenAICodexAuthIdentity(credential).accountId
+			},
+			resolvedAuth: void 0
+		});
+		return fingerprint ? {
+			fingerprint,
+			authProfileStore: structuredClone(params.authProfileStore)
+		} : void 0;
+	}
 	const resolved = await resolveApiKeyForProfile({
 		cfg: params.config,
 		store: params.authProfileStore,
 		profileId: params.authProfileId,
 		agentDir: params.agentDir
 	});
-	if (!resolved?.apiKey) throw new Error(`Codex could not resolve auth profile "${params.authProfileId}".`);
+	if (!resolved?.apiKey) throw new Error(`Codex could not resolve auth profile "${params.authProfileId}". Repair or replace its credential or SecretRef, then retry.`);
 	const fingerprint = fingerprintResolvedAuthProfileCredential({
 		profileId: params.authProfileId,
 		credential,
@@ -44,7 +59,7 @@ async function prepareCodexAppServerAuthBinding(params) {
 			mode: credential.type === "api_key" ? "api-key" : "token"
 		}
 	});
-	if (!fingerprint) throw new Error(`Codex could not attest auth profile "${params.authProfileId}".`);
+	if (!fingerprint) throw new Error(`Codex could not attest auth profile "${params.authProfileId}". Re-select the OpenAI profile and retry.`);
 	return {
 		fingerprint,
 		authProfileStore: withMaterializedCredential({

package/dist/{binding-connection-DAvZwp96.js → binding-connection-CCQFs8lf.js}

@@ -1,5 +1,5 @@
-import { h as readCodexPluginConfig, i as resolveCodexAppServerRuntimeOptions, s as resolveCodexSupervisionAppServerRuntimeOptions } from "./config-CpNeo5AE.js";
-import { a as resolveCodexCatalogConnectionHome, t as buildCodexAppServerConnectionFingerprint } from "./plugin-app-cache-key-DMNQ8Zi8.js";
+import { T as readCodexPluginConfig, i as resolveCodexAppServerRuntimeOptions, s as resolveCodexSupervisionAppServerRuntimeOptions } from "./config-Cxw3Cl3k.js";
+import { n as buildCodexAppServerConnectionFingerprint, o as resolveCodexCatalogConnectionHome } from "./thread-resume-DF54hagX.js";
 //#region extensions/codex/src/app-server/binding-connection.ts
 /** Requires the native model pair after a supervised pending branch has materialized. */
 function requireCodexSupervisionModelSelection(binding) {

package/dist/{bounded-turn-4BjrZEwW.js → bounded-turn-rq5tiSXk.js}

@@ -1,10 +1,11 @@
-import { i as resolveCodexAppServerRuntimeOptions } from "./config-CpNeo5AE.js";
-import { V as createCodexElicitationResponse, s as isCodexAppServerStartSelectionChangedError, ut as isJsonObject } from "./shared-client-Dw-rzii0.js";
-import { _ as readCodexNotificationTurnId, a as closeCodexStartupClientBestEffort, o as interruptCodexTurnAndWaitBestEffort, t as CODEX_APP_SERVER_INTERRUPT_TIMEOUT_MS } from "./attempt-client-cleanup-URjUlCHg.js";
-import { b as isTerminalTurnStatus, n as normalizeCodexResponseTokenUsage, x as readCodexNotificationItem, y as isRetryableErrorNotification } from "./event-projector-usage-CLwNEJqW.js";
-import { a as assertCodexThreadStartResponse, c as readCodexErrorNotification, o as assertCodexTurnStartResponse, u as readCodexTurnCompletedNotification } from "./protocol-validators-VAVyEnDp.js";
-import { r as readModelListResult } from "./models-CZw1wClT.js";
-import { Z as mergeCodexThreadConfigs, c as buildCodexRingZeroThreadConfigPatch, l as buildCodexRuntimeThreadConfig, o as assertCodexManagedRequirementsDoNotOverrideToolPolicy, s as attestCodexRestrictedToolSurfaceMcpServersDisabled, u as readCodexInheritedMcpServerNames } from "./thread-lifecycle-DKdrnTMX.js";
+import { n as readCodexAppServerConfigOptions } from "./launch-args-sXOAg0SX.js";
+import { i as resolveCodexAppServerRuntimeOptions } from "./config-Cxw3Cl3k.js";
+import { Ht as isJsonObject, et as createCodexElicitationResponse, u as isCodexAppServerStartSelectionChangedError } from "./shared-client-kNkljY-R.js";
+import { c as assertCodexTurnStartResponse, f as readCodexTurnCompletedNotification, s as assertCodexThreadStartResponse, u as readCodexErrorNotification } from "./protocol-validators-Bg5rpNxk.js";
+import { a as closeCodexStartupClientBestEffort, o as interruptCodexTurnAndWaitBestEffort, t as CODEX_APP_SERVER_INTERRUPT_TIMEOUT_MS, v as readCodexNotificationTurnId } from "./attempt-client-cleanup-CVPvp9dL.js";
+import { b as isTerminalTurnStatus, n as normalizeCodexResponseTokenUsage, x as readCodexNotificationItem, y as isRetryableErrorNotification } from "./event-projector-usage-D3PHFFXh.js";
+import { r as readModelListResult } from "./models-DgFWSuxA.js";
+import { _ as buildCodexRingZeroThreadConfigPatch, g as attestCodexRestrictedToolSurfaceMcpServersDisabled, h as assertCodexManagedRequirementsDoNotOverrideToolPolicy, ot as mergeCodexThreadConfigs, v as buildCodexRuntimeThreadConfig, y as readCodexInheritedMcpServerNames } from "./thread-lifecycle-Ss-uwnC4.js";
 import { readStringField } from "openclaw/plugin-sdk/string-coerce-runtime";
 import fs from "node:fs/promises";
 import path from "node:path";
@@ -65,11 +66,7 @@ async function runBoundedCodexAppServerTurnInWorkspace(params, appServer, worksp
 	const timeoutMs = deadline - Date.now();
 	if (timeoutMs <= 0) throw timeoutError;
 	const agentDir = params.agentDir?.trim() || void 0;
-	const isolatedStartOptions = workspace.codexHome ? buildPrivateCodexAppServerStartOptions(appServer.start, workspace.codexHome) : appServer.start;
-	const startOptions = workspace.codexHome && params.preparedAuth ? {
-		...isolatedStartOptions,
-		homeScope: "agent"
-	} : isolatedStartOptions;
+	const startOptions = workspace.codexHome ? buildPrivateCodexAppServerStartOptions(appServer.start, workspace.codexHome) : appServer.start;
 	const ownsClient = !params.options.clientFactory;
 	const authSelection = params.preparedAuth ? { preparedAuth: params.preparedAuth } : { authProfileId: params.profile };
 	const client = params.options.clientFactory ? await params.options.clientFactory({
@@ -80,7 +77,7 @@ async function runBoundedCodexAppServerTurnInWorkspace(params, appServer, worksp
 		config: params.config,
 		timeoutMs,
 		...params.signal ? { abandonSignal: params.signal } : {}
-	}) : await import("./shared-client-Dw-rzii0.js").then((n) => n.m).then(({ createIsolatedCodexAppServerClient }) => createIsolatedCodexAppServerClient({
+	}) : await import("./shared-client-kNkljY-R.js").then((n) => n.x).then(({ createIsolatedCodexAppServerClient }) => createIsolatedCodexAppServerClient({
 		startOptions,
 		timeoutMs,
 		...authSelection,
@@ -204,10 +201,7 @@ function resolveBoundedThreadConfig(params, workspace, inheritedMcpServerNames)
 	return mergeCodexThreadConfigs(privateConfig, CODEX_SETTLED_FINALIZER_THREAD_CONFIG, buildCodexRingZeroThreadConfigPatch({ toolsAllow: ["openclaw"] }, true, inheritedMcpServerNames)) ?? privateConfig;
 }
 function buildPrivateCodexAppServerStartOptions(start, codexHome) {
-	const providerArgs = start.args.flatMap((arg, index) => {
-		const override = arg === "-c" || arg === "--config" ? start.args[index + 1] : arg.startsWith("--config=") ? arg.slice(9) : void 0;
-		return override && /^\s*(?:openai_base_url|model_catalog_json)\s*=/u.test(override) ? ["-c", override] : [];
-	});
+	const providerArgs = readCodexAppServerConfigOptions(start.args).flatMap(({ name, value }) => (name === "-c" || name === "--config") && value && /^\s*(?:openai_base_url|model_catalog_json)\s*=/u.test(value) ? ["-c", value] : []);
 	const privateEnv = Object.fromEntries(Object.entries(start.env ?? {}).filter(([name]) => name.trim().toUpperCase() !== CODEX_APP_SERVER_ARGS_ENV_KEY));
 	const clearEnv = (start.clearEnv ?? []).filter((name) => {
 		const normalized = name.trim().toUpperCase();
@@ -215,6 +209,7 @@ function buildPrivateCodexAppServerStartOptions(start, codexHome) {
 	});
 	return {
 		...start,
+		homeScope: "agent",
 		args: [
 			"app-server",
 			...providerArgs,
@@ -249,7 +244,7 @@ async function resolveCodexBoundedTurnModel(params) {
 	const listed = readModelListResult(await params.client.request("model/list", {
 		limit: null,
 		cursor: null,
-		includeHidden: false
+		includeHidden: params.selection.mode === "required"
 	}, {
 		timeoutMs: Math.min(params.timeoutMs, 5e3),
 		signal: params.signal

package/dist/{capabilities-CH3K57v4.js → capabilities-CGm_94eL.js}

@@ -1,4 +1,4 @@
-import { B as CodexAppServerRpcError } from "./shared-client-Dw-rzii0.js";
+import { $ as CodexAppServerRpcError } from "./shared-client-kNkljY-R.js";
 //#region extensions/codex/src/app-server/capabilities.ts
 /**
 * Capability helpers for optional Codex app-server control-plane methods.

package/dist/cli-metadata.js

@@ -2,7 +2,7 @@ import { definePluginEntry } from "openclaw/plugin-sdk/plugin-entry";
 //#region extensions/codex/cli-metadata.ts
 function registerCodexCliMetadata(api) {
 	api.registerCli(async ({ program }) => {
-		const { registerCodexSessionCli } = await import("./session-cli-B1hKvfkI.js");
+		const { registerCodexSessionCli } = await import("./session-cli-BuDjm5Ou.js");
 		registerCodexSessionCli(program);
 	}, { descriptors: [{
 		name: "codex",

package/dist/{command-formatters-D0nZ3qtd.js → command-formatters-C54Yg3eA.js}

@@ -1,5 +1,5 @@
-import { ut as isJsonObject } from "./shared-client-Dw-rzii0.js";
-import { c as summarizeCodexRateLimits, o as summarizeCodexAccountRateLimits, r as hasCodexRateLimitSnapshots } from "./rate-limits-BI1dMHDG.js";
+import { Ht as isJsonObject } from "./shared-client-kNkljY-R.js";
+import { c as summarizeCodexRateLimits, o as summarizeCodexAccountRateLimits, r as hasCodexRateLimitSnapshots } from "./rate-limits-hFtzt2Up.js";
 import { normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
 //#region extensions/codex/src/command-formatters.ts
 /**

package/dist/{command-handlers-DC86lgT4.js → command-handlers-BvOAHTrA.js}

@@ -1,26 +1,26 @@
-import { M as isCodexFastServiceTier, _ as CODEX_PLUGINS_MARKETPLACE_NAME, i as resolveCodexAppServerRuntimeOptions } from "./config-CpNeo5AE.js";
-import { U as consumeCodexAppServerLiveThread, a as getLeasedSharedCodexAppServerClient, et as resolveCodexAppServerAuthAccountCacheKey, l as releaseLeasedSharedCodexAppServerClient, nt as resolveCodexAppServerAuthProfileIdForAgent, rt as resolveCodexAppServerFallbackApiKeyCacheKey, ut as isJsonObject } from "./shared-client-Dw-rzii0.js";
-import { c as reclaimCurrentCodexSessionGeneration, d as sessionBindingIdentity, i as createCodexSessionGenerationSupersededError, n as assertCodexBindingMayBeReplaced, r as bindingStoreKey, s as normalizeCodexAppServerBindingModelProvider } from "./session-binding-BTrLf9Qm.js";
-import { i as assertCodexThreadResumeResponse } from "./protocol-validators-VAVyEnDp.js";
-import { t as listAllCodexAppServerModels } from "./models-CZw1wClT.js";
-import { o as defaultCodexAppInventoryCache, r as buildCodexPluginAppCacheKey } from "./plugin-app-cache-key-DMNQ8Zi8.js";
-import { et as refreshCodexPluginRuntimeState, nt as isOpenAiCuratedMarketplaceName } from "./thread-lifecycle-DKdrnTMX.js";
-import { t as isIncognitoSessionKey } from "./incognito-session-ET_ufDH-.js";
-import { t as CODEX_CONTROL_METHODS } from "./capabilities-CH3K57v4.js";
-import { s as summarizeCodexAccountUsage } from "./rate-limits-BI1dMHDG.js";
-import { a as formatComputerUseStatus, c as formatSkills, i as formatCodexStatus, l as formatThreads, n as formatAccount, o as formatList, r as formatCodexDisplayText, s as formatModels, t as buildHelp } from "./command-formatters-D0nZ3qtd.js";
-import { n as resolveCodexNativeExecutionBlock, r as resolveCodexNativeSandboxBlock } from "./sandbox-guard-C1qEeZ5C.js";
-import { a as rollbackCodexAppServerBindingSubscription, i as retireCodexConversationThreadBinding, n as releaseCodexAppServerBindingSubscription, o as withCodexConversationThreadActivity, r as retainCodexAppServerBindingSubscription, s as withExclusiveCodexAppServerThread, t as isSameCodexAppServerThreadOwner } from "./thread-ownership-i2NBwDUL.js";
-import { a as parseCodexPermissionsModeArg, c as setCodexConversationModel, d as stopCodexConversationTurn, g as hasCodexAdminScope, h as canMutateCodexHost, i as parseCodexFastModeArg, l as setCodexConversationPermissions, m as CODEX_NATIVE_EXECUTION_AUTH_ERROR, n as parseCodexPluginMarketplaceId, o as readCodexConversationActiveTurn, p as CODEX_FULL_PERMISSIONS_AUTH_ERROR, r as formatPermissionsMode, s as setCodexConversationFastMode, t as discoverCodexMarketplacePlugins, u as steerCodexConversationTurn } from "./plugin-marketplace-discovery-CSWDkMrP.js";
+import { i as resolveCodexAppServerRuntimeOptions, j as CODEX_PLUGINS_MARKETPLACE_NAME, k as isCodexFastServiceTier } from "./config-Cxw3Cl3k.js";
+import { Ft as resolveCodexAppServerFallbackApiKeyCacheKey, Ht as isJsonObject, Nt as resolveCodexAppServerAuthProfileIdForAgent, c as getLeasedSharedCodexAppServerClient, gt as consumeCodexAppServerLiveThread, h as releaseLeasedSharedCodexAppServerClient, jt as resolveCodexAppServerAuthAccountCacheKey, vt as hasCodexAppServerLiveThread } from "./shared-client-kNkljY-R.js";
+import { c as reclaimCurrentCodexSessionGeneration, d as sessionBindingIdentity, i as createCodexSessionGenerationSupersededError, n as assertCodexBindingMayBeReplaced, r as bindingStoreKey, s as normalizeCodexAppServerBindingModelProvider } from "./session-binding-q2WSTVmC.js";
+import { o as assertCodexThreadResumeResponse, r as assertCodexThreadAcceptsDirectInput } from "./protocol-validators-Bg5rpNxk.js";
+import { a as closeCodexStartupClientBestEffort } from "./attempt-client-cleanup-CVPvp9dL.js";
+import { t as listAllCodexAppServerModels } from "./models-DgFWSuxA.js";
+import { i as buildCodexPluginAppCacheKey, s as defaultCodexAppInventoryCache } from "./thread-resume-DF54hagX.js";
+import { dt as isOpenAiCuratedMarketplaceName, lt as refreshCodexPluginRuntimeState } from "./thread-lifecycle-Ss-uwnC4.js";
+import { a as rollbackCodexAppServerBindingSubscription, c as withExclusiveCodexAppServerThread, i as retireCodexConversationThreadBinding, l as isIncognitoSessionKey, n as releaseCodexAppServerBindingSubscription, r as retainCodexAppServerBindingSubscription, s as withCodexConversationThreadActivity, t as isSameCodexAppServerThreadOwner } from "./thread-ownership-CeYBqg_4.js";
+import { c as resolveCodexNativeSandboxBlock, s as resolveCodexNativeExecutionBlock } from "./request-CCm4LaED.js";
+import { t as CODEX_CONTROL_METHODS } from "./capabilities-CGm_94eL.js";
+import { s as summarizeCodexAccountUsage } from "./rate-limits-hFtzt2Up.js";
+import { a as formatComputerUseStatus, c as formatSkills, i as formatCodexStatus, l as formatThreads, n as formatAccount, o as formatList, r as formatCodexDisplayText, s as formatModels, t as buildHelp } from "./command-formatters-C54Yg3eA.js";
+import { _ as hasCodexAdminScope, a as parseCodexPermissionsModeArg, c as setCodexConversationModel, d as stopCodexConversationTurn, g as canMutateCodexHost, h as CODEX_NATIVE_EXECUTION_AUTH_ERROR, i as parseCodexFastModeArg, l as setCodexConversationPermissions, m as CODEX_HOST_INSPECTION_AUTH_ERROR, n as parseCodexPluginMarketplaceId, o as readCodexConversationActiveTurn, p as CODEX_FULL_PERMISSIONS_AUTH_ERROR, r as formatPermissionsMode, s as setCodexConversationFastMode, t as discoverCodexMarketplacePlugins, u as steerCodexConversationTurn } from "./plugin-marketplace-discovery-mdmScYOj.js";
 import { i as readCodexConversationBindingData, n as createCodexCliNodeConversationBindingData, o as resolveCodexDefaultWorkspaceDir, r as createCodexConversationBindingData } from "./conversation-binding-data-CW2GuupV.js";
-import { n as resolveCodexBindingAppServerConnection } from "./binding-connection-DAvZwp96.js";
-import { l as formatCodexCliSessions } from "./session-catalog-ezP_UcRM.js";
-import { i as safeCodexControlRequest, n as readCodexStatusProbes, r as requestOptions, t as codexControlRequest } from "./command-rpc-xUIIonsO.js";
-import { i as readCodexComputerUseStatus, r as installCodexComputerUse, t as defaultCodexPluginMetadataCache } from "./plugin-metadata-cache-BXH5NF-4.js";
+import { n as resolveCodexBindingAppServerConnection } from "./binding-connection-CCQFs8lf.js";
+import { c as readCodexStatusProbes, l as requestOptions, p as formatCodexCliSessions, s as codexControlRequest, u as safeCodexControlRequest } from "./session-catalog-C2Tae4rI.js";
+import { i as readCodexComputerUseStatus, r as installCodexComputerUse, t as defaultCodexPluginMetadataCache } from "./plugin-metadata-cache-CulOABwu.js";
 import { normalizeOptionalString, normalizeUniqueStringEntries } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { parseStrictPositiveInteger } from "openclaw/plugin-sdk/number-runtime";
 import crypto from "node:crypto";
-import { ensureAuthProfileStore, findNormalizedProviderValue, resolveAgentDir, resolveAuthProfileEligibility, resolveAuthProfileOrder, resolveProfileUnusableUntilForDisplay, resolveSessionAgentIds } from "openclaw/plugin-sdk/agent-runtime";
+import { ensureAuthProfileStore, findNormalizedProviderValue, resolveAgentDir, resolveAuthProfileEligibility, resolveAuthProfileOrder, resolveProfileUnusableUntilForDisplay } from "openclaw/plugin-sdk/agent-runtime";
+import { resolveSessionAgentIdsStrict } from "openclaw/plugin-sdk/agent-scope-runtime";
 import { getSessionEntry, resolveStorePath } from "openclaw/plugin-sdk/session-store-runtime";
 import { truncateUtf16Safe } from "openclaw/plugin-sdk/text-utility-runtime";
 import { expectDefined } from "openclaw/plugin-sdk/expect-runtime";
@@ -51,8 +51,8 @@ async function readCodexAccountAuthOverview(params) {
 		limits: params.limits,
 		now
 	});
-	const subscriptionProfileId = order.find((profileId) => isChatGptSubscriptionProfile(store.profiles[profileId]));
 	const activeIsSubscription = activeProfileId !== void 0 && isChatGptSubscriptionProfile(store.profiles[activeProfileId]);
+	const subscriptionProfileId = activeIsSubscription ? activeProfileId : order.find((profileId) => isChatGptSubscriptionProfile(store.profiles[profileId]));
 	const activeUsage = activeIsSubscription && params.limits.ok ? summarizeCodexAccountUsage(params.limits.value, now) : void 0;
 	const subscriptionUsage = subscriptionProfileId && (!activeIsSubscription || subscriptionProfileId !== activeProfileId) ? await readSubscriptionUsage({
 		...params,
@@ -157,13 +157,20 @@ function resolveLiveAccountProfileId(params) {
 	const type = normalizeOptionalString(account.type)?.toLowerCase();
 	if (type === "chatgpt") {
 		const email = normalizeOptionalString(account.email)?.toLowerCase();
-		const firstSubscription = params.order.find((profileId) => isChatGptSubscriptionProfile(params.store.profiles[profileId]));
-		if (!email) return firstSubscription;
-		return params.order.find((profileId) => {
-			const credential = params.store.profiles[profileId];
-			if (!credential || !isChatGptSubscriptionProfile(credential)) return false;
-			return (credential.email?.trim().toLowerCase() ?? extractEmailFromProfileId(profileId))?.toLowerCase() === email;
-		}) ?? firstSubscription;
+		const accountId = normalizeOptionalString(account.accountId ?? account.chatgptAccountId);
+		const subscriptionProfiles = params.order.filter((profileId) => isChatGptSubscriptionProfile(params.store.profiles[profileId]));
+		if (accountId) {
+			const exactWorkspace = subscriptionProfiles.find((profileId) => {
+				const credential = params.store.profiles[profileId];
+				return credential && "accountId" in credential && credential.accountId === accountId;
+			});
+			if (exactWorkspace) return exactWorkspace;
+		}
+		const matchingProfiles = email ? subscriptionProfiles.filter((profileId) => {
+			return (params.store.profiles[profileId]?.email?.trim().toLowerCase() ?? extractEmailFromProfileId(profileId))?.toLowerCase() === email;
+		}) : subscriptionProfiles;
+		const lastGood = params.store.lastGood?.[OPENAI_PROVIDER_ID];
+		return (lastGood && matchingProfiles.includes(lastGood) ? lastGood : void 0) ?? matchingProfiles[0] ?? subscriptionProfiles[0];
 	}
 	if (type === "apikey" || type === "api_key") return params.order.find((profileId) => params.store.profiles[profileId]?.type === "api_key");
 }
@@ -1105,7 +1112,7 @@ function conversationBindingIdentity(bindingId) {
 	};
 }
 function resolveCodexConversationControlScope(ctx) {
-	const { sessionAgentId } = resolveSessionAgentIds({
+	const { sessionAgentId } = resolveSessionAgentIdsStrict({
 		sessionKey: ctx.sessionKey,
 		agentId: ctx.agentId,
 		config: ctx.config
@@ -1556,13 +1563,8 @@ async function resumeThread(deps, ctx, pluginConfig, args) {
 			})) throw createCodexSessionGenerationSupersededError(identity.sessionId);
 			const currentBinding = await deps.bindingStore.read(identity);
 			assertCodexBindingMayBeReplaced(currentBinding, "attaching a different resumed thread");
-			const authProfileId = resolveCodexAppServerAuthProfileIdForAgent({
-				authProfileId: currentBinding?.authProfileId,
-				agentDir: scope.agentDir,
-				config: ctx.config
-			});
-			let committedResponse = false;
-			const commitResumedThread = async (value, client) => {
+			let pendingResumeConfiguration = false;
+			const commitResumedThread = async (value, client, { authProfileId, assertCurrent }) => {
 				const response = assertCodexThreadResumeResponse(value);
 				const effectiveThreadId = response.thread.id;
 				if (effectiveThreadId !== normalizedThreadId) throw new Error(`Codex thread/resume returned ${effectiveThreadId} for ${normalizedThreadId}`);
@@ -1574,52 +1576,73 @@ async function resumeThread(deps, ctx, pluginConfig, args) {
 					agentDir: scope.agentDir,
 					config: ctx.config
 				});
-				const bindingBeforeCommit = await deps.bindingStore.read(identity);
-				assertCodexBindingMayBeReplaced(bindingBeforeCommit, "committing a different resumed thread");
-				const clientId = client?.getInstanceId();
-				const sameOwner = client ? isSameCodexAppServerThreadOwner(bindingBeforeCommit, {
-					threadId: effectiveThreadId,
-					clientId
-				}) : bindingBeforeCommit?.threadId === effectiveThreadId;
+				const clientId = client.getInstanceId();
 				let retained = false;
+				let sameOwner = false;
+				let knownOwnership;
 				try {
-					if (client) {
-						retained = await retainCodexAppServerBindingSubscription(client, effectiveThreadId, sameOwner ? await consumeCodexAppServerLiveThread(client, effectiveThreadId) : void 0);
-						if (!retained) throw new Error("Codex resumed thread lost its native subscription owner.");
-					}
+					const bindingBeforeCommit = await deps.bindingStore.read(identity);
+					assertCodexBindingMayBeReplaced(bindingBeforeCommit, "committing a different resumed thread");
+					sameOwner = isSameCodexAppServerThreadOwner(bindingBeforeCommit, {
+						threadId: effectiveThreadId,
+						clientId
+					});
+					const sameThreadBinding = bindingBeforeCommit?.threadId === effectiveThreadId ? bindingBeforeCommit : void 0;
+					pendingResumeConfiguration = sameThreadBinding?.preserveNativeModel !== true && (!sameThreadBinding?.dynamicToolsFingerprint || !sameThreadBinding.webSearchThreadConfigFingerprint || sameThreadBinding.pendingResumeConfiguration === true);
+					assertCurrent();
+					assertCodexThreadAcceptsDirectInput(response.thread);
+					knownOwnership = sameOwner ? await consumeCodexAppServerLiveThread(client, effectiveThreadId) : void 0;
+					assertCurrent();
+					retained = await retainCodexAppServerBindingSubscription(client, effectiveThreadId, knownOwnership);
+					assertCurrent();
+					if (!retained) throw new Error("Codex resumed thread lost its native subscription owner.");
 					if (bindingBeforeCommit && !sameOwner) await releaseCodexAppServerBindingSubscription(bindingBeforeCommit);
+					assertCurrent();
 					if (!await deps.bindingStore.mutate(identity, {
 						kind: "set",
 						binding: {
-							...bindingBeforeCommit?.threadId === effectiveThreadId ? bindingBeforeCommit : {},
+							...sameThreadBinding,
 							threadId: effectiveThreadId,
-							...clientId ? { clientId } : {},
+							clientId,
 							cwd: resumedCwd,
+							rolloutPath: response.thread.path ?? sameThreadBinding?.rolloutPath,
+							pendingResumeConfiguration: pendingResumeConfiguration ? true : void 0,
 							authProfileId,
 							model: response.model,
 							modelProvider,
 							historyCoveredThrough: (/* @__PURE__ */ new Date()).toISOString()
 						}
-					})) throw new Error("Codex thread binding changed while attaching the resumed thread.");
+					}, assertCurrent)) throw new Error("Codex thread binding changed while attaching the resumed thread.");
 				} catch (error) {
-					if (client && !sameOwner) await rollbackCodexAppServerBindingSubscription(client, effectiveThreadId, retained);
+					if (sameOwner && knownOwnership && !retained) {
+						if (!await retainCodexAppServerBindingSubscription(client, effectiveThreadId, knownOwnership)) await closeCodexStartupClientBestEffort(client);
+					} else if (retained && !sameOwner || !hasCodexAppServerLiveThread(client, effectiveThreadId)) await rollbackCodexAppServerBindingSubscription(client, effectiveThreadId, retained);
 					throw error;
 				}
-				committedResponse = true;
 			};
-			const response = await deps.codexControlRequest(pluginConfig, CODEX_CONTROL_METHODS.resumeThread, {
+			await deps.codexControlRequest(pluginConfig, CODEX_CONTROL_METHODS.resumeThread, {
 				threadId: normalizedThreadId,
 				excludeTurns: true
 			}, {
 				config: ctx.config,
+				agentId: scope.agentId,
 				agentDir: scope.agentDir,
-				authProfileId,
+				authProfileId: currentBinding?.authProfileId,
 				sessionKey: ctx.sessionKey,
 				sessionId: ctx.sessionId,
+				beforeRequest: async (request) => {
+					const { thread } = await request({
+						method: "thread/read",
+						requestParams: {
+							threadId: normalizedThreadId,
+							includeTurns: false
+						}
+					});
+					assertCodexThreadAcceptsDirectInput(thread);
+				},
 				onResponse: commitResumedThread
 			});
-			if (!committedResponse) await commitResumedThread(response);
-			return `Attached this OpenClaw session to Codex thread ${formatCodexDisplayText(normalizedThreadId)}.`;
+			return `Attached this OpenClaw session to Codex thread ${formatCodexDisplayText(normalizedThreadId)}.${pendingResumeConfiguration ? " The next turn will validate its tools and apply this session's configuration before continuing." : ""}`;
 		})
 	});
 }
@@ -1834,7 +1857,7 @@ async function setConversationModel(deps, ctx, pluginConfig, args) {
 		}) : void 0;
 		const selectedModel = currentSession && currentSession.sessionId === ctx.sessionId ? currentSession.modelOverride ?? currentSession.model : void 0;
 		const binding = await deps.bindingStore.read(target.identity);
-		const activeModel = selectedModel ?? binding?.model;
+		const activeModel = target.identity.kind === "conversation" ? binding?.model : selectedModel ?? binding?.model;
 		return activeModel ? `Codex model: ${formatCodexDisplayText(activeModel)}` : "Usage: /codex model <model>";
 	}
 	return await deps.setCodexConversationModel({
@@ -1843,12 +1866,7 @@ async function setConversationModel(deps, ctx, pluginConfig, args) {
 		pluginConfig,
 		model: normalized,
 		agentDir: target.agentDir,
-		config: ctx.config,
-		...ctx.sessionId && ctx.sessionKey ? { session: {
-			agentId: target.agentId,
-			sessionId: ctx.sessionId,
-			sessionKey: ctx.sessionKey
-		} } : {}
+		config: ctx.config
 	});
 }
 async function setConversationFastMode(deps, ctx, args) {
@@ -2293,6 +2311,14 @@ function formatPluginList(plugins, options = {}) {
 }
 //#endregion
 //#region extensions/codex/src/command-handlers.ts
+const CODEX_HOST_INSPECTION_SUBCOMMANDS = /* @__PURE__ */ new Set([
+	"account",
+	"mcp",
+	"sessions",
+	"skills",
+	"status",
+	"threads"
+]);
 async function handleCodexSubcommand(ctx, options) {
 	const deps = resolveCodexCommandDeps(options.deps);
 	const args = splitArgs(ctx.args);
@@ -2300,6 +2326,7 @@ async function handleCodexSubcommand(ctx, options) {
 	const [subcommand = "status", ...rest] = args;
 	const normalized = subcommand.toLowerCase();
 	if (normalized === "help") return { text: buildHelp() };
+	if (CODEX_HOST_INSPECTION_SUBCOMMANDS.has(normalized) && !canMutateCodexHost(ctx)) return { text: CODEX_HOST_INSPECTION_AUTH_ERROR };
 	if (CODEX_NATIVE_CONTROL_SUBCOMMANDS.has(normalized) && !returnsBeforeNativeCodexExecution(normalized, rest) && !isReadOnlyCodexGoalCommand(normalized, rest) && !canMutateCodexHost(ctx)) return { text: CODEX_NATIVE_EXECUTION_AUTH_ERROR };
 	const sandboxBlock = resolveCodexNativeCommandSandboxBlock(ctx, normalized, rest);
 	if (sandboxBlock) return { text: sandboxBlock };

package/dist/{compact-COqgBRny.js → compact-Hd7SAc0N.js}

@@ -1,12 +1,11 @@
-import { B as CodexAppServerRpcError, U as consumeCodexAppServerLiveThread, Y as retainCodexAppServerLiveThread, a as getLeasedSharedCodexAppServerClient, l as releaseLeasedSharedCodexAppServerClient, ut as isJsonObject } from "./shared-client-Dw-rzii0.js";
-import { d as sessionBindingIdentity, t as CODEX_APP_SERVER_BINDING_GUARDED_REQUEST_TIMEOUT_MS } from "./session-binding-BTrLf9Qm.js";
-import { _ as readCodexNotificationTurnId, a as closeCodexStartupClientBestEffort, d as unsubscribeCodexThreadBestEffort, g as readCodexNotificationThreadId, r as CodexAppServerUnsafeSubscriptionError, s as isCodexAlreadyTerminalInterruptError } from "./attempt-client-cleanup-URjUlCHg.js";
-import { i as readCodexThreadContextSnapshot, x as readCodexNotificationItem } from "./event-projector-usage-CLwNEJqW.js";
-import { t as isIncognitoSessionKey } from "./incognito-session-ET_ufDH-.js";
-import { t as resumeCodexAppServerThread } from "./thread-resume-CdJk2Ehf.js";
-import { n as resolveCodexNativeExecutionBlock } from "./sandbox-guard-C1qEeZ5C.js";
-import { t as isSameCodexAppServerThreadOwner } from "./thread-ownership-i2NBwDUL.js";
-import { n as resolveCodexBindingAppServerConnection } from "./binding-connection-DAvZwp96.js";
+import { $ as CodexAppServerRpcError, Ct as retainCodexAppServerLiveThread, Ht as isJsonObject, c as getLeasedSharedCodexAppServerClient, gt as consumeCodexAppServerLiveThread, h as releaseLeasedSharedCodexAppServerClient } from "./shared-client-kNkljY-R.js";
+import { d as sessionBindingIdentity, t as CODEX_APP_SERVER_BINDING_GUARDED_REQUEST_TIMEOUT_MS } from "./session-binding-q2WSTVmC.js";
+import { _ as readCodexNotificationThreadId, a as closeCodexStartupClientBestEffort, f as unsubscribeCodexThreadBestEffort, r as CodexAppServerUnsafeSubscriptionError, s as isCodexAlreadyTerminalInterruptError, v as readCodexNotificationTurnId } from "./attempt-client-cleanup-CVPvp9dL.js";
+import { i as readCodexThreadContextSnapshot, x as readCodexNotificationItem } from "./event-projector-usage-D3PHFFXh.js";
+import { t as resumeCodexAppServerThread } from "./thread-resume-DF54hagX.js";
+import { l as isIncognitoSessionKey, t as isSameCodexAppServerThreadOwner } from "./thread-ownership-CeYBqg_4.js";
+import { s as resolveCodexNativeExecutionBlock } from "./request-CCm4LaED.js";
+import { n as resolveCodexBindingAppServerConnection } from "./binding-connection-CCQFs8lf.js";
 import { t as persistCodexContextCompactionActivity } from "./context-compaction-activity-BOeJf7yo.js";
 import { asOptionalRecord } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { createDeferred } from "openclaw/plugin-sdk/extension-shared";