@openclaw/codex 2026.8.1-beta.3 → 2026.9.1-beta.1

package/dist/{shared-client-Dw-rzii0.js → shared-client-DKz23hHY.js}

@@ -1,8 +1,8 @@
 import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
-import { a as resolveCodexAppServerStartOptionsForAgent, i as resolveCodexAppServerRuntimeOptions, o as resolveCodexComputerUseConfig, t as codexAppServerStartOptionsKey, x as resolveCodexAppServerUserHomeDir } from "./config-CpNeo5AE.js";
-import { o as isCodexAppServerNativeAuthProfile } from "./session-binding-BTrLf9Qm.js";
+import { S as resolveCodexAppServerUserHomeDir, a as resolveCodexAppServerStartOptionsForAgent, i as resolveCodexAppServerRuntimeOptions, o as resolveCodexComputerUseConfig, t as codexAppServerStartOptionsKey } from "./config-giW8X0QA.js";
+import { a as CODEX_APP_SERVER_VERSION, c as resolveMacOSDesktopCodexAppPathCandidates, l as resolveMacOSDesktopCodexBundledMarketplaceCandidates, n as resolveManagedCodexAppServerStartOptions, o as MIN_SUPPORTED_CODEX_APP_SERVER_VERSION, r as resolveManagedCodexNativeCommand, s as resolveFirstExistingMacOSDesktopCodexBundledMarketplacePath, t as isManagedCodexDesktopCommand, u as resolveMacOSDesktopCodexComputerUseServiceAppCandidates } from "./managed-binary-DFYK4DWq.js";
+import { o as isCodexAppServerNativeAuthProfile } from "./session-binding-Bcynfd-_.js";
 import { n as resolveCodexAppServerSpawnEnv, t as createStdioTransport } from "./transport-stdio-DhoGy33Z.js";
-import { a as CODEX_APP_SERVER_VERSION, n as resolveManagedCodexAppServerStartOptions, o as MIN_SUPPORTED_CODEX_APP_SERVER_VERSION, r as resolveManagedCodexNativeCommand } from "./managed-binary-By4FZC6i.js";
 import { isRecord, normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
 import fs from "node:fs/promises";
 import path from "node:path";
@@ -10,15 +10,14 @@ import { createDeferred } from "openclaw/plugin-sdk/extension-shared";
 import { addTimerTimeoutGraceMs, resolveTimerTimeoutMs } from "openclaw/plugin-sdk/number-runtime";
 import { AgentHarnessPreflightError, OPENCLAW_VERSION, embeddedAgentLog, formatErrorMessage } from "openclaw/plugin-sdk/agent-harness-runtime";
 import { createHash, randomUUID } from "node:crypto";
-import fsSync, { constants, existsSync } from "node:fs";
+import fsSync, { constants, existsSync, watch } from "node:fs";
 import os from "node:os";
 import { isDeepStrictEqual } from "node:util";
 import { ensureAuthProfileStore, findPersistedAuthProfileCredential, loadAuthProfileStoreForSecretsRuntime, refreshOAuthCredentialForRuntime, resolveApiKeyForProfile, resolveAuthProfileOrder, resolveDefaultAgentDir, resolvePersistedAuthProfileOwnerAgentDir, resolveProviderIdForAuth } from "openclaw/plugin-sdk/agent-runtime";
-import { hasUsableOAuthCredential } from "openclaw/plugin-sdk/provider-auth";
+import { hasUsableOAuthCredential, resolveOpenAICodexAuthIdentity } from "openclaw/plugin-sdk/provider-auth";
 import { readSecretFile } from "openclaw/plugin-sdk/secret-file";
-import { pruneMapToMaxSize } from "openclaw/plugin-sdk/collection-runtime";
-import { runExec } from "openclaw/plugin-sdk/process-runtime";
 import { assertNoSymlinkParents, withTimeout } from "openclaw/plugin-sdk/security-runtime";
+import { runExec } from "openclaw/plugin-sdk/process-runtime";
 import { execFile } from "node:child_process";
 import { createInterface } from "node:readline";
 import { coerceErrorMessage, toStringifiedError } from "openclaw/plugin-sdk/error-runtime";
@@ -56,131 +55,6 @@ function withEphemeralCodexAuthStore(params) {
 	};
 }
 //#endregion
-//#region extensions/codex/src/app-server/desktop-app-paths.ts
-/** Shared path candidates for Codex's macOS desktop app bundle. */
-const MACOS_DESKTOP_CODEX_APP_PATH_CANDIDATES = [{
-	appName: "ChatGPT.app",
-	appBundlePath: "/Applications/ChatGPT.app",
-	appServerCommandPath: "/Applications/ChatGPT.app/Contents/Resources/codex",
-	bundledMarketplacePath: "/Applications/ChatGPT.app/Contents/Resources/plugins/openai-bundled",
-	computerUseServiceAppPaths: ["/Applications/ChatGPT.app/Contents/Resources/cua_node/lib/node_modules/@oai/sky/Codex Computer Use.app", "/Applications/ChatGPT.app/Contents/Resources/plugins/openai-bundled/plugins/computer-use/Codex Computer Use.app"]
-}, {
-	appName: "Codex.app",
-	appBundlePath: "/Applications/Codex.app",
-	appServerCommandPath: "/Applications/Codex.app/Contents/Resources/codex",
-	bundledMarketplacePath: "/Applications/Codex.app/Contents/Resources/plugins/openai-bundled",
-	computerUseServiceAppPaths: ["/Applications/Codex.app/Contents/Resources/plugins/openai-bundled/plugins/computer-use/Codex Computer Use.app", "/Applications/Codex.app/Contents/Resources/cua_node/lib/node_modules/@oai/sky/Codex Computer Use.app"]
-}];
-function resolveMacOSDesktopCodexBundledMarketplaceCandidates(platform = process.platform) {
-	return platform === "darwin" ? MACOS_DESKTOP_CODEX_APP_PATH_CANDIDATES.map((candidate) => candidate.bundledMarketplacePath) : [];
-}
-function resolveMacOSDesktopCodexComputerUseServiceAppCandidates(platform = process.platform, appServerCommand) {
-	if (platform !== "darwin") return [];
-	const matchingCandidate = appServerCommand ? MACOS_DESKTOP_CODEX_APP_PATH_CANDIDATES.find((candidate) => path.resolve(candidate.appServerCommandPath) === path.resolve(appServerCommand)) : void 0;
-	const orderedCandidates = matchingCandidate ? [matchingCandidate, ...MACOS_DESKTOP_CODEX_APP_PATH_CANDIDATES.filter((candidate) => candidate !== matchingCandidate)] : MACOS_DESKTOP_CODEX_APP_PATH_CANDIDATES;
-	return [...new Set(orderedCandidates.flatMap((candidate) => candidate.computerUseServiceAppPaths))];
-}
-function resolveFirstExistingMacOSDesktopCodexBundledMarketplacePath(params = {}) {
-	const candidates = params.candidates ?? resolveMacOSDesktopCodexBundledMarketplaceCandidates(params.platform);
-	const pathExists = params.pathExists ?? existsSync;
-	return candidates.find((candidate) => pathExists(candidate));
-}
-//#endregion
-//#region extensions/codex/src/app-server/computer-use-cache.ts
-/** Shared Computer Use plugin cache reconciliation for isolated Codex homes. */
-const DEFAULT_CODEX_COMPUTER_USE_BUNDLED_MARKETPLACE_PATH = resolveMacOSDesktopCodexBundledMarketplaceCandidates("darwin")[0] ?? "";
-const DEFAULT_BUNDLED_MARKETPLACE_NAME = "openai-bundled";
-async function ensureCodexComputerUseSharedPluginCache(params) {
-	if (!params.config.enabled) return skippedCacheResult("disabled", "Computer Use cache sharing skipped because it is disabled.");
-	if (params.config.pluginCacheMode === "independent") return skippedCacheResult("independent", "Computer Use cache sharing skipped because pluginCacheMode is independent.");
-	if (params.config.marketplaceName || params.config.marketplacePath) return skippedCacheResult("explicit_marketplace", "Computer Use cache sharing skipped because an explicit marketplace is configured.");
-	const bundledMarketplacePath = resolveComputerUseBundledMarketplacePath(params);
-	const sourcePluginRoot = path.join(bundledMarketplacePath, "plugins", params.config.pluginName);
-	const version = await readBundledPluginVersion(sourcePluginRoot);
-	if (!version) return skippedCacheResult("source_missing", `Computer Use bundled plugin source was not found at ${sourcePluginRoot}.`);
-	const marketplaceName = params.config.marketplaceName ?? DEFAULT_BUNDLED_MARKETPLACE_NAME;
-	const cacheRoot = path.join(params.codexHome, "plugins", "cache", marketplaceName, params.config.pluginName);
-	const cachePath = path.join(cacheRoot, version);
-	return {
-		status: "shared",
-		changed: await ensureRealDirectoryCopy(cachePath, sourcePluginRoot, version),
-		cachePath,
-		targetPath: sourcePluginRoot,
-		version,
-		removedStaleVersions: [],
-		warnings: [],
-		message: `Computer Use plugin cache ${cachePath} contains bundled plugin ${sourcePluginRoot}.`
-	};
-}
-function resolveComputerUseBundledMarketplacePath(params) {
-	return params.bundledMarketplacePath ?? resolveFirstExistingMacOSDesktopCodexBundledMarketplacePath({ candidates: params.bundledMarketplacePathCandidates }) ?? params.bundledMarketplacePathCandidates?.[0] ?? DEFAULT_CODEX_COMPUTER_USE_BUNDLED_MARKETPLACE_PATH;
-}
-async function readBundledPluginVersion(sourcePluginRoot) {
-	const pluginJsonPath = path.join(sourcePluginRoot, ".codex-plugin", "plugin.json");
-	let raw;
-	try {
-		raw = await fs.readFile(pluginJsonPath, "utf8");
-	} catch {
-		return;
-	}
-	try {
-		const parsed = JSON.parse(raw);
-		return typeof parsed.version === "string" && parsed.version.trim() ? parsed.version.trim() : void 0;
-	} catch {
-		return;
-	}
-}
-async function ensureRealDirectoryCopy(cachePath, sourcePluginRoot, version) {
-	await fs.mkdir(path.dirname(cachePath), { recursive: true });
-	const stat = await fs.lstat(cachePath).catch(() => void 0);
-	if (stat?.isDirectory() && !stat.isSymbolicLink()) {
-		if (await readBundledPluginVersion(cachePath) === version) return false;
-	}
-	const cacheRoot = path.dirname(cachePath);
-	const cacheName = path.basename(cachePath);
-	const stagingRoot = await fs.mkdtemp(path.join(cacheRoot, `.${cacheName}.staging-`));
-	const stagedPath = path.join(stagingRoot, cacheName);
-	const backupPath = path.join(cacheRoot, `.${cacheName}.backup-${process.pid}-${Date.now()}`);
-	let backupCreated = false;
-	try {
-		await fs.cp(sourcePluginRoot, stagedPath, { recursive: true });
-		if (stat) {
-			await fs.rename(cachePath, backupPath);
-			backupCreated = true;
-		}
-		try {
-			await fs.rename(stagedPath, cachePath);
-		} catch (error) {
-			if (backupCreated) try {
-				await fs.rename(backupPath, cachePath);
-				backupCreated = false;
-			} catch (restoreError) {
-				throw new Error(`Failed to install Computer Use cache ${cachePath} and restore its prior copy: ${String(error)}`, { cause: restoreError });
-			}
-			throw error;
-		}
-		if (backupCreated) await fs.rm(backupPath, {
-			recursive: true,
-			force: true
-		});
-		return true;
-	} finally {
-		await fs.rm(stagingRoot, {
-			recursive: true,
-			force: true
-		});
-	}
-}
-function skippedCacheResult(status, message) {
-	return {
-		status,
-		changed: false,
-		message,
-		removedStaleVersions: [],
-		warnings: status === "source_missing" ? [message] : []
-	};
-}
-//#endregion
 //#region extensions/codex/src/app-server/computer-use-service-path.ts
 /** Filesystem ownership guards for isolated Computer Use service provisioning. */
 async function assertOwnedServicePath(params) {
@@ -279,7 +153,7 @@ async function assertNotSymlink(filePath, label) {
 	try {
 		if ((await fs.lstat(filePath)).isSymbolicLink()) throw new Error(`${label} must not be a symbolic link: ${filePath}`);
 	} catch (error) {
-		if (hasNodeErrorCode(error, "ENOENT")) return;
+		if (hasNodeErrorCode$1(error, "ENOENT")) return;
 		throw error;
 	}
 }
@@ -292,14 +166,14 @@ async function ensureRealDirectoryTree(ownershipRoot, directoryPath, label) {
 	for (const segment of relative.split(path.sep).filter(Boolean)) {
 		current = path.join(current, segment);
 		const existing = await fs.lstat(current).catch((error) => {
-			if (hasNodeErrorCode(error, "ENOENT")) return;
+			if (hasNodeErrorCode$1(error, "ENOENT")) return;
 			throw error;
 		});
 		if (!existing) {
 			try {
 				await fs.mkdir(current, { mode: 448 });
 			} catch (error) {
-				if (!hasNodeErrorCode(error, "EEXIST")) throw error;
+				if (!hasNodeErrorCode$1(error, "EEXIST")) throw error;
 			}
 			const created = await fs.lstat(current);
 			if (created.isSymbolicLink() || !created.isDirectory()) throw new Error(`${label} changed while its directory tree was being created: ${current}`);
@@ -318,6 +192,259 @@ function assertPathAtOrInside(rootPath, candidatePath, label) {
 	const relative = path.relative(path.resolve(rootPath), path.resolve(candidatePath));
 	if (relative === ".." || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative)) throw new Error(`${label} must remain inside ${path.resolve(rootPath)}.`);
 }
+function hasNodeErrorCode$1(error, code) {
+	return Boolean(error && typeof error === "object" && "code" in error && error.code === code);
+}
+//#endregion
+//#region extensions/codex/src/app-server/computer-use-cache.ts
+/** Shared Computer Use plugin cache reconciliation for isolated Codex homes. */
+const DEFAULT_CODEX_COMPUTER_USE_BUNDLED_MARKETPLACE_PATH = resolveMacOSDesktopCodexBundledMarketplaceCandidates("darwin")[0] ?? "";
+const DEFAULT_BUNDLED_MARKETPLACE_NAME = "openai-bundled";
+async function ensureCodexComputerUseSharedPluginCache(params) {
+	if (!params.config.enabled) return skippedCacheResult("disabled", "Computer Use cache sharing skipped because it is disabled.");
+	if (params.config.pluginCacheMode === "independent") return skippedCacheResult("independent", "Computer Use cache sharing skipped because pluginCacheMode is independent.");
+	if (params.config.marketplaceName || params.config.marketplacePath) return skippedCacheResult("explicit_marketplace", "Computer Use cache sharing skipped because an explicit marketplace is configured.");
+	const bundledMarketplacePath = resolveComputerUseBundledMarketplacePath(params);
+	const sourcePluginRoot = path.join(bundledMarketplacePath, "plugins", params.config.pluginName);
+	const version = await readBundledPluginVersion(sourcePluginRoot);
+	if (!version) return skippedCacheResult("source_missing", `Computer Use bundled plugin source was not found at ${sourcePluginRoot}.`);
+	const marketplaceName = params.config.marketplaceName ?? DEFAULT_BUNDLED_MARKETPLACE_NAME;
+	const cacheRoot = path.join(params.codexHome, "plugins", "cache", marketplaceName, params.config.pluginName);
+	const cachePath = path.join(cacheRoot, version);
+	return {
+		status: "shared",
+		changed: await ensureRealDirectoryCopy(cachePath, sourcePluginRoot, version, {
+			codexHome: params.codexHome,
+			ownershipRoot: params.ownershipRoot,
+			assertCurrent: params.assertCurrent,
+			forceRefresh: params.forceRefresh
+		}),
+		cachePath,
+		targetPath: sourcePluginRoot,
+		version,
+		removedStaleVersions: [],
+		warnings: [],
+		message: `Computer Use plugin cache ${cachePath} contains bundled plugin ${sourcePluginRoot}.`
+	};
+}
+function resolveComputerUseBundledMarketplacePath(params) {
+	return params.bundledMarketplacePath ?? resolveFirstExistingMacOSDesktopCodexBundledMarketplacePath({ candidates: params.bundledMarketplacePathCandidates }) ?? params.bundledMarketplacePathCandidates?.[0] ?? DEFAULT_CODEX_COMPUTER_USE_BUNDLED_MARKETPLACE_PATH;
+}
+async function readBundledPluginVersion(sourcePluginRoot) {
+	const pluginJsonPath = path.join(sourcePluginRoot, ".codex-plugin", "plugin.json");
+	let raw;
+	try {
+		raw = await fs.readFile(pluginJsonPath, "utf8");
+	} catch {
+		return;
+	}
+	try {
+		const parsed = JSON.parse(raw);
+		return typeof parsed.version === "string" && parsed.version.trim() ? parsed.version.trim() : void 0;
+	} catch {
+		return;
+	}
+}
+async function ensureRealDirectoryCopy(cachePath, sourcePluginRoot, version, boundary) {
+	const cacheRoot = path.dirname(cachePath);
+	const ownedParent = boundary.ownershipRoot ? await prepareOwnedServiceParent({
+		ownershipRoot: boundary.ownershipRoot,
+		codexHome: boundary.codexHome,
+		targetParent: cacheRoot
+	}) : void 0;
+	if (!ownedParent) await fs.mkdir(cacheRoot, { recursive: true });
+	const physicalCachePath = ownedParent ? path.join(ownedParent.realPath, path.basename(cachePath)) : cachePath;
+	const stat = await fs.lstat(physicalCachePath).catch(() => void 0);
+	if (stat?.isDirectory() && !stat.isSymbolicLink()) {
+		if (await readBundledPluginVersion(physicalCachePath) === version && !boundary.forceRefresh) return false;
+	}
+	const cacheName = path.basename(cachePath);
+	const physicalCacheRoot = path.dirname(physicalCachePath);
+	const stagingRoot = await fs.mkdtemp(path.join(physicalCacheRoot, `.${cacheName}.staging-`));
+	const stagedPath = path.join(stagingRoot, cacheName);
+	const backupPath = path.join(physicalCacheRoot, `.${cacheName}.backup-${process.pid}-${Date.now()}`);
+	let backupCreated = false;
+	try {
+		await fs.cp(sourcePluginRoot, stagedPath, { recursive: true });
+		if (ownedParent) await assertDirectoryIdentityStable(ownedParent, "Computer Use plugin cache parent");
+		if (stat) {
+			boundary.assertCurrent?.();
+			await fs.rename(physicalCachePath, backupPath);
+			backupCreated = true;
+		}
+		try {
+			if (ownedParent) await assertDirectoryIdentityStable(ownedParent, "Computer Use plugin cache parent");
+			boundary.assertCurrent?.();
+			await fs.rename(stagedPath, physicalCachePath);
+		} catch (error) {
+			if (backupCreated) try {
+				if (ownedParent) await assertDirectoryIdentityStable(ownedParent, "Computer Use plugin cache parent");
+				await fs.rename(backupPath, physicalCachePath);
+				backupCreated = false;
+			} catch (restoreError) {
+				throw new Error(`Failed to install Computer Use cache ${cachePath} and restore its prior copy: ${String(error)}`, { cause: restoreError });
+			}
+			throw error;
+		}
+		if (backupCreated) {
+			if (ownedParent) await assertDirectoryIdentityStable(ownedParent, "Computer Use plugin cache parent");
+			await fs.rm(backupPath, {
+				recursive: true,
+				force: true
+			});
+		}
+		return true;
+	} finally {
+		if (!ownedParent || await directoryIdentityIsStable(ownedParent)) await fs.rm(stagingRoot, {
+			recursive: true,
+			force: true
+		});
+	}
+}
+function skippedCacheResult(status, message) {
+	return {
+		status,
+		changed: false,
+		message,
+		removedStaleVersions: [],
+		warnings: status === "source_missing" ? [message] : []
+	};
+}
+//#endregion
+//#region extensions/codex/src/app-server/computer-use-marketplace.ts
+/** Managed local wrapper for Codex's reserved bundled marketplace. */
+const MARKETPLACE_NAME = "openai-bundled";
+const activeInstalls$1 = /* @__PURE__ */ new Map();
+function resolveCodexManagedBundledMarketplacePath(codexHome) {
+	return path.join(codexHome, ".tmp", "bundled-marketplaces", MARKETPLACE_NAME);
+}
+async function ensureCodexManagedBundledMarketplace(params) {
+	const candidates = params.candidates ?? resolveMacOSDesktopCodexAppPathCandidates();
+	const source = await resolveCodexManagedBundledMarketplaceSource({
+		...params,
+		candidates
+	});
+	if (!source) return;
+	const parentPath = path.dirname(resolveCodexManagedBundledMarketplacePath(params.codexHome));
+	const targetPath = path.join(parentPath, MARKETPLACE_NAME);
+	const parent = await prepareOwnedServiceParent({
+		ownershipRoot: params.ownershipRoot,
+		codexHome: params.codexHome,
+		targetParent: parentPath
+	});
+	const physicalTargetPath = path.join(parent.realPath, MARKETPLACE_NAME);
+	await assertNotSymlink(physicalTargetPath, "managed bundled marketplace");
+	const active = activeInstalls$1.get(physicalTargetPath);
+	if (active) {
+		if (active.sourcePath === source.bundledMarketplacePath) return await active.promise;
+		await active.promise.catch(() => void 0);
+		return await ensureCodexManagedBundledMarketplace(params);
+	}
+	const install = reconcileManagedWrapper({
+		parent,
+		physicalTargetPath,
+		targetPath,
+		source,
+		ownershipCandidates: params.ownershipCandidates ?? candidates,
+		assertCurrent: params.assertCurrent
+	});
+	const activeEntry = {
+		sourcePath: source.bundledMarketplacePath,
+		promise: install
+	};
+	activeInstalls$1.set(physicalTargetPath, activeEntry);
+	const clearActive = () => {
+		if (activeInstalls$1.get(physicalTargetPath) === activeEntry) activeInstalls$1.delete(physicalTargetPath);
+	};
+	install.then(clearActive, clearActive);
+	return await install;
+}
+async function reconcileManagedWrapper(params) {
+	if (await wrapperMatches(params.physicalTargetPath, params.source.bundledMarketplacePath)) return params.targetPath;
+	return await publishManagedWrapper(params);
+}
+async function publishManagedWrapper(params) {
+	const { parent, physicalTargetPath, targetPath, source, ownershipCandidates, assertCurrent } = params;
+	const stagingPath = await fs.mkdtemp(path.join(parent.realPath, `.${MARKETPLACE_NAME}.staging-`));
+	const backupPath = path.join(parent.realPath, `.${MARKETPLACE_NAME}.backup-${process.pid}-${Date.now()}`);
+	let backupCreated = false;
+	try {
+		const manifestParent = path.join(stagingPath, ".agents", "plugins");
+		await fs.mkdir(manifestParent, {
+			recursive: true,
+			mode: 448
+		});
+		await Promise.all([fs.symlink(path.join(source.bundledMarketplacePath, ".agents", "plugins", "marketplace.json"), path.join(manifestParent, "marketplace.json")), fs.symlink(path.join(source.bundledMarketplacePath, "plugins"), path.join(stagingPath, "plugins"))]);
+		await assertDirectoryIdentityStable(parent, "managed bundled marketplace parent");
+		const existing = await fs.lstat(physicalTargetPath).catch((error) => {
+			if (hasNodeErrorCode(error, "ENOENT")) return;
+			throw error;
+		});
+		if (existing && !existing.isDirectory()) throw new Error(`Managed bundled marketplace must be a real directory: ${targetPath}`);
+		if (existing && !await wrapperMatchesAnySource(physicalTargetPath, ownershipCandidates)) throw new Error(`Refusing to replace an unowned bundled marketplace directory: ${targetPath}`);
+		if (existing) {
+			assertCurrent?.();
+			await fs.rename(physicalTargetPath, backupPath);
+			backupCreated = true;
+			await assertDirectoryIdentityStable(parent, "managed bundled marketplace parent");
+		}
+		assertCurrent?.();
+		await fs.rename(stagingPath, physicalTargetPath);
+		await assertDirectoryIdentityStable(parent, "managed bundled marketplace parent");
+		if (backupCreated) {
+			await fs.rm(backupPath, { recursive: true });
+			backupCreated = false;
+		}
+		return targetPath;
+	} catch (error) {
+		if (backupCreated) try {
+			await assertDirectoryIdentityStable(parent, "managed bundled marketplace parent");
+			if (await fs.lstat(physicalTargetPath).catch(() => void 0)) {
+				if (!await wrapperMatches(physicalTargetPath, source.bundledMarketplacePath)) throw new Error("managed bundled marketplace replacement is no longer owned", { cause: error });
+				await fs.rm(physicalTargetPath, { recursive: true });
+			}
+			await fs.rename(backupPath, physicalTargetPath);
+			backupCreated = false;
+		} catch (restoreError) {
+			throw new Error(`Failed to restore the prior managed bundled marketplace: ${String(error)}`, { cause: restoreError });
+		}
+		throw error;
+	} finally {
+		if (await directoryIdentityIsStable(parent)) await fs.rm(stagingPath, {
+			recursive: true,
+			force: true
+		});
+	}
+}
+async function resolveCodexManagedBundledMarketplaceSource(params) {
+	const candidates = params.candidates ?? resolveMacOSDesktopCodexAppPathCandidates();
+	const command = params.appServerCommand && path.resolve(params.appServerCommand);
+	const ordered = command ? candidates.filter((candidate) => path.resolve(candidate.appServerCommandPath) === command) : candidates;
+	for (const candidate of ordered) if (await isExpectedMarketplace(candidate.bundledMarketplacePath)) return candidate;
+}
+async function isExpectedMarketplace(root) {
+	try {
+		const manifest = JSON.parse(await fs.readFile(path.join(root, ".agents", "plugins", "marketplace.json"), "utf8"));
+		await fs.access(path.join(root, "plugins", "computer-use", ".codex-plugin", "plugin.json"));
+		return isRecord(manifest) && manifest.name === MARKETPLACE_NAME && Array.isArray(manifest.plugins) && manifest.plugins.some((plugin) => isRecord(plugin) && plugin.name === "computer-use");
+	} catch {
+		return false;
+	}
+}
+async function wrapperMatches(targetPath, sourcePath) {
+	try {
+		const target = await fs.lstat(targetPath);
+		if (!target.isDirectory() || target.isSymbolicLink()) return false;
+		const [manifest, plugins] = await Promise.all([fs.readlink(path.join(targetPath, ".agents", "plugins", "marketplace.json")), fs.readlink(path.join(targetPath, "plugins"))]);
+		return manifest === path.join(sourcePath, ".agents", "plugins", "marketplace.json") && plugins === path.join(sourcePath, "plugins");
+	} catch {
+		return false;
+	}
+}
+async function wrapperMatchesAnySource(targetPath, candidates) {
+	for (const candidate of candidates) if (await wrapperMatches(targetPath, candidate.bundledMarketplacePath)) return true;
+	return false;
+}
 function hasNodeErrorCode(error, code) {
 	return Boolean(error && typeof error === "object" && "code" in error && error.code === code);
 }
@@ -332,9 +459,13 @@ const CLIENT_APP_RELATIVE_PATH = path.join("Contents", "SharedSupport", "SkyComp
 const CLIENT_RELATIVE_PATH = path.join(CLIENT_APP_RELATIVE_PATH, "Contents", "MacOS", "SkyComputerUseClient");
 const COPY_TIMEOUT_MS = 12e4;
 const INSPECT_TIMEOUT_MS = 3e4;
-const COMPLETED_SYNC_CACHE_MAX_ENTRIES = 64;
 const activeInstalls = /* @__PURE__ */ new Map();
-const completedSyncs = /* @__PURE__ */ new Map();
+/** Finds the first signed native service from one ordered desktop owner set. */
+async function resolveCodexComputerUseServiceAppSourcePath(params) {
+	const platform = params.platform ?? process.platform;
+	if (platform !== "darwin") return;
+	return (await findUsableServiceApp(params.sourceAppCandidates ?? resolveMacOSDesktopCodexComputerUseServiceAppCandidates(platform, params.appServerCommand), params.inspectServiceApp ?? inspectTrustedServiceApp))?.path;
+}
 /** Synchronizes the CODEX_HOME native client with the selected signed desktop distribution. */
 async function ensureCodexComputerUseServiceApp(params) {
 	const platform = params.platform ?? process.platform;
@@ -355,25 +486,12 @@ async function ensureCodexComputerUseServiceApp(params) {
 	});
 	const candidates = params.sourceAppCandidates ?? resolveMacOSDesktopCodexComputerUseServiceAppCandidates(platform, params.appServerCommand);
 	const syncKey = [targetPath, ...candidates].join("\0");
-	const completed = completedSyncs.get(targetPath);
-	if (completed?.syncKey === syncKey) {
-		completedSyncs.delete(targetPath);
-		completedSyncs.set(targetPath, completed);
-		return {
-			status: "already_current",
-			changed: false,
-			targetPath: completed.targetPath,
-			sourcePath: completed.sourcePath,
-			sourceBuild: completed.sourceBuild
-		};
-	}
 	const active = activeInstalls.get(targetPath);
 	if (active) {
 		if (active.syncKey === syncKey) return await active.promise;
 		await active.promise.catch(() => void 0);
 		return await ensureCodexComputerUseServiceApp(params);
 	}
-	if (completed) completedSyncs.delete(targetPath);
 	const install = ensureCodexComputerUseServiceAppOnce({
 		...params,
 		codexHome,
@@ -382,18 +500,6 @@ async function ensureCodexComputerUseServiceApp(params) {
 		targetPath,
 		platform,
 		sourceAppCandidates: candidates
-	}).then((result) => {
-		if (isCompletedSyncStatus(result.status)) {
-			completedSyncs.delete(targetPath);
-			completedSyncs.set(targetPath, {
-				syncKey,
-				targetPath: result.targetPath,
-				sourcePath: result.sourcePath,
-				sourceBuild: result.sourceBuild
-			});
-			pruneMapToMaxSize(completedSyncs, COMPLETED_SYNC_CACHE_MAX_ENTRIES);
-		}
-		return result;
 	});
 	const activeEntry = {
 		syncKey,
@@ -406,9 +512,6 @@ async function ensureCodexComputerUseServiceApp(params) {
 	install.then(clearActive, clearActive);
 	return await install;
 }
-function isCompletedSyncStatus(status) {
-	return status === "installed" || status === "refreshed" || status === "already_current";
-}
 async function ensureCodexComputerUseServiceAppOnce(params) {
 	const inspectServiceApp = params.inspectServiceApp ?? inspectTrustedServiceApp;
 	const source = await findUsableServiceApp(params.sourceAppCandidates ?? [], inspectServiceApp);
@@ -453,6 +556,7 @@ async function ensureCodexComputerUseServiceAppOnce(params) {
 		await assertNotSymlink(operationTargetPath, "Computer Use service target");
 		if (await pathExists$1(operationTargetPath)) {
 			await assertOwnedServiceParentStable(ownedParent);
+			params.assertCurrent?.();
 			await fs.rename(operationTargetPath, backupPath);
 			await assertOwnedServiceParentStable(ownedParent);
 			backupCreated = true;
@@ -480,6 +584,7 @@ async function ensureCodexComputerUseServiceAppOnce(params) {
 		}
 		try {
 			await assertOwnedServiceParentStable(ownedParent);
+			params.assertCurrent?.();
 			await fs.rename(stagedPath, operationTargetPath);
 			await assertOwnedServiceParentStable(ownedParent);
 		} catch (error) {
@@ -742,10 +847,12 @@ const CODEX_APP_SERVER_PREPARED_AUTH_ENV_VARS = [
 const CODEX_APP_SERVER_HOME_ENV_VARS = [CODEX_HOME_ENV_VAR, HOME_ENV_VAR];
 const CODEX_AUTH_JSON_FILENAME = "auth.json";
 const CODEX_HOME_DIRNAME = ".codex";
+const MAX_COMPUTER_USE_ARTIFACT_OWNERS = 128;
+const activeComputerUseArtifactReconciliations = /* @__PURE__ */ new Map();
 const scopedOAuthRefreshQueues = /* @__PURE__ */ new WeakMap();
 async function bridgeCodexAppServerStartOptions(params) {
 	if (params.startOptions.transport !== "stdio") return params.startOptions;
-	const scopeStartOptions = () => withCodexHomeEnvironment(withEphemeralCodexAuthStore(params), params.agentDir, params.pluginConfig);
+	const scopeStartOptions = () => withCodexHomeEnvironment(withEphemeralCodexAuthStore(params), params.agentDir);
 	if (params.preparedAuth) return withClearedEnvironmentVariables(await scopeStartOptions(), CODEX_APP_SERVER_PREPARED_AUTH_ENV_VARS);
 	if (params.authProfileId === null) return scopeStartOptions();
 	const store = resolveCodexAppServerAuthProfileStore({
@@ -845,7 +952,7 @@ async function resolveCodexAppServerPreparedAuthProfileSnapshot(params) {
 	const accountId = loginParams.type === "chatgptAuthTokens" ? loginParams.chatgptAccountId : resolveChatgptAccountId(profileId, credential);
 	const stableChatgptAccountId = resolveStableChatgptAccountId(credential);
 	const secretFreeCacheKey = credential.type === "api_key" && loginParams.type === "apiKey" ? `${accountId}:${fingerprintApiKeyAuthProfileCacheKey(loginParams.apiKey)}` : loginParams.type === "chatgptAuthTokens" && (credential.type === "token" || !stableChatgptAccountId) ? `${accountId}:${fingerprintTokenAuthProfileCacheKey(loginParams.accessToken)}` : accountId;
-	const chatgptAccountId = resolveExplicitChatgptAccountId(credential);
+	const chatgptAccountId = loginParams.type === "chatgptAuthTokens" ? loginParams.chatgptAccountId : void 0;
 	return {
 		loginParams,
 		secretFreeCacheKey,
@@ -974,28 +1081,10 @@ function fingerprintCodexCliAuthFileApiKeyCacheKey(apiKey) {
 	hash.update(apiKey);
 	return `CODEX_AUTH_JSON:sha256:${hash.digest("hex")}`;
 }
-async function withCodexHomeEnvironment(startOptions, agentDir, pluginConfig) {
+async function withCodexHomeEnvironment(startOptions, agentDir) {
 	const codexHome = resolveCodexAppServerLocalHomeDir(startOptions, agentDir);
 	const nativeHome = startOptions.env?.[HOME_ENV_VAR]?.trim() ? startOptions.env[HOME_ENV_VAR] : void 0;
 	await fs.mkdir(codexHome, { recursive: true });
-	const computerUseConfig = resolveCodexComputerUseConfig({ pluginConfig });
-	await ensureCodexComputerUseSharedPluginCache({
-		codexHome,
-		config: computerUseConfig
-	});
-	const ownsIsolatedCodexHome = startOptions.homeScope !== "user" && !startOptions.env?.[CODEX_HOME_ENV_VAR]?.trim();
-	if (computerUseConfig.enabled && computerUseConfig.autoInstall && ownsIsolatedCodexHome) try {
-		await ensureCodexComputerUseServiceApp({
-			codexHome,
-			ownershipRoot: agentDir,
-			appServerCommand: startOptions.command
-		});
-	} catch (error) {
-		throw new AgentHarnessPreflightError("Codex Computer Use client provisioning failed.", {
-			cause: error,
-			scope: "harness"
-		});
-	}
 	if (nativeHome) await fs.mkdir(nativeHome, { recursive: true });
 	const nextStartOptions = {
 		...startOptions,
@@ -1010,6 +1099,138 @@ async function withCodexHomeEnvironment(startOptions, agentDir, pluginConfig) {
 	else delete nextStartOptions.clearEnv;
 	return nextStartOptions;
 }
+/** Reconciles Computer Use artifacts for the exact managed command about to start. */
+async function reconcileCodexComputerUseStartArtifacts(params) {
+	if (params.startOptions.transport !== "stdio") return;
+	const codexHome = resolveCodexAppServerLocalHomeDir(params.startOptions, params.agentDir);
+	const key = path.resolve(codexHome);
+	let owner = activeComputerUseArtifactReconciliations.get(key);
+	if (!owner) {
+		owner = {
+			active: 0,
+			tail: Promise.resolve()
+		};
+		activeComputerUseArtifactReconciliations.set(key, owner);
+	} else {
+		activeComputerUseArtifactReconciliations.delete(key);
+		activeComputerUseArtifactReconciliations.set(key, owner);
+	}
+	owner.active += 1;
+	const epoch = params.desktopGeneration?.epoch;
+	if (epoch !== void 0 && (owner.latestEpoch === void 0 || epoch > owner.latestEpoch)) owner.latestEpoch = epoch;
+	const assertCurrent = () => {
+		params.assertCurrent?.();
+		if (epoch !== void 0 && owner.latestEpoch !== epoch) throw new Error("Codex Computer Use artifact reconciliation was superseded.");
+	};
+	const operation = owner.tail.catch(() => void 0).then(async () => {
+		assertCurrent();
+		const appliedCacheBinding = await reconcileCodexComputerUseStartArtifactsOnce({
+			...params,
+			codexHome,
+			assertCurrent,
+			previousCacheBinding: owner.appliedCacheBinding
+		});
+		assertCurrent();
+		owner.appliedCacheBinding = appliedCacheBinding;
+	});
+	const settled = operation.then(() => void 0, () => void 0);
+	owner.tail = settled;
+	try {
+		await operation;
+	} finally {
+		owner.active = Math.max(0, owner.active - 1);
+		if (owner.active === 0 && owner.latestEpoch === void 0 && activeComputerUseArtifactReconciliations.get(key) === owner && owner.tail === settled) activeComputerUseArtifactReconciliations.delete(key);
+		pruneComputerUseArtifactOwners();
+	}
+}
+async function reconcileCodexComputerUseStartArtifactsOnce(params) {
+	const codexHome = params.codexHome;
+	const computerUseConfig = resolveCodexComputerUseConfig({ pluginConfig: params.pluginConfig });
+	const ownsIsolatedCodexHome = params.ownsIsolatedCodexHome ?? (params.startOptions.homeScope !== "user" && !params.startOptions.env?.[CODEX_HOME_ENV_VAR]?.trim());
+	const shouldProvisionComputerUse = computerUseConfig.enabled && computerUseConfig.autoInstall && ownsIsolatedCodexHome;
+	if (shouldProvisionComputerUse) await ensureOwnedCodexHome(codexHome, params.agentDir);
+	else await fs.mkdir(codexHome, { recursive: true });
+	const desktopCandidates = resolveMacOSDesktopCodexAppPathCandidates();
+	const exactDesktopCandidate = desktopCandidates.find((candidate) => path.resolve(candidate.appServerCommandPath) === path.resolve(params.startOptions.command));
+	const usesManagedBundledMarketplace = !computerUseConfig.marketplaceSource && !computerUseConfig.marketplacePath && !computerUseConfig.marketplaceName;
+	const needsBundledMarketplace = usesManagedBundledMarketplace || computerUseConfig.pluginCacheMode === "shared" && !computerUseConfig.marketplaceName && !computerUseConfig.marketplacePath;
+	const artifactCandidate = shouldProvisionComputerUse ? await resolveCompleteComputerUseArtifactCandidate({
+		candidates: exactDesktopCandidate ? [exactDesktopCandidate] : desktopCandidates,
+		needsBundledMarketplace
+	}) : exactDesktopCandidate;
+	params.assertCurrent();
+	if (shouldProvisionComputerUse) {
+		if (desktopCandidates.length > 0 && !artifactCandidate) throw new CodexComputerUseCandidateArtifactsUnavailableError();
+		try {
+			const marketplacePath = usesManagedBundledMarketplace ? await ensureCodexManagedBundledMarketplace({
+				codexHome,
+				ownershipRoot: params.agentDir,
+				...artifactCandidate ? {
+					appServerCommand: artifactCandidate.appServerCommandPath,
+					candidates: [artifactCandidate],
+					ownershipCandidates: desktopCandidates
+				} : {},
+				assertCurrent: params.assertCurrent
+			}) : void 0;
+			params.assertCurrent();
+			if (usesManagedBundledMarketplace && desktopCandidates.length > 0 && !marketplacePath) throw new CodexComputerUseCandidateArtifactsUnavailableError();
+			const service = await ensureCodexComputerUseServiceApp({
+				codexHome,
+				ownershipRoot: params.agentDir,
+				...artifactCandidate ? {
+					appServerCommand: artifactCandidate.appServerCommandPath,
+					sourceAppCandidates: artifactCandidate.computerUseServiceAppPaths
+				} : {},
+				assertCurrent: params.assertCurrent
+			});
+			params.assertCurrent();
+			if (desktopCandidates.length > 0 && service.status === "source_missing") throw new CodexComputerUseCandidateArtifactsUnavailableError();
+		} catch (error) {
+			params.assertCurrent();
+			if (error instanceof CodexComputerUseCandidateArtifactsUnavailableError) throw error;
+			throw new AgentHarnessPreflightError("Codex Computer Use client provisioning failed.", {
+				cause: error,
+				scope: "harness"
+			});
+		}
+	}
+	params.assertCurrent();
+	const cacheBinding = [
+		params.desktopGeneration?.epoch ?? "manual",
+		artifactCandidate?.bundledMarketplacePath ?? "default",
+		computerUseConfig.pluginName
+	].join("\0");
+	const cache = await ensureCodexComputerUseSharedPluginCache({
+		codexHome,
+		config: computerUseConfig,
+		...ownsIsolatedCodexHome ? { ownershipRoot: params.agentDir } : {},
+		...artifactCandidate ? { bundledMarketplacePath: artifactCandidate.bundledMarketplacePath } : {},
+		assertCurrent: params.assertCurrent,
+		forceRefresh: params.forceCacheRefresh === true || params.previousCacheBinding !== cacheBinding
+	});
+	params.assertCurrent();
+	return cache.status === "shared" ? cacheBinding : void 0;
+}
+async function resolveCompleteComputerUseArtifactCandidate(params) {
+	for (const candidate of params.candidates) {
+		if (params.needsBundledMarketplace && !await resolveCodexManagedBundledMarketplaceSource({ candidates: [candidate] })) continue;
+		if (await resolveCodexComputerUseServiceAppSourcePath({ sourceAppCandidates: candidate.computerUseServiceAppPaths })) return candidate;
+	}
+}
+function pruneComputerUseArtifactOwners() {
+	while (activeComputerUseArtifactReconciliations.size > MAX_COMPUTER_USE_ARTIFACT_OWNERS) {
+		const inactive = [...activeComputerUseArtifactReconciliations].find(([, owner]) => owner.active === 0);
+		if (!inactive) return;
+		activeComputerUseArtifactReconciliations.delete(inactive[0]);
+	}
+}
+var CodexComputerUseCandidateArtifactsUnavailableError = class extends Error {
+	constructor() {
+		super("The selected Codex desktop app does not contain complete Computer Use artifacts.");
+		this.code = "CODEX_COMPUTER_USE_CANDIDATE_ARTIFACTS_UNAVAILABLE";
+		this.name = "CodexComputerUseCandidateArtifactsUnavailableError";
+	}
+};
 function withoutClearedCodexHomeEnv(clearEnv) {
 	if (!clearEnv) return;
 	const reserved = new Set(CODEX_APP_SERVER_HOME_ENV_VARS);
@@ -1097,11 +1318,24 @@ async function resolveCodexAppServerAuthProfileLoginParams(params) {
 	});
 }
 async function refreshCodexAppServerAuthTokens(params) {
+	const previousAccountId = params.previousAccountId?.trim();
+	if (previousAccountId) {
+		const store = resolveCodexAppServerAuthProfileStore(params);
+		const profileId = resolveCodexAppServerAuthProfileId({
+			authProfileId: params.authProfileId,
+			store,
+			config: params.config
+		});
+		const credential = profileId ? store.profiles[profileId] : void 0;
+		const selectedAccountId = credential ? resolveExplicitChatgptAccountId(credential) ?? (credential.type === "oauth" ? resolveOpenAICodexAuthIdentity({ access: credential.access }).accountId : void 0) : void 0;
+		if (selectedAccountId && selectedAccountId !== previousAccountId) throw new Error("ChatGPT workspace changed before Codex token refresh.");
+	}
 	const loginParams = await resolveCodexAppServerAuthProfileLoginParamsInternal({
 		...params,
 		forceOAuthRefresh: true
 	});
 	if (!loginParams || loginParams.type !== "chatgptAuthTokens") throw new Error("Codex app-server ChatGPT token refresh requires an OAuth auth profile.");
+	if (previousAccountId && loginParams.chatgptAccountId !== previousAccountId) throw new Error("ChatGPT workspace changed during Codex token refresh.");
 	return {
 		accessToken: loginParams.accessToken,
 		chatgptAccountId: loginParams.chatgptAccountId,
@@ -1339,10 +1573,15 @@ function readFirstNonEmptyEnvEntry(env, keys) {
 	}
 }
 function buildChatgptAuthTokensParams(profileId, credential, accessToken) {
+	const storedAccountId = resolveExplicitChatgptAccountId(credential);
+	const tokenAccountId = resolveOpenAICodexAuthIdentity({ access: accessToken }).accountId;
+	if (storedAccountId && tokenAccountId && storedAccountId !== tokenAccountId) throw new CodexAppServerAuthProfileUnavailableError(`Codex app-server auth profile "${profileId}" has a different ChatGPT account ID than its access token. Sign in again before retrying.`);
+	const chatgptAccountId = storedAccountId ?? tokenAccountId;
+	if (!chatgptAccountId) throw new CodexAppServerAuthProfileUnavailableError(`Codex app-server auth profile "${profileId}" is missing its ChatGPT account ID. Sign in again before retrying.`);
 	return {
 		type: "chatgptAuthTokens",
 		accessToken,
-		chatgptAccountId: resolveChatgptAccountId(profileId, credential),
+		chatgptAccountId,
 		chatgptPlanType: resolveChatgptPlanType(credential)
 	};
 }
@@ -1462,12 +1701,46 @@ function readLimitId(snapshot) {
 	return typeof value === "string" && value.trim() ? value.trim() : "codex";
 }
 //#endregion
+//#region extensions/codex/src/app-server/timeout.ts
+/**
+* Thin Codex app-server timeout adapter around OpenClaw's shared security
+* runtime timeout helper.
+*/
+function resolveAbortError(signal) {
+	return signal.reason instanceof Error ? signal.reason : new Error("Codex app-server operation aborted", { cause: signal.reason });
+}
+/** Awaits a promise with a Codex-specific timeout error message. */
+async function withTimeout$1(promise, timeoutMs, timeoutMessage, createError) {
+	return await withTimeout(promise, timeoutMs, {
+		message: timeoutMessage,
+		...createError ? { createError } : {}
+	});
+}
+/** Bounds an operation by both its owner lifecycle and one total wall-clock budget. */
+async function withAbortableTimeout(params) {
+	const signal = params.signal;
+	if (signal?.aborted) throw resolveAbortError(signal);
+	let removeAbortListener;
+	const operation = signal ? Promise.race([params.promise, new Promise((_, reject) => {
+		const onAbort = () => reject(resolveAbortError(signal));
+		signal.addEventListener("abort", onAbort, { once: true });
+		removeAbortListener = () => signal.removeEventListener("abort", onAbort);
+	})]) : params.promise;
+	try {
+		return await withTimeout$1(operation, params.timeoutMs, params.timeoutMessage, params.createTimeoutError);
+	} finally {
+		removeAbortListener?.();
+	}
+}
+//#endregion
 //#region extensions/codex/src/app-server/client-runtime.ts
 /** Client-scoped Codex auth and account observers. */
 /** Match Codex's native grace window without retaining inactive conversations indefinitely. */
 const CODEX_APP_SERVER_LIVE_THREAD_IDLE_TIMEOUT_MS = 30 * 6e4;
 /** Native-child parents are active ownership, so only otherwise-idle threads count against this cap. */
 const CODEX_APP_SERVER_LIVE_THREAD_MAX_IDLE = 64;
+/** Return a deterministic error before Codex cancels its ten-second external-auth request. */
+const CODEX_EXTERNAL_AUTH_REFRESH_TIMEOUT_MS = 9e3;
 const configuredClients = /* @__PURE__ */ new WeakMap();
 const physicalThreadReleases = /* @__PURE__ */ new WeakMap();
 const claimedThreadReleaseTokens = /* @__PURE__ */ new WeakMap();
@@ -1481,7 +1754,10 @@ function ensureCodexAppServerClientRuntime(client, context) {
 	const existing = configuredClients.get(client);
 	if (existing) {
 		if (existing.closed) return;
-		existing.context = context;
+		existing.context = {
+			...existing.context,
+			config: context.config
+		};
 		return;
 	}
 	const runtime = {
@@ -1506,12 +1782,16 @@ function ensureCodexAppServerClientRuntime(client, context) {
 	client.addRequestHandler(async (request) => {
 		if (request.method !== "account/chatgptAuthTokens/refresh") return;
 		if (runtime.context.authMode === "prepared-api-key") throw new Error("ChatGPT token refresh is unavailable for prepared Codex API-key auth.");
-		return { ...await refreshCodexAppServerAuthTokens({
+		const previousAccountId = isJsonObject(request.params) && typeof request.params.previousAccountId === "string" ? request.params.previousAccountId.trim() || void 0 : void 0;
+		const tokens = await withTimeout$1(refreshCodexAppServerAuthTokens({
 			agentDir: runtime.context.agentDir,
 			authProfileId: runtime.context.authProfileId,
+			...previousAccountId ? { previousAccountId } : {},
 			...runtime.context.authProfileStore ? { authProfileStore: runtime.context.authProfileStore } : {},
 			config: runtime.context.config
-		}) };
+		}), CODEX_EXTERNAL_AUTH_REFRESH_TIMEOUT_MS, "Codex app-server ChatGPT token refresh timed out before its external-auth deadline");
+		if (previousAccountId && tokens.chatgptAccountId !== previousAccountId) throw new Error("ChatGPT workspace changed during Codex token refresh.");
+		return { ...tokens };
 	});
 	client.addNotificationHandler((notification) => {
 		if (notification.method === "account/rateLimits/updated") {
@@ -2305,6 +2585,7 @@ const CODEX_APP_SERVER_STDERR_TAIL_MAX = 2e3;
 const CODEX_APP_SERVER_OVERLOADED_ERROR_CODE = -32001;
 const CODEX_APP_SERVER_OVERLOAD_MAX_RETRIES = 3;
 const CODEX_APP_SERVER_OVERLOAD_RETRY_BASE_MS = 50;
+const CODEX_APP_SERVER_PENDING_STARTUP_WARNINGS_MAX = 32;
 const CODEX_APP_SERVER_CLIENT_INSTANCE_IDS = /* @__PURE__ */ new WeakMap();
 const UNPAIRED_SURROGATE_RE = /[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?<![\uD800-\uDBFF])[\uDC00-\uDFFF]/g;
 /** Process-local generation fence for bindings tied to one app-server client instance. */
@@ -2373,6 +2654,7 @@ var CodexAppServerClient = class CodexAppServerClient {
 		this.pending = /* @__PURE__ */ new Map();
 		this.requestHandlers = /* @__PURE__ */ new Set();
 		this.notificationHandlers = /* @__PURE__ */ new Set();
+		this.pendingStartupWarnings = [];
 		this.closeHandlers = /* @__PURE__ */ new Set();
 		this.nextId = 1;
 		this.initialized = false;
@@ -2429,7 +2711,8 @@ var CodexAppServerClient = class CodexAppServerClient {
 				experimentalApi: true,
 				extensions: {
 					"openai/standard-form-input": {},
-					"openai/form": {}
+					"openai/form": {},
+					"io.modelcontextprotocol/ui": { mimeTypes: ["text/html;profile=mcp-app"] }
 				}
 			}
 		});
@@ -2642,6 +2925,7 @@ var CodexAppServerClient = class CodexAppServerClient {
 	/** Registers a notification handler and returns its disposer. */
 	addNotificationHandler(handler) {
 		this.notificationHandlers.add(handler);
+		for (const notification of this.pendingStartupWarnings.splice(0)) this.handleNotification(notification);
 		return () => this.notificationHandlers.delete(handler);
 	}
 	/** Registers a close handler and returns its disposer. */
@@ -2649,6 +2933,16 @@ var CodexAppServerClient = class CodexAppServerClient {
 		this.closeHandlers.add(handler);
 		return () => this.closeHandlers.delete(handler);
 	}
+	/** Registers a handler for physical transport exit and returns its disposer. */
+	addTransportExitHandler(handler) {
+		if (this.transportExited) {
+			handler(this);
+			return () => void 0;
+		}
+		const onExit = () => handler(this);
+		this.child.once("exit", onExit);
+		return () => this.child.off?.("exit", onExit);
+	}
 	/** Closes the transport without waiting for process/socket shutdown. */
 	close() {
 		if (!this.markClosed(/* @__PURE__ */ new Error("codex app-server client is closed"))) return;
@@ -2839,6 +3133,11 @@ var CodexAppServerClient = class CodexAppServerClient {
 		}
 	}
 	handleNotification(notification) {
+		if (this.notificationHandlers.size === 0 && notification.method === "configWarning") {
+			if (this.pendingStartupWarnings.length === CODEX_APP_SERVER_PENDING_STARTUP_WARNINGS_MAX) this.pendingStartupWarnings.shift();
+			this.pendingStartupWarnings.push(notification);
+			return;
+		}
 		for (const handler of this.notificationHandlers) try {
 			Promise.resolve(handler(notification)).catch((error) => {
 				embeddedAgentLog.warn("codex app-server notification handler failed", { error });
@@ -2910,8 +3209,8 @@ function assertSupportedCodexAppServerVersion(response) {
 	const detectedVersion = readCodexVersionFromUserAgent(response.userAgent);
 	if (!detectedVersion) throw new CodexAppServerVersionError(detectedVersion);
 	const detected = parse(detectedVersion);
-	if (!detected || detected.compare("0.147.0") < 0) throw new CodexAppServerVersionError(detectedVersion);
-	if (detected.compare("0.149.1") > 0) embeddedAgentLog.warn("codex app-server is newer than OpenClaw's managed runtime; continuing with normal startup validation", {
+	if (!detected || detected.compare("0.149.0") < 0) throw new CodexAppServerVersionError(detectedVersion);
+	if (detected.compare("0.150.1") > 0) embeddedAgentLog.warn("codex app-server is newer than OpenClaw's managed runtime; continuing with normal startup validation", {
 		detectedVersion,
 		validatedVersion: CODEX_APP_SERVER_VERSION
 	});
@@ -3078,6 +3377,324 @@ function resolveCodexGatewayTimeoutWithGraceMs(timeoutMs, graceMs = 1e4) {
 	return addTimerTimeoutGraceMs(timeout, resolveTimerTimeoutMs(graceMs, 0, 0)) ?? timeout;
 }
 //#endregion
+//#region extensions/codex/src/app-server/desktop-generation-fingerprint.ts
+const MAX_COMPUTER_USE_PLUGIN_TREE_ENTRIES = 4096;
+/** Fingerprints every desktop candidate that can own a managed fallback artifact. */
+async function readMacOSDesktopGenerationFingerprint(candidates = resolveMacOSDesktopCodexAppPathCandidates("darwin")) {
+	const entries = [];
+	for (const candidate of candidates) {
+		const command = await statFingerprint(candidate.appServerCommandPath);
+		entries.push(`candidate:${candidate.appName}:${candidate.appServerCommandPath}:${command}`);
+		for (const artifactPath of resolveMacOSDesktopGenerationPaths(candidate)) entries.push(`${artifactPath}\0${await statFingerprint(artifactPath)}`);
+		const pluginRoot = resolveComputerUsePluginRoot(candidate);
+		entries.push(`${pluginRoot}\0${await directoryTreeFingerprint(pluginRoot)}`);
+	}
+	return createHash("sha256").update(entries.join("\0")).digest("hex");
+}
+function resolveMacOSDesktopGenerationPaths(candidate) {
+	return [
+		candidate.appBundlePath,
+		path.join(candidate.bundledMarketplacePath, ".agents", "plugins", "marketplace.json"),
+		...candidate.computerUseServiceAppPaths.flatMap((servicePath) => [
+			servicePath,
+			path.join(servicePath, "Contents", "Info.plist"),
+			path.join(servicePath, "Contents", "SharedSupport", "SkyComputerUseClient.app", "Contents", "MacOS", "SkyComputerUseClient")
+		])
+	];
+}
+function resolveComputerUsePluginRoot(candidate) {
+	return path.join(candidate.bundledMarketplacePath, "plugins", "computer-use");
+}
+/** Stable roots that cover bundle replacement and recursive artifact updates. */
+function resolveMacOSDesktopGenerationWatchPaths(candidates = resolveMacOSDesktopCodexAppPathCandidates("darwin")) {
+	const watched = /* @__PURE__ */ new Set(["/Applications"]);
+	for (const candidate of candidates) watched.add(candidate.appBundlePath);
+	return [...watched];
+}
+async function directoryTreeFingerprint(root) {
+	let rootStat;
+	try {
+		rootStat = await fs.lstat(root, { bigint: true });
+	} catch (error) {
+		if (isNodeError(error, "ENOENT") || isNodeError(error, "ENOTDIR")) return "missing";
+		throw error;
+	}
+	if (!rootStat.isDirectory()) return statFingerprint(root);
+	let entryCount = 0;
+	const hash = createHash("sha256");
+	hash.update("openclaw-codex-computer-use-plugin-tree-v1\0");
+	const visit = async (directory, relativeDirectory, before) => {
+		hash.update(`directory\0${relativeDirectory}\0${statTuple(before)}\0`);
+		const entries = (await fs.readdir(directory, { withFileTypes: true })).toSorted((left, right) => left.name < right.name ? -1 : left.name > right.name ? 1 : 0);
+		for (const entry of entries) {
+			entryCount += 1;
+			if (entryCount > MAX_COMPUTER_USE_PLUGIN_TREE_ENTRIES) throw new Error("Codex Computer Use plugin exceeds the bounded tree size");
+			const entryPath = path.join(directory, entry.name);
+			const relativePath = path.join(relativeDirectory, entry.name);
+			const entryStat = await fs.lstat(entryPath, { bigint: true });
+			if (entryStat.isDirectory()) await visit(entryPath, relativePath, entryStat);
+			else hash.update(`entry\0${relativePath}\0${await statFingerprint(entryPath)}\0`);
+		}
+		if (!sameStat(before, await fs.lstat(directory, { bigint: true }))) throw new Error(`Codex desktop artifact changed while fingerprinting: ${directory}`);
+	};
+	await visit(root, ".", rootStat);
+	return hash.digest("hex");
+}
+async function statFingerprint(filePath) {
+	try {
+		const entry = await fs.lstat(filePath, { bigint: true });
+		const type = entry.isSymbolicLink() ? "link" : entry.isDirectory() ? "directory" : entry.isFile() ? "file" : "other";
+		const own = statTuple(entry);
+		if (!entry.isSymbolicLink()) return `${type}:${own}:${entry.isFile() ? await readFileFingerprint(filePath, entry, false) : ""}`;
+		const [link, realPath, target] = await Promise.all([
+			fs.readlink(filePath),
+			fs.realpath(filePath),
+			fs.stat(filePath, { bigint: true })
+		]);
+		const content = target.isFile() ? await readFileFingerprint(filePath, target, true) : "";
+		return `${type}:${own}:${link}:${realPath}:${statTuple(target)}:${content}`;
+	} catch (error) {
+		if (isNodeError(error, "ENOENT") || isNodeError(error, "ENOTDIR")) return "missing";
+		throw error;
+	}
+}
+async function readFileFingerprint(filePath, expected, followsSymlink) {
+	const noFollow = followsSymlink ? 0 : constants.O_NOFOLLOW ?? 0;
+	const handle = await fs.open(filePath, constants.O_RDONLY | noFollow);
+	try {
+		const before = await handle.stat({ bigint: true });
+		if (!sameStat(before, expected)) throw new Error(`Codex desktop artifact changed while fingerprinting: ${filePath}`);
+		const hash = createHash("sha256");
+		for await (const chunk of handle.createReadStream({ autoClose: false })) hash.update(chunk);
+		if (!sameStat(before, await handle.stat({ bigint: true }))) throw new Error(`Codex desktop artifact changed while fingerprinting: ${filePath}`);
+		return hash.digest("hex");
+	} finally {
+		await handle.close();
+	}
+}
+function sameStat(left, right) {
+	return statTuple(left) === statTuple(right);
+}
+function statTuple(stat) {
+	return [
+		stat.dev,
+		stat.ino,
+		stat.mode,
+		stat.size,
+		stat.mtimeNs,
+		stat.ctimeNs
+	].join(":");
+}
+function isNodeError(error, code) {
+	return Boolean(error && typeof error === "object" && "code" in error && error.code === code);
+}
+//#endregion
+//#region extensions/codex/src/app-server/desktop-generation-owner.ts
+const SETTLE_DELAY_MS = 1e3;
+/** Coalesces filesystem invalidations into one stable desktop generation. */
+function createCodexDesktopGenerationOwner(params) {
+	let generation = params.initialGeneration;
+	let invalidation = 0;
+	let dirty = false;
+	let refresh;
+	let stopped = false;
+	const markDirty = () => {
+		invalidation += 1;
+		dirty = true;
+	};
+	const reconcile = () => {
+		if (refresh) return refresh;
+		refresh = (async () => {
+			for (;;) {
+				if (stopped) throw new Error("Codex desktop generation owner stopped");
+				const observedInvalidation = invalidation;
+				const first = await params.readFingerprint();
+				await delay(SETTLE_DELAY_MS);
+				if (stopped) throw new Error("Codex desktop generation owner stopped");
+				const second = await params.readFingerprint();
+				if (stopped) throw new Error("Codex desktop generation owner stopped");
+				if (observedInvalidation !== invalidation || first !== second) continue;
+				const previous = generation;
+				generation = previous?.fingerprint === second ? previous : {
+					epoch: (previous?.epoch ?? 0) + 1,
+					fingerprint: second
+				};
+				dirty = false;
+				if (previous && generation !== previous) params.onGenerationChange?.(generation);
+				return generation;
+			}
+		})().finally(() => {
+			refresh = void 0;
+		});
+		return refresh;
+	};
+	return {
+		read: () => generation,
+		markDirty,
+		wait: () => dirty ? reconcile() : Promise.resolve(generation),
+		refresh: () => {
+			markDirty();
+			return reconcile();
+		},
+		isCurrent: (candidate) => Boolean(candidate && !dirty && generation && candidate.epoch === generation.epoch && candidate.fingerprint === generation.fingerprint),
+		stop: () => {
+			stopped = true;
+		}
+	};
+}
+function delay(ms) {
+	return new Promise((resolve) => {
+		setTimeout(resolve, ms);
+	});
+}
+//#endregion
+//#region extensions/codex/src/app-server/desktop-generation.ts
+/** Lifecycle-owned generation for managed macOS Codex desktop artifacts. */
+const APPLICATIONS_PATH = "/Applications";
+const REARM_INITIAL_DELAY_MS = 100;
+const REARM_MAX_DELAY_MS = 3e4;
+const DESKTOP_GENERATION_STATE = Symbol.for("openclaw.codexDesktopGenerationState");
+function state() {
+	const globalState = globalThis;
+	return globalState[DESKTOP_GENERATION_STATE] ??= {};
+}
+function waitForCodexDesktopGeneration() {
+	return state().owner?.wait() ?? Promise.resolve(void 0);
+}
+function isCodexDesktopGenerationCurrent(generation) {
+	return state().owner?.isCurrent(generation) ?? false;
+}
+function createCodexDesktopGenerationService(params, runtime = {
+	platform: process.platform,
+	readFingerprint: readMacOSDesktopGenerationFingerprint,
+	resolveWatchPaths: resolveMacOSDesktopGenerationWatchPaths,
+	pathExists: existsSync,
+	watchPath: (watchedPath, options, listener) => watch(watchedPath, options, listener)
+}) {
+	return {
+		id: "codex-desktop-generation",
+		async start(ctx) {
+			if (runtime.platform !== "darwin") return;
+			const current = state();
+			current.context = ctx;
+			current.readFingerprint = runtime.readFingerprint;
+			current.resolveWatchPaths = runtime.resolveWatchPaths;
+			current.pathExists = runtime.pathExists;
+			current.watchPath = runtime.watchPath;
+			current.owner = createCodexDesktopGenerationOwner({
+				readFingerprint: current.readFingerprint,
+				onGenerationChange: params.onGenerationChange,
+				initialGeneration: current.lastGeneration
+			});
+			armWatchers(current);
+			refreshGeneration(current, current.owner, current.owner.refresh());
+		},
+		async stop() {
+			const current = state();
+			current.lastGeneration = current.owner?.read() ?? current.lastGeneration;
+			current.owner?.stop();
+			current.owner = void 0;
+			current.armEpoch = (current.armEpoch ?? 0) + 1;
+			current.context = void 0;
+			current.readFingerprint = void 0;
+			current.resolveWatchPaths = void 0;
+			current.pathExists = void 0;
+			current.watchPath = void 0;
+			current.watchHealthy = void 0;
+			current.rearmDelayMs = void 0;
+			if (current.rearmTimer) {
+				clearTimeout(current.rearmTimer);
+				current.rearmTimer = void 0;
+			}
+			closeWatchers(current);
+		}
+	};
+}
+function armWatchers(current) {
+	const owner = current.owner;
+	if (!owner || current.watchers) return false;
+	const armEpoch = (current.armEpoch ?? 0) + 1;
+	current.armEpoch = armEpoch;
+	const watchers = /* @__PURE__ */ new Set();
+	current.watchers = watchers;
+	const candidateNames = new Set(resolveMacOSDesktopCodexAppPathCandidates("darwin").map((candidate) => candidate.appName));
+	let complete = true;
+	for (const watchedPath of current.resolveWatchPaths?.() ?? []) {
+		if (!current.pathExists?.(watchedPath)) continue;
+		try {
+			const watcher = current.watchPath?.(watchedPath, { recursive: watchedPath !== APPLICATIONS_PATH }, (_eventType, filename) => {
+				if (!isCurrentArm(current, owner, watchers, armEpoch)) return;
+				if (watchedPath === APPLICATIONS_PATH && filename && !candidateNames.has(filename.toString().split(path.sep)[0] ?? "")) return;
+				owner.markDirty();
+				scheduleRearm(current, owner);
+			});
+			if (!watcher) {
+				complete = false;
+				reportWatcherFailure(current, owner, /* @__PURE__ */ new Error(`Could not watch ${watchedPath}`));
+				scheduleRearm(current, owner);
+				continue;
+			}
+			watchers.add(watcher);
+			watcher.on("error", (error) => {
+				if (!isCurrentArm(current, owner, watchers, armEpoch)) return;
+				reportWatcherFailure(current, owner, error);
+				scheduleRearm(current, owner);
+			});
+		} catch (error) {
+			complete = false;
+			reportWatcherFailure(current, owner, error);
+			scheduleRearm(current, owner);
+		}
+	}
+	current.watchHealthy = complete;
+	if (complete) current.rearmDelayMs = REARM_INITIAL_DELAY_MS;
+	return complete;
+}
+function reportWatcherFailure(current, owner, error) {
+	if (current.watchHealthy === false) return;
+	current.watchHealthy = false;
+	owner.markDirty();
+	current.context?.serviceHealth?.reportFailure(error);
+	current.context?.logger.warn(`codex desktop generation watcher failed: ${String(error)}`);
+}
+function isCurrentArm(current, owner, watchers, armEpoch) {
+	return current.owner === owner && current.watchers === watchers && current.armEpoch === armEpoch;
+}
+function scheduleRearm(current, owner) {
+	if (current.rearmTimer) {
+		if (current.watchHealthy === false) return;
+		clearTimeout(current.rearmTimer);
+	}
+	const delayMs = current.watchHealthy === false ? current.rearmDelayMs ?? REARM_INITIAL_DELAY_MS : REARM_INITIAL_DELAY_MS;
+	if (current.watchHealthy === false) current.rearmDelayMs = Math.min(delayMs * 2, REARM_MAX_DELAY_MS);
+	current.rearmTimer = setTimeout(() => {
+		current.rearmTimer = void 0;
+		if (current.owner !== owner) return;
+		const wasUnhealthy = current.watchHealthy === false;
+		closeWatchers(current);
+		if (!armWatchers(current) || wasUnhealthy) owner.markDirty();
+		refreshGeneration(current, owner, owner.wait());
+	}, delayMs);
+	current.rearmTimer.unref();
+}
+function logRefreshFailure(current, owner) {
+	return (error) => {
+		if (current.owner !== owner) return;
+		current.context?.serviceHealth?.reportFailure(error);
+		current.context?.logger.warn(`codex desktop generation refresh failed: ${String(error)}`);
+	};
+}
+function refreshGeneration(current, owner, refresh) {
+	refresh.then(() => {
+		if (current.owner === owner && current.watchHealthy) current.context?.serviceHealth?.clearFailure();
+	}).catch(logRefreshFailure(current, owner));
+}
+function closeWatchers(current) {
+	const watchers = current.watchers;
+	current.watchers = void 0;
+	for (const watcher of watchers ?? []) watcher.close();
+}
+//#endregion
 //#region extensions/codex/src/app-server/native-config-fence.ts
 const CODEX_NATIVE_CONFIG_FENCE_STATE = Symbol.for("openclaw.codexNativeConfigFenceState");
 function getFenceState() {
@@ -3140,38 +3757,6 @@ async function waitForPreviousFence(previous, options) {
 	});
 }
 //#endregion
-//#region extensions/codex/src/app-server/timeout.ts
-/**
-* Thin Codex app-server timeout adapter around OpenClaw's shared security
-* runtime timeout helper.
-*/
-function resolveAbortError(signal) {
-	return signal.reason instanceof Error ? signal.reason : new Error("Codex app-server operation aborted", { cause: signal.reason });
-}
-/** Awaits a promise with a Codex-specific timeout error message. */
-async function withTimeout$1(promise, timeoutMs, timeoutMessage, createError) {
-	return await withTimeout(promise, timeoutMs, {
-		message: timeoutMessage,
-		...createError ? { createError } : {}
-	});
-}
-/** Bounds an operation by both its owner lifecycle and one total wall-clock budget. */
-async function withAbortableTimeout(params) {
-	const signal = params.signal;
-	if (signal?.aborted) throw resolveAbortError(signal);
-	let removeAbortListener;
-	const operation = signal ? Promise.race([params.promise, new Promise((_, reject) => {
-		const onAbort = () => reject(resolveAbortError(signal));
-		signal.addEventListener("abort", onAbort, { once: true });
-		removeAbortListener = () => signal.removeEventListener("abort", onAbort);
-	})]) : params.promise;
-	try {
-		return await withTimeout$1(operation, params.timeoutMs, params.timeoutMessage, params.createTimeoutError);
-	} finally {
-		removeAbortListener?.();
-	}
-}
-//#endregion
 //#region extensions/codex/src/app-server/shared-client.ts
 /**
 * Owns shared and isolated Codex app-server client startup, auth application,
@@ -3187,6 +3772,9 @@ var shared_client_exports = /* @__PURE__ */ __exportAll({
 	getLeasedSharedCodexAppServerClient: () => getLeasedSharedCodexAppServerClient,
 	getSharedCodexAppServerClient: () => getSharedCodexAppServerClient,
 	isCodexAppServerStartSelectionChangedError: () => isCodexAppServerStartSelectionChangedError,
+	readCodexAppServerClientDesktopGeneration: () => readCodexAppServerClientDesktopGeneration,
+	readCodexAppServerClientDesktopGenerationFingerprint: () => readCodexAppServerClientDesktopGenerationFingerprint,
+	readCodexAppServerClientProcessIdentity: () => readCodexAppServerClientProcessIdentity,
 	releaseCodexAppServerClientLease: () => releaseCodexAppServerClientLease,
 	releaseLeasedSharedCodexAppServerClient: () => releaseLeasedSharedCodexAppServerClient,
 	resolveCodexAppServerSpawnIdentity: () => resolveCodexAppServerSpawnIdentity,
@@ -3194,6 +3782,8 @@ var shared_client_exports = /* @__PURE__ */ __exportAll({
 	retainSharedCodexAppServerClientByInstanceId: () => retainSharedCodexAppServerClientByInstanceId,
 	retainSharedCodexAppServerClientIfCurrent: () => retainSharedCodexAppServerClientIfCurrent,
 	retireSharedCodexAppServerClientIfCurrent: () => retireSharedCodexAppServerClientIfCurrent,
+	retireSharedCodexAppServerClientsBeforeDesktopGeneration: () => retireSharedCodexAppServerClientsBeforeDesktopGeneration,
+	waitForCodexAppServerClientDesktopGenerationDrain: () => waitForCodexAppServerClientDesktopGenerationDrain,
 	withLeasedCodexAppServerClientStartSelectionRetry: () => withLeasedCodexAppServerClientStartSelectionRetry
 });
 const CODEX_APP_SERVER_INITIALIZE_TIMEOUT_MESSAGE = "codex app-server initialize timed out";
@@ -3205,8 +3795,10 @@ function getSharedCodexAppServerClientState() {
 	globalState[SHARED_CODEX_APP_SERVER_CLIENT_STATE] ??= {
 		clients: /* @__PURE__ */ new Map(),
 		liveClients: /* @__PURE__ */ new Set(),
+		isolatedClients: /* @__PURE__ */ new Set(),
 		entriesByClient: /* @__PURE__ */ new WeakMap(),
-		leasedReleases: /* @__PURE__ */ new WeakMap()
+		leasedReleases: /* @__PURE__ */ new WeakMap(),
+		desktopGenerationDrainChecks: /* @__PURE__ */ new Set()
 	};
 	return globalState[SHARED_CODEX_APP_SERVER_CLIENT_STATE];
 }
@@ -3215,6 +3807,41 @@ function getCodexAppServerClientStartMetadata() {
 	globalState[CODEX_APP_SERVER_CLIENT_START_METADATA] ??= /* @__PURE__ */ new WeakMap();
 	return globalState[CODEX_APP_SERVER_CLIENT_START_METADATA];
 }
+/** Reads the exact successful spawn selection plus its initialized runtime identity. */
+function readCodexAppServerClientProcessIdentity(client) {
+	const metadata = getCodexAppServerClientStartMetadata().get(client);
+	if (!metadata) return;
+	const runtimeIdentity = client.getRuntimeIdentity();
+	return {
+		clientId: client.getInstanceId(),
+		...resolveCodexAppServerSpawnIdentity(metadata.startOptions, metadata.nativeCommand),
+		...runtimeIdentity?.serverVersion ? { serverVersion: runtimeIdentity.serverVersion } : {},
+		...runtimeIdentity?.userAgent ? { userAgent: runtimeIdentity.userAgent } : {}
+	};
+}
+/** Returns the lifecycle fingerprint that owns a managed desktop client. */
+function readCodexAppServerClientDesktopGenerationFingerprint(client) {
+	return readCodexAppServerClientDesktopGeneration(client)?.fingerprint;
+}
+/** Returns the lifecycle generation that owns a managed desktop client. */
+function readCodexAppServerClientDesktopGeneration(client) {
+	return getCodexAppServerClientStartMetadata().get(client)?.desktopGeneration;
+}
+/** Waits until older physical desktop clients for this client's Codex home exit. */
+async function waitForCodexAppServerClientDesktopGenerationDrain(params) {
+	const metadata = getCodexAppServerClientStartMetadata().get(params.client);
+	if (!metadata?.desktopGeneration) return;
+	const drain = createOlderDesktopGenerationDrainWait({
+		generation: metadata.desktopGeneration,
+		startOptions: metadata.startOptions,
+		agentDir: metadata.agentDir
+	});
+	try {
+		await withCodexAppServerAcquireDeadline(params.timeoutMs ?? 0, drain.promise, params.signal, "Codex Computer Use install timed out waiting for older desktop clients");
+	} finally {
+		drain.cancel();
+	}
+}
 /** Resolves non-secret spawn identity before startup; argv is represented only by its hash. */
 function resolveCodexAppServerSpawnIdentity(startOptions, resolvedNativeCommand) {
 	const nativeCommand = resolvedNativeCommand ?? (startOptions.commandSource === "resolved-managed" ? resolveManagedCodexNativeCommand(startOptions.command) : void 0);
@@ -3245,6 +3872,7 @@ function isCodexAppServerStartSelectionChangedError(error) {
 function assertCodexAppServerClientStartSelectionCurrent(params) {
 	const metadata = getCodexAppServerClientStartMetadata().get(params.client);
 	if (!metadata) return;
+	if (metadata.desktopGeneration && !isCodexDesktopGenerationCurrent(metadata.desktopGeneration)) throw new CodexAppServerStartSelectionChangedError();
 	const requestedStartOptions = params.startOptions ?? metadata.requestedStartOptions;
 	if (requestedStartOptions.commandSource !== "managed") return;
 	const current = resolveCodexAppServerStartOptionsForAgent({
@@ -3256,7 +3884,7 @@ function assertCodexAppServerClientStartSelectionCurrent(params) {
 /** Resolves the per-CODEX_HOME key used to serialize native config loading. */
 function resolveCodexNativeConfigFenceKey(params) {
 	const metadata = params.client ? getCodexAppServerClientStartMetadata().get(params.client) : void 0;
-	const startOptions = params.startOptions ?? metadata?.startOptions;
+	const startOptions = metadata?.startOptions ?? params.startOptions;
 	if (!startOptions || startOptions.transport !== "stdio") return;
 	const configuredHome = startOptions.env?.CODEX_HOME?.trim();
 	const agentDir = params.agentDir ?? metadata?.agentDir ?? resolveDefaultAgentDir(params.config ?? {});
@@ -3270,6 +3898,7 @@ function inferAuthRequirement(preparedAuth) {
 async function resolveCodexAppServerClientStartContext(options) {
 	const agentDir = options?.agentDir ?? resolveDefaultAgentDir(options?.config ?? {});
 	const requestedStartOptions = options?.startOptions ?? resolveCodexAppServerRuntimeOptions().start;
+	const desktopGeneration = shouldTrackDesktopGeneration(requestedStartOptions, options?.pluginConfig) ? await waitForCodexDesktopGeneration() : void 0;
 	const preparedAuth = options?.preparedAuth;
 	const preparedApiKey = preparedAuth?.kind === "api-key" ? preparedAuth.apiKey.trim() : void 0;
 	if (preparedAuth && options?.authProfileId !== void 0) throw new Error("Prepared Codex auth cannot also select a legacy auth profile.");
@@ -3328,9 +3957,16 @@ async function resolveCodexAppServerClientStartContext(options) {
 			config: options?.config,
 			pluginConfig: options?.pluginConfig,
 			...authProfileStore ? { authProfileStore } : {}
-		})
+		}),
+		...options?.pluginConfig !== void 0 ? { pluginConfig: options.pluginConfig } : {},
+		...desktopGeneration ? { desktopGeneration } : {}
 	};
 }
+function shouldTrackDesktopGeneration(startOptions, pluginConfig) {
+	if (startOptions.transport !== "stdio") return false;
+	if (resolveCodexComputerUseConfig({ pluginConfig }).enabled && (startOptions.commandSource === "managed" || startOptions.commandSource === "resolved-managed")) return true;
+	return startOptions.commandSource === "managed" && (startOptions.managedCommandOrder ?? "package-first") === "desktop-first";
+}
 function resolveWarmSharedCodexAppServerClientIdentity(options) {
 	if (!options?.config || typeof options.config !== "object" || !options.startOptions || options.pluginConfig !== void 0 || options.authProfileStore !== void 0 || options.preparedAuth !== void 0 || options.runtimeArtifactMode !== void 0 || options.expectedRuntimeArtifact !== void 0) return;
 	const authProfileSelector = options.authProfileId === null ? ["native"] : options.authProfileId === void 0 ? ["implicit"] : ["profile", options.authProfileId];
@@ -3438,9 +4074,19 @@ async function withLeasedCodexAppServerClientStartSelectionRetry(params) {
 }
 async function acquireSharedCodexAppServerClient(options, leaseOptions) {
 	if (options?.abandonSignal?.aborted) throw new CodexAppServerStartupError("aborted", "codex app-server initialize aborted");
+	const acquireStartedAt = Date.now();
+	const timeoutMs = options?.timeoutMs ?? 0;
 	const state = getSharedCodexAppServerClientState();
 	const warmIdentity = resolveWarmSharedCodexAppServerClientIdentity(options);
-	const warmClient = warmIdentity ? readWarmSharedCodexAppServerClient(state, warmIdentity) : void 0;
+	let warmClient = warmIdentity ? readWarmSharedCodexAppServerClient(state, warmIdentity) : void 0;
+	const warmGeneration = warmClient ? getCodexAppServerClientStartMetadata().get(warmClient.client)?.desktopGeneration : void 0;
+	if (warmClient && warmGeneration && !isCodexDesktopGenerationCurrent(warmGeneration)) {
+		await withCodexAppServerAcquireDeadline(resolveRemainingAcquireTimeout(timeoutMs, acquireStartedAt), waitForCodexDesktopGeneration(), options?.abandonSignal);
+		if (!isCodexDesktopGenerationCurrent(warmGeneration)) {
+			retireSharedCodexAppServerClientIfCurrent(warmClient.client);
+			warmClient = void 0;
+		}
+	}
 	if (warmClient) {
 		options?.onStartedClient?.(warmClient.client);
 		const release = leaseOptions?.leased ? retainSharedClientEntry(warmClient.entry) : void 0;
@@ -3449,9 +4095,7 @@ async function acquireSharedCodexAppServerClient(options, leaseOptions) {
 			release
 		} : { client: warmClient.client };
 	}
-	const acquireStartedAt = Date.now();
-	const timeoutMs = options?.timeoutMs ?? 0;
-	const { agentDir, usesNativeAuth, authProfileId, authProfileStore, preparedAuth, authRequirement, requestedStartOptions, startOptions } = await withCodexAppServerAcquireDeadline(timeoutMs, resolveCodexAppServerClientStartContext(options), options?.abandonSignal);
+	const { agentDir, usesNativeAuth, authProfileId, authProfileStore, preparedAuth, authRequirement, requestedStartOptions, startOptions, desktopGeneration, pluginConfig } = await withCodexAppServerAcquireDeadline(timeoutMs, resolveCodexAppServerClientStartContext(options), options?.abandonSignal);
 	const remainingTimeoutMs = resolveRemainingAcquireTimeout(timeoutMs, acquireStartedAt);
 	const authIdentityCacheKey = preparedAuth?.kind === "api-key" ? resolveCodexAppServerPreparedApiKeyCacheKey(preparedAuth.apiKey) : preparedAuth?.snapshot.secretFreeCacheKey ?? (authRequirement === "api-key" && !authProfileId ? resolveCodexAppServerFallbackApiKeyCacheKey({ startOptions }) : void 0);
 	const baseKey = `${codexAppServerStartOptionsKey(startOptions, {
@@ -3459,12 +4103,18 @@ async function acquireSharedCodexAppServerClient(options, leaseOptions) {
 		authBindingFingerprint: options?.authBindingFingerprint,
 		agentDir: usesNativeAuth ? void 0 : agentDir,
 		fallbackApiKeyCacheKey: authIdentityCacheKey
-	})}\0auth-requirement:${authRequirement ?? "native"}`;
+	})}\0auth-requirement:${authRequirement ?? "native"}${desktopGeneration ? `\0desktop-generation:${desktopGeneration.epoch}` : ""}`;
 	const runtimeArtifactMode = options?.runtimeArtifactMode ?? (options?.expectedRuntimeArtifact ? "capture" : void 0);
 	const expectedRuntimeArtifactKey = options?.expectedRuntimeArtifact ? createHash("sha256").update(options.expectedRuntimeArtifact.id).update("\0").update(options.expectedRuntimeArtifact.fingerprint).digest("hex") : "mint";
 	const key = runtimeArtifactMode ? `${baseKey}\0runtime-artifact:capture-v1:${expectedRuntimeArtifactKey}` : baseKey;
-	const entry = getOrCreateSharedClientEntry(state, key);
-	if (runtimeArtifactMode) entry.runtimeArtifactStartupAbort ??= new AbortController();
+	let entry = getOrCreateSharedClientEntry(state, key);
+	const existingClient = entry.client;
+	const existingGeneration = existingClient ? getCodexAppServerClientStartMetadata().get(existingClient)?.desktopGeneration : void 0;
+	if (existingClient && existingGeneration && !isCodexDesktopGenerationCurrent(existingGeneration)) {
+		retireSharedCodexAppServerClientIfCurrent(existingClient);
+		entry = getOrCreateSharedClientEntry(state, key);
+	}
+	entry.startupAbort ??= new AbortController();
 	entry.closeWhenIdle = false;
 	const releasePendingAcquire = retainPendingSharedClientAcquire(entry);
 	const startedCallback = options?.onStartedClient;
@@ -3491,6 +4141,8 @@ async function acquireSharedCodexAppServerClient(options, leaseOptions) {
 		key,
 		requestedStartOptions,
 		startOptions,
+		desktopGeneration,
+		...pluginConfig !== void 0 ? { pluginConfig } : {},
 		agentDir,
 		authProfileId: usesNativeAuth || preparedAuth?.kind === "api-key" ? null : authProfileId,
 		authProfileStore,
@@ -3498,7 +4150,8 @@ async function acquireSharedCodexAppServerClient(options, leaseOptions) {
 		authRequirement,
 		runtimeArtifactMode,
 		...options?.expectedRuntimeArtifact ? { expectedRuntimeArtifact: options.expectedRuntimeArtifact } : {},
-		runtimeArtifactSignal: entry.runtimeArtifactStartupAbort?.signal,
+		runtimeArtifactSignal: entry.startupAbort.signal,
+		abandonSignal: entry.startupAbort.signal,
 		config: options?.config
 	}));
 	try {
@@ -3557,6 +4210,8 @@ function createSharedCodexAppServerClientStartup(params) {
 	const ready = startInitializedCodexAppServerClient({
 		requestedStartOptions: params.requestedStartOptions,
 		startOptions: params.startOptions,
+		...params.desktopGeneration ? { desktopGeneration: params.desktopGeneration } : {},
+		...params.pluginConfig !== void 0 ? { pluginConfig: params.pluginConfig } : {},
 		agentDir: params.agentDir,
 		authProfileId: params.authProfileId,
 		authProfileStore: params.authProfileStore,
@@ -3565,13 +4220,17 @@ function createSharedCodexAppServerClientStartup(params) {
 		runtimeArtifactMode: params.runtimeArtifactMode,
 		...params.expectedRuntimeArtifact ? { expectedRuntimeArtifact: params.expectedRuntimeArtifact } : {},
 		runtimeArtifactSignal: params.runtimeArtifactSignal,
+		abandonSignal: params.abandonSignal,
 		config: params.config,
 		onStartedClient: (startedClient) => {
 			const state = getSharedCodexAppServerClientState();
 			params.entry.client = startedClient;
 			state.liveClients.add(startedClient);
+			startedClient.addTransportExitHandler((exitedClient) => {
+				state.liveClients.delete(exitedClient);
+				notifyDesktopGenerationDrainChecks(state);
+			});
 			startedClient.addCloseHandler((closedClient) => {
-				state.liveClients.delete(closedClient);
 				if (state.entriesByClient.get(closedClient) === params.entry) clearSharedClientEntryIfCurrent(params.key, closedClient);
 			});
 			for (const callback of params.entry.onStartedClientCallbacks) callback(startedClient);
@@ -3587,6 +4246,7 @@ function createSharedCodexAppServerClientStartup(params) {
 		initialized.reject(error);
 		throw error;
 	});
+	initialized.promise.catch(() => void 0);
 	ready.catch(() => void 0);
 	return {
 		initialized: initialized.promise,
@@ -3598,10 +4258,12 @@ async function createIsolatedCodexAppServerClient(options) {
 	if (options?.abandonSignal?.aborted) throw new CodexAppServerStartupError("aborted", "codex app-server initialize aborted");
 	const acquireStartedAt = Date.now();
 	const timeoutMs = options?.timeoutMs ?? 0;
-	const { agentDir, usesNativeAuth, authProfileId, authProfileStore, preparedAuth, authRequirement, requestedStartOptions, startOptions } = await withCodexAppServerAcquireDeadline(timeoutMs, resolveCodexAppServerClientStartContext(options), options?.abandonSignal);
+	const { agentDir, usesNativeAuth, authProfileId, authProfileStore, preparedAuth, authRequirement, requestedStartOptions, startOptions, desktopGeneration, pluginConfig } = await withCodexAppServerAcquireDeadline(timeoutMs, resolveCodexAppServerClientStartContext(options), options?.abandonSignal);
 	return await startInitializedCodexAppServerClient({
 		requestedStartOptions,
 		startOptions,
+		...desktopGeneration ? { desktopGeneration } : {},
+		...pluginConfig !== void 0 ? { pluginConfig } : {},
 		agentDir,
 		authProfileId: usesNativeAuth || preparedAuth?.kind === "api-key" ? null : authProfileId,
 		authProfileStore,
@@ -3613,7 +4275,18 @@ async function createIsolatedCodexAppServerClient(options) {
 		config: options?.config,
 		timeoutMs: resolveRemainingAcquireTimeout(timeoutMs, acquireStartedAt),
 		abandonSignal: options?.abandonSignal,
-		onStartedClient: options?.onStartedClient
+		onStartedClient: (client) => {
+			trackIsolatedCodexAppServerClient(client);
+			options?.onStartedClient?.(client);
+		}
+	});
+}
+function trackIsolatedCodexAppServerClient(client) {
+	const state = getSharedCodexAppServerClientState();
+	state.isolatedClients.add(client);
+	client.addTransportExitHandler((exitedClient) => {
+		state.isolatedClients.delete(exitedClient);
+		notifyDesktopGenerationDrainChecks(state);
 	});
 }
 async function startInitializedCodexAppServerClient(params) {
@@ -3621,6 +4294,40 @@ async function startInitializedCodexAppServerClient(params) {
 	const timeoutMs = params.timeoutMs ?? 0;
 	const startOptionsCandidates = resolveManagedFallbackStartOptions(params.startOptions);
 	for (const [index, startOptions] of startOptionsCandidates.entries()) {
+		const desktopGeneration = params.desktopGeneration ?? (isManagedCodexDesktopCommand(startOptions.command) ? await withCodexAppServerAcquireDeadline(resolveRemainingAcquireTimeout(timeoutMs, acquireStartedAt), waitForCodexDesktopGeneration(), params.abandonSignal) : void 0);
+		const assertDesktopGenerationCurrent = () => {
+			if (params.abandonSignal?.aborted) throw new CodexAppServerStartupError("aborted", "codex app-server initialize aborted");
+			if (desktopGeneration && !isCodexDesktopGenerationCurrent(desktopGeneration)) throw new CodexAppServerStartSelectionChangedError();
+		};
+		const computerUseConfig = resolveCodexComputerUseConfig({ pluginConfig: params.pluginConfig });
+		const ownsIsolatedCodexHome = params.requestedStartOptions.homeScope !== "user" && !params.requestedStartOptions.env?.CODEX_HOME?.trim();
+		const artifactDrain = desktopGeneration && ownsIsolatedCodexHome && computerUseConfig.enabled && (computerUseConfig.autoInstall || computerUseConfig.pluginCacheMode === "shared") ? createOlderDesktopGenerationDrainWait({
+			generation: desktopGeneration,
+			startOptions,
+			agentDir: params.agentDir
+		}) : void 0;
+		try {
+			if (artifactDrain) await withCodexAppServerAcquireDeadline(resolveRemainingAcquireTimeout(timeoutMs, acquireStartedAt), artifactDrain.promise, params.abandonSignal);
+			await reconcileCodexComputerUseStartArtifacts({
+				startOptions,
+				agentDir: params.agentDir,
+				pluginConfig: params.pluginConfig,
+				...desktopGeneration ? { desktopGeneration } : {},
+				assertCurrent: assertDesktopGenerationCurrent,
+				ownsIsolatedCodexHome
+			});
+		} catch (error) {
+			if (isCodexComputerUseCandidateArtifactsUnavailableError(error)) {
+				if (index + 1 < startOptionsCandidates.length) continue;
+				throw new AgentHarnessPreflightError("Codex Computer Use artifacts are unavailable from the installed desktop apps.", {
+					cause: error,
+					scope: "harness"
+				});
+			}
+			throw error;
+		} finally {
+			artifactDrain?.cancel();
+		}
 		const runtimeArtifactModule = params.runtimeArtifactMode ? await import("./runtime-artifact-BvyT1uyd.js") : void 0;
 		const nativeCommandBeforeStart = startOptions.commandSource === "resolved-managed" ? resolveManagedCodexNativeCommand(startOptions.command) : void 0;
 		const runtimeArtifactBeforeStart = runtimeArtifactModule ? await runtimeArtifactModule.captureCodexAppServerRuntimeArtifactBeforeStart({
@@ -3632,7 +4339,16 @@ async function startInitializedCodexAppServerClient(params) {
 			if (index + 1 < startOptionsCandidates.length) continue;
 			throw new Error("Codex app-server runtime artifact does not match verified inference");
 		}
+		assertDesktopGenerationCurrent();
 		const client = CodexAppServerClient.start(startOptions);
+		const nativeCommandAtStart = startOptions.commandSource === "resolved-managed" ? resolveManagedCodexNativeCommand(startOptions.command) : void 0;
+		getCodexAppServerClientStartMetadata().set(client, {
+			requestedStartOptions: params.requestedStartOptions,
+			startOptions,
+			agentDir: params.agentDir,
+			...nativeCommandAtStart ? { nativeCommand: nativeCommandAtStart } : {},
+			...desktopGeneration ? { desktopGeneration } : {}
+		});
 		params.onStartedClient?.(client);
 		let initialize;
 		try {
@@ -3643,6 +4359,12 @@ async function startInitializedCodexAppServerClient(params) {
 			if (shouldTryManagedFallbackStartOption(error, startOptions, index, startOptionsCandidates)) continue;
 			throw error;
 		}
+		try {
+			assertDesktopGenerationCurrent();
+		} catch (error) {
+			client.close();
+			throw error;
+		}
 		params.onInitializedClient?.();
 		let runtimeArtifact;
 		try {
@@ -3669,6 +4391,7 @@ async function startInitializedCodexAppServerClient(params) {
 			config: params.config
 		});
 		try {
+			assertDesktopGenerationCurrent();
 			await withCodexAppServerAcquireDeadline(resolveRemainingAcquireTimeout(timeoutMs, acquireStartedAt), applyCodexAppServerAuthProfile({
 				client,
 				agentDir: params.agentDir,
@@ -3679,14 +4402,8 @@ async function startInitializedCodexAppServerClient(params) {
 				config: params.config,
 				...params.authProfileStore ? { authProfileStore: params.authProfileStore } : {}
 			}), params.abandonSignal);
-			const nativeCommand = startOptions.commandSource === "resolved-managed" ? resolveManagedCodexNativeCommand(startOptions.command) : void 0;
 			if (runtimeArtifactModule && runtimeArtifact) runtimeArtifactModule.bindCodexAppServerRuntimeArtifact(client, runtimeArtifact);
-			getCodexAppServerClientStartMetadata().set(client, {
-				requestedStartOptions: params.requestedStartOptions,
-				startOptions,
-				agentDir: params.agentDir,
-				...nativeCommand ? { nativeCommand } : {}
-			});
+			assertDesktopGenerationCurrent();
 			const fenceKey = resolveCodexNativeConfigFenceKey({ client });
 			if (fenceKey) client.setThreadSessionRequestGuard(async (options) => {
 				const release = await acquireCodexNativeConfigFence(fenceKey, options);
@@ -3706,6 +4423,9 @@ async function startInitializedCodexAppServerClient(params) {
 	}
 	throw new Error("Managed Codex app-server fallback candidates were exhausted.");
 }
+function isCodexComputerUseCandidateArtifactsUnavailableError(error) {
+	return error !== null && typeof error === "object" && "code" in error && error.code === "CODEX_COMPUTER_USE_CANDIDATE_ARTIFACTS_UNAVAILABLE";
+}
 function resolveManagedFallbackStartOptions(startOptions) {
 	const commands = [startOptions.command, ...startOptions.managedFallbackCommandPaths ?? []];
 	const candidates = [];
@@ -3797,6 +4517,62 @@ function retireSharedCodexAppServerClientIfCurrent(client, opts) {
 		};
 	}
 }
+/** Gracefully retires exact clients attached to an older desktop generation. */
+function retireSharedCodexAppServerClientsBeforeDesktopGeneration(generation) {
+	const state = getSharedCodexAppServerClientState();
+	for (const entry of state.clients.values()) {
+		const client = entry.client;
+		const attached = client ? getCodexAppServerClientStartMetadata().get(client) : void 0;
+		if (client && attached?.desktopGeneration && attached.desktopGeneration.epoch < generation.epoch) retireSharedCodexAppServerClientIfCurrent(client);
+	}
+}
+function createOlderDesktopGenerationDrainWait(params) {
+	const targetHome = resolveCodexNativeConfigFenceKey({
+		startOptions: params.startOptions,
+		agentDir: params.agentDir
+	});
+	if (!targetHome) return {
+		promise: Promise.resolve(),
+		cancel: () => void 0
+	};
+	const state = getSharedCodexAppServerClientState();
+	let settled = false;
+	let resolveWait;
+	const promise = new Promise((resolve) => {
+		resolveWait = resolve;
+	});
+	const cancel = () => {
+		if (settled) return;
+		settled = true;
+		state.desktopGenerationDrainChecks.delete(check);
+		resolveWait();
+	};
+	const check = () => {
+		if (!hasLiveOlderDesktopGenerationClient({
+			state,
+			generation: params.generation,
+			targetHome
+		})) cancel();
+	};
+	state.desktopGenerationDrainChecks.add(check);
+	check();
+	return {
+		promise,
+		cancel
+	};
+}
+function hasLiveOlderDesktopGenerationClient(params) {
+	for (const client of params.state.liveClients) if (isOlderDesktopGenerationClientForHome(client, params.generation, params.targetHome)) return true;
+	for (const client of params.state.isolatedClients) if (isOlderDesktopGenerationClientForHome(client, params.generation, params.targetHome)) return true;
+	return false;
+}
+function isOlderDesktopGenerationClientForHome(client, generation, targetHome) {
+	const metadata = getCodexAppServerClientStartMetadata().get(client);
+	return Boolean(metadata?.desktopGeneration && metadata.desktopGeneration.epoch < generation.epoch && resolveCodexNativeConfigFenceKey({ client }) === targetHome);
+}
+function notifyDesktopGenerationDrainChecks(state) {
+	for (const check of state.desktopGenerationDrainChecks) check();
+}
 /** Clears a matching shared client and waits for its process to exit. */
 async function clearSharedCodexAppServerClientIfCurrentAndWait(client, options) {
 	if (!client) return false;
@@ -3864,6 +4640,7 @@ function retainPendingSharedClientAcquire(entry) {
 		released = true;
 		entry.pendingAcquires = Math.max(0, entry.pendingAcquires - 1);
 		closeRetiredSharedClientEntryIfIdle(entry);
+		notifyDesktopGenerationDrainChecks(getSharedCodexAppServerClientState());
 	};
 }
 function retainSharedClientEntry(entry) {
@@ -3874,6 +4651,7 @@ function retainSharedClientEntry(entry) {
 		released = true;
 		entry.activeLeases = Math.max(0, entry.activeLeases - 1);
 		closeRetiredSharedClientEntryIfIdle(entry);
+		notifyDesktopGenerationDrainChecks(getSharedCodexAppServerClientState());
 	};
 }
 function closeRetiredSharedClientEntryIfIdle(entry) {
@@ -3901,7 +4679,7 @@ function closeSharedClientEntryIfUnclaimed(key, entry) {
 }
 function retirePendingSharedClientEntryIfUnclaimed(key, entry) {
 	if (entry.activeLeases > 0 || entry.pendingAcquires > 0) return;
-	entry.runtimeArtifactStartupAbort?.abort(/* @__PURE__ */ new Error("Codex runtime artifact startup was abandoned"));
+	entry.startupAbort?.abort(/* @__PURE__ */ new Error("Codex app-server startup was abandoned"));
 	entry.closeWhenIdle = true;
 	const state = getSharedCodexAppServerClientState();
 	if (state.clients.get(key) === entry) state.clients.delete(key);
@@ -3912,4 +4690,4 @@ function collectSharedClients(state) {
 	return [...state.liveClients];
 }
 //#endregion
-export { rememberCodexRateLimitsRead as $, isCodexAppServerApprovalRequest as A, CodexAppServerRpcError as B, resolveCodexPostToolRawAssistantCompletionIdleTimeoutMs as C, resolveCodexTurnTerminalIdleTimeoutMs as D, resolveCodexTurnCompletionIdleTimeoutMs as E, isCodexAppServerPrewriteRequestCancellationError as F, isCodexAppServerClientRuntimeLive as G, claimCodexAppServerLiveThread as H, isCodexAppServerRequestTimeoutError as I, releaseCodexAppServerLiveThread as J, isCodexAppServerLiveThreadClaimed as K, isUnsupportedCodexAppServerVersionError as L, isCodexAppServerConnectionClosedError as M, isCodexAppServerIndeterminateRequestCancellationError as N, withCodexStartupTimeout as O, isCodexAppServerIndeterminateTransportError as P, readRecentCodexRateLimits as Q, resolveCodexAppServerClientInstanceId as R, resolveCodexGatewayTimeoutWithGraceMs as S, resolveCodexTurnAssistantCompletionIdleTimeoutMs as T, consumeCodexAppServerLiveThread as U, createCodexElicitationResponse as V, ensureCodexAppServerClientRuntime as W, unsubscribeCodexAppServerLiveThread as X, retainCodexAppServerLiveThread as Y, readCodexRateLimitsRevision as Z, withTimeout$1 as _, getLeasedSharedCodexAppServerClient as a, resolveCodexAppServerPreparedAuthHandoff as at, CodexAppServerStartupError as b, releaseCodexAppServerClientLease as c, CODEX_OPENCLAW_DIRECT_DYNAMIC_TOOL_NAMESPACE as ct, retainSharedCodexAppServerClientByInstanceId as d, resolveFirstExistingMacOSDesktopCodexBundledMarketplacePath as dt, resolveCodexAppServerAuthAccountCacheKey as et, retainSharedCodexAppServerClientIfCurrent as f, resolveCodexAppServerHomeDir as ft, withAbortableTimeout as g, withLeasedCodexAppServerClientStartSelectionRetry as h, createIsolatedCodexAppServerClient as i, resolveCodexAppServerPreparedApiKeyCacheKey as it, isCodexAppServerBrokenPipeError as j, getCodexAppServerClientInstanceId as k, releaseLeasedSharedCodexAppServerClient as l, flattenCodexDynamicToolFunctions as lt, shared_client_exports as m, clearSharedCodexAppServerClientIfCurrentAndUnclaimed as n, resolveCodexAppServerAuthProfileIdForAgent as nt, getSharedCodexAppServerClient as o, CODEX_INTERACTIVE_CUSTOM_THREAD_SOURCES as ot, retireSharedCodexAppServerClientIfCurrent as p, resolveCodexAppServerLocalHomeDir as pt, protectCodexAppServerLiveThread as q, clearSharedCodexAppServerClientIfCurrentAndWait as r, resolveCodexAppServerFallbackApiKeyCacheKey as rt, isCodexAppServerStartSelectionChangedError as s, CODEX_INTERACTIVE_THREAD_SOURCE_KINDS as st, clearSharedCodexAppServerClientIfCurrent as t, resolveCodexAppServerAuthProfileId as tt, resolveCodexNativeConfigFenceKey as u, isJsonObject as ut, acquireCodexNativeConfigFence as v, resolveCodexStartupTimeoutMs as w, isCodexAppServerStartupError as x, CODEX_POST_REASONING_REPLY_IDLE_TIMEOUT_MS as y, closeCodexAppServerTransportAndWait as z };
+export { releaseCodexAppServerLiveThread as $, resolveCodexTurnAssistantCompletionIdleTimeoutMs as A, isCodexAppServerPrewriteRequestCancellationError as B, createCodexDesktopGenerationService as C, resolveCodexGatewayTimeoutWithGraceMs as D, isCodexAppServerStartupError as E, isCodexAppServerApprovalRequest as F, CodexAppServerRpcError as G, isUnsupportedCodexAppServerVersionError as H, isCodexAppServerBrokenPipeError as I, consumeCodexAppServerLiveThread as J, createCodexElicitationResponse as K, isCodexAppServerConnectionClosedError as L, resolveCodexTurnTerminalIdleTimeoutMs as M, withCodexStartupTimeout as N, resolveCodexPostToolRawAssistantCompletionIdleTimeoutMs as O, getCodexAppServerClientInstanceId as P, protectCodexAppServerLiveThread as Q, isCodexAppServerIndeterminateRequestCancellationError as R, acquireCodexNativeConfigFence as S, resolveCodexAppServerLocalHomeDir as St, CodexAppServerStartupError as T, resolveCodexAppServerClientInstanceId as U, isCodexAppServerRequestTimeoutError as V, closeCodexAppServerTransportAndWait as W, isCodexAppServerClientRuntimeLive as X, ensureCodexAppServerClientRuntime as Y, isCodexAppServerLiveThreadClaimed as Z, retireSharedCodexAppServerClientIfCurrent as _, flattenCodexDynamicToolFunctions as _t, createIsolatedCodexAppServerClient as a, readRecentCodexRateLimits as at, waitForCodexAppServerClientDesktopGenerationDrain as b, assertNotSymlink as bt, isCodexAppServerStartSelectionChangedError as c, resolveCodexAppServerAuthAccountCacheKey as ct, readCodexAppServerClientProcessIdentity as d, resolveCodexAppServerFallbackApiKeyCacheKey as dt, retainCodexAppServerLiveThread as et, releaseCodexAppServerClientLease as f, resolveCodexAppServerPreparedApiKeyCacheKey as ft, retainSharedCodexAppServerClientIfCurrent as g, CODEX_OPENCLAW_DIRECT_DYNAMIC_TOOL_NAMESPACE as gt, retainSharedCodexAppServerClientByInstanceId as h, CODEX_INTERACTIVE_THREAD_SOURCE_KINDS as ht, clearSharedCodexAppServerClientIfCurrentAndWait as i, readCodexRateLimitsRevision as it, resolveCodexTurnCompletionIdleTimeoutMs as j, resolveCodexStartupTimeoutMs as k, readCodexAppServerClientDesktopGeneration as l, resolveCodexAppServerAuthProfileId as lt, resolveCodexNativeConfigFenceKey as m, CODEX_INTERACTIVE_CUSTOM_THREAD_SOURCES as mt, clearSharedCodexAppServerClientIfCurrent as n, withAbortableTimeout as nt, getLeasedSharedCodexAppServerClient as o, rememberCodexRateLimitsRead as ot, releaseLeasedSharedCodexAppServerClient as p, resolveCodexAppServerPreparedAuthHandoff as pt, claimCodexAppServerLiveThread as q, clearSharedCodexAppServerClientIfCurrentAndUnclaimed as r, withTimeout$1 as rt, getSharedCodexAppServerClient as s, reconcileCodexComputerUseStartArtifacts as st, assertCodexAppServerClientStartSelectionCurrent as t, unsubscribeCodexAppServerLiveThread as tt, readCodexAppServerClientDesktopGenerationFingerprint as u, resolveCodexAppServerAuthProfileIdForAgent as ut, retireSharedCodexAppServerClientsBeforeDesktopGeneration as v, isJsonObject as vt, CODEX_POST_REASONING_REPLY_IDLE_TIMEOUT_MS as w, withLeasedCodexAppServerClientStartSelectionRetry as x, resolveCodexAppServerHomeDir as xt, shared_client_exports as y, resolveCodexManagedBundledMarketplacePath as yt, isCodexAppServerIndeterminateTransportError as z };