@openclaw/codex 2026.8.2 → 2026.9.1

package/dist/index.js

@@ -1,27 +1,26 @@
 import { registerCodexCliMetadata } from "./cli-metadata.js";
-import { n as createCodexAppServerNativeCompaction, t as createCodexAppServerAgentHarness } from "./harness-BgeB7LnD.js";
-import { D as resolveOpenClawExecPolicyForCodexAppServer, T as readCodexPluginConfig, c as assertCodexAppServerConnectionSecurity, i as resolveCodexAppServerRuntimeOptions, j as CODEX_PLUGINS_MARKETPLACE_NAME, n as codexSandboxPolicyForTurn, p as canUseCodexModelBackedApprovalsReviewerForModel, s as resolveCodexSupervisionAppServerRuntimeOptions, t as codexAppServerStartOptionsKey, v as readCodexRequirementsToml } from "./config-CcYL77O6.js";
-import { C as withLeasedCodexAppServerClientStartSelectionRetry, Ft as resolveCodexAppServerFallbackApiKeyCacheKey, Ht as isJsonObject, J as isCodexAppServerOverloadError, K as isCodexAppServerIndeterminateRequestCancellationError, Nt as resolveCodexAppServerAuthProfileIdForAgent, St as releaseCodexAppServerLiveThread, Z as isUnsupportedCodexAppServerVersionError, _ as retainSharedCodexAppServerClientByInstanceId, b as retireSharedCodexAppServerClientsBeforeDesktopGeneration, bt as isCodexAppServerLiveThreadClaimed, c as getLeasedSharedCodexAppServerClient, gt as consumeCodexAppServerLiveThread, h as releaseLeasedSharedCodexAppServerClient, jt as resolveCodexAppServerAuthAccountCacheKey, k as createCodexDesktopGenerationService, m as releaseCodexAppServerClientLease, o as clearSharedCodexAppServerClientIfCurrentAndWait, vt as hasCodexAppServerLiveThread, yt as isCodexAppServerClientRuntimeLive, zt as CODEX_INTERACTIVE_THREAD_SOURCE_KINDS } from "./shared-client-B1tT5U6r.js";
-import { i as setManagedCodexPluginRoot } from "./managed-binary-ZkGodW19.js";
+import { n as createCodexAppServerNativeCompaction, t as createCodexAppServerAgentHarness } from "./harness-DXVZ5II5.js";
+import { $t as isJsonObject, B as isCodexAppServerIndeterminateRequestCancellationError, Bt as resolveCodexAppServerAuthProfileIdForAgent, C as withLeasedCodexAppServerClientStartSelectionRetry, Et as isCodexAppServerLiveThreadClaimed, G as isUnsupportedCodexAppServerVersionError, H as isCodexAppServerOverloadError, Ht as resolveCodexAppServerFallbackApiKeyCacheKey, J as CodexThreadDirectInputError, O as createCodexDesktopGenerationService, Rt as resolveCodexAppServerAuthAccountCacheKey, St as consumeCodexAppServerLiveThread, Tt as isCodexAppServerClientRuntimeLive, X as assertCodexThreadAcceptsDirectInput, Xt as CODEX_INTERACTIVE_THREAD_SOURCE_KINDS, _ as retainSharedCodexAppServerClientByInstanceId, b as retireSharedCodexAppServerClientsBeforeDesktopGeneration, c as getLeasedSharedCodexAppServerClient, et as assertCodexThreadStartResponse, h as releaseLeasedSharedCodexAppServerClient, kt as releaseCodexAppServerLiveThread, m as releaseCodexAppServerClientLease, o as clearSharedCodexAppServerClientIfCurrentAndWait, wt as hasCodexAppServerLiveThread } from "./shared-client-DxcfF9KX.js";
+import { E as readCodexPluginConfig, M as CODEX_PLUGINS_MARKETPLACE_NAME, O as resolveOpenClawExecPolicyForCodexAppServer, c as assertCodexAppServerConnectionSecurity, i as resolveCodexAppServerRuntimeOptions, m as canUseCodexModelBackedApprovalsReviewerForModel, n as codexSandboxPolicyForTurn, s as resolveCodexSupervisionAppServerRuntimeOptions, t as codexAppServerStartOptionsKey, y as readCodexRequirementsToml } from "./config-BhmfC1s6.js";
+import { a as setManagedCodexPluginRoot } from "./managed-binary-4-Vjz5GH.js";
 import { n as CODEX_APP_SERVER_BINDING_NAMESPACE, t as CODEX_APP_SERVER_BINDING_MAX_ENTRIES } from "./session-binding-meta-B7aEMU7g.js";
-import { d as sessionBindingIdentity, n as assertCodexBindingMayBeReplaced, o as isCodexAppServerNativeAuthProfile, s as normalizeCodexAppServerBindingModelProvider } from "./session-binding-D0zinCP1.js";
-import { o as createCodexAppServerProcessReaperService } from "./transport-stdio-NT_Dpd9V.js";
-import { r as assertCodexThreadAcceptsDirectInput, s as assertCodexThreadStartResponse, t as CodexThreadDirectInputError } from "./protocol-validators-Bg5rpNxk.js";
-import { a as closeCodexStartupClientBestEffort, c as isCodexAppServerUnsafeSubscriptionError, f as unsubscribeCodexThreadBestEffort, g as isCodexNotificationForTurn, m as getCodexAppServerTurnRouter, o as interruptCodexTurnAndWaitBestEffort, u as retireUnsafeCodexTurnClientBestEffort } from "./attempt-client-cleanup-CpVfwctT.js";
-import { s as isAssistantCommentaryCompletionNotification } from "./event-projector-usage-B2r5vhWH.js";
-import { i as buildCodexPluginAppCacheKey, s as defaultCodexAppInventoryCache, t as resumeCodexAppServerThread } from "./thread-resume-BFt1-ZDa.js";
-import { C as buildCodexProjectDocThreadConfig, E as resolveCodexAppServerRequestModelSelection, M as CODEX_MANAGED_THREAD_NAMESPACE, N as createCodexManagedThreadStore, ct as ensureCodexPluginActivation, ft as pluginReadParams, it as buildDisabledAppsConfigPatch, j as CODEX_MANAGED_THREAD_MAX_ENTRIES, ot as mergeCodexThreadConfigs, ut as isOpenAiCuratedMarketplace, w as CODEX_NATIVE_PERSONALITY_NONE } from "./thread-lifecycle-CGGKP720.js";
-import { a as rollbackCodexAppServerBindingSubscription, c as withExclusiveCodexAppServerThread, i as retireCodexConversationThreadBinding, l as isIncognitoSessionKey, n as releaseCodexAppServerBindingSubscription, r as retainCodexAppServerBindingSubscription, s as withCodexConversationThreadActivity, t as isSameCodexAppServerThreadOwner } from "./thread-ownership-RkaoZCmQ.js";
-import { c as resolveCodexNativeSandboxBlock, i as requestCodexAppServerJson, o as withCodexAppServerJsonClient, s as resolveCodexNativeExecutionBlock } from "./request-BWxweEdK.js";
-import { p as projectBoundedCodexVisibleSessionHistory } from "./transcript-mirror-1ep4XjzF.js";
+import { d as sessionBindingIdentity, n as assertCodexBindingMayBeReplaced, o as isCodexAppServerNativeAuthProfile, s as normalizeCodexAppServerBindingModelProvider } from "./session-binding-BHuTCRZQ.js";
+import { o as createCodexAppServerProcessReaperService } from "./transport-stdio-CyPldczm.js";
+import { a as closeCodexStartupClientBestEffort, c as isCodexAppServerUnsafeSubscriptionError, d as unsubscribeCodexThreadBestEffort, h as isCodexNotificationForTurn, l as retireUnsafeCodexTurnClientBestEffort, o as interruptCodexTurnAndWaitBestEffort, p as getCodexAppServerTurnRouter } from "./attempt-client-cleanup-DYHcRQAa.js";
+import { o as isAssistantCommentaryCompletionNotification } from "./event-projector-usage-C5mcrGjp.js";
+import { i as buildCodexPluginAppCacheKey, s as defaultCodexAppInventoryCache, t as resumeCodexAppServerThread } from "./thread-resume-C7pyVKeW.js";
+import { Dt as mergeCodexThreadConfigs, E as resolveCodexAppServerRequestModelSelection, Et as buildDisabledAppsConfigPatch, J as createCodexManagedThreadStore, K as CODEX_MANAGED_THREAD_MAX_ENTRIES, Nt as pluginReadParams, jt as isOpenAiCuratedMarketplace, k as buildCodexProjectDocThreadConfig, kt as ensureCodexPluginActivation, q as CODEX_MANAGED_THREAD_NAMESPACE, w as CODEX_NATIVE_PERSONALITY_NONE } from "./thread-lifecycle-DAcEJ_Om.js";
+import { a as rollbackCodexAppServerBindingSubscription, c as withExclusiveCodexAppServerThread, i as retireCodexConversationThreadBinding, l as isIncognitoSessionKey, n as releaseCodexAppServerBindingSubscription, r as retainCodexAppServerBindingSubscription, s as withCodexConversationThreadActivity, t as isSameCodexAppServerThreadOwner } from "./thread-ownership-zGokd8i1.js";
+import { p as projectBoundedCodexVisibleSessionHistory } from "./transcript-mirror-DTUxFWa_.js";
+import { c as resolveCodexNativeSandboxBlock, i as requestCodexAppServerJson, o as withCodexAppServerJsonClient, s as resolveCodexNativeExecutionBlock } from "./request-DYAI5FQE.js";
 import { buildCodexMediaUnderstandingProvider } from "./media-understanding-provider.js";
-import { n as describeControlFailure, t as CODEX_CONTROL_METHODS } from "./capabilities-D6m_TdVy.js";
-import { r as formatCodexDisplayText } from "./command-formatters--UToCokS.js";
-import { a as resolveCodexAppServerForModelProvider, i as resolveCodexSessionPermissionCwd, n as applyCodexSessionPermissionPolicy, t as CODEX_SESSION_PERMISSION_EXEC_MODES } from "./session-permission-policy-ScnAyG90.js";
-import { f as trackCodexConversationActiveTurn, g as canMutateCodexHost, h as CODEX_NATIVE_EXECUTION_AUTH_ERROR, t as discoverCodexMarketplacePlugins } from "./plugin-marketplace-discovery-BXjIFEiw.js";
+import { n as describeControlFailure, t as CODEX_CONTROL_METHODS } from "./capabilities-dIjNVCYH.js";
+import { a as formatCodexDisplayText } from "./command-formatters-CLHhEB1Q.js";
+import { a as resolveCodexAppServerForModelProvider, i as resolveCodexSessionPermissionCwd, n as applyCodexSessionPermissionPolicy, t as CODEX_SESSION_PERMISSION_EXEC_MODES } from "./session-permission-policy-DeWVTCMj.js";
+import { f as trackCodexConversationActiveTurn, g as canMutateCodexHost, h as CODEX_NATIVE_EXECUTION_AUTH_ERROR, t as discoverCodexMarketplacePlugins } from "./plugin-marketplace-discovery-CfFlKqDl.js";
 import { a as readCodexConversationBindingDataRecord, i as readCodexConversationBindingData, o as resolveCodexDefaultWorkspaceDir, r as createCodexConversationBindingData } from "./conversation-binding-data-BiodpIzq.js";
-import { n as resolveCodexBindingAppServerConnection } from "./binding-connection-CF7BmrDk.js";
-import { d as createCodexCliSessionNodeHostCommands, f as createCodexCliSessionNodeInvokePolicies, g as resumeCodexCliSessionOnNode, h as resolveCodexCliSessionForBindingOnNode, i as createCodexSessionCatalogNodeHostCommands, m as listCodexCliSessionsOnNode, n as createCodexSessionCatalogNodeInvokePolicies, o as assertCodexArchiveDescendantsUnowned, r as createCodexSessionCatalogControl, s as codexControlRequest, t as codexSessionCatalogRuntime } from "./session-catalog-eMhVm0Ql.js";
+import { n as resolveCodexBindingAppServerConnection } from "./binding-connection-E6uDsPlx.js";
+import { d as createCodexCliSessionNodeHostCommands, f as createCodexCliSessionNodeInvokePolicies, g as resumeCodexCliSessionOnNode, h as resolveCodexCliSessionForBindingOnNode, i as createCodexSessionCatalogNodeHostCommands, m as listCodexCliSessionsOnNode, n as createCodexSessionCatalogNodeInvokePolicies, o as assertCodexArchiveDescendantsUnowned, r as createCodexSessionCatalogControl, s as codexControlRequest, t as codexSessionCatalogRuntime } from "./session-catalog-yyvTWFOw.js";
 import { t as createCodexWebSearchProviderBase } from "./web-search-provider.shared-BrZmlqyR.js";
 import { mutateConfigFile } from "openclaw/plugin-sdk/config-mutation";
 import { normalizePluginsConfig, resolveEffectiveEnableState, resolveLivePluginConfigObject, resolvePluginConfigObject } from "openclaw/plugin-sdk/plugin-config-runtime";
@@ -31,6 +30,7 @@ import fs from "node:fs/promises";
 import path from "node:path";
 import { parseStrictNonNegativeInteger, resolveTimerTimeoutMs } from "openclaw/plugin-sdk/number-runtime";
 import { embeddedAgentLog, formatErrorMessage, resolveActiveEmbeddedRunSessionId, resolveSandboxContext } from "openclaw/plugin-sdk/agent-harness-runtime";
+import { canonicalPathFromExistingAncestor, isPathInside } from "openclaw/plugin-sdk/file-access-runtime";
 import os from "node:os";
 import { loadAuthProfileStoreWithoutExternalProfiles, resolveAgentConfig, resolveAgentWorkspaceDir, resolveDefaultAgentDir, resolveDefaultAgentId } from "openclaw/plugin-sdk/agent-runtime";
 import { applyAuthProfileConfig, buildApiKeyCredential, buildOauthProviderAuthResult, buildOpenAICodexCredentialExtra, readCodexCliCredentialsCached, resolveOpenAICodexAuthIdentity, resolveOpenAICodexImportProfileName, updateAuthProfileStoreWithLock } from "openclaw/plugin-sdk/provider-auth";
@@ -41,7 +41,6 @@ import { getSessionEntry, resolveStorePath, resolveTranscriptSessionKeyBySession
 import { coerceErrorMessage } from "openclaw/plugin-sdk/error-runtime";
 import { fileURLToPath } from "node:url";
 import { expectDefined } from "openclaw/plugin-sdk/expect-runtime";
-import { canonicalPathFromExistingAncestor, isPathInside } from "openclaw/plugin-sdk/file-access-runtime";
 import { KeyedAsyncQueue } from "openclaw/plugin-sdk/keyed-async-queue";
 import { readVisibleSessionTranscriptMessageEntries } from "openclaw/plugin-sdk/session-transcript-runtime";
 import { getSessionBindingService } from "openclaw/plugin-sdk/conversation-binding-runtime";
@@ -181,7 +180,7 @@ function waitForReconnect(delayMs, signal) {
 /** Defers schema compilation and auth loading until the first binding operation. */
 function createLazyCodexAppServerBindingStore(state, managedThreadState) {
 	let resolved;
-	const store = () => resolved ??= import("./session-binding-D0zinCP1.js").then((n) => n.f).then(({ createCodexAppServerBindingStore }) => createCodexAppServerBindingStore(state));
+	const store = () => resolved ??= import("./session-binding-BHuTCRZQ.js").then((n) => n.f).then(({ createCodexAppServerBindingStore }) => createCodexAppServerBindingStore(state));
 	const managedThreads = managedThreadState ? createCodexManagedThreadStore(managedThreadState) : void 0;
 	return {
 		...managedThreads ? { managedThreads } : {},
@@ -212,7 +211,7 @@ async function handleCodexCommand(ctx, options) {
 	}
 }
 async function loadDefaultCodexSubcommandHandler() {
-	const { handleCodexSubcommand } = await import("./command-handlers-CLFx2Ypa.js");
+	const { handleCodexSubcommand } = await import("./command-handlers-CTGb2csu.js");
 	return handleCodexSubcommand;
 }
 //#endregion
@@ -525,11 +524,15 @@ async function startCodexConversationThread(params) {
 		agentId: params.agentId
 	};
 	const threadId = params.threadId?.trim();
-	if (threadId) await attachExistingThread({
-		...bindingParams,
-		threadId
+	const bind = () => params.bindingStore.withLease(identity, () => bindThread(bindingParams, threadId));
+	const ownedThreadId = threadId ?? existingBinding?.threadId;
+	if (ownedThreadId) await withExclusiveCodexAppServerThread({
+		bindingStore: params.bindingStore,
+		identity,
+		threadId: ownedThreadId,
+		run: bind
 	});
-	else await bindThread(bindingParams);
+	else await bind();
 	const storedBinding = await params.bindingStore.read(identity);
 	if (!storedBinding) throw new Error("Codex session binding disappeared while starting its conversation thread.");
 	return createCodexConversationBindingData({
@@ -770,14 +773,6 @@ async function writeThreadBindingFromResponse(params, resolved, client, response
 		throw error;
 	}
 }
-async function attachExistingThread(params) {
-	await withExclusiveCodexAppServerThread({
-		bindingStore: params.bindingStore,
-		identity: params.identity,
-		threadId: params.threadId,
-		run: () => bindThread(params, params.threadId)
-	});
-}
 async function bindThread(params, threadId) {
 	const current = await params.bindingStore.read(params.identity);
 	assertCodexBindingMayBeReplaced(current, "binding a conversation-bound Codex thread");
@@ -830,277 +825,286 @@ async function runBoundTurn(params) {
 	const identity = conversationBindingIdentity(params.data);
 	const binding = await params.bindingStore.read(identity);
 	if (!binding?.threadId) throw new Error("bound Codex conversation has no thread binding");
-	assertCodexBindingMayBeReplaced(binding, "running a conversation-bound Codex thread");
-	let threadId = binding.threadId;
-	const requestedWorkspaceDir = binding.cwd || params.data.workspaceDir;
-	const reviewerModelProvider = resolveModelBackedReviewerPolicyProvider({
-		authProfileId: binding.authProfileId,
-		modelProvider: binding.modelProvider,
-		...agentLookup
-	});
-	const { runtime, workspaceDir } = await resolveConversationAppServerRuntime({
-		pluginConfig: params.pluginConfig,
-		config: params.config,
-		agentId: params.data.source?.agentId ?? params.data.agentId,
-		sessionKey: params.data.legacyBinding ? params.sessionKey : params.data.source?.sessionKey,
-		source: params.data.source,
-		workspaceDir: requestedWorkspaceDir,
-		modelProvider: reviewerModelProvider,
-		model: binding.model,
-		agentDir: params.data.agentDir
-	});
-	const modelScopedRuntime = resolveCodexAppServerForModelProvider({
-		appServer: runtime,
-		provider: reviewerModelProvider,
-		model: binding.model,
-		config: params.config,
-		env: process.env,
-		agentDir: params.data.agentDir
-	});
-	const sessionRoot = modelScopedRuntime.sessionRoot;
-	const approvalPolicy = modelScopedRuntime.approvalPolicy;
-	const sandbox = modelScopedRuntime.sandbox;
-	const permissionProfile = modelScopedRuntime.networkProxy?.profileName;
-	const networkProxyConfigFingerprint = modelScopedRuntime.networkProxy?.configFingerprint;
-	const networkProxyBindingChanged = binding.networkProxyProfileName !== permissionProfile || binding.networkProxyConfigFingerprint !== networkProxyConfigFingerprint;
-	const serviceTier = binding.serviceTier ?? runtime.serviceTier;
-	let useStickyNetworkProfile = permissionProfile !== void 0 && binding.networkProxyProfileName === permissionProfile && binding.networkProxyConfigFingerprint === networkProxyConfigFingerprint;
-	assertNativeConversationApprovalPolicySupported(modelScopedRuntime);
-	const modelSelection = binding.model ? resolveCodexAppServerRequestModelSelection({
-		model: binding.model,
-		modelProvider: binding.modelProvider,
-		authProfileId: binding.authProfileId,
-		...agentLookup
-	}) : void 0;
-	const threadRequestRuntime = {
-		runtime: modelScopedRuntime,
-		workspaceDir,
-		...modelSelection
-	};
-	const clientOptions = {
-		startOptions: runtime.start,
-		timeoutMs: runtime.requestTimeoutMs,
-		authProfileId: binding.authProfileId,
-		...agentLookup
-	};
-	let client = await getLeasedSharedCodexAppServerClient(clientOptions);
-	const clientLease = { client };
-	let activeTurnId;
-	let activeTurnCleanup = () => void 0;
-	let isolatedSubscriptionClient;
-	let turnRoute;
-	let liveThreadOwnership;
-	let ownsNativeSubscription = false;
-	let turnSucceeded = false;
-	const assertResumeInputAllowed = async () => {
-		const { thread } = await client.request("thread/read", {
-			threadId,
-			includeTurns: false
-		}, { timeoutMs: runtime.requestTimeoutMs });
-		assertCodexThreadAcceptsDirectInput(thread);
-	};
-	try {
-		if (!networkProxyBindingChanged && binding.clientId !== client.getInstanceId()) await assertResumeInputAllowed();
-		if (!params.incognito && isCodexAppServerClientRuntimeLive(client)) {
-			const ownership = await consumeCodexAppServerLiveThread(client, threadId);
-			if (ownership) {
-				liveThreadOwnership = {
-					client,
+	return await withExclusiveCodexAppServerThread({
+		bindingStore: params.bindingStore,
+		identity,
+		threadId: binding.threadId,
+		run: async () => {
+			const current = await params.bindingStore.read(identity);
+			if (!isSameCodexAppServerThreadOwner(current, binding)) throw new Error("Codex conversation binding changed before its turn.");
+			assertCodexBindingMayBeReplaced(binding, "running a conversation-bound Codex thread");
+			let threadId = binding.threadId;
+			const requestedWorkspaceDir = binding.cwd || params.data.workspaceDir;
+			const reviewerModelProvider = resolveModelBackedReviewerPolicyProvider({
+				authProfileId: binding.authProfileId,
+				modelProvider: binding.modelProvider,
+				...agentLookup
+			});
+			const { runtime, workspaceDir } = await resolveConversationAppServerRuntime({
+				pluginConfig: params.pluginConfig,
+				config: params.config,
+				agentId: params.data.source?.agentId ?? params.data.agentId,
+				sessionKey: params.data.legacyBinding ? params.sessionKey : params.data.source?.sessionKey,
+				source: params.data.source,
+				workspaceDir: requestedWorkspaceDir,
+				modelProvider: reviewerModelProvider,
+				model: binding.model,
+				agentDir: params.data.agentDir
+			});
+			const modelScopedRuntime = resolveCodexAppServerForModelProvider({
+				appServer: runtime,
+				provider: reviewerModelProvider,
+				model: binding.model,
+				config: params.config,
+				env: process.env,
+				agentDir: params.data.agentDir
+			});
+			const sessionRoot = modelScopedRuntime.sessionRoot;
+			const approvalPolicy = modelScopedRuntime.approvalPolicy;
+			const sandbox = modelScopedRuntime.sandbox;
+			const permissionProfile = modelScopedRuntime.networkProxy?.profileName;
+			const networkProxyConfigFingerprint = modelScopedRuntime.networkProxy?.configFingerprint;
+			const networkProxyBindingChanged = binding.networkProxyProfileName !== permissionProfile || binding.networkProxyConfigFingerprint !== networkProxyConfigFingerprint;
+			const serviceTier = binding.serviceTier ?? runtime.serviceTier;
+			let useStickyNetworkProfile = permissionProfile !== void 0 && binding.networkProxyProfileName === permissionProfile && binding.networkProxyConfigFingerprint === networkProxyConfigFingerprint;
+			assertNativeConversationApprovalPolicySupported(modelScopedRuntime);
+			const modelSelection = binding.model ? resolveCodexAppServerRequestModelSelection({
+				model: binding.model,
+				modelProvider: binding.modelProvider,
+				authProfileId: binding.authProfileId,
+				...agentLookup
+			}) : void 0;
+			const threadRequestRuntime = {
+				runtime: modelScopedRuntime,
+				workspaceDir,
+				...modelSelection
+			};
+			const clientOptions = {
+				startOptions: runtime.start,
+				timeoutMs: runtime.requestTimeoutMs,
+				authProfileId: binding.authProfileId,
+				...agentLookup
+			};
+			let client = await getLeasedSharedCodexAppServerClient(clientOptions);
+			const clientLease = { client };
+			let activeTurnId;
+			let activeTurnCleanup = () => void 0;
+			let isolatedSubscriptionClient;
+			let turnRoute;
+			let liveThreadOwnership;
+			let ownsNativeSubscription = false;
+			let turnSucceeded = false;
+			const assertResumeInputAllowed = async () => {
+				const { thread } = await client.request("thread/read", {
 					threadId,
-					ownership
-				};
-				ownsNativeSubscription = true;
-			}
-		}
-		if (networkProxyBindingChanged) {
-			const response = assertCodexThreadStartResponse(await withLeasedCodexAppServerClientStartSelectionRetry({
-				lease: clientLease,
-				options: clientOptions,
-				run: async (requestClient, requestOptions) => await requestClient.request("thread/start", {
-					...buildConversationThreadRequest(threadRequestRuntime, serviceTier),
-					developerInstructions: CODEX_CONVERSATION_THREAD_DEVELOPER_INSTRUCTIONS,
-					experimentalRawEvents: true,
-					...params.incognito ? { ephemeral: true } : {}
-				}, requestOptions()),
-				onClientChange: (nextClient) => {
-					client = nextClient;
+					includeTurns: false
+				}, { timeoutMs: runtime.requestTimeoutMs });
+				assertCodexThreadAcceptsDirectInput(thread);
+			};
+			try {
+				if (!networkProxyBindingChanged && binding.clientId !== client.getInstanceId()) await assertResumeInputAllowed();
+				if (!params.incognito && isCodexAppServerClientRuntimeLive(client)) {
+					const ownership = await consumeCodexAppServerLiveThread(client, threadId);
+					if (ownership) {
+						liveThreadOwnership = {
+							client,
+							threadId,
+							ownership
+						};
+						ownsNativeSubscription = true;
+					}
 				}
-			}));
-			threadId = response.thread.id;
-			ownsNativeSubscription = true;
-			assertCodexThreadAcceptsDirectInput(response.thread);
-			if (liveThreadOwnership && (liveThreadOwnership.threadId !== threadId || liveThreadOwnership.client !== client)) {
-				const previousOwnership = liveThreadOwnership;
-				try {
-					await previousOwnership.ownership.release(previousOwnership.threadId);
-				} catch (error) {
-					if (!(isCodexAppServerClientRuntimeLive(previousOwnership.client) && await retainCodexAppServerBindingSubscription(previousOwnership.client, previousOwnership.threadId, previousOwnership.ownership).catch(() => false))) await closeCodexStartupClientBestEffort(previousOwnership.client);
-					liveThreadOwnership = void 0;
-					throw error;
+				if (networkProxyBindingChanged) {
+					const response = assertCodexThreadStartResponse(await withLeasedCodexAppServerClientStartSelectionRetry({
+						lease: clientLease,
+						options: clientOptions,
+						run: async (requestClient, requestOptions) => await requestClient.request("thread/start", {
+							...buildConversationThreadRequest(threadRequestRuntime, serviceTier),
+							developerInstructions: CODEX_CONVERSATION_THREAD_DEVELOPER_INSTRUCTIONS,
+							experimentalRawEvents: true,
+							...params.incognito ? { ephemeral: true } : {}
+						}, requestOptions()),
+						onClientChange: (nextClient) => {
+							client = nextClient;
+						}
+					}));
+					threadId = response.thread.id;
+					ownsNativeSubscription = true;
+					assertCodexThreadAcceptsDirectInput(response.thread);
+					if (liveThreadOwnership && (liveThreadOwnership.threadId !== threadId || liveThreadOwnership.client !== client)) {
+						const previousOwnership = liveThreadOwnership;
+						try {
+							await previousOwnership.ownership.release(previousOwnership.threadId);
+						} catch (error) {
+							if (!(isCodexAppServerClientRuntimeLive(previousOwnership.client) && await retainCodexAppServerBindingSubscription(previousOwnership.client, previousOwnership.threadId, previousOwnership.ownership).catch(() => false))) await closeCodexStartupClientBestEffort(previousOwnership.client);
+							liveThreadOwnership = void 0;
+							throw error;
+						}
+						liveThreadOwnership = void 0;
+					} else if (binding.threadId !== threadId) await releaseCodexAppServerBindingSubscription(binding);
+					if (!await params.bindingStore.mutate(identity, {
+						kind: "set",
+						binding: {
+							threadId,
+							clientId: client.getInstanceId(),
+							cwd: response.thread.cwd ?? workspaceDir,
+							authProfileId: binding.authProfileId,
+							model: response.model ?? modelSelection?.model ?? binding.model,
+							modelProvider: normalizeCodexAppServerBindingModelProvider({
+								authProfileId: binding.authProfileId,
+								modelProvider: response.modelProvider ?? modelSelection?.modelProvider ?? binding.modelProvider,
+								...agentLookup
+							}),
+							serviceTier: serviceTier ?? void 0,
+							networkProxyProfileName: modelScopedRuntime.networkProxy?.profileName,
+							networkProxyConfigFingerprint: modelScopedRuntime.networkProxy?.configFingerprint,
+							conversationStartId: binding.conversationStartId,
+							conversationSourceTransferComplete: binding.conversationSourceTransferComplete,
+							historyCoveredThrough: binding.historyCoveredThrough
+						}
+					})) throw new Error("Codex conversation binding changed while rotating its thread.");
+					useStickyNetworkProfile = modelScopedRuntime.networkProxy !== void 0;
+				} else if (binding.clientId !== client.getInstanceId() || isCodexAppServerClientRuntimeLive(client) && !params.incognito && !liveThreadOwnership) {
+					if (binding.clientId === client.getInstanceId()) await assertResumeInputAllowed();
+					const response = await withLeasedCodexAppServerClientStartSelectionRetry({
+						lease: clientLease,
+						options: clientOptions,
+						run: async (requestClient, requestOptions) => await resumeCodexAppServerThread({
+							client: requestClient,
+							onSubscriptionReleased: () => {
+								isolatedSubscriptionClient = requestClient;
+							},
+							abandonClient: async () => {
+								await closeCodexStartupClientBestEffort(requestClient);
+								isolatedSubscriptionClient = requestClient;
+							},
+							request: {
+								threadId,
+								...buildConversationThreadRequest(threadRequestRuntime, serviceTier)
+							},
+							requestResume: (request) => requestClient.request("thread/resume", request, requestOptions())
+						}),
+						onClientChange: (nextClient) => {
+							client = nextClient;
+						}
+					});
+					threadId = response.thread.id;
+					ownsNativeSubscription = true;
+					assertCodexThreadAcceptsDirectInput(response.thread);
+					if (!isSameCodexAppServerThreadOwner(binding, {
+						threadId,
+						clientId: client.getInstanceId()
+					})) await releaseCodexAppServerBindingSubscription(binding);
+					if (!await params.bindingStore.mutate(identity, {
+						kind: "patch",
+						threadId: binding.threadId,
+						patch: {
+							clientId: client.getInstanceId(),
+							cwd: response.thread.cwd ?? binding.cwd,
+							model: response.model ?? modelSelection?.model ?? binding.model,
+							modelProvider: normalizeCodexAppServerBindingModelProvider({
+								authProfileId: binding.authProfileId,
+								modelProvider: response.modelProvider ?? modelSelection?.modelProvider ?? binding.modelProvider,
+								...agentLookup
+							})
+						}
+					})) throw new Error("Codex conversation binding changed while resuming on a new client.");
 				}
-				liveThreadOwnership = void 0;
-			} else if (binding.threadId !== threadId) await releaseCodexAppServerBindingSubscription(binding);
-			if (!await params.bindingStore.mutate(identity, {
-				kind: "set",
-				binding: {
+				const turnCollector = createCodexConversationTurnCollector(threadId);
+				turnRoute = getCodexAppServerTurnRouter(client).reserveThread({
 					threadId,
-					clientId: client.getInstanceId(),
-					cwd: response.thread.cwd ?? workspaceDir,
-					authProfileId: binding.authProfileId,
-					model: response.model ?? modelSelection?.model ?? binding.model,
-					modelProvider: normalizeCodexAppServerBindingModelProvider({
-						authProfileId: binding.authProfileId,
-						modelProvider: response.modelProvider ?? modelSelection?.modelProvider ?? binding.modelProvider,
-						...agentLookup
+					onNotification: turnCollector.handleNotification
+				});
+				turnRoute.armTurn();
+				activeTurnId = (await client.request("turn/start", {
+					threadId,
+					input: buildCodexConversationTurnInput({
+						prompt: params.prompt,
+						event: params.event
 					}),
-					serviceTier: serviceTier ?? void 0,
-					networkProxyProfileName: modelScopedRuntime.networkProxy?.profileName,
-					networkProxyConfigFingerprint: modelScopedRuntime.networkProxy?.configFingerprint,
-					conversationStartId: binding.conversationStartId,
-					conversationSourceTransferComplete: binding.conversationSourceTransferComplete,
-					historyCoveredThrough: binding.historyCoveredThrough
+					cwd: workspaceDir,
+					...sessionRoot ? { runtimeWorkspaceRoots: [sessionRoot] } : {},
+					approvalPolicy,
+					approvalsReviewer: modelScopedRuntime.approvalsReviewer,
+					...useStickyNetworkProfile ? {} : { sandboxPolicy: codexSandboxPolicyForTurn(sandbox, sessionRoot ?? workspaceDir) },
+					...modelSelection?.model ? { model: modelSelection.model } : {},
+					personality: CODEX_NATIVE_PERSONALITY_NONE,
+					...serviceTier ? { serviceTier } : {}
+				}, { timeoutMs: runtime.requestTimeoutMs })).turn.id;
+				activeTurnCleanup = trackCodexConversationActiveTurn({
+					identity,
+					client,
+					threadId,
+					turnId: activeTurnId
+				});
+				turnCollector.setTurnId(activeTurnId);
+				await turnRoute.bindTurn(activeTurnId);
+				const replyText = (await turnCollector.wait({ timeoutMs: params.timeoutMs ?? DEFAULT_BOUND_TURN_TIMEOUT_MS })).replyText.trim();
+				turnSucceeded = true;
+				return { reply: { text: replyText || "Codex completed without a text reply." } };
+			} catch (error) {
+				if (isCodexAppServerOverloadError(error) && error.method === "thread/resume") throw error;
+				if (error instanceof CodexThreadDirectInputError) {
+					if (params.incognito && ownsNativeSubscription) {
+						if (!await unsubscribeCodexThreadBestEffort(client, {
+							threadId,
+							timeoutMs: 5e3
+						})) await retireUnsafeCodexTurnClientBestEffort(client, "parent-owned thread unsubscribe");
+					}
+					throw error;
 				}
-			})) throw new Error("Codex conversation binding changed while rotating its thread.");
-			useStickyNetworkProfile = modelScopedRuntime.networkProxy !== void 0;
-		} else if (binding.clientId !== client.getInstanceId() || isCodexAppServerClientRuntimeLive(client) && !params.incognito && !liveThreadOwnership) {
-			if (binding.clientId === client.getInstanceId()) await assertResumeInputAllowed();
-			const response = await withLeasedCodexAppServerClientStartSelectionRetry({
-				lease: clientLease,
-				options: clientOptions,
-				run: async (requestClient, requestOptions) => await resumeCodexAppServerThread({
-					client: requestClient,
-					onSubscriptionReleased: () => {
-						isolatedSubscriptionClient = requestClient;
-					},
-					abandonClient: async () => {
-						await closeCodexStartupClientBestEffort(requestClient);
-						isolatedSubscriptionClient = requestClient;
-					},
-					request: {
+				if (error instanceof CodexConversationTurnTimeoutError && activeTurnId || turnRoute && isCodexAppServerIndeterminateRequestCancellationError(error)) {
+					if (!await interruptCodexTurnAndWaitBestEffort(client, {
 						threadId,
-						...buildConversationThreadRequest(threadRequestRuntime, serviceTier)
-					},
-					requestResume: (request) => requestClient.request("thread/resume", request, requestOptions())
-				}),
-				onClientChange: (nextClient) => {
-					client = nextClient;
+						turnId: activeTurnId ?? ""
+					})) {
+						await retireUnsafeCodexTurnClientBestEffort(client, "turn interrupt");
+						isolatedSubscriptionClient = client;
+					}
 				}
-			});
-			threadId = response.thread.id;
-			ownsNativeSubscription = true;
-			assertCodexThreadAcceptsDirectInput(response.thread);
-			if (!isSameCodexAppServerThreadOwner(binding, {
-				threadId,
-				clientId: client.getInstanceId()
-			})) await releaseCodexAppServerBindingSubscription(binding);
-			if (!await params.bindingStore.mutate(identity, {
-				kind: "patch",
-				threadId: binding.threadId,
-				patch: {
-					clientId: client.getInstanceId(),
-					cwd: response.thread.cwd ?? binding.cwd,
-					model: response.model ?? modelSelection?.model ?? binding.model,
-					modelProvider: normalizeCodexAppServerBindingModelProvider({
-						authProfileId: binding.authProfileId,
-						modelProvider: response.modelProvider ?? modelSelection?.modelProvider ?? binding.modelProvider,
-						...agentLookup
-					})
+				if (params.incognito) {
+					if (await params.bindingStore.mutate(identity, {
+						kind: "clear",
+						threadId
+					}) && isolatedSubscriptionClient !== client) {
+						if (!await unsubscribeCodexThreadBestEffort(client, {
+							threadId,
+							timeoutMs: 5e3
+						})) await retireUnsafeCodexTurnClientBestEffort(client, "thread unsubscribe");
+					}
 				}
-			})) throw new Error("Codex conversation binding changed while resuming on a new client.");
-		}
-		const turnCollector = createCodexConversationTurnCollector(threadId);
-		turnRoute = getCodexAppServerTurnRouter(client).reserveThread({
-			threadId,
-			onNotification: turnCollector.handleNotification
-		});
-		turnRoute.armTurn();
-		activeTurnId = (await client.request("turn/start", {
-			threadId,
-			input: buildCodexConversationTurnInput({
-				prompt: params.prompt,
-				event: params.event
-			}),
-			cwd: workspaceDir,
-			...sessionRoot ? { runtimeWorkspaceRoots: [sessionRoot] } : {},
-			approvalPolicy,
-			approvalsReviewer: modelScopedRuntime.approvalsReviewer,
-			...useStickyNetworkProfile ? {} : { sandboxPolicy: codexSandboxPolicyForTurn(sandbox, sessionRoot ?? workspaceDir) },
-			...modelSelection?.model ? { model: modelSelection.model } : {},
-			personality: CODEX_NATIVE_PERSONALITY_NONE,
-			...serviceTier ? { serviceTier } : {}
-		}, { timeoutMs: runtime.requestTimeoutMs })).turn.id;
-		activeTurnCleanup = trackCodexConversationActiveTurn({
-			identity,
-			client,
-			threadId,
-			turnId: activeTurnId
-		});
-		turnCollector.setTurnId(activeTurnId);
-		await turnRoute.bindTurn(activeTurnId);
-		const replyText = (await turnCollector.wait({ timeoutMs: params.timeoutMs ?? DEFAULT_BOUND_TURN_TIMEOUT_MS })).replyText.trim();
-		turnSucceeded = true;
-		return { reply: { text: replyText || "Codex completed without a text reply." } };
-	} catch (error) {
-		if (isCodexAppServerOverloadError(error) && error.method === "thread/resume") throw error;
-		if (error instanceof CodexThreadDirectInputError) {
-			if (params.incognito && ownsNativeSubscription) {
-				if (!await unsubscribeCodexThreadBestEffort(client, {
-					threadId,
-					timeoutMs: 5e3
-				})) await retireUnsafeCodexTurnClientBestEffort(client, "parent-owned thread unsubscribe");
-			}
-			throw error;
-		}
-		if (error instanceof CodexConversationTurnTimeoutError && activeTurnId || turnRoute && isCodexAppServerIndeterminateRequestCancellationError(error)) {
-			if (!await interruptCodexTurnAndWaitBestEffort(client, {
-				threadId,
-				turnId: activeTurnId ?? ""
-			})) {
-				await retireUnsafeCodexTurnClientBestEffort(client, "turn interrupt");
-				isolatedSubscriptionClient = client;
-			}
-		}
-		if (params.incognito) {
-			if (await params.bindingStore.mutate(identity, {
-				kind: "clear",
-				threadId
-			}) && isolatedSubscriptionClient !== client) {
-				if (!await unsubscribeCodexThreadBestEffort(client, {
-					threadId,
-					timeoutMs: 5e3
-				})) await retireUnsafeCodexTurnClientBestEffort(client, "thread unsubscribe");
-			}
-		}
-		throw error;
-	} finally {
-		activeTurnCleanup();
-		turnRoute?.release();
-		try {
-			if (ownsNativeSubscription && isolatedSubscriptionClient !== client && !params.incognito && isCodexAppServerClientRuntimeLive(client)) {
-				const currentLiveThreadOwnership = liveThreadOwnership?.client === client && liveThreadOwnership.threadId === threadId ? liveThreadOwnership.ownership : void 0;
-				let retained = false;
-				if (turnSucceeded) retained = await params.bindingStore.withLease(identity, async () => {
-					const current = await params.bindingStore.read(identity);
-					if (current?.threadId !== threadId || current.clientId !== client.getInstanceId()) return false;
-					return await retainCodexAppServerBindingSubscription(client, threadId, currentLiveThreadOwnership);
-				});
-				if (!retained) {
-					if (!(currentLiveThreadOwnership ? await currentLiveThreadOwnership.release(threadId).then(() => true) : await unsubscribeCodexThreadBestEffort(client, {
+				throw error;
+			} finally {
+				activeTurnCleanup();
+				turnRoute?.release();
+				try {
+					if (ownsNativeSubscription && isolatedSubscriptionClient !== client && !params.incognito && isCodexAppServerClientRuntimeLive(client)) {
+						const currentLiveThreadOwnership = liveThreadOwnership?.client === client && liveThreadOwnership.threadId === threadId ? liveThreadOwnership.ownership : void 0;
+						let retained = false;
+						if (turnSucceeded) retained = await params.bindingStore.withLease(identity, async () => {
+							const latest = await params.bindingStore.read(identity);
+							if (latest?.threadId !== threadId || latest.clientId !== client.getInstanceId()) return false;
+							return await retainCodexAppServerBindingSubscription(client, threadId, currentLiveThreadOwnership);
+						});
+						if (!retained) {
+							if (!(currentLiveThreadOwnership ? await currentLiveThreadOwnership.release(threadId).then(() => true) : await unsubscribeCodexThreadBestEffort(client, {
+								threadId,
+								timeoutMs: 5e3
+							}))) await closeCodexStartupClientBestEffort(client);
+						}
+					}
+				} catch (error) {
+					embeddedAgentLog.warn("codex conversation subscription cleanup failed", {
 						threadId,
-						timeoutMs: 5e3
-					}))) await closeCodexStartupClientBestEffort(client);
+						reason: formatErrorMessage(error)
+					});
+					await closeCodexStartupClientBestEffort(client);
+				} finally {
+					releaseCodexAppServerClientLease(clientLease);
 				}
 			}
-		} catch (error) {
-			embeddedAgentLog.warn("codex conversation subscription cleanup failed", {
-				threadId,
-				reason: formatErrorMessage(error)
-			});
-			await closeCodexStartupClientBestEffort(client);
-		} finally {
-			releaseCodexAppServerClientLease(clientLease);
 		}
-	}
+	});
 }
 function assertNativeConversationApprovalPolicySupported(runtime) {
 	if (runtime.approvalPolicy !== "never" && runtime.approvalsReviewer === "user") throw new Error(NATIVE_CONVERSATION_INTERACTIVE_APPROVALS_UNAVAILABLE);
@@ -1117,8 +1121,10 @@ async function runBoundTurnWithMissingThreadRecovery(params) {
 }
 async function prepareConversationBinding(params, options = {}) {
 	const identity = conversationBindingIdentity(params.data);
-	await params.bindingStore.withLease(identity, async () => {
+	const snapshot = await params.bindingStore.read(identity);
+	const run = () => params.bindingStore.withLease(identity, async () => {
 		const current = await params.bindingStore.read(identity);
+		if (current?.threadId !== snapshot?.threadId || current?.clientId !== snapshot?.clientId) throw new Error("Codex conversation binding changed before preparation.");
 		const requested = params.data.start && current?.conversationStartId !== params.data.start.id ? params.data.start : void 0;
 		if (current && !requested && !options.forceNew) return;
 		const sourceIdentity = params.data.source ? sessionBindingIdentity({
@@ -1152,11 +1158,7 @@ async function prepareConversationBinding(params, options = {}) {
 			agentId: params.data.source?.agentId ?? params.data.agentId
 		};
 		const threadId = requested?.threadId;
-		if (threadId && !options.forceNew) await attachExistingThread({
-			...bindingParams,
-			threadId
-		});
-		else await bindThread(bindingParams);
+		await bindThread(bindingParams, options.forceNew ? void 0 : threadId);
 		const stored = await params.bindingStore.read(identity);
 		if (!stored) throw new Error("Codex conversation binding disappeared while initializing its thread.");
 		if (sourceIdentity && params.data.source && !current?.conversationSourceTransferComplete) await params.bindingStore.withLease(sourceIdentity, async () => {
@@ -1187,6 +1189,14 @@ async function prepareConversationBinding(params, options = {}) {
 			}
 		})) throw new Error("Codex conversation binding changed while initializing its thread.");
 	});
+	const threadId = params.data.start?.threadId ?? snapshot?.threadId;
+	if (threadId) await withExclusiveCodexAppServerThread({
+		bindingStore: params.bindingStore,
+		identity,
+		threadId,
+		run
+	});
+	else await run();
 }
 async function projectConversationSourceHistory(source, target, config) {
 	const storePath = resolveStorePath(config?.session?.store, { agentId: source.agentId });
@@ -3267,7 +3277,7 @@ function createCodexNodeExecServerCommand() {
 			try {
 				if (!context.prepareExecAuthorization) throw new Error("Codex node execution requires node-local exec policy support; update the node.");
 				const assertExecAuthorized = context.prepareExecAuthorization(request.authorization);
-				const { runCodexNodeExecServer } = await import("./node-exec-server.runtime-DirKVZ5h.js");
+				const { runCodexNodeExecServer } = await import("./node-exec-server.runtime-CstNHCmC.js");
 				return await runCodexNodeExecServer({
 					workspaceDir: workspace.workspaceDir,
 					io,
@@ -3292,6 +3302,10 @@ function createCodexNodeExecServerInvokePolicy() {
 	return {
 		commands: [CODEX_NODE_EXEC_SERVER_COMMAND],
 		dangerous: true,
+		standingApproval: {
+			kind: "placement",
+			scope: CODEX_NODE_EXEC_SERVER_CAPABILITY
+		},
 		classifyRisk: () => ({
 			level: "high",
 			family: CODEX_NODE_EXEC_SERVER_CAPABILITY
@@ -3334,21 +3348,16 @@ function createCodexNodeExecServerInvokePolicy() {
 			};
 			const nodeName = context.node?.displayName ?? context.nodeId;
 			const approval = await context.approvals.request({
-				title: "Run Codex execution on node",
-				description: `Allows arbitrary processes and filesystem access across the node account, not only this workspace. ${nodeName}: ${placement.cwd}`,
+				title: "Run Codex on this node placement",
+				description: `Allows arbitrary processes and filesystem access across the node account, not only this workspace. Allow always applies only while this exact placement remains active. ${nodeName}: ${placement.cwd}`,
 				severity: "critical",
-				allowedDecisions: ["allow-once"]
+				allowedDecisions: ["allow-once", "allow-always"]
 			});
-			if (approval.decision !== "allow-once") {
+			if (approval.decision !== "allow-once" && approval.decision !== "allow-always") {
 				if (approval.decision === "deny") return {
 					ok: false,
 					code: "CODEX_NODE_EXEC_APPROVAL_DENIED",
-					message: "Codex node execution was denied. Retry the action and choose Allow once to continue."
-				};
-				if (approval.decision === "allow-always") return {
-					ok: false,
-					code: "CODEX_NODE_EXEC_APPROVAL_INVALID",
-					message: "Codex node execution cannot use permanent approval. Retry the action and choose Allow once."
+					message: "Codex node execution was denied. Retry the action and choose Allow once or Allow always to continue."
 				};
 				return {
 					ok: false,
@@ -4148,7 +4157,7 @@ function createCodexSupervisionTools(options) {
 }
 //#endregion
 //#region extensions/codex/src/web-search-provider.ts
-const loadCodexWebSearchRuntime = createLazyRuntimeModule(() => import("./web-search-provider.runtime-BEmlE7ov.js"));
+const loadCodexWebSearchRuntime = createLazyRuntimeModule(() => import("./web-search-provider.runtime-D2FWSK4w.js"));
 const CodexWebSearchSchema = {
 	type: "object",
 	properties: { query: {
@@ -4190,6 +4199,7 @@ var codex_default = definePluginEntry({
 	id: "codex",
 	name: "Codex",
 	description: "Codex app-server harness and native session supervision.",
+	reload: { noopPrefixes: ["plugins.entries.codex.config.codexPlugins"] },
 	register(api) {
 		setManagedCodexPluginRoot(api.rootDir);
 		const resolveCurrentConfig = () => api.runtime.config?.current ? api.runtime.config.current() : void 0;
@@ -4383,7 +4393,7 @@ var codex_default = definePluginEntry({
 			if (!previousSessionId || !sessionId || previousSessionId === sessionId) return;
 			const config = resolveCurrentConfig();
 			const sessionKey = ctx.sessionKey?.trim();
-			const { sessionBindingIdentity } = await import("./session-binding-D0zinCP1.js").then((n) => n.f);
+			const { sessionBindingIdentity } = await import("./session-binding-BHuTCRZQ.js").then((n) => n.f);
 			const identity = sessionBindingIdentity({
 				sessionId,
 				...sessionKey ? { sessionKey } : {},
@@ -4401,7 +4411,7 @@ var codex_default = definePluginEntry({
 			if (endedSessionKey && nextSessionKey && nextSessionKey !== endedSessionKey) return;
 			if (event.nextSessionId?.trim() === event.sessionId.trim()) return;
 			const config = resolveCurrentConfig();
-			const [{ sessionBindingIdentity }, { retireCodexAppServerSessionGeneration }] = await Promise.all([import("./session-binding-D0zinCP1.js").then((n) => n.f), import("./session-retirement-CtUtUTr9.js")]);
+			const [{ sessionBindingIdentity }, { retireCodexAppServerSessionGeneration }] = await Promise.all([import("./session-binding-BHuTCRZQ.js").then((n) => n.f), import("./session-retirement-BujDjXVF.js")]);
 			await retireCodexAppServerSessionGeneration({
 				bindingStore,
 				identity: sessionBindingIdentity({