@openclaw/codex 2026.9.1-beta.1 → 2026.9.2

package/dist/{transcript-mirror-DsCMWBca.js → transcript-mirror-_njEB84z.js}

@@ -1,15 +1,32 @@
-import { i as readUpstreamUserText, n as attachUpstreamUserText, r as readMirrorIdentity, t as attachCodexMirrorIdentity } from "./upstream-prompt-provenance-CFmsKwr9.js";
-import { asOptionalRecord, normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
-import { deliverAgentHarnessUserInputPrompt, embeddedAgentLog, formatErrorMessage, projectAgentHarnessTranscriptMessageForDisplay, runAgentHarnessBeforeMessageWriteHook } from "openclaw/plugin-sdk/agent-harness-runtime";
+import { i as readUpstreamUserText, n as attachUpstreamUserText, r as readMirrorIdentity, t as attachCodexMirrorIdentity } from "./upstream-prompt-provenance-LphB8slG.js";
+import { i as fingerprintCodexMirrorSourceMessage, n as attachCodexMirrorAttestation, o as readCodexMirrorSourceFingerprint, r as attachCodexMirrorRunId } from "./transcript-mirror-attestation-Byl34PC-.js";
+import { normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { createHash } from "node:crypto";
+import path from "node:path";
+import { deliverAgentHarnessUserInputPrompt, embeddedAgentLog, formatErrorMessage, projectAgentHarnessTranscriptMessageForDisplay, restorePreparedUserTurnOperationalMetaForRuntime, runAgentHarnessBeforeMessageWriteHook } from "openclaw/plugin-sdk/agent-harness-runtime";
+import fsSync from "node:fs";
 import { truncateUtf8Prefix } from "openclaw/plugin-sdk/text-utility-runtime";
 import { withCodexSessionTranscriptMirrorWriteLock } from "openclaw/plugin-sdk/codex-session-transcript-runtime";
 import { publishSessionTranscriptUpdateByIdentity } from "openclaw/plugin-sdk/session-transcript-runtime";
 import { Buffer } from "node:buffer";
+//#region extensions/codex/src/session-catalog-home-id.ts
+function canonicalCodexCatalogHome(value) {
+	const resolved = path.resolve(value);
+	try {
+		return fsSync.realpathSync.native(resolved);
+	} catch {
+		return resolved;
+	}
+}
+/** One canonical identity for catalog discovery and durable ownership rows. */
+function codexCatalogHomeId(codexHome) {
+	return createHash("sha256").update("openclaw:codex-session-catalog-home:v1\0").update(canonicalCodexCatalogHome(codexHome)).digest("hex");
+}
+//#endregion
 //#region extensions/codex/src/app-server/transcript-history-projection.ts
 const CODEX_HISTORY_IMPORT_MAX_MESSAGES = 200;
-const CODEX_HISTORY_IMPORT_MAX_BYTES = 512 * 1024;
-const CODEX_HISTORY_IMPORT_MAX_MESSAGE_BYTES = 64 * 1024;
+const CODEX_HISTORY_IMPORT_MAX_BYTES = 524288;
+const CODEX_HISTORY_IMPORT_MAX_MESSAGE_BYTES = 65536;
 const CODEX_HISTORY_TRUNCATION_SUFFIX = "\n\n[Message truncated during Codex history import.]";
 const CODEX_HISTORY_ASSISTANT_API = "openai-chatgpt-responses";
 const CODEX_HISTORY_ASSISTANT_PROVIDER = "openai";
@@ -34,7 +51,8 @@ function normalizeImportedHistoryText(value) {
 	if (!text) return;
 	if (Buffer.byteLength(text, "utf8") <= CODEX_HISTORY_IMPORT_MAX_MESSAGE_BYTES) return text;
 	const suffixBytes = Buffer.byteLength(CODEX_HISTORY_TRUNCATION_SUFFIX, "utf8");
-	return `${truncateUtf8Prefix(text, Math.max(0, CODEX_HISTORY_IMPORT_MAX_MESSAGE_BYTES - suffixBytes))}${CODEX_HISTORY_TRUNCATION_SUFFIX}`;
+	const contentLimitBytes = Math.max(0, CODEX_HISTORY_IMPORT_MAX_MESSAGE_BYTES - suffixBytes);
+	return `${truncateUtf8Prefix(text, contentLimitBytes)}${CODEX_HISTORY_TRUNCATION_SUFFIX}`;
 }
 function projectCodexUserItemText(item) {
 	if (!Array.isArray(item.content)) return;
@@ -173,57 +191,6 @@ function projectBoundedCodexVisibleSessionHistory(entries) {
 	return selectBoundedCodexHistoryTail(projected).map(({ responseItem }) => responseItem);
 }
 //#endregion
-//#region extensions/codex/src/app-server/transcript-mirror-attestation.ts
-const MIRROR_ORIGIN_META_KEY = "mirrorOrigin";
-const MIRROR_SOURCE_FINGERPRINT_META_KEY = "mirrorSourceFingerprint";
-const CODEX_APP_SERVER_MIRROR_ORIGIN = "codex-app-server";
-const CODEX_META_KEY = "__openclaw";
-function attachCodexMirrorAttestation(message, sourceFingerprint) {
-	const existing = CODEX_META_KEY in message ? message[CODEX_META_KEY] : void 0;
-	const baseMeta = existing && typeof existing === "object" && !Array.isArray(existing) ? existing : {};
-	return {
-		...message,
-		[CODEX_META_KEY]: {
-			...baseMeta,
-			[MIRROR_ORIGIN_META_KEY]: CODEX_APP_SERVER_MIRROR_ORIGIN,
-			...sourceFingerprint ? { [MIRROR_SOURCE_FINGERPRINT_META_KEY]: sourceFingerprint } : {}
-		}
-	};
-}
-function attachCodexMirrorRunId(message, runId, terminal = false) {
-	const { runTerminal: _staleTerminal, ...current } = asOptionalRecord(CODEX_META_KEY in message ? message[CODEX_META_KEY] : void 0) ?? {};
-	return {
-		...message,
-		[CODEX_META_KEY]: {
-			...current,
-			runId,
-			...terminal ? { runTerminal: true } : {}
-		}
-	};
-}
-function readCodexMirrorSourceFingerprint(message) {
-	const meta = CODEX_META_KEY in message ? message[CODEX_META_KEY] : void 0;
-	if (!meta || typeof meta !== "object" || Array.isArray(meta)) return;
-	const value = meta[MIRROR_SOURCE_FINGERPRINT_META_KEY];
-	return typeof value === "string" && value ? value : void 0;
-}
-function serializeCodexMirrorSourceEvidence(message) {
-	const content = "content" in message ? message.content : void 0;
-	return JSON.stringify({
-		role: message.role,
-		content,
-		...message.role === "user" ? { upstreamUserText: readUpstreamUserText(message) } : {},
-		...message.role === "toolResult" ? {
-			toolCallId: message.toolCallId,
-			toolName: message.toolName,
-			isError: message.isError
-		} : {}
-	});
-}
-function fingerprintCodexMirrorSourceMessage(message) {
-	return createHash("sha256").update(serializeCodexMirrorSourceEvidence(message)).digest("hex").slice(0, 32);
-}
-//#endregion
 //#region extensions/codex/src/app-server/user-prompt-message.ts
 function buildSenderLabel(params) {
 	const label = params.senderName ?? params.senderUsername ?? params.senderE164 ?? params.senderId;
@@ -268,6 +235,18 @@ function promptSnapshot(params, turnId, upstreamUserText) {
 async function buildResolvedCodexUserPromptMessage(params) {
 	return buildFromPrepared(params, await params.userTurnTranscriptRecorder?.resolveMessage() ?? params.userTurnTranscriptRecorder?.message);
 }
+async function resolveFinalCodexMirrorMessages(params) {
+	if (params.params.suppressNextUserMessagePersistence || !params.params.userTurnTranscriptRecorder) return params.messagesSnapshot;
+	const previousPrompt = params.messagesSnapshot.find((message) => message.role === "user");
+	const resolvedBase = attachCodexMirrorIdentity(await buildResolvedCodexUserPromptMessage(params.params), `${params.turnId}:prompt`);
+	const upstreamUserText = readUpstreamUserText(previousPrompt);
+	const resolvedPrompt = upstreamUserText ? attachUpstreamUserText(resolvedBase, upstreamUserText) : resolvedBase;
+	const firstUserIndex = params.messagesSnapshot.findIndex((message) => message.role === "user");
+	if (firstUserIndex === -1) return [resolvedPrompt, ...params.messagesSnapshot];
+	const messages = params.messagesSnapshot.slice();
+	messages[firstUserIndex] = resolvedPrompt;
+	return messages;
+}
 //#endregion
 //#region extensions/codex/src/app-server/transcript-mirror.ts
 function isMirroredAgentMessage(message) {
@@ -279,25 +258,26 @@ function readMirroredAssistantText(message) {
 }
 /** Imports a bounded, user-visible Codex history tail into a new OpenClaw transcript. */
 async function importCodexThreadHistoryToTranscript(params) {
-	const projection = projectBoundedCodexThreadHistory({
+	const { transcriptMessages, importedMessages, omittedMessages } = projectBoundedCodexThreadHistory({
 		thread: params.thread,
 		throughTurnId: params.throughTurnId,
 		importedAt: Date.now(),
 		...params.modelProvider ? { modelProvider: params.modelProvider } : {}
 	});
-	if (projection.transcriptMessages.length > 0) await mirror({
+	if (transcriptMessages.length > 0) await mirror({
+		assertCurrent: params.assertCurrent,
 		storePath: params.storePath,
 		sessionId: params.sessionId,
 		sessionKey: params.sessionKey,
 		...params.agentId ? { agentId: params.agentId } : {},
 		...params.cwd ? { cwd: params.cwd } : {},
 		...params.config ? { config: params.config } : {},
-		messages: projection.transcriptMessages,
+		messages: transcriptMessages,
 		idempotencyScope: `codex-app-server:${params.thread.id}:history`
 	});
 	return {
-		importedMessages: projection.importedMessages,
-		omittedMessages: projection.omittedMessages
+		importedMessages,
+		omittedMessages
 	};
 }
 async function mirrorBestEffort(params) {
@@ -311,7 +291,9 @@ async function mirrorBestEffort(params) {
 			messagesSnapshot: params.result.messagesSnapshot,
 			turnId: params.turnId
 		});
+		params.assertWriteCurrent?.();
 		const mirrorResult = await mirror({
+			assertWriteCurrent: params.assertWriteCurrent,
 			agentId: params.agentId,
 			sessionKey: params.sessionKey,
 			sessionId: params.params.sessionId,
@@ -325,10 +307,11 @@ async function mirrorBestEffort(params) {
 				mirrorIdentity: `${params.turnId}:assistant`,
 				runId: params.params.runId
 			},
+			prepareAssistantTranscriptMessage: params.params.prepareAssistantTranscriptMessage,
 			config: params.params.config
 		});
 		for (const receipt of mirrorResult.userMessageReceipts) try {
-			params.notifyUserMessagePersisted(receipt.message, receipt.anchor);
+			params.notifyUserMessagePersisted(receipt);
 		} catch (error) {
 			embeddedAgentLog.warn("failed to notify codex app-server user-message persistence", { error: formatErrorMessage(error) });
 		}
@@ -366,26 +349,14 @@ async function mirrorBestEffort(params) {
 		};
 	}
 }
-async function resolveFinalCodexMirrorMessages(params) {
-	if (params.params.suppressNextUserMessagePersistence || !params.params.userTurnTranscriptRecorder) return params.messagesSnapshot;
-	const promptSnapshot = params.messagesSnapshot.find((message) => message.role === "user");
-	const resolvedBase = attachCodexMirrorIdentity(await buildResolvedCodexUserPromptMessage(params.params), `${params.turnId}:prompt`);
-	const upstreamUserText = readUpstreamUserText(promptSnapshot);
-	const resolvedPrompt = upstreamUserText ? attachUpstreamUserText(resolvedBase, upstreamUserText) : resolvedBase;
-	const firstUserIndex = params.messagesSnapshot.findIndex((message) => message.role === "user");
-	if (firstUserIndex === -1) return [resolvedPrompt, ...params.messagesSnapshot];
-	const messages = params.messagesSnapshot.slice();
-	messages[firstUserIndex] = resolvedPrompt;
-	return messages;
-}
 function createCodexAppServerUserMessagePersistenceNotifier(runParams) {
 	let notified = false;
-	return (message, anchor) => {
+	return (receipt) => {
 		if (notified) return;
 		notified = true;
-		runParams.userTurnTranscriptRecorder?.markRuntimePersisted(message, anchor);
+		runParams.userTurnTranscriptRecorder?.markRuntimePersisted(receipt.message, receipt.anchor, receipt);
 		try {
-			runParams.onUserMessagePersisted?.(message);
+			runParams.onUserMessagePersisted?.(receipt.message);
 		} catch (error) {
 			embeddedAgentLog.warn("codex app-server user persistence notification failed", { error: formatErrorMessage(error) });
 		}
@@ -399,7 +370,19 @@ async function mirrorPromptAtTurnStartBestEffort(params) {
 				hidden: params.params.trigger === "memory",
 				message: attachUpstreamUserText(attachCodexMirrorIdentity(await buildResolvedCodexUserPromptMessage(params.params), `${params.turnId}:prompt`), params.upstreamUserText)
 			});
+			const recorder = params.params.userTurnTranscriptRecorder;
+			if (recorder?.getAdmissionReceipt() && recorder.getPersistedMessage?.()?.display !== false) {
+				const annotate = params.params.hostCapabilities.annotateCurrentUserTurn;
+				if (!annotate || userPromptMessage.role !== "user") throw new Error("current host admission is unavailable for native prompt annotation");
+				await annotate({
+					mirrorIdentity: `${params.turnId}:prompt`,
+					upstreamUserText: params.upstreamUserText,
+					mirrorOrigin: "codex-app-server",
+					mirrorSourceFingerprint: fingerprintCodexMirrorSourceMessage(userPromptMessage)
+				});
+			}
 			const mirrorResult = await mirror({
+				assertCurrent: params.params.hostCapabilities.assertActive,
 				agentId: params.agentId,
 				sessionKey: params.sessionKey,
 				sessionId: params.params.sessionId,
@@ -411,7 +394,7 @@ async function mirrorPromptAtTurnStartBestEffort(params) {
 				runMirrorIdentityPrefix: `${params.turnId}:`,
 				config: params.params.config
 			});
-			for (const receipt of mirrorResult.userMessageReceipts) params.notifyUserMessagePersisted(receipt.message, receipt.anchor);
+			for (const receipt of mirrorResult.userMessageReceipts) params.notifyUserMessagePersisted(receipt);
 		})();
 		params.params.userTurnTranscriptRecorder?.markRuntimePersistencePending(mirrorPromise);
 		await mirrorPromise;
@@ -431,9 +414,7 @@ function fingerprintMirrorMessageContent(message) {
 	return createHash("sha256").update(payload).digest("hex").slice(0, 16);
 }
 function buildMirrorDedupeIdentity(message) {
-	const explicit = readMirrorIdentity(message);
-	if (explicit) return explicit;
-	return `${message.role}:${fingerprintMirrorMessageContent(message)}`;
+	return readMirrorIdentity(message) || `${message.role}:${fingerprintMirrorMessageContent(message)}`;
 }
 async function mirror(params) {
 	const messages = params.messages.filter(isMirroredAgentMessage);
@@ -442,8 +423,7 @@ async function mirror(params) {
 		assistantMirrorIdentitiesOwned: [],
 		anchorsByMirrorIdentity: /* @__PURE__ */ new Map(),
 		messagesPresent: [],
-		userMessageReceipts: [],
-		userMessagesPresent: []
+		userMessageReceipts: []
 	};
 	const candidates = messages.map((message) => {
 		const dedupeIdentity = buildMirrorDedupeIdentity(message);
@@ -457,25 +437,32 @@ async function mirror(params) {
 	});
 	const candidateIdempotencyKeys = candidates.flatMap(({ idempotencyKey }) => idempotencyKey ? [idempotencyKey] : []);
 	const transcriptTarget = resolveCodexMirrorTranscriptTarget(params);
-	const { appendedUpdates, assistantMirrorIdentitiesAppended, assistantMirrorIdentitiesOwned, anchorsByMirrorIdentity, messagesPresent, userMessageReceipts, userMessagesPresent } = await withCodexSessionTranscriptMirrorWriteLock({
+	const assertWritable = () => {
+		params.assertCurrent?.();
+		params.assertWriteCurrent?.();
+	};
+	assertWritable();
+	const mirrorBatch = await withCodexSessionTranscriptMirrorWriteLock({
 		...transcriptTarget,
 		config: params.config
 	}, async (transcript) => {
+		assertWritable();
 		const nextAppendedUpdates = [];
 		const nextAssistantMirrorIdentitiesAppended = /* @__PURE__ */ new Set();
 		const nextAssistantMirrorIdentitiesOwned = /* @__PURE__ */ new Set();
 		const nextAnchorsByMirrorIdentity = /* @__PURE__ */ new Map();
 		const nextMessagesPresent = [];
 		const nextUserMessageReceipts = [];
-		const nextUserMessagesPresent = [];
 		const mirrorFacts = await transcript.readMessageFacts({ idempotencyKeys: candidateIdempotencyKeys });
+		assertWritable();
 		for (const { dedupeIdentity, idempotencyKey, message, sourceFingerprint } of candidates) {
 			const mirrorIdentity = readMirrorIdentity(message);
 			const ownsRun = Boolean(params.runId && (!params.runMirrorIdentityPrefix || mirrorIdentity?.startsWith(params.runMirrorIdentityPrefix)));
 			const terminalOwner = params.terminalAssistantOwner;
 			const ownsTerminal = Boolean(ownsRun && terminalOwner && mirrorIdentity === terminalOwner.mirrorIdentity);
+			const ownedMessage = ownsRun && params.runId ? attachCodexMirrorRunId(message, params.runId, ownsTerminal) : message;
 			const transcriptMessage = {
-				...attachCodexMirrorAttestation(ownsRun && params.runId ? attachCodexMirrorRunId(message, params.runId, ownsTerminal) : message, sourceFingerprint),
+				...attachCodexMirrorAttestation(ownedMessage, sourceFingerprint),
 				...idempotencyKey ? { idempotencyKey } : {}
 			};
 			if (idempotencyKey && mirrorFacts.existingIdempotencyKeys.has(idempotencyKey)) {
@@ -483,31 +470,44 @@ async function mirror(params) {
 				const persistedAnchor = mirrorFacts.anchorsByIdempotencyKey.get(idempotencyKey);
 				if (persistedMessage && isMirroredAgentMessage(persistedMessage)) {
 					nextMessagesPresent.push(persistedMessage);
-					if (persistedMessage.role === "user") {
-						nextUserMessagesPresent.push(persistedMessage);
-						if (persistedAnchor) nextUserMessageReceipts.push({
-							anchor: persistedAnchor,
-							message: persistedMessage
-						});
-					}
+					if (persistedMessage.role === "user" && persistedAnchor) nextUserMessageReceipts.push({
+						anchor: persistedAnchor,
+						appended: false,
+						message: persistedMessage
+					});
 				}
 				if (persistedAnchor) nextAnchorsByMirrorIdentity.set(dedupeIdentity, persistedAnchor);
 				if (message.role === "assistant") nextAssistantMirrorIdentitiesOwned.add(dedupeIdentity);
 				continue;
 			}
-			const nextMessage = params.skipBeforeMessageWriteHooks ? transcriptMessage : runAgentHarnessBeforeMessageWriteHook({
+			assertWritable();
+			const preparedUserMessage = transcriptMessage.role === "user" ? {
+				...transcriptMessage,
+				__openclaw: { ...Reflect.get(transcriptMessage, "__openclaw") }
+			} : void 0;
+			if (preparedUserMessage?.["__openclaw"].humanMentions !== void 0) {
+				preparedUserMessage.content = structuredClone(preparedUserMessage.content);
+				preparedUserMessage["__openclaw"].humanMentions = structuredClone(preparedUserMessage["__openclaw"].humanMentions);
+			}
+			const nextMessage = runAgentHarnessBeforeMessageWriteHook({
 				message: transcriptMessage,
 				agentId: params.agentId,
-				sessionKey: params.sessionKey
+				sessionKey: params.sessionKey,
+				skipBeforeMessageWriteHooks: params.skipBeforeMessageWriteHooks,
+				prepareAssistantTranscriptMessage: ownsTerminal ? params.prepareAssistantTranscriptMessage : void 0
 			});
 			if (!nextMessage) {
 				if (message.role === "assistant") nextAssistantMirrorIdentitiesOwned.add(dedupeIdentity);
 				continue;
 			}
+			const restoredMessage = restorePreparedUserTurnOperationalMetaForRuntime({
+				runtimeMessage: nextMessage,
+				preparedMessage: preparedUserMessage
+			});
 			let messageToAppend = idempotencyKey ? {
-				...attachCodexMirrorAttestation(nextMessage, sourceFingerprint),
+				...attachCodexMirrorAttestation(restoredMessage, sourceFingerprint),
 				idempotencyKey
-			} : attachCodexMirrorAttestation(nextMessage, sourceFingerprint);
+			} : attachCodexMirrorAttestation(restoredMessage, sourceFingerprint);
 			if (mirrorIdentity) messageToAppend = attachCodexMirrorIdentity(messageToAppend, mirrorIdentity);
 			if (ownsRun && params.runId) messageToAppend = attachCodexMirrorRunId(messageToAppend, params.runId, ownsTerminal);
 			if (message.role === "assistant" && message.openclawAsyncDelivery) messageToAppend = Object.assign(messageToAppend, { openclawAsyncDelivery: { itemId: message.openclawAsyncDelivery.itemId } });
@@ -515,11 +515,17 @@ async function mirror(params) {
 				hidden: message.display === false,
 				message: messageToAppend
 			});
+			assertWritable();
 			const { messageSeq, result: appended } = await transcript.appendMessageWithMessageSequence({
 				message: messageToAppend,
+				...params.assertCurrent || params.assertWriteCurrent ? { prepareMessageAfterIdempotencyCheck: (preparedMessage) => {
+					assertWritable();
+					return preparedMessage;
+				} } : {},
 				idempotencyLookup: "scan",
 				cwd: params.cwd
 			});
+			params.assertCurrent?.();
 			if (!appended) continue;
 			const { messageId, message: appendedMessage } = appended;
 			if (isMirroredAgentMessage(appendedMessage)) {
@@ -528,13 +534,11 @@ async function mirror(params) {
 			}
 			if (message.role === "assistant") nextAssistantMirrorIdentitiesOwned.add(dedupeIdentity);
 			if (appended.anchor) nextAnchorsByMirrorIdentity.set(dedupeIdentity, appended.anchor);
-			if (appendedMessage.role === "user" && appended.anchor) {
-				nextUserMessagesPresent.push(appendedMessage);
-				nextUserMessageReceipts.push({
-					anchor: appended.anchor,
-					message: appendedMessage
-				});
-			}
+			if (appendedMessage.role === "user" && appended.anchor) nextUserMessageReceipts.push({
+				anchor: appended.anchor,
+				appended: appended.appended,
+				message: appendedMessage
+			});
 			if (appended.appended) {
 				if (message.role === "assistant") nextAssistantMirrorIdentitiesAppended.add(dedupeIdentity);
 				nextAppendedUpdates.push({
@@ -554,10 +558,11 @@ async function mirror(params) {
 			assistantMirrorIdentitiesOwned: [...nextAssistantMirrorIdentitiesOwned],
 			anchorsByMirrorIdentity: nextAnchorsByMirrorIdentity,
 			messagesPresent: nextMessagesPresent,
-			userMessageReceipts: nextUserMessageReceipts,
-			userMessagesPresent: nextUserMessagesPresent
+			userMessageReceipts: nextUserMessageReceipts
 		};
 	});
+	params.assertCurrent?.();
+	const { appendedUpdates, assistantMirrorIdentitiesAppended, assistantMirrorIdentitiesOwned, anchorsByMirrorIdentity, messagesPresent, userMessageReceipts } = mirrorBatch;
 	for (const update of appendedUpdates) try {
 		const terminalOwner = params.terminalAssistantOwner;
 		const terminalRunId = update.message.role === "assistant" && terminalOwner && readMirrorIdentity(update.message) === terminalOwner.mirrorIdentity ? terminalOwner.runId : void 0;
@@ -580,8 +585,7 @@ async function mirror(params) {
 		assistantMirrorIdentitiesOwned,
 		anchorsByMirrorIdentity,
 		messagesPresent,
-		userMessageReceipts,
-		userMessagesPresent
+		userMessageReceipts
 	};
 }
 async function deliverAsyncMessageBestEffort(params) {
@@ -666,4 +670,4 @@ function resolveCodexMirrorTranscriptTarget(params) {
 	};
 }
 //#endregion
-export { buildCodexUserPromptMessage as a, readCodexMirrorSourceFingerprint as c, projectBoundedCodexVisibleSessionHistory as d, mirrorPromptAtTurnStartBestEffort as i, serializeCodexMirrorSourceEvidence as l, createCodexAppServerUserMessagePersistenceNotifier as n, promptSnapshot as o, importCodexThreadHistoryToTranscript as r, fingerprintCodexMirrorSourceMessage as s, codexTranscriptMirrorRuntime as t, projectBoundedCodexThreadHistory as u };
+export { buildCodexUserPromptMessage as a, projectBoundedCodexVisibleSessionHistory as c, codexCatalogHomeId as d, mirrorPromptAtTurnStartBestEffort as i, projectCodexUserItemText as l, createCodexAppServerUserMessagePersistenceNotifier as n, promptSnapshot as o, importCodexThreadHistoryToTranscript as r, projectBoundedCodexThreadHistory as s, codexTranscriptMirrorRuntime as t, canonicalCodexCatalogHome as u };

package/dist/transcript-mirror-attestation-Byl34PC-.js

@@ -0,0 +1,76 @@
+import { i as readUpstreamUserText } from "./upstream-prompt-provenance-LphB8slG.js";
+import { asOptionalRecord } from "openclaw/plugin-sdk/string-coerce-runtime";
+import { createHash } from "node:crypto";
+//#region extensions/codex/src/app-server/transcript-mirror-attestation.ts
+const MIRROR_ORIGIN_META_KEY = "mirrorOrigin";
+const MIRROR_SOURCE_FINGERPRINT_META_KEY = "mirrorSourceFingerprint";
+const CODEX_APP_SERVER_MIRROR_ORIGIN = "codex-app-server";
+const CODEX_META_KEY = "__openclaw";
+function applyCodexTranscriptTaint(message, state) {
+	if (message.role === "user") {
+		state.tainted = false;
+		return message;
+	}
+	const existing = CODEX_META_KEY in message ? message[CODEX_META_KEY] : void 0;
+	const metadata = asOptionalRecord(existing);
+	state.tainted ||= metadata?.turnTainted === true || metadata?.resultContentSource === "network";
+	return message.role === "assistant" && state.tainted ? {
+		...message,
+		__openclaw: {
+			...metadata,
+			turnTainted: true
+		}
+	} : message;
+}
+function attachCodexMirrorAttestation(message, sourceFingerprint) {
+	const existing = CODEX_META_KEY in message ? message[CODEX_META_KEY] : void 0;
+	const baseMeta = existing && typeof existing === "object" && !Array.isArray(existing) ? existing : {};
+	return {
+		...message,
+		[CODEX_META_KEY]: {
+			...baseMeta,
+			[MIRROR_ORIGIN_META_KEY]: CODEX_APP_SERVER_MIRROR_ORIGIN,
+			...sourceFingerprint ? { [MIRROR_SOURCE_FINGERPRINT_META_KEY]: sourceFingerprint } : {}
+		}
+	};
+}
+function attachCodexMirrorRunId(message, runId, terminal = false) {
+	const existing = CODEX_META_KEY in message ? message[CODEX_META_KEY] : void 0;
+	const { runTerminal: _staleTerminal, ...current } = asOptionalRecord(existing) ?? {};
+	return {
+		...message,
+		[CODEX_META_KEY]: {
+			...current,
+			runId,
+			...terminal ? { runTerminal: true } : {}
+		}
+	};
+}
+function hasCodexMirrorOrigin(message) {
+	const meta = CODEX_META_KEY in message ? message[CODEX_META_KEY] : void 0;
+	return asOptionalRecord(meta)?.[MIRROR_ORIGIN_META_KEY] === CODEX_APP_SERVER_MIRROR_ORIGIN;
+}
+function readCodexMirrorSourceFingerprint(message) {
+	const meta = CODEX_META_KEY in message ? message[CODEX_META_KEY] : void 0;
+	if (!meta || typeof meta !== "object" || Array.isArray(meta)) return;
+	const value = meta[MIRROR_SOURCE_FINGERPRINT_META_KEY];
+	return typeof value === "string" && value ? value : void 0;
+}
+function serializeCodexMirrorSourceEvidence(message) {
+	const content = "content" in message ? message.content : void 0;
+	return JSON.stringify({
+		role: message.role,
+		content,
+		...message.role === "user" ? { upstreamUserText: readUpstreamUserText(message) } : {},
+		...message.role === "toolResult" ? {
+			toolCallId: message.toolCallId,
+			toolName: message.toolName,
+			isError: message.isError
+		} : {}
+	});
+}
+function fingerprintCodexMirrorSourceMessage(message) {
+	return createHash("sha256").update(serializeCodexMirrorSourceEvidence(message)).digest("hex").slice(0, 32);
+}
+//#endregion
+export { hasCodexMirrorOrigin as a, fingerprintCodexMirrorSourceMessage as i, attachCodexMirrorAttestation as n, readCodexMirrorSourceFingerprint as o, attachCodexMirrorRunId as r, serializeCodexMirrorSourceEvidence as s, applyCodexTranscriptTaint as t };