@openclaw/codex 2026.9.1 → 2026.9.2

package/dist/{shared-client-DxcfF9KX.js → shared-client-CKhX2kFt.js}

@@ -1,19 +1,19 @@
 import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
-import { t as isCodexAppServerProxyLaunch } from "./launch-args-RXQwn8zV.js";
-import { F as resolveCodexAppServerHomeDir, I as resolveCodexAppServerLocalHomeDir, L as resolveCodexAppServerUserHomeDir, R as withEphemeralCodexAuthStore, a as resolveCodexAppServerStartOptionsForAgent, i as resolveCodexAppServerRuntimeOptions, o as resolveCodexComputerUseConfig, t as codexAppServerStartOptionsKey } from "./config-BhmfC1s6.js";
-import { c as resolveFirstExistingMacOSDesktopCodexBundledMarketplacePath, d as resolveMacOSDesktopCodexComputerUseServiceAppCandidates, l as resolveMacOSDesktopCodexAppPathCandidates, n as resolveManagedCodexAppServerStartOptions, o as CODEX_APP_SERVER_VERSION, r as resolveManagedCodexNativeCommand, s as MIN_SUPPORTED_CODEX_APP_SERVER_VERSION, t as isManagedCodexDesktopCommand, u as resolveMacOSDesktopCodexBundledMarketplaceCandidates } from "./managed-binary-4-Vjz5GH.js";
-import { o as isCodexAppServerNativeAuthProfile } from "./session-binding-BHuTCRZQ.js";
-import { a as hasCodexAppServerNaturalExit, i as closeCodexAppServerTransportAndWait, n as resolveCodexAppServerSpawnEnv, r as closeCodexAppServerTransport, t as createStdioTransport } from "./transport-stdio-CyPldczm.js";
+import { B as isJsonObject, F as withEphemeralCodexAuthStore, M as resolveCodexAppServerHomeDir, N as resolveCodexAppServerLocalHomeDir, P as resolveCodexAppServerUserHomeDir, V as isRpcResponse, a as resolveCodexAppServerStartOptionsForAgent, i as resolveCodexAppServerRuntimeOptions, o as resolveCodexComputerUseConfig, t as codexAppServerStartOptionsKey } from "./config-CyapYSji.js";
+import { c as resolveFirstExistingMacOSDesktopCodexBundledMarketplacePath, d as resolveMacOSDesktopCodexComputerUseServiceAppCandidates, f as isCodexAppServerProxyLaunch, l as resolveMacOSDesktopCodexAppPathCandidates, n as resolveManagedCodexAppServerStartOptions, o as CODEX_APP_SERVER_VERSION, r as resolveManagedCodexNativeCommand, s as MIN_SUPPORTED_CODEX_APP_SERVER_VERSION, t as isManagedCodexDesktopCommand, u as resolveMacOSDesktopCodexBundledMarketplaceCandidates } from "./managed-binary-DcpnJF9x.js";
+import { a as isCodexAppServerNativeAuthProfile } from "./session-binding-4Ki04sW-.js";
+import { a as hasCodexAppServerNaturalExit, i as closeCodexAppServerTransportAndWait, n as resolveCodexAppServerSpawnEnv, r as closeCodexAppServerTransport, t as createStdioTransport } from "./transport-stdio-CzTngV0j.js";
 import { isRecord, normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
+import { createHash, randomUUID } from "node:crypto";
+import { addTimerTimeoutGraceMs, parseStrictNonNegativeInteger, resolveTimerTimeoutMs } from "openclaw/plugin-sdk/number-runtime";
+import { runExec } from "openclaw/plugin-sdk/process-runtime";
 import fs from "node:fs/promises";
 import path from "node:path";
 import { createDeferred } from "openclaw/plugin-sdk/extension-shared";
-import { addTimerTimeoutGraceMs, parseStrictNonNegativeInteger, resolveTimerTimeoutMs } from "openclaw/plugin-sdk/number-runtime";
 import { AgentHarnessPreflightError, OPENCLAW_VERSION, embeddedAgentLog, formatErrorMessage, formatToolExecutionErrorMessage, normalizeQuestionTimeoutSeconds, resolveToolExecutionErrorKind } from "openclaw/plugin-sdk/agent-harness-runtime";
 import { pruneMapToMaxSize } from "openclaw/plugin-sdk/collection-runtime";
 import { createZstdDecompress } from "node:zlib";
 import { root } from "openclaw/plugin-sdk/file-access-runtime";
-import { createHash, randomUUID } from "node:crypto";
 import fsSync, { constants as constants$1, existsSync, watch } from "node:fs";
 import os from "node:os";
 import { isDeepStrictEqual } from "node:util";
@@ -21,7 +21,6 @@ import { ensureAuthProfileStore, findPersistedAuthProfileCredential, loadAuthPro
 import { hasUsableOAuthCredential, resolveAuthProfileOrder, resolveOpenAICodexAuthIdentity } from "openclaw/plugin-sdk/provider-auth";
 import { readSecretFile } from "openclaw/plugin-sdk/secret-file";
 import { assertNoSymlinkParents, withTimeout } from "openclaw/plugin-sdk/security-runtime";
-import { runExec } from "openclaw/plugin-sdk/process-runtime";
 import { EventEmitter } from "node:events";
 import { createInterface } from "node:readline";
 import { coerceErrorMessage, toStringifiedError } from "openclaw/plugin-sdk/error-runtime";
@@ -33,21 +32,6 @@ import net from "node:net";
 import { PassThrough, Writable } from "node:stream";
 import { StringDecoder } from "node:string_decoder";
 import WebSocket from "ws";
-//#region extensions/codex/src/app-server/protocol.ts
-/** Namespace Codex keeps directly model-visible without exposing it to Code Mode guests. */
-const CODEX_OPENCLAW_DIRECT_DYNAMIC_TOOL_NAMESPACE = "openclaw_direct";
-function flattenCodexDynamicToolFunctions(tools) {
-	return (tools ?? []).flatMap((tool) => tool.type === "namespace" ? tool.tools : [tool]);
-}
-const CODEX_INTERACTIVE_THREAD_SOURCE_KINDS = ["cli", "vscode"];
-const CODEX_INTERACTIVE_CUSTOM_THREAD_SOURCES = ["atlas", "chatgpt"];
-function isJsonObject(value) {
-	return isRecord(value);
-}
-function isRpcResponse(message) {
-	return "id" in message && !("method" in message);
-}
-//#endregion
 //#region extensions/codex/src/session-catalog-provenance.ts
 const MAX_SESSION_META_BYTES = 1048576;
 const SESSION_META_READ_CHUNK_BYTES = 65536;
@@ -979,6 +963,7 @@ function resolveCodexAppServerAuthProfileIdForAgent(params) {
 }
 function ensureCodexAppServerAuthProfileStore(params) {
 	return ensureAuthProfileStore(params.agentDir, {
+		profileId: params.authProfileId,
 		allowKeychainPrompt: false,
 		config: params.config,
 		externalCliProviderIds: CODEX_APP_SERVER_EXTERNAL_CLI_PROVIDER_IDS,
@@ -1306,11 +1291,12 @@ function withoutClearedCodexHomeEnv(clearEnv) {
 	return filtered.length === clearEnv.length ? clearEnv : filtered;
 }
 async function applyCodexAppServerAuthProfile(params) {
+	params.assertCurrent?.();
 	if (!params.preparedAuth && params.authProfileId === null) {
-		await assertNativeCodexAccountMatchesRoute(params.client, params.authRequirement);
+		await assertNativeCodexAccountMatchesRoute(params.client, params.authRequirement, params.assertCurrent);
 		return;
 	}
-	const loginParams = params.preparedAuth?.kind === "profile" ? params.preparedAuth.snapshot.loginParams : params.preparedAuth?.kind === "api-key" ? {
+	let loginParams = params.preparedAuth?.kind === "profile" ? params.preparedAuth.snapshot.loginParams : params.preparedAuth?.kind === "api-key" ? {
 		type: "apiKey",
 		apiKey: params.preparedAuth.apiKey
 	} : await resolveCodexAppServerAuthProfileLoginParams({
@@ -1320,18 +1306,16 @@ async function applyCodexAppServerAuthProfile(params) {
 		config: params.config
 	});
 	if (params.authRequirement === "subscription" && loginParams?.type !== "chatgptAuthTokens") throw createCodexAppServerAuthError("Codex subscription auth profile could not produce login credentials. Sign in with `openclaw models auth login --provider openai`, select that profile, then retry.");
-	if (!loginParams) {
-		if (params.authRequirement !== "api-key" || params.startOptions?.transport !== "stdio") return;
+	if (!loginParams && params.authRequirement === "api-key" && params.startOptions?.transport === "stdio") {
 		const env = resolveCodexAppServerSpawnEnv(params.startOptions, process.env);
-		const fallbackLoginParams = await resolveCodexAppServerFallbackApiKeyLoginParams({
+		loginParams = await resolveCodexAppServerFallbackApiKeyLoginParams({
 			client: params.client,
 			env,
-			codexCliAuthEnv: process.env
+			codexCliAuthEnv: process.env,
+			assertCurrent: params.assertCurrent
 		});
-		if (fallbackLoginParams) await params.client.request("account/login/start", fallbackLoginParams);
-		return;
 	}
-	await params.client.request("account/login/start", loginParams);
+	if (loginParams) await params.client.request("account/login/start", loginParams, { assertCurrent: params.assertCurrent });
 }
 /**
 * Native-home connections are verified, never logged into. Both directions of the
@@ -1340,9 +1324,9 @@ async function applyCodexAppServerAuthProfile(params) {
 * ChatGPT plan. An absent account is left alone because the native home may serve a
 * custom model provider that reports no OpenAI account at all.
 */
-async function assertNativeCodexAccountMatchesRoute(client, authRequirement) {
+async function assertNativeCodexAccountMatchesRoute(client, authRequirement, assertCurrent) {
 	if (!authRequirement) return;
-	const response = await client.request("account/read", { refreshToken: false });
+	const response = await client.request("account/read", { refreshToken: false }, { assertCurrent });
 	const accountType = isJsonObject(response.account) ? response.account.type : void 0;
 	if (authRequirement === "subscription") {
 		if (accountType !== "chatgpt") throw createCodexAppServerAuthError("Codex subscription route requires ChatGPT auth in the native Codex home. Run `codex login` for that home, or use appServer.homeScope=\"agent\" with an OpenClaw OAuth profile, then retry.");
@@ -1430,7 +1414,7 @@ async function resolveCodexAppServerAuthProfileLoginParamsInternal(params) {
 async function resolveCodexAppServerFallbackApiKeyLoginParams(params) {
 	const apiKey = readFirstNonEmptyEnv(params.env, CODEX_APP_SERVER_API_KEY_ENV_VARS) ?? await readCodexCliAuthFileApiKey(params.codexCliAuthEnv);
 	if (!apiKey) return;
-	if ((await params.client.request("account/read", { refreshToken: false })).account) return;
+	if ((await params.client.request("account/read", { refreshToken: false }, { assertCurrent: params.assertCurrent })).account) return;
 	return {
 		type: "apiKey",
 		apiKey
@@ -1478,7 +1462,10 @@ function resolveCodexCliAuthFileApiKeyCacheKey(env) {
 async function resolveLoginParamsForCredential(profileId, credential, params) {
 	if (credential.type === "api_key") {
 		const apiKey = (await resolveApiKeyForProfile({
-			store: params.preferStoreCredential ? params.store : ensureAuthProfileStore(params.agentDir, { allowKeychainPrompt: false }),
+			store: params.preferStoreCredential ? params.store : ensureAuthProfileStore(params.agentDir, {
+				allowKeychainPrompt: false,
+				profileId
+			}),
 			profileId,
 			agentDir: params.agentDir
 		}))?.apiKey?.trim();
@@ -1489,7 +1476,10 @@ async function resolveLoginParamsForCredential(profileId, credential, params) {
 	}
 	if (credential.type === "token") {
 		const accessToken = (await resolveApiKeyForProfile({
-			store: params.preferStoreCredential ? params.store : ensureAuthProfileStore(params.agentDir, { allowKeychainPrompt: false }),
+			store: params.preferStoreCredential ? params.store : ensureAuthProfileStore(params.agentDir, {
+				allowKeychainPrompt: false,
+				profileId
+			}),
 			profileId,
 			agentDir: params.agentDir
 		}))?.apiKey?.trim();
@@ -1548,7 +1538,7 @@ async function resolveOAuthCredentialForCodexAppServer(profileId, credential, pa
 		agentDir: ownerAgentDir,
 		forceRefresh: params.forceRefresh && Boolean(persistedOAuthCredential)
 	});
-	const refreshed = useScopedCredential ? void 0 : loadAuthProfileStoreForSecretsRuntime(ownerAgentDir).profiles[profileId];
+	const refreshed = useScopedCredential ? void 0 : loadAuthProfileStoreForSecretsRuntime(ownerAgentDir, { profileId }).profiles[profileId];
 	const refreshedOAuthCredential = refreshed?.type === "oauth" && isCodexAppServerAuthProvider(refreshed.provider) ? refreshed : void 0;
 	if (refreshedOAuthCredential && isDeepStrictEqual(params.store.profiles[profileId], credential)) params.store.profiles[profileId] = refreshedOAuthCredential;
 	const storedCredential = store.profiles[profileId];
@@ -2555,8 +2545,9 @@ function hasPendingDynamicToolTerminalDiagnostic(params) {
 /** Resolves per-tool timeout, applying media/message defaults and hard caps. */
 function resolveDynamicToolCallTimeoutMs(params) {
 	const args = isJsonObject(params.call.arguments) ? params.call.arguments : void 0;
-	if (params.call.tool === "ask_user" || params.call.tool === "secrets" && args?.action === "request") try {
-		return normalizeQuestionTimeoutSeconds(args?.timeoutSeconds) * 1e3 + CODEX_DYNAMIC_TOOL_TIMEOUT_SECONDS_GRACE_MS;
+	if (params.call.tool === "openclaw" || params.call.tool === "ask_user" || params.call.tool === "secrets" && args?.action === "request") try {
+		const timeoutSeconds = params.call.tool === "openclaw" ? void 0 : args?.timeoutSeconds;
+		return normalizeQuestionTimeoutSeconds(timeoutSeconds) * 1e3 + CODEX_DYNAMIC_TOOL_TIMEOUT_SECONDS_GRACE_MS;
 	} catch {
 		return CODEX_DYNAMIC_TOOL_TIMEOUT_MS;
 	}
@@ -2763,6 +2754,18 @@ var definitions = {
 		],
 		"type": "string"
 	}] },
+	"AsyncUserInputQuestion": {
+		"additionalProperties": false,
+		"properties": {
+			"options": {
+				"items": { "type": "string" },
+				"type": ["array", "null"]
+			},
+			"title": { "type": "string" }
+		},
+		"required": ["title"],
+		"type": "object"
+	},
 	"ByteRange": {
 		"properties": {
 			"end": {
@@ -3716,6 +3719,10 @@ var definitions = {
 				"description": "Identifier for this thread. Codex-generated thread IDs are UUIDv7.",
 				"type": "string"
 			},
+			"model": {
+				"description": "Current configured model when loaded, otherwise the latest persisted model. Null when unavailable. This is not per-turn execution telemetry.",
+				"type": ["string", "null"]
+			},
 			"modelProvider": {
 				"description": "Model provider used for this thread (for example, 'openai').",
 				"type": "string"
@@ -3740,6 +3747,10 @@ var definitions = {
 				"description": "Canonical project assignment owned by app-server, if any.",
 				"type": ["string", "null"]
 			},
+			"reasoningEffort": {
+				"anyOf": [{ "$ref": "#/definitions/ReasoningEffort" }, { "type": "null" }],
+				"description": "Current configured reasoning effort when loaded, otherwise the latest persisted effort. Null when unset or unavailable. This is not per-turn execution telemetry."
+			},
 			"recencyAt": {
 				"description": "Unix timestamp (in seconds) used for thread recency ordering.",
 				"format": "int64",
@@ -3872,6 +3883,11 @@ var definitions = {
 					"anyOf": [{ "$ref": "#/definitions/MessagePhase" }, { "type": "null" }],
 					"default": null
 				},
+				"questions": {
+					"default": null,
+					"items": { "$ref": "#/definitions/AsyncUserInputQuestion" },
+					"type": ["array", "null"]
+				},
 				"text": { "type": "string" },
 				"type": {
 					"enum": ["agentMessage"],
@@ -5074,6 +5090,22 @@ function assertCodexTurnStartResponse(value) {
 	const normalized = normalizeWithDefaults(turnStartResponseSchema, normalizeTurnStartResponse(value));
 	return assertCodexShape(validateTurnStartResponse, normalized, "turn/start response");
 }
+/** Only the current text prompt may be echoed; capabilities and historical items are not passive. */
+function assertCodexPassiveTurnItems(items, prompt, taskLabel) {
+	let promptEchoSeen = false;
+	for (const item of items) {
+		if (item.type === "agentMessage" || item.type === "reasoning") continue;
+		if (item.type === "userMessage" && !promptEchoSeen) {
+			const content = Array.isArray(item.content) ? item.content : [];
+			const input = content[0];
+			if (content.length === 1 && isJsonObject(input) && input.type === "text" && input.text === prompt) {
+				promptEchoSeen = true;
+				continue;
+			}
+		}
+		throw new Error(`Codex ${taskLabel} returned unexpected native item: ${item.type}`);
+	}
+}
 /** Reads Codex dynamic-tool call params, returning undefined for invalid payloads. */
 function readCodexDynamicToolCallParams(value) {
 	return readCodexShape(validateDynamicToolCallParams, normalizeWithDefaults(dynamicToolCallParamsSchema, value));
@@ -5176,6 +5208,9 @@ var CodexAppServerRpcError = class extends Error {
 		this.method = method;
 	}
 };
+function isCodexThreadReadMissingError(error, threadId) {
+	return error instanceof CodexAppServerRpcError && error.method === "thread/read" && error.code === -32600 && error.message === `thread not loaded: ${threadId}`;
+}
 function formatCodexAppServerRpcErrorMessage(error, method) {
 	const message = error.message || `${method} failed`;
 	const detail = readCodexAppServerRpcReloginDetail(error.data);
@@ -5972,7 +6007,11 @@ var CodexAppServerClient = class CodexAppServerClient {
 			pending.reject(error);
 		}
 		this.pending.clear();
-		for (const handler of this.closeHandlers) handler(this);
+		for (const handler of this.closeHandlers) try {
+			handler(this);
+		} catch (closeError) {
+			embeddedAgentLog.warn("codex app-server close handler failed", { error: closeError });
+		}
 	}
 };
 function defaultServerRequestResponse(request) {
@@ -6018,7 +6057,7 @@ function assertSupportedCodexAppServerVersion(response) {
 	if (!detectedVersion) throw new CodexAppServerVersionError(detectedVersion);
 	const detected = parse(detectedVersion);
 	if (!detected || detected.compare("0.149.0") < 0) throw new CodexAppServerVersionError(detectedVersion);
-	if (detected.compare("0.152.1") > 0) embeddedAgentLog.warn("codex app-server is newer than OpenClaw's managed runtime; continuing with normal startup validation", {
+	if (detected.compare("0.153.4") > 0) embeddedAgentLog.warn("codex app-server is newer than OpenClaw's managed runtime; continuing with normal startup validation", {
 		detectedVersion,
 		validatedVersion: CODEX_APP_SERVER_VERSION
 	});
@@ -6597,7 +6636,10 @@ var shared_client_exports = /* @__PURE__ */ __exportAll({
 const CODEX_APP_SERVER_INITIALIZE_TIMEOUT_MESSAGE = "codex app-server initialize timed out";
 const SHARED_CODEX_APP_SERVER_CLIENT_STATE = Symbol.for("openclaw.codexAppServerClientState");
 const SHARED_CODEX_APP_SERVER_CLIENT_DISPOSER = Symbol.for("openclaw.codexAppServerClientDisposer");
-const CODEX_APP_SERVER_CLIENT_START_METADATA = Symbol.for("openclaw.codexAppServerClientStartMetadata");
+const createStartupLifetime = () => ({
+	controller: new AbortController(),
+	pending: /* @__PURE__ */ new Set()
+});
 function getSharedCodexAppServerClientState() {
 	const globalState = globalThis;
 	globalState[SHARED_CODEX_APP_SERVER_CLIENT_STATE] ??= {
@@ -6605,19 +6647,37 @@ function getSharedCodexAppServerClientState() {
 		liveClients: /* @__PURE__ */ new Set(),
 		isolatedClients: /* @__PURE__ */ new Set(),
 		entriesByClient: /* @__PURE__ */ new WeakMap(),
-		leasedReleases: /* @__PURE__ */ new WeakMap(),
-		desktopGenerationDrainChecks: /* @__PURE__ */ new Set()
+		desktopGenerationDrainChecks: /* @__PURE__ */ new Set(),
+		startup: createStartupLifetime(),
+		startMetadata: /* @__PURE__ */ new WeakMap()
 	};
 	return globalState[SHARED_CODEX_APP_SERVER_CLIENT_STATE];
 }
-function getCodexAppServerClientStartMetadata() {
-	const globalState = globalThis;
-	globalState[CODEX_APP_SERVER_CLIENT_START_METADATA] ??= /* @__PURE__ */ new WeakMap();
-	return globalState[CODEX_APP_SERVER_CLIENT_START_METADATA];
+function ownCodexStartup(lifetime, operation) {
+	lifetime.pending.add(operation);
+	const release = () => lifetime.pending.delete(operation);
+	operation.then(release, release);
+	return operation;
+}
+async function prepareCodexAppServerClient(options) {
+	const lifetime = getSharedCodexAppServerClientState().startup;
+	const abandonSignal = options?.abandonSignal ? AbortSignal.any([lifetime.controller.signal, options.abandonSignal]) : lifetime.controller.signal;
+	const assertCurrent = () => {
+		if (abandonSignal.aborted) throw new CodexAppServerStartupError("aborted", "codex app-server initialize aborted");
+	};
+	assertCurrent();
+	const startedAt = Date.now();
+	return {
+		context: await withCodexAppServerAcquireDeadline(options?.timeoutMs ?? 0, ownCodexStartup(lifetime, resolveCodexAppServerClientStartContext(options)), abandonSignal),
+		lifetime,
+		abandonSignal,
+		startedAt,
+		assertCurrent
+	};
 }
 /** Reads the exact successful spawn selection plus its initialized runtime identity. */
 function readCodexAppServerClientProcessIdentity(client) {
-	const metadata = getCodexAppServerClientStartMetadata().get(client);
+	const metadata = getSharedCodexAppServerClientState().startMetadata.get(client);
 	if (!metadata) return;
 	const runtimeIdentity = client.getRuntimeIdentity();
 	return {
@@ -6633,11 +6693,11 @@ function readCodexAppServerClientDesktopGenerationFingerprint(client) {
 }
 /** Returns the lifecycle generation that owns a managed desktop client. */
 function readCodexAppServerClientDesktopGeneration(client) {
-	return getCodexAppServerClientStartMetadata().get(client)?.desktopGeneration;
+	return getSharedCodexAppServerClientState().startMetadata.get(client)?.desktopGeneration;
 }
 /** Waits until older physical desktop clients for this client's Codex home exit. */
 async function waitForCodexAppServerClientDesktopGenerationDrain(params) {
-	const metadata = getCodexAppServerClientStartMetadata().get(params.client);
+	const metadata = getSharedCodexAppServerClientState().startMetadata.get(params.client);
 	if (!metadata?.desktopGeneration) return;
 	const drain = createOlderDesktopGenerationDrainWait({
 		generation: metadata.desktopGeneration,
@@ -6678,7 +6738,7 @@ function isCodexAppServerStartSelectionChangedError(error) {
 * Use between the check and the JSON-RPC write on the same event loop turn.
 */
 function assertCodexAppServerClientStartSelectionCurrent(params) {
-	const metadata = getCodexAppServerClientStartMetadata().get(params.client);
+	const metadata = getSharedCodexAppServerClientState().startMetadata.get(params.client);
 	if (!metadata) return;
 	if (metadata.desktopGeneration && !isCodexDesktopGenerationCurrent(metadata.desktopGeneration)) throw new CodexAppServerStartSelectionChangedError();
 	const requestedStartOptions = params.startOptions ?? metadata.requestedStartOptions;
@@ -6691,7 +6751,7 @@ function assertCodexAppServerClientStartSelectionCurrent(params) {
 }
 /** Resolves the per-CODEX_HOME key used to serialize native config loading. */
 function resolveCodexNativeConfigFenceKey(params) {
-	const metadata = params.client ? getCodexAppServerClientStartMetadata().get(params.client) : void 0;
+	const metadata = params.client ? getSharedCodexAppServerClientState().startMetadata.get(params.client) : void 0;
 	const startOptions = metadata?.startOptions ?? params.startOptions;
 	if (!startOptions || startOptions.transport !== "stdio") return;
 	const configuredHome = startOptions.env?.CODEX_HOME?.trim();
@@ -6779,27 +6839,19 @@ function shouldTrackDesktopGeneration(startOptions, pluginConfig) {
 	return startOptions.commandSource === "managed" && (startOptions.managedCommandOrder ?? "package-first") === "desktop-first";
 }
 /** Gets or starts a shared Codex app-server client without retaining a lease. */
-async function getSharedCodexAppServerClient(options) {
-	return (await acquireSharedCodexAppServerClient(options)).client;
+function getSharedCodexAppServerClient(options) {
+	return acquireSharedCodexAppServerClient(options);
 }
 /** Gets or starts a shared Codex app-server client and records a release lease. */
-async function getLeasedSharedCodexAppServerClient(options) {
-	const acquired = await acquireSharedCodexAppServerClient(options, { leased: true });
-	const state = getSharedCodexAppServerClientState();
-	const releases = state.leasedReleases.get(acquired.client) ?? [];
-	releases.push(acquired.release);
-	state.leasedReleases.set(acquired.client, releases);
-	return acquired.client;
+function getLeasedSharedCodexAppServerClient(options) {
+	return acquireSharedCodexAppServerClient(options, true);
 }
 /** Releases one outstanding lease for a shared Codex app-server client. */
 function releaseLeasedSharedCodexAppServerClient(client) {
-	const state = getSharedCodexAppServerClientState();
-	const releases = state.leasedReleases.get(client);
-	if (!releases) return false;
-	const release = releases.pop();
-	if (!release) return false;
-	if (releases.length === 0) state.leasedReleases.delete(client);
-	release();
+	const entry = getSharedCodexAppServerClientState().entriesByClient.get(client);
+	if (!entry || entry.anonymousLeases === 0) return false;
+	entry.anonymousLeases -= 1;
+	releaseSharedClientEntry(entry, "activeLeases");
 	return true;
 }
 /** Releases the currently owned client exactly once. */
@@ -6861,13 +6913,13 @@ async function withLeasedCodexAppServerClientStartSelectionRetry(params) {
 	}
 	throw new Error("Codex app-server selection retry loop exited unexpectedly");
 }
-async function acquireSharedCodexAppServerClient(options, leaseOptions) {
-	if (options?.abandonSignal?.aborted) throw new CodexAppServerStartupError("aborted", "codex app-server initialize aborted");
-	const acquireStartedAt = Date.now();
+async function acquireSharedCodexAppServerClient(options, leased = false) {
 	const timeoutMs = options?.timeoutMs ?? 0;
 	const state = getSharedCodexAppServerClientState();
-	const { agentDir, usesNativeAuth, authProfileId, authProfileStore, preparedAuth, authRequirement, requestedStartOptions, startOptions, desktopGeneration, pluginConfig } = await withCodexAppServerAcquireDeadline(timeoutMs, resolveCodexAppServerClientStartContext(options), options?.abandonSignal);
-	const remainingTimeoutMs = resolveRemainingAcquireTimeout(timeoutMs, acquireStartedAt);
+	const { context, lifetime, abandonSignal, startedAt, assertCurrent } = await prepareCodexAppServerClient(options);
+	assertCurrent();
+	const { agentDir, usesNativeAuth, authProfileId, authProfileStore, preparedAuth, authRequirement, requestedStartOptions, startOptions, desktopGeneration, pluginConfig } = context;
+	const remainingTimeoutMs = resolveRemainingAcquireTimeout(timeoutMs, startedAt);
 	const authIdentityCacheKey = preparedAuth?.kind === "api-key" ? resolveCodexAppServerPreparedApiKeyCacheKey(preparedAuth.apiKey) : preparedAuth?.snapshot.secretFreeCacheKey ?? (authRequirement === "api-key" && !authProfileId ? resolveCodexAppServerFallbackApiKeyCacheKey({ startOptions }) : void 0);
 	const baseKey = `${codexAppServerStartOptionsKey(startOptions, {
 		authProfileId,
@@ -6880,14 +6932,14 @@ async function acquireSharedCodexAppServerClient(options, leaseOptions) {
 	const key = runtimeArtifactMode ? `${baseKey}\0runtime-artifact:capture-v1:${expectedRuntimeArtifactKey}` : baseKey;
 	let entry = getOrCreateSharedClientEntry(state, key);
 	const existingClient = entry.client;
-	const existingGeneration = existingClient ? getCodexAppServerClientStartMetadata().get(existingClient)?.desktopGeneration : void 0;
+	const existingGeneration = existingClient ? state.startMetadata.get(existingClient)?.desktopGeneration : void 0;
 	if (existingClient && existingGeneration && !isCodexDesktopGenerationCurrent(existingGeneration)) {
 		retireSharedCodexAppServerClientIfCurrent(existingClient);
 		entry = getOrCreateSharedClientEntry(state, key);
 	}
 	entry.startupAbort ??= new AbortController();
 	entry.closeWhenIdle = false;
-	const releasePendingAcquire = retainPendingSharedClientAcquire(entry);
+	const releasePendingAcquire = retainSharedClientEntry(entry, "pendingAcquires");
 	const startedCallback = options?.onStartedClient;
 	if (startedCallback) {
 		entry.onStartedClientCallbacks.add(startedCallback);
@@ -6901,15 +6953,15 @@ async function acquireSharedCodexAppServerClient(options, leaseOptions) {
 		const abandon = () => {
 			stopStartedClientNotifications();
 			releasePendingAcquire();
-			retirePendingSharedClientEntryIfUnclaimed(key, entry);
+			retirePendingSharedClientEntryIfUnclaimed(entry);
 		};
 		options.abandonSignal.addEventListener("abort", abandon, { once: true });
 		cleanupAbandonSignal = () => options.abandonSignal?.removeEventListener("abort", abandon);
 		if (options.abandonSignal.aborted) abandon();
 	}
 	const startup = entry.startup ?? (entry.startup = createSharedCodexAppServerClientStartup({
+		lifetime,
 		entry,
-		key,
 		requestedStartOptions,
 		startOptions,
 		desktopGeneration,
@@ -6921,13 +6973,12 @@ async function acquireSharedCodexAppServerClient(options, leaseOptions) {
 		authRequirement,
 		runtimeArtifactMode,
 		...options?.expectedRuntimeArtifact ? { expectedRuntimeArtifact: options.expectedRuntimeArtifact } : {},
-		runtimeArtifactSignal: entry.startupAbort.signal,
 		abandonSignal: entry.startupAbort.signal,
 		config: options?.config
 	}));
 	try {
-		await withCodexAppServerAcquireDeadline(remainingTimeoutMs, startup.initialized, options?.abandonSignal, CODEX_APP_SERVER_INITIALIZE_TIMEOUT_MESSAGE, () => buildCodexAppServerInitializeTimeoutError(entry.client));
-		const client = await withCodexAppServerAcquireDeadline(timeoutMs, startup.ready, options?.abandonSignal, "codex app-server authentication timed out");
+		await withCodexAppServerAcquireDeadline(remainingTimeoutMs, startup.initialized, abandonSignal, CODEX_APP_SERVER_INITIALIZE_TIMEOUT_MESSAGE, () => buildCodexAppServerInitializeTimeoutError(entry.client));
+		const client = await withCodexAppServerAcquireDeadline(timeoutMs, startup.ready, abandonSignal, "codex app-server authentication timed out");
 		if (entry.closeError) throw entry.closeError;
 		ensureCodexAppServerClientRuntime(client, {
 			agentDir,
@@ -6936,14 +6987,14 @@ async function acquireSharedCodexAppServerClient(options, leaseOptions) {
 			authMode: preparedAuth?.kind === "api-key" ? "prepared-api-key" : "profile",
 			config: options?.config
 		});
-		const release = leaseOptions?.leased ? retainSharedClientEntry(entry) : void 0;
-		return release ? {
-			client,
-			release
-		} : { client };
+		if (leased) {
+			entry.anonymousLeases += 1;
+			entry.activeLeases += 1;
+		}
+		return client;
 	} catch (error) {
 		releasePendingAcquire();
-		retirePendingSharedClientEntryIfUnclaimed(key, entry);
+		retirePendingSharedClientEntryIfUnclaimed(entry);
 		throw error;
 	} finally {
 		cleanupAbandonSignal?.();
@@ -6973,45 +7024,34 @@ function resolveRemainingAcquireTimeout(timeoutMs, startedAt) {
 }
 function createSharedCodexAppServerClientStartup(params) {
 	const initialized = createDeferred();
-	const ready = startInitializedCodexAppServerClient({
-		requestedStartOptions: params.requestedStartOptions,
-		startOptions: params.startOptions,
-		...params.desktopGeneration ? { desktopGeneration: params.desktopGeneration } : {},
-		...params.pluginConfig !== void 0 ? { pluginConfig: params.pluginConfig } : {},
-		agentDir: params.agentDir,
-		authProfileId: params.authProfileId,
-		authProfileStore: params.authProfileStore,
-		preparedAuth: params.preparedAuth,
-		authRequirement: params.authRequirement,
-		runtimeArtifactMode: params.runtimeArtifactMode,
-		...params.expectedRuntimeArtifact ? { expectedRuntimeArtifact: params.expectedRuntimeArtifact } : {},
-		runtimeArtifactSignal: params.runtimeArtifactSignal,
-		abandonSignal: params.abandonSignal,
-		config: params.config,
+	const ready = ownCodexStartup(params.lifetime, startInitializedCodexAppServerClient({
+		...params,
 		onStartedClient: (startedClient) => {
 			const state = getSharedCodexAppServerClientState();
+			if (params.entry.client) state.entriesByClient.delete(params.entry.client);
 			params.entry.client = startedClient;
+			state.entriesByClient.set(startedClient, params.entry);
 			state.liveClients.add(startedClient);
 			startedClient.addTransportExitHandler((exitedClient) => {
 				state.liveClients.delete(exitedClient);
 				notifyDesktopGenerationDrainChecks(state);
 			});
-			startedClient.addCloseHandler((closedClient) => {
-				if (state.entriesByClient.get(closedClient) === params.entry) clearSharedClientEntryIfCurrent(params.key, closedClient);
-			});
 			for (const callback of params.entry.onStartedClientCallbacks) callback(startedClient);
-			retirePendingSharedClientEntryIfUnclaimed(params.key, params.entry);
+			retirePendingSharedClientEntryIfUnclaimed(params.entry);
 		},
 		onInitializedClient: () => initialized.resolve()
 	}).then((client) => {
 		const state = getSharedCodexAppServerClientState();
 		params.entry.client = client;
-		state.entriesByClient.set(client, params.entry);
+		client.addCloseHandler((closedClient) => {
+			const entry = getCurrentSharedClientEntry(closedClient);
+			if (entry) state.clients.delete(entry.key);
+		});
 		return client;
 	}, (error) => {
 		initialized.reject(error);
 		throw error;
-	});
+	}));
 	initialized.promise.catch(() => void 0);
 	ready.catch(() => void 0);
 	return {
@@ -7019,13 +7059,15 @@ function createSharedCodexAppServerClientStartup(params) {
 		ready
 	};
 }
-/** Starts a non-shared Codex app-server client owned entirely by the caller. */
+/** Starts a caller-owned client; its assertion never binds ordinary shared-client leases. */
 async function createIsolatedCodexAppServerClient(options) {
-	if (options?.abandonSignal?.aborted) throw new CodexAppServerStartupError("aborted", "codex app-server initialize aborted");
-	const acquireStartedAt = Date.now();
+	options?.assertCurrent?.();
+	const { context, lifetime, abandonSignal, startedAt, assertCurrent } = await prepareCodexAppServerClient(options);
+	assertCurrent();
 	const timeoutMs = options?.timeoutMs ?? 0;
-	const { agentDir, usesNativeAuth, authProfileId, authProfileStore, preparedAuth, authRequirement, requestedStartOptions, startOptions, desktopGeneration, pluginConfig } = await withCodexAppServerAcquireDeadline(timeoutMs, resolveCodexAppServerClientStartContext(options), options?.abandonSignal);
-	return await startInitializedCodexAppServerClient({
+	const { agentDir, usesNativeAuth, authProfileId, authProfileStore, preparedAuth, authRequirement, requestedStartOptions, startOptions, desktopGeneration, pluginConfig } = context;
+	return await ownCodexStartup(lifetime, startInitializedCodexAppServerClient({
+		lifetime,
 		requestedStartOptions,
 		startOptions,
 		...desktopGeneration ? { desktopGeneration } : {},
@@ -7037,15 +7079,15 @@ async function createIsolatedCodexAppServerClient(options) {
 		authRequirement,
 		runtimeArtifactMode: options?.runtimeArtifactMode ?? (options?.expectedRuntimeArtifact ? "capture" : void 0),
 		...options?.expectedRuntimeArtifact ? { expectedRuntimeArtifact: options.expectedRuntimeArtifact } : {},
-		runtimeArtifactSignal: options?.abandonSignal,
 		config: options?.config,
-		timeoutMs: resolveRemainingAcquireTimeout(timeoutMs, acquireStartedAt),
-		abandonSignal: options?.abandonSignal,
+		timeoutMs: resolveRemainingAcquireTimeout(timeoutMs, startedAt),
+		abandonSignal,
+		assertCurrent: options?.assertCurrent,
 		onStartedClient: (client) => {
 			trackIsolatedCodexAppServerClient(client);
 			options?.onStartedClient?.(client);
 		}
-	});
+	}));
 }
 function trackIsolatedCodexAppServerClient(client) {
 	const state = getSharedCodexAppServerClientState();
@@ -7058,11 +7100,18 @@ function trackIsolatedCodexAppServerClient(client) {
 async function startInitializedCodexAppServerClient(params) {
 	const acquireStartedAt = Date.now();
 	const timeoutMs = params.timeoutMs ?? 0;
+	const abandonSignal = params.abandonSignal ? AbortSignal.any([params.lifetime.controller.signal, params.abandonSignal]) : params.lifetime.controller.signal;
+	const waitForStartup = (operation, timeoutMessage = CODEX_APP_SERVER_INITIALIZE_TIMEOUT_MESSAGE, timeoutErrorFactory) => {
+		if (abandonSignal.aborted) throw new CodexAppServerStartupError("aborted", "codex app-server initialize aborted");
+		return withCodexAppServerAcquireDeadline(resolveRemainingAcquireTimeout(timeoutMs, acquireStartedAt), ownCodexStartup(params.lifetime, operation()), abandonSignal, timeoutMessage, timeoutErrorFactory);
+	};
 	const startOptionsCandidates = resolveManagedFallbackStartOptions(params.startOptions);
 	for (const [index, startOptions] of startOptionsCandidates.entries()) {
-		const desktopGeneration = params.desktopGeneration ?? (isManagedCodexDesktopCommand(startOptions.command) ? await withCodexAppServerAcquireDeadline(resolveRemainingAcquireTimeout(timeoutMs, acquireStartedAt), waitForCodexDesktopGeneration(), params.abandonSignal) : void 0);
-		const assertDesktopGenerationCurrent = () => {
-			if (params.abandonSignal?.aborted) throw new CodexAppServerStartupError("aborted", "codex app-server initialize aborted");
+		params.assertCurrent?.();
+		const desktopGeneration = params.desktopGeneration ?? (isManagedCodexDesktopCommand(startOptions.command) ? await waitForStartup(waitForCodexDesktopGeneration) : void 0);
+		const assertStartupCurrent = () => {
+			params.assertCurrent?.();
+			if (abandonSignal.aborted) throw new CodexAppServerStartupError("aborted", "codex app-server initialize aborted");
 			if (desktopGeneration && !isCodexDesktopGenerationCurrent(desktopGeneration)) throw new CodexAppServerStartSelectionChangedError();
 		};
 		const computerUseConfig = resolveCodexComputerUseConfig({ pluginConfig: params.pluginConfig });
@@ -7073,13 +7122,13 @@ async function startInitializedCodexAppServerClient(params) {
 			agentDir: params.agentDir
 		}) : void 0;
 		try {
-			if (artifactDrain) await withCodexAppServerAcquireDeadline(resolveRemainingAcquireTimeout(timeoutMs, acquireStartedAt), artifactDrain.promise, params.abandonSignal);
+			if (artifactDrain) await waitForStartup(() => artifactDrain.promise);
 			await reconcileCodexComputerUseStartArtifacts({
 				startOptions,
 				agentDir: params.agentDir,
 				pluginConfig: params.pluginConfig,
 				...desktopGeneration ? { desktopGeneration } : {},
-				assertCurrent: assertDesktopGenerationCurrent,
+				assertCurrent: assertStartupCurrent,
 				ownsIsolatedCodexHome
 			});
 		} catch (error) {
@@ -7094,80 +7143,69 @@ async function startInitializedCodexAppServerClient(params) {
 		} finally {
 			artifactDrain?.cancel();
 		}
-		const runtimeArtifactModule = params.runtimeArtifactMode ? await import("./runtime-artifact-C3jVimFn.js") : void 0;
+		const runtimeArtifactModule = params.runtimeArtifactMode ? await import("./runtime-artifact-Bh_gf6-t.js") : void 0;
 		const runtimeArtifactBeforeStart = runtimeArtifactModule ? await runtimeArtifactModule.captureCodexAppServerRuntimeArtifactBeforeStart({
 			startOptions,
 			spawnIdentity: resolveCodexAppServerSpawnIdentity(startOptions),
-			signal: params.runtimeArtifactSignal
+			signal: abandonSignal
 		}) : void 0;
 		if (runtimeArtifactModule && runtimeArtifactBeforeStart && params.expectedRuntimeArtifact && !runtimeArtifactModule.validateCodexAppServerRuntimeArtifactCapture(params.expectedRuntimeArtifact, runtimeArtifactBeforeStart)) {
 			if (index + 1 < startOptionsCandidates.length) continue;
 			throw new Error("Codex app-server runtime artifact does not match verified inference");
 		}
-		assertDesktopGenerationCurrent();
+		assertStartupCurrent();
 		let starting;
 		let client;
 		try {
-			client = await withCodexAppServerAcquireDeadline(resolveRemainingAcquireTimeout(timeoutMs, acquireStartedAt), starting = CodexAppServerClient.start(startOptions, () => {
-				assertDesktopGenerationCurrent();
+			client = await waitForStartup(() => starting = CodexAppServerClient.start(startOptions, () => {
+				assertStartupCurrent();
 				resolveRemainingAcquireTimeout(timeoutMs, acquireStartedAt);
-			}), params.abandonSignal);
-		} catch (error) {
-			starting?.then((lateClient) => lateClient.close(), () => {});
-			throw error;
-		}
-		const nativeCommandAtStart = startOptions.commandSource === "resolved-managed" ? resolveManagedCodexNativeCommand(startOptions.command) : void 0;
-		getCodexAppServerClientStartMetadata().set(client, {
-			requestedStartOptions: params.requestedStartOptions,
-			startOptions,
-			agentDir: params.agentDir,
-			...nativeCommandAtStart ? { nativeCommand: nativeCommandAtStart } : {},
-			...desktopGeneration ? { desktopGeneration } : {}
-		});
-		params.onStartedClient?.(client);
-		let initialize;
-		try {
-			await withCodexAppServerAcquireDeadline(resolveRemainingAcquireTimeout(timeoutMs, acquireStartedAt), initialize = client.initialize(), params.abandonSignal, CODEX_APP_SERVER_INITIALIZE_TIMEOUT_MESSAGE, () => buildCodexAppServerInitializeTimeoutError(client));
-		} catch (error) {
-			client.close();
-			initialize?.catch(() => void 0);
-			if (shouldTryManagedFallbackStartOption(error, startOptions, index, startOptionsCandidates)) continue;
-			throw error;
-		}
-		try {
-			assertDesktopGenerationCurrent();
+			}));
 		} catch (error) {
-			client.close();
+			if (starting) ownCodexStartup(params.lifetime, starting.then((lateClient) => lateClient.closeAndWait(), () => {}));
 			throw error;
 		}
-		params.onInitializedClient?.();
-		let runtimeArtifact;
+		let ready = false;
 		try {
+			const nativeCommandAtStart = startOptions.commandSource === "resolved-managed" ? resolveManagedCodexNativeCommand(startOptions.command) : void 0;
+			getSharedCodexAppServerClientState().startMetadata.set(client, {
+				requestedStartOptions: params.requestedStartOptions,
+				startOptions,
+				agentDir: params.agentDir,
+				...nativeCommandAtStart ? { nativeCommand: nativeCommandAtStart } : {},
+				...desktopGeneration ? { desktopGeneration } : {}
+			});
+			assertStartupCurrent();
+			params.onStartedClient?.(client);
+			try {
+				await waitForStartup(() => client.initialize(), CODEX_APP_SERVER_INITIALIZE_TIMEOUT_MESSAGE, () => buildCodexAppServerInitializeTimeoutError(client));
+			} catch (error) {
+				if (shouldTryManagedFallbackStartOption(error, startOptions, index, startOptionsCandidates)) continue;
+				throw error;
+			}
+			assertStartupCurrent();
+			params.onInitializedClient?.();
+			let runtimeArtifact;
 			if (runtimeArtifactModule && runtimeArtifactBeforeStart) {
 				runtimeArtifact = await runtimeArtifactModule.finalizeCodexAppServerRuntimeArtifact({
 					before: runtimeArtifactBeforeStart,
 					startOptions,
 					spawnIdentity: resolveCodexAppServerSpawnIdentity(startOptions),
 					runtimeIdentity: client.getRuntimeIdentity(),
-					signal: params.runtimeArtifactSignal
+					signal: abandonSignal
 				});
 				if (params.expectedRuntimeArtifact && (runtimeArtifact.id !== params.expectedRuntimeArtifact.id || runtimeArtifact.fingerprint !== params.expectedRuntimeArtifact.fingerprint)) throw new Error("Codex app-server runtime artifact does not match verified inference");
 			}
-		} catch (error) {
-			client.close();
-			throw error;
-		}
-		ensureCodexAppServerClientRuntime(client, {
-			agentDir: params.agentDir,
-			authProfileId: params.authProfileId ?? void 0,
-			authMode: params.preparedAuth?.kind === "api-key" ? "prepared-api-key" : "profile",
-			...params.authProfileStore ? { authProfileStore: params.authProfileStore } : {},
-			config: params.config,
-			onAuthRefreshFailure: () => retireSharedCodexAppServerClientIfCurrent(client)
-		});
-		try {
-			assertDesktopGenerationCurrent();
-			await withCodexAppServerAcquireDeadline(resolveRemainingAcquireTimeout(timeoutMs, acquireStartedAt), applyCodexAppServerAuthProfile({
+			ensureCodexAppServerClientRuntime(client, {
+				agentDir: params.agentDir,
+				authProfileId: params.authProfileId ?? void 0,
+				authMode: params.preparedAuth?.kind === "api-key" ? "prepared-api-key" : "profile",
+				...params.authProfileStore ? { authProfileStore: params.authProfileStore } : {},
+				config: params.config,
+				onAuthRefreshFailure: () => retireSharedCodexAppServerClientIfCurrent(client)
+			});
+			assertStartupCurrent();
+			await waitForStartup(() => applyCodexAppServerAuthProfile({
 				client,
 				agentDir: params.agentDir,
 				authProfileId: params.authProfileId,
@@ -7175,10 +7213,11 @@ async function startInitializedCodexAppServerClient(params) {
 				authRequirement: params.authRequirement,
 				startOptions,
 				config: params.config,
+				assertCurrent: assertStartupCurrent,
 				...params.authProfileStore ? { authProfileStore: params.authProfileStore } : {}
-			}), params.abandonSignal);
+			}));
 			if (runtimeArtifactModule && runtimeArtifact) runtimeArtifactModule.bindCodexAppServerRuntimeArtifact(client, runtimeArtifact);
-			assertDesktopGenerationCurrent();
+			assertStartupCurrent();
 			const fenceKey = resolveCodexNativeConfigFenceKey({ client });
 			if (fenceKey) client.setThreadSessionRequestGuard(async (options) => {
 				const release = await acquireCodexNativeConfigFence(fenceKey, options);
@@ -7190,10 +7229,10 @@ async function startInitializedCodexAppServerClient(params) {
 					throw error;
 				}
 			});
+			ready = true;
 			return client;
-		} catch (error) {
-			client.close();
-			throw error;
+		} finally {
+			if (!ready) ownCodexStartup(params.lifetime, client.closeAndWait());
 		}
 	}
 	throw new Error("Managed Codex app-server fallback candidates were exhausted.");
@@ -7223,12 +7262,11 @@ function shouldTryManagedFallbackStartOption(error, startOptions, index, startOp
 function clearSharedCodexAppServerClientIfCurrent(client) {
 	if (!client) return false;
 	const state = getSharedCodexAppServerClientState();
-	for (const [key, entry] of state.clients) if (entry.client === client) {
-		state.clients.delete(key);
-		client.close();
-		return true;
-	}
-	return false;
+	const entry = getCurrentSharedClientEntry(client);
+	if (!entry) return false;
+	state.clients.delete(entry.key);
+	client.close();
+	return true;
 }
 /** Captures a revocable observation of the exact shared client and native account/config. */
 function captureSharedCodexAppServerCatalogLifetime(client) {
@@ -7239,16 +7277,14 @@ function captureSharedCodexAppServerCatalogLifetime(client) {
 /** Registration ends on retirement even when sibling leases keep the process alive. */
 function captureSharedClientRegistration(client) {
 	const state = getSharedCodexAppServerClientState();
-	const entry = state.entriesByClient.get(client);
-	const key = [...state.clients].find(([, candidate]) => candidate === entry)?.[0];
+	const entry = getCurrentSharedClientEntry(client);
 	const generation = readCodexAppServerClientDesktopGeneration(client);
-	return () => key !== void 0 && state.clients.get(key) === entry && entry?.client === client && !entry.closeWhenIdle && !entry.closeError && !client.getCloseError() && (!generation || isCodexDesktopGenerationCurrent(generation));
+	return () => entry !== void 0 && state.clients.get(entry.key) === entry && entry.client === client && !entry.closeWhenIdle && !entry.closeError && !client.getCloseError() && (!generation || isCodexDesktopGenerationCurrent(generation));
 }
 /** Retains the matching shared client and returns a release callback. */
 function retainSharedCodexAppServerClientIfCurrent(client) {
-	if (!client) return;
-	const state = getSharedCodexAppServerClientState();
-	for (const entry of state.clients.values()) if (entry.client === client) return retainSharedClientEntry(entry);
+	const entry = getCurrentSharedClientEntry(client);
+	return entry ? retainSharedClientEntry(entry) : void 0;
 }
 /** Retains the live shared client whose initialized instance id matches a thread binding. */
 function retainSharedCodexAppServerClientByInstanceId(clientId) {
@@ -7266,7 +7302,7 @@ function retainSharedCodexAppServerClientByInstanceId(clientId) {
 /** Captures physical ownership, independently of unrelated thread and reader leases. */
 function captureCodexAppServerClientLifetime(client, requiredOwnership) {
 	const state = getSharedCodexAppServerClientState();
-	const start = getCodexAppServerClientStartMetadata().get(client)?.startOptions;
+	const start = state.startMetadata.get(client)?.startOptions;
 	if (requiredOwnership === "native-process" && (start?.transport !== "stdio" || isCodexAppServerProxyLaunch(start.args))) throw new AgentHarnessPreflightError("Codex ordinary configuration refresh requires an OpenClaw-managed local stdio process, not an external socket or app-server proxy. No turn was sent; reconnect through managed local stdio before continuing.");
 	const isCurrent = requiredOwnership === "native-process" && state.isolatedClients.has(client) ? () => state.isolatedClients.has(client) && !client.getCloseError() : captureSharedClientRegistration(client);
 	const assertCurrent = () => {
@@ -7288,43 +7324,31 @@ function captureCodexAppServerClientLifetime(client, requiredOwnership) {
 function retireSharedCodexAppServerClientIfCurrent(client, opts) {
 	if (!client) return;
 	const state = getSharedCodexAppServerClientState();
-	for (const [key, entry] of state.clients) if (entry.client === client) {
-		state.clients.delete(key);
+	const currentEntry = getCurrentSharedClientEntry(client);
+	const entry = currentEntry ?? state.entriesByClient.get(client);
+	if (!entry || entry.client !== client && !entry.closeError) return;
+	if (currentEntry) {
+		state.clients.delete(entry.key);
 		entry.closeWhenIdle = true;
-		if (opts?.failActiveLeases) {
-			entry.closeError = /* @__PURE__ */ new Error("codex app-server client is closed");
-			return {
-				activeLeases: entry.activeLeases,
-				closed: closeRetiredSharedClientEntry(entry)
-			};
-		}
-		const closed = closeRetiredSharedClientEntryIfIdle(entry);
-		return {
-			activeLeases: entry.activeLeases,
-			closed
-		};
 	}
-	const detachedEntry = state.entriesByClient.get(client);
-	if (detachedEntry && (detachedEntry.client === client || detachedEntry.closeError)) {
-		if (opts?.failActiveLeases && !detachedEntry.closeError) {
-			detachedEntry.closeError = /* @__PURE__ */ new Error("codex app-server client is closed");
-			return {
-				activeLeases: detachedEntry.activeLeases,
-				closed: closeRetiredSharedClientEntry(detachedEntry)
-			};
-		}
+	if (opts?.failActiveLeases && (currentEntry || !entry.closeError)) {
+		entry.closeError = /* @__PURE__ */ new Error("codex app-server client is closed");
 		return {
-			activeLeases: detachedEntry.activeLeases,
-			closed: false
+			activeLeases: entry.activeLeases,
+			closed: closeRetiredSharedClientEntry(entry)
 		};
 	}
+	return {
+		activeLeases: entry.activeLeases,
+		closed: currentEntry ? closeRetiredSharedClientEntryIfIdle(entry) : false
+	};
 }
 /** Gracefully retires exact clients attached to an older desktop generation. */
 function retireSharedCodexAppServerClientsBeforeDesktopGeneration(generation) {
 	const state = getSharedCodexAppServerClientState();
 	for (const entry of state.clients.values()) {
 		const client = entry.client;
-		const attached = client ? getCodexAppServerClientStartMetadata().get(client) : void 0;
+		const attached = client ? state.startMetadata.get(client) : void 0;
 		if (client && attached?.desktopGeneration && attached.desktopGeneration.epoch < generation.epoch) retireSharedCodexAppServerClientIfCurrent(client);
 	}
 }
@@ -7369,7 +7393,7 @@ function hasLiveOlderDesktopGenerationClient(params) {
 	return false;
 }
 function isOlderDesktopGenerationClientForHome(client, generation, targetHome) {
-	const metadata = getCodexAppServerClientStartMetadata().get(client);
+	const metadata = getSharedCodexAppServerClientState().startMetadata.get(client);
 	return Boolean(metadata?.desktopGeneration && metadata.desktopGeneration.epoch < generation.epoch && resolveCodexNativeConfigFenceKey({ client }) === targetHome);
 }
 function notifyDesktopGenerationDrainChecks(state) {
@@ -7379,26 +7403,35 @@ function notifyDesktopGenerationDrainChecks(state) {
 async function clearSharedCodexAppServerClientIfCurrentAndWait(client, options) {
 	if (!client) return false;
 	const state = getSharedCodexAppServerClientState();
-	for (const [key, entry] of state.clients) if (entry.client === client) {
-		state.clients.delete(key);
-		await client.closeAndWait(options);
-		return true;
-	}
-	return false;
+	const entry = getCurrentSharedClientEntry(client);
+	if (!entry) return false;
+	state.clients.delete(entry.key);
+	await client.closeAndWait(options);
+	return true;
 }
 /** Clears all shared clients and waits for their processes to exit. */
 async function clearSharedCodexAppServerClientAndWait(options) {
 	const state = getSharedCodexAppServerClientState();
-	const clients = collectSharedClients(state);
+	const lifetime = state.startup;
+	lifetime.controller.abort();
 	state.clients.clear();
-	await Promise.all(clients.map((client) => client.closeAndWait(options)));
+	const closing = Promise.all([...state.liveClients].map((client) => ownCodexStartup(lifetime, client.closeAndWait(options))));
+	closing.catch(() => void 0);
+	try {
+		while (lifetime.pending.size > 0) await Promise.allSettled(lifetime.pending);
+		await closing;
+	} finally {
+		if (state.startup === lifetime) state.startup = createStartupLifetime();
+	}
 }
 globalThis[SHARED_CODEX_APP_SERVER_CLIENT_DISPOSER] = clearSharedCodexAppServerClientAndWait;
 function getOrCreateSharedClientEntry(state, key) {
 	let entry = state.clients.get(key);
 	if (!entry) {
 		entry = {
+			key,
 			activeLeases: 0,
+			anonymousLeases: 0,
 			pendingAcquires: 0,
 			closeWhenIdle: false,
 			onStartedClientCallbacks: /* @__PURE__ */ new Set()
@@ -7407,53 +7440,34 @@ function getOrCreateSharedClientEntry(state, key) {
 	}
 	return entry;
 }
-function clearSharedClientEntryIfCurrent(key, client) {
+function getCurrentSharedClientEntry(client) {
 	const state = getSharedCodexAppServerClientState();
-	if (state.clients.get(key)?.client === client) state.clients.delete(key);
+	const entry = client ? state.entriesByClient.get(client) : void 0;
+	return entry && entry.client === client && state.clients.get(entry.key) === entry ? entry : void 0;
 }
 /** Clears a matching shared client only when no lease or acquire currently claims it. */
 function clearSharedCodexAppServerClientIfCurrentAndUnclaimed(client) {
-	if (!client) return {
-		found: false,
-		closed: false,
-		activeLeases: 0,
-		pendingAcquires: 0
-	};
-	const state = getSharedCodexAppServerClientState();
-	for (const [key, entry] of state.clients) if (entry.client === client) return {
-		found: true,
-		closed: closeSharedClientEntryIfUnclaimed(key, entry),
-		activeLeases: entry.activeLeases,
-		pendingAcquires: entry.pendingAcquires
-	};
+	const entry = getCurrentSharedClientEntry(client);
 	return {
-		found: false,
-		closed: false,
-		activeLeases: 0,
-		pendingAcquires: 0
+		found: entry !== void 0,
+		closed: entry ? closeSharedClientEntryIfUnclaimed(entry) : false,
+		activeLeases: entry?.activeLeases ?? 0,
+		pendingAcquires: entry?.pendingAcquires ?? 0
 	};
 }
-function retainPendingSharedClientAcquire(entry) {
+function retainSharedClientEntry(entry, counter = "activeLeases") {
 	let released = false;
-	entry.pendingAcquires += 1;
+	entry[counter] += 1;
 	return () => {
 		if (released) return;
 		released = true;
-		entry.pendingAcquires = Math.max(0, entry.pendingAcquires - 1);
-		closeRetiredSharedClientEntryIfIdle(entry);
-		notifyDesktopGenerationDrainChecks(getSharedCodexAppServerClientState());
+		releaseSharedClientEntry(entry, counter);
 	};
 }
-function retainSharedClientEntry(entry) {
-	let released = false;
-	entry.activeLeases += 1;
-	return () => {
-		if (released) return;
-		released = true;
-		entry.activeLeases = Math.max(0, entry.activeLeases - 1);
-		closeRetiredSharedClientEntryIfIdle(entry);
-		notifyDesktopGenerationDrainChecks(getSharedCodexAppServerClientState());
-	};
+function releaseSharedClientEntry(entry, counter) {
+	entry[counter] -= 1;
+	closeRetiredSharedClientEntryIfIdle(entry);
+	notifyDesktopGenerationDrainChecks(getSharedCodexAppServerClientState());
 }
 function closeRetiredSharedClientEntryIfIdle(entry) {
 	if (!entry.closeWhenIdle || entry.activeLeases > 0 || entry.pendingAcquires > 0 || !entry.client) return false;
@@ -7470,25 +7484,22 @@ function closeRetiredSharedClientEntry(entry) {
 	client.close();
 	return true;
 }
-function closeSharedClientEntryIfUnclaimed(key, entry) {
+function closeSharedClientEntryIfUnclaimed(entry) {
 	if (entry.activeLeases > 0 || entry.pendingAcquires > 0) return false;
 	const state = getSharedCodexAppServerClientState();
-	if (state.clients.get(key) !== entry) return false;
-	state.clients.delete(key);
+	if (state.clients.get(entry.key) !== entry) return false;
+	state.clients.delete(entry.key);
 	entry.client?.close();
 	return Boolean(entry.client);
 }
-function retirePendingSharedClientEntryIfUnclaimed(key, entry) {
+function retirePendingSharedClientEntryIfUnclaimed(entry) {
 	if (entry.activeLeases > 0 || entry.pendingAcquires > 0) return;
 	entry.startupAbort?.abort(/* @__PURE__ */ new Error("Codex app-server startup was abandoned"));
 	entry.closeWhenIdle = true;
 	const state = getSharedCodexAppServerClientState();
-	if (state.clients.get(key) === entry) state.clients.delete(key);
+	if (state.clients.get(entry.key) === entry) state.clients.delete(entry.key);
 	if (!entry.client) return;
 	closeRetiredSharedClientEntry(entry);
 }
-function collectSharedClients(state) {
-	return [...state.liveClients];
-}
 //#endregion
-export { assertCodexThreadResumeResponse as $, isJsonObject as $t, TURN_FINALIZE_DRAIN_ABORT_GRACE_MS as A, retainCodexAppServerLiveThread as At, isCodexAppServerIndeterminateRequestCancellationError as B, resolveCodexAppServerAuthProfileIdForAgent as Bt, withLeasedCodexAppServerClientStartSelectionRetry as C, ensureCodexAppServerClientRuntime as Ct, acquireCodexNativeConfigFence as D, protectCodexAppServerLiveThread as Dt, CodexThreadStartRequestError as E, isCodexAppServerLiveThreadClaimed as Et, withCodexStartupTimeout as F, readRecentCodexRateLimits as Ft, isUnsupportedCodexAppServerVersionError as G, resolveCodexManagedBundledMarketplacePath as Gt, isCodexAppServerOverloadError as H, resolveCodexAppServerFallbackApiKeyCacheKey as Ht, getCodexAppServerClientInstanceId as I, rememberCodexRateLimitsRead as It, CodexThreadDirectInputError as J, readCodexSessionMeta as Jt, resolveCodexAppServerClientInstanceId as K, assertNotSymlink as Kt, isCodexAppServerApprovalRequest as L, reconcileCodexComputerUseStartArtifacts as Lt, isCodexAppServerStartupError as M, withAbortableTimeout as Mt, resolveCodexGatewayTimeoutWithGraceMs as N, withTimeout$1 as Nt, createCodexDesktopGenerationService as O, readCodexClientSessionMeta as Ot, resolveCodexStartupTimeoutMs as P, readCodexRateLimitsRevision as Pt, assertCodexThreadForkResponse as Q, flattenCodexDynamicToolFunctions as Qt, isCodexAppServerBrokenPipeError as R, resolveCodexAppServerAuthAccountCacheKey as Rt, waitForCodexAppServerClientDesktopGenerationDrain as S, consumeCodexAppServerLiveThread as St, CodexThreadBindingConflictError as T, isCodexAppServerClientRuntimeLive as Tt, isCodexAppServerPrewriteRequestCancellationError as U, resolveCodexAppServerPreparedApiKeyCacheKey as Ut, isCodexAppServerIndeterminateTransportError as V, resolveCodexAppServerAuthProfileStore as Vt, isCodexAppServerRequestTimeoutError as W, resolveCodexAppServerPreparedAuthHandoff as Wt, assertCodexThreadAcceptsDirectInput as X, CODEX_INTERACTIVE_THREAD_SOURCE_KINDS as Xt, assertCodexModelListResponse as Y, CODEX_INTERACTIVE_CUSTOM_THREAD_SOURCES as Yt, assertCodexThreadForkParams as Z, CODEX_OPENCLAW_DIRECT_DYNAMIC_TOOL_NAMESPACE as Zt, retainSharedCodexAppServerClientByInstanceId as _, resolveCodexToolAbortTerminalReason as _t, clearSharedCodexAppServerClientIfCurrentAndUnclaimed as a, readCodexTurnCompletedNotification as at, retireSharedCodexAppServerClientsBeforeDesktopGeneration as b, withDynamicToolTranscriptDetails as bt, getLeasedSharedCodexAppServerClient as c, hasPendingDynamicToolTerminalDiagnostic as ct, readCodexAppServerClientDesktopGeneration as d, resolveDynamicToolCallTimeoutMs as dt, assertCodexThreadStartResponse as et, readCodexAppServerClientDesktopGenerationFingerprint as f, resolveTerminalDynamicToolBatchAction as ft, resolveCodexNativeConfigFenceKey as g, toCodexDynamicToolProtocolResponse as gt, releaseLeasedSharedCodexAppServerClient as h, toCodexDynamicToolProgressResponse as ht, clearSharedCodexAppServerClientIfCurrent as i, readCodexTurn as it, TURN_TERMINAL_SETTLEMENT_TIMEOUT_MS as j, unsubscribeCodexAppServerLiveThread as jt, CodexAppServerStartupError as k, releaseCodexAppServerLiveThread as kt, getSharedCodexAppServerClient as l, isDynamicToolTerminalDiagnosticEvent as lt, releaseCodexAppServerClientLease as m, shouldReleaseTurnAfterTerminalDynamicTool as mt, captureCodexAppServerClientLifetime as n, readCodexDynamicToolCallParams as nt, clearSharedCodexAppServerClientIfCurrentAndWait as o, createCodexElicitationResponse as ot, readCodexAppServerClientProcessIdentity as p, shouldBlockTerminalReleaseForNonTerminalDynamicToolResult as pt, CodexAppServerRpcError as q, isOpenClawManagedCodexThread as qt, captureSharedCodexAppServerCatalogLifetime as r, readCodexErrorNotification as rt, createIsolatedCodexAppServerClient as s, handleDynamicToolCallWithTimeout as st, assertCodexAppServerClientStartSelectionCurrent as t, assertCodexTurnStartResponse as tt, isCodexAppServerStartSelectionChangedError as u, isMatchingDynamicToolTerminalDiagnostic as ut, retainSharedCodexAppServerClientIfCurrent as v, createFailedDynamicToolResponse as vt, CodexAdoptedThreadActiveError as w, hasCodexAppServerLiveThread as wt, shared_client_exports as x, claimCodexAppServerLiveThread as xt, retireSharedCodexAppServerClientIfCurrent as y, withDynamicToolExecutionState as yt, isCodexAppServerConnectionClosedError as z, resolveCodexAppServerAuthProfileId as zt };
+export { assertCodexThreadForkParams as $, TURN_FINALIZE_DRAIN_ABORT_GRACE_MS as A, readCodexClientSessionMeta as At, isCodexAppServerIndeterminateRequestCancellationError as B, resolveCodexAppServerAuthAccountCacheKey as Bt, withLeasedCodexAppServerClientStartSelectionRetry as C, claimCodexAppServerLiveThread as Ct, acquireCodexNativeConfigFence as D, isCodexAppServerClientRuntimeLive as Dt, CodexThreadStartRequestError as E, hasCodexAppServerLiveThread as Et, withCodexStartupTimeout as F, withTimeout$1 as Ft, isUnsupportedCodexAppServerVersionError as G, resolveCodexAppServerPreparedApiKeyCacheKey as Gt, isCodexAppServerOverloadError as H, resolveCodexAppServerAuthProfileIdForAgent as Ht, getCodexAppServerClientInstanceId as I, readCodexRateLimitsRevision as It, isCodexThreadReadMissingError as J, assertNotSymlink as Jt, resolveCodexAppServerClientInstanceId as K, resolveCodexAppServerPreparedAuthHandoff as Kt, isCodexAppServerApprovalRequest as L, readRecentCodexRateLimits as Lt, isCodexAppServerStartupError as M, retainCodexAppServerLiveThread as Mt, resolveCodexGatewayTimeoutWithGraceMs as N, unsubscribeCodexAppServerLiveThread as Nt, createCodexDesktopGenerationService as O, isCodexAppServerLiveThreadClaimed as Ot, resolveCodexStartupTimeoutMs as P, withAbortableTimeout as Pt, assertCodexThreadAcceptsDirectInput as Q, isCodexAppServerBrokenPipeError as R, rememberCodexRateLimitsRead as Rt, waitForCodexAppServerClientDesktopGenerationDrain as S, withDynamicToolTranscriptDetails as St, CodexThreadBindingConflictError as T, ensureCodexAppServerClientRuntime as Tt, isCodexAppServerPrewriteRequestCancellationError as U, resolveCodexAppServerAuthProfileStore as Ut, isCodexAppServerIndeterminateTransportError as V, resolveCodexAppServerAuthProfileId as Vt, isCodexAppServerRequestTimeoutError as W, resolveCodexAppServerFallbackApiKeyCacheKey as Wt, assertCodexModelListResponse as X, readCodexSessionMeta as Xt, CodexThreadDirectInputError as Y, isOpenClawManagedCodexThread as Yt, assertCodexPassiveTurnItems as Z, retainSharedCodexAppServerClientByInstanceId as _, toCodexDynamicToolProgressResponse as _t, clearSharedCodexAppServerClientIfCurrentAndUnclaimed as a, readCodexErrorNotification as at, retireSharedCodexAppServerClientsBeforeDesktopGeneration as b, createFailedDynamicToolResponse as bt, getLeasedSharedCodexAppServerClient as c, createCodexElicitationResponse as ct, readCodexAppServerClientDesktopGeneration as d, isDynamicToolTerminalDiagnosticEvent as dt, assertCodexThreadForkResponse as et, readCodexAppServerClientDesktopGenerationFingerprint as f, isMatchingDynamicToolTerminalDiagnostic as ft, resolveCodexNativeConfigFenceKey as g, shouldReleaseTurnAfterTerminalDynamicTool as gt, releaseLeasedSharedCodexAppServerClient as h, shouldBlockTerminalReleaseForNonTerminalDynamicToolResult as ht, clearSharedCodexAppServerClientIfCurrent as i, readCodexDynamicToolCallParams as it, TURN_TERMINAL_SETTLEMENT_TIMEOUT_MS as j, releaseCodexAppServerLiveThread as jt, CodexAppServerStartupError as k, protectCodexAppServerLiveThread as kt, getSharedCodexAppServerClient as l, handleDynamicToolCallWithTimeout as lt, releaseCodexAppServerClientLease as m, resolveTerminalDynamicToolBatchAction as mt, captureCodexAppServerClientLifetime as n, assertCodexThreadStartResponse as nt, clearSharedCodexAppServerClientIfCurrentAndWait as o, readCodexTurn as ot, readCodexAppServerClientProcessIdentity as p, resolveDynamicToolCallTimeoutMs as pt, CodexAppServerRpcError as q, resolveCodexManagedBundledMarketplacePath as qt, captureSharedCodexAppServerCatalogLifetime as r, assertCodexTurnStartResponse as rt, createIsolatedCodexAppServerClient as s, readCodexTurnCompletedNotification as st, assertCodexAppServerClientStartSelectionCurrent as t, assertCodexThreadResumeResponse as tt, isCodexAppServerStartSelectionChangedError as u, hasPendingDynamicToolTerminalDiagnostic as ut, retainSharedCodexAppServerClientIfCurrent as v, toCodexDynamicToolProtocolResponse as vt, CodexAdoptedThreadActiveError as w, consumeCodexAppServerLiveThread as wt, shared_client_exports as x, withDynamicToolExecutionState as xt, retireSharedCodexAppServerClientIfCurrent as y, resolveCodexToolAbortTerminalReason as yt, isCodexAppServerConnectionClosedError as z, reconcileCodexComputerUseStartArtifacts as zt };