@openclaw/codex 2026.9.1 → 2026.9.2

package/dist/index.js

@@ -1,50 +1,52 @@
 import { registerCodexCliMetadata } from "./cli-metadata.js";
-import { n as createCodexAppServerNativeCompaction, t as createCodexAppServerAgentHarness } from "./harness-DXVZ5II5.js";
-import { $t as isJsonObject, B as isCodexAppServerIndeterminateRequestCancellationError, Bt as resolveCodexAppServerAuthProfileIdForAgent, C as withLeasedCodexAppServerClientStartSelectionRetry, Et as isCodexAppServerLiveThreadClaimed, G as isUnsupportedCodexAppServerVersionError, H as isCodexAppServerOverloadError, Ht as resolveCodexAppServerFallbackApiKeyCacheKey, J as CodexThreadDirectInputError, O as createCodexDesktopGenerationService, Rt as resolveCodexAppServerAuthAccountCacheKey, St as consumeCodexAppServerLiveThread, Tt as isCodexAppServerClientRuntimeLive, X as assertCodexThreadAcceptsDirectInput, Xt as CODEX_INTERACTIVE_THREAD_SOURCE_KINDS, _ as retainSharedCodexAppServerClientByInstanceId, b as retireSharedCodexAppServerClientsBeforeDesktopGeneration, c as getLeasedSharedCodexAppServerClient, et as assertCodexThreadStartResponse, h as releaseLeasedSharedCodexAppServerClient, kt as releaseCodexAppServerLiveThread, m as releaseCodexAppServerClientLease, o as clearSharedCodexAppServerClientIfCurrentAndWait, wt as hasCodexAppServerLiveThread } from "./shared-client-DxcfF9KX.js";
-import { E as readCodexPluginConfig, M as CODEX_PLUGINS_MARKETPLACE_NAME, O as resolveOpenClawExecPolicyForCodexAppServer, c as assertCodexAppServerConnectionSecurity, i as resolveCodexAppServerRuntimeOptions, m as canUseCodexModelBackedApprovalsReviewerForModel, n as codexSandboxPolicyForTurn, s as resolveCodexSupervisionAppServerRuntimeOptions, t as codexAppServerStartOptionsKey, y as readCodexRequirementsToml } from "./config-BhmfC1s6.js";
-import { a as setManagedCodexPluginRoot } from "./managed-binary-4-Vjz5GH.js";
+import { n as createCodexAppServerNativeCompaction, t as createCodexAppServerAgentHarness } from "./harness-Czh2Sdoc.js";
+import { m as CODEX_PLUGINS_MARKETPLACE_NAME } from "./config-utils-C57JiJrU.js";
+import { l as sessionBindingIdentity, s as readCurrentCodexAppServerBinding } from "./session-binding-record-CyaXZvTe.js";
+import { A as resolveOpenClawExecPolicyForCodexAppServer, B as isJsonObject, L as CODEX_INTERACTIVE_THREAD_SOURCE_KINDS, O as readCodexPluginConfig, c as assertCodexAppServerConnectionSecurity, i as resolveCodexAppServerRuntimeOptions, m as canUseCodexModelBackedApprovalsReviewerForModel, n as codexSandboxPolicyForTurn, s as resolveCodexSupervisionAppServerRuntimeOptions, t as codexAppServerStartOptionsKey, y as readCodexRequirementsToml } from "./config-CyapYSji.js";
+import { B as isCodexAppServerIndeterminateRequestCancellationError, Bt as resolveCodexAppServerAuthAccountCacheKey, C as withLeasedCodexAppServerClientStartSelectionRetry, Dt as isCodexAppServerClientRuntimeLive, Et as hasCodexAppServerLiveThread, G as isUnsupportedCodexAppServerVersionError, H as isCodexAppServerOverloadError, Ht as resolveCodexAppServerAuthProfileIdForAgent, O as createCodexDesktopGenerationService, Ot as isCodexAppServerLiveThreadClaimed, Q as assertCodexThreadAcceptsDirectInput, Wt as resolveCodexAppServerFallbackApiKeyCacheKey, Y as CodexThreadDirectInputError, _ as retainSharedCodexAppServerClientByInstanceId, b as retireSharedCodexAppServerClientsBeforeDesktopGeneration, c as getLeasedSharedCodexAppServerClient, h as releaseLeasedSharedCodexAppServerClient, jt as releaseCodexAppServerLiveThread, m as releaseCodexAppServerClientLease, nt as assertCodexThreadStartResponse, o as clearSharedCodexAppServerClientIfCurrentAndWait, wt as consumeCodexAppServerLiveThread } from "./shared-client-CKhX2kFt.js";
+import { a as setManagedCodexPluginRoot } from "./managed-binary-DcpnJF9x.js";
 import { n as CODEX_APP_SERVER_BINDING_NAMESPACE, t as CODEX_APP_SERVER_BINDING_MAX_ENTRIES } from "./session-binding-meta-B7aEMU7g.js";
-import { d as sessionBindingIdentity, n as assertCodexBindingMayBeReplaced, o as isCodexAppServerNativeAuthProfile, s as normalizeCodexAppServerBindingModelProvider } from "./session-binding-BHuTCRZQ.js";
-import { o as createCodexAppServerProcessReaperService } from "./transport-stdio-CyPldczm.js";
-import { a as closeCodexStartupClientBestEffort, c as isCodexAppServerUnsafeSubscriptionError, d as unsubscribeCodexThreadBestEffort, h as isCodexNotificationForTurn, l as retireUnsafeCodexTurnClientBestEffort, o as interruptCodexTurnAndWaitBestEffort, p as getCodexAppServerTurnRouter } from "./attempt-client-cleanup-DYHcRQAa.js";
-import { o as isAssistantCommentaryCompletionNotification } from "./event-projector-usage-C5mcrGjp.js";
-import { i as buildCodexPluginAppCacheKey, s as defaultCodexAppInventoryCache, t as resumeCodexAppServerThread } from "./thread-resume-C7pyVKeW.js";
-import { Dt as mergeCodexThreadConfigs, E as resolveCodexAppServerRequestModelSelection, Et as buildDisabledAppsConfigPatch, J as createCodexManagedThreadStore, K as CODEX_MANAGED_THREAD_MAX_ENTRIES, Nt as pluginReadParams, jt as isOpenAiCuratedMarketplace, k as buildCodexProjectDocThreadConfig, kt as ensureCodexPluginActivation, q as CODEX_MANAGED_THREAD_NAMESPACE, w as CODEX_NATIVE_PERSONALITY_NONE } from "./thread-lifecycle-DAcEJ_Om.js";
-import { a as rollbackCodexAppServerBindingSubscription, c as withExclusiveCodexAppServerThread, i as retireCodexConversationThreadBinding, l as isIncognitoSessionKey, n as releaseCodexAppServerBindingSubscription, r as retainCodexAppServerBindingSubscription, s as withCodexConversationThreadActivity, t as isSameCodexAppServerThreadOwner } from "./thread-ownership-zGokd8i1.js";
-import { p as projectBoundedCodexVisibleSessionHistory } from "./transcript-mirror-DTUxFWa_.js";
-import { c as resolveCodexNativeSandboxBlock, i as requestCodexAppServerJson, o as withCodexAppServerJsonClient, s as resolveCodexNativeExecutionBlock } from "./request-DYAI5FQE.js";
+import { a as isCodexAppServerNativeAuthProfile, n as assertCodexBindingMayBeReplaced, o as normalizeCodexAppServerBindingModelProvider } from "./session-binding-4Ki04sW-.js";
+import { o as createCodexAppServerProcessReaperService } from "./transport-stdio-CzTngV0j.js";
+import { a as closeCodexStartupClientBestEffort, d as unsubscribeCodexThreadBestEffort, h as isCodexNotificationForTurn, l as retireUnsafeCodexTurnClientBestEffort, o as interruptCodexTurnAndWaitBestEffort, p as getCodexAppServerTurnRouter, s as isCodexAppServerUnsafeSubscriptionError } from "./attempt-client-cleanup-Bp1ZOnk2.js";
+import { i as isAssistantCommentaryCompletionNotification } from "./event-projector-usage-ZqEVbAEY.js";
+import { c as defaultCodexAppInventoryCache, i as buildCodexPluginAppCacheKey, t as resumeCodexAppServerThread } from "./thread-resume-BLgqkUc1.js";
+import { E as resolveCodexAppServerRequestModelSelection, Et as mergeCodexThreadConfigs, J as createCodexManagedThreadStore, K as CODEX_MANAGED_THREAD_MAX_ENTRIES, Nt as pluginReadParams, Tt as buildDisabledAppsConfigPatch, jt as isOpenAiCuratedMarketplace, k as buildCodexProjectDocThreadConfig, kt as ensureCodexPluginActivation, q as CODEX_MANAGED_THREAD_NAMESPACE, w as CODEX_NATIVE_PERSONALITY_NONE } from "./thread-lifecycle-DPK30jad.js";
+import { a as rollbackCodexAppServerBindingSubscription, c as withExclusiveCodexAppServerThread, i as retireCodexConversationThreadBinding, l as isIncognitoSessionKey, n as releaseCodexAppServerBindingSubscription, r as retainCodexAppServerBindingSubscription, s as withCodexConversationThreadActivity, t as isSameCodexAppServerThreadOwner } from "./thread-ownership-CbucAmmp.js";
+import { s as resolveCodexBindingAppServerConnection } from "./thread-policy-CTalhWFy.js";
+import { c as projectBoundedCodexVisibleSessionHistory } from "./transcript-mirror-_njEB84z.js";
+import { c as resolveCodexNativeSandboxBlock, i as requestCodexAppServerJson, o as withCodexAppServerJsonClient, s as resolveCodexNativeExecutionBlock } from "./request-C8H22rPi.js";
 import { buildCodexMediaUnderstandingProvider } from "./media-understanding-provider.js";
-import { n as describeControlFailure, t as CODEX_CONTROL_METHODS } from "./capabilities-dIjNVCYH.js";
-import { a as formatCodexDisplayText } from "./command-formatters-CLHhEB1Q.js";
-import { a as resolveCodexAppServerForModelProvider, i as resolveCodexSessionPermissionCwd, n as applyCodexSessionPermissionPolicy, t as CODEX_SESSION_PERMISSION_EXEC_MODES } from "./session-permission-policy-DeWVTCMj.js";
-import { f as trackCodexConversationActiveTurn, g as canMutateCodexHost, h as CODEX_NATIVE_EXECUTION_AUTH_ERROR, t as discoverCodexMarketplacePlugins } from "./plugin-marketplace-discovery-CfFlKqDl.js";
+import { n as describeControlFailure, t as CODEX_CONTROL_METHODS } from "./capabilities-B1mgvpP8.js";
+import { a as formatCodexDisplayText } from "./command-formatters-DSbGMXA0.js";
+import { a as resolveCodexAppServerForModelProvider, i as resolveCodexSessionPermissionCwd, n as applyCodexSessionPermissionPolicy, t as CODEX_SESSION_PERMISSION_EXEC_MODES } from "./session-permission-policy-BaueHmSj.js";
+import { f as trackCodexConversationActiveTurn, g as canMutateCodexHost, h as CODEX_NATIVE_EXECUTION_AUTH_ERROR, t as discoverCodexMarketplacePlugins } from "./plugin-marketplace-discovery-B7gHXJ3d.js";
 import { a as readCodexConversationBindingDataRecord, i as readCodexConversationBindingData, o as resolveCodexDefaultWorkspaceDir, r as createCodexConversationBindingData } from "./conversation-binding-data-BiodpIzq.js";
-import { n as resolveCodexBindingAppServerConnection } from "./binding-connection-E6uDsPlx.js";
-import { d as createCodexCliSessionNodeHostCommands, f as createCodexCliSessionNodeInvokePolicies, g as resumeCodexCliSessionOnNode, h as resolveCodexCliSessionForBindingOnNode, i as createCodexSessionCatalogNodeHostCommands, m as listCodexCliSessionsOnNode, n as createCodexSessionCatalogNodeInvokePolicies, o as assertCodexArchiveDescendantsUnowned, r as createCodexSessionCatalogControl, s as codexControlRequest, t as codexSessionCatalogRuntime } from "./session-catalog-yyvTWFOw.js";
+import { d as createCodexCliSessionNodeHostCommands, f as createCodexCliSessionNodeInvokePolicies, g as resumeCodexCliSessionOnNode, h as resolveCodexCliSessionForBindingOnNode, i as createCodexSessionCatalogNodeHostCommands, m as listCodexCliSessionsOnNode, n as createCodexSessionCatalogNodeInvokePolicies, o as assertCodexArchiveDescendantsUnowned, r as createCodexSessionCatalogControl, s as codexControlRequest, t as codexSessionCatalogRuntime } from "./session-catalog-B47uwekb.js";
 import { t as createCodexWebSearchProviderBase } from "./web-search-provider.shared-BrZmlqyR.js";
 import { mutateConfigFile } from "openclaw/plugin-sdk/config-mutation";
 import { normalizePluginsConfig, resolveEffectiveEnableState, resolveLivePluginConfigObject, resolvePluginConfigObject } from "openclaw/plugin-sdk/plugin-config-runtime";
 import { definePluginEntry } from "openclaw/plugin-sdk/plugin-entry";
 import { asBoolean, asOptionalRecord, asSafeIntegerInRange, isRecord, normalizeOptionalString, normalizeSingleOrTrimmedStringList, uniqueStrings } from "openclaw/plugin-sdk/string-coerce-runtime";
+import { resolveSessionAgentIdsStrict } from "openclaw/plugin-sdk/agent-scope-runtime";
+import { getSessionEntry, resolveStorePath, resolveTranscriptSessionKeyBySessionId } from "openclaw/plugin-sdk/session-store-runtime";
+import { parseStrictNonNegativeInteger, resolveTimerTimeoutMs } from "openclaw/plugin-sdk/number-runtime";
 import fs from "node:fs/promises";
 import path from "node:path";
-import { parseStrictNonNegativeInteger, resolveTimerTimeoutMs } from "openclaw/plugin-sdk/number-runtime";
 import { embeddedAgentLog, formatErrorMessage, resolveActiveEmbeddedRunSessionId, resolveSandboxContext } from "openclaw/plugin-sdk/agent-harness-runtime";
 import { canonicalPathFromExistingAncestor, isPathInside } from "openclaw/plugin-sdk/file-access-runtime";
 import os from "node:os";
-import { loadAuthProfileStoreWithoutExternalProfiles, resolveAgentConfig, resolveAgentWorkspaceDir, resolveDefaultAgentDir, resolveDefaultAgentId } from "openclaw/plugin-sdk/agent-runtime";
+import { loadAuthProfileStoreWithoutExternalProfiles, resolveAgentConfig as resolveAgentConfig$1, resolveAgentWorkspaceDir, resolveDefaultAgentDir, resolveDefaultAgentId as resolveDefaultAgentId$1 } from "openclaw/plugin-sdk/agent-runtime";
 import { applyAuthProfileConfig, buildApiKeyCredential, buildOauthProviderAuthResult, buildOpenAICodexCredentialExtra, readCodexCliCredentialsCached, resolveOpenAICodexAuthIdentity, resolveOpenAICodexImportProfileName, updateAuthProfileStoreWithLock } from "openclaw/plugin-sdk/provider-auth";
 import { extractErrorCode, pathExists } from "openclaw/plugin-sdk/security-runtime";
-import { resolveSessionAgentIdsStrict } from "openclaw/plugin-sdk/agent-scope-runtime";
 import { loadExecApprovals } from "openclaw/plugin-sdk/exec-approvals-runtime";
-import { getSessionEntry, resolveStorePath, resolveTranscriptSessionKeyBySessionId } from "openclaw/plugin-sdk/session-store-runtime";
 import { coerceErrorMessage } from "openclaw/plugin-sdk/error-runtime";
-import { fileURLToPath } from "node:url";
 import { expectDefined } from "openclaw/plugin-sdk/expect-runtime";
 import { KeyedAsyncQueue } from "openclaw/plugin-sdk/keyed-async-queue";
 import { readVisibleSessionTranscriptMessageEntries } from "openclaw/plugin-sdk/session-transcript-runtime";
 import { getSessionBindingService } from "openclaw/plugin-sdk/conversation-binding-runtime";
 import { ModelSelectionLockedError, isModelSelectionLocked } from "openclaw/plugin-sdk/model-session-runtime";
+import { fileURLToPath } from "node:url";
 import { MIGRATION_REASON_TARGET_EXISTS, applyMigrationManualItem, createMigrationItem, createMigrationManualItem, hasMigrationConfigPatchConflict, markMigrationItemConflict, markMigrationItemError, markMigrationItemSkipped, mergeMigrationConfigValue, readMigrationConfigPath, resolveMigrationConfigRuntime, summarizeMigrationItems, writeMigrationConfigPath } from "openclaw/plugin-sdk/migration";
 import { archiveMigrationItem, copyMemoryMigrationFileItem, copyMigrationFileItem, withCachedMigrationConfigRuntime, writeMigrationReport } from "openclaw/plugin-sdk/migration-runtime";
 import { sleep } from "openclaw/plugin-sdk/runtime-env";
@@ -177,18 +179,18 @@ function waitForReconnect(delayMs, signal) {
 }
 //#endregion
 //#region extensions/codex/src/app-server/session-binding-store.ts
-/** Defers schema compilation and auth loading until the first binding operation. */
+/** Keeps lifecycle/auth loading behind mutations while sharing the canonical read codec. */
 function createLazyCodexAppServerBindingStore(state, managedThreadState) {
 	let resolved;
-	const store = () => resolved ??= import("./session-binding-BHuTCRZQ.js").then((n) => n.f).then(({ createCodexAppServerBindingStore }) => createCodexAppServerBindingStore(state));
+	const store = () => resolved ??= import("./session-binding-4Ki04sW-.js").then((n) => n.d).then(({ createCodexAppServerBindingStore }) => createCodexAppServerBindingStore(state));
 	const managedThreads = managedThreadState ? createCodexManagedThreadStore(managedThreadState) : void 0;
 	return {
 		...managedThreads ? { managedThreads } : {},
-		read: async (identity) => (await store()).read(identity),
+		read: (identity) => readCurrentCodexAppServerBinding(state, identity),
 		hasOtherThreadOwner: async (threadId, currentIdentity) => (await store()).hasOtherThreadOwner(threadId, currentIdentity),
 		mutate: async (identity, mutation, assertCurrent) => (await store()).mutate(identity, mutation, assertCurrent),
 		prepareSessionGenerationReclaim: async (identity) => (await store()).prepareSessionGenerationReclaim(identity),
-		adoptSessionGeneration: async (identity, previousSessionId) => (await store()).adoptSessionGeneration(identity, previousSessionId),
+		adoptSessionGeneration: async (identity, previousSessionId, assertCurrent) => (await store()).adoptSessionGeneration(identity, previousSessionId, assertCurrent),
 		resetSessionGeneration: async (identity) => (await store()).resetSessionGeneration(identity),
 		retireSessionGeneration: async (identity) => (await store()).retireSessionGeneration(identity),
 		withSessionDeletion: async (identity, assertCurrent, run) => (await store()).withSessionDeletion(identity, assertCurrent, run),
@@ -211,7 +213,7 @@ async function handleCodexCommand(ctx, options) {
 	}
 }
 async function loadDefaultCodexSubcommandHandler() {
-	const { handleCodexSubcommand } = await import("./command-handlers-CTGb2csu.js");
+	const { handleCodexSubcommand } = await import("./command-handlers-DOJvGv6-.js");
 	return handleCodexSubcommand;
 }
 //#endregion
@@ -502,7 +504,7 @@ async function startCodexConversationThread(params) {
 		sessionKey: params.sessionKey,
 		config: params.config
 	});
-	const existingBinding = await params.bindingStore.read(identity);
+	const existingBinding = params.bindingStore.read(identity);
 	assertCodexBindingMayBeReplaced(existingBinding, "starting a conversation-bound Codex thread");
 	const authProfileId = resolveCodexAppServerAuthProfileIdForAgent({
 		authProfileId: params.authProfileId ?? existingBinding?.authProfileId,
@@ -533,7 +535,7 @@ async function startCodexConversationThread(params) {
 		run: bind
 	});
 	else await bind();
-	const storedBinding = await params.bindingStore.read(identity);
+	const storedBinding = params.bindingStore.read(identity);
 	if (!storedBinding) throw new Error("Codex session binding disappeared while starting its conversation thread.");
 	return createCodexConversationBindingData({
 		source: {
@@ -602,7 +604,7 @@ async function handleCodexConversationInboundClaim(event, ctx, options) {
 		const identity = conversationBindingIdentity(data);
 		const sessionKey = event.sessionKey ?? ctx.sessionKey;
 		const incognito = isIncognitoSessionKey(data.source?.sessionKey ?? (data.legacyBinding ? sessionKey : void 0));
-		const queuedOwner = options.bindingStore.read(identity);
+		const expected = options.bindingStore.read(identity);
 		return {
 			handled: true,
 			reply: (await withCodexConversationThreadActivity(data.bindingId, async () => {
@@ -612,8 +614,7 @@ async function handleCodexConversationInboundClaim(event, ctx, options) {
 					conversationId: publicBinding.conversationId,
 					...publicBinding.parentConversationId ? { parentConversationId: publicBinding.parentConversationId } : {}
 				});
-				const expected = await queuedOwner;
-				const current = await options.bindingStore.read(identity);
+				const current = options.bindingStore.read(identity);
 				if (currentPublicBinding?.bindingId !== publicBinding.bindingId || expected && (!current || current.threadId !== expected.threadId || current.conversationStartId !== expected.conversationStartId) || !expected && current && data.start?.id && current.conversationStartId !== data.start.id) return { reply: { text: "This Codex conversation was detached or changed before its message could run." } };
 				return await runBoundTurnWithMissingThreadRecovery({
 					bindingStore: options.bindingStore,
@@ -640,7 +641,7 @@ async function handleCodexConversationBindingResolved(event, options) {
 	const data = readCodexConversationBindingDataRecord(event.request.data ?? {});
 	if (!data || data.kind !== "codex-app-server-session") return;
 	const identity = conversationBindingIdentity(data);
-	const binding = await options.bindingStore.read(identity);
+	const binding = options.bindingStore.read(identity);
 	assertCodexBindingMayBeReplaced(binding, "clearing a denied conversation binding");
 	if (binding && (!data.start?.id || binding.conversationStartId === data.start.id)) await withCodexConversationThreadActivity(identity.bindingId, () => retireCodexConversationThreadBinding({
 		bindingStore: options.bindingStore,
@@ -721,8 +722,7 @@ function buildConversationThreadRequest(resolved, serviceTier) {
 }
 function codexConversationSandboxOrPermissions(runtime, sandbox) {
 	const networkProxy = runtime.networkProxy;
-	const disabledApps = mergeCodexThreadConfigs(buildDisabledAppsConfigPatch(), { "features.apps": false });
-	const config = buildCodexProjectDocThreadConfig(mergeCodexThreadConfigs(networkProxy?.configPatch, disabledApps));
+	const config = buildCodexProjectDocThreadConfig(mergeCodexThreadConfigs(networkProxy?.configPatch, buildDisabledAppsConfigPatch()));
 	return networkProxy ? { config } : {
 		sandbox,
 		config
@@ -732,7 +732,7 @@ async function writeThreadBindingFromResponse(params, resolved, client, response
 	let retained = false;
 	let sameOwner = false;
 	try {
-		const current = await params.bindingStore.read(params.identity);
+		const current = params.bindingStore.read(params.identity);
 		assertCodexBindingMayBeReplaced(current, "storing a conversation-bound Codex thread");
 		const trackSubscription = !params.incognito && isCodexAppServerClientRuntimeLive(client);
 		sameOwner = isSameCodexAppServerThreadOwner(current, {
@@ -774,7 +774,7 @@ async function writeThreadBindingFromResponse(params, resolved, client, response
 	}
 }
 async function bindThread(params, threadId) {
-	const current = await params.bindingStore.read(params.identity);
+	const current = params.bindingStore.read(params.identity);
 	assertCodexBindingMayBeReplaced(current, "binding a conversation-bound Codex thread");
 	const resolved = await resolveThreadBindingRuntime(params);
 	const clientLease = { client: await getLeasedSharedCodexAppServerClient(resolved.clientOptions) };
@@ -823,14 +823,14 @@ async function runBoundTurn(params) {
 		config: params.config
 	});
 	const identity = conversationBindingIdentity(params.data);
-	const binding = await params.bindingStore.read(identity);
+	const binding = params.bindingStore.read(identity);
 	if (!binding?.threadId) throw new Error("bound Codex conversation has no thread binding");
 	return await withExclusiveCodexAppServerThread({
 		bindingStore: params.bindingStore,
 		identity,
 		threadId: binding.threadId,
 		run: async () => {
-			const current = await params.bindingStore.read(identity);
+			const current = params.bindingStore.read(identity);
 			if (!isSameCodexAppServerThreadOwner(current, binding)) throw new Error("Codex conversation binding changed before its turn.");
 			assertCodexBindingMayBeReplaced(binding, "running a conversation-bound Codex thread");
 			let threadId = binding.threadId;
@@ -1082,7 +1082,7 @@ async function runBoundTurn(params) {
 						const currentLiveThreadOwnership = liveThreadOwnership?.client === client && liveThreadOwnership.threadId === threadId ? liveThreadOwnership.ownership : void 0;
 						let retained = false;
 						if (turnSucceeded) retained = await params.bindingStore.withLease(identity, async () => {
-							const latest = await params.bindingStore.read(identity);
+							const latest = params.bindingStore.read(identity);
 							if (latest?.threadId !== threadId || latest.clientId !== client.getInstanceId()) return false;
 							return await retainCodexAppServerBindingSubscription(client, threadId, currentLiveThreadOwnership);
 						});
@@ -1121,9 +1121,9 @@ async function runBoundTurnWithMissingThreadRecovery(params) {
 }
 async function prepareConversationBinding(params, options = {}) {
 	const identity = conversationBindingIdentity(params.data);
-	const snapshot = await params.bindingStore.read(identity);
+	const snapshot = params.bindingStore.read(identity);
 	const run = () => params.bindingStore.withLease(identity, async () => {
-		const current = await params.bindingStore.read(identity);
+		const current = params.bindingStore.read(identity);
 		if (current?.threadId !== snapshot?.threadId || current?.clientId !== snapshot?.clientId) throw new Error("Codex conversation binding changed before preparation.");
 		const requested = params.data.start && current?.conversationStartId !== params.data.start.id ? params.data.start : void 0;
 		if (current && !requested && !options.forceNew) return;
@@ -1133,7 +1133,7 @@ async function prepareConversationBinding(params, options = {}) {
 			sessionKey: params.data.source.sessionKey,
 			config: params.config
 		}) : void 0;
-		const sourceBinding = sourceIdentity ? await params.bindingStore.read(sourceIdentity) : void 0;
+		const sourceBinding = sourceIdentity ? params.bindingStore.read(sourceIdentity) : void 0;
 		assertCodexBindingMayBeReplaced(current, "initializing a conversation-bound Codex thread");
 		assertCodexBindingMayBeReplaced(sourceBinding, "transferring a session into a conversation-bound Codex thread");
 		const inherited = current ?? sourceBinding;
@@ -1159,10 +1159,10 @@ async function prepareConversationBinding(params, options = {}) {
 		};
 		const threadId = requested?.threadId;
 		await bindThread(bindingParams, options.forceNew ? void 0 : threadId);
-		const stored = await params.bindingStore.read(identity);
+		const stored = params.bindingStore.read(identity);
 		if (!stored) throw new Error("Codex conversation binding disappeared while initializing its thread.");
 		if (sourceIdentity && params.data.source && !current?.conversationSourceTransferComplete) await params.bindingStore.withLease(sourceIdentity, async () => {
-			const source = await params.bindingStore.read(sourceIdentity);
+			const source = params.bindingStore.read(sourceIdentity);
 			if (source && source.threadId === params.data.source?.threadId) {
 				const sourceSessionKey = sourceIdentity.sessionKey ?? resolveTranscriptSessionKeyBySessionId({
 					agentId: sourceIdentity.agentId,
@@ -2130,9 +2130,9 @@ function sanitizePluginName(value) {
 //#region extensions/codex/src/migration/targets.ts
 function resolveCodexMigrationTargets(ctx) {
 	const cfg = ctx.config;
-	const agentId = ctx.targetAgentId ?? resolveDefaultAgentId(cfg);
+	const agentId = ctx.targetAgentId ?? resolveDefaultAgentId$1(cfg);
 	const workspaceDir = resolveAgentWorkspaceDir(cfg, agentId);
-	const configuredAgentDir = resolveAgentConfig(cfg, agentId)?.agentDir?.trim();
+	const configuredAgentDir = resolveAgentConfig$1(cfg, agentId)?.agentDir?.trim();
 	return {
 		workspaceDir,
 		agentDir: ctx.runtime?.agent?.resolveAgentDir(cfg, agentId) ?? (configuredAgentDir ? resolveHomePath(configuredAgentDir) : void 0) ?? path.join(ctx.stateDir, "agents", agentId, "agent")
@@ -2874,7 +2874,7 @@ function createCodexPluginsTool(options) {
 			const marketplace = typeof params.marketplace === "string" ? params.marketplace.trim() : void 0;
 			const limit = typeof params.limit === "number" && Number.isInteger(params.limit) ? Math.max(1, Math.min(params.limit, 20)) : 12;
 			const pluginConfig = options.getPluginConfig();
-			const binding = options.context.sessionId ? await options.bindingStore.read(sessionBindingIdentity({
+			const binding = options.context.sessionId ? options.bindingStore.read(sessionBindingIdentity({
 				sessionId: options.context.sessionId,
 				sessionKey: options.context.sessionKey,
 				agentId: options.context.agentId,
@@ -3049,11 +3049,11 @@ function createCodexThreadsTool(options) {
 		agentId: options.context.agentId,
 		config: runtimeConfig()
 	});
-	const currentBinding = async (session) => session ? await options.bindingStore.read(currentIdentity(session.sessionId)) : void 0;
-	const requestOptions = async (pluginConfig) => {
+	const currentBinding = (session) => session ? options.bindingStore.read(currentIdentity(session.sessionId)) : void 0;
+	const requestOptions = (pluginConfig) => {
 		const plugin = readCodexPluginConfig(pluginConfig);
 		const session = currentSession();
-		const binding = await currentBinding(session);
+		const binding = currentBinding(session);
 		if (binding?.connectionScope === "supervision") {
 			const connection = resolveCodexBindingAppServerConnection({
 				binding,
@@ -3114,7 +3114,7 @@ function createCodexThreadsTool(options) {
 					sourceKinds: [...CODEX_INTERACTIVE_THREAD_SOURCE_KINDS],
 					...cursor ? { cursor } : {},
 					...searchTerm ? { searchTerm } : {}
-				}, await requestOptions(pluginConfig));
+				}, requestOptions(pluginConfig));
 				return jsonResult(mayReadRawTranscripts ? response : redactNativeThreadResponse(response));
 			}
 			const threadId = readThreadId(params);
@@ -3124,7 +3124,7 @@ function createCodexThreadsTool(options) {
 				const response = await request(pluginConfig, CODEX_CONTROL_METHODS.readThread, {
 					threadId,
 					includeTurns
-				}, await requestOptions(pluginConfig));
+				}, requestOptions(pluginConfig));
 				return jsonResult(mayReadRawTranscripts ? response : redactNativeThreadResponse(response));
 			}
 			if ((action === "fork" || action === "rename" || action === "archive" || action === "unarchive") && supervision?.enabled === true && supervision.allowWriteControls !== true) throw new Error("Codex native thread mutations are disabled for this codex plugin supervision config.");
@@ -3136,7 +3136,7 @@ function createCodexThreadsTool(options) {
 				await request(pluginConfig, CODEX_CONTROL_METHODS.renameThread, {
 					threadId,
 					name
-				}, await requestOptions(pluginConfig));
+				}, requestOptions(pluginConfig));
 				return jsonResult({
 					action,
 					threadId,
@@ -3144,17 +3144,17 @@ function createCodexThreadsTool(options) {
 				});
 			}
 			if (action === "unarchive") {
-				const response = await request(pluginConfig, CODEX_CONTROL_METHODS.unarchiveThread, { threadId }, await requestOptions(pluginConfig));
+				const response = await request(pluginConfig, CODEX_CONTROL_METHODS.unarchiveThread, { threadId }, requestOptions(pluginConfig));
 				return jsonResult(mayReadRawTranscripts ? response : redactNativeThreadResponse(response));
 			}
 			const session = currentSession();
-			const binding = await currentBinding(session);
+			const binding = currentBinding(session);
 			if (action === "archive") {
 				if (params.confirm !== true) throw new Error("confirm=true is required to archive a native Codex thread");
 				if (!session) throw new Error("cannot safely archive a native Codex thread without a session identity");
 				const identity = currentIdentity(session.sessionId);
 				await options.bindingStore.withThreadArchiveFence(async () => {
-					const archivedBinding = await currentBinding(session);
+					const archivedBinding = currentBinding(session);
 					if (archivedBinding?.threadId === threadId) {
 						if (session.modelSelectionLocked) throw new ModelSelectionLockedError();
 						assertCodexBindingMayBeReplaced(archivedBinding, "archiving its bound native thread");
@@ -3162,20 +3162,20 @@ function createCodexThreadsTool(options) {
 					assertThreadMayBeArchived(await request(pluginConfig, CODEX_CONTROL_METHODS.readThread, {
 						threadId,
 						includeTurns: false
-					}, await requestOptions(pluginConfig)), threadId);
+					}, requestOptions(pluginConfig)), threadId);
 					if (await options.bindingStore.hasOtherThreadOwner(threadId, identity)) throw new Error("cannot archive a native Codex thread owned by another OpenClaw session");
 					await assertCodexArchiveDescendantsUnowned({
 						bindingStore: options.bindingStore,
 						threadId,
-						listPage: async (listParams) => await request(pluginConfig, CODEX_CONTROL_METHODS.listThreads, listParams, await requestOptions(pluginConfig)),
+						listPage: async (listParams) => await request(pluginConfig, CODEX_CONTROL_METHODS.listThreads, listParams, requestOptions(pluginConfig)),
 						assertDescendantIdle: async (descendantThreadId) => {
 							assertThreadMayBeArchived(await request(pluginConfig, CODEX_CONTROL_METHODS.readThread, {
 								threadId: descendantThreadId,
 								includeTurns: false
-							}, await requestOptions(pluginConfig)), descendantThreadId);
+							}, requestOptions(pluginConfig)), descendantThreadId);
 						}
 					});
-					await request(pluginConfig, CODEX_CONTROL_METHODS.archiveThread, { threadId }, await requestOptions(pluginConfig));
+					await request(pluginConfig, CODEX_CONTROL_METHODS.archiveThread, { threadId }, requestOptions(pluginConfig));
 					if (archivedBinding?.threadId === threadId) await options.bindingStore.mutate(identity, {
 						kind: "clear",
 						threadId
@@ -3197,13 +3197,13 @@ function createCodexThreadsTool(options) {
 				assertThreadMayBeForked(await request(pluginConfig, CODEX_CONTROL_METHODS.readThread, {
 					threadId,
 					includeTurns: false
-				}, await requestOptions(pluginConfig)), threadId);
+				}, requestOptions(pluginConfig)), threadId);
 			}
 			const response = await request(pluginConfig, CODEX_CONTROL_METHODS.forkThread, {
 				threadId,
 				threadSource: "user",
 				excludeTurns: true
-			}, await requestOptions(pluginConfig));
+			}, requestOptions(pluginConfig));
 			if (!isJsonObject(response) || !isJsonObject(response.thread)) throw new Error("Codex app-server returned an invalid thread/fork response");
 			const forkThreadId = typeof response.thread.id === "string" && response.thread.id.trim() ? response.thread.id : void 0;
 			if (!forkThreadId) throw new Error("Codex app-server thread/fork response did not include a thread id");
@@ -3277,7 +3277,7 @@ function createCodexNodeExecServerCommand() {
 			try {
 				if (!context.prepareExecAuthorization) throw new Error("Codex node execution requires node-local exec policy support; update the node.");
 				const assertExecAuthorized = context.prepareExecAuthorization(request.authorization);
-				const { runCodexNodeExecServer } = await import("./node-exec-server.runtime-CstNHCmC.js");
+				const { runCodexNodeExecServer } = await import("./node-exec-server.runtime-nfbUOtUB.js");
 				return await runCodexNodeExecServer({
 					workspaceDir: workspace.workspaceDir,
 					io,
@@ -4157,7 +4157,7 @@ function createCodexSupervisionTools(options) {
 }
 //#endregion
 //#region extensions/codex/src/web-search-provider.ts
-const loadCodexWebSearchRuntime = createLazyRuntimeModule(() => import("./web-search-provider.runtime-D2FWSK4w.js"));
+const loadCodexWebSearchRuntime = createLazyRuntimeModule(() => import("./web-search-provider.runtime-DKQn67A7.js"));
 const CodexWebSearchSchema = {
 	type: "object",
 	properties: { query: {
@@ -4387,22 +4387,6 @@ var codex_default = definePluginEntry({
 			})
 		}));
 		api.onConversationBindingResolved?.((event) => codexConversationBindingRuntime.handleBindingResolved(event, { bindingStore }));
-		api.on("after_compaction", async (event, ctx) => {
-			const previousSessionId = event.previousSessionId?.trim();
-			const sessionId = ctx.sessionId?.trim();
-			if (!previousSessionId || !sessionId || previousSessionId === sessionId) return;
-			const config = resolveCurrentConfig();
-			const sessionKey = ctx.sessionKey?.trim();
-			const { sessionBindingIdentity } = await import("./session-binding-BHuTCRZQ.js").then((n) => n.f);
-			const identity = sessionBindingIdentity({
-				sessionId,
-				...sessionKey ? { sessionKey } : {},
-				...ctx.agentId ? { agentId: ctx.agentId } : {},
-				...config ? { config } : {}
-			});
-			const adopted = await bindingStore.adoptSessionGeneration(identity, previousSessionId);
-			if (adopted === "conflict") api.logger.warn?.(`codex: could not adopt compacted session generation ${sessionId} (${adopted}); secondary native compaction will skip`);
-		});
 		api.on("session_end", async (event, ctx) => {
 			if (!event.reason || !ENDED_SESSION_REASONS.has(event.reason)) return;
 			const sessionKey = event.sessionKey ?? ctx.sessionKey;
@@ -4411,7 +4395,7 @@ var codex_default = definePluginEntry({
 			if (endedSessionKey && nextSessionKey && nextSessionKey !== endedSessionKey) return;
 			if (event.nextSessionId?.trim() === event.sessionId.trim()) return;
 			const config = resolveCurrentConfig();
-			const [{ sessionBindingIdentity }, { retireCodexAppServerSessionGeneration }] = await Promise.all([import("./session-binding-BHuTCRZQ.js").then((n) => n.f), import("./session-retirement-BujDjXVF.js")]);
+			const [{ sessionBindingIdentity }, { retireCodexAppServerSessionGeneration }] = await Promise.all([import("./session-binding-4Ki04sW-.js").then((n) => n.d), import("./session-retirement-DNdmYdFc.js")]);
 			await retireCodexAppServerSessionGeneration({
 				bindingStore,
 				identity: sessionBindingIdentity({

package/dist/{isolated-completion-kg9kv4iH.js → isolated-completion-CRh-51AK.js}

@@ -1,26 +1,11 @@
-import { $t as isJsonObject, Wt as resolveCodexAppServerPreparedAuthHandoff } from "./shared-client-DxcfF9KX.js";
-import { E as readCodexPluginConfig, r as resolveCodexAppServerHomeScope } from "./config-BhmfC1s6.js";
-import { t as runBoundedCodexAppServerTurn } from "./bounded-turn-wzJrwKKe.js";
-import { a as createAttributedCodexAssistantMessage } from "./event-projector-assistant-message-DHRFXKbS.js";
+import { O as readCodexPluginConfig, r as resolveCodexAppServerHomeScope } from "./config-CyapYSji.js";
+import { Kt as resolveCodexAppServerPreparedAuthHandoff, Z as assertCodexPassiveTurnItems } from "./shared-client-CKhX2kFt.js";
+import { t as runBoundedCodexAppServerTurn } from "./bounded-turn-DxGJRYbY.js";
+import { a as createAttributedCodexAssistantMessage } from "./event-projector-assistant-message-B9kp6iGC.js";
 //#region extensions/codex/src/app-server/isolated-completion.ts
-const ISOLATED_PASSIVE_ITEM_TYPES = /* @__PURE__ */ new Set(["agentMessage", "reasoning"]);
-function assertIsolatedCompletionItems(items, prompt) {
-	let promptEchoSeen = false;
-	for (const item of items) {
-		if (ISOLATED_PASSIVE_ITEM_TYPES.has(item.type)) continue;
-		if (item.type === "userMessage" && !promptEchoSeen) {
-			const content = Array.isArray(item.content) ? item.content : [];
-			const input = content[0];
-			if (content.length === 1 && isJsonObject(input) && input.type === "text" && input.text === prompt) {
-				promptEchoSeen = true;
-				continue;
-			}
-		}
-		throw new Error(`Codex isolated completion returned unexpected native item: ${item.type}`);
-	}
-}
 /** Runs prompt-only Codex inference on an ephemeral, ring-zero native thread. */
 async function runCodexIsolatedCompletion(params, options) {
+	params.assertCurrent?.();
 	const authorization = params.authorization;
 	if (authorization.owner !== "harness") throw new Error("Codex native isolated completion requires harness-owned authorization.");
 	const pluginConfig = readCodexPluginConfig(options.pluginConfig);
@@ -35,6 +20,7 @@ async function runCodexIsolatedCompletion(params, options) {
 		subscriptionProfileRequiredError: "Prepared Codex subscription route requires a scoped native OAuth or token profile.",
 		subscriptionProfileUnusableError: `Prepared Codex auth profile "${authorization.plan.forwardedAuthProfileId}" is unusable.`
 	});
+	params.assertCurrent?.();
 	const authSelection = authHandoff.preparedAuth ? { preparedAuth: authHandoff.preparedAuth } : { profile: authHandoff.authProfileId };
 	const result = await runBoundedCodexAppServerTurn({
 		config: params.config,
@@ -46,6 +32,7 @@ async function runCodexIsolatedCompletion(params, options) {
 		authRequirement,
 		timeoutMs: params.timeoutMs,
 		signal: params.abortSignal,
+		assertCurrent: params.assertCurrent,
 		agentDir: params.agentDir,
 		authProfileStore: authorization.authProfileStore,
 		options,
@@ -60,7 +47,8 @@ async function runCodexIsolatedCompletion(params, options) {
 		isolation: "configured-transport",
 		requireNoExternalCapabilities: true
 	});
-	assertIsolatedCompletionItems(result.items, params.prompt);
+	params.assertCurrent?.();
+	assertCodexPassiveTurnItems(result.items, params.prompt, "isolated completion");
 	return { assistant: createAttributedCodexAssistantMessage({
 		api: "openai-chatgpt-responses",
 		provider: params.provider,