@openclaw/codex 2026.9.1 → 2026.9.3

package/dist/{upstream-session-fork-CYlBIGVt.js → upstream-session-fork-De-sLJ2r.js}

@@ -1,83 +1,58 @@
-import { $t as isJsonObject, Jt as readCodexSessionMeta, Q as assertCodexThreadForkResponse, Qt as flattenCodexDynamicToolFunctions, X as assertCodexThreadAcceptsDirectInput, f as readCodexAppServerClientDesktopGenerationFingerprint, wt as hasCodexAppServerLiveThread, xt as claimCodexAppServerLiveThread } from "./shared-client-DxcfF9KX.js";
-import { E as readCodexPluginConfig, O as resolveOpenClawExecPolicyForCodexAppServer, p as assertCodexModelBackedReviewerEffectiveConfig, s as resolveCodexSupervisionAppServerRuntimeOptions } from "./config-BhmfC1s6.js";
-import { d as sessionBindingIdentity } from "./session-binding-BHuTCRZQ.js";
-import { i as buildCodexPluginAppCacheKey } from "./thread-resume-C7pyVKeW.js";
-import { $ as resolveCodexNativeSkillIsolation, C as buildDeveloperInstructions, Ct as buildCodexPluginThreadConfig, Dt as mergeCodexThreadConfigs, F as assertCodexNativeHookRelayAllowed, I as buildCodexNativeHookRelayConfig, Ot as shouldBuildCodexPluginThreadConfig, Q as applyCodexNativeSkillIsolation, R as buildCodexNativeHookRelayId, S as resolveCodexWebSearchPlan, V as resolveCodexNativeHookRelayEvents, W as attestCodexPluginThreadApps, Z as parseCodexNativeToolCatalog, it as fingerprintUserMcpServersConfigPatch, rt as fingerprintJsonObject, tt as codexDynamicToolsFingerprint, y as buildCodexThreadConfiguration } from "./thread-lifecycle-DAcEJ_Om.js";
-import { o as withCodexAppServerThreadMutation } from "./thread-ownership-zGokd8i1.js";
-import { c as fingerprintCodexMirrorSourceMessage, m as projectCodexUserItemText, u as readCodexMirrorSourceFingerprint } from "./transcript-mirror-DTUxFWa_.js";
-import { l as resolveCodexNativeExecutionPolicy, t as CodexAppServerScopedRequestRejectedError } from "./request-DYAI5FQE.js";
-import { i as refreshCodexThreadPolicy, n as CodexThreadPolicyHandoffError } from "./thread-policy-g4KbJPzp.js";
+import { l as sessionBindingIdentity } from "./session-binding-record-CaZjYwNS.js";
+import { f as assertCodexModelBackedReviewerEffectiveConfig } from "./config-options-jnIFvwxD.js";
+import { a as flattenCodexDynamicToolFunctions, o as isJsonObject, x as readCodexPluginConfig } from "./protocol-CAAcVIKF.js";
+import { _ as assertCodexThreadAcceptsDirectInput, v as assertCodexThreadForkResponse } from "./client-BEKu4yDx.js";
+import { n as withCodexAppServerThreadMutation } from "./incognito-session-uhrBF6wJ.js";
+import { n as readCodexSessionMeta } from "./session-catalog-provenance-DkJHo735.js";
 import { i as readUpstreamUserText, r as readMirrorIdentity } from "./upstream-prompt-provenance-LphB8slG.js";
-import { n as prepareCodexSessionInitialization } from "./session-initialization-BeWzjGiR.js";
-import { i as createImportedCodexSession, n as codexUpstreamBaseline, t as codexLastTerminalTurnId } from "./session-upstream-marker-C351-5Qw.js";
-import { l as isCodexDynamicToolExcluded, n as resolveCodexProviderWebSearchSupportForClient } from "./provider-capabilities-DW5p4k9w.js";
-import { o as prepareCodexWorkspaceDeveloperInstructions } from "./attempt-context-DmQUNWwT.js";
+import { a as projectCodexUserItemText } from "./session-catalog-home-id-D7-aLiNt.js";
+import { n as codexUpstreamBaseline, t as codexLastTerminalTurnId } from "./session-upstream-marker-D15C9NHp.js";
+import { r as buildCodexPluginAppCacheKey } from "./plugin-app-cache-key-CdSQzWyX.js";
+import { t as CodexAppServerScopedRequestRejectedError } from "./request-CGvGOpeR.js";
+import { n as resolveOpenClawExecPolicyForCodexAppServer } from "./config-JDfTI4VI.js";
+import { r as resolveCodexSupervisionAppServerRuntimeOptions } from "./config-runtime-BWf6JLWG.js";
+import { a as fingerprintCodexMirrorSourceMessage, c as readCodexMirrorSourceFingerprint } from "./transcript-mirror-attestation-DibE0krH.js";
+import { L as hasCodexAppServerLiveThread, N as claimCodexAppServerLiveThread, f as readCodexAppServerClientDesktopGenerationFingerprint } from "./shared-client-CVhez2Uo.js";
+import { C as buildDeveloperInstructions, Dt as shouldBuildCodexPluginThreadConfig, F as assertCodexNativeHookRelayAllowed, I as buildCodexNativeHookRelayConfig, J as parseCodexNativeToolCatalog, Q as codexDynamicToolsFingerprint, R as buildCodexNativeHookRelayId, S as resolveCodexWebSearchPlan, Tt as mergeCodexThreadConfigs, V as resolveCodexNativeHookRelayEvents, W as checkCodexThreadAppAvailability, X as resolveCodexNativeSkillIsolation, Y as applyCodexNativeSkillIsolation, et as fingerprintJsonObject, tt as fingerprintUserMcpServersConfigPatch, xt as buildCodexPluginThreadConfig, y as buildCodexThreadConfiguration } from "./thread-lifecycle-D1pzRwHB.js";
+import "./session-binding-CKSepwIC.js";
+import { i as refreshCodexThreadPolicy, n as CodexThreadPolicyHandoffError } from "./thread-policy-D8kI7yAO.js";
+import "./thread-ownership-D6oASVRu.js";
+import { n as resolveCodexNativeExecutionPolicy } from "./native-execution-policy-umd0tgh4.js";
+import { l as isCodexDynamicToolExcluded, n as resolveCodexProviderWebSearchSupportForClient } from "./provider-capabilities-W4tfK5Y5.js";
+import { o as prepareCodexWorkspaceDeveloperInstructions } from "./attempt-context-AO4DSjE0.js";
+import { n as prepareCodexSessionInitialization } from "./session-initialization-Jo86C60I.js";
+import { createImportedCodexSession } from "./session-history-import-DFN7sWRU.js";
 import { isRecord, normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
-import { lstat } from "node:fs/promises";
+import { randomUUID } from "node:crypto";
 import path from "node:path";
-import { loadCodexBundleMcpThreadConfig } from "openclaw/plugin-sdk/agent-harness-runtime";
+import { lstat } from "node:fs/promises";
 import { constants, createZstdDecompress } from "node:zlib";
 import { root } from "openclaw/plugin-sdk/file-access-runtime";
-import { randomUUID } from "node:crypto";
 import { isDeepStrictEqual } from "node:util";
 import { resolveAgentWorkspaceDir } from "openclaw/plugin-sdk/agent-runtime";
+import { loadCodexBundleMcpThreadConfig } from "openclaw/plugin-sdk/agent-harness-runtime";
 import { loadExecApprovals } from "openclaw/plugin-sdk/exec-approvals-runtime";
 import { resolveStorePath } from "openclaw/plugin-sdk/session-store-runtime";
 import { buildCodexUserMcpServersThreadConfigPatchForRuntime, resolveCodexMcpToolOverridesForAgent } from "openclaw/plugin-sdk/codex-mcp-projection";
 import { buildNativeHookRelayCommandPlan } from "openclaw/plugin-sdk/native-hook-relay-runtime";
 import { appendSessionTranscriptMessagesByIdentity, readVisibleSessionTranscriptMessageEntries } from "openclaw/plugin-sdk/session-transcript-runtime";
-//#region extensions/codex/src/session-rollout-selection.ts
+//#region extensions/codex/src/session-rollout-snapshot.ts
 const CHUNK_BYTES = 65536;
-const RECORD_BYTES = 1048576;
-const SCAN_BYTES = 8388608;
-const DECOMPRESSED_BYTES = 33554432;
+const META_BYTES = 1048576;
+const COMPRESSED_BYTES = 8388608;
 const DEADLINE_MS = 5e3;
 const utf8Decoder = new TextDecoder("utf-8", { fatal: true });
-function scalar(value) {
-	if (typeof value !== "string" || !value.trim() || Buffer.byteLength(value) > 256) throw new Error("Codex rollout has an invalid model or provider selection");
-	return value;
-}
-function record(line) {
-	if (!line.length || line.length > RECORD_BYTES) throw new Error("Codex rollout record exceeds the observation limit");
+function parseMetadata(line, threadId) {
 	const parsed = JSON.parse(utf8Decoder.decode(line));
-	if (!isRecord(parsed) || typeof parsed.type !== "string" || !isRecord(parsed.payload)) throw new Error("Codex rollout contains an incomplete record");
-	return {
-		type: parsed.type,
-		payload: parsed.payload
-	};
-}
-/** Observe settings only; rollback changes history, never the native scalar selection. */
-function observation(parsed, threadId) {
-	const payload = parsed.payload;
-	if (parsed.type === "session_meta") {
-		if (typeof payload.id !== "string") throw new Error("Codex rollout metadata is missing its thread identity");
-		return payload.id === threadId ? { provider: scalar(payload.model_provider) } : {};
-	}
-	if (parsed.type === "turn_context") return { model: scalar(payload.model) };
-	if (parsed.type === "event_msg" && payload.type === "thread_settings_applied") {
-		if (!isRecord(payload.thread_settings)) throw new Error("Codex rollout settings are incomplete");
-		return {
-			model: scalar(payload.thread_settings.model),
-			provider: scalar(payload.thread_settings.model_provider_id)
-		};
-	}
-	return {};
-}
-async function readExtent(handle, start, length) {
-	const buffer = Buffer.alloc(length);
-	for (let offset = 0; offset < length;) {
-		const { bytesRead } = await handle.read(buffer, offset, length - offset, start + offset);
-		if (!bytesRead) throw new Error("Codex rollout changed during model observation");
-		offset += bytesRead;
-	}
-	return buffer;
+	if (!isRecord(parsed) || parsed.type !== "session_meta" || !isRecord(parsed.payload) || parsed.payload.id !== threadId) throw new Error("Codex rollout does not belong to the bound thread");
+	return parsed.payload;
 }
-/** Latest durable selection at one verified local rollout snapshot, not live-memory state. */
-async function readCodexRolloutSelection(params) {
+/** Read immutable metadata while pinning the entire rollout against concurrent writers. */
+async function readCodexRolloutSnapshot(params) {
 	const deadline = Date.now() + DEADLINE_MS;
 	const check = () => {
 		params.assertCurrent();
-		if (Date.now() >= deadline) throw new Error("Codex rollout model observation timed out");
+		if (Date.now() >= deadline) throw new Error("Codex rollout metadata observation timed out");
 	};
 	check();
 	const rootStat = await lstat(params.sessionsRoot);
@@ -100,94 +75,49 @@ async function readCodexRolloutSelection(params) {
 	try {
 		check();
 		const snapshot = opened.stat;
-		let metadata;
-		let model;
-		let provider;
-		const header = (parsed) => {
-			if (parsed.type !== "session_meta" || parsed.payload.id !== params.threadId) throw new Error("Codex rollout does not belong to the bound thread");
-			scalar(parsed.payload.model_provider);
-			metadata = parsed.payload;
-		};
-		if (selected.endsWith(".zst")) {
-			if (snapshot.size === 0 || snapshot.size > SCAN_BYTES) throw new Error("Compressed Codex rollout exceeds the observation limit");
-			const input = opened.handle.createReadStream({
-				autoClose: false,
-				highWaterMark: CHUNK_BYTES,
-				end: snapshot.size - 1
-			});
-			const decoder = createZstdDecompress({
-				chunkSize: CHUNK_BYTES,
-				params: { [constants.ZSTD_d_windowLogMax]: 25 }
-			});
-			const timer = setTimeout(() => decoder.destroy(/* @__PURE__ */ new Error("Codex rollout observation timed out")), Math.max(1, deadline - Date.now()));
+		const unchanged = (stat) => stat.dev === snapshot.dev && stat.ino === snapshot.ino && stat.size === snapshot.size && stat.mtimeMs === snapshot.mtimeMs && stat.ctimeMs === snapshot.ctimeMs && stat.nlink === 1;
+		if (!snapshot.size) throw new Error("Codex rollout metadata is incomplete");
+		const compressed = selected.endsWith(".zst");
+		if (compressed && snapshot.size > COMPRESSED_BYTES) throw new Error("Compressed Codex rollout exceeds the observation limit");
+		const input = opened.handle.createReadStream({
+			autoClose: false,
+			highWaterMark: CHUNK_BYTES,
+			end: snapshot.size - 1
+		});
+		const decoder = compressed ? createZstdDecompress({
+			chunkSize: CHUNK_BYTES,
+			params: { [constants.ZSTD_d_windowLogMax]: 25 }
+		}) : void 0;
+		if (decoder) {
 			input.on("error", (error) => decoder.destroy(error));
-			const forward = input.pipe(decoder);
-			let tail = Buffer.alloc(0);
-			let total = 0;
-			try {
-				for await (const chunk of forward) {
-					check();
-					const bytes = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
-					total += bytes.length;
-					if (total > DECOMPRESSED_BYTES) throw new Error("Decompressed Codex rollout exceeds the observation limit");
-					tail = Buffer.concat([tail, bytes]);
-					let newline;
-					while ((newline = tail.indexOf(10)) >= 0) {
-						const parsed = record(tail.subarray(0, newline));
-						if (!metadata) header(parsed);
-						const value = observation(parsed, params.threadId);
-						model = value.model ?? model;
-						provider = value.provider ?? provider;
-						tail = tail.subarray(newline + 1);
-					}
-					if (tail.length > RECORD_BYTES) throw new Error("Codex rollout record exceeds the observation limit");
-				}
-				if (tail.length) throw new Error("Codex rollout has an incomplete trailing record");
-			} finally {
-				clearTimeout(timer);
-				if (!input.readableEnded) input.destroy();
-				decoder.destroy();
-			}
-		} else {
-			let first = Buffer.alloc(0);
-			for (let offset = 0; offset < snapshot.size && first.length <= RECORD_BYTES;) {
+			input.pipe(decoder);
+		}
+		const reader = decoder ?? input;
+		const timer = setTimeout(() => reader.destroy(/* @__PURE__ */ new Error("Codex rollout metadata observation timed out")), Math.max(1, deadline - Date.now()));
+		let metadata;
+		const chunks = [];
+		let total = 0;
+		try {
+			for await (const chunk of reader) {
 				check();
-				const bytes = await readExtent(opened.handle, offset, Math.min(CHUNK_BYTES, snapshot.size - offset));
-				offset += bytes.length;
-				first = Buffer.concat([first, bytes]);
-				const newline = first.indexOf(10);
+				const bytes = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+				const newline = bytes.indexOf(10);
+				const prefix = newline < 0 ? bytes : bytes.subarray(0, newline);
+				total += prefix.length;
+				if (total > META_BYTES) throw new Error("Codex rollout metadata exceeds the observation limit");
+				chunks.push(prefix);
 				if (newline >= 0) {
-					header(record(first.subarray(0, newline)));
+					metadata = parseMetadata(Buffer.concat(chunks), params.threadId);
+					if (!unchanged(await opened.handle.stat())) throw new Error("Codex rollout changed during metadata observation");
 					break;
 				}
 			}
-			if (!metadata) throw new Error("Codex rollout metadata is incomplete or oversized");
-			let end = snapshot.size;
-			let scanned = 0;
-			let tail = Buffer.alloc(0);
-			while (end > 0 && (!model || !provider)) {
-				check();
-				const length = Math.min(CHUNK_BYTES, end, SCAN_BYTES - scanned);
-				if (!length) throw new Error("Codex rollout model observation exhausted its scan budget");
-				end -= length;
-				const bytes = await readExtent(opened.handle, end, length);
-				if (!scanned) {
-					if (bytes.at(-1) !== 10) throw new Error("Codex rollout has an incomplete trailing record");
-					tail = bytes.subarray(0, -1);
-				} else tail = Buffer.concat([bytes, tail]);
-				scanned += length;
-				for (;;) {
-					const newline = tail.lastIndexOf(10);
-					if (newline < 0 && (end !== 0 || tail.length === 0)) break;
-					const value = observation(record(tail.subarray(newline + 1)), params.threadId);
-					model ??= value.model;
-					provider ??= value.provider;
-					tail = newline < 0 ? Buffer.alloc(0) : tail.subarray(0, newline);
-					if (model && provider) break;
-				}
-				if (tail.length > RECORD_BYTES) throw new Error("Codex rollout record exceeds the observation limit");
-			}
+		} finally {
+			clearTimeout(timer);
+			reader.destroy();
+			input.destroy();
 		}
+		if (!metadata) throw new Error("Codex rollout metadata is incomplete");
 		const assertUnchanged = async () => {
 			params.assertCurrent();
 			if (selected !== plain) {
@@ -197,7 +127,7 @@ async function readCodexRolloutSelection(params) {
 					if (!isRecord(error) || error.code !== "ENOENT") throw error;
 					return await verifySelected();
 				}
-				throw new Error("Codex rollout selection changed during model observation");
+				throw new Error("Codex rollout selection changed during metadata observation");
 			}
 			await verifySelected();
 		};
@@ -207,20 +137,15 @@ async function readCodexRolloutSelection(params) {
 			const fresh = await safeRoot.open(path.relative(params.sessionsRoot, selected));
 			try {
 				const stat = fresh.stat;
-				if (stat.dev !== snapshot.dev || stat.ino !== snapshot.ino || stat.size !== snapshot.size || stat.mtimeMs !== snapshot.mtimeMs || stat.ctimeMs !== snapshot.ctimeMs || stat.nlink !== 1 || currentRoot.isSymbolicLink() || currentRoot.ino !== rootStat.ino || currentRoot.dev !== rootStat.dev) throw new Error("Codex rollout changed during model observation");
+				if (!unchanged(stat) || currentRoot.isSymbolicLink() || currentRoot.ino !== rootStat.ino || currentRoot.dev !== rootStat.dev) throw new Error("Codex rollout changed during metadata observation");
 			} finally {
 				await fresh.handle.close();
 			}
 			params.assertCurrent();
 		};
-		const descriptor = await opened.handle.stat();
-		if (descriptor.dev !== snapshot.dev || descriptor.ino !== snapshot.ino || descriptor.size !== snapshot.size || descriptor.mtimeMs !== snapshot.mtimeMs || descriptor.ctimeMs !== snapshot.ctimeMs || descriptor.nlink !== 1) throw new Error("Codex rollout changed during model observation");
 		await assertUnchanged();
 		check();
-		if (!model || !provider || !metadata) throw new Error("Codex rollout has no complete durable model selection");
 		return {
-			model,
-			modelProvider: provider,
 			metadata,
 			assertUnchanged
 		};
@@ -552,7 +477,7 @@ async function resolveCodexUpstreamForkBoundary(params) {
 					if (index < 0 || !isDeepStrictEqual(current.slice(0, index + 1), frozen)) throw new Error("The local Codex fork prefix changed during initialization");
 					const currentThread = await params.control.readThread(threadId, false);
 					assertCodexThreadAcceptsDirectInput(currentThread);
-					if (currentThread.id !== thread.id || currentThread.path !== thread.path || currentThread.cwd !== thread.cwd || currentThread.historyMode !== thread.historyMode || currentThread.status?.type === "active") throw new Error("The canonical Codex source changed during initialization");
+					if (currentThread.id !== thread.id || currentThread.path !== thread.path || currentThread.cwd !== thread.cwd || currentThread.historyMode !== thread.historyMode || currentThread.model !== thread.model || currentThread.modelProvider !== thread.modelProvider || currentThread.status?.type === "active") throw new Error("The canonical Codex source changed during initialization");
 					const currentTurns = await listCodexUpstreamTurns(params.control, threadId);
 					const cut = turns.findIndex((turn) => turn.id === resolved.boundary.beforeTurnId);
 					if (!isDeepStrictEqual(currentTurns.slice(0, cut + 1), turns.slice(0, cut + 1))) throw new Error("The canonical Codex fork boundary changed during initialization");
@@ -579,12 +504,15 @@ async function forkCanonicalCodexSession(params) {
 	const { fork, resolved, control, bindingStore, sourceBinding, config } = params;
 	const context = control.forkContext;
 	if (!context?.localSessionsRoot || !resolved.canonical.thread.path) throw new Error("Canonical Codex forks require the verified local rollout on its selected connection. Fork an original imported message instead.");
+	const model = normalizeOptionalString(resolved.canonical.thread.model);
+	const modelProvider = normalizeOptionalString(resolved.canonical.thread.modelProvider);
+	if (!model || !modelProvider) throw new Error("Codex did not report the canonical thread's model selection. Use Codex 0.153.0 or newer, or fork an original imported message instead.");
 	const sourceIdentity = sessionBindingIdentity({
 		...fork.source,
 		config
 	});
 	return bindingStore.withLease(sourceIdentity, async () => {
-		if (!isDeepStrictEqual(await bindingStore.read(sourceIdentity), sourceBinding)) throw new Error("Codex canonical source binding changed before initialization");
+		if (!isDeepStrictEqual(bindingStore.read(sourceIdentity), sourceBinding)) throw new Error("Codex canonical source binding changed before initialization");
 		let freshThreadId;
 		let ownership;
 		let subscriptionReleased = false;
@@ -641,7 +569,7 @@ async function forkCanonicalCodexSession(params) {
 						initialization.assertCurrent();
 						if (ownership && !subscriptionReleased) ownership.assertCurrent();
 					};
-					const selection = await readCodexRolloutSelection({
+					const snapshot = await readCodexRolloutSnapshot({
 						sessionsRoot: context.localSessionsRoot,
 						rolloutPath: resolved.canonical.thread.path,
 						threadId: sourceBinding.threadId,
@@ -649,23 +577,23 @@ async function forkCanonicalCodexSession(params) {
 					});
 					assertCurrent();
 					if (!sourceBinding.dynamicToolsFingerprint) throw new Error("The canonical source has no verified native catalog binding");
-					const sourceCatalog = parseCodexNativeToolCatalog(selection.metadata, sourceBinding.threadId, sourceBinding.dynamicToolsFingerprint);
+					const sourceCatalog = parseCodexNativeToolCatalog(snapshot.metadata, sourceBinding.threadId, sourceBinding.dynamicToolsFingerprint);
 					const prepared = await prepareCanonicalCodexFork({
 						created,
 						initialization: host,
 						config,
 						context,
-						model: selection.model,
-						modelProvider: selection.modelProvider,
+						model,
+						modelProvider,
 						sandbox: fork.sandbox,
 						dynamicTools: sourceCatalog
 					});
 					assertCurrent();
-					await selection.assertUnchanged();
+					await snapshot.assertUnchanged();
 					assertCurrent();
 					await resolved.canonical.assertUnchanged();
 					assertCurrent();
-					if (!isDeepStrictEqual(await bindingStore.read(sourceIdentity), sourceBinding)) throw new Error("Codex canonical source binding changed during preparation");
+					if (!isDeepStrictEqual(bindingStore.read(sourceIdentity), sourceBinding)) throw new Error("Codex canonical source binding changed during preparation");
 					assertCurrent();
 					let raw;
 					try {
@@ -673,8 +601,8 @@ async function forkCanonicalCodexSession(params) {
 							...prepared.request,
 							threadId: sourceBinding.threadId,
 							beforeTurnId: resolved.boundary.beforeTurnId,
-							model: selection.model,
-							modelProvider: selection.modelProvider,
+							model,
+							modelProvider,
 							threadSource: "appServer",
 							excludeTurns: true
 						}, assertCurrent);
@@ -700,19 +628,19 @@ async function forkCanonicalCodexSession(params) {
 						throw new Error("Codex fork subscription ownership could not be acquired");
 					}
 					assertCurrent();
-					if (response.model !== selection.model || response.modelProvider !== selection.modelProvider || response.thread.modelProvider !== selection.modelProvider) throw new Error("Codex fork did not preserve the exact canonical source and selected native model");
+					if (response.model !== model || response.thread.model !== model || response.modelProvider !== modelProvider || response.thread.modelProvider !== modelProvider) throw new Error("Codex fork did not preserve the exact canonical source and selected native model");
 					const turns = await listCodexUpstreamTurns(control, freshThreadId);
 					assertCurrent();
 					const cut = resolved.canonical.turns.findIndex((turn) => turn.id === resolved.boundary.beforeTurnId);
 					if (cut < 0 || !isDeepStrictEqual(turns, resolved.canonical.turns.slice(0, cut))) throw new Error("Codex did not apply the exact beforeTurnId cut. Reconnect to a compatible server and retry.");
 					const metadata = response.thread.path ? await readCodexSessionMeta(context.localSessionsRoot, response.thread.path, freshThreadId) : void 0;
 					assertCurrent();
-					if (!metadata || metadata.model_provider !== selection.modelProvider) throw new Error("The fresh Codex fork metadata could not be verified");
+					if (!metadata || metadata.model_provider !== modelProvider) throw new Error("The fresh Codex fork metadata could not be verified");
 					const childCatalog = parseCodexNativeToolCatalog(metadata, freshThreadId);
 					if (!isDeepStrictEqual(sourceCatalog, childCatalog)) throw new Error("Codex fork did not preserve the actual native tool catalog");
-					await selection.assertUnchanged();
+					await snapshot.assertUnchanged();
 					assertCurrent();
-					await attestCodexPluginThreadApps({
+					await checkCodexThreadAppAvailability({
 						client: context.client,
 						threadId: freshThreadId,
 						appIds: prepared.provisionalAppIds
@@ -769,8 +697,8 @@ async function forkCanonicalCodexSession(params) {
 						conversationSourceTransferComplete: true,
 						cwd: prepared.request.cwd ?? "",
 						rolloutPath: response.thread.path ?? void 0,
-						model: selection.model,
-						modelProvider: selection.modelProvider,
+						model,
+						modelProvider,
 						appServerRuntimeFingerprint: control.connectionFingerprint,
 						dynamicToolsFingerprint: codexDynamicToolsFingerprint(childCatalog),
 						dynamicToolsContainDeferred: flattenCodexDynamicToolFunctions(childCatalog).some((tool) => tool.deferLoading === true),
@@ -783,7 +711,7 @@ async function forkCanonicalCodexSession(params) {
 					initialization.assertCurrent();
 					await resolved.canonical.assertUnchanged();
 					initialization.assertCurrent();
-					if (!isDeepStrictEqual(await bindingStore.read(sourceIdentity), sourceBinding)) throw new Error("Codex source binding changed before fork readiness");
+					if (!isDeepStrictEqual(bindingStore.read(sourceIdentity), sourceBinding)) throw new Error("Codex source binding changed before fork readiness");
 					initialization.assertCurrent();
 					return { pluginExtensions: created.entry.pluginExtensions };
 				}
@@ -810,7 +738,7 @@ async function forkCodexUpstreamSession(params, options) {
 			message: "This Codex thread is not available on the current connection. Reconnect to its host and try again."
 		};
 		return await requestControl.withPinnedConnection(async (control) => {
-			const sourceBinding = await options.bindingStore.read(sessionBindingIdentity({
+			const sourceBinding = options.bindingStore.read(sessionBindingIdentity({
 				...params.source,
 				config: options.resolveConfig?.()
 			}));

package/dist/{usage-Bj-rrzkR.js → usage-CPPTmBvZ.js}

@@ -1,6 +1,7 @@
-import { i as resolveCodexAppServerRuntimeOptions } from "./config-BhmfC1s6.js";
-import { n as readCodexAppServerUsage } from "./request-DYAI5FQE.js";
-import { t as buildCodexAppServerUsageSnapshot } from "./rate-limits-CawQJfUS.js";
+import { t as buildCodexAppServerUsageSnapshot } from "./rate-limits-Bqnx1N4z.js";
+import { n as readCodexAppServerUsage } from "./request-CGvGOpeR.js";
+import "./config-JDfTI4VI.js";
+import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-BWf6JLWG.js";
 import { CODEX_APP_SERVER_AUTH_MARKER } from "openclaw/plugin-sdk/agent-runtime";
 //#region extensions/codex/src/app-server/usage.ts
 /** Handles the synthetic usage credential for a Codex-backed OpenAI route. */

package/dist/version-omm6IPI3.js

@@ -0,0 +1,12 @@
+//#region extensions/codex/src/app-server/version.ts
+/**
+* Version and package pins for the managed Codex app-server runtime.
+*/
+/** Exact Codex app-server version shipped by the OpenClaw Codex bridge. */
+const CODEX_APP_SERVER_VERSION = "0.153.4";
+/** Inclusive runtime compatibility floor for external app-server binaries. */
+const MIN_SUPPORTED_CODEX_APP_SERVER_VERSION = "0.149.0";
+/** npm package name for the managed Codex app-server binary. */
+const MANAGED_CODEX_APP_SERVER_PACKAGE = "@openai/codex";
+//#endregion
+export { MANAGED_CODEX_APP_SERVER_PACKAGE as n, MIN_SUPPORTED_CODEX_APP_SERVER_VERSION as r, CODEX_APP_SERVER_VERSION as t };

package/dist/{web-search-provider.runtime-D2FWSK4w.js → web-search-provider.runtime-CSVgQL0w.js}

@@ -1,6 +1,6 @@
-import { $t as isJsonObject } from "./shared-client-DxcfF9KX.js";
-import { x as buildCodexNativeWebSearchThreadConfig } from "./thread-lifecycle-DAcEJ_Om.js";
-import { t as runBoundedCodexAppServerTurn } from "./bounded-turn-wzJrwKKe.js";
+import { o as isJsonObject } from "./protocol-CAAcVIKF.js";
+import { x as buildCodexNativeWebSearchThreadConfig } from "./thread-lifecycle-D1pzRwHB.js";
+import { runBoundedCodexAppServerTurn } from "./bounded-turn-lRpmZHFv.js";
 import { normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { readStringParam, resolveSearchTimeoutSeconds, wrapWebContent } from "openclaw/plugin-sdk/provider-web-search";
 //#region extensions/codex/src/web-search-provider.runtime.ts

package/openclaw.plugin.json

@@ -19,7 +19,14 @@
   ],
   "doctorContract": {
     "configRepair": true,
-    "stateMigrations": true
+    "stateMigrations": [
+      { "id": "codex-app-server-sidecars-to-plugin-state" },
+      {
+        "id": "codex-app-server-orphaned-session-bindings",
+        "doctorOnly": true,
+        "phase": "after-session-repair"
+      }
+    ]
   },
   "doctorHealthChecks": true,
   "sessionRouteStateOwners": [
@@ -81,6 +88,20 @@
       "cliCommand": "plugins"
     }
   ],
+  "setup": {
+    "nativeSessionCatalog": {
+      "label": "Codex",
+      "legacyDefaultEnabled": true,
+      "description": "Existing native Codex conversations on this Gateway and eligible paired nodes.",
+      "nodeCommands": [
+        "codex.appServer.threads.list.v1",
+        "codex.appServer.thread.turns.list.v1",
+        "codex.sessionCatalog.transcript.read.v1",
+        "codex.terminal.resume.v1",
+        "codex.cli.sessions.list"
+      ]
+    }
+  },
   "configSchema": {
     "type": "object",
     "additionalProperties": false,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openclaw/codex",
-  "version": "2026.9.1",
+  "version": "2026.9.3",
   "description": "OpenClaw Codex app-server harness and native session supervision plugin.",
   "repository": {
     "type": "git",
@@ -8,10 +8,10 @@
   },
   "type": "module",
   "dependencies": {
-    "@openai/codex": "0.152.1",
+    "@openai/codex": "0.153.4",
     "semver": "7.8.5",
     "smol-toml": "1.8.0",
-    "typebox": "1.3.17",
+    "typebox": "1.3.18",
     "ws": "8.21.3",
     "zod": "4.4.3"
   },
@@ -36,10 +36,10 @@
       ]
     },
     "compat": {
-      "pluginApi": ">=2026.9.1"
+      "pluginApi": ">=2026.9.3"
     },
     "build": {
-      "openclawVersion": "2026.9.1"
+      "openclawVersion": "2026.9.3"
     },
     "release": {
       "publishToClawHub": true,
@@ -59,7 +59,7 @@
     "README.md"
   ],
   "peerDependencies": {
-    "openclaw": ">=2026.9.1"
+    "openclaw": ">=2026.9.3"
   },
   "peerDependenciesMeta": {
     "openclaw": {