@openclaw/codex 2026.9.1 → 2026.9.3

package/dist/command-dispatch-CisT9Jqq.js

@@ -0,0 +1,21 @@
+import { a as formatCodexDisplayText } from "./command-formatters-DeTfrapr.js";
+import { n as describeControlFailure } from "./capabilities-BeqLPbtM.js";
+//#region extensions/codex/src/command-dispatch.ts
+/** Dispatches a `/codex` command to the lazily loaded handler. */
+async function handleCodexCommand(ctx, options) {
+	const { loadSubcommandHandler, resolvePluginConfig, ...subcommandOptions } = options;
+	try {
+		return await (loadSubcommandHandler ? await loadSubcommandHandler() : await loadDefaultCodexSubcommandHandler())(ctx, {
+			...subcommandOptions,
+			pluginConfig: resolvePluginConfig?.() ?? subcommandOptions.pluginConfig
+		});
+	} catch (error) {
+		return { text: `Codex command failed: ${formatCodexDisplayText(describeControlFailure(error))}` };
+	}
+}
+async function loadDefaultCodexSubcommandHandler() {
+	const { handleCodexSubcommand } = await import("./command-handlers-BfIsJEuA.js");
+	return handleCodexSubcommand;
+}
+//#endregion
+export { handleCodexCommand };

package/dist/{command-formatters-CLHhEB1Q.js → command-formatters-DeTfrapr.js}

@@ -1,5 +1,5 @@
-import { $t as isJsonObject } from "./shared-client-DxcfF9KX.js";
-import { c as summarizeCodexRateLimits, o as summarizeCodexAccountRateLimits, r as hasCodexRateLimitSnapshots } from "./rate-limits-CawQJfUS.js";
+import { o as isJsonObject } from "./protocol-CAAcVIKF.js";
+import { c as summarizeCodexRateLimits, o as summarizeCodexAccountRateLimits, r as hasCodexRateLimitSnapshots } from "./rate-limits-Bqnx1N4z.js";
 import { normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
 //#region extensions/codex/src/command-formatters.ts
 /**

package/dist/{command-handlers-CTGb2csu.js → command-handlers-BfIsJEuA.js}

@@ -1,32 +1,43 @@
-import { $ as assertCodexThreadResumeResponse, $t as isJsonObject, Bt as resolveCodexAppServerAuthProfileIdForAgent, Ht as resolveCodexAppServerFallbackApiKeyCacheKey, Rt as resolveCodexAppServerAuthAccountCacheKey, St as consumeCodexAppServerLiveThread, X as assertCodexThreadAcceptsDirectInput, c as getLeasedSharedCodexAppServerClient, h as releaseLeasedSharedCodexAppServerClient, wt as hasCodexAppServerLiveThread } from "./shared-client-DxcfF9KX.js";
-import { A as isCodexFastServiceTier, M as CODEX_PLUGINS_MARKETPLACE_NAME, i as resolveCodexAppServerRuntimeOptions } from "./config-BhmfC1s6.js";
-import { c as reclaimCurrentCodexSessionGeneration, d as sessionBindingIdentity, i as createCodexSessionGenerationSupersededError, n as assertCodexBindingMayBeReplaced, r as bindingStoreKey, s as normalizeCodexAppServerBindingModelProvider } from "./session-binding-BHuTCRZQ.js";
-import { a as closeCodexStartupClientBestEffort } from "./attempt-client-cleanup-DYHcRQAa.js";
-import { t as listAllCodexAppServerModels } from "./models-sYnEc0gd.js";
-import { i as buildCodexPluginAppCacheKey, s as defaultCodexAppInventoryCache } from "./thread-resume-C7pyVKeW.js";
-import { At as refreshCodexPluginRuntimeState, Mt as isOpenAiCuratedMarketplaceName } from "./thread-lifecycle-DAcEJ_Om.js";
-import { a as rollbackCodexAppServerBindingSubscription, c as withExclusiveCodexAppServerThread, i as retireCodexConversationThreadBinding, l as isIncognitoSessionKey, n as releaseCodexAppServerBindingSubscription, r as retainCodexAppServerBindingSubscription, s as withCodexConversationThreadActivity, t as isSameCodexAppServerThreadOwner } from "./thread-ownership-zGokd8i1.js";
-import { c as resolveCodexNativeSandboxBlock, s as resolveCodexNativeExecutionBlock } from "./request-DYAI5FQE.js";
-import { r as assertCodexSupervisionThreadLineage } from "./thread-policy-g4KbJPzp.js";
-import { t as CODEX_CONTROL_METHODS } from "./capabilities-dIjNVCYH.js";
-import { s as summarizeCodexAccountUsage } from "./rate-limits-CawQJfUS.js";
-import { a as formatCodexDisplayText, c as formatComputerUseStatus, d as formatSkills, f as formatThreads, i as formatAccount, l as formatList, n as buildHelp, o as formatCodexStatus, r as escapeCodexChatText, s as formatCodexTextForDisplay, t as CODEX_RESUME_SAFE_THREAD_ID_PATTERN, u as formatModels } from "./command-formatters-CLHhEB1Q.js";
-import { _ as hasCodexAdminScope, a as parseCodexPermissionsModeArg, c as setCodexConversationModel, d as stopCodexConversationTurn, g as canMutateCodexHost, h as CODEX_NATIVE_EXECUTION_AUTH_ERROR, i as parseCodexFastModeArg, l as setCodexConversationPermissions, m as CODEX_HOST_INSPECTION_AUTH_ERROR, n as parseCodexPluginMarketplaceId, o as readCodexConversationActiveTurn, p as CODEX_FULL_PERMISSIONS_AUTH_ERROR, r as formatPermissionsMode, s as setCodexConversationFastMode, t as discoverCodexMarketplacePlugins, u as steerCodexConversationTurn } from "./plugin-marketplace-discovery-CfFlKqDl.js";
+import { m as CODEX_PLUGINS_MARKETPLACE_NAME, n as isCodexFastServiceTier } from "./config-utils-C57JiJrU.js";
+import { l as sessionBindingIdentity, n as assertCodexBindingMayBeReplaced, r as bindingStoreKey } from "./session-binding-record-CaZjYwNS.js";
+import { o as isJsonObject } from "./protocol-CAAcVIKF.js";
+import { _ as assertCodexThreadAcceptsDirectInput, y as assertCodexThreadResumeResponse } from "./client-BEKu4yDx.js";
+import { s as resolveCodexAppServerFallbackApiKeyCacheKey } from "./auth-cache-key-Kq6oerr6.js";
+import { r as withCodexConversationThreadActivity, t as isIncognitoSessionKey } from "./incognito-session-uhrBF6wJ.js";
+import { a as CODEX_NATIVE_EXECUTION_AUTH_ERROR, i as CODEX_HOST_INSPECTION_AUTH_ERROR, n as parseCodexPluginMarketplaceId, o as canMutateCodexHost, r as CODEX_FULL_PERMISSIONS_AUTH_ERROR, s as hasCodexAdminScope, t as discoverCodexMarketplacePlugins } from "./plugin-marketplace-discovery-3akBizzF.js";
+import { s as summarizeCodexAccountUsage } from "./rate-limits-Bqnx1N4z.js";
+import { a as formatCodexDisplayText, c as formatComputerUseStatus, d as formatSkills, f as formatThreads, i as formatAccount, l as formatList, n as buildHelp, o as formatCodexStatus, r as escapeCodexChatText, s as formatCodexTextForDisplay, t as CODEX_RESUME_SAFE_THREAD_ID_PATTERN, u as formatModels } from "./command-formatters-DeTfrapr.js";
 import { i as readCodexConversationBindingData, n as createCodexCliNodeConversationBindingData, o as resolveCodexDefaultWorkspaceDir, r as createCodexConversationBindingData } from "./conversation-binding-data-BiodpIzq.js";
-import { n as resolveCodexBindingAppServerConnection } from "./binding-connection-E6uDsPlx.js";
-import { c as readCodexStatusProbes, l as requestOptions, p as formatCodexCliSessions, s as codexControlRequest, u as safeCodexControlRequest } from "./session-catalog-yyvTWFOw.js";
-import { i as readCodexComputerUseStatus, r as installCodexComputerUse, t as defaultCodexPluginMetadataCache } from "./plugin-metadata-cache-BFrPhb2c.js";
+import { t as CODEX_CONTROL_METHODS } from "./capabilities-BeqLPbtM.js";
+import { i as formatCodexCliSessions } from "./node-cli-sessions-rj0ysJwM.js";
+import { r as buildCodexPluginAppCacheKey, s as defaultCodexAppInventoryCache } from "./plugin-app-cache-key-CdSQzWyX.js";
+import "./config-JDfTI4VI.js";
+import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-BWf6JLWG.js";
+import { i as resolveCodexBindingAppServerConnection } from "./binding-connection-QqgcPCgk.js";
+import { i as resolveCodexAppServerAuthProfileIdForAgent, n as normalizeCodexAppServerBindingModelProvider } from "./auth-profile-CwzO4_RG.js";
+import { L as hasCodexAppServerLiveThread, P as consumeCodexAppServerLiveThread, X as resolveCodexAppServerAuthAccountCacheKey, c as getLeasedSharedCodexAppServerClient, h as releaseLeasedSharedCodexAppServerClient } from "./shared-client-CVhez2Uo.js";
+import { a as closeCodexStartupClientBestEffort } from "./attempt-client-cleanup-D6cR54TV.js";
+import { t as listAllCodexAppServerModels } from "./models-P9k2qAof.js";
+import { r as isOpenAiCuratedMarketplaceName } from "./plugin-inventory-CoRCzWW4.js";
+import { n as refreshCodexPluginRuntimeState } from "./plugin-activation-BQK-f5sV.js";
+import { n as createCodexSessionGenerationSupersededError, o as resolveCodexSessionBinding } from "./session-binding-CKSepwIC.js";
+import { r as assertCodexSupervisionThreadLineage } from "./thread-policy-D8kI7yAO.js";
+import { a as rollbackCodexAppServerBindingSubscription, i as retireCodexConversationThreadBinding, n as releaseCodexAppServerBindingSubscription, r as retainCodexAppServerBindingSubscription, s as withExclusiveCodexAppServerThread, t as isSameCodexAppServerThreadOwner } from "./thread-ownership-D6oASVRu.js";
+import { n as resolveCodexNativeSandboxBlock, t as resolveCodexNativeExecutionBlock } from "./sandbox-guard-BcT66fWy.js";
+import { i as readCodexComputerUseStatus, r as installCodexComputerUse, t as defaultCodexPluginMetadataCache } from "./plugin-metadata-cache-DgNfRAGA.js";
+import { a as safeCodexControlRequest, i as requestOptions, r as readCodexStatusProbes, t as codexControlRequest } from "./command-rpc-BMqRQOFX.js";
+import { a as setCodexConversationFastMode, c as steerCodexConversationTurn, i as readCodexConversationActiveTurn, l as stopCodexConversationTurn, n as parseCodexFastModeArg, o as setCodexConversationModel, r as parseCodexPermissionsModeArg, s as setCodexConversationPermissions, t as formatPermissionsMode } from "./conversation-control-CUCrSIQI.js";
 import { normalizeOptionalString, normalizeUniqueStringEntries } from "openclaw/plugin-sdk/string-coerce-runtime";
-import { parseStrictPositiveInteger } from "openclaw/plugin-sdk/number-runtime";
 import crypto from "node:crypto";
-import { isDeepStrictEqual } from "node:util";
-import { ensureAuthProfileStore, resolveAgentDir, resolveAuthProfileEligibility, resolveProfileUnusableUntilForDisplay } from "openclaw/plugin-sdk/agent-runtime";
-import { findNormalizedProviderValue, resolveAuthProfileOrder } from "openclaw/plugin-sdk/provider-auth";
 import { resolveSessionAgentIdsStrict } from "openclaw/plugin-sdk/agent-scope-runtime";
-import { getSessionEntry, resolveStorePath } from "openclaw/plugin-sdk/session-store-runtime";
-import { truncateUtf16Safe } from "openclaw/plugin-sdk/text-utility-runtime";
+import { parseStrictPositiveInteger } from "openclaw/plugin-sdk/number-runtime";
 import { expectDefined } from "openclaw/plugin-sdk/expect-runtime";
+import { truncateUtf16Safe } from "openclaw/plugin-sdk/text-utility-runtime";
+import { isDeepStrictEqual } from "node:util";
+import { ensureAuthProfileStore, resolveAgentDir as resolveAgentDir$1, resolveAuthProfileEligibility, resolveProfileUnusableUntilForDisplay } from "openclaw/plugin-sdk/agent-runtime";
 import { parseAgentSessionKey } from "openclaw/plugin-sdk/routing";
+import { getSessionEntry, resolveStorePath } from "openclaw/plugin-sdk/session-store-runtime";
+import { findNormalizedProviderValue, resolveAuthProfileOrder } from "openclaw/plugin-sdk/provider-auth";
 import { MODEL_SELECTION_LOCKED_MESSAGE, isModelSelectionLocked, resolvePersistedSessionRuntimeId } from "openclaw/plugin-sdk/model-session-runtime";
 //#region extensions/codex/src/command-account.ts
 const OPENAI_PROVIDER_ID = "openai";
@@ -1065,11 +1076,56 @@ async function resolveControlTarget(ctx) {
 		agentDir: scope.agentDir
 	} : void 0;
 }
-async function resolveCommandAppServerScope(deps, ctx, pluginConfig) {
+async function resolvePreparedCodexCommandAuthority(deps, ctx) {
 	const target = await resolveControlTarget(ctx);
 	const fallback = resolveCodexConversationControlScope(ctx);
+	const sessionId = ctx.sessionId;
+	const sessionKey = ctx.sessionKey;
+	const sessionAgentId = ctx.sessionTarget?.agentId ?? fallback.agentId;
+	const storePath = ctx.sessionTarget?.storePath ?? (sessionKey ? resolveStorePath(ctx.config.session?.store, { agentId: sessionAgentId }) : void 0);
+	const sessionIdentity = sessionId ? sessionBindingIdentity({
+		sessionId,
+		sessionKey,
+		agentId: sessionAgentId,
+		config: ctx.config
+	}) : void 0;
+	const currentSession = sessionIdentity ? await resolveCodexSessionBinding({
+		reclaimStale: true,
+		bindingStore: deps.bindingStore,
+		identity: sessionIdentity,
+		config: ctx.config,
+		storePath
+	}) : void 0;
+	const assertHostCurrent = currentSession?.assertCurrent ?? (() => {});
+	const binding = (target && (!sessionIdentity || !isDeepStrictEqual(target.identity, sessionIdentity)) ? await resolveCodexSessionBinding({
+		bindingStore: deps.bindingStore,
+		identity: target.identity,
+		config: ctx.config,
+		storePath,
+		assertCurrent: assertHostCurrent
+	}) : currentSession)?.binding;
+	const assertCurrent = () => {
+		assertHostCurrent();
+		if (target && !isDeepStrictEqual(deps.bindingStore.read(target.identity), binding)) throw new Error("Codex command binding changed before dispatch");
+		assertHostCurrent();
+	};
+	assertCurrent();
+	return {
+		target,
+		binding,
+		currentSessionBinding: currentSession?.binding,
+		sessionId,
+		sessionKey,
+		storePath,
+		assertHostCurrent,
+		assertCurrent
+	};
+}
+async function resolveCommandAppServerScope(deps, ctx, pluginConfig) {
+	const authority = await resolvePreparedCodexCommandAuthority(deps, ctx);
+	const { target, binding } = authority;
+	const fallback = resolveCodexConversationControlScope(ctx);
 	const agentDir = target?.agentDir ?? fallback.agentDir;
-	const binding = target ? await deps.bindingStore.read(target.identity) : void 0;
 	const authProfileId = binding?.connectionScope === "supervision" ? void 0 : resolveCodexAppServerAuthProfileIdForAgent({
 		authProfileId: binding?.authProfileId ?? target?.requestedAuthProfileId,
 		agentDir,
@@ -1085,8 +1141,10 @@ async function resolveCommandAppServerScope(deps, ctx, pluginConfig) {
 		agentDir,
 		...connection.clientAuthProfileId !== void 0 ? { authProfileId: connection.clientAuthProfileId } : {},
 		...connection.usesSupervisionConnection ? { startOptions: connection.appServer.start } : {},
-		...ctx.sessionKey ? { sessionKey: ctx.sessionKey } : {},
-		...ctx.sessionId ? { sessionId: ctx.sessionId } : {}
+		...authority.sessionKey ? { sessionKey: authority.sessionKey } : {},
+		...authority.sessionId ? { sessionId: authority.sessionId } : {},
+		...authority.storePath ? { storePath: authority.storePath } : {},
+		assertCurrent: authority.assertCurrent
 	};
 }
 function conversationBindingIdentity(bindingId) {
@@ -1103,7 +1161,7 @@ function resolveCodexConversationControlScope(ctx) {
 	});
 	return {
 		agentId: sessionAgentId,
-		agentDir: resolveAgentDir(ctx.config, sessionAgentId)
+		agentDir: resolveAgentDir$1(ctx.config, sessionAgentId)
 	};
 }
 //#endregion
@@ -1200,7 +1258,7 @@ async function confirmCodexDiagnosticsFeedback(deps, ctx, pluginConfig, token) {
 	if (scopeMismatch) return scopeMismatch.confirmMessage;
 	deletePendingCodexDiagnosticsConfirmation(token);
 	if (!pending.privateRouted && !await hasAnyCodexDiagnosticsIdentity(ctx)) return "Cannot send Codex diagnostics because this command did not include a stable session identity.";
-	const currentTargets = pending.privateRouted ? await resolvePendingCodexDiagnosticsTargets(deps, pending.targets, ctx.config) : await resolveCodexDiagnosticsTargets(deps, ctx);
+	const currentTargets = pending.privateRouted ? resolvePendingCodexDiagnosticsTargets(deps, pending.targets, ctx.config) : await resolveCodexDiagnosticsTargets(deps, ctx);
 	if (!codexDiagnosticsTargetsMatch(pending.targets, currentTargets)) return "The Codex diagnostics sessions changed before confirmation. Run /diagnostics again for the current threads.";
 	return await sendCodexDiagnosticsFeedbackForTargets(deps, ctx, pluginConfig, pending.note ?? "", currentTargets, { cooldownScope: pending.scopeKey });
 }
@@ -1307,7 +1365,7 @@ async function resolveCodexDiagnosticsTargets(deps, ctx) {
 		});
 		candidates.push({
 			identity,
-			agentDir: resolveAgentDir(ctx.config, identity.agentId),
+			agentDir: resolveAgentDir$1(ctx.config, identity.agentId),
 			sessionKey: session.sessionKey,
 			sessionId: session.sessionId,
 			channel: session.channel,
@@ -1324,17 +1382,17 @@ async function resolveCodexDiagnosticsTargets(deps, ctx) {
 		const key = bindingStoreKey(candidate.identity);
 		if (seenBindingKeys.has(key)) continue;
 		seenBindingKeys.add(key);
-		const binding = await deps.bindingStore.read(candidate.identity);
+		const binding = deps.bindingStore.read(candidate.identity);
 		if (!binding?.threadId || seenThreadIds.has(binding.threadId)) continue;
 		seenThreadIds.add(binding.threadId);
 		targets.push(resolveCodexDiagnosticsTarget(candidate, binding, ctx.config));
 	}
 	return targets;
 }
-async function resolvePendingCodexDiagnosticsTargets(deps, targets, config) {
+function resolvePendingCodexDiagnosticsTargets(deps, targets, config) {
 	const resolved = [];
 	for (const target of targets) {
-		const binding = await deps.bindingStore.read(target.identity);
+		const binding = deps.bindingStore.read(target.identity);
 		if (!binding?.threadId) continue;
 		resolved.push(resolveCodexDiagnosticsTarget(target, binding, config));
 	}
@@ -1376,7 +1434,7 @@ function isCurrentSessionModelSelectionLocked(ctx) {
 	const sessionKey = ctx.sessionKey?.trim();
 	if (!sessionKey) return false;
 	const { agentId } = resolveCodexConversationControlScope(ctx);
-	const storePath = resolveStorePath(ctx.config.session?.store, { agentId });
+	const storePath = ctx.sessionTarget?.storePath ?? resolveStorePath(ctx.config.session?.store, { agentId });
 	return isModelSelectionLocked(getSessionEntry({
 		storePath,
 		sessionKey,
@@ -1400,7 +1458,7 @@ async function bindConversation(deps, ctx, pluginConfig, args) {
 		config: ctx.config
 	}) : void 0;
 	const currentOwner = currentConversationData?.kind === "codex-app-server-session" ? conversationBindingIdentity(currentConversationData.bindingId) : sessionOwner;
-	const existingBinding = currentOwner ? await deps.bindingStore.read(currentOwner) : void 0;
+	const existingBinding = currentOwner ? deps.bindingStore.read(currentOwner) : void 0;
 	assertCodexBindingMayBeReplaced(existingBinding, "binding this conversation to another thread");
 	const sessionSource = sessionOwner && existingBinding ? {
 		agentId: sessionOwner.agentId,
@@ -1442,7 +1500,7 @@ async function detachConversation(deps, ctx) {
 	let expectedThreadId;
 	let expectedStartId;
 	if (data?.kind === "codex-app-server-session") {
-		const binding = await deps.bindingStore.read(identity);
+		const binding = deps.bindingStore.read(identity);
 		assertCodexBindingMayBeReplaced(binding, "detaching its conversation binding");
 		if (deps.readCodexConversationActiveTurn(identity)) return "This Codex conversation has an active run; use /codex stop before detaching it.";
 		expectedThreadId = binding?.threadId;
@@ -1480,13 +1538,13 @@ async function describeConversationBinding(deps, ctx) {
 		"- Active run: not tracked"
 	].join("\n");
 	const identity = conversationBindingIdentity(data.bindingId);
-	const threadBinding = await deps.bindingStore.read(identity);
+	const threadBinding = deps.bindingStore.read(identity);
 	const active = deps.readCodexConversationActiveTurn(identity);
 	const sessionKey = ctx.sessionKey?.trim();
 	const { agentId } = resolveCodexConversationControlScope(ctx);
 	const sessionEntry = sessionKey ? getSessionEntry({
 		agentId,
-		storePath: resolveStorePath(ctx.config.session?.store, { agentId }),
+		storePath: ctx.sessionTarget?.storePath ?? resolveStorePath(ctx.config.session?.store, { agentId }),
 		sessionKey,
 		hydrateSkillPromptRefs: false,
 		readConsistency: "latest"
@@ -1538,17 +1596,22 @@ async function resumeThread(deps, ctx, pluginConfig, args) {
 		agentId: scope.agentId,
 		config: ctx.config
 	});
+	const { assertCurrent: assertHostGeneration } = await resolveCodexSessionBinding({
+		reclaimStale: true,
+		bindingStore: deps.bindingStore,
+		identity,
+		config: ctx.config,
+		storePath: ctx.sessionTarget?.storePath
+	});
 	return await withExclusiveCodexAppServerThread({
 		bindingStore: deps.bindingStore,
 		identity,
 		threadId: normalizedThreadId,
 		run: async () => await deps.bindingStore.withLease(identity, async () => {
-			if (!await reclaimCurrentCodexSessionGeneration({
-				bindingStore: deps.bindingStore,
-				identity,
-				config: ctx.config
-			})) throw createCodexSessionGenerationSupersededError(identity.sessionId);
-			const currentBinding = await deps.bindingStore.read(identity);
+			const generation = await deps.bindingStore.prepareSessionGenerationReclaim(identity);
+			assertHostGeneration();
+			if (generation.kind !== "resolved" || !generation.result) throw createCodexSessionGenerationSupersededError(identity.sessionId);
+			const currentBinding = deps.bindingStore.read(identity);
 			assertCodexBindingMayBeReplaced(currentBinding, "attaching a different resumed thread");
 			let pendingResumeConfiguration = false;
 			const commitResumedThread = async (value, client, { authProfileId, assertCurrent }) => {
@@ -1568,7 +1631,7 @@ async function resumeThread(deps, ctx, pluginConfig, args) {
 				let sameOwner = false;
 				let knownOwnership;
 				try {
-					const bindingBeforeCommit = await deps.bindingStore.read(identity);
+					const bindingBeforeCommit = deps.bindingStore.read(identity);
 					assertCodexBindingMayBeReplaced(bindingBeforeCommit, "committing a different resumed thread");
 					sameOwner = isSameCodexAppServerThreadOwner(bindingBeforeCommit, {
 						threadId: effectiveThreadId,
@@ -1583,7 +1646,7 @@ async function resumeThread(deps, ctx, pluginConfig, args) {
 					retained = await retainCodexAppServerBindingSubscription(client, effectiveThreadId, knownOwnership);
 					assertCurrent();
 					if (!retained) throw new Error("Codex resumed thread lost its native subscription owner.");
-					if (bindingBeforeCommit && !sameOwner) await releaseCodexAppServerBindingSubscription(bindingBeforeCommit);
+					if (bindingBeforeCommit && !sameOwner) await releaseCodexAppServerBindingSubscription(bindingBeforeCommit, { assertCurrent });
 					assertCurrent();
 					if (!await deps.bindingStore.mutate(identity, {
 						kind: "set",
@@ -1617,6 +1680,8 @@ async function resumeThread(deps, ctx, pluginConfig, args) {
 				authProfileId: currentBinding?.authProfileId,
 				sessionKey: ctx.sessionKey,
 				sessionId: ctx.sessionId,
+				storePath: ctx.sessionTarget?.storePath,
+				assertCurrent: assertHostGeneration,
 				beforeRequest: async (request) => {
 					const { thread } = await request({
 						method: "thread/read",
@@ -1638,7 +1703,7 @@ async function bindCodexCliNodeSession(deps, ctx, parsed) {
 	if (isCurrentSessionModelSelectionLocked(ctx)) return MODEL_SELECTION_LOCKED_MESSAGE;
 	if (ctx.sessionId) {
 		const scope = resolveCodexConversationControlScope(ctx);
-		const binding = await deps.bindingStore.read(sessionBindingIdentity({
+		const binding = deps.bindingStore.read(sessionBindingIdentity({
 			sessionId: ctx.sessionId,
 			sessionKey: ctx.sessionKey,
 			agentId: scope.agentId,
@@ -1759,9 +1824,9 @@ async function handleComputerUseCommand(deps, ctx, pluginConfig, args) {
 async function handleNativeGoal(deps, ctx, pluginConfig, args) {
 	const action = (args[0] ?? "status").toLowerCase();
 	const objective = args.slice(1).join(" ").trim();
-	const target = await resolveControlTarget(ctx);
+	const authority = await resolvePreparedCodexCommandAuthority(deps, ctx);
+	const { target, binding } = authority;
 	if (!target) return "Cannot manage the Codex goal because this command has no stable binding identity.";
-	const binding = await deps.bindingStore.read(target.identity);
 	if (!binding?.threadId) return "No Codex thread is attached to this OpenClaw session yet.";
 	const connection = resolveCodexBindingAppServerConnection({
 		binding,
@@ -1772,6 +1837,10 @@ async function handleNativeGoal(deps, ctx, pluginConfig, args) {
 		agentDir: target.agentDir,
 		authProfileId: connection.clientAuthProfileId,
 		config: ctx.config,
+		sessionId: authority.sessionId,
+		sessionKey: authority.sessionKey,
+		storePath: authority.storePath,
+		assertCurrent: authority.assertCurrent,
 		...connection.usesSupervisionConnection ? { startOptions: connection.appServer.start } : {}
 	};
 	if (action === "status" || action === "get") {
@@ -1810,26 +1879,30 @@ function formatNativeGoal(response) {
 	].join("\n");
 }
 async function stopConversationTurn(deps, ctx, pluginConfig) {
-	const target = await resolveControlTarget(ctx);
+	const authority = await resolvePreparedCodexCommandAuthority(deps, ctx);
+	const { target, binding } = authority;
 	if (!target) return "Cannot stop Codex because this command did not include a stable binding identity.";
 	return (await deps.stopCodexConversationTurn({
 		identity: target.identity,
-		bindingStore: deps.bindingStore,
+		binding,
 		pluginConfig,
 		agentDir: target.agentDir,
-		config: ctx.config
+		config: ctx.config,
+		assertCurrent: authority.assertCurrent
 	})).message;
 }
 async function steerConversationTurn(deps, ctx, pluginConfig, message) {
-	const target = await resolveControlTarget(ctx);
+	const authority = await resolvePreparedCodexCommandAuthority(deps, ctx);
+	const { target, binding } = authority;
 	if (!target) return "Cannot steer Codex because this command did not include a stable binding identity.";
 	return (await deps.steerCodexConversationTurn({
 		identity: target.identity,
-		bindingStore: deps.bindingStore,
+		binding,
 		message,
 		pluginConfig,
 		agentDir: target.agentDir,
-		config: ctx.config
+		config: ctx.config,
+		assertCurrent: authority.assertCurrent
 	})).message;
 }
 async function setConversationModel(deps, ctx, pluginConfig, args) {
@@ -1837,17 +1910,18 @@ async function setConversationModel(deps, ctx, pluginConfig, args) {
 	const [model = ""] = args;
 	const normalized = model.trim();
 	if (normalized && isCurrentSessionModelSelectionLocked(ctx)) return MODEL_SELECTION_LOCKED_MESSAGE;
-	const target = await resolveControlTarget(ctx);
+	const authority = await resolvePreparedCodexCommandAuthority(deps, ctx);
+	const { target, binding } = authority;
 	if (!target) return "Cannot set Codex model because this command did not include a stable binding identity.";
 	if (!normalized) {
-		const currentSession = ctx.sessionId && ctx.sessionKey ? getSessionEntry({
-			storePath: resolveStorePath(ctx.config.session?.store, { agentId: target.agentId }),
-			sessionKey: ctx.sessionKey,
+		const currentSession = authority.sessionId && authority.sessionKey && authority.storePath ? getSessionEntry({
+			storePath: authority.storePath,
+			sessionKey: authority.sessionKey,
 			hydrateSkillPromptRefs: false,
 			readConsistency: "latest"
 		}) : void 0;
-		const selectedModel = currentSession && currentSession.sessionId === ctx.sessionId ? currentSession.modelOverride ?? currentSession.model : void 0;
-		const binding = await deps.bindingStore.read(target.identity);
+		const selectedModel = currentSession && currentSession.sessionId === authority.sessionId ? currentSession.modelOverride ?? currentSession.model : void 0;
+		authority.assertCurrent();
 		const activeModel = target.identity.kind === "conversation" ? binding?.model : selectedModel ?? binding?.model;
 		return activeModel ? `Codex model: ${formatCodexDisplayText(activeModel)}` : "Usage: /codex model <model>";
 	}
@@ -1857,12 +1931,16 @@ async function setConversationModel(deps, ctx, pluginConfig, args) {
 		pluginConfig,
 		model: normalized,
 		agentDir: target.agentDir,
-		config: ctx.config
+		config: ctx.config,
+		binding,
+		storePath: authority.storePath,
+		assertCurrent: authority.assertCurrent
 	});
 }
 async function setConversationFastMode(deps, ctx, args) {
 	if (args.length > 1) return "Usage: /codex fast [on|off|status]";
-	const target = await resolveControlTarget(ctx);
+	const authority = await resolvePreparedCodexCommandAuthority(deps, ctx);
+	const { target, binding } = authority;
 	if (!target) return "Cannot set Codex fast mode because this command did not include a stable binding identity.";
 	const value = args[0];
 	const parsed = parseCodexFastModeArg(value);
@@ -1870,12 +1948,15 @@ async function setConversationFastMode(deps, ctx, args) {
 	return await deps.setCodexConversationFastMode({
 		identity: target.identity,
 		bindingStore: deps.bindingStore,
-		enabled: parsed
+		binding,
+		enabled: parsed,
+		assertCurrent: authority.assertCurrent
 	});
 }
 async function setConversationPermissions(deps, ctx, args) {
 	if (args.length > 1) return "Usage: /codex permissions [default|yolo|status]";
-	const target = await resolveControlTarget(ctx);
+	const authority = await resolvePreparedCodexCommandAuthority(deps, ctx);
+	const { target } = authority;
 	if (!target || !ctx.sessionId || !ctx.sessionKey) return "Cannot set Codex permissions because this command did not include a complete session identity.";
 	const value = args[0];
 	const parsed = parseCodexPermissionsModeArg(value);
@@ -1884,6 +1965,8 @@ async function setConversationPermissions(deps, ctx, args) {
 	return await deps.setCodexConversationPermissions({
 		mode: parsed,
 		config: ctx.config,
+		storePath: authority.storePath,
+		assertCurrent: authority.assertHostCurrent,
 		session: {
 			agentId: target.agentId,
 			sessionId: ctx.sessionId,
@@ -1893,31 +1976,26 @@ async function setConversationPermissions(deps, ctx, args) {
 }
 async function startThreadAction(deps, ctx, pluginConfig, kind, args) {
 	if (args.length > 0) return `Usage: /codex ${kind}`;
-	const target = await resolveControlTarget(ctx);
+	const authority = await resolvePreparedCodexCommandAuthority(deps, ctx);
+	const { target, binding } = authority;
 	if (!target) return `Cannot start Codex ${kind === "compact" ? "compaction" : "review"} because this command did not include a stable binding identity.`;
-	const binding = await deps.bindingStore.read(target.identity);
 	if (!binding?.threadId) return `No Codex thread is attached to this OpenClaw session yet.`;
 	if (kind === "compact") {
 		const sessionTarget = ctx.sessionTarget;
 		if (!ctx.sessionId || !ctx.sessionKey || !sessionTarget || sessionTarget.sessionId !== ctx.sessionId || sessionTarget.sessionKey !== ctx.sessionKey) return "Codex compaction is unavailable because this command is not bound to a complete session identity.";
 		const currentSession = getSessionEntry({
-			storePath: sessionTarget.storePath,
+			storePath: authority.storePath ?? sessionTarget.storePath,
 			sessionKey: ctx.sessionKey,
 			hydrateSkillPromptRefs: false,
 			readConsistency: "latest"
 		});
 		if (currentSession?.sessionId !== ctx.sessionId || resolvePersistedSessionRuntimeId(currentSession) !== "codex") return "Codex compaction is unavailable because the current OpenClaw session is not using the Codex runtime.";
 		if (target.identity.kind === "conversation") {
-			const sessionBinding = ctx.sessionId ? await deps.bindingStore.read(sessionBindingIdentity({
-				sessionId: ctx.sessionId,
-				sessionKey: ctx.sessionKey,
-				agentId: sessionTarget.agentId,
-				config: ctx.config
-			})) : void 0;
-			if (!isSameCodexAppServerThreadOwner(binding, sessionBinding)) return "Codex compaction is unavailable because the conversation-bound thread differs from the current session binding. Resume that thread into the session first.";
+			if (!isSameCodexAppServerThreadOwner(binding, authority.currentSessionBinding)) return "Codex compaction is unavailable because the conversation-bound thread differs from the current session binding. Resume that thread into the session first.";
 		}
 		const compactCurrent = ctx.runtimeContext?.compactCurrent;
 		if (!compactCurrent) return "Codex compaction is unavailable because this command is not bound to a session.";
+		authority.assertCurrent();
 		const result = await compactCurrent();
 		return result.compacted ? `Compacted Codex session (${result.tokensAfter ?? "unknown"} tokens after).` : `Codex compaction did not complete: ${formatCodexDisplayText(result.reason ?? "no reason returned")}.`;
 	}
@@ -1933,6 +2011,10 @@ async function startThreadAction(deps, ctx, pluginConfig, kind, args) {
 		agentDir: target.agentDir,
 		authProfileId: connection.clientAuthProfileId,
 		config: ctx.config,
+		sessionId: authority.sessionId,
+		sessionKey: authority.sessionKey,
+		storePath: authority.storePath,
+		assertCurrent: authority.assertCurrent,
 		...connection.usesSupervisionConnection ? {
 			startOptions: connection.appServer.start,
 			beforeRequest: supervisedCommandGuard(deps, target.identity, binding)
@@ -1947,7 +2029,7 @@ function supervisedCommandGuard(deps, identity, binding) {
 			includeTurns: false
 		});
 		scope.assertCurrent();
-		if (!isDeepStrictEqual(await deps.bindingStore.read(identity), binding)) throw new Error("Codex command binding changed before model execution");
+		if (!isDeepStrictEqual(deps.bindingStore.read(identity), binding)) throw new Error("Codex command binding changed before model execution");
 		scope.assertCurrent();
 		assertCodexSupervisionThreadLineage(binding, thread);
 	};