@openclaw/codex 2026.9.2 → 2026.9.3

package/README.md

@@ -34,4 +34,6 @@ For a supervised branch, Codex App Server selects the snapshot fork's model and
 
 The visible-history mirror keeps at most 200 user or assistant messages, 512 KiB total, and 64 KiB per message. Image inputs become `[Image attachment]`; image data and local paths are not copied.
 
+When settled-turn recovery rejects history, the `codex settled-turn finalization context capture failed` warning includes a stable `reason`, such as `item_limit`, `byte_limit`, `field_limit`, `unsupported_user_image`, or `snapshot_invalidated`. Unknown failures use `history_read_failed`. The warning excludes transcript content and exception text. Rejected history remains unavailable for finalization, and completed actions are never replayed.
+
 See the [Codex harness](https://docs.openclaw.ai/plugins/codex-harness) and [Codex supervision](https://docs.openclaw.ai/plugins/codex-supervision) guides.

package/dist/api.js

@@ -1,15 +1,20 @@
-import { a as resolveCodexAppServerStartOptionsForAgent, i as resolveCodexAppServerRuntimeOptions } from "./config-CyapYSji.js";
-import { n as resolveManagedCodexAppServerStartOptions, o as CODEX_APP_SERVER_VERSION, r as resolveManagedCodexNativeCommand, t as isManagedCodexDesktopCommand } from "./managed-binary-DcpnJF9x.js";
+import { a as resolveCodexAppServerStartOptionsForAgent } from "./config-options-jnIFvwxD.js";
+import { n as resolveManagedCodexAppServerStartOptions, r as resolveManagedCodexNativeCommand, t as isManagedCodexDesktopCommand } from "./managed-binary-DrjjRRUD.js";
+import { t as CODEX_APP_SERVER_VERSION } from "./version-omm6IPI3.js";
+import "./config-JDfTI4VI.js";
+import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-BWf6JLWG.js";
 import { listAgentIds, resolveAgentDir } from "openclaw/plugin-sdk/agent-scope-runtime";
 import path from "node:path";
-import { resolveDefaultModelForAgent } from "openclaw/plugin-sdk/agent-runtime";
 import { execFile } from "node:child_process";
 import { fileURLToPath } from "node:url";
+import { promisify } from "node:util";
+import { resolveDefaultModelForAgent } from "openclaw/plugin-sdk/agent-runtime";
 import { resolveEffectiveAgentRuntime } from "openclaw/plugin-sdk/command-auth-native";
 //#region extensions/codex/src/doctor.ts
 const CODEX_MANAGED_APP_SERVER_CHECK_ID = "codex/managed-app-server";
 const CODEX_VERSION_TIMEOUT_MS = 5e3;
 const CODEX_VERSION_MAX_BUFFER_BYTES = 65536;
+const execFileAsync = promisify(execFile);
 function managedCodexFinding(params) {
 	return {
 		checkId: CODEX_MANAGED_APP_SERVER_CHECK_ID,
@@ -28,22 +33,12 @@ function parseCodexVersion(output) {
 	return /(?:^|\s)(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?)(?:\s|$)/u.exec(output)?.[1];
 }
 function runVersionCommand(command) {
-	return new Promise((resolve, reject) => {
-		execFile(command, ["--version"], {
-			encoding: "utf8",
-			maxBuffer: CODEX_VERSION_MAX_BUFFER_BYTES,
-			timeout: CODEX_VERSION_TIMEOUT_MS,
-			windowsHide: true
-		}, (error, stdout, stderr) => {
-			if (error) {
-				reject(new Error(readErrorMessage(error), { cause: error }));
-				return;
-			}
-			resolve({
-				stdout,
-				stderr
-			});
-		});
+	return execFileAsync(command, ["--version"], {
+		encoding: "utf8",
+		maxBuffer: CODEX_VERSION_MAX_BUFFER_BYTES,
+		timeout: CODEX_VERSION_TIMEOUT_MS,
+		killSignal: "SIGKILL",
+		windowsHide: true
 	});
 }
 function createCodexManagedAppServerHealthCheck(params) {

package/dist/apply-B6el6hdO.js

@@ -0,0 +1,357 @@
+import { m as CODEX_PLUGINS_MARKETPLACE_NAME } from "./config-utils-C57JiJrU.js";
+import { x as readCodexPluginConfig } from "./protocol-CAAcVIKF.js";
+import { s as resolveCodexAppServerFallbackApiKeyCacheKey } from "./auth-cache-key-Kq6oerr6.js";
+import { r as buildCodexPluginAppCacheKey, s as defaultCodexAppInventoryCache } from "./plugin-app-cache-key-CdSQzWyX.js";
+import { i as requestCodexAppServerJson } from "./request-CGvGOpeR.js";
+import "./config-JDfTI4VI.js";
+import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-BWf6JLWG.js";
+import { i as resolveCodexAppServerAuthProfileIdForAgent } from "./auth-profile-CwzO4_RG.js";
+import { X as resolveCodexAppServerAuthAccountCacheKey, c as getLeasedSharedCodexAppServerClient, h as releaseLeasedSharedCodexAppServerClient, o as clearSharedCodexAppServerClientIfCurrentAndWait } from "./shared-client-CVhez2Uo.js";
+import { t as ensureCodexPluginActivation } from "./plugin-activation-BQK-f5sV.js";
+import { CODEX_PLUGIN_CONFIG_PATH, buildCodexMigrationPlan, buildCodexPluginsConfigValue, hasCodexPluginConfigConflict, n as applyCodexAuthItems, readCodexPluginMigrationConfigEntry, t as resolveCodexMigrationTargets } from "./plan-BMJdMOEF.js";
+import { uniqueStrings } from "openclaw/plugin-sdk/string-coerce-runtime";
+import { parseStrictNonNegativeInteger } from "openclaw/plugin-sdk/number-runtime";
+import path from "node:path";
+import { coerceErrorMessage } from "openclaw/plugin-sdk/error-runtime";
+import { sleep } from "openclaw/plugin-sdk/runtime-env";
+import { MIGRATION_REASON_TARGET_EXISTS, applyMigrationManualItem, markMigrationItemConflict, markMigrationItemError, markMigrationItemSkipped, resolveMigrationConfigRuntime, summarizeMigrationItems, writeMigrationConfigPath } from "openclaw/plugin-sdk/migration";
+import { archiveMigrationItem, copyMemoryMigrationFileItem, copyMigrationFileItem, withCachedMigrationConfigRuntime, writeMigrationReport } from "openclaw/plugin-sdk/migration-runtime";
+//#region extensions/codex/src/migration/apply-report.ts
+function codexPluginActivationReportState(result) {
+	switch (result.reason) {
+		case "already_active":
+		case "installed": return {
+			installed: true,
+			enabled: true
+		};
+		case "auth_required": return {
+			installed: true,
+			enabled: false
+		};
+		case "disabled":
+		case "install_failed":
+		case "marketplace_missing":
+		case "plugin_missing": return {
+			installed: false,
+			enabled: false
+		};
+		case "refresh_failed": return {
+			installed: true,
+			enabled: false
+		};
+	}
+	return result.reason;
+}
+function sanitizeAppsNeedingAuth(apps) {
+	return apps.map((app) => ({
+		id: app.id,
+		name: app.name,
+		needsAuth: true
+	}));
+}
+//#endregion
+//#region extensions/codex/src/migration/apply.ts
+const CODEX_PLUGIN_AUTH_REQUIRED_REASON = "auth_required";
+const CODEX_PLUGIN_NOT_SELECTED_REASON = "not selected for migration";
+const CODEX_CONFIG_PATCH_MODE_RETURN = "return";
+const CODEX_PLUGIN_LOAD_WARNING = "Some Codex plugins could not be migrated. Run `openclaw migrate codex` after onboarding.";
+const TARGET_CODEX_MARKETPLACE_DISCOVERY_POLL_MS = 250;
+const TARGET_CODEX_MARKETPLACE_DISCOVERY_TIMEOUT_MS = 3e4;
+const TARGET_CODEX_MARKETPLACE_DISCOVERY_TIMEOUT_ENV = "OPENCLAW_CODEX_MIGRATION_PLUGIN_LIST_TIMEOUT_MS";
+var CodexPluginConfigConflictError = class extends Error {
+	constructor(reason) {
+		super(reason);
+		this.reason = reason;
+		this.name = "CodexPluginConfigConflictError";
+	}
+};
+function shouldReturnCodexPluginConfigPatch(ctx) {
+	return ctx.providerOptions?.configPatchMode === CODEX_CONFIG_PATCH_MODE_RETURN;
+}
+function prepareTargetCodexAppServer(ctx) {
+	const appServer = resolveTargetCodexAppServer(ctx);
+	const targets = resolveCodexMigrationTargets(ctx);
+	let warmedClient;
+	const ready = getLeasedSharedCodexAppServerClient({
+		startOptions: appServer.start,
+		timeoutMs: 6e4,
+		agentDir: targets.agentDir,
+		config: ctx.config
+	}).then((client) => {
+		warmedClient = client;
+	}, () => void 0);
+	return { async dispose() {
+		await ready;
+		if (warmedClient) releaseLeasedSharedCodexAppServerClient(warmedClient);
+		await clearSharedCodexAppServerClientIfCurrentAndWait(warmedClient, {
+			exitTimeoutMs: 2e3,
+			forceKillDelayMs: 250
+		});
+	} };
+}
+async function applyCodexMigrationPlan(params) {
+	const plan = params.plan ?? await buildCodexMigrationPlan(params.ctx);
+	const reportDir = params.ctx.reportDir ?? path.join(params.ctx.stateDir, "migration", "codex");
+	const items = [];
+	const targets = resolveCodexMigrationTargets(params.ctx);
+	const codexHome = typeof plan.metadata?.codexHome === "string" && plan.metadata.codexHome.trim() ? plan.metadata.codexHome : plan.source;
+	const authSource = {
+		codexHome,
+		authPath: path.join(codexHome, "auth.json"),
+		modelsCachePath: path.join(codexHome, "models_cache.json")
+	};
+	const runtime = withCachedMigrationConfigRuntime(params.ctx.runtime ?? params.runtime, params.ctx.config);
+	const applyCtx = {
+		...params.ctx,
+		runtime
+	};
+	for (const item of plan.items) {
+		if (item.status !== "planned") {
+			items.push(item);
+			continue;
+		}
+		if (item.id === "config:codex-plugins") items.push(await applyCodexPluginConfigItem(applyCtx, item, items));
+		else if (item.kind === "auth") items.push(...await applyCodexAuthItems({
+			ctx: applyCtx,
+			item,
+			source: authSource,
+			targets
+		}));
+		else if (item.kind === "plugin" && item.action === "install") items.push(await applyCodexPluginInstallItem(applyCtx, item));
+		else if (item.kind === "manual") items.push(applyMigrationManualItem(item));
+		else if (item.action === "archive") items.push(await archiveMigrationItem(item, reportDir));
+		else if (item.kind === "memory") items.push(await copyMemoryMigrationFileItem(item, reportDir, {
+			workspaceDir: targets.workspaceDir,
+			overwrite: params.ctx.overwrite
+		}));
+		else items.push(await copyMigrationFileItem(item, reportDir, { overwrite: params.ctx.overwrite }));
+	}
+	const result = {
+		...plan,
+		items,
+		summary: summarizeMigrationItems(items),
+		backupPath: params.ctx.backupPath,
+		reportDir
+	};
+	if (items.some(isCodexPluginLoadWarningItem)) {
+		result.warnings = uniqueStrings([...result.warnings ?? [], CODEX_PLUGIN_LOAD_WARNING]);
+		result.nextSteps = uniqueStrings([CODEX_PLUGIN_LOAD_WARNING, ...result.nextSteps ?? []]);
+	}
+	await writeMigrationReport(result, { title: "Codex Migration Report" });
+	return result;
+}
+async function applyCodexPluginInstallItem(ctx, item) {
+	const policy = readCodexPluginPolicy(item);
+	if (!policy) return {
+		...markMigrationItemError(item, "invalid Codex plugin migration item"),
+		details: {
+			...item.details,
+			code: "invalid_plugin_item"
+		}
+	};
+	try {
+		const appCacheKey = await buildTargetCodexPluginAppCacheKey(ctx);
+		const appServer = resolveTargetCodexAppServer(ctx);
+		const result = await ensureCodexPluginActivation({
+			identity: policy,
+			installEvenIfActive: true,
+			request: async (method, requestParams) => await requestTargetCodexAppServerJson({
+				method,
+				requestParams,
+				timeoutMs: 6e4,
+				startOptions: appServer.start,
+				agentDir: resolveCodexMigrationTargets(ctx).agentDir,
+				config: ctx.config,
+				isolated: false
+			}),
+			appCache: defaultCodexAppInventoryCache,
+			appCacheKey
+		});
+		const baseDetails = {
+			...item.details,
+			code: result.reason,
+			activationReason: result.reason,
+			...codexPluginActivationReportState(result),
+			installAttempted: result.installAttempted,
+			diagnostics: result.diagnostics.map((diagnostic) => diagnostic.message)
+		};
+		if (result.ok) return {
+			...item,
+			status: "migrated",
+			...result.reason === "already_active" ? { reason: "already active" } : {},
+			details: baseDetails
+		};
+		if (result.reason === CODEX_PLUGIN_AUTH_REQUIRED_REASON) return {
+			...item,
+			status: "skipped",
+			reason: CODEX_PLUGIN_AUTH_REQUIRED_REASON,
+			details: {
+				...baseDetails,
+				appsNeedingAuth: sanitizeAppsNeedingAuth(result.installResponse?.appsNeedingAuth ?? [])
+			}
+		};
+		if (result.reason === "plugin_missing" || result.reason === "marketplace_missing") return {
+			...item,
+			status: "warning",
+			reason: result.reason,
+			message: `Codex plugin "${policy.pluginName}" could not be migrated automatically`,
+			details: {
+				...baseDetails,
+				warningReason: CODEX_PLUGIN_LOAD_WARNING
+			}
+		};
+		return {
+			...item,
+			status: "error",
+			reason: result.reason,
+			details: baseDetails
+		};
+	} catch (error) {
+		if (isCodexPluginInventoryLoadError(error)) return {
+			...item,
+			status: "warning",
+			reason: "plugin_inventory_unavailable",
+			message: `Codex plugin "${policy.pluginName}" could not be migrated automatically`,
+			details: {
+				...item.details,
+				code: "plugin_inventory_unavailable",
+				warningReason: CODEX_PLUGIN_LOAD_WARNING,
+				diagnostic: coerceErrorMessage(error)
+			}
+		};
+		return {
+			...item,
+			status: "error",
+			reason: coerceErrorMessage(error),
+			details: {
+				...item.details,
+				code: "plugin_install_failed"
+			}
+		};
+	}
+}
+function isCodexPluginInventoryLoadError(error) {
+	return coerceErrorMessage(error).includes("codex app-server plugin/list timed out");
+}
+function resolveTargetCodexAppServer(ctx) {
+	return resolveCodexAppServerRuntimeOptions({ pluginConfig: readCodexPluginConfig(ctx.config) });
+}
+async function requestTargetCodexAppServerJson(params) {
+	if (params.method !== "plugin/list") return await requestCodexAppServerJson(params);
+	const deadline = Date.now() + params.timeoutMs;
+	const discoveryTimeoutMs = targetCodexMarketplaceDiscoveryTimeoutMs();
+	const discoveryDeadline = Math.min(deadline, Date.now() + discoveryTimeoutMs);
+	let lastResponse;
+	let attempt = 0;
+	do {
+		attempt += 1;
+		const remainingMs = Math.max(1, discoveryDeadline - Date.now());
+		lastResponse = await requestCodexAppServerJson({
+			...params,
+			timeoutMs: remainingMs
+		});
+		if (hasOpenAiCuratedMarketplace(lastResponse)) return lastResponse;
+		if (Date.now() >= discoveryDeadline) return lastResponse;
+		const waitMs = Math.min(TARGET_CODEX_MARKETPLACE_DISCOVERY_POLL_MS, discoveryDeadline - Date.now());
+		await sleep(waitMs);
+	} while (Date.now() < discoveryDeadline);
+	return lastResponse;
+}
+function hasOpenAiCuratedMarketplace(response) {
+	if (!response || typeof response !== "object" || !("marketplaces" in response)) return false;
+	const marketplaces = response.marketplaces;
+	return Array.isArray(marketplaces) && marketplaces.some((marketplace) => marketplace && typeof marketplace === "object" && marketplace.name === "openai-curated");
+}
+function targetCodexMarketplaceDiscoveryTimeoutMs(env = process.env) {
+	const configured = parseStrictNonNegativeInteger(env[TARGET_CODEX_MARKETPLACE_DISCOVERY_TIMEOUT_ENV]);
+	if (configured !== void 0) return configured;
+	return TARGET_CODEX_MARKETPLACE_DISCOVERY_TIMEOUT_MS;
+}
+function isCodexPluginLoadWarningItem(item) {
+	return item.kind === "plugin" && item.action === "install" && item.status === "warning" && item.details?.warningReason === CODEX_PLUGIN_LOAD_WARNING;
+}
+async function buildTargetCodexPluginAppCacheKey(ctx) {
+	const targets = resolveCodexMigrationTargets(ctx);
+	const appServer = resolveTargetCodexAppServer(ctx);
+	const authProfileId = resolveCodexAppServerAuthProfileIdForAgent({
+		agentDir: targets.agentDir,
+		config: ctx.config
+	});
+	const accountId = await resolveCodexAppServerAuthAccountCacheKey({
+		authProfileId,
+		agentDir: targets.agentDir,
+		config: ctx.config
+	});
+	const envApiKeyFingerprint = authProfileId ? void 0 : resolveCodexAppServerFallbackApiKeyCacheKey({ startOptions: appServer.start });
+	return buildCodexPluginAppCacheKey({
+		appServer,
+		agentDir: targets.agentDir,
+		authProfileId,
+		accountId,
+		envApiKeyFingerprint
+	});
+}
+async function applyCodexPluginConfigItem(ctx, item, appliedItems) {
+	if (appliedItems.filter((candidate) => candidate.kind === "plugin" && candidate.action === "install" && readCodexPluginPolicy(candidate) !== void 0 && !isCodexPluginConfigTerminal(candidate)).length > 0) return {
+		...item,
+		status: "warning",
+		reason: "selected Codex plugin activation is incomplete"
+	};
+	const entries = appliedItems.map(readAppliedPluginConfigEntry).filter((entry) => entry !== void 0);
+	if (entries.length === 0) return {
+		...markMigrationItemSkipped(item, "no selected Codex plugins"),
+		deferredCompletion: true
+	};
+	const returnPatch = shouldReturnCodexPluginConfigPatch(ctx);
+	const configApi = resolveMigrationConfigRuntime(ctx);
+	const currentConfig = returnPatch ? ctx.config : configApi?.current?.();
+	if (!currentConfig) return markMigrationItemError(item, "config runtime unavailable");
+	const value = buildCodexPluginsConfigValue(entries, currentConfig);
+	if (!ctx.overwrite && hasCodexPluginConfigConflict(currentConfig, value)) return markMigrationItemConflict(item, MIGRATION_REASON_TARGET_EXISTS);
+	const migratedItem = {
+		...item,
+		status: "migrated",
+		details: {
+			...item.details,
+			path: [...CODEX_PLUGIN_CONFIG_PATH],
+			value
+		}
+	};
+	if (returnPatch) return migratedItem;
+	if (!configApi?.mutateConfigFile) return markMigrationItemError(item, "config runtime unavailable");
+	try {
+		await configApi.mutateConfigFile({
+			base: "runtime",
+			afterWrite: { mode: "auto" },
+			mutate(draft) {
+				if (!ctx.overwrite && hasCodexPluginConfigConflict(draft, value)) throw new CodexPluginConfigConflictError(MIGRATION_REASON_TARGET_EXISTS);
+				writeMigrationConfigPath(draft, CODEX_PLUGIN_CONFIG_PATH, value);
+			}
+		});
+		return migratedItem;
+	} catch (error) {
+		if (error instanceof CodexPluginConfigConflictError) return markMigrationItemConflict(item, error.reason);
+		return markMigrationItemError(item, coerceErrorMessage(error));
+	}
+}
+function isCodexPluginConfigTerminal(item) {
+	return item.status === "migrated" || item.status === "skipped" && (item.deferredCompletion === true || item.reason === CODEX_PLUGIN_NOT_SELECTED_REASON || item.reason === CODEX_PLUGIN_AUTH_REQUIRED_REASON);
+}
+function readAppliedPluginConfigEntry(item) {
+	if (item.status === "migrated" || item.deferredCompletion === true) return readCodexPluginMigrationConfigEntry(item, true);
+	if (item.status === "skipped" && item.reason === CODEX_PLUGIN_AUTH_REQUIRED_REASON) return readCodexPluginMigrationConfigEntry(item, false);
+}
+function readCodexPluginPolicy(item) {
+	const entry = readCodexPluginMigrationConfigEntry(item, true);
+	if (!entry) return;
+	return {
+		configKey: entry.configKey,
+		marketplaceName: CODEX_PLUGINS_MARKETPLACE_NAME,
+		pluginName: entry.pluginName,
+		enabled: true,
+		allowDestructiveActions: true,
+		destructiveApprovalMode: "allow"
+	};
+}
+//#endregion
+export { applyCodexMigrationPlan, prepareTargetCodexAppServer };

package/dist/{attempt-client-cleanup-Bp1ZOnk2.js → attempt-client-cleanup-D6cR54TV.js}

@@ -1,8 +1,12 @@
-import { B as isJsonObject } from "./config-CyapYSji.js";
-import { Nt as unsubscribeCodexAppServerLiveThread, q as CodexAppServerRpcError, y as retireSharedCodexAppServerClientIfCurrent } from "./shared-client-CKhX2kFt.js";
+import { o as isJsonObject } from "./protocol-CAAcVIKF.js";
+import "./client-BEKu4yDx.js";
+import { m as retireSharedCodexAppServerClientIfCurrent } from "./auth-cache-key-Kq6oerr6.js";
+import { r as CodexAppServerRpcError } from "./session-catalog-provenance-DkJHo735.js";
+import { G as unsubscribeCodexAppServerLiveThread } from "./shared-client-CVhez2Uo.js";
 import { asFiniteNumber, normalizeOptionalString, normalizeOptionalString as normalizeOptionalString$1, readStringField } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { createDeferred } from "openclaw/plugin-sdk/extension-shared";
 import { embeddedAgentLog } from "openclaw/plugin-sdk/agent-harness-runtime";
+import { AsyncResource } from "node:async_hooks";
 import { redactSensitiveText } from "openclaw/plugin-sdk/logging-core";
 import { sanitizeTerminalText } from "openclaw/plugin-sdk/text-chunking";
 //#region extensions/codex/src/app-server/event-projector-values.ts
@@ -14,6 +18,10 @@ function readCodexProviderRefusal(message, codexErrorInfo) {
 		category: "cyber",
 		message
 	};
+	if (codexErrorInfo === "misalignmentPolicyViolation") return {
+		category: "misalignment",
+		message
+	};
 	return message.startsWith(BIO_POLICY_SAFETY_ACCESS_BLOCK_PREFIX) ? {
 		category: "bio",
 		message
@@ -293,7 +301,6 @@ var ClientTurnRouter = class {
 		this.routes = /* @__PURE__ */ new Map();
 		this.globalWarnings = [];
 		this.nativeTurnCompletionWatchers = /* @__PURE__ */ new Map();
-		this.disposed = false;
 		client.addNotificationHandler((notification) => this.routeNotification(notification));
 		client.addRequestHandler((request, signal) => this.routeRequest(request, signal));
 		client.addCloseHandler((closedClient) => {
@@ -334,9 +341,12 @@ var ClientTurnRouter = class {
 			get observedNativeTurnId() {
 				return route.observedNativeTurn?.id;
 			},
+			get completed() {
+				return Boolean(route.turnId && route.completedNativeTurnIds.has(route.turnId));
+			},
 			activate: (handlers) => this.activate(route, handlers),
 			armTurn: () => this.armTurn(route),
-			bindTurn: (turnId) => this.bindTurn(route, turnId),
+			bindTurn: (turnId, bindingOptions) => this.bindTurn(route, turnId, bindingOptions),
 			cancelTurn: () => this.cancelTurn(route),
 			drain: () => this.drainNotifications(route),
 			release: () => this.release(route)
@@ -393,9 +403,9 @@ var ClientTurnRouter = class {
 		};
 	}
 	dispose(cause) {
-		if (this.disposed) return;
-		this.disposed = true;
+		if (this.closeError) return;
 		const closeError = cause ? new Error("codex app-server turn router closed", { cause }) : /* @__PURE__ */ new Error("codex app-server turn router closed");
+		this.closeError = closeError;
 		for (const route of this.routes.values()) this.release(route, closeError);
 		for (const watchers of this.nativeTurnCompletionWatchers.values()) for (const watcher of watchers) watcher.finish(false);
 	}
@@ -409,7 +419,11 @@ var ClientTurnRouter = class {
 		if (route.handlers) throw new Error(`codex app-server thread route already activated: ${route.threadId}`);
 		this.assertRoute(route);
 		if (!handlers.onNotification && !handlers.onRequest) throw new Error("codex app-server thread route requires a notification or request handler");
-		route.handlers = handlers;
+		route.handlers = {
+			onRequest: handlers.onRequest && AsyncResource.bind(handlers.onRequest),
+			onNotification: handlers.onNotification && AsyncResource.bind(handlers.onNotification),
+			onNotificationReceived: handlers.onNotificationReceived && AsyncResource.bind(handlers.onNotificationReceived, void 0, handlers)
+		};
 		if (!handlers.onNotification) route.pending.length = 0;
 		else if (route.gate !== "armed") this.flushNotifications(route);
 		route.activated.resolve();
@@ -432,20 +446,22 @@ var ClientTurnRouter = class {
 		await this.waitForNotifications(route);
 		this.assertRoute(route);
 	}
-	async bindTurn(route, turnIdInput) {
-		this.assertRoute(route);
+	async bindTurn(route, turnIdInput, options) {
+		const turnId = requireId(turnIdInput, "turn id");
+		if (options?.completed && route.gate === "armed" && (!route.released || route.released === this.closeError)) route.completedNativeTurnIds.add(turnId);
+		this.assertRoute(route, route.gate === "armed" ? turnId : void 0);
 		if (!route.handlers) throw new Error("codex app-server thread route must be activated before binding a turn");
 		if (route.gate !== "armed") throw new Error(`codex app-server thread route cannot bind from ${route.gate}`);
-		const turnId = requireId(turnIdInput, "turn id");
 		route.gate = "bound";
 		route.turnId = turnId;
 		this.flushNotifications(route);
 		route.binding?.resolve();
 		await this.waitForNotifications(route);
-		this.assertRoute(route);
+		this.assertRoute(route, turnId);
+		await route.notificationTail;
 	}
 	routeNotification(notification) {
-		if (this.disposed) return;
+		if (this.closeError) return;
 		const scope = readScope(notification.params);
 		if (!scope.threadId && (notification.method === "configWarning" || notification.method === "warning")) {
 			if (this.globalWarnings.length === DEFAULT_GLOBAL_WARNING_LIMIT) this.globalWarnings.shift();
@@ -504,7 +520,7 @@ var ClientTurnRouter = class {
 		return route.notificationTail;
 	}
 	async routeRequest(request, signal = new AbortController().signal) {
-		if (this.disposed || signal.aborted) return;
+		if (this.closeError || signal.aborted) return;
 		const scope = readScope(request.params);
 		if (!scope.threadId) return;
 		const route = this.routes.get(scope.threadId);
@@ -579,7 +595,7 @@ var ClientTurnRouter = class {
 		this.release(route, error);
 	}
 	enqueueNotification(route, handler, notification, scope) {
-		if (route.released) return;
+		if (route.released && !this.canDrainClosedTurn(route, route.turnId)) return;
 		route.notificationTail = route.notificationTail.then(() => handler(notification, scope)).catch((error) => {
 			if (!route.released) embeddedAgentLog.warn("codex app-server keyed notification handler failed", {
 				method: notification.method,
@@ -598,7 +614,7 @@ var ClientTurnRouter = class {
 	release(route, error = /* @__PURE__ */ new Error("codex app-server thread route is released")) {
 		if (route.released) return;
 		route.released = error;
-		route.pending.length = 0;
+		if (error !== this.closeError) route.pending.length = 0;
 		route.ended.resolve();
 		route.activated.resolve();
 		route.binding?.resolve();
@@ -607,10 +623,13 @@ var ClientTurnRouter = class {
 		if (this.routes.get(route.threadId) === route) this.routes.delete(route.threadId);
 	}
 	assertActive() {
-		if (this.disposed) throw new Error("codex app-server turn router is closed");
+		if (this.closeError) throw new Error("codex app-server turn router is closed");
+	}
+	canDrainClosedTurn(route, turnId) {
+		return Boolean(this.closeError && route.released === this.closeError && turnId && route.completedNativeTurnIds.has(turnId));
 	}
-	assertRoute(route) {
-		if (route.released) throw route.released;
+	assertRoute(route, completedTurnId) {
+		if (route.released && !this.canDrainClosedTurn(route, completedTurnId)) throw route.released;
 	}
 };
 async function waitForPromiseOrAbort(promise, signal) {
@@ -745,7 +764,7 @@ async function interruptCodexTurnAndWaitBestEffort(client, params) {
 	}
 }
 /** Stops native terminals on the cancelled thread without retiring peer threads. */
-async function terminateCodexBackgroundTerminals(client, threadId) {
+async function terminateCodexBackgroundTerminals(client, threadId, oneShotCliRun = false) {
 	const options = {
 		timeoutMs: CODEX_APP_SERVER_INTERRUPT_TIMEOUT_MS,
 		signal: AbortSignal.timeout(CODEX_APP_SERVER_INTERRUPT_TIMEOUT_MS)
@@ -761,6 +780,7 @@ async function terminateCodexBackgroundTerminals(client, threadId) {
 				threadId,
 				limit: 1
 			}, options)).data.length > 0) throw new Error("native background terminals remain running");
+			if (oneShotCliRun) throw new Error("native terminal termination did not confirm process cleanup");
 		}
 	} catch (cause) {
 		throw new Error("Codex background-terminal cleanup failed; inspect the thread's running terminals before starting more work.", { cause });

package/dist/{attempt-context-CSazkWns.js → attempt-context-AO4DSjE0.js}

@@ -1,11 +1,11 @@
-import { B as isJsonObject, z as flattenCodexDynamicToolFunctions } from "./config-CyapYSji.js";
-import { ct as isMessageOnlyCodexSourceReply, et as areCodexDynamicToolFingerprintsCompatible, mt as isContextEngineBindingCompatible } from "./thread-lifecycle-DPK30jad.js";
-import { t as readCodexMirroredSessionHistoryMessages } from "./session-history-DWmMqiqW.js";
+import { a as flattenCodexDynamicToolFunctions, o as isJsonObject } from "./protocol-CAAcVIKF.js";
+import { t as readCodexMirroredSessionHistoryMessages } from "./session-history-Cz-tOOYj.js";
+import { Z as areCodexDynamicToolFingerprintsCompatible, at as isMessageOnlyCodexSourceReply, dt as isContextEngineBindingCompatible } from "./thread-lifecycle-D1pzRwHB.js";
 import { readNonBlankString } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { createHash } from "node:crypto";
 import path from "node:path";
-import { buildBootstrapContextForFiles, buildWatchedSessionsHarnessContext, embeddedAgentLog, resolveBootstrapFilesForRun } from "openclaw/plugin-sdk/agent-harness-runtime";
 import { resolveAgentWorkspaceDir } from "openclaw/plugin-sdk/agent-runtime";
+import { buildBootstrapContextForFiles, buildWatchedSessionsHarnessContext, embeddedAgentLog, resolveBootstrapFilesForRun } from "openclaw/plugin-sdk/agent-harness-runtime";
 import { resolveBootstrapFilesForPreparation } from "openclaw/plugin-sdk/codex-mcp-projection";
 import { prepareMemorySystemPromptAddition } from "openclaw/plugin-sdk/core";
 import { MESSAGE_TOOL_DELIVERY_HINTS } from "openclaw/plugin-sdk/message-tool-delivery-hints";
@@ -214,6 +214,7 @@ function buildCodexSystemPromptReport(params) {
 		injectedWorkspaceFiles: buildCodexBootstrapInjectionStats({
 			bootstrapFiles: params.workspaceBootstrapContext.bootstrapFiles,
 			injectedFiles: params.workspaceBootstrapContext.promptContextFiles ?? [],
+			omitReferenceFiles: params.omitWorkspaceReferences,
 			developerInstructionFiles: [...params.workspaceBootstrapContext.threadDeveloperInstructionFiles ?? [], ...params.workspaceBootstrapContext.turnScopedDeveloperInstructionFiles ?? []],
 			memoryToolRoutedBootstrapFiles: params.workspaceBootstrapContext.memoryToolRoutedBootstrapFiles ?? [],
 			memoryToolRouted: params.workspaceBootstrapContext.memoryToolRouted === true
@@ -304,8 +305,9 @@ function buildCodexBootstrapInjectionStats(params) {
 			injectedChars: null,
 			truncated: null
 		};
-		const injectedChars = memoryToolRoutedFile ? 0 : injected?.length ?? 0;
-		const truncated = memoryToolRoutedFile ? false : !file.missing && injectedChars < rawChars;
+		const omitted = memoryToolRoutedFile || params.omitReferenceFiles && readCodexIndexedContextFileContent(injectedIndex, pathValue, fileName) !== void 0;
+		const injectedChars = omitted ? 0 : injected?.length ?? 0;
+		const truncated = omitted ? false : !file.missing && injectedChars < rawChars;
 		return {
 			name: displayName,
 			path: pathValue,