@openclaw/codex 2026.9.2 → 2026.9.3

package/dist/{isolated-completion-CRh-51AK.js → isolated-completion-DHBefrzg.js}

@@ -1,7 +1,10 @@
-import { O as readCodexPluginConfig, r as resolveCodexAppServerHomeScope } from "./config-CyapYSji.js";
-import { Kt as resolveCodexAppServerPreparedAuthHandoff, Z as assertCodexPassiveTurnItems } from "./shared-client-CKhX2kFt.js";
-import { t as runBoundedCodexAppServerTurn } from "./bounded-turn-DxGJRYbY.js";
-import { a as createAttributedCodexAssistantMessage } from "./event-projector-assistant-message-B9kp6iGC.js";
+import { i as resolveCodexAppServerHomeScope } from "./config-options-jnIFvwxD.js";
+import { x as readCodexPluginConfig } from "./protocol-CAAcVIKF.js";
+import { g as assertCodexPassiveTurnItems } from "./client-BEKu4yDx.js";
+import "./config-JDfTI4VI.js";
+import { Z as resolveCodexAppServerPreparedAuthHandoff } from "./shared-client-CVhez2Uo.js";
+import { runBoundedCodexAppServerTurn } from "./bounded-turn-lRpmZHFv.js";
+import { a as createAttributedCodexAssistantMessage } from "./event-projector-assistant-message-BmBM4qBV.js";
 //#region extensions/codex/src/app-server/isolated-completion.ts
 /** Runs prompt-only Codex inference on an ephemeral, ring-zero native thread. */
 async function runCodexIsolatedCompletion(params, options) {

package/dist/launch-args-RXQwn8zV.js

@@ -0,0 +1,90 @@
+//#region extensions/codex/src/app-server/launch-args.ts
+const CODEX_VALUE_OPTIONS = /* @__PURE__ */ new Set([
+	"-m",
+	"--model",
+	"--local-provider",
+	"-p",
+	"--profile",
+	"-s",
+	"--sandbox",
+	"-a",
+	"--ask-for-approval",
+	"-C",
+	"--cd",
+	"--add-dir",
+	"--remote",
+	"--remote-auth-token-env",
+	"-c",
+	"--config",
+	"--enable",
+	"--disable",
+	"--listen",
+	"--code-mode-host",
+	"--ws-auth",
+	"--ws-token-file",
+	"--ws-token-sha256",
+	"--ws-shared-secret-file",
+	"--ws-issuer",
+	"--ws-audience",
+	"--ws-max-clock-skew-seconds"
+]);
+/** One tokenization owner for launch, turn policy, reviewer trust, and private turns. */
+function readCodexArgs(args) {
+	const tokens = [];
+	let nativeSubcommand = false;
+	let end = 0;
+	for (const [index, arg] of args.entries()) {
+		if (index < end) continue;
+		end = index + 1;
+		const attached = /^(--[^=]+)=([\s\S]*)$/u.exec(arg) ?? /^(-[cmpisaC])=?([\s\S]+)$/u.exec(arg);
+		const name = attached?.[1] ?? arg;
+		let value = attached?.[2];
+		if (name === "-i" || name === "--image") while (args[end]?.startsWith("-") === false) end += 1;
+		else if (!attached && CODEX_VALUE_OPTIONS.has(name)) {
+			value = args[end];
+			if (value !== void 0) end += 1;
+		}
+		tokens.push({
+			index,
+			end,
+			name,
+			value
+		});
+		if (name === "app-server") nativeSubcommand = true;
+		if (name === "--" && nativeSubcommand) break;
+	}
+	return tokens;
+}
+function readCodexAppServerConfigOptions(args) {
+	return readCodexArgs(args).filter(({ name }) => name === "-c" || name === "--config" || name === "-p" || name === "--profile");
+}
+/** The stdio proxy forwards to an external server; it does not own that runtime. */
+function isCodexAppServerProxyLaunch(args) {
+	const tokens = readCodexArgs(args);
+	const server = tokens.findLastIndex(({ name }) => name === "app-server");
+	return server >= 0 && tokens.slice(server + 1).find(({ name }) => !name.startsWith("-"))?.name === "proxy";
+}
+/** Keeps Codex overrides in one CLI scope without rewriting raw TOML or wrapper prefixes. */
+function normalizeCodexAppServerArgs(rawArgs, enforcedOverride) {
+	const tokens = readCodexArgs(rawArgs);
+	const subcommandIndex = tokens.findLast(({ name }) => name === "app-server")?.index ?? -1;
+	const prefix = subcommandIndex < 0 ? [...rawArgs] : rawArgs.slice(0, subcommandIndex);
+	const suffix = [];
+	if (subcommandIndex >= 0) for (const token of tokens) {
+		if (token.index <= subcommandIndex) continue;
+		if (token.name === "--") {
+			suffix.push(...rawArgs.slice(token.index));
+			break;
+		}
+		(token.name === "-c" || token.name === "--config" ? prefix : suffix).push(...rawArgs.slice(token.index, token.end));
+	}
+	if (enforcedOverride && !(prefix.at(-2) === "-c" && prefix.at(-1) === enforcedOverride)) prefix.push("-c", enforcedOverride);
+	const normalized = subcommandIndex < 0 ? prefix : [
+		...prefix,
+		"app-server",
+		...suffix
+	];
+	return normalized.length === rawArgs.length && normalized.every((arg, index) => arg === rawArgs[index]) ? rawArgs : normalized;
+}
+//#endregion
+export { normalizeCodexAppServerArgs as n, readCodexAppServerConfigOptions as r, isCodexAppServerProxyLaunch as t };

package/dist/{managed-binary-DcpnJF9x.js → managed-binary-DrjjRRUD.js}

@@ -1,98 +1,10 @@
+import { n as MANAGED_CODEX_APP_SERVER_PACKAGE } from "./version-omm6IPI3.js";
 import { createRequire } from "node:module";
-import { access } from "node:fs/promises";
-import path from "node:path";
 import { constants, existsSync, realpathSync } from "node:fs";
+import path from "node:path";
+import { access } from "node:fs/promises";
 import { expectDefined } from "openclaw/plugin-sdk/expect-runtime";
 import { resolveGlobalSingleton } from "openclaw/plugin-sdk/global-singleton";
-//#region extensions/codex/src/app-server/launch-args.ts
-const CODEX_VALUE_OPTIONS = /* @__PURE__ */ new Set([
-	"-m",
-	"--model",
-	"--local-provider",
-	"-p",
-	"--profile",
-	"-s",
-	"--sandbox",
-	"-a",
-	"--ask-for-approval",
-	"-C",
-	"--cd",
-	"--add-dir",
-	"--remote",
-	"--remote-auth-token-env",
-	"-c",
-	"--config",
-	"--enable",
-	"--disable",
-	"--listen",
-	"--code-mode-host",
-	"--ws-auth",
-	"--ws-token-file",
-	"--ws-token-sha256",
-	"--ws-shared-secret-file",
-	"--ws-issuer",
-	"--ws-audience",
-	"--ws-max-clock-skew-seconds"
-]);
-/** One tokenization owner for launch, turn policy, reviewer trust, and private turns. */
-function readCodexArgs(args) {
-	const tokens = [];
-	let nativeSubcommand = false;
-	let end = 0;
-	for (const [index, arg] of args.entries()) {
-		if (index < end) continue;
-		end = index + 1;
-		const attached = /^(--[^=]+)=([\s\S]*)$/u.exec(arg) ?? /^(-[cmpisaC])=?([\s\S]+)$/u.exec(arg);
-		const name = attached?.[1] ?? arg;
-		let value = attached?.[2];
-		if (name === "-i" || name === "--image") while (args[end]?.startsWith("-") === false) end += 1;
-		else if (!attached && CODEX_VALUE_OPTIONS.has(name)) {
-			value = args[end];
-			if (value !== void 0) end += 1;
-		}
-		tokens.push({
-			index,
-			end,
-			name,
-			value
-		});
-		if (name === "app-server") nativeSubcommand = true;
-		if (name === "--" && nativeSubcommand) break;
-	}
-	return tokens;
-}
-function readCodexAppServerConfigOptions(args) {
-	return readCodexArgs(args).filter(({ name }) => name === "-c" || name === "--config" || name === "-p" || name === "--profile");
-}
-/** The stdio proxy forwards to an external server; it does not own that runtime. */
-function isCodexAppServerProxyLaunch(args) {
-	const tokens = readCodexArgs(args);
-	const server = tokens.findLastIndex(({ name }) => name === "app-server");
-	return server >= 0 && tokens.slice(server + 1).find(({ name }) => !name.startsWith("-"))?.name === "proxy";
-}
-/** Keeps Codex overrides in one CLI scope without rewriting raw TOML or wrapper prefixes. */
-function normalizeCodexAppServerArgs(rawArgs, enforcedOverride) {
-	const tokens = readCodexArgs(rawArgs);
-	const subcommandIndex = tokens.findLast(({ name }) => name === "app-server")?.index ?? -1;
-	const prefix = subcommandIndex < 0 ? [...rawArgs] : rawArgs.slice(0, subcommandIndex);
-	const suffix = [];
-	if (subcommandIndex >= 0) for (const token of tokens) {
-		if (token.index <= subcommandIndex) continue;
-		if (token.name === "--") {
-			suffix.push(...rawArgs.slice(token.index));
-			break;
-		}
-		(token.name === "-c" || token.name === "--config" ? prefix : suffix).push(...rawArgs.slice(token.index, token.end));
-	}
-	if (enforcedOverride && !(prefix.at(-2) === "-c" && prefix.at(-1) === enforcedOverride)) prefix.push("-c", enforcedOverride);
-	const normalized = subcommandIndex < 0 ? prefix : [
-		...prefix,
-		"app-server",
-		...suffix
-	];
-	return normalized.length === rawArgs.length && normalized.every((arg, index) => arg === rawArgs[index]) ? rawArgs : normalized;
-}
-//#endregion
 //#region extensions/codex/src/app-server/desktop-app-paths.ts
 /** Shared path candidates for Codex's macOS desktop app bundle. */
 const MACOS_DESKTOP_CODEX_APP_PATH_CANDIDATES = [{
@@ -130,17 +42,6 @@ function resolveFirstExistingMacOSDesktopCodexBundledMarketplacePath(params = {}
 	return candidates.find((candidate) => pathExists(candidate));
 }
 //#endregion
-//#region extensions/codex/src/app-server/version.ts
-/**
-* Version and package pins for the managed Codex app-server runtime.
-*/
-/** Exact Codex app-server version shipped by the OpenClaw Codex bridge. */
-const CODEX_APP_SERVER_VERSION = "0.153.4";
-/** Inclusive runtime compatibility floor for external app-server binaries. */
-const MIN_SUPPORTED_CODEX_APP_SERVER_VERSION = "0.149.0";
-/** npm package name for the managed Codex app-server binary. */
-const MANAGED_CODEX_APP_SERVER_PACKAGE = "@openai/codex";
-//#endregion
 //#region extensions/codex/src/app-server/managed-binary.ts
 /**
 * Resolves the managed Codex app-server binary shipped with or installed beside
@@ -282,4 +183,4 @@ async function commandPathExists(filePath, platform) {
 	}
 }
 //#endregion
-export { setManagedCodexPluginRoot as a, resolveFirstExistingMacOSDesktopCodexBundledMarketplacePath as c, resolveMacOSDesktopCodexComputerUseServiceAppCandidates as d, isCodexAppServerProxyLaunch as f, resolvePackagedCodexNativeCommand as i, resolveMacOSDesktopCodexAppPathCandidates as l, readCodexAppServerConfigOptions as m, resolveManagedCodexAppServerStartOptions as n, CODEX_APP_SERVER_VERSION as o, normalizeCodexAppServerArgs as p, resolveManagedCodexNativeCommand as r, MIN_SUPPORTED_CODEX_APP_SERVER_VERSION as s, isManagedCodexDesktopCommand as t, resolveMacOSDesktopCodexBundledMarketplaceCandidates as u };
+export { setManagedCodexPluginRoot as a, resolveMacOSDesktopCodexBundledMarketplaceCandidates as c, resolvePackagedCodexNativeCommand as i, resolveMacOSDesktopCodexComputerUseServiceAppCandidates as l, resolveManagedCodexAppServerStartOptions as n, resolveFirstExistingMacOSDesktopCodexBundledMarketplacePath as o, resolveManagedCodexNativeCommand as r, resolveMacOSDesktopCodexAppPathCandidates as s, isManagedCodexDesktopCommand as t };

package/dist/managed-thread-store-D1t5jh3G.js

@@ -0,0 +1,66 @@
+import { createHash } from "node:crypto";
+import { embeddedAgentLog } from "openclaw/plugin-sdk/agent-harness-registration";
+import { z } from "zod";
+//#region extensions/codex/src/app-server/managed-thread-store.ts
+const CODEX_MANAGED_THREAD_NAMESPACE = "app-server-managed-threads";
+const CODEX_MANAGED_THREAD_MAX_ENTRIES = 2e4;
+const managedThreadSchema = z.object({
+	version: z.literal(1),
+	kind: z.literal("managed-thread"),
+	sourceHomeId: z.string().min(1),
+	threadId: z.string().min(1),
+	rolloutPath: z.string().min(1).optional()
+});
+async function markStartedCodexManagedThread(store, params) {
+	if (!store) return;
+	try {
+		await store.mark({
+			sourceHomeId: params.sourceHomeId,
+			threadId: params.threadId,
+			...params.rolloutPath ? { rolloutPath: params.rolloutPath } : {}
+		});
+	} catch (error) {
+		embeddedAgentLog.warn("failed to record Codex managed thread ownership", { error });
+	}
+}
+function managedThreadStoreKey(sourceHomeId, threadId) {
+	return `sha256:${createHash("sha256").update("openclaw:codex-managed-thread:v1\0").update(sourceHomeId).update("\0").update(threadId).digest("hex")}`;
+}
+/** Durable ownership index for Codex threads created by OpenClaw. */
+function createCodexManagedThreadStore(state) {
+	return {
+		async has(sourceHomeId, threadId) {
+			const parsed = managedThreadSchema.safeParse(state.lookup(managedThreadStoreKey(sourceHomeId, threadId)));
+			return parsed.success && parsed.data.sourceHomeId === sourceHomeId && parsed.data.threadId === threadId;
+		},
+		async mark(params) {
+			try {
+				const value = managedThreadSchema.parse({
+					version: 1,
+					kind: "managed-thread",
+					sourceHomeId: params.sourceHomeId.trim(),
+					threadId: params.threadId.trim(),
+					...params.rolloutPath?.trim() ? { rolloutPath: params.rolloutPath.trim() } : {}
+				});
+				state.registerIfAbsent(managedThreadStoreKey(value.sourceHomeId, value.threadId), value);
+				return true;
+			} catch (error) {
+				embeddedAgentLog.warn("failed to record Codex managed thread ownership", { error });
+				return false;
+			}
+		},
+		async snapshot() {
+			const byHome = /* @__PURE__ */ new Map();
+			for (const entry of state.entries()) {
+				const parsed = managedThreadSchema.safeParse(entry.value);
+				if (!parsed.success) continue;
+				const ids = byHome.get(parsed.data.sourceHomeId) ?? /* @__PURE__ */ new Set();
+				ids.add(parsed.data.threadId);
+				byHome.set(parsed.data.sourceHomeId, ids);
+			}
+			return byHome;
+		}
+	};
+}
+//#endregion
+export { markStartedCodexManagedThread as i, CODEX_MANAGED_THREAD_NAMESPACE as n, createCodexManagedThreadStore as r, CODEX_MANAGED_THREAD_MAX_ENTRIES as t };

package/dist/media-understanding-provider.js

@@ -1,4 +1,3 @@
-import { t as runBoundedCodexAppServerTurn } from "./bounded-turn-DxGJRYbY.js";
 import { isRecord } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { validateJsonSchemaValue } from "openclaw/plugin-sdk/json-schema-runtime";
 //#region extensions/codex/media-understanding-provider.ts
@@ -44,6 +43,8 @@ async function describeCodexImages(req, options) {
 	const model = req.model.trim();
 	if (!model) throw new Error("Codex image understanding requires model id.");
 	req.signal?.throwIfAborted();
+	const { runBoundedCodexAppServerTurn } = await import("./bounded-turn-lRpmZHFv.js");
+	req.signal?.throwIfAborted();
 	const { text } = await runBoundedCodexAppServerTurn({
 		config: req.cfg,
 		model: {
@@ -82,6 +83,8 @@ async function extractCodexStructured(req, options) {
 	if (req.input.length === 0) throw new Error("Codex structured extraction requires at least one input.");
 	if (!req.input.some((entry) => entry.type === "image")) throw new Error("Codex structured extraction requires at least one image input.");
 	req.signal?.throwIfAborted();
+	const { runBoundedCodexAppServerTurn } = await import("./bounded-turn-lRpmZHFv.js");
+	req.signal?.throwIfAborted();
 	const { text } = await runBoundedCodexAppServerTurn({
 		config: req.cfg,
 		model: {

package/dist/{model-catalog-DT5vo6qo.js → model-catalog-B_6M04Wo.js}

@@ -1,8 +1,9 @@
-import { r as buildCodexRuntimeModelParams } from "./harness-Czh2Sdoc.js";
-import { B as isJsonObject, O as readCodexPluginConfig, i as resolveCodexAppServerRuntimeOptions } from "./config-CyapYSji.js";
-import { r as captureSharedCodexAppServerCatalogLifetime } from "./shared-client-CKhX2kFt.js";
-import { t as listAllCodexAppServerModels } from "./models-CcrgSMQR.js";
-import { o as withCodexAppServerJsonClient } from "./request-C8H22rPi.js";
+import { r as buildCodexRuntimeModelParams } from "./harness-FR6eQgyO.js";
+import { o as isJsonObject, x as readCodexPluginConfig } from "./protocol-CAAcVIKF.js";
+import { o as withCodexAppServerJsonClient } from "./request-CGvGOpeR.js";
+import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-BWf6JLWG.js";
+import { r as captureSharedCodexAppServerCatalogLifetime } from "./shared-client-CVhez2Uo.js";
+import { t as listAllCodexAppServerModels } from "./models-P9k2qAof.js";
 //#region extensions/codex/src/app-server/model-catalog.ts
 const DEFAULT_MODEL_DISCOVERY_TIMEOUT_MS = 2500;
 const INPUT_TYPES = /* @__PURE__ */ new Set([

package/dist/{models-CcrgSMQR.js → models-P9k2qAof.js}

@@ -1,4 +1,4 @@
-import { X as assertCodexModelListResponse } from "./shared-client-CKhX2kFt.js";
+import { h as assertCodexModelListResponse } from "./client-BEKu4yDx.js";
 import { normalizeOptionalString, uniqueStrings } from "openclaw/plugin-sdk/string-coerce-runtime";
 //#region extensions/codex/src/app-server/models.ts
 /**
@@ -37,8 +37,8 @@ async function withCodexAppServerModelRequest(options, run) {
 	if (options.request) return await run(options.request);
 	const timeoutMs = options.timeoutMs ?? 2500;
 	const useSharedClient = options.sharedClient !== false;
-	const { createIsolatedCodexAppServerClient, getLeasedSharedCodexAppServerClient, releaseLeasedSharedCodexAppServerClient } = await import("./shared-client-CKhX2kFt.js").then((n) => n.x);
-	const { requestCodexAppServerClientJson } = await import("./request-C8H22rPi.js").then((n) => n.a);
+	const { createIsolatedCodexAppServerClient, getLeasedSharedCodexAppServerClient, releaseLeasedSharedCodexAppServerClient } = await import("./shared-client-CVhez2Uo.js").then((n) => n.y);
+	const { requestCodexAppServerClientJson } = await import("./request-CGvGOpeR.js").then((n) => n.a);
 	const client = await (useSharedClient ? getLeasedSharedCodexAppServerClient : createIsolatedCodexAppServerClient)({
 		startOptions: options.startOptions,
 		timeoutMs,

package/dist/native-execution-policy-umd0tgh4.js

@@ -0,0 +1,128 @@
+import { resolveAgentConfig, tryResolveDefaultAgentId } from "openclaw/plugin-sdk/agent-scope-runtime";
+import { normalizeAgentId, parseAgentSessionKey } from "openclaw/plugin-sdk/routing";
+import { getSessionEntry } from "openclaw/plugin-sdk/session-store-runtime";
+import { resolveSandboxRuntimeStatus } from "openclaw/plugin-sdk/sandbox";
+//#region extensions/codex/src/app-server/native-execution-policy.ts
+/** Projects node execution ownership into the runtime tool factory options. */
+function resolveCodexNodeExecToolOverrides(policy) {
+	if (policy.effectiveExecHost !== "node") return;
+	const node = policy.node?.trim();
+	return {
+		host: "node",
+		...node ? { node } : {}
+	};
+}
+/** Resolves node/gateway/sandbox execution ownership from overrides, session, agent, and config. */
+function resolveCodexNativeExecutionPolicy(params) {
+	const config = params.config ?? {};
+	const sessionKey = params.sessionKey?.trim() || params.sessionId?.trim() || void 0;
+	const agentId = resolvePolicyAgentId({
+		config,
+		sessionKey,
+		agentId: params.agentId
+	});
+	const canReadSessionEntry = Boolean(agentId) && params.readRuntimeSessionEntry && shouldReadRuntimeSessionEntry({
+		config,
+		sessionKey,
+		agentId
+	});
+	const sessionEntry = params.sessionEntry ?? (canReadSessionEntry && sessionKey && agentId ? readRuntimeSessionEntryBestEffort({
+		sessionKey,
+		agentId
+	}) : void 0);
+	const sandboxAgentId = parseAgentSessionKey(sessionKey)?.agentId ?? agentId;
+	const sandboxAvailable = params.sandboxAvailable ?? (sessionKey && sandboxAgentId ? resolveSandboxRuntimeStatus({
+		cfg: config,
+		sessionKey,
+		agentId: sandboxAgentId,
+		classificationAgentId: sandboxAgentId
+	}).sandboxed : false);
+	const agentExec = agentId ? resolvePolicyAgentExec({
+		config,
+		agentId
+	}) : void 0;
+	const globalExec = config.tools?.exec;
+	const requestedExecHost = normalizeExecTarget(params.execOverrides?.host) ?? normalizeExecTarget(sessionEntry?.execHost) ?? normalizeExecTarget(agentExec?.host) ?? normalizeExecTarget(globalExec?.host) ?? "auto";
+	const effectiveExecHost = resolveEffectiveExecHost({
+		requestedExecHost,
+		sandboxAvailable
+	});
+	const node = params.execOverrides?.node ?? sessionEntry?.execNode ?? agentExec?.node ?? globalExec?.node;
+	if (effectiveExecHost !== "node") return {
+		nativeToolSurfaceAllowed: true,
+		requestedExecHost,
+		effectiveExecHost,
+		node
+	};
+	return {
+		nativeToolSurfaceAllowed: false,
+		requestedExecHost,
+		effectiveExecHost,
+		node,
+		blockReason: "OpenClaw exec host=node is active for this session. Codex app-server native execution cannot route shell, filesystem, MCP, or app-backed work through the selected OpenClaw node."
+	};
+}
+/** Formats the user-facing explanation shown when native tools are blocked by exec host=node. */
+function formatCodexNativeNodeExecBlock(params) {
+	return [
+		`Codex-native ${params.surface} is unavailable because OpenClaw exec host=node is active for this session.`,
+		params.reason ?? "Codex app-server native execution cannot route execution through the selected OpenClaw node.",
+		"Use a normal Codex harness turn so OpenClaw exec/process tools run on the node, or switch exec host to gateway for native Codex app-server execution."
+	].join(" ");
+}
+function resolvePolicyAgentId(params) {
+	const explicitAgentId = normalizeAgentIdOrDefault(params.agentId);
+	if (explicitAgentId) return explicitAgentId;
+	const sessionAgentId = parseAgentIdFromSessionKey(params.sessionKey);
+	if (sessionAgentId) return sessionAgentId;
+	return tryResolveDefaultAgentId(params.config);
+}
+function resolvePolicyAgentExec(params) {
+	return resolveAgentConfig(params.config, params.agentId)?.tools?.exec;
+}
+function parseAgentIdFromSessionKey(sessionKey) {
+	const raw = sessionKey?.trim();
+	if (!raw) return;
+	const parts = raw.toLowerCase().split(":").filter(Boolean);
+	if (parts.length < 3 || parts[0] !== "agent" || !parts[2]) return;
+	return normalizeAgentIdOrDefault(parts[1]);
+}
+function shouldReadRuntimeSessionEntry(params) {
+	if (!params.sessionKey) return false;
+	const explicitAgentId = normalizeAgentIdOrDefault(params.agentId);
+	if (!explicitAgentId) return true;
+	const sessionAgentId = parseAgentIdFromSessionKey(params.sessionKey);
+	if (!sessionAgentId) return isDefaultAgentSessionKeyForAgent({
+		config: params.config,
+		agentId: explicitAgentId
+	});
+	return sessionAgentId === explicitAgentId;
+}
+function isDefaultAgentSessionKeyForAgent(params) {
+	return normalizeAgentId(params.agentId) === tryResolveDefaultAgentId(params.config);
+}
+function normalizeAgentIdOrDefault(value) {
+	const normalized = normalizeAgentId(value);
+	return normalized === "main" && !(value ?? "").trim() ? void 0 : normalized;
+}
+function normalizeExecTarget(value) {
+	const normalized = value?.trim().toLowerCase();
+	if (normalized === "auto" || normalized === "sandbox" || normalized === "gateway" || normalized === "node") return normalized;
+}
+function resolveEffectiveExecHost(params) {
+	if (params.requestedExecHost === "auto") return params.sandboxAvailable ? "sandbox" : "gateway";
+	return params.requestedExecHost;
+}
+function readRuntimeSessionEntryBestEffort(params) {
+	try {
+		return getSessionEntry({
+			sessionKey: params.sessionKey,
+			agentId: params.agentId,
+			hydrateSkillPromptRefs: false
+		});
+	} catch {
+		return;
+	}
+}
+//#endregion
+export { resolveCodexNativeExecutionPolicy as n, resolveCodexNodeExecToolOverrides as r, formatCodexNativeNodeExecBlock as t };