@openclaw/codex 2026.9.2 → 2026.9.4

package/dist/{transcript-mirror-_njEB84z.js → transcript-mirror-C5CKgNy6.js}

@@ -1,196 +1,11 @@
+import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
 import { i as readUpstreamUserText, n as attachUpstreamUserText, r as readMirrorIdentity, t as attachCodexMirrorIdentity } from "./upstream-prompt-provenance-LphB8slG.js";
-import { i as fingerprintCodexMirrorSourceMessage, n as attachCodexMirrorAttestation, o as readCodexMirrorSourceFingerprint, r as attachCodexMirrorRunId } from "./transcript-mirror-attestation-Byl34PC-.js";
+import { t as projectBoundedCodexThreadHistory } from "./transcript-history-projection-v17wXgdK.js";
+import { a as fingerprintCodexMirrorSourceMessage, c as readCodexMirrorSourceFingerprint, i as buildCodexMirrorDedupeIdentity, n as attachCodexMirrorAttestation, r as attachCodexMirrorRunId, s as isMirroredAgentMessage, t as applyCodexTranscriptTaint } from "./transcript-mirror-attestation-DibE0krH.js";
 import { normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
-import { createHash } from "node:crypto";
-import path from "node:path";
 import { deliverAgentHarnessUserInputPrompt, embeddedAgentLog, formatErrorMessage, projectAgentHarnessTranscriptMessageForDisplay, restorePreparedUserTurnOperationalMetaForRuntime, runAgentHarnessBeforeMessageWriteHook } from "openclaw/plugin-sdk/agent-harness-runtime";
-import fsSync from "node:fs";
-import { truncateUtf8Prefix } from "openclaw/plugin-sdk/text-utility-runtime";
 import { withCodexSessionTranscriptMirrorWriteLock } from "openclaw/plugin-sdk/codex-session-transcript-runtime";
 import { publishSessionTranscriptUpdateByIdentity } from "openclaw/plugin-sdk/session-transcript-runtime";
-import { Buffer } from "node:buffer";
-//#region extensions/codex/src/session-catalog-home-id.ts
-function canonicalCodexCatalogHome(value) {
-	const resolved = path.resolve(value);
-	try {
-		return fsSync.realpathSync.native(resolved);
-	} catch {
-		return resolved;
-	}
-}
-/** One canonical identity for catalog discovery and durable ownership rows. */
-function codexCatalogHomeId(codexHome) {
-	return createHash("sha256").update("openclaw:codex-session-catalog-home:v1\0").update(canonicalCodexCatalogHome(codexHome)).digest("hex");
-}
-//#endregion
-//#region extensions/codex/src/app-server/transcript-history-projection.ts
-const CODEX_HISTORY_IMPORT_MAX_MESSAGES = 200;
-const CODEX_HISTORY_IMPORT_MAX_BYTES = 524288;
-const CODEX_HISTORY_IMPORT_MAX_MESSAGE_BYTES = 65536;
-const CODEX_HISTORY_TRUNCATION_SUFFIX = "\n\n[Message truncated during Codex history import.]";
-const CODEX_HISTORY_ASSISTANT_API = "openai-chatgpt-responses";
-const CODEX_HISTORY_ASSISTANT_PROVIDER = "openai";
-const CODEX_HISTORY_ASSISTANT_MODEL = "native-history";
-const CODEX_HISTORY_ZERO_USAGE = {
-	input: 0,
-	output: 0,
-	cacheRead: 0,
-	cacheWrite: 0,
-	totalTokens: 0,
-	cost: {
-		input: 0,
-		output: 0,
-		cacheRead: 0,
-		cacheWrite: 0,
-		total: 0
-	}
-};
-function normalizeImportedHistoryText(value) {
-	if (typeof value !== "string") return;
-	const text = value.trim();
-	if (!text) return;
-	if (Buffer.byteLength(text, "utf8") <= CODEX_HISTORY_IMPORT_MAX_MESSAGE_BYTES) return text;
-	const suffixBytes = Buffer.byteLength(CODEX_HISTORY_TRUNCATION_SUFFIX, "utf8");
-	const contentLimitBytes = Math.max(0, CODEX_HISTORY_IMPORT_MAX_MESSAGE_BYTES - suffixBytes);
-	return `${truncateUtf8Prefix(text, contentLimitBytes)}${CODEX_HISTORY_TRUNCATION_SUFFIX}`;
-}
-function projectCodexUserItemText(item) {
-	if (!Array.isArray(item.content)) return;
-	const parts = [];
-	for (const value of item.content) {
-		if (!value || typeof value !== "object" || Array.isArray(value)) continue;
-		const input = value;
-		if (input.type === "text") {
-			const text = normalizeImportedHistoryText(input.text);
-			if (text) parts.push(text);
-			continue;
-		}
-		if (input.type === "image" || input.type === "localImage") {
-			parts.push("[Image attachment]");
-			continue;
-		}
-		if (input.type === "audio" || input.type === "localAudio" || input.type === "local_audio") parts.push("[Audio attachment]");
-		if (input.type === "skill" || input.type === "mention") {
-			const name = normalizeOptionalString(input.name);
-			if (name) parts.push(`${input.type === "skill" ? "$" : "@"}${name}`);
-		}
-	}
-	return normalizeImportedHistoryText(parts.join("\n"));
-}
-function selectTurnsThroughBoundary(thread, throughTurnId) {
-	if (throughTurnId === null) return [];
-	const turns = thread.turns ?? [];
-	const boundaryIndex = turns.findIndex((turn) => turn.id === throughTurnId);
-	if (boundaryIndex < 0) throw new Error(`Codex history boundary turn not found: ${throughTurnId}`);
-	const boundary = turns[boundaryIndex];
-	if (boundary?.status !== "completed" && boundary?.status !== "interrupted" && boundary?.status !== "failed") throw new Error(`Codex history boundary turn is not terminal: ${throughTurnId}`);
-	return turns.slice(0, boundaryIndex + 1);
-}
-function projectCodexThreadHistory(params) {
-	const projected = [];
-	const threadTimestamp = typeof params.thread.createdAt === "number" && Number.isFinite(params.thread.createdAt) ? params.thread.createdAt * 1e3 : params.importedAt;
-	let itemOffset = 0;
-	for (const turn of selectTurnsThroughBoundary(params.thread, params.throughTurnId)) for (const value of turn.items) {
-		const item = value;
-		const itemId = normalizeOptionalString(item.id);
-		const identity = `${turn.id}:${itemId ?? itemOffset}`;
-		const timestampSeconds = item.type === "agentMessage" ? turn.completedAt ?? turn.startedAt : turn.startedAt ?? turn.completedAt;
-		const timestamp = typeof timestampSeconds === "number" && Number.isFinite(timestampSeconds) ? timestampSeconds * 1e3 + itemOffset : threadTimestamp + itemOffset;
-		const text = item.type === "userMessage" ? projectCodexUserItemText(item) : item.type === "agentMessage" ? normalizeImportedHistoryText(item.text) : void 0;
-		const role = item.type === "userMessage" ? "user" : item.type === "agentMessage" ? "assistant" : void 0;
-		itemOffset += 1;
-		if (!text || !role) continue;
-		const phase = item.phase === "commentary" || item.phase === "final_answer" ? item.phase : void 0;
-		const asyncDelivery = item.delivery === "async";
-		const message = role === "assistant" ? attachCodexMirrorIdentity({
-			role,
-			content: [{
-				type: "text",
-				text
-			}],
-			api: CODEX_HISTORY_ASSISTANT_API,
-			provider: normalizeOptionalString(params.modelProvider) ?? normalizeOptionalString(params.thread.modelProvider) ?? CODEX_HISTORY_ASSISTANT_PROVIDER,
-			model: CODEX_HISTORY_ASSISTANT_MODEL,
-			usage: CODEX_HISTORY_ZERO_USAGE,
-			stopReason: turn.status === "interrupted" ? "aborted" : turn.status === "failed" ? "error" : "stop",
-			...turn.status === "failed" && turn.error?.message ? { errorMessage: turn.error.message } : {},
-			...phase ? { phase } : {},
-			...asyncDelivery && itemId ? { openclawAsyncDelivery: { itemId } } : {},
-			timestamp
-		}, identity) : attachCodexMirrorIdentity({
-			role,
-			content: text,
-			timestamp
-		}, identity);
-		projected.push({
-			message,
-			responseItem: {
-				type: "message",
-				role,
-				content: [{
-					type: role === "assistant" ? "output_text" : "input_text",
-					text
-				}],
-				...role === "assistant" && phase ? { phase } : {}
-			},
-			textBytes: Buffer.byteLength(text, "utf8")
-		});
-	}
-	return projected;
-}
-function selectBoundedCodexHistoryTail(projected) {
-	const selected = [];
-	let selectedBytes = 0;
-	for (let index = projected.length - 1; index >= 0; index -= 1) {
-		const candidate = projected[index];
-		if (!candidate) continue;
-		if (selected.length >= CODEX_HISTORY_IMPORT_MAX_MESSAGES || selectedBytes + candidate.textBytes > CODEX_HISTORY_IMPORT_MAX_BYTES) break;
-		selected.push(candidate);
-		selectedBytes += candidate.textBytes;
-	}
-	return selected.toReversed();
-}
-/** Projects one terminal Codex history prefix into transcript and Responses API items. */
-function projectBoundedCodexThreadHistory(params) {
-	const projected = projectCodexThreadHistory({
-		thread: params.thread,
-		throughTurnId: params.throughTurnId,
-		importedAt: params.importedAt,
-		...params.modelProvider ? { modelProvider: params.modelProvider } : {}
-	});
-	const selected = selectBoundedCodexHistoryTail(projected);
-	return {
-		importedMessages: selected.length,
-		omittedMessages: projected.length - selected.length,
-		responseItems: selected.filter(({ message }) => message.role !== "assistant" || message.stopReason !== "aborted" && message.stopReason !== "error" && !("openclawAsyncDelivery" in message)).map(({ responseItem }) => responseItem),
-		transcriptMessages: selected.map(({ message }) => message)
-	};
-}
-/** Projects only visible local user/assistant messages through the same bounded history policy. */
-function projectBoundedCodexVisibleSessionHistory(entries) {
-	const projected = [];
-	for (const entry of entries) {
-		if (entry.role !== "user" && entry.role !== "assistant" || !("content" in entry.message)) continue;
-		if (entry.role === "assistant" && ("stopReason" in entry.message && (entry.message.stopReason === "aborted" || entry.message.stopReason === "error") || "openclawAsyncDelivery" in entry.message)) continue;
-		const content = entry.message.content;
-		const text = normalizeImportedHistoryText(typeof content === "string" ? content : Array.isArray(content) ? content.flatMap((part) => part && typeof part === "object" && "text" in part && typeof part.text === "string" ? [part.text] : []).join("\n") : void 0);
-		if (!text) continue;
-		projected.push({
-			message: entry.message,
-			responseItem: {
-				type: "message",
-				role: entry.role,
-				content: [{
-					type: entry.role === "assistant" ? "output_text" : "input_text",
-					text
-				}]
-			},
-			textBytes: Buffer.byteLength(text, "utf8")
-		});
-	}
-	return selectBoundedCodexHistoryTail(projected).map(({ responseItem }) => responseItem);
-}
-//#endregion
 //#region extensions/codex/src/app-server/user-prompt-message.ts
 function buildSenderLabel(params) {
 	const label = params.senderName ?? params.senderUsername ?? params.senderE164 ?? params.senderId;
@@ -249,12 +64,15 @@ async function resolveFinalCodexMirrorMessages(params) {
 }
 //#endregion
 //#region extensions/codex/src/app-server/transcript-mirror.ts
-function isMirroredAgentMessage(message) {
-	return message.role === "user" || message.role === "assistant" || message.role === "toolResult";
-}
+var transcript_mirror_exports = /* @__PURE__ */ __exportAll({
+	codexTranscriptMirrorRuntime: () => codexTranscriptMirrorRuntime,
+	createCodexAppServerUserMessagePersistenceNotifier: () => createCodexAppServerUserMessagePersistenceNotifier,
+	importCodexThreadHistoryToTranscript: () => importCodexThreadHistoryToTranscript,
+	mirrorPromptAtTurnStartBestEffort: () => mirrorPromptAtTurnStartBestEffort,
+	projectBoundedCodexThreadHistory: () => projectBoundedCodexThreadHistory
+});
 function readMirroredAssistantText(message) {
-	if (message?.role !== "assistant") return;
-	return message.content.flatMap((part) => part.type === "text" ? [part.text] : []).join("\n") || void 0;
+	return message?.role === "assistant" ? message.content.flatMap((part) => part.type === "text" ? [part.text] : []).join("\n") || void 0 : void 0;
 }
 /** Imports a bounded, user-visible Codex history tail into a new OpenClaw transcript. */
 async function importCodexThreadHistoryToTranscript(params) {
@@ -303,9 +121,10 @@ async function mirrorBestEffort(params) {
 			idempotencyScope: `codex-app-server:${params.threadId}`,
 			runId: params.params.runId,
 			runMirrorIdentityPrefix: `${params.turnId}:`,
-			terminalAssistantOwner: {
+			terminalAssistantOwner: params.params.deferTerminalLifecycle && params.result.terminal.kind === "failed" ? void 0 : {
 				mirrorIdentity: `${params.turnId}:assistant`,
-				runId: params.params.runId
+				runId: params.params.runId,
+				settlementWarning: params.settlementWarning
 			},
 			prepareAssistantTranscriptMessage: params.params.prepareAssistantTranscriptMessage,
 			config: params.params.config
@@ -406,27 +225,16 @@ async function mirrorPromptAtTurnStartBestEffort(params) {
 		});
 	}
 }
-function fingerprintMirrorMessageContent(message) {
-	const payload = JSON.stringify({
-		role: message.role,
-		content: message.content
-	});
-	return createHash("sha256").update(payload).digest("hex").slice(0, 16);
-}
-function buildMirrorDedupeIdentity(message) {
-	return readMirrorIdentity(message) || `${message.role}:${fingerprintMirrorMessageContent(message)}`;
-}
 async function mirror(params) {
 	const messages = params.messages.filter(isMirroredAgentMessage);
 	if (messages.length === 0) return {
-		assistantMirrorIdentitiesAppended: [],
 		assistantMirrorIdentitiesOwned: [],
 		anchorsByMirrorIdentity: /* @__PURE__ */ new Map(),
 		messagesPresent: [],
 		userMessageReceipts: []
 	};
 	const candidates = messages.map((message) => {
-		const dedupeIdentity = buildMirrorDedupeIdentity(message);
+		const dedupeIdentity = buildCodexMirrorDedupeIdentity(message);
 		const sourceFingerprint = fingerprintCodexMirrorSourceMessage(message);
 		return {
 			dedupeIdentity,
@@ -448,19 +256,20 @@ async function mirror(params) {
 	}, async (transcript) => {
 		assertWritable();
 		const nextAppendedUpdates = [];
-		const nextAssistantMirrorIdentitiesAppended = /* @__PURE__ */ new Set();
 		const nextAssistantMirrorIdentitiesOwned = /* @__PURE__ */ new Set();
 		const nextAnchorsByMirrorIdentity = /* @__PURE__ */ new Map();
 		const nextMessagesPresent = [];
 		const nextUserMessageReceipts = [];
 		const mirrorFacts = await transcript.readMessageFacts({ idempotencyKeys: candidateIdempotencyKeys });
 		assertWritable();
+		const taint = { tainted: false };
 		for (const { dedupeIdentity, idempotencyKey, message, sourceFingerprint } of candidates) {
+			const sourceMessage = applyCodexTranscriptTaint(message, taint);
 			const mirrorIdentity = readMirrorIdentity(message);
 			const ownsRun = Boolean(params.runId && (!params.runMirrorIdentityPrefix || mirrorIdentity?.startsWith(params.runMirrorIdentityPrefix)));
 			const terminalOwner = params.terminalAssistantOwner;
 			const ownsTerminal = Boolean(ownsRun && terminalOwner && mirrorIdentity === terminalOwner.mirrorIdentity);
-			const ownedMessage = ownsRun && params.runId ? attachCodexMirrorRunId(message, params.runId, ownsTerminal) : message;
+			const ownedMessage = ownsRun && params.runId ? attachCodexMirrorRunId(sourceMessage, params.runId, ownsTerminal, terminalOwner?.settlementWarning) : sourceMessage;
 			const transcriptMessage = {
 				...attachCodexMirrorAttestation(ownedMessage, sourceFingerprint),
 				...idempotencyKey ? { idempotencyKey } : {}
@@ -509,8 +318,9 @@ async function mirror(params) {
 				idempotencyKey
 			} : attachCodexMirrorAttestation(restoredMessage, sourceFingerprint);
 			if (mirrorIdentity) messageToAppend = attachCodexMirrorIdentity(messageToAppend, mirrorIdentity);
-			if (ownsRun && params.runId) messageToAppend = attachCodexMirrorRunId(messageToAppend, params.runId, ownsTerminal);
+			if (ownsRun && params.runId) messageToAppend = attachCodexMirrorRunId(messageToAppend, params.runId, ownsTerminal, terminalOwner?.settlementWarning);
 			if (message.role === "assistant" && message.openclawAsyncDelivery) messageToAppend = Object.assign(messageToAppend, { openclawAsyncDelivery: { itemId: message.openclawAsyncDelivery.itemId } });
+			messageToAppend = applyCodexTranscriptTaint(messageToAppend, taint);
 			messageToAppend = projectAgentHarnessTranscriptMessageForDisplay({
 				hidden: message.display === false,
 				message: messageToAppend
@@ -539,14 +349,11 @@ async function mirror(params) {
 				appended: appended.appended,
 				message: appendedMessage
 			});
-			if (appended.appended) {
-				if (message.role === "assistant") nextAssistantMirrorIdentitiesAppended.add(dedupeIdentity);
-				nextAppendedUpdates.push({
-					messageId,
-					message: appendedMessage,
-					...messageSeq !== void 0 ? { messageSeq } : {}
-				});
-			}
+			if (appended.appended) nextAppendedUpdates.push({
+				messageId,
+				message: appendedMessage,
+				...messageSeq !== void 0 ? { messageSeq } : {}
+			});
 			if (idempotencyKey) {
 				mirrorFacts.existingIdempotencyKeys.add(idempotencyKey);
 				if (appended.anchor) mirrorFacts.anchorsByIdempotencyKey.set(idempotencyKey, appended.anchor);
@@ -554,7 +361,6 @@ async function mirror(params) {
 		}
 		return {
 			appendedUpdates: nextAppendedUpdates,
-			assistantMirrorIdentitiesAppended: [...nextAssistantMirrorIdentitiesAppended],
 			assistantMirrorIdentitiesOwned: [...nextAssistantMirrorIdentitiesOwned],
 			anchorsByMirrorIdentity: nextAnchorsByMirrorIdentity,
 			messagesPresent: nextMessagesPresent,
@@ -562,7 +368,7 @@ async function mirror(params) {
 		};
 	});
 	params.assertCurrent?.();
-	const { appendedUpdates, assistantMirrorIdentitiesAppended, assistantMirrorIdentitiesOwned, anchorsByMirrorIdentity, messagesPresent, userMessageReceipts } = mirrorBatch;
+	const { appendedUpdates, ...result } = mirrorBatch;
 	for (const update of appendedUpdates) try {
 		const terminalOwner = params.terminalAssistantOwner;
 		const terminalRunId = update.message.role === "assistant" && terminalOwner && readMirrorIdentity(update.message) === terminalOwner.mirrorIdentity ? terminalOwner.runId : void 0;
@@ -580,13 +386,7 @@ async function mirror(params) {
 	} catch (error) {
 		embeddedAgentLog.warn("failed to publish codex app-server transcript update", { error: formatErrorMessage(error) });
 	}
-	return {
-		assistantMirrorIdentitiesAppended,
-		assistantMirrorIdentitiesOwned,
-		anchorsByMirrorIdentity,
-		messagesPresent,
-		userMessageReceipts
-	};
+	return result;
 }
 async function deliverAsyncMessageBestEffort(params) {
 	const mirrorIdentity = `${params.turnId}:async:${params.itemId}`;
@@ -596,13 +396,22 @@ async function deliverAsyncMessageBestEffort(params) {
 		params.itemId
 	].map(encodeURIComponent).join(":")}`;
 	const target = params.params.sessionTarget;
-	if (!target) {
-		if (!params.params.onBlockReply) return "retry";
+	let text;
+	if (target) {
+		let result;
 		try {
-			await deliverAsyncBlockReply(params.params.onBlockReply, params.text, deliveryIntentId);
-			return "settled";
+			result = await mirror({
+				agentId: target.agentId ?? params.params.agentId,
+				sessionId: target.sessionId ?? params.params.sessionId,
+				sessionKey: target.sessionKey ?? params.params.sessionKey,
+				storePath: target.storePath,
+				cwd: params.cwd,
+				config: params.params.config,
+				messages: [attachCodexMirrorIdentity(params.message, mirrorIdentity)],
+				idempotencyScope: `codex-app-server:${params.threadId}`
+			});
 		} catch (error) {
-			embeddedAgentLog.warn("failed to deliver codex async agent message", {
+			embeddedAgentLog.warn("failed to persist codex async agent message", {
 				error: formatErrorMessage(error),
 				itemId: params.itemId,
 				runId: params.params.runId,
@@ -611,35 +420,16 @@ async function deliverAsyncMessageBestEffort(params) {
 			});
 			return "retry";
 		}
+		if (!result.assistantMirrorIdentitiesOwned.includes(mirrorIdentity)) return "retry";
+		text = readMirroredAssistantText(result.messagesPresent.find((message) => readMirrorIdentity(message) === mirrorIdentity));
+	} else {
+		if (!params.params.onBlockReply) return "retry";
+		text = params.text;
 	}
-	let result;
-	try {
-		result = await mirror({
-			agentId: target.agentId ?? params.params.agentId,
-			sessionId: target.sessionId ?? params.params.sessionId,
-			sessionKey: target.sessionKey ?? params.params.sessionKey,
-			storePath: target.storePath,
-			cwd: params.cwd,
-			config: params.params.config,
-			messages: [attachCodexMirrorIdentity(params.message, mirrorIdentity)],
-			idempotencyScope: `codex-app-server:${params.threadId}`
-		});
-	} catch (error) {
-		embeddedAgentLog.warn("failed to persist codex async agent message", {
-			error: formatErrorMessage(error),
-			itemId: params.itemId,
-			runId: params.params.runId,
-			threadId: params.threadId,
-			turnId: params.turnId
-		});
-		return "retry";
-	}
-	if (!result.assistantMirrorIdentitiesOwned.includes(mirrorIdentity)) return "retry";
-	const persistedText = readMirroredAssistantText(result.messagesPresent.find((message) => readMirrorIdentity(message) === mirrorIdentity));
-	if (params.params.onBlockReply && persistedText !== void 0) try {
-		await deliverAsyncBlockReply(params.params.onBlockReply, persistedText, deliveryIntentId);
+	if (params.params.onBlockReply && text !== void 0) try {
+		await deliverAsyncBlockReply(params.params.onBlockReply, text, deliveryIntentId);
 	} catch (error) {
-		embeddedAgentLog.warn("failed to deliver persisted codex async agent message", {
+		embeddedAgentLog.warn(target ? "failed to deliver persisted codex async agent message" : "failed to deliver codex async agent message", {
 			error: formatErrorMessage(error),
 			itemId: params.itemId,
 			runId: params.params.runId,
@@ -670,4 +460,4 @@ function resolveCodexMirrorTranscriptTarget(params) {
 	};
 }
 //#endregion
-export { buildCodexUserPromptMessage as a, projectBoundedCodexVisibleSessionHistory as c, codexCatalogHomeId as d, mirrorPromptAtTurnStartBestEffort as i, projectCodexUserItemText as l, createCodexAppServerUserMessagePersistenceNotifier as n, promptSnapshot as o, importCodexThreadHistoryToTranscript as r, projectBoundedCodexThreadHistory as s, codexTranscriptMirrorRuntime as t, canonicalCodexCatalogHome as u };
+export { transcript_mirror_exports as a, mirrorPromptAtTurnStartBestEffort as i, createCodexAppServerUserMessagePersistenceNotifier as n, buildCodexUserPromptMessage as o, importCodexThreadHistoryToTranscript as r, promptSnapshot as s, codexTranscriptMirrorRuntime as t };

package/dist/{transcript-mirror-attestation-Byl34PC-.js → transcript-mirror-attestation-DibE0krH.js}

@@ -1,7 +1,19 @@
-import { i as readUpstreamUserText } from "./upstream-prompt-provenance-LphB8slG.js";
+import { i as readUpstreamUserText, r as readMirrorIdentity } from "./upstream-prompt-provenance-LphB8slG.js";
 import { asOptionalRecord } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { createHash } from "node:crypto";
 //#region extensions/codex/src/app-server/transcript-mirror-attestation.ts
+function isMirroredAgentMessage(message) {
+	return message.role === "user" || message.role === "assistant" || message.role === "toolResult";
+}
+function buildCodexMirrorDedupeIdentity(message) {
+	const identity = readMirrorIdentity(message);
+	if (identity) return identity;
+	const payload = JSON.stringify({
+		role: message.role,
+		content: message.content
+	});
+	return `${message.role}:${createHash("sha256").update(payload).digest("hex").slice(0, 16)}`;
+}
 const MIRROR_ORIGIN_META_KEY = "mirrorOrigin";
 const MIRROR_SOURCE_FINGERPRINT_META_KEY = "mirrorSourceFingerprint";
 const CODEX_APP_SERVER_MIRROR_ORIGIN = "codex-app-server";
@@ -34,7 +46,7 @@ function attachCodexMirrorAttestation(message, sourceFingerprint) {
 		}
 	};
 }
-function attachCodexMirrorRunId(message, runId, terminal = false) {
+function attachCodexMirrorRunId(message, runId, terminal = false, settlementWarning) {
 	const existing = CODEX_META_KEY in message ? message[CODEX_META_KEY] : void 0;
 	const { runTerminal: _staleTerminal, ...current } = asOptionalRecord(existing) ?? {};
 	return {
@@ -42,7 +54,8 @@ function attachCodexMirrorRunId(message, runId, terminal = false) {
 		[CODEX_META_KEY]: {
 			...current,
 			runId,
-			...terminal ? { runTerminal: true } : {}
+			...terminal ? { runTerminal: true } : {},
+			...terminal && settlementWarning ? { settlementWarning } : {}
 		}
 	};
 }
@@ -73,4 +86,4 @@ function fingerprintCodexMirrorSourceMessage(message) {
 	return createHash("sha256").update(serializeCodexMirrorSourceEvidence(message)).digest("hex").slice(0, 32);
 }
 //#endregion
-export { hasCodexMirrorOrigin as a, fingerprintCodexMirrorSourceMessage as i, attachCodexMirrorAttestation as n, readCodexMirrorSourceFingerprint as o, attachCodexMirrorRunId as r, serializeCodexMirrorSourceEvidence as s, applyCodexTranscriptTaint as t };
+export { fingerprintCodexMirrorSourceMessage as a, readCodexMirrorSourceFingerprint as c, buildCodexMirrorDedupeIdentity as i, serializeCodexMirrorSourceEvidence as l, attachCodexMirrorAttestation as n, hasCodexMirrorOrigin as o, attachCodexMirrorRunId as r, isMirroredAgentMessage as s, applyCodexTranscriptTaint as t };