@openclaw/codex 2026.9.3 → 2026.9.4

package/dist/api.js

@@ -1,24 +1,22 @@
-import { a as resolveCodexAppServerStartOptionsForAgent } from "./config-options-jnIFvwxD.js";
-import { n as resolveManagedCodexAppServerStartOptions, r as resolveManagedCodexNativeCommand, t as isManagedCodexDesktopCommand } from "./managed-binary-DrjjRRUD.js";
+import { a as resolveCodexAppServerStartOptionsForAgent } from "./config-options-CXMq1T-C.js";
+import { i as resolveManagedCodexNativeCommand, r as resolveManagedCodexAppServerStartOptions, t as isManagedCodexDesktopCommand } from "./managed-binary-D22rNEcR.js";
 import { t as CODEX_APP_SERVER_VERSION } from "./version-omm6IPI3.js";
-import "./config-JDfTI4VI.js";
-import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-BWf6JLWG.js";
+import "./config-oIORaQ5T.js";
+import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-D0zGNIHu.js";
 import { listAgentIds, resolveAgentDir } from "openclaw/plugin-sdk/agent-scope-runtime";
+import { runUtf8CommandWithTimeout } from "openclaw/plugin-sdk/process-runtime";
 import path from "node:path";
-import { execFile } from "node:child_process";
 import { fileURLToPath } from "node:url";
-import { promisify } from "node:util";
 import { resolveDefaultModelForAgent } from "openclaw/plugin-sdk/agent-runtime";
 import { resolveEffectiveAgentRuntime } from "openclaw/plugin-sdk/command-auth-native";
 //#region extensions/codex/src/doctor.ts
 const CODEX_MANAGED_APP_SERVER_CHECK_ID = "codex/managed-app-server";
 const CODEX_VERSION_TIMEOUT_MS = 5e3;
 const CODEX_VERSION_MAX_BUFFER_BYTES = 65536;
-const execFileAsync = promisify(execFile);
 function managedCodexFinding(params) {
 	return {
 		checkId: CODEX_MANAGED_APP_SERVER_CHECK_ID,
-		severity: "error",
+		severity: params.severity ?? "error",
 		source: "codex",
 		message: params.message,
 		...params.path ? { path: params.path } : {},
@@ -32,21 +30,26 @@ function readErrorMessage(error) {
 function parseCodexVersion(output) {
 	return /(?:^|\s)(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?)(?:\s|$)/u.exec(output)?.[1];
 }
-function runVersionCommand(command) {
-	return execFileAsync(command, ["--version"], {
-		encoding: "utf8",
-		maxBuffer: CODEX_VERSION_MAX_BUFFER_BYTES,
-		timeout: CODEX_VERSION_TIMEOUT_MS,
+async function runVersionCommand(command, env) {
+	const result = await runUtf8CommandWithTimeout([command, "--version"], {
+		baseEnv: env,
+		input: "",
+		timeoutMs: CODEX_VERSION_TIMEOUT_MS,
+		maxOutputBytes: CODEX_VERSION_MAX_BUFFER_BYTES,
+		outputCapture: "head",
+		terminateOnOutputLimit: true,
+		killProcessTree: true,
 		killSignal: "SIGKILL",
-		windowsHide: true
+		killGraceMs: 0
 	});
+	if (result.termination !== "exit" || result.code !== 0 || result.outputLimitExceeded) throw new Error(result.outputLimitExceeded ? "Version output exceeded its capture limit" : result.termination === "timeout" ? `Version probe timed out after ${CODEX_VERSION_TIMEOUT_MS} ms` : `Version probe failed (${result.signal ?? result.code ?? result.termination})`);
+	return result;
 }
 function createCodexManagedAppServerHealthCheck(params) {
 	const resolveStartOptions = params.deps?.resolveStartOptions ?? resolveManagedCodexAppServerStartOptions;
 	const resolveAgentStartOptions = params.deps?.resolveAgentStartOptions ?? resolveCodexAppServerStartOptionsForAgent;
 	const isDesktopCommand = params.deps?.isDesktopCommand ?? isManagedCodexDesktopCommand;
 	const resolveNativeCommand = params.deps?.resolveNativeCommand ?? resolveManagedCodexNativeCommand;
-	const executeVersion = params.deps?.runVersionCommand ?? runVersionCommand;
 	return {
 		id: CODEX_MANAGED_APP_SERVER_CHECK_ID,
 		kind: "plugin",
@@ -61,6 +64,9 @@ function createCodexManagedAppServerHealthCheck(params) {
 			}).start;
 			if (start.transport !== "stdio" || start.commandSource !== "managed") return [];
 			const env = ctx.env ?? process.env;
+			const isFinalization = ctx.mode === "fix" && env.OPENCLAW_UPDATE_POST_CORE === "1";
+			const versionFailureSeverity = isFinalization ? "warning" : "error";
+			const versionFailureHint = isFinalization ? "Codex readiness will be rechecked by its plugin after restart; inspect the Codex plugin if the warning persists." : void 0;
 			let resolved;
 			for (const agentId of listAgentIds(ctx.cfg)) {
 				const model = resolveDefaultModelForAgent({
@@ -101,21 +107,23 @@ function createCodexManagedAppServerHealthCheck(params) {
 			})];
 			let output;
 			try {
-				output = await executeVersion(nativeCommand);
+				output = await (params.deps?.runVersionCommand ? params.deps.runVersionCommand(nativeCommand) : runVersionCommand(nativeCommand, env));
 			} catch (error) {
 				return [managedCodexFinding({
 					message: `Managed Codex app-server version check failed: ${readErrorMessage(error)}`,
+					severity: versionFailureSeverity,
 					path: nativeCommand,
 					requirement: `Codex ${CODEX_APP_SERVER_VERSION} must report its version within ${CODEX_VERSION_TIMEOUT_MS} ms`,
-					fixHint: "Repair or reinstall the staged OpenClaw package, then rerun the candidate check before cutover."
+					fixHint: versionFailureHint ?? "Repair or reinstall the staged OpenClaw package, then rerun the candidate check before cutover."
 				})];
 			}
 			const detectedVersion = parseCodexVersion(`${output.stdout}\n${output.stderr}`);
 			if (detectedVersion !== "0.153.4") return [managedCodexFinding({
+				severity: versionFailureSeverity,
 				message: detectedVersion ? `Managed Codex app-server version mismatch: expected ${CODEX_APP_SERVER_VERSION}, detected ${detectedVersion}.` : `Managed Codex app-server did not report a parseable version; expected ${CODEX_APP_SERVER_VERSION}.`,
 				path: nativeCommand,
 				requirement: `the exact OpenClaw-pinned Codex version ${CODEX_APP_SERVER_VERSION}`,
-				fixHint: "Reinstall the staged OpenClaw package so its managed @openai/codex dependency matches the pinned version, then rerun the candidate check."
+				fixHint: versionFailureHint ?? "Reinstall the staged OpenClaw package so its managed @openai/codex dependency matches the pinned version, then rerun the candidate check."
 			})];
 			return [];
 		}

package/dist/{apply-B6el6hdO.js → apply-CvT8tW5i.js}

@@ -1,14 +1,14 @@
-import { m as CODEX_PLUGINS_MARKETPLACE_NAME } from "./config-utils-C57JiJrU.js";
-import { x as readCodexPluginConfig } from "./protocol-CAAcVIKF.js";
-import { s as resolveCodexAppServerFallbackApiKeyCacheKey } from "./auth-cache-key-Kq6oerr6.js";
-import { r as buildCodexPluginAppCacheKey, s as defaultCodexAppInventoryCache } from "./plugin-app-cache-key-CdSQzWyX.js";
-import { i as requestCodexAppServerJson } from "./request-CGvGOpeR.js";
-import "./config-JDfTI4VI.js";
-import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-BWf6JLWG.js";
+import { c as CODEX_PLUGINS_MARKETPLACE_NAME } from "./plugin-inventory-oL4Na1ZG.js";
+import { x as readCodexPluginConfig } from "./protocol-5bh1G-H7.js";
+import { s as resolveCodexAppServerFallbackApiKeyCacheKey } from "./auth-cache-key-7orQae_j.js";
+import { r as buildCodexPluginAppCacheKey, s as defaultCodexAppInventoryCache } from "./plugin-app-cache-key-d0eKxy7b.js";
+import { i as requestCodexAppServerJson } from "./request-B7hEkBGq.js";
+import "./config-oIORaQ5T.js";
+import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-D0zGNIHu.js";
 import { i as resolveCodexAppServerAuthProfileIdForAgent } from "./auth-profile-CwzO4_RG.js";
-import { X as resolveCodexAppServerAuthAccountCacheKey, c as getLeasedSharedCodexAppServerClient, h as releaseLeasedSharedCodexAppServerClient, o as clearSharedCodexAppServerClientIfCurrentAndWait } from "./shared-client-CVhez2Uo.js";
-import { t as ensureCodexPluginActivation } from "./plugin-activation-BQK-f5sV.js";
-import { CODEX_PLUGIN_CONFIG_PATH, buildCodexMigrationPlan, buildCodexPluginsConfigValue, hasCodexPluginConfigConflict, n as applyCodexAuthItems, readCodexPluginMigrationConfigEntry, t as resolveCodexMigrationTargets } from "./plan-BMJdMOEF.js";
+import { c as getLeasedSharedCodexAppServerClient, et as resolveCodexAppServerAuthAccountCacheKey, h as releaseLeasedSharedCodexAppServerClient, o as clearSharedCodexAppServerClientIfCurrentAndWait } from "./shared-client-CscigXXL.js";
+import { t as ensureCodexPluginActivation } from "./plugin-activation-BYQculil.js";
+import { CODEX_PLUGIN_CONFIG_PATH, buildCodexMigrationPlan, buildCodexPluginsConfigValue, hasCodexPluginConfigConflict, n as applyCodexAuthItems, r as resolveCodexConfigPatchMode, readCodexPluginMigrationConfigEntry, t as resolveCodexMigrationTargets } from "./plan-7uG-Fp36.js";
 import { uniqueStrings } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { parseStrictNonNegativeInteger } from "openclaw/plugin-sdk/number-runtime";
 import path from "node:path";
@@ -53,7 +53,6 @@ function sanitizeAppsNeedingAuth(apps) {
 //#region extensions/codex/src/migration/apply.ts
 const CODEX_PLUGIN_AUTH_REQUIRED_REASON = "auth_required";
 const CODEX_PLUGIN_NOT_SELECTED_REASON = "not selected for migration";
-const CODEX_CONFIG_PATCH_MODE_RETURN = "return";
 const CODEX_PLUGIN_LOAD_WARNING = "Some Codex plugins could not be migrated. Run `openclaw migrate codex` after onboarding.";
 const TARGET_CODEX_MARKETPLACE_DISCOVERY_POLL_MS = 250;
 const TARGET_CODEX_MARKETPLACE_DISCOVERY_TIMEOUT_MS = 3e4;
@@ -66,7 +65,7 @@ var CodexPluginConfigConflictError = class extends Error {
 	}
 };
 function shouldReturnCodexPluginConfigPatch(ctx) {
-	return ctx.providerOptions?.configPatchMode === CODEX_CONFIG_PATCH_MODE_RETURN;
+	return resolveCodexConfigPatchMode(ctx) === "return";
 }
 function prepareTargetCodexAppServer(ctx) {
 	const appServer = resolveTargetCodexAppServer(ctx);

package/dist/{attempt-client-cleanup-D6cR54TV.js → attempt-client-cleanup-DKHzbwt5.js}

@@ -1,211 +1,15 @@
-import { o as isJsonObject } from "./protocol-CAAcVIKF.js";
-import "./client-BEKu4yDx.js";
-import { m as retireSharedCodexAppServerClientIfCurrent } from "./auth-cache-key-Kq6oerr6.js";
-import { r as CodexAppServerRpcError } from "./session-catalog-provenance-DkJHo735.js";
-import { G as unsubscribeCodexAppServerLiveThread } from "./shared-client-CVhez2Uo.js";
-import { asFiniteNumber, normalizeOptionalString, normalizeOptionalString as normalizeOptionalString$1, readStringField } from "openclaw/plugin-sdk/string-coerce-runtime";
+import { o as isJsonObject } from "./protocol-5bh1G-H7.js";
+import "./client-B57KWPQx.js";
+import { m as retireSharedCodexAppServerClientIfCurrent } from "./auth-cache-key-7orQae_j.js";
+import { t as CodexAppServerRpcError } from "./rpc-error-ttN_QjEm.js";
+import { h as unknownItemStatus } from "./event-projector-items-5VhsECCO.js";
+import { Y as unsubscribeCodexAppServerLiveThread } from "./shared-client-CscigXXL.js";
+import { normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { createDeferred } from "openclaw/plugin-sdk/extension-shared";
 import { embeddedAgentLog } from "openclaw/plugin-sdk/agent-harness-runtime";
 import { AsyncResource } from "node:async_hooks";
 import { redactSensitiveText } from "openclaw/plugin-sdk/logging-core";
 import { sanitizeTerminalText } from "openclaw/plugin-sdk/text-chunking";
-//#region extensions/codex/src/app-server/event-projector-values.ts
-const BIO_POLICY_SAFETY_ACCESS_BLOCK_PREFIX = "This content was flagged for possible biological risk.";
-/** Project only Codex's explicit refusal contracts; other policy errors retain their own paths. */
-function readCodexProviderRefusal(message, codexErrorInfo) {
-	if (!message) return;
-	if (codexErrorInfo === "cyberPolicy") return {
-		category: "cyber",
-		message
-	};
-	if (codexErrorInfo === "misalignmentPolicyViolation") return {
-		category: "misalignment",
-		message
-	};
-	return message.startsWith(BIO_POLICY_SAFETY_ACCESS_BLOCK_PREFIX) ? {
-		category: "bio",
-		message
-	} : void 0;
-}
-function readNonEmptyString(record, key) {
-	return normalizeOptionalString$1(record[key]);
-}
-function readNonEmptyStringArray(record, key) {
-	const value = record[key];
-	if (!Array.isArray(value)) return [];
-	const entries = [];
-	for (const entry of value) {
-		const normalized = normalizeOptionalString$1(entry);
-		if (normalized) entries.push(normalized);
-	}
-	return entries;
-}
-function readNullableString(record, key) {
-	const value = record[key];
-	if (value === null) return null;
-	return typeof value === "string" ? value : void 0;
-}
-function readNonNegativeInteger(record, key) {
-	const value = asFiniteNumber(record[key]);
-	return value !== void 0 && Number.isInteger(value) && value >= 0 ? value : void 0;
-}
-function readCodexErrorNotificationMessage(record) {
-	const error = record.error;
-	return isJsonObject(error) ? readStringField(error, "message") : void 0;
-}
-function readHookOutputEntries(value) {
-	if (!Array.isArray(value)) return [];
-	return value.flatMap((entry) => {
-		if (!isJsonObject(entry)) return [];
-		const text = readStringField(entry, "text");
-		if (!text) return [];
-		const kind = readStringField(entry, "kind");
-		return [{
-			...kind ? { kind } : {},
-			text
-		}];
-	});
-}
-function splitPlanText(text) {
-	return text.split(/\r?\n/).map((line) => line.trim().replace(/^[-*]\s+/, "")).filter((line) => line.length > 0);
-}
-function extractRawAssistantText(item) {
-	const parts = (Array.isArray(item.content) ? item.content : []).flatMap((entry) => {
-		if (!isJsonObject(entry)) return [];
-		const type = readStringField(entry, "type");
-		if (type !== "output_text" && type !== "text") return [];
-		const value = readStringField(entry, "text");
-		return value === void 0 ? [] : [value];
-	});
-	return parts.length > 0 ? parts.join("").trim() : void 0;
-}
-function readItemString(item, key) {
-	const value = item[key];
-	return typeof value === "string" ? value : void 0;
-}
-function readItem(value) {
-	if (!isJsonObject(value)) return;
-	const type = typeof value.type === "string" ? value.type : void 0;
-	const id = typeof value.id === "string" ? value.id : void 0;
-	if (!type || !id) return;
-	return value;
-}
-//#endregion
-//#region extensions/codex/src/app-server/event-projector-items.ts
-function matchesCodexSnapshotTurn(item, turnId) {
-	const itemTurnId = readItemString(item, "turnId");
-	return itemTurnId === void 0 || itemTurnId === turnId;
-}
-function itemKind(item) {
-	switch (item.type) {
-		case "dynamicToolCall":
-		case "mcpToolCall": return "tool";
-		case "commandExecution": return "command";
-		case "fileChange": return "patch";
-		case "webSearch": return "search";
-		case "reasoning":
-		case "contextCompaction": return "analysis";
-		default: return;
-	}
-}
-function itemTitle(item) {
-	switch (item.type) {
-		case "commandExecution": return "Command";
-		case "fileChange": return "File change";
-		case "mcpToolCall": return "MCP tool";
-		case "dynamicToolCall": return "Tool";
-		case "webSearch": return "Web search";
-		case "contextCompaction": return "Context compaction";
-		case "reasoning": return "Reasoning";
-		default: return item.type;
-	}
-}
-function itemStatus(item) {
-	const status = readItemString(item, "status");
-	if (status === "failed" || status === "error") return "failed";
-	if (status === "declined") return "blocked";
-	if (status === "inProgress" || status === "in_progress" || status === "running") return "running";
-	return "completed";
-}
-function unknownItemStatus(item) {
-	const status = readItemString(item, "status");
-	switch (status) {
-		case void 0:
-		case "completed":
-		case "failed":
-		case "error":
-		case "declined":
-		case "inProgress":
-		case "in_progress":
-		case "running": return;
-		default: return status;
-	}
-}
-function auditNativeToolTerminalStatus(item) {
-	if (item.type === "imageView" || item.type === "sleep") return "completed";
-	const status = readItemString(item, "status");
-	if (status === "completed") return "completed";
-	if (status === "failed" || status === "error") return "failed";
-	if (status === "declined") return "blocked";
-	return "unknown";
-}
-function auditNativeToolUnfinishedStatus(item) {
-	return item.type === "webSearch" || item.type === "imageGeneration" ? "unknown" : "failed";
-}
-function isNonSuccessItemStatus(status) {
-	return status === "failed" || status === "blocked";
-}
-function itemName(item) {
-	if (item.type === "dynamicToolCall" && typeof item.tool === "string") return item.tool;
-	if (item.type === "mcpToolCall" && typeof item.tool === "string") {
-		const server = typeof item.server === "string" ? item.server : void 0;
-		return server ? `${server}.${item.tool}` : item.tool;
-	}
-	if (item.type === "commandExecution") return "bash";
-	if (item.type === "fileChange") return "apply_patch";
-	if (item.type === "webSearch") return "web_search";
-}
-function auditNativeToolName(item) {
-	if (item.type === "dynamicToolCall") return;
-	const progressName = itemName(item);
-	if (progressName) return progressName;
-	if (item.type === "collabAgentToolCall") return typeof item.tool === "string" && item.tool.trim() ? `collab.${item.tool.trim()}` : "collab_agent";
-	if (item.type === "imageGeneration") return "image_generation";
-	if (item.type === "imageView") return "image_view";
-	if (item.type === "sleep") return "sleep";
-}
-function isSideEffectingNativeToolItem(item) {
-	return itemStatus(item) !== "blocked" && (isMutatingNativeToolItem(item) || item.type === "mcpToolCall");
-}
-function shouldSynthesizeToolProgressForItem(item) {
-	switch (item.type) {
-		case "commandExecution":
-		case "fileChange":
-		case "webSearch":
-		case "mcpToolCall": return true;
-		default: return false;
-	}
-}
-function shouldRecordNativeToolTranscript(item) {
-	return shouldSynthesizeToolProgressForItem(item);
-}
-function isMutatingNativeToolItem(item) {
-	if (item.type === "commandExecution") return true;
-	return item.type === "fileChange" || item.type === "collabAgentToolCall" || item.type === "imageGeneration";
-}
-function shouldClearTerminalPresentationForNativeItem(item) {
-	switch (item.type) {
-		case "collabAgentToolCall":
-		case "commandExecution":
-		case "fileChange":
-		case "imageGeneration":
-		case "imageView":
-		case "mcpToolCall":
-		case "webSearch": return true;
-		default: return false;
-	}
-}
-//#endregion
 //#region extensions/codex/src/app-server/notification-correlation.ts
 /**
 * Correlates Codex app-server notifications with the active thread/turn so
@@ -801,4 +605,4 @@ async function unsubscribeCodexThreadBestEffort(client, params) {
 	}
 }
 //#endregion
-export { shouldRecordNativeToolTranscript as A, readNonEmptyStringArray as B, isSideEffectingNativeToolItem as C, itemTitle as D, itemStatus as E, readCodexProviderRefusal as F, readNullableString as H, readHookOutputEntries as I, readItem as L, extractRawAssistantText as M, normalizeOptionalString$1 as N, matchesCodexSnapshotTurn as O, readCodexErrorNotificationMessage as P, readItemString as R, isNonSuccessItemStatus as S, itemName as T, splitPlanText as U, readNonNegativeInteger as V, readCodexNotificationTurnId as _, closeCodexStartupClientBestEffort as a, auditNativeToolUnfinishedStatus as b, isCodexNoActiveTurnInterruptError as c, unsubscribeCodexThreadBestEffort as d, CODEX_APP_SERVER_NATIVE_TURN_WAIT_TIMEOUT_MS as f, readCodexNotificationThreadId as g, isCodexNotificationForTurn as h, assertCodexThreadResumeSubscription as i, shouldSynthesizeToolProgressForItem as j, shouldClearTerminalPresentationForNativeItem as k, retireUnsafeCodexTurnClientBestEffort as l, CodexProjectionDiagnostics as m, CODEX_APP_SERVER_UNSUBSCRIBE_TIMEOUT_MS as n, interruptCodexTurnAndWaitBestEffort as o, getCodexAppServerTurnRouter as p, CodexAppServerUnsafeSubscriptionError as r, isCodexAppServerUnsafeSubscriptionError as s, CODEX_APP_SERVER_INTERRUPT_TIMEOUT_MS as t, terminateCodexBackgroundTerminals as u, auditNativeToolName as v, itemKind as w, isMutatingNativeToolItem as x, auditNativeToolTerminalStatus as y, readNonEmptyString as z };
+export { readCodexNotificationTurnId as _, closeCodexStartupClientBestEffort as a, isCodexNoActiveTurnInterruptError as c, unsubscribeCodexThreadBestEffort as d, CODEX_APP_SERVER_NATIVE_TURN_WAIT_TIMEOUT_MS as f, readCodexNotificationThreadId as g, isCodexNotificationForTurn as h, assertCodexThreadResumeSubscription as i, retireUnsafeCodexTurnClientBestEffort as l, CodexProjectionDiagnostics as m, CODEX_APP_SERVER_UNSUBSCRIBE_TIMEOUT_MS as n, interruptCodexTurnAndWaitBestEffort as o, getCodexAppServerTurnRouter as p, CodexAppServerUnsafeSubscriptionError as r, isCodexAppServerUnsafeSubscriptionError as s, CODEX_APP_SERVER_INTERRUPT_TIMEOUT_MS as t, terminateCodexBackgroundTerminals as u };

package/dist/{attempt-context-AO4DSjE0.js → attempt-context-D44yeDII.js}

@@ -1,6 +1,6 @@
-import { a as flattenCodexDynamicToolFunctions, o as isJsonObject } from "./protocol-CAAcVIKF.js";
+import { a as flattenCodexDynamicToolFunctions, o as isJsonObject } from "./protocol-5bh1G-H7.js";
 import { t as readCodexMirroredSessionHistoryMessages } from "./session-history-Cz-tOOYj.js";
-import { Z as areCodexDynamicToolFingerprintsCompatible, at as isMessageOnlyCodexSourceReply, dt as isContextEngineBindingCompatible } from "./thread-lifecycle-D1pzRwHB.js";
+import { Q as areCodexDynamicToolFingerprintsCompatible, ft as isContextEngineBindingCompatible, ot as isMessageOnlyCodexSourceReply } from "./thread-lifecycle-DXl1-I6b.js";
 import { readNonBlankString } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { createHash } from "node:crypto";
 import path from "node:path";
@@ -442,7 +442,7 @@ function renderCodexWorkspaceBootstrapPromptContext(contextFiles) {
 	const files = contextFiles;
 	if (files.length === 0) return;
 	const lines = [
-		"OpenClaw loaded these user-editable workspace files for the current turn. Codex loads project-local AGENTS.md natively. When execution uses another folder, OpenClaw supplies the agent workspace AGENTS.md as thread-level developer instructions. SOUL.md, IDENTITY.md, and USER.md remain turn-scoped collaboration instructions. Those files are not repeated here.",
+		"OpenClaw loaded these user-editable workspace files for the current turn. Codex loads project-local AGENTS.md natively. When execution uses another folder, OpenClaw supplies the agent workspace AGENTS.md as thread-level developer instructions. SOUL.md, IDENTITY.md, and USER.md are prepared separately from user input and are not repeated here.",
 		"",
 		"# Project Context",
 		"",

package/dist/{attempt-notifications--H8zXR5-.js → attempt-notifications-C9XufG6l.js}

@@ -1,4 +1,4 @@
-import { o as isJsonObject } from "./protocol-CAAcVIKF.js";
+import { o as isJsonObject } from "./protocol-5bh1G-H7.js";
 import { readStringField } from "openclaw/plugin-sdk/string-coerce-runtime";
 //#region extensions/codex/src/app-server/attempt-notifications.ts
 const CODEX_TURN_ABORT_MARKER_START = "<turn_aborted>";

package/dist/{auth-binding-Co2Vfcf_.js → auth-binding-CWlKVccJ.js}

@@ -74,4 +74,4 @@ async function fingerprintCodexAppServerAuthBinding(params) {
 	return (await prepareCodexAppServerAuthBinding(params))?.fingerprint;
 }
 //#endregion
-export { prepareCodexAppServerAuthBinding as n, auth_binding_exports as t };
+export { fingerprintCodexAppServerAuthBinding as n, prepareCodexAppServerAuthBinding as r, auth_binding_exports as t };

package/dist/{auth-cache-key-Kq6oerr6.js → auth-cache-key-7orQae_j.js}

@@ -1,5 +1,5 @@
-import { n as defineCodexBuildState } from "./build-state-6RL6qohz.js";
-import { s as resolveMacOSDesktopCodexAppPathCandidates } from "./managed-binary-DrjjRRUD.js";
+import { n as defineCodexBuildState } from "./build-state-BCmg9-5p.js";
+import { c as resolveMacOSDesktopCodexAppPathCandidates } from "./managed-binary-D22rNEcR.js";
 import { n as resolveCodexAppServerSpawnEnv } from "./transport-stdio-BGjHoYLr.js";
 import { createHash } from "node:crypto";
 import fs, { constants, existsSync, watch } from "node:fs";

package/dist/{binding-connection-QqgcPCgk.js → binding-connection-D3udKbIE.js}

@@ -1,7 +1,7 @@
 import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
-import { x as readCodexPluginConfig } from "./protocol-CAAcVIKF.js";
-import { a as resolveCodexCatalogConnectionHome, t as buildCodexAppServerConnectionFingerprint } from "./plugin-app-cache-key-CdSQzWyX.js";
-import { n as resolveCodexAppServerRuntimeOptions, r as resolveCodexSupervisionAppServerRuntimeOptions } from "./config-runtime-BWf6JLWG.js";
+import { x as readCodexPluginConfig } from "./protocol-5bh1G-H7.js";
+import { a as resolveCodexCatalogConnectionHome, t as buildCodexAppServerConnectionFingerprint } from "./plugin-app-cache-key-d0eKxy7b.js";
+import { n as resolveCodexAppServerRuntimeOptions, r as resolveCodexSupervisionAppServerRuntimeOptions } from "./config-runtime-D0zGNIHu.js";
 import { AgentHarnessPreflightError } from "openclaw/plugin-sdk/agent-harness-registration";
 //#region extensions/codex/src/app-server/binding-connection.ts
 var binding_connection_exports = /* @__PURE__ */ __exportAll({

package/dist/{bounded-turn-lRpmZHFv.js → bounded-turn-C_Hneydj.js}

@@ -1,12 +1,12 @@
 import { r as readCodexAppServerConfigOptions } from "./launch-args-RXQwn8zV.js";
-import { C as readCodexErrorNotification, E as createCodexElicitationResponse, b as assertCodexThreadStartResponse, x as assertCodexTurnStartResponse } from "./client-BEKu4yDx.js";
-import "./config-JDfTI4VI.js";
-import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-BWf6JLWG.js";
-import { u as isCodexAppServerStartSelectionChangedError } from "./shared-client-CVhez2Uo.js";
-import { a as closeCodexStartupClientBestEffort, o as interruptCodexTurnAndWaitBestEffort, t as CODEX_APP_SERVER_INTERRUPT_TIMEOUT_MS } from "./attempt-client-cleanup-D6cR54TV.js";
-import { t as CodexEphemeralTurn } from "./ephemeral-turn-DSwzP8YY.js";
-import { r as readModelListResult } from "./models-P9k2qAof.js";
-import { G as attestCodexRestrictedToolSurfaceMcpServersDisabled, Tt as mergeCodexThreadConfigs, _ as buildCodexRingZeroThreadConfigPatch, b as readCodexInheritedMcpServerNames, g as assertCodexManagedRequirementsDoNotOverrideToolPolicy, v as buildCodexRuntimeThreadConfig } from "./thread-lifecycle-D1pzRwHB.js";
+import { C as readCodexErrorNotification, E as createCodexElicitationResponse, b as assertCodexThreadStartResponse, x as assertCodexTurnStartResponse } from "./client-B57KWPQx.js";
+import "./config-oIORaQ5T.js";
+import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-D0zGNIHu.js";
+import { u as isCodexAppServerStartSelectionChangedError } from "./shared-client-CscigXXL.js";
+import { a as closeCodexStartupClientBestEffort, o as interruptCodexTurnAndWaitBestEffort, t as CODEX_APP_SERVER_INTERRUPT_TIMEOUT_MS } from "./attempt-client-cleanup-DKHzbwt5.js";
+import { t as CodexEphemeralTurn } from "./ephemeral-turn-D78_VmzO.js";
+import { r as readModelListResult } from "./models-PCKOim-h.js";
+import { Et as mergeCodexThreadConfigs, K as attestCodexRestrictedToolSurfaceMcpServersDisabled, _ as assertCodexManagedRequirementsDoNotOverrideToolPolicy, v as buildCodexRingZeroThreadConfigPatch, x as readCodexInheritedMcpServerNames, y as buildCodexRuntimeThreadConfig } from "./thread-lifecycle-DXl1-I6b.js";
 import { resolveTimerTimeoutMs } from "openclaw/plugin-sdk/number-runtime";
 import path from "node:path";
 import fs from "node:fs/promises";
@@ -62,8 +62,8 @@ async function runBoundedCodexAppServerTurn(params) {
 async function runBoundedCodexAppServerTurnInWorkspace(params, appServer, workspace, selectionAttempt = 0, timing) {
 	const totalTimeoutMs = timing?.timeoutMs ?? resolveTimerTimeoutMs(params.timeoutMs, 100, 100);
 	const timeoutError = new CodexBoundedTurnTimeoutError(params.taskLabel, totalTimeoutMs);
-	const deadline = timing?.deadline ?? Date.now() + totalTimeoutMs;
-	const timeoutMs = deadline - Date.now();
+	const deadline = timing?.deadline ?? performance.now() + totalTimeoutMs;
+	const timeoutMs = deadline - performance.now();
 	if (timeoutMs <= 0) throw timeoutError;
 	params.assertCurrent?.();
 	const agentDir = params.agentDir?.trim() || void 0;
@@ -79,7 +79,7 @@ async function runBoundedCodexAppServerTurnInWorkspace(params, appServer, worksp
 		assertCurrent: params.assertCurrent,
 		...params.signal ? { abandonSignal: params.signal } : {}
 	};
-	const client = params.options.clientFactory ? await params.options.clientFactory(clientOptions) : await import("./shared-client-CVhez2Uo.js").then((n) => n.y).then(({ createIsolatedCodexAppServerClient }) => createIsolatedCodexAppServerClient({
+	const client = params.options.clientFactory ? await params.options.clientFactory(clientOptions) : await import("./shared-client-CscigXXL.js").then((n) => n.y).then(({ createIsolatedCodexAppServerClient }) => createIsolatedCodexAppServerClient({
 		...clientOptions,
 		authProfileStore: params.authProfileStore
 	}));
@@ -102,7 +102,7 @@ async function runBoundedCodexAppServerTurnInWorkspace(params, appServer, worksp
 	const abortFromCaller = () => abortRun(params.signal?.reason ?? "aborted");
 	if (params.signal?.aborted) abortFromCaller();
 	else params.signal?.addEventListener("abort", abortFromCaller, { once: true });
-	const remainingRunMs = deadline - Date.now();
+	const remainingRunMs = deadline - performance.now();
 	if (remainingRunMs <= 0) abortRun(timeoutError);
 	const timeout = setTimeout(() => abortRun(timeoutError), Math.max(1, remainingRunMs));
 	timeout.unref?.();

package/dist/{build-state-6RL6qohz.js → build-state-BCmg9-5p.js}

@@ -1,5 +1,5 @@
 //#region extensions/codex/package.json
-var version = "2026.9.3";
+var version = "2026.9.4";
 //#endregion
 //#region extensions/codex/src/build-state.ts
 /**

package/dist/{capabilities-BeqLPbtM.js → capabilities-8vx68WLH.js}

@@ -1,4 +1,4 @@
-import { r as CodexAppServerRpcError } from "./session-catalog-provenance-DkJHo735.js";
+import { t as CodexAppServerRpcError } from "./rpc-error-ttN_QjEm.js";
 //#region extensions/codex/src/app-server/capabilities.ts
 /**
 * Capability helpers for optional Codex app-server control-plane methods.

package/dist/cli-metadata.js

@@ -2,7 +2,7 @@ import { definePluginEntry } from "openclaw/plugin-sdk/plugin-entry";
 //#region extensions/codex/cli-metadata.ts
 function registerCodexCliMetadata(api) {
 	api.registerCli(async ({ program }) => {
-		const { registerCodexSessionCli } = await import("./session-cli-CbgaHh0f.js");
+		const { registerCodexSessionCli } = await import("./session-cli-DNN_jhGc.js");
 		registerCodexSessionCli(program);
 	}, { descriptors: [{
 		name: "codex",

package/dist/{client-BEKu4yDx.js → client-B57KWPQx.js}

@@ -1,10 +1,10 @@
 import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
-import { l as resolveCodexAppServerUserHomeDir, o as isJsonObject } from "./protocol-CAAcVIKF.js";
+import { l as resolveCodexAppServerUserHomeDir, o as isJsonObject } from "./protocol-5bh1G-H7.js";
 import { r as MIN_SUPPORTED_CODEX_APP_SERVER_VERSION, t as CODEX_APP_SERVER_VERSION } from "./version-omm6IPI3.js";
 import { a as hasCodexAppServerNaturalExit, i as closeCodexAppServerTransportAndWait, r as closeCodexAppServerTransport, t as createStdioTransport } from "./transport-stdio-BGjHoYLr.js";
-import { r as CodexAppServerRpcError } from "./session-catalog-provenance-DkJHo735.js";
-import "./config-JDfTI4VI.js";
-import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-BWf6JLWG.js";
+import { t as CodexAppServerRpcError } from "./rpc-error-ttN_QjEm.js";
+import "./config-oIORaQ5T.js";
+import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-D0zGNIHu.js";
 import { isRecord, normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { randomUUID } from "node:crypto";
 import { addTimerTimeoutGraceMs, parseStrictNonNegativeInteger } from "openclaw/plugin-sdk/number-runtime";
@@ -3333,13 +3333,16 @@ var CodexAppServerClient = class CodexAppServerClient {
 		this.transportExited = false;
 		this.nativeExecutionObserved = false;
 		this.stderrTail = "";
+		this.privateTransportSecrets = /* @__PURE__ */ new Set();
+		this.privateStderrPending = "";
 		this.child = child;
 		this.lines = createInterface({ input: child.stdout });
 		this.lines.on("line", (line) => this.handleLine(line));
 		this.lines.on("error", (error) => this.closeWithError(toStringifiedError(error)));
 		child.stdout.on("error", (error) => this.closeWithError(toStringifiedError(error)));
 		child.stderr.setEncoding("utf8");
-		child.stderr.on("data", (text) => {
+		child.stderr.on("data", (chunk) => {
+			const text = this.redactPrivateStderr(chunk);
 			this.stderrTail = appendBoundedTail(this.stderrTail, text, CODEX_APP_SERVER_STDERR_TAIL_MAX);
 			const trimmed = text.trim();
 			if (trimmed) embeddedAgentLog.debug(`codex app-server stderr: ${trimmed}`);
@@ -3685,6 +3688,25 @@ var CodexAppServerClient = class CodexAppServerClient {
 			}
 		});
 	}
+	/** Protect private loopback route capabilities before native diagnostics can mention them. */
+	protectPrivateTransportSecret(secret) {
+		if (!/^[A-Za-z0-9_-]{43}$/.test(secret) || this.privateTransportSecrets.size >= 8) {
+			if (!this.privateTransportSecrets.has(secret)) throw new Error("Invalid private Codex transport capability");
+		}
+		this.privateTransportSecrets.add(secret);
+	}
+	redactPrivateText(text) {
+		let redacted = text;
+		for (const secret of this.privateTransportSecrets) redacted = redacted.replaceAll(secret, "[REDACTED]");
+		return redacted;
+	}
+	redactPrivateStderr(chunk) {
+		const text = this.redactPrivateText(this.privateStderrPending + chunk);
+		let held = 0;
+		for (const secret of this.privateTransportSecrets) for (let length = 1; length < secret.length; length++) if (text.endsWith(secret.slice(0, length))) held = Math.max(held, length);
+		this.privateStderrPending = held ? text.slice(-held) : "";
+		return held ? text.slice(0, -held) : text;
+	}
 	handleLine(line) {
 		const rawLine = line.endsWith("\r") ? line.slice(0, -1) : line;
 		if (this.pendingParse) {

package/dist/{command-dispatch-CisT9Jqq.js → command-dispatch-BpduNGVf.js}

@@ -1,5 +1,5 @@
-import { a as formatCodexDisplayText } from "./command-formatters-DeTfrapr.js";
-import { n as describeControlFailure } from "./capabilities-BeqLPbtM.js";
+import { o as formatCodexDisplayText } from "./command-formatters-lxlkNZgU.js";
+import { n as describeControlFailure } from "./capabilities-8vx68WLH.js";
 //#region extensions/codex/src/command-dispatch.ts
 /** Dispatches a `/codex` command to the lazily loaded handler. */
 async function handleCodexCommand(ctx, options) {
@@ -14,7 +14,7 @@ async function handleCodexCommand(ctx, options) {
 	}
 }
 async function loadDefaultCodexSubcommandHandler() {
-	const { handleCodexSubcommand } = await import("./command-handlers-BfIsJEuA.js");
+	const { handleCodexSubcommand } = await import("./command-handlers-tiL9iWj7.js");
 	return handleCodexSubcommand;
 }
 //#endregion

package/dist/{command-formatters-DeTfrapr.js → command-formatters-lxlkNZgU.js}

@@ -1,5 +1,5 @@
-import { o as isJsonObject } from "./protocol-CAAcVIKF.js";
-import { c as summarizeCodexRateLimits, o as summarizeCodexAccountRateLimits, r as hasCodexRateLimitSnapshots } from "./rate-limits-Bqnx1N4z.js";
+import { o as isJsonObject } from "./protocol-5bh1G-H7.js";
+import { c as summarizeCodexRateLimits, o as summarizeCodexAccountRateLimits, r as hasCodexRateLimitSnapshots } from "./rate-limits-CBMmWBr9.js";
 import { normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
 //#region extensions/codex/src/command-formatters.ts
 /**
@@ -198,6 +198,7 @@ function buildHelp() {
 		"- /codex diagnostics [note]",
 		"- /codex computer-use [status|install]",
 		"- /codex account",
+		"- /codex plugins refresh                   refresh hosted inventory for the current Codex account/runtime",
 		"- /codex mcp",
 		"- /codex skills",
 		"- /codex plugins [list|enable|disable]"
@@ -279,4 +280,4 @@ function extractArray(value) {
 	return [];
 }
 //#endregion
-export { formatCodexDisplayText as a, formatComputerUseStatus as c, formatSkills as d, formatThreads as f, formatAccount as i, formatList as l, buildHelp as n, formatCodexStatus as o, escapeCodexChatText as r, formatCodexTextForDisplay as s, CODEX_RESUME_SAFE_THREAD_ID_PATTERN as t, formatModels as u };
+export { formatCodexAccountLine as a, formatCodexTextForDisplay as c, formatModels as d, formatSkills as f, formatAccount as i, formatComputerUseStatus as l, buildHelp as n, formatCodexDisplayText as o, formatThreads as p, escapeCodexChatText as r, formatCodexStatus as s, CODEX_RESUME_SAFE_THREAD_ID_PATTERN as t, formatList as u };