@openclaw/codex 2026.9.34 → 2026.9.35

package/dist/.setup/{session-catalog-node-continue-DjKXHBbi.mjs → session-catalog-node-continue-XFJG3JGh.mjs}

@@ -1,10 +1,10 @@
-import { A as unwrapNodeInvokePayload, b as parseTranscriptPage, d as boundedCatalogString, f as catalogError, g as isInteractiveThreadSource, h as filterCatalogPageByTitle, n as CODEX_APP_SERVER_THREADS_LIST_COMMAND, o as CatalogParamsError, r as CODEX_APP_SERVER_THREAD_TURNS_LIST_COMMAND, u as NODE_INVOKE_TIMEOUT_MS, v as parseCatalogPage } from "./session-catalog-parsing-CPGaPYr-.mjs";
-import { n as createCodexCliNodeConversationBindingData } from "./conversation-binding-data-C746z5Pn.mjs";
-import { r as CODEX_CLI_SESSION_SOURCE_UPGRADE_MESSAGE, t as CODEX_CLI_SESSION_RESUME_COMMAND } from "./node-cli-sessions-HC4W6FLI.mjs";
+import { A as unwrapNodeInvokePayload, b as parseTranscriptPage, d as boundedCatalogString, f as catalogError, g as isInteractiveThreadSource, h as filterCatalogPageByTitle, n as CODEX_APP_SERVER_THREADS_LIST_COMMAND, o as CatalogParamsError, r as CODEX_APP_SERVER_THREAD_TURNS_LIST_COMMAND, u as NODE_INVOKE_TIMEOUT_MS, v as parseCatalogPage } from "./session-catalog-parsing-CnEH565l.mjs";
+import { n as createCodexCliNodeConversationBindingData } from "./conversation-binding-data-DlsG-dQu.mjs";
+import { r as CODEX_CLI_SESSION_SOURCE_UPGRADE_MESSAGE, t as CODEX_CLI_SESSION_RESUME_COMMAND } from "./node-cli-sessions-BwhIYgCZ.mjs";
 import { i as withTimeout } from "./timeout-CXOfNoaX.mjs";
-import { t as lookupNodeCodexCatalogRecord } from "./session-catalog-node-lookup-CtAXI5W5.mjs";
+import { t as lookupNodeCodexCatalogRecord } from "./session-catalog-node-lookup-D9AP5D5o.mjs";
 import { t as codexLastTerminalTurnId } from "./session-upstream-marker-D15C9NHp.mjs";
-import { catalogSessionActions, createOrReuseNodeAdoptedSession, finalizeNodeAdoptedSession, findNodeAdoptedSessionEntry, nodeAdoptedSourceKey, nodeSessionMarker } from "./session-catalog-node-adoption-DgXvSGu0.mjs";
+import { catalogSessionActions, createOrReuseNodeAdoptedSession, finalizeNodeAdoptedSession, findNodeAdoptedSessionEntry, nodeAdoptedSourceKey, nodeSessionMarker } from "./session-catalog-node-adoption-BdS7zDuY.mjs";
 import { resolveSessionAgentIdsStrict } from "openclaw/plugin-sdk/agent-scope-runtime";
 import { createSessionCatalogAdoptionCoordinator, publishSessionCatalogHost, sessionCatalogAdoptedSourceKey } from "openclaw/plugin-sdk/session-catalog";
 //#region extensions/codex/src/session-catalog-node-continue.ts

package/dist/.setup/{session-catalog-node-lookup-CtAXI5W5.mjs → session-catalog-node-lookup-D9AP5D5o.mjs}

@@ -1,5 +1,5 @@
-import { A as unwrapNodeInvokePayload, n as CODEX_APP_SERVER_THREADS_LIST_COMMAND, o as CatalogParamsError, u as NODE_INVOKE_TIMEOUT_MS, v as parseCatalogPage } from "./session-catalog-parsing-CPGaPYr-.mjs";
-import "./session-catalog-limits-DDxOsQeC.mjs";
+import { A as unwrapNodeInvokePayload, n as CODEX_APP_SERVER_THREADS_LIST_COMMAND, o as CatalogParamsError, u as NODE_INVOKE_TIMEOUT_MS, v as parseCatalogPage } from "./session-catalog-parsing-CnEH565l.mjs";
+import "./session-catalog-limits-bz5ZvjtY.mjs";
 import { i as withTimeout } from "./timeout-CXOfNoaX.mjs";
 //#region extensions/codex/src/session-catalog-node-lookup.ts
 async function lookupNodeCodexCatalogRecord(params) {

package/dist/.setup/{session-catalog-parsing-CPGaPYr-.mjs → session-catalog-parsing-CnEH565l.mjs}

@@ -1,5 +1,5 @@
 import "./protocol-CANUwXJ3.mjs";
-import { n as detachCodexCatalogString } from "./session-catalog-limits-DDxOsQeC.mjs";
+import { n as detachCodexCatalogString } from "./session-catalog-limits-bz5ZvjtY.mjs";
 import { asFiniteNumber, isRecord } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { truncateUtf16Safe } from "openclaw/plugin-sdk/text-utility-runtime";
 //#region extensions/codex/src/app-server/protocol-session-source.ts

package/dist/.setup/{session-catalog-projection-DcqN7DuI.mjs → session-catalog-projection-DcDKizZd.mjs}

@@ -1,8 +1,8 @@
-import { D as selectCodexCatalogPreviewInput, O as toCatalogSession, S as readControlCursor, d as boundedCatalogString, k as truncateCodexCatalogPreview } from "./session-catalog-parsing-CPGaPYr-.mjs";
-import { n as detachCodexCatalogString } from "./session-catalog-limits-DDxOsQeC.mjs";
-import { n as codexCatalogRowRecency } from "./session-catalog-index-order-BcQpHks3.mjs";
+import { D as selectCodexCatalogPreviewInput, O as toCatalogSession, S as readControlCursor, d as boundedCatalogString, k as truncateCodexCatalogPreview } from "./session-catalog-parsing-CnEH565l.mjs";
+import { n as detachCodexCatalogString } from "./session-catalog-limits-bz5ZvjtY.mjs";
+import { n as codexCatalogRowRecency } from "./session-catalog-index-order-DQhmgM3b.mjs";
 import { t as isOpenClawManagedCodexThread } from "./session-catalog-provenance-DoAvktcj.mjs";
-import { c as copyCodexCatalogSource, l as getCodexCatalogSource, p as setCodexCatalogSource, r as projectCodexCatalogNativeThread } from "./session-catalog-native-projection-DhId_sl8.mjs";
+import { c as copyCodexCatalogSource, l as getCodexCatalogSource, p as setCodexCatalogSource, r as projectCodexCatalogNativeThread } from "./session-catalog-native-projection-CXTe4qQr.mjs";
 import { asFiniteNumber, isRecord } from "openclaw/plugin-sdk/string-coerce-runtime";
 import path from "node:path";
 import fs from "node:fs/promises";

package/dist/.setup/{session-cli-TEVHpWaE.mjs → session-cli-C3GejWcm.mjs}

@@ -1,5 +1,5 @@
-import "./session-catalog-parsing-CPGaPYr-.mjs";
-import "./session-catalog-BaVqm4-Q.mjs";
+import "./session-catalog-parsing-CnEH565l.mjs";
+import "./session-catalog-DMagZcW-.mjs";
 import { isRecord } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { normalizeAgentId } from "openclaw/plugin-sdk/routing";
 import { truncateUtf16Safe } from "openclaw/plugin-sdk/text-utility-runtime";

package/dist/.setup/{session-history-import-WhX-X33a.mjs → session-history-import-tquj9DCz.mjs}

@@ -1,7 +1,7 @@
-import { v as sessionBindingIdentity } from "./session-binding-record-Oe9L-CNY.mjs";
-import "./session-binding-DGCYAfvD.mjs";
-import { r as importCodexThreadHistoryToTranscript } from "./transcript-mirror-kxmCYsuF.mjs";
-import { n as prepareCodexSessionInitialization } from "./session-initialization-6aveB9qb.mjs";
+import { v as sessionBindingIdentity } from "./session-binding-record-CUKpUKVm.mjs";
+import "./session-binding-Fn7Ekzuv.mjs";
+import { r as importCodexThreadHistoryToTranscript } from "./transcript-mirror-BRNhyb1o.mjs";
+import { n as prepareCodexSessionInitialization } from "./session-initialization-DefAI1_5.mjs";
 import { resolveStorePath } from "openclaw/plugin-sdk/session-store-runtime";
 //#region extensions/codex/src/app-server/session-history-import.ts
 /** Creates a session whose transcript is derived from one verified Codex thread snapshot. */

package/dist/.setup/{session-initialization-6aveB9qb.mjs → session-initialization-DefAI1_5.mjs}

@@ -1,5 +1,5 @@
-import { b as validateBindingForWrite } from "./session-binding-record-Oe9L-CNY.mjs";
-import "./session-binding-DGCYAfvD.mjs";
+import { b as validateBindingForWrite } from "./session-binding-record-CUKpUKVm.mjs";
+import "./session-binding-Fn7Ekzuv.mjs";
 import { createNativeSessionInitializationOwner } from "openclaw/plugin-sdk/agent-harness-session-runtime";
 //#region extensions/codex/src/app-server/session-initialization.ts
 const codexInitializations = createNativeSessionInitializationOwner({

package/dist/.setup/{session-permission-policy-Ci_fVX6y.mjs → session-permission-policy-7lM447LW.mjs}

@@ -1,5 +1,5 @@
 import { E as selectGuardianSandbox, _ as selectUserApprovalsReviewer, d as parseAllowedApprovalPoliciesFromCodexRequirements, f as parseAllowedApprovalsReviewersFromCodexRequirements, g as selectGuardianApprovalsReviewer, h as selectGuardianApprovalPolicy, i as resolveCodexAppServerNetworkProxy, p as parseAllowedSandboxModesFromCodexRequirements } from "./config-security-CE-FcGw9.mjs";
-import { n as canUseCodexModelBackedApprovalsReviewerForModel } from "./config-DKhXquav.mjs";
+import { n as canUseCodexModelBackedApprovalsReviewerForModel } from "./config-DqmrqI23.mjs";
 import { hostname } from "node:os";
 import { isPathInside } from "openclaw/plugin-sdk/file-access-runtime";
 //#region extensions/codex/src/app-server/app-server-policy.ts

package/dist/.setup/{session-retirement-CW0ciVbW.mjs → session-retirement-CQCMiDul.mjs}

@@ -1,11 +1,11 @@
-import { l as retainSharedCodexAppServerClientByInstanceId } from "./shared-client-lifecycle-CJ0lYVCW.mjs";
+import { u as retainSharedCodexAppServerClientByInstanceId } from "./shared-client-lifecycle-BH_y_i8l.mjs";
 import { t as withCodexAppServerThreadMutation } from "./thread-ownership-queue-Dp24d7-F.mjs";
 import { t as isIncognitoSessionKey } from "./incognito-session-C5ve_-63.mjs";
-import { K as releaseCodexAppServerLiveThread, R as hasCodexAppServerLiveThread, V as isCodexAppServerLiveThreadClaimed } from "./shared-client-tOOyadmg.mjs";
-import { n as CODEX_APP_SERVER_UNSUBSCRIBE_TIMEOUT_MS, o as closeCodexStartupClientBestEffort, p as unsubscribeCodexThreadBestEffort, r as CodexAppServerUnsafeSubscriptionError } from "./attempt-client-cleanup-93r-CLTi.mjs";
-import { t as codexNativeSubagentMonitorRuntime } from "./native-subagent-monitor-B9aAqfnU.mjs";
-import { t as isSameCodexAppServerThreadOwner } from "./thread-ownership-DDban_4i.mjs";
-import { t as getCodexSessionInitializationRollback } from "./session-initialization-6aveB9qb.mjs";
+import { K as releaseCodexAppServerLiveThread, R as hasCodexAppServerLiveThread, V as isCodexAppServerLiveThreadClaimed } from "./shared-client-ZXKMsK6f.mjs";
+import { n as CODEX_APP_SERVER_UNSUBSCRIBE_TIMEOUT_MS, o as closeCodexStartupClientBestEffort, p as unsubscribeCodexThreadBestEffort, r as CodexAppServerUnsafeSubscriptionError } from "./attempt-client-cleanup-BVtNsTOE.mjs";
+import { t as codexNativeSubagentMonitorRuntime } from "./native-subagent-monitor-g-ZDkvCr.mjs";
+import { t as isSameCodexAppServerThreadOwner } from "./thread-ownership-BT_SeSUp.mjs";
+import { t as getCodexSessionInitializationRollback } from "./session-initialization-DefAI1_5.mjs";
 //#region extensions/codex/src/app-server/session-retirement.ts
 async function releaseSessionSubscription(client, binding, sessionKey, assertCurrent) {
 	assertCurrent?.();

package/dist/.setup/{settled-turn-finalizer-DlPT87wW.mjs → settled-turn-finalizer-w92T5Rbb.mjs}

@@ -1,12 +1,12 @@
 import { r as readMirrorIdentity, t as attachCodexMirrorIdentity } from "./upstream-prompt-provenance-fXkKbPVC.mjs";
 import { a as fingerprintCodexMirrorSourceMessage, c as readCodexMirrorSourceFingerprint } from "./transcript-mirror-attestation-YSegaktH.mjs";
-import { rt as resolveCodexAppServerPreparedAuthHandoff } from "./shared-client-tOOyadmg.mjs";
-import { _ as assertCodexPassiveTurnItems } from "./client-CyquSiJ2.mjs";
-import { o as resolveCodexLocalRuntimeAttribution } from "./native-subagent-monitor-B9aAqfnU.mjs";
-import { t as codexTranscriptMirrorRuntime } from "./transcript-mirror-kxmCYsuF.mjs";
-import { runBoundedCodexAppServerTurn } from "./bounded-turn-I8Vb-qq3.mjs";
-import { t as resolveCodexBoundedTurnIsolation } from "./bounded-turn-isolation-B8K_ylqk.mjs";
-import { a as createAttributedCodexAssistantMessage } from "./event-projector-assistant-message-BmWQXFLV.mjs";
+import { rt as resolveCodexAppServerPreparedAuthHandoff } from "./shared-client-ZXKMsK6f.mjs";
+import { _ as assertCodexPassiveTurnItems } from "./client-DcTISXe3.mjs";
+import { o as resolveCodexLocalRuntimeAttribution } from "./native-subagent-monitor-g-ZDkvCr.mjs";
+import { t as codexTranscriptMirrorRuntime } from "./transcript-mirror-BRNhyb1o.mjs";
+import { runBoundedCodexAppServerTurn } from "./bounded-turn-DBwLoFDR.mjs";
+import { t as resolveCodexBoundedTurnIsolation } from "./bounded-turn-isolation-Ce-oOk-D.mjs";
+import { a as createAttributedCodexAssistantMessage } from "./event-projector-assistant-message-DXDX94zH.mjs";
 import { t as CodexSettledTurnContext } from "./settled-turn-context-D4yj4rxf.mjs";
 import { isSilentReplyText } from "openclaw/plugin-sdk/reply-runtime";
 //#region extensions/codex/src/app-server/settled-turn-finalizer.ts

package/dist/.setup/{shared-client-tOOyadmg.mjs → shared-client-ZXKMsK6f.mjs}

@@ -1,23 +1,23 @@
 import { i as isJsonObject } from "./protocol-CANUwXJ3.mjs";
-import { n as defineCodexBuildState, t as codexBuildSymbol } from "./build-state--SrHyc6r.mjs";
+import { n as defineCodexBuildState, t as codexBuildSymbol } from "./build-state-B3lvV1Op.mjs";
 import { t as CODEX_APP_SERVER_AUTH_PROVIDER } from "./auth-profile-selection-DFu9e167.mjs";
 import { n as isCodexAppServerProxyLaunch } from "./launch-args-DbFCehO7.mjs";
 import { a as withEphemeralCodexAuthStore, i as withClearedEnvironmentVariables, n as resolveCodexAppServerLocalHomeDir, r as resolveCodexAppServerUserHomeDir, t as resolveCodexAppServerHomeDir } from "./auth-start-options-BPIPeEX8.mjs";
 import { a as resolveCodexAppServerStartOptionsForAgent, d as readCodexEffectiveConfig, o as resolveCodexComputerUseConfig, t as codexAppServerStartOptionsKey, u as CODEX_SESSION_OVERRIDABLE_LAYER_TYPES } from "./config-options-CzyWLTJt.mjs";
-import { d as resolveMacOSDesktopCodexBundledMarketplaceCandidates, f as resolveMacOSDesktopCodexComputerUseServiceAppCandidates, i as resolveManagedCodexNativeCommand, l as resolveFirstExistingMacOSDesktopCodexBundledMarketplacePath, r as resolveManagedCodexAppServerStartOptions, t as isManagedCodexDesktopCommand, u as resolveMacOSDesktopCodexAppPathCandidates } from "./managed-binary-B6hQ1UKR.mjs";
-import { a as readCodexCliAuthFileApiKey, c as resolveCodexAppServerPreparedApiKeyCacheKey, d as waitForCodexDesktopGeneration, f as readCodexDesktopArtifactTreeFingerprint, i as fingerprintTokenAuthProfileCacheKey, n as CODEX_AUTH_JSON_FILENAME, o as readFirstNonEmptyEnv, r as fingerprintApiKeyAuthProfileCacheKey, s as resolveCodexAppServerFallbackApiKeyCacheKey, t as CODEX_APP_SERVER_API_KEY_ENV_VARS, u as isCodexDesktopGenerationCurrent } from "./auth-cache-key-Bs_3kRJD.mjs";
-import { a as notifyDesktopGenerationDrainChecks, c as retainSharedClientEntry, d as retireSharedCodexAppServerClientIfCurrent, m as waitForUnclaimedSharedClientStartup, n as getCurrentSharedClientEntry, o as ownCodexStartup, r as getSharedCodexAppServerClientState, s as releaseSharedClientEntry, t as createCodexAppServerStartupLifetime, u as retirePendingSharedClientEntryIfUnclaimed } from "./shared-client-lifecycle-CJ0lYVCW.mjs";
-import { n as resolveCodexAppServerSpawnEnv } from "./transport-stdio-CbutOIEh.mjs";
+import { d as resolveMacOSDesktopCodexBundledMarketplaceCandidates, f as resolveMacOSDesktopCodexComputerUseServiceAppCandidates, i as resolveManagedCodexNativeCommand, l as resolveFirstExistingMacOSDesktopCodexBundledMarketplacePath, r as resolveManagedCodexAppServerStartOptions, t as isManagedCodexDesktopCommand, u as resolveMacOSDesktopCodexAppPathCandidates } from "./managed-binary-Ckgvm_4V.mjs";
+import { a as readCodexCliAuthFileApiKey, c as resolveCodexAppServerPreparedApiKeyCacheKey, d as waitForCodexDesktopGeneration, f as readCodexDesktopArtifactTreeFingerprint, i as fingerprintTokenAuthProfileCacheKey, n as CODEX_AUTH_JSON_FILENAME, o as readFirstNonEmptyEnv, r as fingerprintApiKeyAuthProfileCacheKey, s as resolveCodexAppServerFallbackApiKeyCacheKey, t as CODEX_APP_SERVER_API_KEY_ENV_VARS, u as isCodexDesktopGenerationCurrent } from "./auth-cache-key-CskfconU.mjs";
+import { a as notifyDesktopGenerationDrainChecks, c as releaseSharedClientEntry, d as retirePendingSharedClientEntryIfUnclaimed, f as retireSharedCodexAppServerClientIfCurrent, h as waitForUnclaimedSharedClientStartup, l as retainSharedClientEntry, n as getCurrentSharedClientEntry, o as ownCodexStartup, r as getSharedCodexAppServerClientState, s as refreshSharedClientIdleRetirement, t as createCodexAppServerStartupLifetime } from "./shared-client-lifecycle-BH_y_i8l.mjs";
+import { n as resolveCodexAppServerSpawnEnv } from "./transport-stdio-DU8dIOCj.mjs";
 import { n as CodexAppServerAuthProfileUnavailableError, r as formatCodexAuthProfileUnavailableMessage } from "./auth-profile-recovery-BREezV0L.mjs";
 import { i as withTimeout } from "./timeout-CXOfNoaX.mjs";
 import { n as readCodexSessionMeta } from "./session-catalog-provenance-DoAvktcj.mjs";
-import { n as observeCodexCatalogClient } from "./session-catalog-events-D9zC7gRb.mjs";
-import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-C0NbLms1.mjs";
+import { n as observeCodexCatalogClient } from "./session-catalog-events-r59AxcQ4.mjs";
+import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-DDhvIeUC.mjs";
 import { a as resolveCodexAppServerAuthProfileStore, i as resolveCodexAppServerAuthProfileIdForAgent, r as resolveCodexAppServerAuthProfileId, t as isCodexAppServerNativeAuthProfile } from "./auth-profile-B0okYl2D.mjs";
 import { i as isCodexResponsesOAuthCredential, n as createCodexResponsesOAuth, o as resolveCodexResponsesOAuthProfileFingerprint, r as isCodexResponsesOAuth, t as CODEX_RESPONSES_OAUTH_PROVIDER } from "./responses-oauth-twnuTaAa.mjs";
-import { f as isUnsupportedCodexAppServerVersionError, t as CodexAppServerClient } from "./client-CyquSiJ2.mjs";
-import { n as isCodexWebSocketOpenFailure } from "./transport-websocket-BTBE-LD9.mjs";
-import { t as __exportAll } from "./session-binding-sidecars-jo6H8dFr.mjs";
+import { f as isUnsupportedCodexAppServerVersionError, t as CodexAppServerClient } from "./client-DcTISXe3.mjs";
+import { n as isCodexWebSocketOpenFailure } from "./transport-websocket-zu3jRPnu.mjs";
+import { t as __exportAll } from "./session-binding-sidecars-BuEALwJY.mjs";
 import { isRecord } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { createHash, randomUUID } from "node:crypto";
 import { isDeepStrictEqual } from "node:util";
@@ -1906,7 +1906,7 @@ async function readCodexClientSessionMeta(client, sessionsRoot, boundRolloutPath
 	return structuredClone(metadata);
 }
 /** Installs one auth-refresh handler and one rate-limit observer per physical client. */
-function ensureCodexAppServerClientRuntime(client, context) {
+function ensureCodexAppServerClientRuntime(client, context, onThreadOwnershipChange) {
 	const existing = configuredClients.get(client);
 	if (existing) {
 		if (existing.closed) return;
@@ -1918,6 +1918,7 @@ function ensureCodexAppServerClientRuntime(client, context) {
 	}
 	const runtime = {
 		context,
+		onThreadOwnershipChange,
 		closed: false,
 		retainedThreads: /* @__PURE__ */ new Map(),
 		claimedThreads: /* @__PURE__ */ new Map(),
@@ -1989,17 +1990,16 @@ function ensureCodexAppServerClientRuntime(client, context) {
 				invalidateThreadOwnership(runtime, threadId);
 				runtime.sessionMetadata.delete(threadId);
 				runtime.workspaceReferences.delete(threadId);
-				scheduleRetainedThreadEviction(client, runtime);
+				updateThreadOwnership(client, runtime);
 			}
 		}
 	});
 }
-function scheduleRetainedThreadEviction(client, runtime) {
-	if (runtime.evictionTimer) {
-		clearTimeout(runtime.evictionTimer);
-		runtime.evictionTimer = void 0;
-	}
+function updateThreadOwnership(client, runtime) {
+	clearTimeout(runtime.evictionTimer);
+	runtime.evictionTimer = void 0;
 	if (runtime.closed) return;
+	runtime.onThreadOwnershipChange?.();
 	let expiresAt = Number.POSITIVE_INFINITY;
 	for (const [threadId, thread] of runtime.retainedThreads) if (!runtime.protectedThreads.has(threadId)) expiresAt = Math.min(expiresAt, thread.expiresAt);
 	if (!Number.isFinite(expiresAt)) return;
@@ -2026,7 +2026,6 @@ async function releaseRetainedThread(client, runtime, threadId, assertCurrent) {
 		olderThreadIds.add(candidateThreadId);
 	}
 	runtime.retainedThreads.delete(threadId);
-	scheduleRetainedThreadEviction(client, runtime);
 	const transition = {
 		retainedOwnerToken: retained.ownerToken,
 		completion: Promise.resolve().then(() => {
@@ -2035,6 +2034,7 @@ async function releaseRetainedThread(client, runtime, threadId, assertCurrent) {
 		})
 	};
 	runtime.releasingThreads.set(threadId, transition);
+	updateThreadOwnership(client, runtime);
 	try {
 		await transition.completion;
 		runtime.workspaceReferences.delete(threadId);
@@ -2051,13 +2051,13 @@ async function releaseRetainedThread(client, runtime, threadId, assertCurrent) {
 		throw error;
 	} finally {
 		if (runtime.releasingThreads.get(threadId) === transition) runtime.releasingThreads.delete(threadId);
-		scheduleRetainedThreadEviction(client, runtime);
+		updateThreadOwnership(client, runtime);
 	}
 }
 async function evictExpiredRetainedThreads(client, runtime) {
 	const now = Date.now();
 	for (const [threadId, thread] of runtime.retainedThreads) if (thread.expiresAt <= now && !runtime.protectedThreads.has(threadId)) await releaseRetainedThread(client, runtime, threadId);
-	scheduleRetainedThreadEviction(client, runtime);
+	updateThreadOwnership(client, runtime);
 }
 async function evictExcessIdleThreads(client, runtime) {
 	const idleThreads = () => [...runtime.retainedThreads].filter(([threadId, thread]) => thread.ephemeralPolicy === void 0 && !runtime.protectedThreads.has(threadId));
@@ -2098,7 +2098,7 @@ async function retainCodexAppServerLiveThread(client, threadId, releaseThread, c
 		await evictExcessIdleThreads(client, runtime);
 	} catch (error) {
 		if (runtime.retainedThreads.get(threadId) === retained) runtime.retainedThreads.delete(threadId);
-		scheduleRetainedThreadEviction(client, runtime);
+		updateThreadOwnership(client, runtime);
 		embeddedAgentLog$1.warn("codex retained thread capacity eviction failed", {
 			threadId,
 			reason: formatErrorMessage$1(error)
@@ -2107,7 +2107,7 @@ async function retainCodexAppServerLiveThread(client, threadId, releaseThread, c
 	}
 	if (runtime.closed) return false;
 	if (claimed !== void 0 && runtime.claimedThreads.get(threadId) === claimed) runtime.claimedThreads.delete(threadId);
-	scheduleRetainedThreadEviction(client, runtime);
+	updateThreadOwnership(client, runtime);
 	return true;
 }
 /** Transfer one idle subscription to its next turn or compaction without touching sibling threads. */
@@ -2146,7 +2146,7 @@ function claimCodexAppServerThreadOwnership(client, runtime, threadId, retained,
 	runtime.claimedThreads.set(threadId, claimed);
 	previousClaim?.invalidate();
 	retained.ownerToken?.invalidate();
-	scheduleRetainedThreadEviction(client, runtime);
+	updateThreadOwnership(client, runtime);
 	const assertCurrent = () => {
 		if (claimed.invalidated || runtime.closed || runtime.claimedThreads.get(threadId) !== claimed) throw new Error(`Codex thread subscription ownership changed: ${threadId}`);
 	};
@@ -2187,6 +2187,7 @@ function claimCodexAppServerThreadOwnership(client, runtime, threadId, retained,
 			}
 		} finally {
 			if (runtime.releasingThreads.get(threadId) === transition) runtime.releasingThreads.delete(threadId);
+			updateThreadOwnership(client, runtime);
 		}
 	};
 	physicalThreadReleases.set(release, retained.release);
@@ -2200,7 +2201,7 @@ function claimCodexAppServerThreadOwnership(client, runtime, threadId, retained,
 		forget: () => {
 			if (forgetThreadOwnership(runtime, threadId, claimed)) {
 				runtime.workspaceReferences.delete(threadId);
-				scheduleRetainedThreadEviction(client, runtime);
+				updateThreadOwnership(client, runtime);
 			}
 		}
 	};
@@ -2210,6 +2211,11 @@ function revertCodexAppServerLiveThreadSkillsCatalog(client, threadId) {
 	const runtime = configuredClients.get(client);
 	if (runtime && !runtime.closed) revertRetainedThreadSkillsCatalog(runtime, threadId);
 }
+/** Native subscriptions, including ephemeral history and releases, pin their physical client. */
+function hasCodexAppServerThreadOwnership(client) {
+	const runtime = configuredClients.get(client);
+	return Boolean(runtime && !runtime.closed && (runtime.retainedThreads.size > 0 || runtime.claimedThreads.size > 0 || runtime.releasingThreads.size > 0 || runtime.protectedThreads.size > 0));
+}
 /** Distinguish active claimed ownership from an already-evicted idle subscription. */
 function hasCodexAppServerLiveThread(client, threadId) {
 	return hasThreadOwnership(configuredClients.get(client), threadId);
@@ -2253,20 +2259,24 @@ async function unsubscribeCodexAppServerLiveThread(client, threadId, timeoutMs,
 			physicalRelease
 		};
 		runtime.releasingThreads.set(threadId, transition);
+		updateThreadOwnership(client, runtime);
 	}
 	try {
 		await physicalRelease;
 		if (retained !== void 0 && runtime?.retainedThreads.get(threadId) === retained) {
 			runtime.retainedThreads.delete(threadId);
 			retained.ownerToken?.invalidate();
-			scheduleRetainedThreadEviction(client, runtime);
+			updateThreadOwnership(client, runtime);
 		}
 		if (claimed !== void 0 && runtime?.claimedThreads.get(threadId) === claimed) {
 			runtime.claimedThreads.delete(threadId);
 			claimed.invalidate();
 		}
 	} finally {
-		if (ownsTransition && runtime.releasingThreads.get(threadId) === transition) runtime.releasingThreads.delete(threadId);
+		if (ownsTransition && runtime.releasingThreads.get(threadId) === transition) {
+			runtime.releasingThreads.delete(threadId);
+			updateThreadOwnership(client, runtime);
+		}
 	}
 }
 /** Reset/end owns the exact thread; failed generation retirement must never release its successor. */
@@ -2279,7 +2289,7 @@ function protectCodexAppServerLiveThread(client, threadId) {
 	const runtime = configuredClients.get(client);
 	if (!runtime || runtime.closed) return () => void 0;
 	runtime.protectedThreads.set(threadId, (runtime.protectedThreads.get(threadId) ?? 0) + 1);
-	scheduleRetainedThreadEviction(client, runtime);
+	updateThreadOwnership(client, runtime);
 	let protectedThread = true;
 	return () => {
 		if (!protectedThread) return;
@@ -2295,7 +2305,7 @@ function protectCodexAppServerLiveThread(client, threadId) {
 				runtime.retainedThreads.set(threadId, retained);
 			}
 		} else runtime.protectedThreads.set(threadId, count - 1);
-		scheduleRetainedThreadEviction(client, runtime);
+		updateThreadOwnership(client, runtime);
 		evictExcessIdleThreads(client, runtime).catch((error) => {
 			embeddedAgentLog$1.warn("codex retained thread unpin eviction failed", {
 				threadId,
@@ -2558,7 +2568,7 @@ async function prepareCodexInferenceRoute(params) {
 		}
 		pending = Promise.all([
 			import("./inference-proxy-DhcXOgUE.mjs"),
-			import("./native-subagent-monitor-B9aAqfnU.mjs").then((n) => n.n),
+			import("./native-subagent-monitor-g-ZDkvCr.mjs").then((n) => n.n),
 			import("./inference-dispatch-CMZtjQyz.mjs")
 		]).then(([{ createCodexInferenceProxy }, native, { createCodexInferenceModelBinding }]) => {
 			assertClient();
@@ -3245,7 +3255,10 @@ function createSharedCodexAppServerClientStartup(params) {
 	}).then((client) => {
 		const state = getSharedCodexAppServerClientState();
 		params.entry.client = client;
+		params.entry.hasOwnedThreads = () => hasCodexAppServerThreadOwnership(client);
 		client.addCloseHandler((closedClient) => {
+			clearTimeout(params.entry.idleTimer);
+			params.entry.idleTimer = void 0;
 			const entry = getCurrentSharedClientEntry(closedClient);
 			if (entry) state.clients.delete(entry.key);
 		});
@@ -3349,7 +3362,7 @@ async function startInitializedCodexAppServerClientOnce(params) {
 		} finally {
 			artifactDrain?.cancel();
 		}
-		const runtimeArtifactModule = params.runtimeArtifactMode ? await import("./runtime-artifact-D7lCXdhV.mjs") : void 0;
+		const runtimeArtifactModule = params.runtimeArtifactMode ? await import("./runtime-artifact-Riq878B2.mjs") : void 0;
 		const runtimeArtifactBeforeStart = runtimeArtifactModule ? await runtimeArtifactModule.captureCodexAppServerRuntimeArtifactBeforeStart({
 			startOptions,
 			spawnIdentity: resolveCodexAppServerSpawnIdentity(startOptions),
@@ -3420,7 +3433,7 @@ async function startInitializedCodexAppServerClientOnce(params) {
 				...params.authProfileStore ? { authProfileStore: params.authProfileStore } : {},
 				config: params.config,
 				onAuthRefreshFailure: () => retireSharedCodexAppServerClientIfCurrent(client)
-			});
+			}, () => refreshSharedClientIdleRetirement(client));
 			assertStartupCurrent();
 			const authHandoff = await waitForStartup(() => applyCodexAppServerAuthProfile({
 				client,

package/dist/.setup/{shared-client-lifecycle-CJ0lYVCW.mjs → shared-client-lifecycle-BH_y_i8l.mjs}

@@ -1,4 +1,4 @@
-import { n as defineCodexBuildState } from "./build-state--SrHyc6r.mjs";
+import { n as defineCodexBuildState } from "./build-state-B3lvV1Op.mjs";
 //#region extensions/codex/src/app-server/shared-client-lifecycle.ts
 /** Client ownership and synchronous retirement, independent of startup/auth execution. */
 const createCodexAppServerStartupLifetime = () => ({
@@ -50,6 +50,7 @@ function retireSharedCodexAppServerClientIfCurrent(client, opts) {
 	const currentEntry = getCurrentSharedClientEntry(client);
 	const entry = currentEntry ?? state.entriesByClient.get(client);
 	if (!entry || entry.client !== client && !entry.closeError) return;
+	cancelSharedClientIdleRetirement(entry);
 	if (currentEntry) {
 		state.clients.delete(entry.key);
 		entry.closeWhenIdle = true;
@@ -84,6 +85,7 @@ function closeRetiredSharedClientEntry(entry) {
 	const client = entry.client;
 	if (!client) return false;
 	entry.client = void 0;
+	cancelSharedClientIdleRetirement(entry);
 	client.close();
 	return true;
 }
@@ -135,8 +137,27 @@ async function retainSharedCodexAppServerClientByInstanceId(clientId) {
 function notifyDesktopGenerationDrainChecks(state) {
 	for (const check of state.desktopGenerationDrainChecks) check();
 }
+const CODEX_APP_SERVER_CLIENT_IDLE_GRACE_MS = 3e4;
+function cancelSharedClientIdleRetirement(entry) {
+	clearTimeout(entry.idleTimer);
+	entry.idleTimer = void 0;
+}
+function refreshSharedClientIdleRetirement(client) {
+	const entry = getCurrentSharedClientEntry(client);
+	if (entry) scheduleSharedClientIdleRetirement(entry);
+}
+function scheduleSharedClientIdleRetirement(entry) {
+	cancelSharedClientIdleRetirement(entry);
+	if (entry.activeLeases > 0 || entry.pendingAcquires > 0 || !entry.client || entry.hasOwnedThreads?.() || getCurrentSharedClientEntry(entry.client) !== entry) return;
+	entry.idleTimer = setTimeout(() => {
+		entry.idleTimer = void 0;
+		if (entry.activeLeases === 0 && entry.pendingAcquires === 0 && !entry.hasOwnedThreads?.()) retireSharedCodexAppServerClientIfCurrent(entry.client);
+	}, CODEX_APP_SERVER_CLIENT_IDLE_GRACE_MS);
+	entry.idleTimer.unref?.();
+}
 function retainSharedClientEntry(entry, counter = "activeLeases") {
 	let released = false;
+	cancelSharedClientIdleRetirement(entry);
 	entry[counter] += 1;
 	return () => {
 		if (released) return;
@@ -147,7 +168,8 @@ function retainSharedClientEntry(entry, counter = "activeLeases") {
 function releaseSharedClientEntry(entry, counter) {
 	entry[counter] -= 1;
 	closeRetiredSharedClientEntryIfIdle(entry);
+	scheduleSharedClientIdleRetirement(entry);
 	notifyDesktopGenerationDrainChecks(getSharedCodexAppServerClientState());
 }
 //#endregion
-export { notifyDesktopGenerationDrainChecks as a, retainSharedClientEntry as c, retireSharedCodexAppServerClientIfCurrent as d, retireSharedCodexAppServerClientsBeforeDesktopGeneration as f, hasActiveSharedCodexAppServerWork as i, retainSharedCodexAppServerClientByInstanceId as l, waitForUnclaimedSharedClientStartup as m, getCurrentSharedClientEntry as n, ownCodexStartup as o, waitForCodexAppServerClientExit as p, getSharedCodexAppServerClientState as r, releaseSharedClientEntry as s, createCodexAppServerStartupLifetime as t, retirePendingSharedClientEntryIfUnclaimed as u };
+export { notifyDesktopGenerationDrainChecks as a, releaseSharedClientEntry as c, retirePendingSharedClientEntryIfUnclaimed as d, retireSharedCodexAppServerClientIfCurrent as f, waitForUnclaimedSharedClientStartup as h, hasActiveSharedCodexAppServerWork as i, retainSharedClientEntry as l, waitForCodexAppServerClientExit as m, getCurrentSharedClientEntry as n, ownCodexStartup as o, retireSharedCodexAppServerClientsBeforeDesktopGeneration as p, getSharedCodexAppServerClientState as r, refreshSharedClientIdleRetirement as s, createCodexAppServerStartupLifetime as t, retainSharedCodexAppServerClientByInstanceId as u };

package/dist/.setup/{side-question-BbnuMFTT.mjs → side-question-BBZJibHK.mjs}

@@ -1,23 +1,23 @@
 import { i as isJsonObject } from "./protocol-CANUwXJ3.mjs";
-import { v as sessionBindingIdentity } from "./session-binding-record-Oe9L-CNY.mjs";
+import { v as sessionBindingIdentity } from "./session-binding-record-CUKpUKVm.mjs";
 import { c as shouldAutoApproveCodexAppServerApprovals, l as withMcpElicitationsApprovalPolicy, m as readCodexRequirementsToml, n as hasCodexMcpToolApprovalOverrides } from "./config-security-CE-FcGw9.mjs";
 import { c as isCodexPairedNodeRemoteExecPlacementSandbox, d as readCodexPluginConfig, l as isCodexRemoteExecPlacementSandbox, u as isCodexSandboxExecServerEnabled } from "./config-parsing-b088LyhT.mjs";
 import { i as resolveCodexAppServerHomeScope, l as resolveCodexModelBackedReviewerPolicyContext } from "./config-options-CzyWLTJt.mjs";
 import { n as formatCodexUsageLimitErrorMessage } from "./rate-limits-B7-X2TgG.mjs";
-import { i as resolveCodexBindingAppServerConnection, r as requireCodexSupervisionModelSelection } from "./binding-connection-DTtN1KrX.mjs";
-import { n as canUseCodexModelBackedApprovalsReviewerForModel, r as resolveOpenClawExecPolicyForCodexAppServer } from "./config-DKhXquav.mjs";
-import { Z as readRecentCodexRateLimits, b as withLeasedCodexAppServerClientStartSelectionRetry, c as getLeasedSharedCodexAppServerClient, m as releaseCodexAppServerClientLease, rt as resolveCodexAppServerPreparedAuthHandoff } from "./shared-client-tOOyadmg.mjs";
-import { A as handleDynamicToolCallWithTimeout, B as resolveCodexToolAbortTerminalReason, P as resolveDynamicToolCallTimeoutMs, S as assertCodexTurnStartResponse, i as isCodexAppServerApprovalRequest, k as createCodexElicitationResponse, s as isCodexAppServerIndeterminateRequestCancellationError, w as readCodexDynamicToolCallParams, y as assertCodexThreadForkResponse, z as toCodexDynamicToolProtocolResponse } from "./client-CyquSiJ2.mjs";
-import { f as terminateCodexBackgroundTerminals, p as unsubscribeCodexThreadBestEffort, s as interruptCodexTurnAndWaitBestEffort, u as retireUnsafeCodexTurnClientBestEffort } from "./attempt-client-cleanup-93r-CLTi.mjs";
-import { t as CodexEphemeralTurn } from "./ephemeral-turn-ksZ9NfsS.mjs";
-import { Ct as refreshCodexPluginAppApprovalPolicy, D as buildCodexNativeHookRelayConfig, M as resolveCodexNativeHookRelayEvents, N as resolveCodexNativeHookRelayTtlMs, O as buildCodexNativeHookRelayDisabledConfig, St as mergeCodexThreadConfigs, ft as resolveCodexDynamicToolsLoading, g as CODEX_NATIVE_PERSONALITY_NONE, p as resolveCodexWebSearchPlan, r as buildCodexRuntimeThreadConfig, y as resolveCodexAppServerThreadModelSelection } from "./thread-requests-DmkmrGIt.mjs";
-import { S as resolveCodexAppServerReasoningEffort, o as buildCodexUserInput, r as buildCodexTemporalAdditionalContext, x as readCodexSupportedReasoningEfforts } from "./thread-lifecycle-DcNw9n7E.mjs";
-import { o as resolveCodexSessionBinding } from "./session-binding-DGCYAfvD.mjs";
-import { a as refreshCodexThreadPolicy, i as assertCodexSupervisionThreadLineage, n as CodexThreadPolicyHandoffError } from "./thread-policy-TTAb-1yF.mjs";
-import { t as resolveCodexNativeExecutionBlock } from "./sandbox-guard-DjCz2eOw.mjs";
-import { E as CodexNativeToolLifecycleProjector, a as emitDynamicToolStartedDiagnostic, b as createCodexNativePreToolUseFailureBuffer, c as buildDynamicTools, f as resolveCodexExternalSandboxPolicyForOpenClawSandbox, g as shouldRequireCodexSandboxExecServerEnvironment, h as shouldEnableCodexAppServerNativeToolSurface, i as emitDynamicToolErrorDiagnostic, m as resolveCodexSandboxEnvironmentSelection, o as emitDynamicToolTerminalDiagnostic, p as resolveCodexMessageToolProvider, r as routeCodexAppServerElicitationRequest, s as handleCodexAppServerApprovalRequest, t as createCodexDynamicToolBridge, v as ensureCodexSandboxExecServerEnvironment, y as releaseCodexSandboxExecServerEnvironment } from "./dynamic-tools-D3NAwGw3.mjs";
-import { a as resolveCodexAppServerForModelProvider, i as resolveCodexSessionPermissionCwd, n as applyCodexSessionPermissionPolicy, r as resolveCodexEffectiveSessionPermissionPolicy, t as CODEX_SESSION_PERMISSION_EXEC_MODES } from "./session-permission-policy-Ci_fVX6y.mjs";
-import { n as resolveCodexProviderWebSearchSupportForClient } from "./provider-capabilities-ByhBukaD.mjs";
+import { i as resolveCodexBindingAppServerConnection, r as requireCodexSupervisionModelSelection } from "./binding-connection-DRPlnIgg.mjs";
+import { n as canUseCodexModelBackedApprovalsReviewerForModel, r as resolveOpenClawExecPolicyForCodexAppServer } from "./config-DqmrqI23.mjs";
+import { Z as readRecentCodexRateLimits, b as withLeasedCodexAppServerClientStartSelectionRetry, c as getLeasedSharedCodexAppServerClient, m as releaseCodexAppServerClientLease, rt as resolveCodexAppServerPreparedAuthHandoff } from "./shared-client-ZXKMsK6f.mjs";
+import { A as handleDynamicToolCallWithTimeout, B as resolveCodexToolAbortTerminalReason, P as resolveDynamicToolCallTimeoutMs, S as assertCodexTurnStartResponse, i as isCodexAppServerApprovalRequest, k as createCodexElicitationResponse, s as isCodexAppServerIndeterminateRequestCancellationError, w as readCodexDynamicToolCallParams, y as assertCodexThreadForkResponse, z as toCodexDynamicToolProtocolResponse } from "./client-DcTISXe3.mjs";
+import { f as terminateCodexBackgroundTerminals, p as unsubscribeCodexThreadBestEffort, s as interruptCodexTurnAndWaitBestEffort, u as retireUnsafeCodexTurnClientBestEffort } from "./attempt-client-cleanup-BVtNsTOE.mjs";
+import { t as CodexEphemeralTurn } from "./ephemeral-turn-Dj3iTfSP.mjs";
+import { Ct as refreshCodexPluginAppApprovalPolicy, D as buildCodexNativeHookRelayConfig, M as resolveCodexNativeHookRelayEvents, N as resolveCodexNativeHookRelayTtlMs, O as buildCodexNativeHookRelayDisabledConfig, St as mergeCodexThreadConfigs, ft as resolveCodexDynamicToolsLoading, g as CODEX_NATIVE_PERSONALITY_NONE, p as resolveCodexWebSearchPlan, r as buildCodexRuntimeThreadConfig, y as resolveCodexAppServerThreadModelSelection } from "./thread-requests-y_MnVuWC.mjs";
+import { S as resolveCodexAppServerReasoningEffort, o as buildCodexUserInput, r as buildCodexTemporalAdditionalContext, x as readCodexSupportedReasoningEfforts } from "./thread-lifecycle-CzzYMvTL.mjs";
+import { o as resolveCodexSessionBinding } from "./session-binding-Fn7Ekzuv.mjs";
+import { a as refreshCodexThreadPolicy, i as assertCodexSupervisionThreadLineage, n as CodexThreadPolicyHandoffError } from "./thread-policy-MM5YD22L.mjs";
+import { t as resolveCodexNativeExecutionBlock } from "./sandbox-guard-OIYEmTRF.mjs";
+import { E as CodexNativeToolLifecycleProjector, a as emitDynamicToolStartedDiagnostic, b as createCodexNativePreToolUseFailureBuffer, c as buildDynamicTools, f as resolveCodexExternalSandboxPolicyForOpenClawSandbox, g as shouldRequireCodexSandboxExecServerEnvironment, h as shouldEnableCodexAppServerNativeToolSurface, i as emitDynamicToolErrorDiagnostic, m as resolveCodexSandboxEnvironmentSelection, o as emitDynamicToolTerminalDiagnostic, p as resolveCodexMessageToolProvider, r as routeCodexAppServerElicitationRequest, s as handleCodexAppServerApprovalRequest, t as createCodexDynamicToolBridge, v as ensureCodexSandboxExecServerEnvironment, y as releaseCodexSandboxExecServerEnvironment } from "./dynamic-tools-Dr0ye5P3.mjs";
+import { a as resolveCodexAppServerForModelProvider, i as resolveCodexSessionPermissionCwd, n as applyCodexSessionPermissionPolicy, r as resolveCodexEffectiveSessionPermissionPolicy, t as CODEX_SESSION_PERMISSION_EXEC_MODES } from "./session-permission-policy-7lM447LW.mjs";
+import { n as resolveCodexProviderWebSearchSupportForClient } from "./provider-capabilities-DBs9l8oL.mjs";
 import { readStringField } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { randomUUID } from "node:crypto";
 import { isDeepStrictEqual } from "node:util";

package/dist/.setup/{source-Cr8STZpF.mjs → source-Iusn97ly.mjs}

@@ -1,8 +1,8 @@
-import { a as marketplaceRef, n as isOpenAiCuratedMarketplace, o as pluginReadParams, u as CODEX_PLUGINS_MARKETPLACE_NAME } from "./plugin-inventory-Cky2XJUw.mjs";
+import { a as marketplaceRef, n as isOpenAiCuratedMarketplace, o as pluginReadParams, u as CODEX_PLUGINS_MARKETPLACE_NAME } from "./plugin-inventory-B4uqIw4J.mjs";
 import { a as defaultCodexAppInventoryCache, r as buildCodexPluginAppCacheKey } from "./plugin-app-cache-key-BL9B5H0L.mjs";
-import { o as withCodexAppServerJsonClient } from "./request-DxKAfWyy.mjs";
-import "./config-DKhXquav.mjs";
-import { t as __exportAll } from "./session-binding-sidecars-jo6H8dFr.mjs";
+import { o as withCodexAppServerJsonClient } from "./request-CWERwKIL.mjs";
+import "./config-DqmrqI23.mjs";
+import { t as __exportAll } from "./session-binding-sidecars-BuEALwJY.mjs";
 import { asNonArrayRecord } from "openclaw/plugin-sdk/string-coerce-runtime";
 import path from "node:path";
 import os from "node:os";

package/dist/.setup/{thread-lifecycle-DcNw9n7E.mjs → thread-lifecycle-CzzYMvTL.mjs}

@@ -1,10 +1,10 @@
 import { i as isJsonObject, r as flattenCodexDynamicToolFunctions } from "./protocol-CANUwXJ3.mjs";
-import { a as matchesPendingSupervisionBranch, n as assertCodexBindingMayBeReplaced, v as sessionBindingIdentity } from "./session-binding-record-Oe9L-CNY.mjs";
+import { a as matchesPendingSupervisionBranch, n as assertCodexBindingMayBeReplaced, v as sessionBindingIdentity } from "./session-binding-record-CUKpUKVm.mjs";
 import { u as stringifyCodexPolicy } from "./config-security-CE-FcGw9.mjs";
 import { n as resolveCodexAppServerLocalHomeDir, t as resolveCodexAppServerHomeDir } from "./auth-start-options-BPIPeEX8.mjs";
 import { d as readCodexEffectiveConfig, n as codexSandboxPolicyForTurn, s as assertCodexModelBackedReviewerEffectiveConfig, u as CODEX_SESSION_OVERRIDABLE_LAYER_TYPES } from "./config-options-CzyWLTJt.mjs";
 import { i as markStartedCodexManagedThread } from "./managed-thread-store-BMqgThVL.mjs";
-import { l as retainSharedCodexAppServerClientByInstanceId, n as getCurrentSharedClientEntry } from "./shared-client-lifecycle-CJ0lYVCW.mjs";
+import { n as getCurrentSharedClientEntry, u as retainSharedCodexAppServerClientByInstanceId } from "./shared-client-lifecycle-BH_y_i8l.mjs";
 import { t as withCodexAppServerThreadMutation } from "./thread-ownership-queue-Dp24d7-F.mjs";
 import { t as isIncognitoSessionKey } from "./incognito-session-C5ve_-63.mjs";
 import { n as CodexAppServerRpcError, r as isCodexThreadReadMissingError } from "./rpc-error-BlD2vuzn.mjs";
@@ -13,20 +13,20 @@ import { r as withAbortableTimeout } from "./timeout-CXOfNoaX.mjs";
 import { t as projectBoundedCodexThreadHistory } from "./transcript-history-projection-DRSifI-1.mjs";
 import { t as buildCodexAppServerConnectionFingerprint } from "./plugin-app-cache-key-BL9B5H0L.mjs";
 import { n as readCodexSessionMeta } from "./session-catalog-provenance-DoAvktcj.mjs";
-import { t as assertCodexSessionRuntimeOwnership } from "./binding-connection-DTtN1KrX.mjs";
-import "./config-DKhXquav.mjs";
+import { t as assertCodexSessionRuntimeOwnership } from "./binding-connection-DRPlnIgg.mjs";
+import "./config-DqmrqI23.mjs";
 import { i as sanitizeInlineImageDataUrl, r as invalidInlineImageText } from "./session-history-read-Ov3StuL4.mjs";
 import { c as resolveCodexContextEngineProjectionMaxChars, o as neutralizeCodexExplicitMentionSigils } from "./context-engine-projection-PezSESth.mjs";
 import { n as normalizeCodexAppServerBindingModelProvider } from "./auth-profile-B0okYl2D.mjs";
-import { $ as createCodexEphemeralThreadPolicy, A as bindCodexInferenceThread, B as isCodexAppServerClientRuntimeLive, C as CodexThreadBindingConflictError, F as consumeCodexAppServerLiveThread, H as isCodexAppServerLiveThreadProtected, K as releaseCodexAppServerLiveThread, M as getCodexInferenceThreadQualification, N as prepareCodexInferenceThreadConfig, S as CodexAdoptedThreadActiveError, T as CodexThreadStartRequestError, V as isCodexAppServerLiveThreadClaimed, Y as unsubscribeCodexAppServerLiveThread, et as wasCodexAppServerThreadClosed, j as getCodexInferenceThread, k as assertCodexInferenceRouteConfig, n as captureCodexAppServerClientLifetime, w as CodexThreadClientReplacementError, z as hasCodexAppServerSiblingThreadWork } from "./shared-client-tOOyadmg.mjs";
-import { C as assertExactSupervisionModelSelection, D as readSupervisionResponseThreadId, O as resolveCodexThreadRolloutPath, d as isCodexAppServerRequestTimeoutError, l as isCodexAppServerOverloadError, p as resolveCodexAppServerClientInstanceId, r as getCodexAppServerClientInstanceId, v as assertCodexThreadAcceptsDirectInput, x as assertCodexThreadStartResponse, y as assertCodexThreadForkResponse } from "./client-CyquSiJ2.mjs";
-import { c as isCodexAppServerUnsafeSubscriptionError, g as hasCodexAppServerSiblingRouteWork, n as CODEX_APP_SERVER_UNSUBSCRIBE_TIMEOUT_MS, o as closeCodexStartupClientBestEffort, p as unsubscribeCodexThreadBestEffort, r as CodexAppServerUnsafeSubscriptionError, u as retireUnsafeCodexTurnClientBestEffort } from "./attempt-client-cleanup-93r-CLTi.mjs";
-import { $ as readActiveCodexTurnIdsFromResume, B as loadCodexNativeToolCatalog, C as mergeCodexNativeProjectDocThreadConfig, E as assertCodexNativeHookRelayAllowed, F as attestCodexThreadToolSurface, G as areUserMcpServersFingerprintsCompatible, H as applyCodexNativeSkillIsolation, I as checkCodexThreadAppAvailability, J as fingerprintCodexThreadConfig, K as codexDynamicToolsFingerprint, L as discardUnattestedCodexPluginThread, Q as legacyFingerprintUserMcpServersConfigPatch, R as attestCodexRestrictedToolSurfaceMcpServersDisabled, St as mergeCodexThreadConfigs, T as CodexManagedHooksOnlyError, Tt as buildCodexAppApprovalOverrides, U as resolveCodexNativeSkillIsolation, W as areCodexDynamicToolFingerprintsCompatible, X as fingerprintJsonObject, Y as fingerprintEnvironmentSelection, Z as fingerprintUserMcpServersConfigPatch, _ as resolveCodexAppServerModelProvider, at as shouldRotateCodexGpt56MultiAgentBinding, bt as disableUnlistedCodexApps, c as codexThreadSandboxOrPermissions, d as resolveCodexThreadApprovalsReviewer, et as shouldStartTransientNoToolThread, g as CODEX_NATIVE_PERSONALITY_NONE, h as buildDeveloperInstructions, i as buildCodexRuntimeThreadConfigForRun, it as shouldRotateCodexAppServerBindingForRuntime, l as readCodexInheritedMcpServerNames, lt as isMessageOnlyCodexSourceReply, m as mergeCodexNativeShellEnvironment, mt as buildCodexPluginAppsConfigPatchFromPolicyContext, n as buildCodexRingZeroThreadConfigPatch, nt as isTransientWebSearchRestriction, o as buildThreadResumeParams, p as resolveCodexWebSearchPlan, q as codexLegacyDynamicToolsFingerprint, rt as shouldRecheckRecoverablePluginBinding, s as buildThreadStartParams, t as assertCodexManagedRequirementsDoNotOverrideToolPolicy, u as readCodexManagedRequirementsFingerprint, ut as isSystemAgentOnlyCodexDynamicToolAllowlist, v as resolveCodexAppServerRequestModelSelection, x as joinPresentSections, xt as isCodexPluginThreadBindingStale, y as resolveCodexAppServerThreadModelSelection, yt as buildPluginAppPolicyContext, z as hasCodexNativeToolCatalog } from "./thread-requests-DmkmrGIt.mjs";
-import { o as resolveCodexSessionBinding, r as hashCodexAppServerBindingFingerprint } from "./session-binding-DGCYAfvD.mjs";
-import { a as refreshCodexThreadPolicy, i as assertCodexSupervisionThreadLineage, n as CodexThreadPolicyHandoffError, o as refreshCodexThreadSkillsCatalog, r as assertAdoptedCodexThreadResumeAllowed, t as CodexIncognitoPolicyChangeError } from "./thread-policy-TTAb-1yF.mjs";
-import { t as resumeCodexAppServerThread } from "./thread-resume-eo3IhOhh.mjs";
-import { c as withExclusiveCodexAppServerThread, r as retainCodexAppServerBindingSubscription, t as isSameCodexAppServerThreadOwner } from "./thread-ownership-DDban_4i.mjs";
-import "./transcript-mirror-kxmCYsuF.mjs";
+import { $ as createCodexEphemeralThreadPolicy, A as bindCodexInferenceThread, B as isCodexAppServerClientRuntimeLive, C as CodexThreadBindingConflictError, F as consumeCodexAppServerLiveThread, H as isCodexAppServerLiveThreadProtected, K as releaseCodexAppServerLiveThread, M as getCodexInferenceThreadQualification, N as prepareCodexInferenceThreadConfig, S as CodexAdoptedThreadActiveError, T as CodexThreadStartRequestError, V as isCodexAppServerLiveThreadClaimed, Y as unsubscribeCodexAppServerLiveThread, et as wasCodexAppServerThreadClosed, j as getCodexInferenceThread, k as assertCodexInferenceRouteConfig, n as captureCodexAppServerClientLifetime, w as CodexThreadClientReplacementError, z as hasCodexAppServerSiblingThreadWork } from "./shared-client-ZXKMsK6f.mjs";
+import { C as assertExactSupervisionModelSelection, D as readSupervisionResponseThreadId, O as resolveCodexThreadRolloutPath, d as isCodexAppServerRequestTimeoutError, l as isCodexAppServerOverloadError, p as resolveCodexAppServerClientInstanceId, r as getCodexAppServerClientInstanceId, v as assertCodexThreadAcceptsDirectInput, x as assertCodexThreadStartResponse, y as assertCodexThreadForkResponse } from "./client-DcTISXe3.mjs";
+import { c as isCodexAppServerUnsafeSubscriptionError, g as hasCodexAppServerSiblingRouteWork, n as CODEX_APP_SERVER_UNSUBSCRIBE_TIMEOUT_MS, o as closeCodexStartupClientBestEffort, p as unsubscribeCodexThreadBestEffort, r as CodexAppServerUnsafeSubscriptionError, u as retireUnsafeCodexTurnClientBestEffort } from "./attempt-client-cleanup-BVtNsTOE.mjs";
+import { $ as readActiveCodexTurnIdsFromResume, B as loadCodexNativeToolCatalog, C as mergeCodexNativeProjectDocThreadConfig, E as assertCodexNativeHookRelayAllowed, F as attestCodexThreadToolSurface, G as areUserMcpServersFingerprintsCompatible, H as applyCodexNativeSkillIsolation, I as checkCodexThreadAppAvailability, J as fingerprintCodexThreadConfig, K as codexDynamicToolsFingerprint, L as discardUnattestedCodexPluginThread, Q as legacyFingerprintUserMcpServersConfigPatch, R as attestCodexRestrictedToolSurfaceMcpServersDisabled, St as mergeCodexThreadConfigs, T as CodexManagedHooksOnlyError, Tt as buildCodexAppApprovalOverrides, U as resolveCodexNativeSkillIsolation, W as areCodexDynamicToolFingerprintsCompatible, X as fingerprintJsonObject, Y as fingerprintEnvironmentSelection, Z as fingerprintUserMcpServersConfigPatch, _ as resolveCodexAppServerModelProvider, at as shouldRotateCodexGpt56MultiAgentBinding, bt as disableUnlistedCodexApps, c as codexThreadSandboxOrPermissions, d as resolveCodexThreadApprovalsReviewer, et as shouldStartTransientNoToolThread, g as CODEX_NATIVE_PERSONALITY_NONE, h as buildDeveloperInstructions, i as buildCodexRuntimeThreadConfigForRun, it as shouldRotateCodexAppServerBindingForRuntime, l as readCodexInheritedMcpServerNames, lt as isMessageOnlyCodexSourceReply, m as mergeCodexNativeShellEnvironment, mt as buildCodexPluginAppsConfigPatchFromPolicyContext, n as buildCodexRingZeroThreadConfigPatch, nt as isTransientWebSearchRestriction, o as buildThreadResumeParams, p as resolveCodexWebSearchPlan, q as codexLegacyDynamicToolsFingerprint, rt as shouldRecheckRecoverablePluginBinding, s as buildThreadStartParams, t as assertCodexManagedRequirementsDoNotOverrideToolPolicy, u as readCodexManagedRequirementsFingerprint, ut as isSystemAgentOnlyCodexDynamicToolAllowlist, v as resolveCodexAppServerRequestModelSelection, x as joinPresentSections, xt as isCodexPluginThreadBindingStale, y as resolveCodexAppServerThreadModelSelection, yt as buildPluginAppPolicyContext, z as hasCodexNativeToolCatalog } from "./thread-requests-y_MnVuWC.mjs";
+import { o as resolveCodexSessionBinding, r as hashCodexAppServerBindingFingerprint } from "./session-binding-Fn7Ekzuv.mjs";
+import { a as refreshCodexThreadPolicy, i as assertCodexSupervisionThreadLineage, n as CodexThreadPolicyHandoffError, o as refreshCodexThreadSkillsCatalog, r as assertAdoptedCodexThreadResumeAllowed, t as CodexIncognitoPolicyChangeError } from "./thread-policy-MM5YD22L.mjs";
+import { t as resumeCodexAppServerThread } from "./thread-resume-B9clyqXE.mjs";
+import { c as withExclusiveCodexAppServerThread, r as retainCodexAppServerBindingSubscription, t as isSameCodexAppServerThreadOwner } from "./thread-ownership-BT_SeSUp.mjs";
+import "./transcript-mirror-BRNhyb1o.mjs";
 import { asOptionalRecord, normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
 import crypto from "node:crypto";
 import { isDeepStrictEqual } from "node:util";

package/dist/.setup/{thread-ownership-DDban_4i.mjs → thread-ownership-BT_SeSUp.mjs}

@@ -1,8 +1,8 @@
-import { l as retainSharedCodexAppServerClientByInstanceId } from "./shared-client-lifecycle-CJ0lYVCW.mjs";
+import { u as retainSharedCodexAppServerClientByInstanceId } from "./shared-client-lifecycle-BH_y_i8l.mjs";
 import { t as withCodexAppServerThreadMutation } from "./thread-ownership-queue-Dp24d7-F.mjs";
-import { K as releaseCodexAppServerLiveThread, V as isCodexAppServerLiveThreadClaimed, q as retainCodexAppServerLiveThread } from "./shared-client-tOOyadmg.mjs";
-import { o as closeCodexStartupClientBestEffort, p as unsubscribeCodexThreadBestEffort, r as CodexAppServerUnsafeSubscriptionError } from "./attempt-client-cleanup-93r-CLTi.mjs";
-import { t as __exportAll } from "./session-binding-sidecars-jo6H8dFr.mjs";
+import { K as releaseCodexAppServerLiveThread, V as isCodexAppServerLiveThreadClaimed, q as retainCodexAppServerLiveThread } from "./shared-client-ZXKMsK6f.mjs";
+import { o as closeCodexStartupClientBestEffort, p as unsubscribeCodexThreadBestEffort, r as CodexAppServerUnsafeSubscriptionError } from "./attempt-client-cleanup-BVtNsTOE.mjs";
+import { t as __exportAll } from "./session-binding-sidecars-BuEALwJY.mjs";
 import { createDeferred } from "openclaw/plugin-sdk/extension-shared";
 import { runWithAsyncWorkResources } from "openclaw/plugin-sdk/agent-harness-tool-runtime";
 //#region extensions/codex/src/app-server/thread-ownership.ts

package/dist/.setup/{thread-policy-TTAb-1yF.mjs → thread-policy-MM5YD22L.mjs}

@@ -1,6 +1,6 @@
-import { r as requestCodexAppServerClientJson, t as CodexAppServerScopedRequestRejectedError } from "./request-DxKAfWyy.mjs";
-import { S as CodexAdoptedThreadActiveError } from "./shared-client-tOOyadmg.mjs";
-import { l as isCodexAppServerOverloadError, u as isCodexAppServerPrewriteRequestCancellationError, v as assertCodexThreadAcceptsDirectInput } from "./client-CyquSiJ2.mjs";
+import { r as requestCodexAppServerClientJson, t as CodexAppServerScopedRequestRejectedError } from "./request-CWERwKIL.mjs";
+import { S as CodexAdoptedThreadActiveError } from "./shared-client-ZXKMsK6f.mjs";
+import { l as isCodexAppServerOverloadError, u as isCodexAppServerPrewriteRequestCancellationError, v as assertCodexThreadAcceptsDirectInput } from "./client-DcTISXe3.mjs";
 import { AgentHarnessPreflightError, embeddedAgentLog, formatErrorMessage } from "openclaw/plugin-sdk/agent-harness-runtime";
 //#region extensions/codex/src/app-server/thread-policy.ts
 /** A refusal, not a failed native write: the ephemeral conversation must stay alive. */