@openclaw/codex 2026.9.34 → 2026.9.36

package/dist/.setup/{config-DKhXquav.mjs → config-DqmrqI23.mjs}

@@ -3,8 +3,8 @@ import "./config-security-CE-FcGw9.mjs";
 import "./config-parsing-b088LyhT.mjs";
 import "./auth-start-options-BPIPeEX8.mjs";
 import { c as canUseCodexModelBackedApprovalsReviewerForModel$1 } from "./config-options-CzyWLTJt.mjs";
-import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-C0NbLms1.mjs";
-import { t as __exportAll } from "./session-binding-sidecars-jo6H8dFr.mjs";
+import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-DDhvIeUC.mjs";
+import { t as __exportAll } from "./session-binding-sidecars-BuEALwJY.mjs";
 import { resolveAgentConfig } from "openclaw/plugin-sdk/agent-scope-runtime";
 import { execPolicy } from "openclaw/plugin-sdk/agent-harness-runtime";
 import { resolveExecApprovalsFromFile } from "openclaw/plugin-sdk/exec-approvals-runtime";

package/dist/.setup/{config-runtime-C0NbLms1.mjs → config-runtime-DDhvIeUC.mjs}

@@ -1,5 +1,5 @@
 import { r as createCodexAppServerConfig } from "./config-options-CzyWLTJt.mjs";
-import { t as __exportAll } from "./session-binding-sidecars-jo6H8dFr.mjs";
+import { t as __exportAll } from "./session-binding-sidecars-BuEALwJY.mjs";
 import { resolveProviderIdForAuth } from "openclaw/plugin-sdk/provider-auth-aliases";
 //#region extensions/codex/src/app-server/config-runtime.ts
 var config_runtime_exports = /* @__PURE__ */ __exportAll({

package/dist/.setup/{conversation-binding-C-0jWdSo.mjs → conversation-binding-CfIcWNVS.mjs}

@@ -1,24 +1,24 @@
+import { h as CodexThreadDirectInputError, l as isCodexAppServerOverloadError, s as isCodexAppServerIndeterminateRequestCancellationError, v as assertCodexThreadAcceptsDirectInput, x as assertCodexThreadStartResponse } from "./client-BdNoDUaQ.mjs";
 import { i as isJsonObject } from "./protocol-CANUwXJ3.mjs";
-import { n as assertCodexBindingMayBeReplaced, v as sessionBindingIdentity } from "./session-binding-record-Oe9L-CNY.mjs";
+import { n as assertCodexBindingMayBeReplaced, v as sessionBindingIdentity } from "./session-binding-record-CUKpUKVm.mjs";
 import { m as readCodexRequirementsToml } from "./config-security-CE-FcGw9.mjs";
 import { d as readCodexPluginConfig } from "./config-parsing-b088LyhT.mjs";
 import { d as readCodexEffectiveConfig, n as codexSandboxPolicyForTurn } from "./config-options-CzyWLTJt.mjs";
-import { l as retainSharedCodexAppServerClientByInstanceId } from "./shared-client-lifecycle-CJ0lYVCW.mjs";
-import { o as resolveCodexDefaultWorkspaceDir } from "./conversation-binding-data-C746z5Pn.mjs";
+import { u as retainSharedCodexAppServerClientByInstanceId } from "./shared-client-lifecycle-wN_lOZkB.mjs";
+import { o as resolveCodexDefaultWorkspaceDir } from "./conversation-binding-data-DlsG-dQu.mjs";
 import { n as projectBoundedCodexVisibleSessionHistory } from "./transcript-history-projection-DRSifI-1.mjs";
-import { n as canUseCodexModelBackedApprovalsReviewerForModel, r as resolveOpenClawExecPolicyForCodexAppServer } from "./config-DKhXquav.mjs";
-import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-C0NbLms1.mjs";
+import { n as canUseCodexModelBackedApprovalsReviewerForModel, r as resolveOpenClawExecPolicyForCodexAppServer } from "./config-DqmrqI23.mjs";
+import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-DDhvIeUC.mjs";
 import { n as normalizeCodexAppServerBindingModelProvider, t as isCodexAppServerNativeAuthProfile } from "./auth-profile-B0okYl2D.mjs";
-import { B as isCodexAppServerClientRuntimeLive, F as consumeCodexAppServerLiveThread, K as releaseCodexAppServerLiveThread, R as hasCodexAppServerLiveThread, V as isCodexAppServerLiveThreadClaimed, b as withLeasedCodexAppServerClientStartSelectionRetry, c as getLeasedSharedCodexAppServerClient, m as releaseCodexAppServerClientLease } from "./shared-client-tOOyadmg.mjs";
-import { h as CodexThreadDirectInputError, l as isCodexAppServerOverloadError, s as isCodexAppServerIndeterminateRequestCancellationError, v as assertCodexThreadAcceptsDirectInput, x as assertCodexThreadStartResponse } from "./client-CyquSiJ2.mjs";
-import { c as isCodexAppServerUnsafeSubscriptionError, h as getCodexAppServerTurnRouter, o as closeCodexStartupClientBestEffort, p as unsubscribeCodexThreadBestEffort, s as interruptCodexTurnAndWaitBestEffort, u as retireUnsafeCodexTurnClientBestEffort, v as isCodexNotificationForTurn } from "./attempt-client-cleanup-93r-CLTi.mjs";
-import { S as buildCodexProjectDocThreadConfig, St as mergeCodexThreadConfigs, g as CODEX_NATIVE_PERSONALITY_NONE, v as resolveCodexAppServerRequestModelSelection, vt as buildDisabledAppsConfigPatch } from "./thread-requests-DmkmrGIt.mjs";
-import "./thread-lifecycle-DcNw9n7E.mjs";
-import "./session-binding-DGCYAfvD.mjs";
-import { t as resumeCodexAppServerThread } from "./thread-resume-eo3IhOhh.mjs";
-import { a as rollbackCodexAppServerBindingSubscription, c as withExclusiveCodexAppServerThread, n as releaseCodexAppServerBindingSubscription, r as retainCodexAppServerBindingSubscription, t as isSameCodexAppServerThreadOwner } from "./thread-ownership-DDban_4i.mjs";
-import { a as resolveCodexAppServerForModelProvider, i as resolveCodexSessionPermissionCwd, n as applyCodexSessionPermissionPolicy, t as CODEX_SESSION_PERMISSION_EXEC_MODES } from "./session-permission-policy-Ci_fVX6y.mjs";
-import { u as trackCodexConversationActiveTurn } from "./conversation-control-BEotI-gH.mjs";
+import { B as isCodexAppServerClientRuntimeLive, F as consumeCodexAppServerLiveThread, K as releaseCodexAppServerLiveThread, R as hasCodexAppServerLiveThread, V as isCodexAppServerLiveThreadClaimed, b as withLeasedCodexAppServerClientStartSelectionRetry, c as getLeasedSharedCodexAppServerClient, m as releaseCodexAppServerClientLease } from "./shared-client-B__jQti1.mjs";
+import { c as isCodexAppServerUnsafeSubscriptionError, h as getCodexAppServerTurnRouter, o as closeCodexStartupClientBestEffort, p as unsubscribeCodexThreadBestEffort, s as interruptCodexTurnAndWaitBestEffort, u as retireUnsafeCodexTurnClientBestEffort, v as isCodexNotificationForTurn } from "./attempt-client-cleanup-C9dwStbK.mjs";
+import { S as buildCodexProjectDocThreadConfig, St as mergeCodexThreadConfigs, g as CODEX_NATIVE_PERSONALITY_NONE, v as resolveCodexAppServerRequestModelSelection, vt as buildDisabledAppsConfigPatch } from "./thread-requests-D-GTNAnZ.mjs";
+import "./thread-lifecycle-Cw5Nsciw.mjs";
+import "./session-binding-Fn7Ekzuv.mjs";
+import { t as resumeCodexAppServerThread } from "./thread-resume-BNdEFZpM.mjs";
+import { a as rollbackCodexAppServerBindingSubscription, c as withExclusiveCodexAppServerThread, n as releaseCodexAppServerBindingSubscription, r as retainCodexAppServerBindingSubscription, t as isSameCodexAppServerThreadOwner } from "./thread-ownership-Cxb01Uwq.mjs";
+import { a as resolveCodexAppServerForModelProvider, i as resolveCodexSessionPermissionCwd, n as applyCodexSessionPermissionPolicy, t as CODEX_SESSION_PERMISSION_EXEC_MODES } from "./session-permission-policy-7lM447LW.mjs";
+import { u as trackCodexConversationActiveTurn } from "./conversation-control-BWzVNh-v.mjs";
 import { asOptionalRecord, normalizeOptionalString, readNonEmptyStringPreservingWhitespace } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { resolveSessionAgentIdsStrict } from "openclaw/plugin-sdk/agent-scope-runtime";
 import { resolveTimerTimeoutMs } from "openclaw/plugin-sdk/number-runtime";

package/dist/.setup/{conversation-binding-data-C746z5Pn.mjs → conversation-binding-data-DlsG-dQu.mjs}

@@ -1,4 +1,4 @@
-import { t as __exportAll } from "./session-binding-sidecars-jo6H8dFr.mjs";
+import { t as __exportAll } from "./session-binding-sidecars-BuEALwJY.mjs";
 import { asOptionalRecord, normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { createHash, randomUUID } from "node:crypto";
 import process from "node:process";

package/dist/.setup/{conversation-control-BEotI-gH.mjs → conversation-control-BWzVNh-v.mjs}

@@ -1,11 +1,11 @@
 import { n as isCodexFastServiceTier } from "./config-utils-D0CXecki.mjs";
-import { r as bindingStoreKey } from "./session-binding-record-Oe9L-CNY.mjs";
+import { r as bindingStoreKey } from "./session-binding-record-CUKpUKVm.mjs";
 import { o as formatCodexDisplayText } from "./command-formatters-R3ckE3Co.mjs";
-import "./config-DKhXquav.mjs";
+import "./config-DqmrqI23.mjs";
 import { n as normalizeCodexAppServerBindingModelProvider, t as isCodexAppServerNativeAuthProfile } from "./auth-profile-B0okYl2D.mjs";
-import { b as resolveCodexBindingModelProviderFallback, v as resolveCodexAppServerRequestModelSelection } from "./thread-requests-DmkmrGIt.mjs";
-import "./thread-lifecycle-DcNw9n7E.mjs";
-import "./session-binding-DGCYAfvD.mjs";
+import { b as resolveCodexBindingModelProviderFallback, v as resolveCodexAppServerRequestModelSelection } from "./thread-requests-D-GTNAnZ.mjs";
+import "./thread-lifecycle-Cw5Nsciw.mjs";
+import "./session-binding-Fn7Ekzuv.mjs";
 import { resolveAgentDir } from "openclaw/plugin-sdk/agent-runtime";
 import { getSessionEntry, patchSessionEntry, resolveStorePath } from "openclaw/plugin-sdk/session-store-runtime";
 import { ModelSelectionLockedError, applyModelOverrideWithAuthProfileCompatibility } from "openclaw/plugin-sdk/model-session-runtime";

package/dist/.setup/{dynamic-tools-D3NAwGw3.mjs → dynamic-tools-CAWsGyFZ.mjs}

@@ -1,19 +1,19 @@
 import { CODEX_NATIVE_TOOL_REQUIREMENTS } from "../native-tool-policy.js";
+import { B as resolveCodexToolAbortTerminalReason, E as readCodexTurnCompletedNotification, H as failedToolResult, V as createFailedDynamicToolResponse, k as createCodexElicitationResponse, m as CodexServerRequestResolvedError } from "./client-BdNoDUaQ.mjs";
 import { i as isJsonObject, r as flattenCodexDynamicToolFunctions, t as CODEX_OPENCLAW_DIRECT_DYNAMIC_TOOL_NAMESPACE } from "./protocol-CANUwXJ3.mjs";
 import { d as readCodexPluginConfig, l as isCodexRemoteExecPlacementSandbox } from "./config-parsing-b088LyhT.mjs";
 import { o as formatCodexDisplayText } from "./command-formatters-R3ckE3Co.mjs";
 import { s as readItem } from "./event-projector-values-DJSz8BTk.mjs";
 import { s as codexAppIdentityKey } from "./plugin-app-cache-key-BL9B5H0L.mjs";
-import "./config-DKhXquav.mjs";
+import "./config-DqmrqI23.mjs";
 import { i as sanitizeInlineImageDataUrl, r as invalidInlineImageText } from "./session-history-read-Ov3StuL4.mjs";
-import { W as protectCodexAppServerLiveThread, _ as retainSharedCodexAppServerClientIfCurrent } from "./shared-client-tOOyadmg.mjs";
+import { W as protectCodexAppServerLiveThread, _ as retainSharedCodexAppServerClientIfCurrent } from "./shared-client-B__jQti1.mjs";
 import { a as isCodexResponsesOAuthRun } from "./responses-oauth-twnuTaAa.mjs";
-import { B as resolveCodexToolAbortTerminalReason, E as readCodexTurnCompletedNotification, H as failedToolResult, V as createFailedDynamicToolResponse, k as createCodexElicitationResponse, m as CodexServerRequestResolvedError } from "./client-CyquSiJ2.mjs";
-import { A as itemStatus, C as auditNativeToolUnfinishedStatus, N as shouldClearTerminalPresentationForNativeItem, S as auditNativeToolTerminalStatus, b as readCodexNotificationTurnId, k as itemName, v as isCodexNotificationForTurn, x as auditNativeToolName, y as readCodexNotificationThreadId } from "./attempt-client-cleanup-93r-CLTi.mjs";
-import { ct as isForcedPrivateQaCodexRuntime, dt as normalizeCodexDynamicToolName, j as emitCodexNativePreToolUseFailureDiagnostic, ot as filterCodexDynamicTools, p as resolveCodexWebSearchPlan, st as filterCodexDynamicToolsForDisabledNativeSurface, ut as isSystemAgentOnlyCodexDynamicToolAllowlist } from "./thread-requests-DmkmrGIt.mjs";
-import { _ as waitForPluginApprovalDecision, d as mapExecDecisionToOutcome, f as requestPluginApproval, g as truncateCodexApprovalDisplayText, h as stripDanglingCodexApprovalTerminalSequence, l as approvalRequestExplicitlyUnavailable, m as sanitizeCodexApprovalVisibleText, p as requestPluginApprovalOutcome, u as codexApprovalTimeoutText } from "./native-subagent-monitor-B9aAqfnU.mjs";
+import { A as itemStatus, C as auditNativeToolUnfinishedStatus, N as shouldClearTerminalPresentationForNativeItem, S as auditNativeToolTerminalStatus, b as readCodexNotificationTurnId, k as itemName, v as isCodexNotificationForTurn, x as auditNativeToolName, y as readCodexNotificationThreadId } from "./attempt-client-cleanup-C9dwStbK.mjs";
+import { ct as isForcedPrivateQaCodexRuntime, dt as normalizeCodexDynamicToolName, j as emitCodexNativePreToolUseFailureDiagnostic, ot as filterCodexDynamicTools, p as resolveCodexWebSearchPlan, st as filterCodexDynamicToolsForDisabledNativeSurface, ut as isSystemAgentOnlyCodexDynamicToolAllowlist } from "./thread-requests-D-GTNAnZ.mjs";
+import { _ as waitForPluginApprovalDecision, d as mapExecDecisionToOutcome, f as requestPluginApproval, g as truncateCodexApprovalDisplayText, h as stripDanglingCodexApprovalTerminalSequence, l as approvalRequestExplicitlyUnavailable, m as sanitizeCodexApprovalVisibleText, p as requestPluginApprovalOutcome, u as codexApprovalTimeoutText } from "./native-subagent-monitor-GOGINNw0.mjs";
 import { n as resolveCodexNativeExecutionPolicy, r as resolveCodexNodeExecToolOverrides } from "./native-execution-policy-BxZJy5mP.mjs";
-import { a as CODEX_NODE_EXEC_DYNAMIC_TOOL_NAME, c as createNodeExecAliasDynamicTool, d as isCodexDynamicToolExcluded, i as CODEX_GATEWAY_PROCESS_DYNAMIC_TOOL_NAME, l as createSandboxExecProjection, o as createGatewayExecProjection, r as CODEX_GATEWAY_EXEC_DYNAMIC_TOOL_NAME, s as createGatewayProcessProjection, u as createSandboxProcessProjection } from "./provider-capabilities-ByhBukaD.mjs";
+import { a as CODEX_NODE_EXEC_DYNAMIC_TOOL_NAME, c as createNodeExecAliasDynamicTool, d as isCodexDynamicToolExcluded, i as CODEX_GATEWAY_PROCESS_DYNAMIC_TOOL_NAME, l as createSandboxExecProjection, o as createGatewayExecProjection, r as CODEX_GATEWAY_EXEC_DYNAMIC_TOOL_NAME, s as createGatewayProcessProjection, u as createSandboxProcessProjection } from "./provider-capabilities-DcF-V_3D.mjs";
 import { createRequire } from "node:module";
 import { asNonArrayRecord, asOptionalRecord, isRecord, normalizeTrimmedStringList, readNonBlankString, readStringField } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { createHash, randomUUID } from "node:crypto";

package/dist/.setup/{effective-mcp-catalog-C0DfQNYU.mjs → effective-mcp-catalog-BYzIV1DD.mjs}

@@ -1,7 +1,7 @@
-import { v as sessionBindingIdentity } from "./session-binding-record-Oe9L-CNY.mjs";
-import { l as retainSharedCodexAppServerClientByInstanceId } from "./shared-client-lifecycle-CJ0lYVCW.mjs";
-import "./shared-client-tOOyadmg.mjs";
-import "./session-binding-DGCYAfvD.mjs";
+import { v as sessionBindingIdentity } from "./session-binding-record-CUKpUKVm.mjs";
+import { u as retainSharedCodexAppServerClientByInstanceId } from "./shared-client-lifecycle-wN_lOZkB.mjs";
+import "./shared-client-B__jQti1.mjs";
+import "./session-binding-Fn7Ekzuv.mjs";
 import { asOptionalRecord, normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { assignMcpCatalogSafeServerNames } from "openclaw/plugin-sdk/agent-harness-runtime";
 //#region extensions/codex/src/app-server/effective-mcp-catalog.ts

package/dist/.setup/{ephemeral-turn-ksZ9NfsS.mjs → ephemeral-turn-CIcaAzR4.mjs}

@@ -1,6 +1,6 @@
+import { E as readCodexTurnCompletedNotification } from "./client-BdNoDUaQ.mjs";
 import { i as isJsonObject } from "./protocol-CANUwXJ3.mjs";
-import { E as readCodexTurnCompletedNotification } from "./client-CyquSiJ2.mjs";
-import { h as getCodexAppServerTurnRouter } from "./attempt-client-cleanup-93r-CLTi.mjs";
+import { h as getCodexAppServerTurnRouter } from "./attempt-client-cleanup-C9dwStbK.mjs";
 import { o as isTerminalTurnStatus, s as readCodexNotificationItem, t as CodexUsageProjection } from "./event-projector-usage-03R0I2dM.mjs";
 import { readStringField } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { toStringifiedError } from "openclaw/plugin-sdk/error-runtime";

package/dist/.setup/{event-projector-assistant-message-BmWQXFLV.mjs → event-projector-assistant-message-CDe3ohIy.mjs}

@@ -1,5 +1,5 @@
 import { t as codexProviderRefusalDiagnostics } from "./event-projector-values-DJSz8BTk.mjs";
-import { o as resolveCodexLocalRuntimeAttribution } from "./native-subagent-monitor-B9aAqfnU.mjs";
+import { o as resolveCodexLocalRuntimeAttribution } from "./native-subagent-monitor-GOGINNw0.mjs";
 import { createAgentHarnessAssistantMessage } from "openclaw/plugin-sdk/agent-harness-attempt-runtime";
 //#region extensions/codex/src/app-server/event-projector-assistant-message.ts
 function createAssistantMessage(params, text, options) {

package/dist/.setup/{isolated-completion-Ci27cKqA.mjs → isolated-completion-DLV0kBu2.mjs}

@@ -1,11 +1,11 @@
+import { _ as assertCodexPassiveTurnItems } from "./client-BdNoDUaQ.mjs";
 import { d as readCodexPluginConfig } from "./config-parsing-b088LyhT.mjs";
 import { i as resolveCodexAppServerHomeScope } from "./config-options-CzyWLTJt.mjs";
-import "./config-DKhXquav.mjs";
-import { rt as resolveCodexAppServerPreparedAuthHandoff } from "./shared-client-tOOyadmg.mjs";
-import { _ as assertCodexPassiveTurnItems } from "./client-CyquSiJ2.mjs";
-import { runBoundedCodexAppServerTurn } from "./bounded-turn-I8Vb-qq3.mjs";
-import { t as resolveCodexBoundedTurnIsolation } from "./bounded-turn-isolation-B8K_ylqk.mjs";
-import { a as createAttributedCodexAssistantMessage } from "./event-projector-assistant-message-BmWQXFLV.mjs";
+import "./config-DqmrqI23.mjs";
+import { rt as resolveCodexAppServerPreparedAuthHandoff } from "./shared-client-B__jQti1.mjs";
+import { runBoundedCodexAppServerTurn } from "./bounded-turn-Csc9Qvpm.mjs";
+import { t as resolveCodexBoundedTurnIsolation } from "./bounded-turn-isolation-Ce-oOk-D.mjs";
+import { a as createAttributedCodexAssistantMessage } from "./event-projector-assistant-message-CDe3ohIy.mjs";
 //#region extensions/codex/src/app-server/isolated-completion.ts
 /** Runs prompt-only Codex inference on an ephemeral, ring-zero native thread. */
 async function runCodexIsolatedCompletion(params, options) {

package/dist/.setup/{managed-binary-B6hQ1UKR.mjs → managed-binary-Ckgvm_4V.mjs}

@@ -1,4 +1,4 @@
-import { t as __exportAll } from "./session-binding-sidecars-jo6H8dFr.mjs";
+import { t as __exportAll } from "./session-binding-sidecars-BuEALwJY.mjs";
 import { createRequire } from "node:module";
 import { constants, existsSync, realpathSync } from "node:fs";
 import path from "node:path";

package/dist/.setup/{model-catalog-qzAfnHzR.mjs → model-catalog-CbhJ0pMa.mjs}

@@ -1,15 +1,15 @@
 import { t as buildCodexRuntimeModelParams } from "./model-runtime-BdqzOMkU.mjs";
+import { s as isCodexAppServerIndeterminateRequestCancellationError } from "./client-BdNoDUaQ.mjs";
 import { d as readCodexPluginConfig } from "./config-parsing-b088LyhT.mjs";
 import { n as isCodexAppServerProxyLaunch } from "./launch-args-DbFCehO7.mjs";
-import { d as retireSharedCodexAppServerClientIfCurrent } from "./shared-client-lifecycle-CJ0lYVCW.mjs";
-import { o as withCodexAppServerJsonClient } from "./request-DxKAfWyy.mjs";
-import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-C0NbLms1.mjs";
+import { f as retireSharedCodexAppServerClientIfCurrent } from "./shared-client-lifecycle-wN_lOZkB.mjs";
+import { o as withCodexAppServerJsonClient } from "./request-DZKa6YSy.mjs";
+import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-DDhvIeUC.mjs";
 import { a as resolveCodexAppServerAuthProfileStore, r as resolveCodexAppServerAuthProfileId } from "./auth-profile-B0okYl2D.mjs";
-import { r as captureSharedCodexAppServerCatalogLifetime } from "./shared-client-tOOyadmg.mjs";
+import { r as captureSharedCodexAppServerCatalogLifetime } from "./shared-client-B__jQti1.mjs";
 import { i as isCodexResponsesOAuthCredential } from "./responses-oauth-twnuTaAa.mjs";
-import { s as isCodexAppServerIndeterminateRequestCancellationError } from "./client-CyquSiJ2.mjs";
-import { n as listAllCodexAppServerModels } from "./models-BbEE4EWS.mjs";
-import { probeCodexNativeAuth } from "./native-auth-BN-BD2AV.mjs";
+import { n as listAllCodexAppServerModels } from "./models-DXVC1KpU.mjs";
+import { probeCodexNativeAuth } from "./native-auth-BNGz77PF.mjs";
 //#region extensions/codex/src/app-server/model-catalog.ts
 const INPUT_TYPES = /* @__PURE__ */ new Set([
 	"text",

package/dist/.setup/{models-BbEE4EWS.mjs → models-DXVC1KpU.mjs}

@@ -1,4 +1,4 @@
-import { g as assertCodexModelListResponse } from "./client-CyquSiJ2.mjs";
+import { g as assertCodexModelListResponse } from "./client-BdNoDUaQ.mjs";
 import { normalizeOptionalString, normalizeUniqueTrimmedStringList } from "openclaw/plugin-sdk/string-coerce-runtime";
 //#region extensions/codex/src/app-server/models.ts
 const DEFAULT_MODEL_DISCOVERY_TIMEOUT_MS = 1e4;
@@ -32,8 +32,8 @@ async function withCodexAppServerModelRequest(options, run) {
 	if (options.request) return await run(options.request);
 	const timeoutMs = options.timeoutMs ?? 1e4;
 	const useSharedClient = options.sharedClient !== false;
-	const { createIsolatedCodexAppServerClient, getLeasedSharedCodexAppServerClient, releaseLeasedSharedCodexAppServerClient } = await import("./shared-client-tOOyadmg.mjs").then((n) => n.v);
-	const { requestCodexAppServerClientJson } = await import("./request-DxKAfWyy.mjs").then((n) => n.a);
+	const { createIsolatedCodexAppServerClient, getLeasedSharedCodexAppServerClient, releaseLeasedSharedCodexAppServerClient } = await import("./shared-client-B__jQti1.mjs").then((n) => n.v);
+	const { requestCodexAppServerClientJson } = await import("./request-DZKa6YSy.mjs").then((n) => n.a);
 	const client = await (useSharedClient ? getLeasedSharedCodexAppServerClient : createIsolatedCodexAppServerClient)({
 		startOptions: options.startOptions,
 		timeoutMs,

package/dist/.setup/{native-auth-BN-BD2AV.mjs → native-auth-BNGz77PF.mjs}

@@ -1,8 +1,8 @@
 import { d as readCodexPluginConfig } from "./config-parsing-b088LyhT.mjs";
 import { n as isCodexAppServerProxyLaunch, t as buildCodexLoginStatusArgs } from "./launch-args-DbFCehO7.mjs";
-import { r as resolveManagedCodexAppServerStartOptions } from "./managed-binary-B6hQ1UKR.mjs";
-import { n as resolveCodexAppServerSpawnEnv } from "./transport-stdio-CbutOIEh.mjs";
-import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-C0NbLms1.mjs";
+import { r as resolveManagedCodexAppServerStartOptions } from "./managed-binary-Ckgvm_4V.mjs";
+import { n as resolveCodexAppServerSpawnEnv } from "./transport-stdio-DU8dIOCj.mjs";
+import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-DDhvIeUC.mjs";
 import { runUtf8CommandWithTimeout } from "openclaw/plugin-sdk/process-runtime";
 import { materializeWindowsSpawnProgram, resolveWindowsSpawnProgram } from "openclaw/plugin-sdk/windows-spawn";
 //#region extensions/codex/src/app-server/native-auth.ts

package/dist/.setup/{native-subagent-monitor-B9aAqfnU.mjs → native-subagent-monitor-GOGINNw0.mjs}

@@ -1,11 +1,11 @@
-import { c as codexNativeSubagentRunId, d as readNativeSubagentThreadIds, f as readThreadParentThreadId, l as normalizeIdentifier, m as assertHistoryOwnerMatchesRegistration, p as readThreadSpawnSource, t as matchesNativeAssignmentLifecycle, u as readCodexNativeSubagentRunId } from "./native-subagent-pending-assignments-DwkCzLvD.mjs";
+import { c as codexNativeSubagentRunId, d as readNativeSubagentThreadIds, f as readThreadParentThreadId, l as normalizeIdentifier, m as assertHistoryOwnerMatchesRegistration, p as readThreadSpawnSource, t as matchesNativeAssignmentLifecycle, u as readCodexNativeSubagentRunId } from "./native-subagent-pending-assignments-XHNn4k5q.mjs";
 import { i as isJsonObject } from "./protocol-CANUwXJ3.mjs";
 import { c as readNonEmptyString, o as readHookOutputEntries, r as normalizeOptionalString$1, s as readItem, u as readNullableString } from "./event-projector-values-DJSz8BTk.mjs";
 import { t as attachCodexMirrorIdentity } from "./upstream-prompt-provenance-fXkKbPVC.mjs";
 import { t as readCodexMirroredSessionHistoryMessages } from "./session-history-D83lJWHG.mjs";
-import { P as claimCodexAppServerLiveThread, R as hasCodexAppServerLiveThread, ht as resolveCodexGatewayTimeoutWithGraceMs, q as retainCodexAppServerLiveThread } from "./shared-client-tOOyadmg.mjs";
-import { A as itemStatus, D as isSideEffectingNativeToolItem, E as isProjectedNativeToolItem, M as matchesCodexSnapshotTurn, O as itemKind, P as unknownItemStatus, S as auditNativeToolTerminalStatus, T as isNonSuccessItemStatus, j as itemTitle, k as itemName, s as interruptCodexTurnAndWaitBestEffort, w as isMutatingNativeToolItem, x as auditNativeToolName } from "./attempt-client-cleanup-93r-CLTi.mjs";
-import { t as __exportAll } from "./session-binding-sidecars-jo6H8dFr.mjs";
+import { P as claimCodexAppServerLiveThread, R as hasCodexAppServerLiveThread, ht as resolveCodexGatewayTimeoutWithGraceMs, q as retainCodexAppServerLiveThread } from "./shared-client-B__jQti1.mjs";
+import { A as itemStatus, D as isSideEffectingNativeToolItem, E as isProjectedNativeToolItem, M as matchesCodexSnapshotTurn, O as itemKind, P as unknownItemStatus, S as auditNativeToolTerminalStatus, T as isNonSuccessItemStatus, j as itemTitle, k as itemName, s as interruptCodexTurnAndWaitBestEffort, w as isMutatingNativeToolItem, x as auditNativeToolName } from "./attempt-client-cleanup-C9dwStbK.mjs";
+import { t as __exportAll } from "./session-binding-sidecars-BuEALwJY.mjs";
 import { asFiniteNumber, asNonArrayRecord, normalizeLowercaseStringOrEmpty, normalizeOptionalString, normalizeTrimmedStringList, readStringField } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { randomUUID } from "node:crypto";
 import { asDateTimestampMs } from "openclaw/plugin-sdk/number-runtime";
@@ -560,6 +560,7 @@ var CodexNativeSubagentAssignmentInventory = class {
 		this.dependencies = dependencies;
 		this.writes = /* @__PURE__ */ new Map();
 		this.snapshots = /* @__PURE__ */ new WeakMap();
+		this.acknowledged = /* @__PURE__ */ new WeakSet();
 	}
 	hasWrites(state) {
 		return this.writes.has(state);
@@ -597,7 +598,7 @@ var CodexNativeSubagentAssignmentInventory = class {
 	}
 	record(state, child) {
 		const assignment = this.fact(child);
-		if (!assignment || !state.assignmentStore || child.nativeCompletionDelivered || child.subscriptionClosed) return;
+		if (!assignment || !state.assignmentStore || child.nativeCompletionDelivered || child.completionDeliveryAbandoned || child.subscriptionClosed) return;
 		const snapshot = JSON.stringify(assignment);
 		if (this.snapshots.get(child) === snapshot) return;
 		this.snapshots.set(child, snapshot);
@@ -612,11 +613,46 @@ var CodexNativeSubagentAssignmentInventory = class {
 	}
 	settle(state, child) {
 		const assignment = this.fact(child);
-		if (!assignment || !state.assignmentStore || !child.nativeCompletionDelivered && (!child.subscriptionClosed || child.pendingCompletion)) return;
+		if (!assignment || !state.assignmentStore || this.acknowledged.has(child) || !child.nativeCompletionDelivered && (!child.subscriptionClosed || child.pendingCompletion)) return;
 		this.enqueue(state, async () => {
 			await state.assignmentStore?.consume(assignment, () => this.dependencies.assertCurrent(state));
 		});
 	}
+	abandon(state, child, assertCurrent) {
+		return this.enqueue(state, async () => {
+			const assignment = this.fact(child);
+			if (!assignment || !state.assignmentStore || !child.pendingCompletion) return;
+			if (!await state.assignmentStore.consume(assignment, () => {
+				this.dependencies.assertCurrent(state);
+				assertCurrent();
+			}, { status: child.pendingCompletion.status })) throw new Error("Undeliverable native assignment was not retired.");
+		});
+	}
+	async settleNestedCompletion(state, child, assertCurrent) {
+		const owner = child.historyOwner;
+		if (!owner || owner.parentThreadId === child.nativeParentThreadId || !await this.dependencies.isNativeChildThread(child.nativeParentThreadId)) return false;
+		await this.acknowledge(state, child, () => {
+			assertCurrent();
+			assertHistoryOwnerMatchesRegistration(owner, state.historyOwner, owner.parentThreadId, true);
+		});
+		child.nativeCompletionDelivered = true;
+		child.pendingCompletion = void 0;
+		return true;
+	}
+	acknowledge(state, child, assertCurrent) {
+		return this.enqueue(state, async () => {
+			const assertAdmission = () => {
+				this.dependencies.assertCurrent(state);
+				assertCurrent();
+			};
+			assertAdmission();
+			const assignment = this.fact(child);
+			if (!assignment || !state.assignmentStore || this.acknowledged.has(child)) return;
+			if (!await state.assignmentStore.consume(assignment, assertAdmission)) throw new Error("Native assignment was not acknowledged.");
+			this.acknowledged.add(child);
+			assertAdmission();
+		});
+	}
 	async restore(state, owner) {
 		const store = state.assignmentStore;
 		const current = state.historyOwner;
@@ -628,11 +664,15 @@ var CodexNativeSubagentAssignmentInventory = class {
 			for (const assignment of store.read()) {
 				if (!matchesNativeAssignmentLifecycle(assignment.owner, current)) continue;
 				const recovery = await this.dependencies.readHistory(assignment);
+				const pending = store.read();
 				if (!this.dependencies.isCurrent(state) || !custody.isCurrent()) return;
 				store.assertCurrent();
 				if (!recovery || recovery.parentThreadId !== assignment.nativeParentThreadId) continue;
-				await this.dependencies.restore(state, assignment, recovery, custody);
-				await this.drain(state);
+				const surviving = pending.find((entry) => entry.childThreadId === assignment.childThreadId && entry.nativeParentThreadId === assignment.nativeParentThreadId && matchesNativeAssignmentLifecycle(entry.owner, assignment.owner) && (entry.nativeTurnId === assignment.nativeTurnId && (entry.nativeTurnId !== void 0 || entry.runId === assignment.runId) || recovery.nativeTurnId !== void 0 && entry.nativeTurnId === recovery.nativeTurnId && (assignment.nativeTurnId === void 0 || entry.runId === assignment.runId)));
+				if (surviving) {
+					await this.dependencies.restore(state, surviving, recovery, custody);
+					await this.drain(state);
+				}
 			}
 		} catch (error) {
 			embeddedAgentLog.warn("Native pending assignments remain for reconciliation", { error: formatErrorMessage$1(error) });
@@ -993,7 +1033,18 @@ var CodexNativeSubagentCompletionDelivery = class {
 		childState.deliveringCompletion = true;
 		let deferredToForeground = false;
 		try {
+			if (await this.dependencies.settleNestedCompletion(state, childState, () => {
+				if (!this.isCurrent(state, childState) || childState.completionCustody && !childState.completionCustody.isCurrent()) throw new Error("Native completion acknowledgement is no longer current.");
+			})) {
+				this.dependencies.unregisterChild(childState);
+				return;
+			}
+			if (!this.isCurrent(state, childState)) return;
 			if (!this.prepareDelivery(state, childState)) return;
+			if (childState.completionDeliveryAbandoned) {
+				await this.abandon(state, childState);
+				return;
+			}
 			if (state.owners.size > 0 || !state.completionScope) {
 				deferredToForeground = state.owners.size > 0;
 				return;
@@ -1028,15 +1079,15 @@ var CodexNativeSubagentCompletionDelivery = class {
 				return;
 			}
 			if (delivery.recoveryBlocked) {
-				this.dependencies.unregisterChild(childState);
+				await this.abandon(state, childState);
 				return;
 			}
 			if (delivery.recoveryPending) {
-				this.scheduleRetry(childState, delivery.error ?? "requester recovery owns completion", false);
+				await this.scheduleRetry(state, childState, delivery.error ?? "requester recovery owns completion", false);
 				return;
 			}
 			const error = delivery.error ?? "completion delivery did not produce a parent response";
-			this.scheduleRetry(childState, error);
+			await this.scheduleRetry(state, childState, error);
 		} catch (error) {
 			if (!this.dependencies.isCurrentChild(childState) || !this.dependencies.isCurrentParent(state) || this.dependencies.isRetiredParent(state)) return;
 			if (!this.claim(state, childState)) {
@@ -1044,7 +1095,7 @@ var CodexNativeSubagentCompletionDelivery = class {
 				return;
 			}
 			const message = formatErrorMessage$1(error);
-			this.scheduleRetry(childState, message);
+			await this.scheduleRetry(state, childState, message, !childState.completionDeliveryAbandoned);
 			embeddedAgentLog.warn("Failed to deliver Codex native subagent completion", {
 				parentThreadId: state.parentThreadId,
 				childThreadId: completion.childThreadId,
@@ -1107,22 +1158,41 @@ var CodexNativeSubagentCompletionDelivery = class {
 		this.dependencies.releaseClientRetentionIfIdle();
 		return true;
 	}
-	scheduleRetry(childState, error, chargeAttempt = true) {
+	async abandon(state, child) {
+		child.completionDeliveryAbandoned = true;
+		try {
+			await this.dependencies.abandon(state, child, () => {
+				if (child.nativeCompletionDelivered || !this.isCurrent(state, child) || !this.claim(state, child)) throw new Error("Native completion retirement is no longer current.");
+			});
+			this.dependencies.unregisterChild(child);
+		} catch (error) {
+			if (this.isCurrent(state, child) && child.nativeCompletionDelivered) {
+				this.prepareDelivery(state, child);
+				return;
+			}
+			embeddedAgentLog.warn("Native completion retirement remains pending", {
+				childThreadId: child.childThreadId,
+				error: formatErrorMessage$1(error)
+			});
+			await this.scheduleRetry(state, child, formatErrorMessage$1(error), false);
+		}
+	}
+	async scheduleRetry(state, childState, error, chargeAttempt = true) {
 		if (!childState.pendingCompletion || childState.completionDeliveryTimer || !this.dependencies.isCurrentChild(childState)) return;
 		if (chargeAttempt && childState.completionDeliveryAttempt >= this.maxRetries) {
 			embeddedAgentLog.warn("Native subagent completion retries exhausted", {
 				childThreadId: childState.childThreadId,
 				error
 			});
-			this.dependencies.unregisterChild(childState);
+			await this.abandon(state, childState);
 			return;
 		}
 		const delayMs = delayForAttempt(this.retryDelaysMs, chargeAttempt ? childState.completionDeliveryAttempt++ : childState.completionDeliveryAttempt);
 		childState.completionDeliveryTimer = setTimeout(() => {
 			childState.completionDeliveryTimer = void 0;
 			if (!this.dependencies.isCurrentChild(childState)) return;
-			const state = this.dependencies.getParent(childState.parentThreadId);
-			if (state) this.deliverPending(state, childState);
+			const currentParent = this.dependencies.getParent(childState.parentThreadId);
+			if (currentParent) this.deliverPending(currentParent, childState);
 		}, delayMs);
 		childState.completionDeliveryTimer.unref();
 	}
@@ -1130,7 +1200,7 @@ var CodexNativeSubagentCompletionDelivery = class {
 		if (childState.completionCustody && !childState.completionCustody.isCurrent()) return false;
 		const requesterSessionKey = state.requesterSessionKey?.trim();
 		if (!requesterSessionKey) return true;
-		const key = `${requesterSessionKey}\0${childState.runId}`;
+		const key = childState.deliveryOwnerKey ?? `${requesterSessionKey}\0${childState.nativeTurnId ? codexNativeSubagentRunId(childState.childThreadId, childState.nativeTurnId) : childState.runId}`;
 		try {
 			state.assignmentStore?.assertCurrent();
 			assertHistoryOwnerMatchesRegistration(childState.historyOwner, state.historyOwner, childState.nativeParentThreadId, state.historyOwner !== void 0);
@@ -1408,6 +1478,10 @@ var CodexNativeSubagentHistoryRecovery = class {
 			itemsView: "full"
 		}, { timeoutMs: THREAD_READ_TIMEOUT_MS });
 	}
+	async isNativeChildThread(threadId) {
+		const response = await this.requestThreadRead(threadId, false);
+		return response.thread.id === threadId && Boolean(readThreadParentThreadId(response.thread));
+	}
 	async read(assignment, options) {
 		const { childThreadId } = assignment;
 		const { recordedCompletion } = options;
@@ -2633,6 +2707,7 @@ var CodexNativeSubagentSubmissionOwner = class {
 		if (!this.isObserving(state, custody) || !this.admitTurn(state, custody.receipt, turn, custody.owner, historyValidated, custody.completionCustody)) return;
 		custody.phase = "promoting";
 		if (custody.timer) clearTimeout(custody.timer);
+		custody.release();
 	}
 	settleChild(state, child) {
 		for (const custody of this.pending.get(state)?.values() ?? []) {
@@ -4582,6 +4657,8 @@ var Monitor = class {
 			isRetiredParent: (state) => this.retiredParentStates.has(state),
 			getParent: (id) => this.parentStates.get(id),
 			unregisterChild: (child) => this.unregisterChild(child),
+			abandon: (state, child, assertCurrent) => this.assignments.abandon(state, child, assertCurrent),
+			settleNestedCompletion: (state, child, assertCurrent) => this.assignments.settleNestedCompletion(state, child, assertCurrent),
 			releaseClientRetentionIfIdle: () => this.releaseClientRetentionIfIdle()
 		});
 		this.turnObservation = new CodexNativeSubagentTurnObservation({
@@ -4697,8 +4774,9 @@ var Monitor = class {
 					revision.release();
 				}
 			},
+			isNativeChildThread: async (threadId) => this.knownChildren.has(threadId) || await this.historyRecovery.isNativeChildThread(threadId),
 			restore: async (state, assignment, recovery, custody) => {
-				const existing = this.childStates.get(assignment.runId);
+				const existing = this.childStates.get(assignment.runId) ?? [...this.childStates.values()].find((child) => assignment.nativeTurnId !== void 0 && child.childThreadId === assignment.childThreadId && child.nativeTurnId === assignment.nativeTurnId && child.nativeParentThreadId === assignment.nativeParentThreadId && child.historyOwner !== void 0 && matchesNativeAssignmentLifecycle(child.historyOwner, assignment.owner));
 				if (existing) {
 					const original = this.parentStates.get(existing.parentThreadId);
 					if (original && original.requesterSessionKey === state.requesterSessionKey && original.historyOwner && state.historyOwner && matchesNativeAssignmentLifecycle(original.historyOwner, state.historyOwner)) original.assignmentStore = state.assignmentStore;
@@ -4845,6 +4923,9 @@ var Monitor = class {
 		});
 		if (!capture) return;
 		try {
+			const known = this.knownChildren.get(request.threadId);
+			const child = known ? this.admitFollowupChild(known, request.threadId) : void 0;
+			if (child?.nativeTurnId === request.turnId && child.settledWithoutCompletion) this.resumeChild(child);
 			await this.persistModelAssignment(request, capture);
 			request.signal?.throwIfAborted();
 			capture.assertCurrent();
@@ -5018,6 +5099,7 @@ var Monitor = class {
 		childState.settledWithoutCompletion = false;
 		childState.fallbackCompletion = void 0;
 		this.releaseClientRetention ??= this.retainClient?.();
+		this.retainParentThreadForChild(childState.parentThreadId);
 	}
 	settleResumableChild(childState) {
 		if (childState.terminal) return;
@@ -5028,6 +5110,7 @@ var Monitor = class {
 		releaseNativeDirectChild(childState);
 		releaseNativeModelExecution(childState);
 		this.recovery.clearRecoveryTimers(childState);
+		this.releaseParentThreadIfChildrenSettled(childState.parentThreadId);
 		this.releaseClientRetentionIfIdle();
 	}
 	async handleChildTurnCompletion(notification, childState) {
@@ -5201,6 +5284,7 @@ var Monitor = class {
 		this.recovery.markTerminalRevision(childState.childThreadId);
 		releaseNativeDirectChild(childState);
 		this.recovery.clearRecoveryTimers(childState);
+		this.releaseParentThreadIfChildrenSettled(state.parentThreadId);
 		this.applyNativeReceipts(state, childState.deliveryReceipts.record(childState.runId, this.knownChildren.get(childState.childThreadId)?.agentPaths ?? [childState.childThreadId], acceptedCompletion.result));
 		await this.completionDelivery.deliverPending(state, childState);
 	}
@@ -5260,10 +5344,7 @@ var Monitor = class {
 		if (!childState) {
 			this.updateChildThreadOwnership("claim", childThreadId, this.claimChildThread);
 			this.releaseClientRetention ??= this.retainClient?.();
-			if (!this.parentThreadRetentions.has(parentThreadId)) {
-				const releaseParentThread = this.retainParentThread?.(parentThreadId);
-				if (releaseParentThread) this.parentThreadRetentions.set(parentThreadId, releaseParentThread);
-			}
+			this.retainParentThreadForChild(parentThreadId);
 			childState = {
 				runId,
 				nativeTurnId: assignment.nativeTurnId,
@@ -5482,6 +5563,7 @@ var Monitor = class {
 			}
 			if (!transitioned) claimOwner.onDirectChildAccepted?.();
 		}
+		this.observeActiveChild(child);
 		this.admissionCustody.bindEventSink(child);
 		return child;
 	}
@@ -5536,11 +5618,7 @@ var Monitor = class {
 		this.recovery.clearRecoveryTimers(childState);
 		this.completionDelivery.release(childState);
 		if (this.childStates.get(childState.runId) === childState) this.childStates.delete(childState.runId);
-		if (![...this.childStates.values()].some((remainingChild) => remainingChild.parentThreadId === childState.parentThreadId)) {
-			const releaseParentThread = this.parentThreadRetentions.get(childState.parentThreadId);
-			this.parentThreadRetentions.delete(childState.parentThreadId);
-			releaseParentThread?.();
-		}
+		this.releaseParentThreadIfChildrenSettled(childState.parentThreadId);
 		this.recovery.collectThreadStatusRevision(childState.childThreadId);
 		this.releaseClientRetentionIfIdle();
 		const state = this.parentStates.get(childState.parentThreadId);
@@ -5565,6 +5643,17 @@ var Monitor = class {
 			});
 		});
 	}
+	retainParentThreadForChild(parentThreadId) {
+		if (this.parentThreadRetentions.has(parentThreadId)) return;
+		const releaseParentThread = this.retainParentThread?.(parentThreadId);
+		if (releaseParentThread) this.parentThreadRetentions.set(parentThreadId, releaseParentThread);
+	}
+	releaseParentThreadIfChildrenSettled(parentThreadId) {
+		for (const childState of this.childStates.values()) if (childState.parentThreadId === parentThreadId && !childState.terminal && !childState.settledWithoutCompletion) return;
+		const releaseParentThread = this.parentThreadRetentions.get(parentThreadId);
+		this.parentThreadRetentions.delete(parentThreadId);
+		releaseParentThread?.();
+	}
 	releaseClientRetentionIfIdle() {
 		if ([...this.childStates.values()].some((childState) => !childState.terminal && !childState.settledWithoutCompletion)) return;
 		this.releaseRetainedClient();