@openclaw/codex 2026.9.4 → 2026.9.5

package/dist/{native-subagent-task-ids-BzTdT0Uw.js → .setup/native-subagent-task-ids-DsuOonKv.mjs}

@@ -1,6 +1,6 @@
-import { o as isJsonObject } from "./protocol-5bh1G-H7.js";
-import { C as readNonEmptyString, _ as normalizeOptionalString$1, c as itemName, l as itemStatus, m as shouldSynthesizeToolProgressForItem, w as readNonEmptyStringArray } from "./event-projector-items-5VhsECCO.js";
-import { asNonArrayRecord, readStringField } from "openclaw/plugin-sdk/string-coerce-runtime";
+import { m as isJsonObject } from "./config-security-BRQ2mgW9.mjs";
+import { C as readNonEmptyString, _ as normalizeOptionalString$1, c as itemName, l as itemStatus, m as shouldSynthesizeToolProgressForItem, w as readNonEmptyStringArray } from "./event-projector-items-DyTQ_XqL.mjs";
+import { asNonArrayRecord, normalizeOptionalString, readStringField } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { truncateUtf16Safe } from "openclaw/plugin-sdk/text-utility-runtime";
 import { formatToolAggregate, formatToolProgressOutput, inferToolMetaFromArgs } from "openclaw/plugin-sdk/agent-harness-runtime";
 import { redactSensitiveFieldValue, redactToolPayloadText } from "openclaw/plugin-sdk/logging-core";
@@ -373,15 +373,39 @@ function stringifyJsonValue(value) {
 }
 //#endregion
 //#region extensions/codex/src/app-server/native-subagent-task-ids.ts
-/**
-* Shared identifiers for representing Codex native subagents as OpenClaw task
-* runtime rows.
-*/
 /** Task runtime namespace for Codex native subagent task rows. */
 const CODEX_NATIVE_SUBAGENT_RUNTIME = "subagent";
 /** Task kind used to distinguish native Codex subagents from other subagent runtimes. */
 const CODEX_NATIVE_SUBAGENT_TASK_KIND = "codex-native";
 /** Run id prefix for task rows keyed by Codex child thread ids. */
 const CODEX_NATIVE_SUBAGENT_RUN_ID_PREFIX = "codex-thread:";
+/** Initial tasks keep their shipped locator; later assignments belong to a native turn. */
+function codexNativeSubagentRunId(threadId, turnId) {
+	return `${CODEX_NATIVE_SUBAGENT_RUN_ID_PREFIX}${threadId.trim()}${turnId ? `:turn:${turnId}` : ""}`;
+}
+function readCodexNativeSubagentRunId(runId) {
+	if (!runId?.startsWith("codex-thread:")) return;
+	const [threadId, turnId] = runId.slice(13).split(":turn:");
+	return threadId?.trim() ? {
+		threadId,
+		...turnId ? { turnId } : {}
+	} : void 0;
+}
+function readNativeTaskAssignment(task) {
+	const runId = task.runId;
+	const identity = readCodexNativeSubagentRunId(runId);
+	if (!runId || !identity) return;
+	const storedTurnId = isJsonObject(task.detail) ? normalizeOptionalString(readStringField(task.detail, "nativeTurnId")) : void 0;
+	return {
+		runId,
+		childThreadId: identity.threadId,
+		nativeTurnId: storedTurnId ?? identity.turnId,
+		initialTurnId: identity.turnId
+	};
+}
+function readNativeSubagentThreadIds(value) {
+	if (!Array.isArray(value)) return [];
+	return value.filter((entry) => typeof entry === "string" && entry.trim() !== "");
+}
 //#endregion
-export { formatToolSummary as C, truncateToolTranscriptText as E, formatToolOutput as S, toolOutputRawEchoSignature as T, sanitizeCodexToolResponse as _, isNativePostToolUseRelayItem as a, ToolOutputAccumulator as b, itemToolArgs as c, itemTranscriptResultText as d, shouldSuppressChannelProgressForItem as f, sanitizeCodexToolArguments as g, resolveCodexToolProgressDetailMode as h, isCommandBearingToolItem as i, itemToolError as l, isCodexCommandBearingToolCall as m, CODEX_NATIVE_SUBAGENT_RUN_ID_PREFIX as n, itemMeta as o, inferCodexDynamicToolMeta as p, CODEX_NATIVE_SUBAGENT_TASK_KIND as r, itemOutputText as s, CODEX_NATIVE_SUBAGENT_RUNTIME as t, itemToolResult as u, TOOL_PROGRESS_ECHO_PREFIX_MIN_CHARS as v, normalizeToolTranscriptArguments as w, collectDynamicToolContentText as x, TOOL_TRANSCRIPT_OUTPUT_MAX_CHARS as y };
+export { truncateToolTranscriptText as A, TOOL_TRANSCRIPT_OUTPUT_MAX_CHARS as C, formatToolSummary as D, formatToolOutput as E, normalizeToolTranscriptArguments as O, TOOL_PROGRESS_ECHO_PREFIX_MIN_CHARS as S, collectDynamicToolContentText as T, inferCodexDynamicToolMeta as _, readCodexNativeSubagentRunId as a, sanitizeCodexToolArguments as b, isCommandBearingToolItem as c, itemOutputText as d, itemToolArgs as f, shouldSuppressChannelProgressForItem as g, itemTranscriptResultText as h, codexNativeSubagentRunId as i, toolOutputRawEchoSignature as k, isNativePostToolUseRelayItem as l, itemToolResult as m, CODEX_NATIVE_SUBAGENT_RUN_ID_PREFIX as n, readNativeSubagentThreadIds as o, itemToolError as p, CODEX_NATIVE_SUBAGENT_TASK_KIND as r, readNativeTaskAssignment as s, CODEX_NATIVE_SUBAGENT_RUNTIME as t, itemMeta as u, isCodexCommandBearingToolCall as v, ToolOutputAccumulator as w, sanitizeCodexToolResponse as x, resolveCodexToolProgressDetailMode as y };

package/dist/{node-cli-sessions-DKaOmVUh.js → .setup/node-cli-sessions-Cl8b2ZF3.mjs}

@@ -1,4 +1,4 @@
-import { o as formatCodexDisplayText } from "./command-formatters-lxlkNZgU.js";
+import { o as formatCodexDisplayText } from "./command-formatters-CGEkdawF.mjs";
 import { isRecord } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { timestampMsToIsoString } from "openclaw/plugin-sdk/number-runtime";
 import { runCommandBuffered } from "openclaw/plugin-sdk/process-runtime";

package/dist/{node-exec-server.runtime-Cl2vapEi.js → .setup/node-exec-server.runtime-BaViBKNz.mjs}

@@ -1,13 +1,13 @@
-import { i as resolveManagedCodexNativeCommand, r as resolveManagedCodexAppServerStartOptions, t as isManagedCodexDesktopCommand } from "./managed-binary-D22rNEcR.js";
-import { i as closeCodexAppServerTransportAndWait, t as createStdioTransport } from "./transport-stdio-BGjHoYLr.js";
+import { i as resolveManagedCodexNativeCommand, r as resolveManagedCodexAppServerStartOptions, t as isManagedCodexDesktopCommand } from "./managed-binary-DP6Rib3P.mjs";
+import { i as closeCodexAppServerTransportAndWait, t as createStdioTransport } from "./transport-stdio-Cmx94Oiy.mjs";
 import { isRecord } from "openclaw/plugin-sdk/string-coerce-runtime";
+import { stripVTControlCharacters } from "node:util";
 import { killProcessTree } from "openclaw/plugin-sdk/process-runtime";
 import path from "node:path";
 import { mkdir } from "node:fs/promises";
 import { once } from "node:events";
 import { resolvePreferredOpenClawTmpDir, withTempWorkspace } from "openclaw/plugin-sdk/temp-path";
 import { createDeferred } from "openclaw/plugin-sdk/extension-shared";
-import { stripVTControlCharacters } from "node:util";
 import { StringDecoder } from "node:string_decoder";
 import { sanitizeEnvVars } from "openclaw/plugin-sdk/sandbox";
 //#region extensions/codex/src/node-exec-server.runtime.ts

package/dist/{plan-7uG-Fp36.js → .setup/plan-xD7WKYTM.mjs}

@@ -1,6 +1,6 @@
-import { c as CODEX_PLUGINS_MARKETPLACE_NAME } from "./plugin-inventory-oL4Na1ZG.js";
-import "./config-oIORaQ5T.js";
-import { a as exists, c as sanitizeName, n as discoverCodexSource, o as readJsonObject, r as hasCodexSource, s as resolveHomePath, t as codexPluginMigrationSubscriptionWarning } from "./source-CElXU0Oy.js";
+import { c as CODEX_PLUGINS_MARKETPLACE_NAME } from "./plugin-inventory-DUle8DLz.mjs";
+import "./config-CedDWjM-.mjs";
+import { c as resolveHomePath, i as hasCodexSource, l as sanitizeName, n as defaultCodexHome, o as exists, r as discoverCodexSource, s as readJsonObject, t as codexPluginMigrationSubscriptionWarning } from "./source-Bjp4UQij.mjs";
 import { asBoolean, asOptionalRecord, isRecord, normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { createHash } from "node:crypto";
 import { runCommandBuffered } from "openclaw/plugin-sdk/process-runtime";
@@ -10,10 +10,56 @@ import { canonicalPathFromExistingAncestor, isPathInside } from "openclaw/plugin
 import { readSecretFile } from "openclaw/plugin-sdk/secret-file";
 import { fileURLToPath } from "node:url";
 import { loadAuthProfileStoreWithoutExternalProfiles, resolveAgentConfig, resolveAgentWorkspaceDir, resolveDefaultAgentId } from "openclaw/plugin-sdk/agent-runtime";
-import { extractErrorCode } from "openclaw/plugin-sdk/security-runtime";
 import { applyAuthProfileConfig, buildApiKeyCredential, buildOauthProviderAuthResult, buildOpenAICodexCredentialExtra, hasUsableOAuthCredential, resolveOpenAICodexAuthIdentity, resolveOpenAICodexImportProfileName, updateAuthProfileStoreWithLock } from "openclaw/plugin-sdk/provider-auth";
+import { extractErrorCode } from "openclaw/plugin-sdk/security-runtime";
 import { MIGRATION_REASON_TARGET_EXISTS, createMigrationItem, createMigrationManualItem, hasMigrationConfigPatchConflict, markMigrationItemConflict, markMigrationItemError, markMigrationItemSkipped, mergeMigrationConfigValue, readMigrationConfigPath, resolveMigrationConfigRuntime, summarizeMigrationItems } from "openclaw/plugin-sdk/migration";
 import { decodeOpenAICodexJwtPayload } from "openclaw/plugin-sdk/provider-oauth-runtime";
+//#region extensions/codex/src/migration/auth-profile-target.ts
+const OPENAI_PROVIDER_ID$1 = "openai";
+const LEGACY_CODEX_PROFILE_ID = "openai:default";
+function findMatchingOAuthProfile(store, credential) {
+	const subject = oauthSubject(credential);
+	if (!subject) return;
+	for (const [profileId, existing] of Object.entries(store.profiles)) {
+		if (existing.type !== "oauth" || existing.provider !== credential.provider) continue;
+		const previous = oauthSubject(existing);
+		if (previous?.accountId === subject.accountId && previous.userId === subject.userId) return profileId;
+	}
+}
+function oauthSubject(credential) {
+	const claims = decodeOpenAICodexJwtPayload(credential.access)?.["https://api.openai.com/auth"];
+	if (!isRecord(claims)) return;
+	const accountId = normalizeOptionalString(claims.chatgpt_account_id);
+	const userId = normalizeOptionalString(claims.chatgpt_user_id) ?? normalizeOptionalString(claims.user_id);
+	return accountId && userId ? {
+		accountId,
+		userId
+	} : void 0;
+}
+function findMatchingApiKeyProfile(store, provider, key) {
+	for (const [profileId, existing] of Object.entries(store.profiles)) if (existing.type === "api_key" && existing.provider === provider && existing.key === key) return profileId;
+}
+function itemProfileTarget(credential, store, ctx, source) {
+	if (credential.kind === "oauth") {
+		const profile = credential.result.profiles[0];
+		const matched = profile?.credential.type === "oauth" ? findMatchingOAuthProfile(store, profile.credential) : void 0;
+		if (matched) return {
+			profileId: matched,
+			matchedExisting: true
+		};
+		const legacyProfile = ctx.config.auth?.profiles?.[LEGACY_CODEX_PROFILE_ID];
+		return {
+			profileId: legacyProfile?.provider === OPENAI_PROVIDER_ID$1 && legacyProfile.mode === "oauth" && source.codexHome === defaultCodexHome() && profile?.credential.type === "oauth" && oauthSubject(profile.credential) !== void 0 && !Object.entries(store.profiles).some(([id, existing]) => id !== "openai:default" && existing.type === "oauth" && existing.provider === OPENAI_PROVIDER_ID$1) ? LEGACY_CODEX_PROFILE_ID : credential.profileId,
+			matchedExisting: false
+		};
+	}
+	const matched = findMatchingApiKeyProfile(store, credential.provider, credential.key);
+	return {
+		profileId: matched ?? credential.profileId,
+		matchedExisting: Boolean(matched)
+	};
+}
+//#endregion
 //#region extensions/codex/src/migration/cli-credentials.ts
 /** Explicit migration reads the storage selected by the native credential owner. */
 async function readAuthFile(home) {
@@ -48,8 +94,8 @@ async function readDirectKeyring(home, signal) {
 async function readSelectedCredentialStorage(options, requireApiKey) {
 	options.signal?.throwIfAborted();
 	const home = await fs.realpath(options.codexHome).catch(() => path.resolve(options.codexHome));
-	const { CodexAppServerClient } = await import("./client-B57KWPQx.js").then((n) => n.n);
-	const { resolveManagedCodexPackageEntrypoint, resolveManagedCodexNativeCommand } = await import("./managed-binary-D22rNEcR.js").then((n) => n.n);
+	const { CodexAppServerClient } = await import("./client-vXs2929Q.mjs").then((n) => n.n);
+	const { resolveManagedCodexPackageEntrypoint, resolveManagedCodexNativeCommand } = await import("./managed-binary-DP6Rib3P.mjs").then((n) => n.n);
 	const launcher = resolveManagedCodexPackageEntrypoint(path.dirname(fileURLToPath(import.meta.url)));
 	const command = launcher ? resolveManagedCodexNativeCommand(launcher) : void 0;
 	if (!command) return;
@@ -164,7 +210,7 @@ async function readCodexCliActiveApiKeyAsync(options) {
 const OPENAI_PROVIDER_ID = "openai";
 const OPENAI_OAUTH_ITEM_ID = "auth:openai";
 const OPENAI_API_KEY_ITEM_ID = "auth:openai:api-key";
-const OPENAI_CODEX_DEFAULT_MODEL = "openai/gpt-5.6-sol";
+const OPENAI_CODEX_DEFAULT_MODEL = "openai/gpt-6-astra";
 const CODEX_IMPORT_DISPLAY_NAME = "Codex import";
 const CODEX_REASON_AUTH_NOT_SELECTED = "auth credential migration not selected";
 const CODEX_REASON_AUTH_PROFILE_EXISTS = "auth profile exists";
@@ -255,43 +301,6 @@ async function readCodexAuthCredentials(source, options) {
 		...options.signal ? { signal: options.signal } : {}
 	}), options.credentialKind === "oauth" ? null : await buildCodexApiKeyCredential(source, options.allowKeychainPrompt, options.signal)].filter((entry) => entry !== null);
 }
-function findMatchingOAuthProfile(store, credential) {
-	const subject = oauthSubject(credential);
-	if (!subject) return;
-	for (const [profileId, existing] of Object.entries(store.profiles)) {
-		if (existing.type !== "oauth" || existing.provider !== credential.provider) continue;
-		const previous = oauthSubject(existing);
-		if (previous?.accountId === subject.accountId && previous.userId === subject.userId) return profileId;
-	}
-}
-function oauthSubject(credential) {
-	const claims = decodeOpenAICodexJwtPayload(credential.access)?.["https://api.openai.com/auth"];
-	if (!isRecord(claims)) return;
-	const accountId = normalizeOptionalString(claims.chatgpt_account_id);
-	const userId = normalizeOptionalString(claims.chatgpt_user_id) ?? normalizeOptionalString(claims.user_id);
-	return accountId && userId ? {
-		accountId,
-		userId
-	} : void 0;
-}
-function findMatchingApiKeyProfile(store, provider, key) {
-	for (const [profileId, existing] of Object.entries(store.profiles)) if (existing.type === "api_key" && existing.provider === provider && existing.key === key) return profileId;
-}
-function itemProfileTarget(credential, store) {
-	if (credential.kind === "oauth") {
-		const profile = credential.result.profiles[0];
-		const matched = profile?.credential.type === "oauth" ? findMatchingOAuthProfile(store, profile.credential) : void 0;
-		return {
-			profileId: matched ?? credential.profileId,
-			matchedExisting: Boolean(matched)
-		};
-	}
-	const matched = findMatchingApiKeyProfile(store, credential.provider, credential.key);
-	return {
-		profileId: matched ?? credential.profileId,
-		matchedExisting: Boolean(matched)
-	};
-}
 function replaceConfigDraft(draft, next) {
 	for (const key of Object.keys(draft)) delete draft[key];
 	Object.assign(draft, next);
@@ -437,7 +446,7 @@ async function buildCodexAuthItems(params) {
 	const store = loadAuthProfileStoreWithoutExternalProfiles(params.targets.agentDir);
 	const skipped = !params.ctx.includeSecrets;
 	return credentials.map((credential) => {
-		const { profileId, matchedExisting } = itemProfileTarget(credential, store);
+		const { profileId, matchedExisting } = itemProfileTarget(credential, store, params.ctx, params.source);
 		const existing = store.profiles[profileId];
 		const configProfile = authProfileConfigForCredential(credential, profileId);
 		const configConflict = configProfile ? hasAuthProfileConfigConflict(params.ctx.config, configProfile, Boolean(params.ctx.overwrite)) : false;
@@ -459,6 +468,7 @@ async function buildCodexAuthItems(params) {
 				sourceProfileId: credential.profileId,
 				sourceCredentialFingerprint: sourceCredentialFingerprint(credential),
 				sourceKind: "codex-native-selected-storage",
+				...profileId === "openai:default" && !matchedExisting ? { legacyNativeHome: params.source.codexHome } : {},
 				credentialKind: credential.kind,
 				credentialImportUnavailable: unavailable
 			}
@@ -482,6 +492,7 @@ async function applyCodexAuthItems(params) {
 	})).find((candidate) => candidate.provider === provider && candidate.kind === credentialKind && (!sourceProfileId || candidate.profileId === sourceProfileId));
 	if (!credential) return [markMigrationItemSkipped(item, CODEX_REASON_AUTH_NO_LONGER_PRESENT)];
 	if (item.details?.sourceCredentialFingerprint !== sourceCredentialFingerprint(credential)) return [markMigrationItemSkipped(item, CODEX_REASON_AUTH_NO_LONGER_PRESENT)];
+	if (item.details?.legacyNativeHome !== void 0 && (item.details.legacyNativeHome !== source.codexHome || source.codexHome !== defaultCodexHome())) return [markMigrationItemSkipped(item, CODEX_REASON_AUTH_NO_LONGER_PRESENT)];
 	ctx.signal?.throwIfAborted();
 	const oauthProfile = credential.kind === "oauth" ? credential.result.profiles[0] : void 0;
 	const oauthCredential = oauthProfile?.credential.type === "oauth" ? oauthProfile.credential : void 0;
@@ -497,9 +508,14 @@ async function applyCodexAuthItems(params) {
 		stateDir: ctx.stateDir,
 		updater: (freshStore) => {
 			ctx.signal?.throwIfAborted();
-			const existing = freshStore.profiles[profileId];
+			const effectiveStore = loadAuthProfileStoreWithoutExternalProfiles(targets.agentDir);
+			if (item.details?.legacyNativeHome !== void 0 && itemProfileTarget(credential, effectiveStore, ctx, source).profileId !== profileId) {
+				conflicted = true;
+				return false;
+			}
+			const existing = effectiveStore.profiles[profileId];
 			if (!ctx.overwrite && existing) {
-				if ((credential.kind === "oauth" ? findMatchingOAuthProfile(freshStore, oauthCredential) : findMatchingApiKeyProfile(freshStore, credential.provider, credential.key)) === profileId) {
+				if ((credential.kind === "oauth" ? findMatchingOAuthProfile(effectiveStore, oauthCredential) : findMatchingApiKeyProfile(effectiveStore, credential.provider, credential.key)) === profileId) {
 					unusable = existing.type === "oauth" && !hasUsableOAuthCredential(existing);
 					return false;
 				}
@@ -519,7 +535,7 @@ async function applyCodexAuthItems(params) {
 	});
 	if (conflicted) return [markMigrationItemConflict(item, CODEX_REASON_AUTH_PROFILE_EXISTS)];
 	if (unusable) return [markMigrationItemSkipped(item, CODEX_REASON_AUTH_PROFILE_UNUSABLE)];
-	if (!store?.profiles[profileId]) return [markMigrationItemError(item, CODEX_REASON_AUTH_PROFILE_WRITE_FAILED)];
+	if (!store || !loadAuthProfileStoreWithoutExternalProfiles(targets.agentDir).profiles[profileId]) return [markMigrationItemError(item, CODEX_REASON_AUTH_PROFILE_WRITE_FAILED)];
 	const configResult = configPatchMode !== "apply" ? "unavailable" : await applyCodexAuthConfig(ctx, credential, profileId);
 	if (configResult === "conflict") return [markMigrationItemConflict(item, CODEX_REASON_AUTH_PROFILE_EXISTS)];
 	const migratedItem = {

package/dist/{plugin-activation-BYQculil.js → .setup/plugin-activation-r8nq5Jzp.mjs}

@@ -1,6 +1,6 @@
-import { c as CODEX_PLUGINS_MARKETPLACE_NAME, i as pluginReadParams, n as isOpenAiCuratedMarketplace, r as isOpenAiCuratedMarketplaceName, t as findCodexMarketplacePluginSummary } from "./plugin-inventory-oL4Na1ZG.js";
-import { t as CodexAppServerRpcError } from "./rpc-error-ttN_QjEm.js";
-import "./config-oIORaQ5T.js";
+import { c as CODEX_PLUGINS_MARKETPLACE_NAME, i as pluginReadParams, n as isOpenAiCuratedMarketplace, r as isOpenAiCuratedMarketplaceName, t as findCodexMarketplacePluginSummary } from "./plugin-inventory-DUle8DLz.mjs";
+import { i as CodexAppServerRpcError } from "./timeout-DZF05XrR.mjs";
+import "./config-CedDWjM-.mjs";
 import { coerceErrorMessage } from "openclaw/plugin-sdk/error-runtime";
 //#region extensions/codex/src/app-server/plugin-activation.ts
 /**

package/dist/{plugin-app-cache-key-d0eKxy7b.js → .setup/plugin-app-cache-key-BOxKP7db.mjs}

@@ -1,4 +1,4 @@
-import { c as resolveCodexAppServerLocalHomeDir, l as resolveCodexAppServerUserHomeDir, s as resolveCodexAppServerHomeDir } from "./protocol-5bh1G-H7.js";
+import { _ as resolveCodexAppServerUserHomeDir, g as resolveCodexAppServerLocalHomeDir, h as resolveCodexAppServerHomeDir } from "./config-security-BRQ2mgW9.mjs";
 import { createRequire } from "node:module";
 import { isRecord } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { createHash } from "node:crypto";
@@ -6,6 +6,22 @@ import { OPENCLAW_VERSION, embeddedAgentLog } from "openclaw/plugin-sdk/agent-ha
 import { isFutureDateTimestampMs, resolveDateTimestampMs, resolveExpiresAtMsFromDurationMs } from "openclaw/plugin-sdk/number-runtime";
 import { truncateUtf16Safe } from "openclaw/plugin-sdk/text-utility-runtime";
 import { readPluginPackageVersion } from "openclaw/plugin-sdk/extension-shared";
+//#region extensions/codex/src/app-server/app-identity.ts
+/**
+* Apps SDK manifests and installed Codex connections can name the same app
+* with asdk_app_ and legacy connector_ prefixes. Only the shared 128-bit ID
+* establishes equivalence; display names never establish app ownership.
+* Keep the installed ID for native config and calls. This comparison bridge
+* can retire when installed inventories consistently return Apps SDK IDs.
+*/
+function codexAppIdentityKey(id) {
+	return id.replace(/^connector_([a-f0-9]{32})$/, "asdk_app_$1");
+}
+/** Resolves a declared app against account-authorized runtime metadata. */
+function findCodexAppById(apps, id) {
+	return apps.find((app) => app.id === id) ?? apps.find((app) => codexAppIdentityKey(app.id) === codexAppIdentityKey(id));
+}
+//#endregion
 //#region extensions/codex/src/app-server/app-inventory-cache.ts
 /**
 * Process-local cache for Codex app-server app inventories, keyed by runtime
@@ -69,7 +85,7 @@ var CodexAppInventoryCache = class {
 		};
 		const entry = this.entries.get(key);
 		if (entry) {
-			const scope = invalidatedAppIds?.filter(Boolean) ?? [];
+			const scope = invalidatedAppIds?.filter(Boolean).map(codexAppIdentityKey) ?? [];
 			if (!entry.invalidated) entry.invalidatedAppIds = scope.length ? [...scope].toSorted() : void 0;
 			else if (entry.invalidatedAppIds && scope.length) entry.invalidatedAppIds = Array.from(/* @__PURE__ */ new Set([...entry.invalidatedAppIds, ...scope])).toSorted();
 			else entry.invalidatedAppIds = void 0;
@@ -106,7 +122,7 @@ var CodexAppInventoryCache = class {
 		const promise = this.refreshUncoalesced(params, refreshToken, previousRefresh);
 		const currentRefresh = {
 			promise,
-			targetAppIds: new Set(params.targetAppIds?.filter(Boolean) ?? [])
+			targetAppIds: new Set(params.targetAppIds?.filter(Boolean).map(codexAppIdentityKey) ?? [])
 		};
 		this.inFlight.set(params.key, currentRefresh);
 		try {
@@ -133,7 +149,7 @@ var CodexAppInventoryCache = class {
 				key: params.key,
 				apps: inventory.apps,
 				installedApps: inventory.installedApps,
-				...params.targetAppIds?.some(Boolean) ? { targetAppIds: Array.from(new Set(params.targetAppIds.filter(Boolean))).toSorted() } : {},
+				...params.targetAppIds?.some(Boolean) ? { targetAppIds: Array.from(new Set(params.targetAppIds.filter(Boolean).map(codexAppIdentityKey))).toSorted() } : {},
 				fetchedAtMs: nowMs,
 				expiresAtMs,
 				revision: this.revision
@@ -191,13 +207,13 @@ function resolvePublishedInventorySnapshot(existing, snapshot, nowMs) {
 }
 /** Replaces refreshed target rows in place, deletes vanished ones, appends new ones. */
 function mergeRefreshedRows(existingRows, refreshedRows, refreshedTargetIds) {
-	const refreshedById = new Map(refreshedRows.map((row) => [row.id, row]));
-	const existingIds = new Set(existingRows.map((row) => row.id));
+	const refreshedById = new Map(refreshedRows.map((row) => [codexAppIdentityKey(row.id), row]));
+	const existingIds = new Set(existingRows.map((row) => codexAppIdentityKey(row.id)));
 	return [...existingRows.flatMap((row) => {
-		if (!refreshedTargetIds.has(row.id)) return [row];
-		const refreshed = refreshedById.get(row.id);
+		if (!refreshedTargetIds.has(codexAppIdentityKey(row.id))) return [row];
+		const refreshed = refreshedById.get(codexAppIdentityKey(row.id));
 		return refreshed ? [refreshed] : [];
-	}), ...refreshedRows.filter((row) => !existingIds.has(row.id))];
+	}), ...refreshedRows.filter((row) => !existingIds.has(codexAppIdentityKey(row.id)))];
 }
 /**
 * A refresh retires exactly the invalidation scope it re-read: a complete
@@ -217,7 +233,7 @@ function resolveRemainingInvalidationScope(existing, snapshot) {
 }
 function doesInFlightRefreshCover(existing, params) {
 	if (existing.targetAppIds.size === 0) return true;
-	const requestedAppIds = new Set(params.targetAppIds?.filter(Boolean) ?? []);
+	const requestedAppIds = new Set(params.targetAppIds?.filter(Boolean).map(codexAppIdentityKey) ?? []);
 	return requestedAppIds.size > 0 && Array.from(requestedAppIds).every((appId) => existing.targetAppIds.has(appId));
 }
 /** Serializes a refresh failure without leaking large or sensitive error data. */
@@ -257,8 +273,8 @@ function normalizeRuntimeIdentityForCacheKey(value) {
 }
 async function readInstalledApps(request, options) {
 	const installed = await request("app/installed", { forceRefresh: options.forceRefresh });
-	const targetIds = new Set((options.targetAppIds ?? []).filter(Boolean));
-	const apps = targetIds.size === 0 ? installed.apps : installed.apps.filter((app) => targetIds.has(app.id));
+	const targetIds = new Set((options.targetAppIds ?? []).filter(Boolean).map(codexAppIdentityKey));
+	const apps = targetIds.size === 0 ? installed.apps : installed.apps.filter((app) => targetIds.has(codexAppIdentityKey(app.id)));
 	if (apps.length === 0) return {
 		apps: [],
 		installedApps: []
@@ -335,14 +351,6 @@ function isSensitiveErrorDataKey(key) {
 */
 const require = createRequire(import.meta.url);
 const CODEX_PLUGIN_VERSION = readPluginPackageVersion({ require });
-let catalogConnectionHomes = /* @__PURE__ */ new Map();
-function catalogConnectionHomeKey(fingerprint, agentDir) {
-	return `${agentDir ?? ""}\0${fingerprint}`;
-}
-/** Replaces the lifecycle-owned catalog connection snapshot used by supervised bindings. */
-function replaceCodexCatalogConnectionHomes(homes) {
-	catalogConnectionHomes = new Map(homes.map((home) => [catalogConnectionHomeKey(home.fingerprint, home.agentDir), home.codexHome]));
-}
 /** Builds the full app inventory cache key for Codex plugin/app discovery. */
 function buildCodexPluginAppCacheKey(params) {
 	return buildCodexAppInventoryCacheKey({
@@ -379,10 +387,6 @@ function buildCodexAppServerConnectionFingerprint(appServer, agentDir) {
 		cwd: appServer.start.cwd ?? null
 	});
 }
-/** Looks up a snapshotted catalog store without repeating filesystem discovery on a run. */
-function resolveCodexCatalogConnectionHome(fingerprint, agentDir) {
-	return catalogConnectionHomes.get(catalogConnectionHomeKey(fingerprint, agentDir));
-}
 function resolveCodexAppServerConnectionHome(start, agentDir) {
 	const configured = start.env?.CODEX_HOME?.trim();
 	if (configured) return configured;
@@ -424,4 +428,4 @@ function fingerprintCodexPluginAppCacheCredentials(startOptions) {
 	return `sha256:${hash.digest("hex")}`;
 }
 //#endregion
-export { resolveCodexCatalogConnectionHome as a, serializeCodexAppInventoryError as c, replaceCodexCatalogConnectionHomes as i, buildCodexAppServerRuntimeFingerprint as n, CodexAppInventoryCache as o, buildCodexPluginAppCacheKey as r, defaultCodexAppInventoryCache as s, buildCodexAppServerConnectionFingerprint as t };
+export { defaultCodexAppInventoryCache as a, findCodexAppById as c, CodexAppInventoryCache as i, buildCodexAppServerRuntimeFingerprint as n, serializeCodexAppInventoryError as o, buildCodexPluginAppCacheKey as r, codexAppIdentityKey as s, buildCodexAppServerConnectionFingerprint as t };

package/dist/{plugin-approval-roundtrip-Bz3FT8W5.js → .setup/plugin-approval-roundtrip-CjfzafAZ.mjs}

@@ -1,4 +1,4 @@
-import { P as resolveCodexGatewayTimeoutWithGraceMs } from "./shared-client-CscigXXL.js";
+import { it as resolveCodexGatewayTimeoutWithGraceMs } from "./shared-client-BpTtuLQ5.mjs";
 import { isApprovalNotFoundError, toErrorObject } from "openclaw/plugin-sdk/error-runtime";
 import { truncateUtf16Safe } from "openclaw/plugin-sdk/text-utility-runtime";
 //#region extensions/codex/src/app-server/plugin-approval-roundtrip.ts

package/dist/{plugin-inventory-oL4Na1ZG.js → .setup/plugin-inventory-DUle8DLz.mjs}

@@ -1,5 +1,6 @@
-import { S as resolveCodexPluginsPolicy } from "./protocol-5bh1G-H7.js";
-import "./config-oIORaQ5T.js";
+import { f as resolveCodexPluginsPolicy } from "./config-parsing-CcB9iPoq.mjs";
+import { c as findCodexAppById } from "./plugin-app-cache-key-BOxKP7db.mjs";
+import "./config-CedDWjM-.mjs";
 import { embeddedAgentLog } from "openclaw/plugin-sdk/agent-harness-runtime";
 //#region extensions/codex/src/app-server/config-contracts.ts
 const CODEX_PLUGINS_MARKETPLACE_NAME = "openai-curated";
@@ -109,7 +110,7 @@ async function readCodexPluginInventory(params) {
 			activationRequired: pluginPolicy.enabled && (unavailableByMarketplacePolicy || !summary.installed || !summary.enabled),
 			authRequired: apps.some((app) => app.needsAuth || !app.accessible),
 			appOwnership,
-			ownedAppIds,
+			ownedAppIds: Array.from(/* @__PURE__ */ new Set([...ownedAppIds, ...apps.map((app) => app.id)])).toSorted(),
 			apps
 		});
 	}
@@ -237,9 +238,9 @@ function resolveOwnedApps(params) {
 		});
 		return [];
 	}
-	const appInfoById = new Map((params.appInventory?.snapshot?.apps ?? []).map((app) => [app.id, app]));
+	const appInfos = params.appInventory?.snapshot?.apps ?? [];
 	return detailApps.map((app) => {
-		const info = appInfoById.get(app.id);
+		const info = findCodexAppById(appInfos, app.id);
 		if (!info) return {
 			id: app.id,
 			name: app.name,
@@ -248,7 +249,7 @@ function resolveOwnedApps(params) {
 			needsAuth: true
 		};
 		return Object.assign({
-			id: app.id,
+			id: info.id,
 			name: app.name,
 			accessible: info.isAccessible,
 			enabled: info.isEnabled,

package/dist/{plugin-metadata-cache-ClPJpRio.js → .setup/plugin-metadata-cache-DsS5buNa.mjs}

@@ -1,12 +1,12 @@
-import { o as resolveCodexComputerUseConfig } from "./config-options-CXMq1T-C.js";
-import { s as resolveCodexAppServerHomeDir } from "./protocol-5bh1G-H7.js";
-import { c as isCodexAppServerIndeterminateTransportError, o as isCodexAppServerConnectionClosedError, s as isCodexAppServerIndeterminateRequestCancellationError } from "./client-B57KWPQx.js";
-import { l as resolveMacOSDesktopCodexBundledMarketplaceCandidates, s as resolveFirstExistingMacOSDesktopCodexBundledMarketplacePath, t as isManagedCodexDesktopCommand } from "./managed-binary-D22rNEcR.js";
-import { n as describeControlFailure } from "./capabilities-8vx68WLH.js";
-import { i as requestCodexAppServerJson } from "./request-B7hEkBGq.js";
-import "./config-oIORaQ5T.js";
-import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-D0zGNIHu.js";
-import { $ as reconcileCodexComputerUseStartArtifacts, T as acquireCodexNativeConfigFence, b as waitForCodexAppServerClientDesktopGenerationDrain, c as getLeasedSharedCodexAppServerClient, d as readCodexAppServerClientDesktopGeneration, g as resolveCodexNativeConfigFenceKey, h as releaseLeasedSharedCodexAppServerClient, nt as resolveCodexManagedBundledMarketplacePath, p as readCodexAppServerClientProcessIdentity, rt as assertNotSymlink, t as assertCodexAppServerClientStartSelectionCurrent, u as isCodexAppServerStartSelectionChangedError } from "./shared-client-CscigXXL.js";
+import { h as resolveCodexAppServerHomeDir } from "./config-security-BRQ2mgW9.mjs";
+import { c as isCodexAppServerIndeterminateTransportError, o as isCodexAppServerConnectionClosedError, s as isCodexAppServerIndeterminateRequestCancellationError } from "./client-vXs2929Q.mjs";
+import { o as resolveCodexComputerUseConfig } from "./config-options-BsanJ8QG.mjs";
+import { l as resolveMacOSDesktopCodexBundledMarketplaceCandidates, s as resolveFirstExistingMacOSDesktopCodexBundledMarketplacePath, t as isManagedCodexDesktopCommand } from "./managed-binary-DP6Rib3P.mjs";
+import { n as describeControlFailure } from "./capabilities-_vXcZGSx.mjs";
+import { i as requestCodexAppServerJson } from "./request-BioXJLYa.mjs";
+import "./config-CedDWjM-.mjs";
+import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-CeAhl_h4.mjs";
+import { $ as assertNotSymlink, D as acquireCodexNativeConfigFence, Q as resolveCodexManagedBundledMarketplacePath, Y as reconcileCodexComputerUseStartArtifacts, b as waitForCodexAppServerClientDesktopGenerationDrain, c as getLeasedSharedCodexAppServerClient, d as readCodexAppServerClientDesktopGeneration, g as resolveCodexNativeConfigFenceKey, h as releaseLeasedSharedCodexAppServerClient, p as readCodexAppServerClientProcessIdentity, t as assertCodexAppServerClientStartSelectionCurrent, u as isCodexAppServerStartSelectionChangedError } from "./shared-client-BpTtuLQ5.mjs";
 import { existsSync } from "node:fs";
 import path from "node:path";
 import fs$1 from "node:fs/promises";
@@ -33,6 +33,9 @@ const COMPUTER_USE_MARKETPLACE_NAME_PRIORITY = [
 ];
 const COMPUTER_USE_LIVE_TEST_RETRY_COUNT = 1;
 const COMPUTER_USE_LIVE_TEST_THREAD_NAME = "OpenClaw Computer Use readiness probe";
+const COMPUTER_USE_LIST_APPS_TOOL = "list_apps";
+const COMPUTER_USE_UNIFIED_JS_TOOL = "js";
+const COMPUTER_USE_UNIFIED_JS_PROBE = "await cua.getState();";
 /** Reads Computer Use readiness without installing or mutating app-server state. */
 async function readCodexComputerUseStatus(params = {}) {
 	const config = resolveComputerUseConfig(params);
@@ -318,7 +321,8 @@ async function readComputerUseTools(params) {
 	params.releaseNativeConfigFence?.();
 	const { liveTest, repair } = await runCodexComputerUseLiveTest({
 		request: params.request,
-		config: params.config
+		config: params.config,
+		tools
 	});
 	const compatibilityStartupAllowed = !liveTest.ok && !params.config.strictReadiness;
 	return {
@@ -342,6 +346,7 @@ async function runCodexComputerUseLiveTest(params) {
 	const startedAt = Date.now();
 	let lastError;
 	let repair;
+	const probe = resolveComputerUseLiveTestProbe(params.tools);
 	for (let attempt = 0; attempt <= COMPUTER_USE_LIVE_TEST_RETRY_COUNT; attempt += 1) {
 		let threadId;
 		try {
@@ -350,12 +355,12 @@ async function runCodexComputerUseLiveTest(params) {
 				developerInstructions: COMPUTER_USE_LIVE_TEST_THREAD_NAME,
 				ephemeral: true
 			}, { timeoutMs: params.config.liveTestTimeoutMs })).thread.id;
-			await params.request("mcpServer/tool/call", {
+			if ((await params.request("mcpServer/tool/call", {
 				threadId,
 				server: params.config.mcpServerName,
-				tool: "list_apps",
-				arguments: {}
-			}, { timeoutMs: params.config.toolCallTimeoutMs });
+				tool: probe.tool,
+				arguments: probe.arguments
+			}, { timeoutMs: params.config.toolCallTimeoutMs })).isError === true) throw new Error(`Computer Use readiness tool ${params.config.mcpServerName}.${probe.tool} returned an error result`);
 			return {
 				liveTest: {
 					status: "passed",
@@ -395,6 +400,16 @@ async function runCodexComputerUseLiveTest(params) {
 		...repair ? { repair } : {}
 	};
 }
+function resolveComputerUseLiveTestProbe(tools) {
+	if (tools?.includes(COMPUTER_USE_UNIFIED_JS_TOOL) && !tools.includes(COMPUTER_USE_LIST_APPS_TOOL)) return {
+		tool: COMPUTER_USE_UNIFIED_JS_TOOL,
+		arguments: { code: COMPUTER_USE_UNIFIED_JS_PROBE }
+	};
+	return {
+		tool: COMPUTER_USE_LIST_APPS_TOOL,
+		arguments: {}
+	};
+}
 async function repairComputerUseMcpRuntime(request, config) {
 	try {
 		await request("config/mcpServer/reload", void 0, { timeoutMs: config.liveTestTimeoutMs });

package/dist/{provider-capabilities-BvCUL69A.js → .setup/provider-capabilities-B8J4Dy-O.mjs}

@@ -1,5 +1,5 @@
-import { h as releaseLeasedSharedCodexAppServerClient } from "./shared-client-CscigXXL.js";
-import { ct as normalizeCodexDynamicToolName } from "./thread-lifecycle-DXl1-I6b.js";
+import { h as releaseLeasedSharedCodexAppServerClient } from "./shared-client-BpTtuLQ5.mjs";
+import { lt as normalizeCodexDynamicToolName } from "./thread-lifecycle-Cik28qWn.mjs";
 import { pinExecToolTarget } from "openclaw/plugin-sdk/codex-mcp-projection";
 import { loadNodeExecAvailability } from "openclaw/plugin-sdk/node-selection-runtime";
 //#region extensions/codex/src/app-server/shell-dynamic-tools.ts

package/dist/{provider-MQ8PVkuE.js → .setup/provider-fFh_-VR3.mjs}

@@ -12,7 +12,7 @@ function buildCodexMigrationProvider(params = {}) {
 		description: "Import Codex memory and skills while keeping Codex native plugins and hooks explicit.",
 		supportedItemKinds: ["memory", "auth"],
 		async detect(ctx) {
-			const { discoverCodexSource, hasCodexSource } = await import("./source-CElXU0Oy.js").then((n) => n.i);
+			const { discoverCodexSource, hasCodexSource } = await import("./source-Bjp4UQij.mjs").then((n) => n.a);
 			const source = await discoverCodexSource({
 				input: ctx.source,
 				memoryOnly: isMemoryOnlyMigration(ctx),
@@ -28,16 +28,16 @@ function buildCodexMigrationProvider(params = {}) {
 			};
 		},
 		async plan(ctx) {
-			const { buildCodexMigrationPlan } = await import("./plan-7uG-Fp36.js");
+			const { buildCodexMigrationPlan } = await import("./plan-xD7WKYTM.mjs");
 			return buildCodexMigrationPlan(ctx);
 		},
 		deferredApply: { retrySafe: true },
 		prepareApply(ctx) {
 			if (isMemoryOnlyMigration(ctx) || isAuthOnlyMigration(ctx)) return;
-			return import("./apply-CvT8tW5i.js").then(({ prepareTargetCodexAppServer }) => prepareTargetCodexAppServer(ctx));
+			return import("./apply-CJ0ZfmBG.mjs").then(({ prepareTargetCodexAppServer }) => prepareTargetCodexAppServer(ctx));
 		},
 		async apply(ctx, plan) {
-			const { applyCodexMigrationPlan } = await import("./apply-CvT8tW5i.js");
+			const { applyCodexMigrationPlan } = await import("./apply-CJ0ZfmBG.mjs");
 			return await applyCodexMigrationPlan({
 				ctx,
 				plan,