@openclaw/codex 2026.9.4 → 2026.9.5

package/dist/{command-dispatch-BpduNGVf.js → .setup/command-dispatch-naHIZwwF.mjs}

@@ -1,5 +1,5 @@
-import { o as formatCodexDisplayText } from "./command-formatters-lxlkNZgU.js";
-import { n as describeControlFailure } from "./capabilities-8vx68WLH.js";
+import { o as formatCodexDisplayText } from "./command-formatters-CGEkdawF.mjs";
+import { n as describeControlFailure } from "./capabilities-_vXcZGSx.mjs";
 //#region extensions/codex/src/command-dispatch.ts
 /** Dispatches a `/codex` command to the lazily loaded handler. */
 async function handleCodexCommand(ctx, options) {
@@ -14,7 +14,7 @@ async function handleCodexCommand(ctx, options) {
 	}
 }
 async function loadDefaultCodexSubcommandHandler() {
-	const { handleCodexSubcommand } = await import("./command-handlers-tiL9iWj7.js");
+	const { handleCodexSubcommand } = await import("./command-handlers-BtAJEW1X.mjs");
 	return handleCodexSubcommand;
 }
 //#endregion

package/dist/{command-formatters-lxlkNZgU.js → .setup/command-formatters-CGEkdawF.mjs}

@@ -1,5 +1,5 @@
-import { o as isJsonObject } from "./protocol-5bh1G-H7.js";
-import { c as summarizeCodexRateLimits, o as summarizeCodexAccountRateLimits, r as hasCodexRateLimitSnapshots } from "./rate-limits-CBMmWBr9.js";
+import { m as isJsonObject } from "./config-security-BRQ2mgW9.mjs";
+import { c as summarizeCodexRateLimits, o as summarizeCodexAccountRateLimits, r as hasCodexRateLimitSnapshots } from "./rate-limits-DOEGYRNs.mjs";
 import { normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
 //#region extensions/codex/src/command-formatters.ts
 /**

package/dist/{command-handlers-tiL9iWj7.js → .setup/command-handlers-BtAJEW1X.mjs}

@@ -1,46 +1,46 @@
-import { n as isCodexFastServiceTier } from "./config-utils-DujwEnhg.js";
-import { c as CODEX_PLUGINS_MARKETPLACE_NAME, i as pluginReadParams, r as isOpenAiCuratedMarketplaceName, t as findCodexMarketplacePluginSummary } from "./plugin-inventory-oL4Na1ZG.js";
-import { l as sessionBindingIdentity, n as assertCodexBindingMayBeReplaced, r as bindingStoreKey } from "./session-binding-record-Bcvslnhf.js";
-import { o as isJsonObject } from "./protocol-5bh1G-H7.js";
-import { _ as assertCodexThreadAcceptsDirectInput, s as isCodexAppServerIndeterminateRequestCancellationError, u as isCodexAppServerPrewriteRequestCancellationError, y as assertCodexThreadResumeResponse } from "./client-B57KWPQx.js";
-import { c as resolveCodexAppServerPreparedApiKeyCacheKey, s as resolveCodexAppServerFallbackApiKeyCacheKey } from "./auth-cache-key-7orQae_j.js";
-import { r as withCodexConversationThreadActivity, t as isIncognitoSessionKey } from "./incognito-session-uhrBF6wJ.js";
-import { a as CODEX_HOST_INSPECTION_AUTH_ERROR, c as hasCodexAdminScope, i as CODEX_FULL_PERMISSIONS_AUTH_ERROR, n as filterCodexMarketplacePlugins, o as CODEX_NATIVE_EXECUTION_AUTH_ERROR, r as parseCodexPluginMarketplaceId, s as canMutateCodexHost, t as discoverCodexMarketplacePlugins } from "./plugin-marketplace-discovery-P-Vndfqq.js";
-import { s as summarizeCodexAccountUsage } from "./rate-limits-CBMmWBr9.js";
-import { a as formatCodexAccountLine, c as formatCodexTextForDisplay, d as formatModels, f as formatSkills, i as formatAccount, l as formatComputerUseStatus, n as buildHelp, o as formatCodexDisplayText, p as formatThreads, r as escapeCodexChatText, s as formatCodexStatus, t as CODEX_RESUME_SAFE_THREAD_ID_PATTERN, u as formatList } from "./command-formatters-lxlkNZgU.js";
-import { i as readCodexConversationBindingData, n as createCodexCliNodeConversationBindingData, o as resolveCodexDefaultWorkspaceDir, r as createCodexConversationBindingData } from "./conversation-binding-data-BiodpIzq.js";
-import { t as CodexAppServerRpcError } from "./rpc-error-ttN_QjEm.js";
-import { t as CODEX_CONTROL_METHODS } from "./capabilities-8vx68WLH.js";
-import { i as formatCodexCliSessions } from "./node-cli-sessions-DKaOmVUh.js";
-import { r as buildCodexPluginAppCacheKey, s as defaultCodexAppInventoryCache } from "./plugin-app-cache-key-d0eKxy7b.js";
-import { o as withCodexAppServerJsonClient } from "./request-B7hEkBGq.js";
-import "./config-oIORaQ5T.js";
-import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-D0zGNIHu.js";
-import { n as fingerprintCodexAppServerAuthBinding } from "./auth-binding-CWlKVccJ.js";
-import { i as resolveCodexBindingAppServerConnection } from "./binding-connection-D3udKbIE.js";
-import { a as resolveCodexAppServerAuthProfileStore, i as resolveCodexAppServerAuthProfileIdForAgent, n as normalizeCodexAppServerBindingModelProvider } from "./auth-profile-CwzO4_RG.js";
-import { R as consumeCodexAppServerLiveThread, V as hasCodexAppServerLiveThread, c as getLeasedSharedCodexAppServerClient, et as resolveCodexAppServerAuthAccountCacheKey, h as releaseLeasedSharedCodexAppServerClient } from "./shared-client-CscigXXL.js";
-import { a as closeCodexStartupClientBestEffort } from "./attempt-client-cleanup-DKHzbwt5.js";
-import { t as listAllCodexAppServerModels } from "./models-PCKOim-h.js";
-import { n as refreshCodexAppRuntimeState, r as refreshCodexPluginRuntimeState } from "./plugin-activation-BYQculil.js";
-import { n as createCodexSessionGenerationSupersededError, o as resolveCodexSessionBinding } from "./session-binding-CI8UuilT.js";
-import { r as assertCodexSupervisionThreadLineage } from "./thread-policy-BuEQfE0g.js";
-import { a as rollbackCodexAppServerBindingSubscription, i as retireCodexConversationThreadBinding, n as releaseCodexAppServerBindingSubscription, r as retainCodexAppServerBindingSubscription, s as withExclusiveCodexAppServerThread, t as isSameCodexAppServerThreadOwner } from "./thread-ownership-BsDRTsyp.js";
-import { n as resolveCodexNativeSandboxBlock, t as resolveCodexNativeExecutionBlock } from "./sandbox-guard-BxgyoM8M.js";
-import { i as readCodexComputerUseStatus, r as installCodexComputerUse, t as defaultCodexPluginMetadataCache } from "./plugin-metadata-cache-ClPJpRio.js";
-import { a as requestOptions, i as readCodexStatusProbes, o as safeCodexControlRequest, r as prepareCodexControlSessionAuth, t as codexControlRequest } from "./command-rpc-CR5EOEZX.js";
-import { a as setCodexConversationFastMode, c as steerCodexConversationTurn, i as readCodexConversationActiveTurn, l as stopCodexConversationTurn, n as parseCodexFastModeArg, o as setCodexConversationModel, r as parseCodexPermissionsModeArg, s as setCodexConversationPermissions, t as formatPermissionsMode } from "./conversation-control-CtUu1b3m.js";
+import { n as isCodexFastServiceTier } from "./config-utils-DujwEnhg.mjs";
+import { c as CODEX_PLUGINS_MARKETPLACE_NAME, i as pluginReadParams, r as isOpenAiCuratedMarketplaceName, t as findCodexMarketplacePluginSummary } from "./plugin-inventory-DUle8DLz.mjs";
+import { n as assertCodexBindingMayBeReplaced, p as sessionBindingIdentity, r as bindingStoreKey } from "./session-binding-record-TH3xA0zj.mjs";
+import { m as isJsonObject } from "./config-security-BRQ2mgW9.mjs";
+import { _ as assertCodexThreadAcceptsDirectInput, s as isCodexAppServerIndeterminateRequestCancellationError, u as isCodexAppServerPrewriteRequestCancellationError, y as assertCodexThreadResumeResponse } from "./client-vXs2929Q.mjs";
+import { c as resolveCodexAppServerPreparedApiKeyCacheKey, s as resolveCodexAppServerFallbackApiKeyCacheKey } from "./auth-cache-key-QirmgiCo.mjs";
+import { r as withCodexConversationThreadActivity, t as isIncognitoSessionKey } from "./incognito-session-uhrBF6wJ.mjs";
+import { a as CODEX_HOST_INSPECTION_AUTH_ERROR, c as hasCodexAdminScope, i as CODEX_FULL_PERMISSIONS_AUTH_ERROR, n as filterCodexMarketplacePlugins, o as CODEX_NATIVE_EXECUTION_AUTH_ERROR, r as parseCodexPluginMarketplaceId, s as canMutateCodexHost, t as discoverCodexMarketplacePlugins } from "./plugin-marketplace-discovery-P-Vndfqq.mjs";
+import { s as summarizeCodexAccountUsage } from "./rate-limits-DOEGYRNs.mjs";
+import { a as formatCodexAccountLine, c as formatCodexTextForDisplay, d as formatModels, f as formatSkills, i as formatAccount, l as formatComputerUseStatus, n as buildHelp, o as formatCodexDisplayText, p as formatThreads, r as escapeCodexChatText, s as formatCodexStatus, t as CODEX_RESUME_SAFE_THREAD_ID_PATTERN, u as formatList } from "./command-formatters-CGEkdawF.mjs";
+import { i as readCodexConversationBindingData, n as createCodexCliNodeConversationBindingData, o as resolveCodexDefaultWorkspaceDir, r as createCodexConversationBindingData } from "./conversation-binding-data-CrcyZk6O.mjs";
+import { i as CodexAppServerRpcError } from "./timeout-DZF05XrR.mjs";
+import { t as CODEX_CONTROL_METHODS } from "./capabilities-_vXcZGSx.mjs";
+import { i as formatCodexCliSessions } from "./node-cli-sessions-Cl8b2ZF3.mjs";
+import { a as defaultCodexAppInventoryCache, r as buildCodexPluginAppCacheKey } from "./plugin-app-cache-key-BOxKP7db.mjs";
+import { i as resolveCodexBindingAppServerConnection } from "./binding-connection-Bm38niE8.mjs";
+import { o as withCodexAppServerJsonClient } from "./request-BioXJLYa.mjs";
+import "./config-CedDWjM-.mjs";
+import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-CeAhl_h4.mjs";
+import { a as resolveCodexAppServerAuthProfileStore, i as resolveCodexAppServerAuthProfileIdForAgent, n as normalizeCodexAppServerBindingModelProvider } from "./auth-profile-WqZtZfXN.mjs";
+import { n as fingerprintCodexAppServerAuthBinding } from "./auth-binding-DhLWa_7K.mjs";
+import { I as hasCodexAppServerLiveThread, N as consumeCodexAppServerLiveThread, X as resolveCodexAppServerAuthAccountCacheKey, c as getLeasedSharedCodexAppServerClient, h as releaseLeasedSharedCodexAppServerClient } from "./shared-client-BpTtuLQ5.mjs";
+import { a as closeCodexStartupClientBestEffort } from "./attempt-client-cleanup-BpYKdTA0.mjs";
+import { t as listAllCodexAppServerModels } from "./models-BDFgm_G-.mjs";
+import { n as refreshCodexAppRuntimeState, r as refreshCodexPluginRuntimeState } from "./plugin-activation-r8nq5Jzp.mjs";
+import { n as createCodexSessionGenerationSupersededError, o as resolveCodexSessionBinding } from "./session-binding-_0W_fHRr.mjs";
+import { r as assertCodexSupervisionThreadLineage } from "./thread-policy-Cjs4B8xf.mjs";
+import { a as rollbackCodexAppServerBindingSubscription, i as retireCodexConversationThreadBinding, n as releaseCodexAppServerBindingSubscription, r as retainCodexAppServerBindingSubscription, s as withExclusiveCodexAppServerThread, t as isSameCodexAppServerThreadOwner } from "./thread-ownership-skomxnIt.mjs";
+import { n as resolveCodexNativeSandboxBlock, t as resolveCodexNativeExecutionBlock } from "./sandbox-guard-BBP-RbTf.mjs";
+import { i as readCodexComputerUseStatus, r as installCodexComputerUse, t as defaultCodexPluginMetadataCache } from "./plugin-metadata-cache-DsS5buNa.mjs";
+import { a as requestOptions, i as readCodexStatusProbes, o as safeCodexControlRequest, r as prepareCodexControlSessionAuth, t as codexControlRequest } from "./command-rpc-DHFpn4le.mjs";
+import { a as setCodexConversationFastMode, c as steerCodexConversationTurn, i as readCodexConversationActiveTurn, l as stopCodexConversationTurn, n as parseCodexFastModeArg, o as setCodexConversationModel, r as parseCodexPermissionsModeArg, s as setCodexConversationPermissions, t as formatPermissionsMode } from "./conversation-control-DN53ns41.mjs";
 import { normalizeOptionalString, normalizeUniqueStringEntries } from "openclaw/plugin-sdk/string-coerce-runtime";
 import crypto from "node:crypto";
+import { isDeepStrictEqual } from "node:util";
 import { resolveSessionAgentIdsStrict } from "openclaw/plugin-sdk/agent-scope-runtime";
 import { parseStrictPositiveInteger } from "openclaw/plugin-sdk/number-runtime";
 import { expectDefined } from "openclaw/plugin-sdk/expect-runtime";
 import { truncateUtf16Safe } from "openclaw/plugin-sdk/text-utility-runtime";
 import { ensureAuthProfileStore, resolveAgentDir as resolveAgentDir$1, resolveAgentWorkspaceDir, resolveAuthProfileEligibility, resolveProfileUnusableUntilForDisplay } from "openclaw/plugin-sdk/agent-runtime";
-import { isDeepStrictEqual } from "node:util";
-import { parseAgentSessionKey } from "openclaw/plugin-sdk/routing";
 import { getSessionEntry, resolveStorePath } from "openclaw/plugin-sdk/session-store-runtime";
 import { findNormalizedProviderValue, resolveAuthProfileOrder } from "openclaw/plugin-sdk/provider-auth";
+import { parseAgentSessionKey } from "openclaw/plugin-sdk/routing";
 import { renderMessagePresentationFallbackText } from "openclaw/plugin-sdk/interactive-runtime";
 import { MODEL_SELECTION_LOCKED_MESSAGE, isModelSelectionLocked, resolvePersistedSessionRuntimeId } from "openclaw/plugin-sdk/model-session-runtime";
 //#region extensions/codex/src/command-account.ts
@@ -1586,10 +1586,13 @@ async function resolveCommandAppServerContext(deps, ctx, pluginConfig) {
 		agentDir,
 		config: ctx.config
 	});
-	const connection = resolveCodexBindingAppServerConnection({
+	const connection = await resolveCodexBindingAppServerConnection({
 		binding,
 		authProfileId,
-		pluginConfig
+		pluginConfig,
+		agentDir,
+		config: ctx.config,
+		assertCurrent: authority.assertCurrent
 	});
 	return {
 		scope: {
@@ -1754,12 +1757,19 @@ async function sendCodexDiagnosticsFeedbackForTargets(deps, ctx, pluginConfig, n
 	const sent = [];
 	const failed = [];
 	for (const target of targets) {
+		const assertCurrent = () => {
+			const current = resolvePendingCodexDiagnosticsTargets(deps, [target], ctx.config);
+			if (!codexDiagnosticsTargetsMatch([target], current)) throw new Error("The Codex diagnostics session changed before upload; request it again.");
+		};
 		let connection;
 		try {
-			connection = resolveCodexBindingAppServerConnection({
+			connection = await resolveCodexBindingAppServerConnection({
 				binding: target,
 				authProfileId: target.authProfileId,
-				pluginConfig
+				pluginConfig,
+				agentDir: target.agentDir,
+				config: ctx.config,
+				assertCurrent
 			});
 		} catch (error) {
 			failed.push({
@@ -1777,6 +1787,7 @@ async function sendCodexDiagnosticsFeedbackForTargets(deps, ctx, pluginConfig, n
 		}, {
 			config: ctx.config,
 			agentDir: target.agentDir,
+			assertCurrent,
 			...connection.clientAuthProfileId !== void 0 ? { authProfileId: connection.clientAuthProfileId } : {},
 			...connection.usesSupervisionConnection ? { startOptions: connection.appServer.start } : {},
 			...target.sessionId ? { sessionId: target.sessionId } : {},
@@ -2290,10 +2301,13 @@ async function handleNativeGoal(deps, ctx, pluginConfig, args) {
 	const { target, binding } = authority;
 	if (!target) return "Cannot manage the Codex goal because this command has no stable binding identity.";
 	if (!binding?.threadId) return "No Codex thread is attached to this OpenClaw session yet.";
-	const connection = resolveCodexBindingAppServerConnection({
+	const connection = await resolveCodexBindingAppServerConnection({
 		binding,
 		authProfileId: binding.authProfileId,
-		pluginConfig
+		pluginConfig,
+		agentDir: target.agentDir,
+		config: ctx.config,
+		assertCurrent: authority.assertCurrent
 	});
 	const goalRequestOptions = {
 		agentDir: target.agentDir,
@@ -2461,10 +2475,13 @@ async function startThreadAction(deps, ctx, pluginConfig, kind, args) {
 		const result = await compactCurrent();
 		return result.compacted ? `Compacted Codex session (${result.tokensAfter ?? "unknown"} tokens after).` : `Codex compaction did not complete: ${formatCodexDisplayText(result.reason ?? "no reason returned")}.`;
 	}
-	const connection = resolveCodexBindingAppServerConnection({
+	const connection = await resolveCodexBindingAppServerConnection({
 		binding,
 		authProfileId: binding.authProfileId,
-		pluginConfig
+		pluginConfig,
+		agentDir: target.agentDir,
+		config: ctx.config,
+		assertCurrent: authority.assertCurrent
 	});
 	await deps.bindingStore.withLease(target.identity, () => deps.codexControlRequest(pluginConfig, CODEX_CONTROL_METHODS.review, {
 		threadId: binding.threadId,

package/dist/{command-rpc-CR5EOEZX.js → .setup/command-rpc-DHFpn4le.mjs}

@@ -1,16 +1,16 @@
-import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
-import { o as isJsonObject } from "./protocol-5bh1G-H7.js";
-import { n as describeControlFailure, t as CODEX_CONTROL_METHODS } from "./capabilities-8vx68WLH.js";
-import { i as requestCodexAppServerJson, o as withCodexAppServerJsonClient } from "./request-B7hEkBGq.js";
-import "./config-oIORaQ5T.js";
-import { n as resolveCodexAppServerRuntimeOptions, r as resolveCodexSupervisionAppServerRuntimeOptions } from "./config-runtime-D0zGNIHu.js";
-import { r as prepareCodexAppServerAuthBinding } from "./auth-binding-CWlKVccJ.js";
-import { a as resolveCodexAppServerAuthProfileStore, r as resolveCodexAppServerAuthProfileId } from "./auth-profile-CwzO4_RG.js";
-import { tt as resolveCodexAppServerPreparedAuthHandoff } from "./shared-client-CscigXXL.js";
-import { a as closeCodexStartupClientBestEffort } from "./attempt-client-cleanup-DKHzbwt5.js";
-import { n as listCodexAppServerModels } from "./models-PCKOim-h.js";
-import { n as createCodexSessionGenerationSupersededError } from "./session-binding-CI8UuilT.js";
-import { t as resumeCodexAppServerThread } from "./thread-resume-DsDOZpFg.js";
+import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.mjs";
+import { m as isJsonObject } from "./config-security-BRQ2mgW9.mjs";
+import { n as describeControlFailure, t as CODEX_CONTROL_METHODS } from "./capabilities-_vXcZGSx.mjs";
+import { i as requestCodexAppServerJson, o as withCodexAppServerJsonClient } from "./request-BioXJLYa.mjs";
+import "./config-CedDWjM-.mjs";
+import { n as resolveCodexAppServerRuntimeOptions, r as resolveCodexSupervisionAppServerRuntimeOptions } from "./config-runtime-CeAhl_h4.mjs";
+import { a as resolveCodexAppServerAuthProfileStore, r as resolveCodexAppServerAuthProfileId } from "./auth-profile-WqZtZfXN.mjs";
+import { r as prepareCodexAppServerAuthBinding } from "./auth-binding-DhLWa_7K.mjs";
+import { Z as resolveCodexAppServerPreparedAuthHandoff } from "./shared-client-BpTtuLQ5.mjs";
+import { a as closeCodexStartupClientBestEffort } from "./attempt-client-cleanup-BpYKdTA0.mjs";
+import { n as listCodexAppServerModels } from "./models-BDFgm_G-.mjs";
+import { n as createCodexSessionGenerationSupersededError } from "./session-binding-_0W_fHRr.mjs";
+import { t as resumeCodexAppServerThread } from "./thread-resume-BkNpj9Pz.mjs";
 import { resolveAgentDir, resolveSessionAgentIdsStrict } from "openclaw/plugin-sdk/agent-scope-runtime";
 import { resolveAgentWorkspaceDir } from "openclaw/plugin-sdk/agent-runtime";
 import { prepareAgentRuntimeAuth } from "openclaw/plugin-sdk/agent-harness-runtime";
@@ -130,6 +130,9 @@ function requestOptions(pluginConfig, limit, config, agentDir) {
 	};
 }
 async function codexControlRequest(pluginConfig, method, requestParams, options = {}) {
+	try {
+		options.controlObservation?.phase("prepare");
+	} catch {}
 	const runtime = options.startOptions ? resolveCodexSupervisionAppServerRuntimeOptions({ pluginConfig }) : resolveCodexAppServerRuntimeOptions({ pluginConfig });
 	const startOptions = options.startOptions ?? runtime.start;
 	const auth = options.onResponse ? await prepareCodexControlSessionAuth(options, startOptions) : {
@@ -145,6 +148,12 @@ async function codexControlRequest(pluginConfig, method, requestParams, options
 		sessionId: options.sessionId,
 		agentDir: options.agentDir,
 		isolated: options.isolated,
+		...options.catalogPreview && method === "thread/list" ? {
+			catalogPreview: true,
+			catalogPreviewCache: options.catalogPreviewCache,
+			catalogRows: options.catalogRows
+		} : {},
+		...options.controlObservation ? { controlObservation: options.controlObservation } : {},
 		...auth.clientOptions
 	};
 	if (options.onResponse || options.beforeRequest) return await withCodexAppServerJsonClient(controlRequestOptions, async (request, client, scope) => {

package/dist/{compact-B_H3AOd7.js → .setup/compact-C3i3qlzj.mjs}

@@ -1,26 +1,24 @@
-import { l as sessionBindingIdentity } from "./session-binding-record-Bcvslnhf.js";
-import { o as isJsonObject } from "./protocol-5bh1G-H7.js";
-import { u as isCodexAppServerPrewriteRequestCancellationError } from "./client-B57KWPQx.js";
-import { n as withCodexAppServerThreadMutation, t as isIncognitoSessionKey } from "./incognito-session-uhrBF6wJ.js";
-import { t as CodexAppServerRpcError } from "./rpc-error-ttN_QjEm.js";
-import { i as resolveCodexBindingAppServerConnection } from "./binding-connection-D3udKbIE.js";
-import { J as retainCodexAppServerLiveThread, R as consumeCodexAppServerLiveThread, c as getLeasedSharedCodexAppServerClient, h as releaseLeasedSharedCodexAppServerClient } from "./shared-client-CscigXXL.js";
-import { _ as readCodexNotificationTurnId, a as closeCodexStartupClientBestEffort, c as isCodexNoActiveTurnInterruptError, d as unsubscribeCodexThreadBestEffort, g as readCodexNotificationThreadId, r as CodexAppServerUnsafeSubscriptionError } from "./attempt-client-cleanup-DKHzbwt5.js";
-import { s as readCodexNotificationItem } from "./attempt-notifications-C9XufG6l.js";
-import { n as readCodexThreadContextSnapshot } from "./event-projector-usage-BfXmpOec.js";
-import { o as resolveCodexSessionBinding, t as CODEX_APP_SERVER_BINDING_GUARDED_REQUEST_TIMEOUT_MS } from "./session-binding-CI8UuilT.js";
-import { r as assertCodexSupervisionThreadLineage } from "./thread-policy-BuEQfE0g.js";
-import { t as resumeCodexAppServerThread } from "./thread-resume-DsDOZpFg.js";
-import { t as isSameCodexAppServerThreadOwner } from "./thread-ownership-BsDRTsyp.js";
-import { t as persistCodexContextCompactionActivity } from "./context-compaction-activity-CMla5FPJ.js";
-import { t as resolveCodexNativeExecutionBlock } from "./sandbox-guard-BxgyoM8M.js";
+import { p as sessionBindingIdentity } from "./session-binding-record-TH3xA0zj.mjs";
+import { m as isJsonObject } from "./config-security-BRQ2mgW9.mjs";
+import { u as isCodexAppServerPrewriteRequestCancellationError } from "./client-vXs2929Q.mjs";
+import { n as withCodexAppServerThreadMutation, t as isIncognitoSessionKey } from "./incognito-session-uhrBF6wJ.mjs";
+import { i as CodexAppServerRpcError } from "./timeout-DZF05XrR.mjs";
+import { i as resolveCodexBindingAppServerConnection } from "./binding-connection-Bm38niE8.mjs";
+import { N as consumeCodexAppServerLiveThread, W as retainCodexAppServerLiveThread, c as getLeasedSharedCodexAppServerClient, h as releaseLeasedSharedCodexAppServerClient } from "./shared-client-BpTtuLQ5.mjs";
+import { a as closeCodexStartupClientBestEffort, b as readCodexNotificationTurnId, c as isCodexNoActiveTurnInterruptError, f as unsubscribeCodexThreadBestEffort, r as CodexAppServerUnsafeSubscriptionError, y as readCodexNotificationThreadId } from "./attempt-client-cleanup-BpYKdTA0.mjs";
+import { c as readCodexNotificationItem, n as readCodexThreadContextSnapshot } from "./event-projector-usage-C7Ntzs-f.mjs";
+import { o as resolveCodexSessionBinding, t as CODEX_APP_SERVER_BINDING_GUARDED_REQUEST_TIMEOUT_MS } from "./session-binding-_0W_fHRr.mjs";
+import { r as assertCodexSupervisionThreadLineage } from "./thread-policy-Cjs4B8xf.mjs";
+import { t as resumeCodexAppServerThread } from "./thread-resume-BkNpj9Pz.mjs";
+import { t as isSameCodexAppServerThreadOwner } from "./thread-ownership-skomxnIt.mjs";
+import { t as persistCodexContextCompactionActivity } from "./context-compaction-activity-CMla5FPJ.mjs";
+import { t as resolveCodexNativeExecutionBlock } from "./sandbox-guard-BBP-RbTf.mjs";
 import { asOptionalRecord } from "openclaw/plugin-sdk/string-coerce-runtime";
-import { resolveDefaultAgentId } from "openclaw/plugin-sdk/agent-scope-runtime";
 import { coerceErrorMessage } from "openclaw/plugin-sdk/error-runtime";
+import { AsyncLocalStorage } from "node:async_hooks";
 import { createDeferred } from "openclaw/plugin-sdk/extension-shared";
-import { resolveAgentDir as resolveAgentDir$1 } from "openclaw/plugin-sdk/agent-runtime";
+import { resolveAgentDir } from "openclaw/plugin-sdk/agent-runtime";
 import { embeddedAgentLog, resolveCompactionTimeoutMs } from "openclaw/plugin-sdk/agent-harness-runtime";
-import { AsyncLocalStorage } from "node:async_hooks";
 import { createDedupeCache } from "openclaw/plugin-sdk/dedupe-runtime";
 //#region extensions/codex/src/app-server/compact.ts
 const warnedIgnoredCompactionOverrides = createDedupeCache({
@@ -237,28 +235,15 @@ function warnIfIgnoringOpenClawCompactionOverrides(params) {
 	});
 }
 function readIgnoredCompactionOverridePaths(params) {
-	const ignored = /* @__PURE__ */ new Set();
-	for (const entry of readCompactionOverrideEntries(params)) {
-		const localProvider = typeof entry.record.provider === "string" ? entry.record.provider.trim() : "";
-		if (typeof entry.record.model === "string" && entry.record.model.trim()) ignored.add(`${entry.path}.compaction.model`);
-		if (typeof entry.record.thinkingLevel === "string" && entry.record.thinkingLevel.trim()) ignored.add(`${entry.path}.compaction.thinkingLevel`);
-		if (localProvider) ignored.add(`${entry.path}.compaction.provider`);
-	}
-	return [...ignored];
-}
-function readCompactionOverrideEntries(params) {
-	const entries = [];
-	const defaultRecord = asOptionalRecord(params.config?.agents?.defaults?.compaction);
-	if (defaultRecord) entries.push({
-		path: "agents.defaults",
-		record: defaultRecord
+	const compaction = asOptionalRecord(params.config?.agents?.defaults?.compaction);
+	return [
+		"model",
+		"thinkingLevel",
+		"provider"
+	].flatMap((field) => {
+		const value = compaction?.[field];
+		return typeof value === "string" && value.trim() ? [`agents.defaults.compaction.${field}`] : [];
 	});
-	return entries;
-}
-function readAgentIdFromSessionKey(sessionKey) {
-	const parts = sessionKey?.trim().toLowerCase().split(":").filter(Boolean) ?? [];
-	if (parts.length < 3 || parts[0] !== "agent") return;
-	return parts[1]?.trim() || void 0;
 }
 async function compactCodexNativeThread(params, options) {
 	if (params.trigger !== "manual" && !options.allowNonManualNativeRequest) {
@@ -344,13 +329,13 @@ async function compactCodexNativeThread(params, options) {
 	let connection;
 	try {
 		const config = params.config ?? {};
-		const agentId = params.agentId ?? readAgentIdFromSessionKey(params.sessionKey) ?? resolveDefaultAgentId(config);
-		connection = resolveCodexBindingAppServerConnection({
+		connection = await resolveCodexBindingAppServerConnection({
 			binding,
 			authProfileId: requestedAuthProfileId ?? binding.authProfileId,
 			pluginConfig: options.pluginConfig,
 			config,
-			agentDir: resolveAgentDir$1(config, agentId)
+			assertCurrent,
+			agentDir: resolveAgentDir(config, bindingIdentity.agentId)
 		});
 	} catch (error) {
 		return {

package/dist/{config-oIORaQ5T.js → .setup/config-CedDWjM-.mjs}

@@ -1,7 +1,8 @@
-import { c as readExecAsk, f as readRecord, l as readExecSecurity } from "./config-utils-DujwEnhg.js";
-import { p as canUseCodexModelBackedApprovalsReviewerForModel$1 } from "./config-options-CXMq1T-C.js";
-import "./protocol-5bh1G-H7.js";
-import "./config-runtime-D0zGNIHu.js";
+import { c as readExecAsk, f as readRecord, l as readExecSecurity } from "./config-utils-DujwEnhg.mjs";
+import "./config-security-BRQ2mgW9.mjs";
+import "./config-parsing-CcB9iPoq.mjs";
+import { c as canUseCodexModelBackedApprovalsReviewerForModel$1 } from "./config-options-BsanJ8QG.mjs";
+import "./config-runtime-CeAhl_h4.mjs";
 import { resolveAgentConfig } from "openclaw/plugin-sdk/agent-scope-runtime";
 import { execPolicy } from "openclaw/plugin-sdk/agent-harness-runtime";
 import { resolveExecApprovalsFromFile } from "openclaw/plugin-sdk/exec-approvals-runtime";