@openclaw/codex 2026.9.4 → 2026.9.5

package/dist/{attempt-notifications-C9XufG6l.js → .setup/event-projector-usage-C7Ntzs-f.mjs}

@@ -1,5 +1,6 @@
-import { o as isJsonObject } from "./protocol-5bh1G-H7.js";
-import { readStringField } from "openclaw/plugin-sdk/string-coerce-runtime";
+import { m as isJsonObject } from "./config-security-BRQ2mgW9.mjs";
+import { asSafeIntegerInRange, readStringField } from "openclaw/plugin-sdk/string-coerce-runtime";
+import { normalizeUsage } from "openclaw/plugin-sdk/agent-harness-runtime";
 //#region extensions/codex/src/app-server/attempt-notifications.ts
 const CODEX_TURN_ABORT_MARKER_START = "<turn_aborted>";
 const CODEX_TURN_ABORT_MARKER_END = "</turn_aborted>";
@@ -34,12 +35,6 @@ function isRawFunctionToolOutputCompletionNotification(notification) {
 	const item = isJsonObject(notification.params.item) ? notification.params.item : void 0;
 	return item ? readStringField(item, "type") === "function_call_output" : false;
 }
-/** Distinguishes progress-only assistant items from conversation answers. */
-function isAssistantCommentaryCompletionNotification(notification) {
-	if (!isJsonObject(notification.params) || notification.method !== "item/completed") return false;
-	const item = isJsonObject(notification.params.item) ? notification.params.item : void 0;
-	return Boolean(item && readStringField(item, "type") === "agentMessage" && (readStringField(item, "phase") === "commentary" || readStringField(item, "delivery") === "async"));
-}
 /** Returns true for terminal app-server thread status strings. */
 function isTerminalTurnStatus(status) {
 	return status === "completed" || status === "interrupted" || status === "failed";
@@ -106,4 +101,102 @@ function isNonEmptyString(value) {
 	return typeof value === "string" && value.length > 0;
 }
 //#endregion
-export { isRawFunctionToolOutputCompletionNotification as a, readNotificationItemId as c, isPendingOpenClawDynamicToolCompletionNotification as i, readRawResponseToolCallId as l, isAssistantCommentaryCompletionNotification as n, isTerminalTurnStatus as o, isCodexTurnAbortMarkerNotification as r, readCodexNotificationItem as s, codexExecutionToolName as t, updateActiveTurnItemIds as u };
+//#region extensions/codex/src/app-server/event-projector-usage.ts
+function readTokenCount(record, key) {
+	return asSafeIntegerInRange(record[key], { min: 0 });
+}
+function readCodexThreadTokenUsage(params) {
+	const tokenUsage = isJsonObject(params.tokenUsage) ? params.tokenUsage : void 0;
+	const last = tokenUsage && isJsonObject(tokenUsage.last) ? tokenUsage.last : void 0;
+	return last ? normalizeCodexResponseTokenUsage(last) : void 0;
+}
+function readCodexThreadContextSnapshot(params) {
+	const tokenUsage = isJsonObject(params.tokenUsage) ? params.tokenUsage : void 0;
+	const last = tokenUsage && isJsonObject(tokenUsage.last) ? tokenUsage.last : void 0;
+	const modelContextWindow = tokenUsage ? readTokenCount(tokenUsage, "modelContextWindow") : void 0;
+	const activeContextTokens = last ? readTokenCount(last, "totalTokens") : void 0;
+	const inputTokens = last ? readTokenCount(last, "inputTokens") : void 0;
+	const cachedInputTokens = last ? readTokenCount(last, "cachedInputTokens") : void 0;
+	const cacheWriteInputTokens = last ? readTokenCount(last, "cacheWriteInputTokens") : void 0;
+	const reasoningOutputTokens = last ? readTokenCount(last, "reasoningOutputTokens") : void 0;
+	return {
+		...activeContextTokens !== void 0 ? { activeContextTokens } : {},
+		...cachedInputTokens !== void 0 ? { cachedInputTokens } : {},
+		...cacheWriteInputTokens !== void 0 ? { cacheWriteInputTokens } : {},
+		...inputTokens !== void 0 ? { inputTokens } : {},
+		...modelContextWindow && modelContextWindow > 0 ? { modelContextWindow } : {},
+		...inputTokens !== void 0 ? { promptTokens: inputTokens } : {},
+		...reasoningOutputTokens !== void 0 ? { reasoningOutputTokens } : {}
+	};
+}
+function normalizeCodexResponseTokenUsage(record) {
+	const totalTokens = readTokenCount(record, "totalTokens");
+	const inputTokens = readTokenCount(record, "inputTokens");
+	const cacheRead = readTokenCount(record, "cachedInputTokens");
+	const output = readTokenCount(record, "outputTokens");
+	const reasoningTokens = readTokenCount(record, "reasoningOutputTokens");
+	const cacheWrite = record.cacheWriteInputTokens === void 0 ? 0 : readTokenCount(record, "cacheWriteInputTokens");
+	const hasCoherentInput = inputTokens !== void 0 && cacheRead !== void 0 && cacheWrite !== void 0 && cacheRead + cacheWrite <= inputTokens;
+	const hasCoherentContext = hasCoherentInput && totalTokens !== void 0 && output !== void 0 && totalTokens === inputTokens + output;
+	const usage = normalizeUsage({
+		input: hasCoherentInput ? inputTokens - cacheRead - cacheWrite : void 0,
+		output,
+		cacheRead,
+		cacheWrite,
+		reasoningTokens,
+		total: totalTokens
+	});
+	if (!usage) return;
+	return {
+		...usage,
+		contextUsage: hasCoherentContext ? {
+			state: "available",
+			promptTokens: inputTokens,
+			totalTokens
+		} : { state: "unavailable" }
+	};
+}
+var CodexUsageProjection = class {
+	constructor() {
+		this.responseIds = /* @__PURE__ */ new Set();
+	}
+	get usage() {
+		const usage = this.responseUsage ?? this.threadUsage;
+		return usage ? {
+			...usage,
+			contextUsage: this.contextUsage
+		} : void 0;
+	}
+	get modelIterations() {
+		return this.responseIds.size;
+	}
+	invalidateContext() {
+		this.contextUsage = { state: "unavailable" };
+	}
+	recordThread(params) {
+		const usage = readCodexThreadTokenUsage(params);
+		this.threadUsage = usage ?? this.threadUsage;
+		if (!this.responseUsage && usage) this.contextUsage = usage.contextUsage;
+		return readCodexThreadContextSnapshot(params);
+	}
+	record(params, reportOutputTokens) {
+		const responseId = readStringField(params, "responseId");
+		if (!responseId || this.responseIds.has(responseId)) return;
+		this.responseIds.add(responseId);
+		const usage = isJsonObject(params.usage) ? normalizeCodexResponseTokenUsage(params.usage) : void 0;
+		this.contextUsage = usage?.contextUsage ?? { state: "unavailable" };
+		this.responseUsage ??= {};
+		for (const field of [
+			"input",
+			"output",
+			"cacheRead",
+			"cacheWrite",
+			"reasoningTokens",
+			"total"
+		]) if (usage?.[field] !== void 0) this.responseUsage[field] = (this.responseUsage[field] ?? 0) + usage[field];
+		const outputTokens = usage?.output;
+		if (outputTokens !== void 0) reportOutputTokens?.(outputTokens);
+	}
+};
+//#endregion
+export { isPendingOpenClawDynamicToolCompletionNotification as a, readCodexNotificationItem as c, updateActiveTurnItemIds as d, isCodexTurnAbortMarkerNotification as i, readNotificationItemId as l, readCodexThreadContextSnapshot as n, isRawFunctionToolOutputCompletionNotification as o, codexExecutionToolName as r, isTerminalTurnStatus as s, CodexUsageProjection as t, readRawResponseToolCallId as u };

package/dist/{harness-C7rRa7bm.js → .setup/harness-rxaaoN-o.mjs}

@@ -1,5 +1,6 @@
-import { l as sessionBindingIdentity } from "./session-binding-record-Bcvslnhf.js";
-import { t as codexBuildSymbol } from "./build-state-BCmg9-5p.js";
+import { CODEX_NATIVE_TOOL_REQUIREMENTS } from "../native-tool-policy.js";
+import { p as sessionBindingIdentity } from "./session-binding-record-TH3xA0zj.mjs";
+import { t as codexBuildSymbol } from "./build-state-Xx9ybZqa.mjs";
 import { resolvePluginConfigObject } from "openclaw/plugin-sdk/plugin-config-runtime";
 import { normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
 //#region extensions/codex/src/app-server/model-runtime.ts
@@ -73,6 +74,7 @@ function createCodexAppServerAgentHarness(options) {
 		contextEngineHostCapabilities: CODEX_APP_SERVER_CONTEXT_ENGINE_HOST_CAPABILITIES,
 		conversationToolPolicySupport: "exact",
 		conversationToolPolicySafeDenyTools: CODEX_TOOL_POLICY_SAFE_DENY_NAMES,
+		conversationToolPolicyNativeTools: CODEX_NATIVE_TOOL_REQUIREMENTS,
 		deliveryDefaults: { visibleReplies: "message_tool" },
 		authBootstrap: "harness",
 		resolveSessionRuntimeOwnership: (params) => {
@@ -103,7 +105,7 @@ function createCodexAppServerAgentHarness(options) {
 		...sessionCatalogControlFactory && sessionRuntime ? { sessionFork: {
 			upstreamKinds: ["codex-app-server"],
 			fork: async (params) => {
-				const { forkCodexUpstreamSession } = await import("./upstream-session-fork-BZerMte_.js");
+				const { forkCodexUpstreamSession } = await import("./upstream-session-fork-D3UKxgVD.mjs");
 				return await forkCodexUpstreamSession(params, {
 					bindingStore: options.bindingStore,
 					controlFactory: sessionCatalogControlFactory,
@@ -116,7 +118,7 @@ function createCodexAppServerAgentHarness(options) {
 		taskHistory: {
 			taskKinds: ["codex-native"],
 			read: async (params) => {
-				const { readCodexNativeSubagentHistory } = await import("./native-subagent-history-DjtPloaU.js");
+				const { readCodexNativeSubagentHistory } = await import("./native-subagent-history-YXaL6dMd.mjs");
 				const assertCurrent = () => {
 					params.assertCurrent();
 					if (disposed) throw new Error("Agent harness is disposed");
@@ -131,26 +133,26 @@ function createCodexAppServerAgentHarness(options) {
 			}
 		},
 		authBinding: { fingerprint: async (params) => {
-			const { fingerprintCodexAppServerAuthBinding } = await import("./auth-binding-CWlKVccJ.js").then((n) => n.t);
+			const { fingerprintCodexAppServerAuthBinding } = await import("./auth-binding-DhLWa_7K.mjs").then((n) => n.t);
 			return fingerprintCodexAppServerAuthBinding(params);
 		} },
 		runtimeArtifact: { validate: async (binding) => {
-			const { validateCodexAppServerRuntimeArtifact } = await import("./runtime-artifact-BJ0rXBZ_.js");
+			const { validateCodexAppServerRuntimeArtifact } = await import("./runtime-artifact-Dy38Z5iU.mjs");
 			return validateCodexAppServerRuntimeArtifact(binding);
 		} },
 		fetchUsageSnapshot: async (ctx) => {
-			const { fetchCodexAppServerUsageSnapshot } = await import("./usage-tCk-mg_x.js");
+			const { fetchCodexAppServerUsageSnapshot } = await import("./usage-BOgBEKso.mjs");
 			return await fetchCodexAppServerUsageSnapshot(ctx, { pluginConfig: options?.resolvePluginConfig?.() ?? options?.pluginConfig });
 		},
 		loadModelCatalog: async (params) => {
-			const { createCodexAppServerModelCatalog } = await import("./model-catalog-Dq2n8f_p.js");
+			const { createCodexAppServerModelCatalog } = await import("./model-catalog-DkvUuBey.mjs");
 			if (disposed) return [];
 			modelCatalog ??= createCodexAppServerModelCatalog(harnessRuntimeId);
 			return await modelCatalog.load(params, resolveAttemptPluginConfig(params.config));
 		},
 		readModelCatalogReadiness: (params) => modelCatalog?.read(params, resolveAttemptPluginConfig(params.config)),
 		loadMcpToolCatalog: async (params) => {
-			const { loadCodexEffectiveMcpCatalog } = await import("./effective-mcp-catalog-Bd73bqA8.js");
+			const { loadCodexEffectiveMcpCatalog } = await import("./effective-mcp-catalog-K6kLCN8X.mjs");
 			return await loadCodexEffectiveMcpCatalog(params, { bindingStore: options.bindingStore });
 		},
 		supports: (ctx) => {
@@ -193,21 +195,73 @@ function createCodexAppServerAgentHarness(options) {
 			};
 		},
 		runAttempt: async (params) => {
-			const { runCodexAppServerAttempt } = await import("./run-attempt-CvsAAGa0.js");
-			return runCodexAppServerAttempt(params, {
+			const { runCodexAppServerAttempt } = await import("./run-attempt-rlA07pUv.mjs");
+			const { planCodexCyberEscalation, readCodexCyberAttemptVerdict, recordCodexCyberTargetUnavailable, reserveCodexCyberProbe, resolveCodexCyberFailoverConfig } = await import("./cyber-failover-DYwbmf1o.mjs");
+			const { emitCodexCyberNotice } = await import("./cyber-failover-notice-e9G3J9-e.mjs");
+			const pluginConfig = resolveAttemptPluginConfig(params.config);
+			const attemptModel = readCodexRuntimeModelId(params.model, params.modelId);
+			const runAttemptOnModel = (model, isRetry = false) => runCodexAppServerAttempt(isRetry ? {
+				...params,
+				suppressNextUserMessagePersistence: true
+			} : params, {
 				bindingStore: options.bindingStore,
-				pluginConfig: resolveAttemptPluginConfig(params.config),
+				pluginConfig,
 				runtime: sessionRuntime,
-				runtimeModelId: readCodexRuntimeModelId(params.model, params.modelId),
+				runtimeModelId: model,
 				nativeHookRelay: { enabled: true }
 			});
+			const cyberFailover = resolveCodexCyberFailoverConfig(pluginConfig);
+			const workspace = {
+				agentId: params.agentId,
+				authProfileId: params.authProfileId
+			};
+			const result = await runAttemptOnModel(attemptModel);
+			const refusal = readCodexCyberAttemptVerdict(result);
+			if (!refusal.cyberRefused) return result;
+			const plan = planCodexCyberEscalation({
+				config: cyberFailover,
+				currentModel: attemptModel,
+				replaySafe: refusal.replaySafe,
+				workspace
+			});
+			if (plan.kind !== "escalate") {
+				if (plan.reason === "target_unavailable") await emitCodexCyberNotice(params, {
+					state: "unavailable",
+					model: attemptModel,
+					fallbackModel: cyberFailover.model
+				});
+				return result;
+			}
+			const releaseProbe = reserveCodexCyberProbe({
+				model: plan.model,
+				workspace
+			});
+			let escalated;
+			try {
+				escalated = await runAttemptOnModel(plan.model, true);
+			} finally {
+				releaseProbe();
+			}
+			const outcome = readCodexCyberAttemptVerdict(escalated);
+			if (outcome.unavailable) recordCodexCyberTargetUnavailable({
+				model: plan.model,
+				workspace,
+				cooloffMs: cyberFailover.cooloffMs
+			});
+			if (outcome.answered || outcome.unavailable) await emitCodexCyberNotice(params, {
+				state: outcome.answered ? "escalated" : "unavailable",
+				model: attemptModel,
+				fallbackModel: plan.model
+			});
+			if (outcome.unavailable && outcome.replaySafe && escalated.terminal.kind === "failed" && escalated.toolMetas.length === 0) return result;
+			return escalated;
 		},
 		runIsolatedCompletionV2: async (params) => {
 			if (params.authorization.owner === "host") {
 				const { runHostPreparedIsolatedCompletion } = await import("openclaw/plugin-sdk/simple-completion-runtime");
 				return runHostPreparedIsolatedCompletion(params);
 			}
-			const { runCodexIsolatedCompletion } = await import("./isolated-completion-DWVb5U2J.js");
+			const { runCodexIsolatedCompletion } = await import("./isolated-completion-B6srt48J.mjs");
 			return runCodexIsolatedCompletion(params, { pluginConfig: options?.resolvePluginConfig?.() ?? options?.pluginConfig });
 		},
 		runIsolatedCompletion: async (params) => {
@@ -223,11 +277,11 @@ function createCodexAppServerAgentHarness(options) {
 			});
 		},
 		finalizeSettledTurn: async (params) => {
-			const { runCodexSettledTurnFinalization } = await import("./settled-turn-finalizer-Dn91stmc.js");
+			const { runCodexSettledTurnFinalization } = await import("./settled-turn-finalizer-CiY2bLFK.mjs");
 			return runCodexSettledTurnFinalization(params, { pluginConfig: options?.resolvePluginConfig?.() ?? options?.pluginConfig });
 		},
 		runSideQuestion: async (params) => {
-			const { runCodexAppServerSideQuestion } = await import("./side-question-BGMJQf4U.js");
+			const { runCodexAppServerSideQuestion } = await import("./side-question-DSCZyoBD.mjs");
 			return runCodexAppServerSideQuestion(params, {
 				bindingStore: options.bindingStore,
 				pluginConfig: options?.resolvePluginConfig?.() ?? options?.pluginConfig,
@@ -237,20 +291,20 @@ function createCodexAppServerAgentHarness(options) {
 			});
 		},
 		compact: async (params) => {
-			const { maybeCompactCodexAppServerSession } = await import("./compact-B_H3AOd7.js");
+			const { maybeCompactCodexAppServerSession } = await import("./compact-C3i3qlzj.mjs");
 			return maybeCompactCodexAppServerSession(params, {
 				bindingStore: options.bindingStore,
 				pluginConfig: options?.resolvePluginConfig?.() ?? options?.pluginConfig
 			});
 		},
 		withSessionDeletion: async (params, run) => {
-			const { withCodexAppServerSessionDeletion } = await import("./session-retirement-B2YfbAAT.js");
+			const { withCodexAppServerSessionDeletion } = await import("./session-retirement-CU87AOg9.mjs");
 			params.assertCurrent();
 			return withCodexAppServerSessionDeletion(options.bindingStore, params, run);
 		},
 		reset: async (params) => {
 			if (params.sessionId && params.reason !== "deleted") {
-				const [{ reclaimCurrentCodexSessionGeneration }, { retireCodexAppServerSessionGeneration }] = await Promise.all([import("./session-binding-CI8UuilT.js").then((n) => n.c), import("./session-retirement-B2YfbAAT.js")]);
+				const [{ reclaimCurrentCodexSessionGeneration }, { retireCodexAppServerSessionGeneration }] = await Promise.all([import("./session-binding-_0W_fHRr.mjs").then((n) => n.c), import("./session-retirement-CU87AOg9.mjs")]);
 				const identity = sessionBindingIdentity({
 					agentId: params.agentId,
 					sessionId: params.sessionId,
@@ -282,7 +336,7 @@ function createCodexAppServerAgentHarness(options) {
 /** Creates the private native-compaction bridge registered in host-owned capability state. */
 function createCodexAppServerNativeCompaction(options) {
 	return async (params) => {
-		const { maybeCompactCodexAppServerSession } = await import("./compact-B_H3AOd7.js");
+		const { maybeCompactCodexAppServerSession } = await import("./compact-C3i3qlzj.mjs");
 		return maybeCompactCodexAppServerSession(params, {
 			bindingStore: options.bindingStore,
 			pluginConfig: options.resolvePluginConfig?.() ?? options.pluginConfig,

package/dist/{inference-context-Dr_mzvk4.js → .setup/inference-context-fulhZuz8.mjs}

@@ -1,4 +1,4 @@
-import { o as isJsonObject } from "./protocol-5bh1G-H7.js";
+import { m as isJsonObject } from "./config-security-BRQ2mgW9.mjs";
 import { randomUUID } from "node:crypto";
 //#region extensions/codex/src/app-server/inference-context.ts
 const MAX_CONTEXT_BYTES = 262144;

package/dist/{inference-proxy-HGXKUIre.js → .setup/inference-proxy-CC15HuSi.mjs}

@@ -1,9 +1,9 @@
-import { o as isJsonObject } from "./protocol-5bh1G-H7.js";
-import { n as createCodexInferenceContext } from "./inference-context-Dr_mzvk4.js";
-import { zstdCompress, zstdDecompress } from "node:zlib";
+import { m as isJsonObject } from "./config-security-BRQ2mgW9.mjs";
+import { n as createCodexInferenceContext } from "./inference-context-fulhZuz8.mjs";
 import { promisify } from "node:util";
+import { zstdCompress, zstdDecompress } from "node:zlib";
 import { Writable } from "node:stream";
-import WebSocket, { WebSocketServer } from "ws";
+import { WebSocket, WebSocketServer } from "openclaw/plugin-sdk/websocket-runtime";
 import { createServer } from "node:http";
 import { createNodeProxyAgent } from "openclaw/plugin-sdk/fetch-runtime";
 import { generateSecureToken } from "openclaw/plugin-sdk/secure-random-runtime";

package/dist/{isolated-completion-DWVb5U2J.js → .setup/isolated-completion-B6srt48J.mjs}

@@ -1,10 +1,10 @@
-import { i as resolveCodexAppServerHomeScope } from "./config-options-CXMq1T-C.js";
-import { x as readCodexPluginConfig } from "./protocol-5bh1G-H7.js";
-import { g as assertCodexPassiveTurnItems } from "./client-B57KWPQx.js";
-import "./config-oIORaQ5T.js";
-import { tt as resolveCodexAppServerPreparedAuthHandoff } from "./shared-client-CscigXXL.js";
-import { runBoundedCodexAppServerTurn } from "./bounded-turn-C_Hneydj.js";
-import { a as createAttributedCodexAssistantMessage } from "./event-projector-assistant-message-BmBM4qBV.js";
+import { d as readCodexPluginConfig } from "./config-parsing-CcB9iPoq.mjs";
+import { g as assertCodexPassiveTurnItems } from "./client-vXs2929Q.mjs";
+import { i as resolveCodexAppServerHomeScope } from "./config-options-BsanJ8QG.mjs";
+import "./config-CedDWjM-.mjs";
+import { Z as resolveCodexAppServerPreparedAuthHandoff } from "./shared-client-BpTtuLQ5.mjs";
+import { runBoundedCodexAppServerTurn } from "./bounded-turn-BtlZcivC.mjs";
+import { a as createAttributedCodexAssistantMessage } from "./event-projector-assistant-message-DNUR1s0A.mjs";
 //#region extensions/codex/src/app-server/isolated-completion.ts
 /** Runs prompt-only Codex inference on an ephemeral, ring-zero native thread. */
 async function runCodexIsolatedCompletion(params, options) {

package/dist/{launch-args-RXQwn8zV.js → .setup/launch-args-DnMak49W.mjs}

@@ -55,6 +55,27 @@ function readCodexArgs(args) {
 	}
 	return tokens;
 }
+/** Uses the native CLI configuration for status without starting its transport. */
+function buildCodexLoginStatusArgs(args) {
+	const options = /* @__PURE__ */ new Set([
+		"-c",
+		"--config",
+		"-p",
+		"--profile",
+		"--enable",
+		"--disable"
+	]);
+	const tokens = readCodexArgs(args);
+	const subcommandIndex = tokens.findLast(({ name }) => name === "app-server")?.index ?? -1;
+	const prefix = subcommandIndex < 0 ? [] : args.slice(0, subcommandIndex);
+	const configArgs = tokens.filter(({ index, name }) => index > subcommandIndex && options.has(name)).flatMap(({ index, end }) => args.slice(index, end));
+	return [
+		...prefix,
+		...configArgs,
+		"login",
+		"status"
+	];
+}
 function readCodexAppServerConfigOptions(args) {
 	return readCodexArgs(args).filter(({ name }) => name === "-c" || name === "--config" || name === "-p" || name === "--profile");
 }
@@ -87,4 +108,4 @@ function normalizeCodexAppServerArgs(rawArgs, enforcedOverride) {
 	return normalized.length === rawArgs.length && normalized.every((arg, index) => arg === rawArgs[index]) ? rawArgs : normalized;
 }
 //#endregion
-export { normalizeCodexAppServerArgs as n, readCodexAppServerConfigOptions as r, isCodexAppServerProxyLaunch as t };
+export { readCodexAppServerConfigOptions as i, isCodexAppServerProxyLaunch as n, normalizeCodexAppServerArgs as r, buildCodexLoginStatusArgs as t };

package/dist/{managed-binary-D22rNEcR.js → .setup/managed-binary-DP6Rib3P.mjs}

@@ -1,5 +1,5 @@
-import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
-import { n as MANAGED_CODEX_APP_SERVER_PACKAGE } from "./version-omm6IPI3.js";
+import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.mjs";
+import { n as MANAGED_CODEX_APP_SERVER_PACKAGE } from "./version-CoqzXPgK.mjs";
 import { createRequire } from "node:module";
 import { constants, existsSync, realpathSync } from "node:fs";
 import path from "node:path";

package/dist/{managed-thread-store-D1t5jh3G.js → .setup/managed-thread-store-BMqgThVL.mjs}

@@ -28,10 +28,53 @@ function managedThreadStoreKey(sourceHomeId, threadId) {
 }
 /** Durable ownership index for Codex threads created by OpenClaw. */
 function createCodexManagedThreadStore(state) {
+	const byHome = /* @__PURE__ */ new Map();
+	const memberships = /* @__PURE__ */ new Map();
+	let hydration;
+	const remember = ({ sourceHomeId, threadId }) => {
+		const key = managedThreadStoreKey(sourceHomeId, threadId);
+		if (memberships.has(key)) return key;
+		memberships.set(key, {
+			sourceHomeId,
+			threadId
+		});
+		let ids = byHome.get(sourceHomeId);
+		if (!ids) {
+			ids = /* @__PURE__ */ new Set();
+			byHome.set(sourceHomeId, ids);
+		}
+		ids.add(threadId);
+		if (memberships.size > 2e4) {
+			const oldest = memberships.entries().next().value;
+			if (oldest) {
+				memberships.delete(oldest[0]);
+				const oldestHome = byHome.get(oldest[1].sourceHomeId);
+				oldestHome?.delete(oldest[1].threadId);
+				if (oldestHome?.size === 0) byHome.delete(oldest[1].sourceHomeId);
+			}
+		}
+		return key;
+	};
+	const snapshot = async () => {
+		hydration ??= state.entries().then((entries) => {
+			const marked = new Map(memberships);
+			memberships.clear();
+			byHome.clear();
+			for (const entry of entries.toSorted((a, b) => a.createdAt - b.createdAt)) {
+				const parsed = managedThreadSchema.safeParse(entry.value);
+				if (parsed.success) marked.delete(remember(parsed.data));
+			}
+			for (const membership of marked.values()) remember(membership);
+		}).catch((error) => {
+			hydration = void 0;
+			throw error;
+		});
+		await hydration;
+		return byHome;
+	};
 	return {
 		async has(sourceHomeId, threadId) {
-			const parsed = managedThreadSchema.safeParse(state.lookup(managedThreadStoreKey(sourceHomeId, threadId)));
-			return parsed.success && parsed.data.sourceHomeId === sourceHomeId && parsed.data.threadId === threadId;
+			return (await snapshot()).get(sourceHomeId)?.has(threadId) ?? false;
 		},
 		async mark(params) {
 			try {
@@ -42,24 +85,15 @@ function createCodexManagedThreadStore(state) {
 					threadId: params.threadId.trim(),
 					...params.rolloutPath?.trim() ? { rolloutPath: params.rolloutPath.trim() } : {}
 				});
-				state.registerIfAbsent(managedThreadStoreKey(value.sourceHomeId, value.threadId), value);
+				await state.registerIfAbsent(managedThreadStoreKey(value.sourceHomeId, value.threadId), value);
+				remember(value);
 				return true;
 			} catch (error) {
 				embeddedAgentLog.warn("failed to record Codex managed thread ownership", { error });
 				return false;
 			}
 		},
-		async snapshot() {
-			const byHome = /* @__PURE__ */ new Map();
-			for (const entry of state.entries()) {
-				const parsed = managedThreadSchema.safeParse(entry.value);
-				if (!parsed.success) continue;
-				const ids = byHome.get(parsed.data.sourceHomeId) ?? /* @__PURE__ */ new Set();
-				ids.add(parsed.data.threadId);
-				byHome.set(parsed.data.sourceHomeId, ids);
-			}
-			return byHome;
-		}
+		snapshot
 	};
 }
 //#endregion

package/dist/{model-catalog-Dq2n8f_p.js → .setup/model-catalog-DkvUuBey.mjs}

@@ -1,9 +1,13 @@
-import { r as buildCodexRuntimeModelParams } from "./harness-C7rRa7bm.js";
-import { o as isJsonObject, x as readCodexPluginConfig } from "./protocol-5bh1G-H7.js";
-import { o as withCodexAppServerJsonClient } from "./request-B7hEkBGq.js";
-import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-D0zGNIHu.js";
-import { r as captureSharedCodexAppServerCatalogLifetime } from "./shared-client-CscigXXL.js";
-import { t as listAllCodexAppServerModels } from "./models-PCKOim-h.js";
+import { r as buildCodexRuntimeModelParams } from "./harness-rxaaoN-o.mjs";
+import { m as isJsonObject } from "./config-security-BRQ2mgW9.mjs";
+import { d as readCodexPluginConfig } from "./config-parsing-CcB9iPoq.mjs";
+import { n as isCodexAppServerProxyLaunch } from "./launch-args-DnMak49W.mjs";
+import { o as withCodexAppServerJsonClient } from "./request-BioXJLYa.mjs";
+import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-CeAhl_h4.mjs";
+import { a as resolveCodexAppServerAuthProfileStore, r as resolveCodexAppServerAuthProfileId } from "./auth-profile-WqZtZfXN.mjs";
+import { r as captureSharedCodexAppServerCatalogLifetime } from "./shared-client-BpTtuLQ5.mjs";
+import { t as listAllCodexAppServerModels } from "./models-BDFgm_G-.mjs";
+import { probeCodexNativeAuth } from "./native-auth-BLZGqFjw.mjs";
 //#region extensions/codex/src/app-server/model-catalog.ts
 const DEFAULT_MODEL_DISCOVERY_TIMEOUT_MS = 2500;
 const INPUT_TYPES = /* @__PURE__ */ new Set([
@@ -51,7 +55,10 @@ function createCodexAppServerModelCatalog(runtime) {
 		},
 		read(params, pluginConfig) {
 			const observation = scopes.get(params.config)?.get(scopeKey(params));
-			return !disposed && params.provider === "openai" && observation !== void 0 && observation.pluginConfig === pluginConfig && observation.models?.has(params.modelId) && observation.accountType && observation.isCurrent?.() ? { accountType: observation.accountType } : void 0;
+			return !disposed && params.provider === "openai" && observation !== void 0 && observation.pluginConfig === pluginConfig && observation.models?.has(params.modelId) && observation.accountType && observation.isCurrent?.() ? {
+				accountType: observation.accountType,
+				...observation.authMode ? { authMode: observation.authMode } : {}
+			} : void 0;
 		},
 		async load(params, pluginConfig) {
 			if (disposed) return [];
@@ -65,13 +72,30 @@ function createCodexAppServerModelCatalog(runtime) {
 			observations.set(key, observation);
 			const discovery = readCodexPluginConfig(pluginConfig).discovery;
 			if (discovery?.enabled === false) return [];
-			const { start } = resolveCodexAppServerRuntimeOptions({ pluginConfig });
+			const options = resolveCodexAppServerRuntimeOptions({ pluginConfig });
+			const ownsLocalProcess = options.start.transport === "stdio" && !isCodexAppServerProxyLaunch(options.start.args);
+			const authProfileStore = ownsLocalProcess && options.start.homeScope === "agent" ? resolveCodexAppServerAuthProfileStore({
+				agentDir: params.agentDir,
+				config: params.config
+			}) : void 0;
+			const authProfileId = authProfileStore ? resolveCodexAppServerAuthProfileId({
+				store: authProfileStore,
+				config: params.config
+			}) : void 0;
+			const usesNativeHome = ownsLocalProcess && options.start.homeScope === "user";
+			const native = usesNativeHome ? await probeCodexNativeAuth({ pluginConfig }) : void 0;
+			if (usesNativeHome && !native || disposed || observations.get(key) !== observation) return [];
+			const { start } = options;
 			const timeoutMs = discovery?.timeoutMs ?? DEFAULT_MODEL_DISCOVERY_TIMEOUT_MS;
 			const result = await withCodexAppServerJsonClient({
 				startOptions: start,
 				config: params.config,
 				agentDir: params.agentDir,
-				timeoutMs
+				timeoutMs,
+				...authProfileStore ? {
+					authProfileStore,
+					authProfileId
+				} : {}
 			}, async (request, client) => {
 				const isCurrent = captureSharedCodexAppServerCatalogLifetime(client);
 				const models = (await listAllCodexAppServerModels({
@@ -92,8 +116,9 @@ function createCodexAppServerModelCatalog(runtime) {
 			});
 			if (disposed || observations.get(key) !== observation || !result.isCurrent()) return [];
 			observation.models = new Set(result.models.map((model) => model.id));
-			observation.accountType = result.accountType;
+			observation.accountType = !usesNativeHome || native?.mode === "api-key" && result.accountType === "apiKey" || (native?.mode === "oauth" || native?.mode === "token") && result.accountType === "chatgpt" ? result.accountType : void 0;
 			observation.isCurrent = result.isCurrent;
+			observation.authMode = observation.accountType === "apiKey" ? "api_key" : observation.accountType === "chatgpt" && (native?.mode === "oauth" || native?.mode === "token") ? native.mode : void 0;
 			return codexAppServerModelsToCatalogEntries(result.models, runtime);
 		}
 	};

package/dist/{models-PCKOim-h.js → .setup/models-BDFgm_G-.mjs}

@@ -1,4 +1,4 @@
-import { h as assertCodexModelListResponse } from "./client-B57KWPQx.js";
+import { h as assertCodexModelListResponse } from "./client-vXs2929Q.mjs";
 import { normalizeOptionalString, uniqueStrings } from "openclaw/plugin-sdk/string-coerce-runtime";
 //#region extensions/codex/src/app-server/models.ts
 /**
@@ -37,8 +37,8 @@ async function withCodexAppServerModelRequest(options, run) {
 	if (options.request) return await run(options.request);
 	const timeoutMs = options.timeoutMs ?? 2500;
 	const useSharedClient = options.sharedClient !== false;
-	const { createIsolatedCodexAppServerClient, getLeasedSharedCodexAppServerClient, releaseLeasedSharedCodexAppServerClient } = await import("./shared-client-CscigXXL.js").then((n) => n.y);
-	const { requestCodexAppServerClientJson } = await import("./request-B7hEkBGq.js").then((n) => n.a);
+	const { createIsolatedCodexAppServerClient, getLeasedSharedCodexAppServerClient, releaseLeasedSharedCodexAppServerClient } = await import("./shared-client-BpTtuLQ5.mjs").then((n) => n.y);
+	const { requestCodexAppServerClientJson } = await import("./request-BioXJLYa.mjs").then((n) => n.a);
 	const client = await (useSharedClient ? getLeasedSharedCodexAppServerClient : createIsolatedCodexAppServerClient)({
 		startOptions: options.startOptions,
 		timeoutMs,

package/dist/.setup/native-auth-BLZGqFjw.mjs

@@ -0,0 +1,57 @@
+import { d as readCodexPluginConfig } from "./config-parsing-CcB9iPoq.mjs";
+import { n as isCodexAppServerProxyLaunch, t as buildCodexLoginStatusArgs } from "./launch-args-DnMak49W.mjs";
+import { r as resolveManagedCodexAppServerStartOptions } from "./managed-binary-DP6Rib3P.mjs";
+import { n as resolveCodexAppServerSpawnEnv } from "./transport-stdio-Cmx94Oiy.mjs";
+import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-CeAhl_h4.mjs";
+import { runUtf8CommandWithTimeout } from "openclaw/plugin-sdk/process-runtime";
+import { materializeWindowsSpawnProgram, resolveWindowsSpawnProgram } from "openclaw/plugin-sdk/windows-spawn";
+//#region extensions/codex/src/app-server/native-auth.ts
+const OPENAI_LOGIN_MODES = {
+	"Logged in using ChatGPT": "oauth",
+	"Logged in using access token": "token",
+	"Logged in using personal access token": "token"
+};
+/** Ask the selected native binary about its own store; retain no credential material. */
+async function probeCodexNativeAuth(params) {
+	params.signal?.throwIfAborted();
+	try {
+		const pluginConfig = readCodexPluginConfig(params.pluginConfig ?? params.config?.plugins?.entries?.codex?.config);
+		const options = resolveCodexAppServerRuntimeOptions({
+			pluginConfig,
+			env: params.env
+		});
+		if (options.start.transport !== "stdio" || options.start.homeScope !== "user" || isCodexAppServerProxyLaunch(options.start.args)) return;
+		const start = await resolveManagedCodexAppServerStartOptions(options.start, { pluginRoot: params.pluginRoot });
+		if (start.transport !== "stdio") return;
+		const env = resolveCodexAppServerSpawnEnv(start, params.env ?? process.env);
+		const invocation = materializeWindowsSpawnProgram(resolveWindowsSpawnProgram({
+			command: start.command,
+			env,
+			packageName: "@openai/codex"
+		}), buildCodexLoginStatusArgs(start.args));
+		const result = await runUtf8CommandWithTimeout([invocation.command, ...invocation.argv], {
+			baseEnv: env,
+			timeoutMs: 3e3,
+			signal: params.signal,
+			killProcessTree: true
+		});
+		params.signal?.throwIfAborted();
+		if (result.termination !== "exit" || result.code !== 0) return;
+		const line = `${result.stdout}\n${result.stderr}`.split("\n").map((value) => value.trim()).find((value) => value.startsWith("Logged in using "));
+		const mode = line?.startsWith("Logged in using an API key - ") ? "api-key" : line ? OPENAI_LOGIN_MODES[line] : void 0;
+		return mode ? {
+			apiKey: "codex-app-server",
+			source: "Codex native login",
+			mode,
+			nativeAuth: {
+				runtime: "codex",
+				mode
+			}
+		} : void 0;
+	} catch {
+		params.signal?.throwIfAborted();
+		return;
+	}
+}
+//#endregion
+export { probeCodexNativeAuth };