@openclaw/codex 2026.9.4 → 2026.9.6

package/dist/{shared-client-CscigXXL.js → .setup/shared-client-DA4VR4Eb.mjs}

@@ -1,32 +1,109 @@
-import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
-import { n as defineCodexBuildState, t as codexBuildSymbol } from "./build-state-BCmg9-5p.js";
-import { t as CODEX_APP_SERVER_AUTH_PROVIDER } from "./auth-profile-selection-DFu9e167.js";
-import { a as resolveCodexAppServerStartOptionsForAgent, g as readCodexEffectiveConfig, h as CODEX_SESSION_OVERRIDABLE_LAYER_TYPES, o as resolveCodexComputerUseConfig, t as codexAppServerStartOptionsKey } from "./config-options-CXMq1T-C.js";
-import { c as resolveCodexAppServerLocalHomeDir, l as resolveCodexAppServerUserHomeDir, o as isJsonObject, s as resolveCodexAppServerHomeDir, u as withEphemeralCodexAuthStore } from "./protocol-5bh1G-H7.js";
-import { t as isCodexAppServerProxyLaunch } from "./launch-args-RXQwn8zV.js";
-import { f as isUnsupportedCodexAppServerVersionError, t as CodexAppServerClient } from "./client-B57KWPQx.js";
-import { c as resolveMacOSDesktopCodexAppPathCandidates, i as resolveManagedCodexNativeCommand, l as resolveMacOSDesktopCodexBundledMarketplaceCandidates, r as resolveManagedCodexAppServerStartOptions, s as resolveFirstExistingMacOSDesktopCodexBundledMarketplacePath, t as isManagedCodexDesktopCommand, u as resolveMacOSDesktopCodexComputerUseServiceAppCandidates } from "./managed-binary-D22rNEcR.js";
-import { _ as isCodexDesktopGenerationCurrent, a as readCodexCliAuthFileApiKey, c as resolveCodexAppServerPreparedApiKeyCacheKey, d as createCodexAppServerStartupLifetime, f as getCurrentSharedClientEntry, i as fingerprintTokenAuthProfileCacheKey, l as closeRetiredSharedClientEntry, m as retireSharedCodexAppServerClientIfCurrent, n as CODEX_AUTH_JSON_FILENAME, o as readFirstNonEmptyEnv, p as getSharedCodexAppServerClientState, r as fingerprintApiKeyAuthProfileCacheKey, s as resolveCodexAppServerFallbackApiKeyCacheKey, t as CODEX_APP_SERVER_API_KEY_ENV_VARS, u as closeRetiredSharedClientEntryIfIdle, v as waitForCodexDesktopGeneration } from "./auth-cache-key-7orQae_j.js";
-import { n as resolveCodexAppServerSpawnEnv } from "./transport-stdio-BGjHoYLr.js";
-import { n as withTimeout } from "./timeout-BVw8aaM1.js";
-import { n as readCodexSessionMeta } from "./session-catalog-provenance-D-dIfRAH.js";
-import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-D0zGNIHu.js";
-import { a as resolveCodexAppServerAuthProfileStore, i as resolveCodexAppServerAuthProfileIdForAgent, r as resolveCodexAppServerAuthProfileId, t as isCodexAppServerNativeAuthProfile } from "./auth-profile-CwzO4_RG.js";
+import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.mjs";
+import { n as defineCodexBuildState, t as codexBuildSymbol } from "./build-state-C7EnDVgr.mjs";
+import { t as CODEX_APP_SERVER_AUTH_PROVIDER } from "./auth-profile-selection-DFu9e167.mjs";
+import { d as resolveCodexAppServerHomeDir, f as resolveCodexAppServerLocalHomeDir, h as withEphemeralCodexAuthStore, m as withClearedEnvironmentVariables, p as resolveCodexAppServerUserHomeDir } from "./config-security-BEReZ6go.mjs";
+import { n as isCodexAppServerProxyLaunch } from "./launch-args-DbFCehO7.mjs";
+import { i as isJsonObject } from "./protocol-CANUwXJ3.mjs";
+import { a as resolveCodexAppServerStartOptionsForAgent, d as readCodexEffectiveConfig, o as resolveCodexComputerUseConfig, t as codexAppServerStartOptionsKey, u as CODEX_SESSION_OVERRIDABLE_LAYER_TYPES } from "./config-options-BvaRs51b.mjs";
+import { d as resolveMacOSDesktopCodexBundledMarketplaceCandidates, f as resolveMacOSDesktopCodexComputerUseServiceAppCandidates, i as resolveManagedCodexNativeCommand, l as resolveFirstExistingMacOSDesktopCodexBundledMarketplacePath, r as resolveManagedCodexAppServerStartOptions, t as isManagedCodexDesktopCommand, u as resolveMacOSDesktopCodexAppPathCandidates } from "./managed-binary-BnshlFag.mjs";
+import { a as readCodexCliAuthFileApiKey, c as resolveCodexAppServerPreparedApiKeyCacheKey, d as waitForCodexDesktopGeneration, i as fingerprintTokenAuthProfileCacheKey, n as CODEX_AUTH_JSON_FILENAME, o as readFirstNonEmptyEnv, r as fingerprintApiKeyAuthProfileCacheKey, s as resolveCodexAppServerFallbackApiKeyCacheKey, t as CODEX_APP_SERVER_API_KEY_ENV_VARS, u as isCodexDesktopGenerationCurrent } from "./auth-cache-key-B2mpaI9D.mjs";
+import { d as createCodexAppServerStartupLifetime, f as getCurrentSharedClientEntry, h as retireSharedCodexAppServerClientIfCurrent, l as closeRetiredSharedClientEntry, n as observeCodexCatalogClient, o as readCodexSessionMeta, p as getSharedCodexAppServerClientState, u as closeRetiredSharedClientEntryIfIdle } from "./session-catalog-events-Bj6j94E_.mjs";
+import { n as resolveCodexAppServerSpawnEnv } from "./transport-stdio-h2VHOskC.mjs";
+import { n as CodexAppServerAuthProfileUnavailableError, r as formatCodexAuthProfileUnavailableMessage } from "./auth-profile-recovery-BREezV0L.mjs";
+import { i as withTimeout } from "./timeout-C910MdAB.mjs";
+import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-C8Rw1m1m.mjs";
+import { a as resolveCodexAppServerAuthProfileStore, i as resolveCodexAppServerAuthProfileIdForAgent, r as resolveCodexAppServerAuthProfileId, t as isCodexAppServerNativeAuthProfile } from "./auth-profile-WqZtZfXN.mjs";
+import { f as isUnsupportedCodexAppServerVersionError, t as CodexAppServerClient } from "./client-Cs08OXVQ.mjs";
 import { isRecord } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { createHash } from "node:crypto";
+import { isDeepStrictEqual } from "node:util";
 import { AgentHarnessPreflightError, resolveDefaultAgentDir } from "openclaw/plugin-sdk/agent-harness-registration";
 import { addTimerTimeoutGraceMs, resolveTimerTimeoutMs } from "openclaw/plugin-sdk/number-runtime";
 import { runExec } from "openclaw/plugin-sdk/process-runtime";
 import fs, { constants } from "node:fs";
 import path from "node:path";
 import fs$1 from "node:fs/promises";
-import { pruneMapToMaxSize } from "openclaw/plugin-sdk/collection-runtime";
 import { createDeferred } from "openclaw/plugin-sdk/extension-shared";
 import { ensureAuthProfileStore, findPersistedAuthProfileCredential, refreshOAuthCredentialForRuntime, resolveApiKeyForProfile, resolvePersistedAuthProfileOwnerAgentDir } from "openclaw/plugin-sdk/agent-runtime";
 import { AgentHarnessPreflightError as AgentHarnessPreflightError$1, embeddedAgentLog as embeddedAgentLog$1, formatErrorMessage } from "openclaw/plugin-sdk/agent-harness-runtime";
-import { isDeepStrictEqual } from "node:util";
-import { assertNoSymlinkParents } from "openclaw/plugin-sdk/security-runtime";
 import { hasUsableOAuthCredential, resolveOpenAICodexAuthIdentity } from "openclaw/plugin-sdk/provider-auth";
+import { pruneMapToMaxSize } from "openclaw/plugin-sdk/collection-runtime";
+import { assertNoSymlinkParents } from "openclaw/plugin-sdk/security-runtime";
+//#region extensions/codex/src/app-server/attempt-timeouts.ts
+/**
+* Timeout defaults and normalizers for Codex app-server startup and turn
+* liveness watches.
+*/
+/** Minimum startup timeout accepted by the Codex app-server harness. */
+const CODEX_APP_SERVER_STARTUP_TIMEOUT_FLOOR_MS = 100;
+const TURN_TERMINAL_SETTLEMENT_TIMEOUT_MS = 12e4;
+const TURN_FINALIZE_DRAIN_ABORT_GRACE_MS = 5e3;
+var CodexAppServerStartupError = class extends Error {
+	constructor(reason, message = reason === "timed_out" ? "codex app-server startup timed out" : "codex app-server startup aborted") {
+		super(message);
+		this.reason = reason;
+		this.code = "CODEX_APP_SERVER_STARTUP_CANCELLED";
+		this.name = "CodexAppServerStartupError";
+	}
+};
+function isCodexAppServerStartupError(error, reason) {
+	return error instanceof Error && "code" in error && error.code === "CODEX_APP_SERVER_STARTUP_CANCELLED" && "reason" in error && (error.reason === "aborted" || error.reason === "timed_out") && (reason === void 0 || error.reason === reason);
+}
+function resolvePositiveIntegerTimeoutMs(value, fallbackMs) {
+	const fallback = resolveTimerTimeoutMs(fallbackMs, 1);
+	return resolveTimerTimeoutMs(value, fallback);
+}
+/** Runs startup work with abort and timeout handling plus optional cleanup. */
+async function withCodexStartupTimeout(params) {
+	if (params.signal.aborted) throw new CodexAppServerStartupError("aborted");
+	let timeout;
+	let abortCleanup;
+	let timeoutError;
+	let timeoutCleanup;
+	try {
+		return await Promise.race([params.operation(), new Promise((_, reject) => {
+			const rejectOnce = (error) => {
+				if (timeout) {
+					clearTimeout(timeout);
+					timeout = void 0;
+				}
+				reject(error);
+			};
+			timeout = setTimeout(() => {
+				timeoutError = new CodexAppServerStartupError("timed_out");
+				timeoutCleanup = Promise.resolve(params.onTimeout?.()).then(() => void 0, () => void 0);
+				timeoutCleanup.finally(() => {
+					rejectOnce(timeoutError);
+				});
+			}, params.timeoutMs);
+			const abortListener = () => rejectOnce(new CodexAppServerStartupError("aborted"));
+			params.signal.addEventListener("abort", abortListener, { once: true });
+			abortCleanup = () => params.signal.removeEventListener("abort", abortListener);
+		})]);
+	} catch (error) {
+		if (timeoutError) {
+			await timeoutCleanup;
+			throw timeoutError;
+		}
+		throw error;
+	} finally {
+		if (timeout) clearTimeout(timeout);
+		abortCleanup?.();
+	}
+}
+/** Resolves startup timeout while honoring the configured floor. */
+function resolveCodexStartupTimeoutMs(params) {
+	const timeoutFloorMs = resolvePositiveIntegerTimeoutMs(params.timeoutFloorMs, CODEX_APP_SERVER_STARTUP_TIMEOUT_FLOOR_MS);
+	const timeoutMs = resolvePositiveIntegerTimeoutMs(params.timeoutMs, timeoutFloorMs);
+	return Math.max(timeoutFloorMs, timeoutMs);
+}
+/** Adds gateway grace time to a caller timeout without overflowing invalid values. */
+function resolveCodexGatewayTimeoutWithGraceMs(timeoutMs, graceMs = 1e4) {
+	const timeout = resolvePositiveIntegerTimeoutMs(timeoutMs, 1);
+	const grace = resolveTimerTimeoutMs(graceMs, 0, 0);
+	return addTimerTimeoutGraceMs(timeout, grace) ?? timeout;
+}
+//#endregion
 //#region extensions/codex/src/app-server/computer-use-service-path.ts
 /** Filesystem ownership guards for isolated Computer Use service provisioning. */
 async function assertOwnedServicePath(params) {
@@ -238,6 +315,7 @@ async function ensureRealDirectoryCopy(cachePath, sourcePluginRoot, version, bou
 	let backupCreated = false;
 	try {
 		await fs$1.cp(sourcePluginRoot, stagedPath, { recursive: true });
+		await waitForCodexDesktopGeneration();
 		if (ownedParent) await assertDirectoryIdentityStable(ownedParent, "Computer Use plugin cache parent");
 		if (stat) {
 			boundary.assertCurrent?.();
@@ -523,7 +601,9 @@ async function ensureCodexComputerUseServiceAppOnce(params) {
 		if (!stagedIdentity || !identitiesMatch(stagedIdentity, sourceIdentity)) throw new Error(`Copied Computer Use service app at ${stagedPath} does not match its selected signed source.`);
 		const stagedSnapshot = await readServiceAppSnapshot(stagedPath, inspectServiceApp);
 		const currentSourceIdentity = await inspectServiceApp(sourcePath);
+		await waitForCodexDesktopGeneration();
 		await assertOwnedServiceParentStable(ownedParent);
+		await assertDirectoryIdentityStable(stagingRootIdentity, "Computer Use service staging directory");
 		if (!currentSourceIdentity || !identitiesMatch(currentSourceIdentity, sourceIdentity)) throw new Error("Selected Computer Use service source changed during refresh.");
 		await assertNotSymlink(operationTargetPath, "Computer Use service target");
 		if (await pathExists$1(operationTargetPath)) {
@@ -802,7 +882,10 @@ const scopedOAuthRefreshQueues = /* @__PURE__ */ new WeakMap();
 async function bridgeCodexAppServerStartOptions(params) {
 	if (params.startOptions.transport !== "stdio") return params.startOptions;
 	const scopeStartOptions = () => withCodexHomeEnvironment(withEphemeralCodexAuthStore(params), params.agentDir);
-	if (params.preparedAuth) return withClearedEnvironmentVariables(await scopeStartOptions(), CODEX_APP_SERVER_PREPARED_AUTH_ENV_VARS);
+	if (params.preparedAuth) {
+		const scopedStartOptions = await scopeStartOptions();
+		return withClearedEnvironmentVariables(scopedStartOptions, CODEX_APP_SERVER_PREPARED_AUTH_ENV_VARS);
+	}
 	if (params.authProfileId === null) return scopeStartOptions();
 	const store = resolveCodexAppServerAuthProfileStore({
 		agentDir: params.agentDir,
@@ -886,6 +969,7 @@ async function resolveCodexAppServerPreparedAuthHandoff(params) {
 		};
 	}
 	const authProfileId = params.authProfileId?.trim() || void 0;
+	if (authProfileId && !params.authProfileStore.profiles[authProfileId]) throw new CodexAppServerAuthProfileUnavailableError(formatCodexAuthProfileUnavailableMessage(authProfileId));
 	const nativeAuthProfile = isCodexAppServerNativeAuthProfile({
 		authProfileId,
 		authProfileStore: params.authProfileStore,
@@ -931,23 +1015,16 @@ async function resolveCodexAppServerAuthAccountCacheKey(params) {
 	if (!profileId) return;
 	const credential = store.profiles[profileId];
 	if (!credential || !isCodexAppServerAuthProfileCredential(credential)) return;
-	if (credential.type === "api_key") {
-		const apiKey = (await resolveApiKeyForProfile({
-			store,
-			profileId,
-			agentDir
-		}))?.apiKey?.trim();
-		return apiKey ? `${resolveChatgptAccountId(profileId, credential)}:${fingerprintApiKeyAuthProfileCacheKey(apiKey)}` : resolveChatgptAccountId(profileId, credential);
-	}
-	if (credential.type === "token") {
-		const accessToken = (await resolveApiKeyForProfile({
-			store,
-			profileId,
-			agentDir
-		}))?.apiKey?.trim();
-		return accessToken ? `${resolveChatgptAccountId(profileId, credential)}:${fingerprintTokenAuthProfileCacheKey(accessToken)}` : resolveChatgptAccountId(profileId, credential);
-	}
-	return resolveChatgptAccountId(profileId, credential);
+	const accountId = resolveChatgptAccountId(profileId, credential);
+	if (credential.type === "oauth") return accountId;
+	const value = (await resolveApiKeyForProfile({
+		cfg: params.config,
+		store,
+		profileId,
+		agentDir
+	}))?.apiKey?.trim();
+	if (!value) return accountId;
+	return `${accountId}:${credential.type === "api_key" ? fingerprintApiKeyAuthProfileCacheKey(value) : fingerprintTokenAuthProfileCacheKey(value)}`;
 }
 async function withCodexHomeEnvironment(startOptions, agentDir) {
 	const codexHome = resolveCodexAppServerLocalHomeDir(startOptions, agentDir);
@@ -1016,7 +1093,9 @@ async function reconcileCodexComputerUseStartArtifactsOnce(params) {
 	const computerUseConfig = resolveCodexComputerUseConfig({ pluginConfig: params.pluginConfig });
 	const ownsIsolatedCodexHome = params.ownsIsolatedCodexHome ?? (params.startOptions.homeScope !== "user" && !params.startOptions.env?.[CODEX_HOME_ENV_VAR]?.trim());
 	const shouldProvisionComputerUse = computerUseConfig.enabled && computerUseConfig.autoInstall && ownsIsolatedCodexHome;
-	if (shouldProvisionComputerUse) await ensureOwnedCodexHome(codexHome, params.agentDir);
+	const provisioningAgentDir = shouldProvisionComputerUse ? params.agentDir : void 0;
+	if (shouldProvisionComputerUse && !provisioningAgentDir) throw new Error("Managed Codex Computer Use requires an OpenClaw agent directory");
+	if (provisioningAgentDir) await ensureOwnedCodexHome(codexHome, provisioningAgentDir);
 	else await fs$1.mkdir(codexHome, { recursive: true });
 	const desktopCandidates = resolveMacOSDesktopCodexAppPathCandidates();
 	const exactDesktopCandidate = desktopCandidates.find((candidate) => path.resolve(candidate.appServerCommandPath) === path.resolve(params.startOptions.command));
@@ -1027,12 +1106,12 @@ async function reconcileCodexComputerUseStartArtifactsOnce(params) {
 		needsBundledMarketplace
 	}) : exactDesktopCandidate;
 	params.assertCurrent();
-	if (shouldProvisionComputerUse) {
+	if (provisioningAgentDir) {
 		if (desktopCandidates.length > 0 && !artifactCandidate) throw new CodexComputerUseCandidateArtifactsUnavailableError();
 		try {
 			const marketplacePath = usesManagedBundledMarketplace ? await ensureCodexManagedBundledMarketplace({
 				codexHome,
-				ownershipRoot: params.agentDir,
+				ownershipRoot: provisioningAgentDir,
 				...artifactCandidate ? {
 					appServerCommand: artifactCandidate.appServerCommandPath,
 					candidates: [artifactCandidate],
@@ -1111,11 +1190,12 @@ async function applyCodexAppServerAuthProfile(params) {
 		await assertNativeCodexAccountMatchesRoute(params.client, params.authRequirement, params.assertCurrent);
 		return;
 	}
+	const agentDir = params.agentDir ?? resolveDefaultAgentDir(params.config ?? {});
 	let loginParams = params.preparedAuth?.kind === "profile" ? params.preparedAuth.snapshot.loginParams : params.preparedAuth?.kind === "api-key" ? {
 		type: "apiKey",
 		apiKey: params.preparedAuth.apiKey
 	} : await resolveCodexAppServerAuthProfileLoginParams({
-		agentDir: params.agentDir,
+		agentDir,
 		authProfileId: params.authProfileId ?? void 0,
 		authProfileStore: params.authProfileStore,
 		config: params.config
@@ -1150,8 +1230,7 @@ async function applyCodexAppServerAuthProfile(params) {
 */
 async function assertNativeCodexAccountMatchesRoute(client, authRequirement, assertCurrent) {
 	if (!authRequirement) return;
-	const response = await client.request("account/read", { refreshToken: false }, { assertCurrent });
-	const accountType = isJsonObject(response.account) ? response.account.type : void 0;
+	const accountType = (await client.request("account/read", { refreshToken: false }, { assertCurrent })).account?.type;
 	if (authRequirement === "subscription") {
 		if (accountType !== "chatgpt") throw createCodexAppServerAuthError("Codex subscription route requires ChatGPT auth in the native Codex home. Run `codex login` for that home, or use appServer.homeScope=\"agent\" with an OpenClaw OAuth profile, then retry.");
 		return;
@@ -1162,23 +1241,8 @@ function createCodexAppServerAuthError(message, cause) {
 	const error = cause === void 0 ? new Error(message) : new Error(message, { cause });
 	return Object.assign(error, { status: 401 });
 }
-var CodexAppServerAuthProfileUnavailableError = class extends Error {
-	constructor(..._args) {
-		super(..._args);
-		this.status = 401;
-		this.code = "selected_auth_profile_unavailable";
-	}
-};
 async function resolveCodexAppServerAuthProfileLoginParams(params) {
 	const store = resolveCodexAppServerAuthProfileStore(params);
-	const profileId = resolveCodexAppServerAuthProfileId({
-		authProfileId: params.authProfileId,
-		store,
-		config: params.config
-	});
-	const profile = profileId ? store.profiles[profileId] : void 0;
-	if (profileId && !profile) throw new CodexAppServerAuthProfileUnavailableError(`Codex app-server auth profile "${profileId}" was not found. Select an existing OpenAI profile or sign in again with OpenClaw, then retry.`);
-	if (profileId && profile && !isCodexAppServerAuthProfileCredential(profile)) throw new CodexAppServerAuthProfileUnavailableError(`Codex app-server auth profile "${profileId}" must use the canonical OpenAI auth provider; run "openclaw doctor --fix" to migrate legacy provider IDs.`);
 	return await resolveCodexAppServerAuthProfileLoginParamsInternal({
 		...params,
 		authProfileStore: store
@@ -1226,7 +1290,7 @@ async function resolveCodexAppServerAuthProfileLoginParamsInternal(params) {
 	});
 	if (!profileId) return;
 	const credential = store.profiles[profileId];
-	if (!credential) throw new CodexAppServerAuthProfileUnavailableError(`Codex app-server auth profile "${profileId}" was not found. Select an existing OpenAI profile or sign in again with OpenClaw, then retry.`);
+	if (!credential) throw new CodexAppServerAuthProfileUnavailableError(formatCodexAuthProfileUnavailableMessage(profileId));
 	if (!isCodexAppServerAuthProfileCredential(credential)) throw new CodexAppServerAuthProfileUnavailableError(`Codex app-server auth profile "${profileId}" must use the canonical OpenAI auth provider; run "openclaw doctor --fix" to migrate legacy provider IDs.`);
 	const loginParams = await resolveLoginParamsForCredential(profileId, credential, {
 		agentDir: params.agentDir,
@@ -1250,30 +1314,22 @@ async function resolveCodexAppServerFallbackApiKeyLoginParams(params) {
 	};
 }
 async function resolveLoginParamsForCredential(profileId, credential, params) {
-	if (credential.type === "api_key") {
-		const apiKey = (await resolveApiKeyForProfile({
+	if (credential.type === "api_key" || credential.type === "token") {
+		const value = (await resolveApiKeyForProfile({
+			cfg: params.config,
 			store: params.preferStoreCredential ? params.store : ensureAuthProfileStore(params.agentDir, {
 				allowKeychainPrompt: false,
-				profileId
+				profileId,
+				config: params.config
 			}),
 			profileId,
 			agentDir: params.agentDir
 		}))?.apiKey?.trim();
-		return apiKey ? {
+		if (!value) return;
+		return credential.type === "api_key" ? {
 			type: "apiKey",
-			apiKey
-		} : void 0;
-	}
-	if (credential.type === "token") {
-		const accessToken = (await resolveApiKeyForProfile({
-			store: params.preferStoreCredential ? params.store : ensureAuthProfileStore(params.agentDir, {
-				allowKeychainPrompt: false,
-				profileId
-			}),
-			profileId,
-			agentDir: params.agentDir
-		}))?.apiKey?.trim();
-		return accessToken ? buildChatgptAuthTokensParams(profileId, credential, accessToken) : void 0;
+			apiKey: value
+		} : buildChatgptAuthTokensParams(profileId, credential, value);
 	}
 	if (credential.type !== "oauth") return;
 	const resolvedCredential = await resolveOAuthCredentialForCodexAppServer(profileId, credential, {
@@ -1303,7 +1359,7 @@ async function resolveOAuthCredentialForCodexAppServer(profileId, credential, pa
 		persistedCredential,
 		suppliedCredential: credential
 	});
-	if (params.preferStoreCredential && params.store.runtimePersistedProfileIds?.includes(profileId) && (persistedCredential?.type !== "oauth" || !isCodexAppServerAuthProvider(persistedCredential.provider))) throw new CodexAppServerAuthProfileUnavailableError(`Codex app-server auth profile "${profileId}" is no longer available. Sign in again with OpenClaw, then retry.`);
+	if (params.preferStoreCredential && params.store.runtimePersistedProfileIds?.includes(profileId) && (persistedCredential?.type !== "oauth" || !isCodexAppServerAuthProvider(persistedCredential.provider))) throw new CodexAppServerAuthProfileUnavailableError(`Codex app-server auth profile "${profileId}" is no longer an OpenAI OAuth credential in its persisted OpenClaw store. Run "openclaw doctor" to inspect credential ownership, or select an existing OpenAI profile.`);
 	const store = useScopedCredential ? params.store : resolveCodexAppServerAuthProfileStore({
 		agentDir: ownerAgentDir,
 		authProfileId: profileId,
@@ -1327,17 +1383,22 @@ async function resolveOAuthCredentialForCodexAppServer(profileId, credential, pa
 		profileId,
 		credential: overlaidOAuthCredential,
 		forceRefresh: params.forceRefresh && !reuseCompletedRotation,
-		expectedAccountId
+		expectedAccountId,
+		config: params.config
 	});
 	if (params.forceRefresh && !persistedOAuthCredential && overlaidOAuthCredential) {
 		if (reuseCompletedRotation) return overlaidOAuthCredential;
-		const refreshedRuntimeCredential = await refreshOAuthCredentialForRuntime({ credential: overlaidOAuthCredential });
+		const refreshedRuntimeCredential = await refreshOAuthCredentialForRuntime({
+			credential: overlaidOAuthCredential,
+			cfg: params.config
+		});
 		if (!refreshedRuntimeCredential?.access?.trim()) throw new Error(`Codex app-server auth profile "${profileId}" could not refresh. Sign in again with OpenClaw, then retry.`);
 		assertCodexOAuthRefreshWorkspace(profileId, refreshedRuntimeCredential, expectedAccountId);
 		store.profiles[profileId] = refreshedRuntimeCredential;
 		return refreshedRuntimeCredential;
 	}
 	const resolved = await resolveApiKeyForProfile({
+		cfg: params.config,
 		store,
 		profileId,
 		agentDir: ownerAgentDir,
@@ -1345,7 +1406,7 @@ async function resolveOAuthCredentialForCodexAppServer(profileId, credential, pa
 		allowProfileFallback: false,
 		...expectedAccountId ? { validateOAuthCredential: (candidate) => assertCodexOAuthRefreshWorkspace(profileId, candidate, expectedAccountId) } : {}
 	});
-	if (!resolved || resolved.credential?.type !== "oauth" || !isCodexAppServerAuthProvider(resolved.credential.provider) || !resolved.apiKey.trim()) throw new CodexAppServerAuthProfileUnavailableError(`Codex app-server auth profile "${profileId}" is no longer available. Sign in again with OpenClaw, then retry.`);
+	if (!resolved || resolved.credential?.type !== "oauth" || !isCodexAppServerAuthProvider(resolved.credential.provider) || !resolved.apiKey.trim()) throw new CodexAppServerAuthProfileUnavailableError(`Codex app-server auth profile "${profileId}" could not resolve usable OAuth credentials from its OpenClaw credential store. Run "openclaw doctor" to inspect credential ownership, or select an existing OpenAI profile.`);
 	const candidate = {
 		...resolved.credential,
 		access: resolved.apiKey
@@ -1389,7 +1450,10 @@ async function resolveScopedOAuthCredential(params) {
 		const current = params.store.profiles[params.profileId];
 		const credential = current?.type === "oauth" ? current : params.credential;
 		if (!params.forceRefresh && hasUsableOAuthCredential(credential)) return credential;
-		const refreshed = await refreshOAuthCredentialForRuntime({ credential });
+		const refreshed = await refreshOAuthCredentialForRuntime({
+			credential,
+			cfg: params.config
+		});
 		if (!refreshed?.access?.trim()) throw new Error(`Codex app-server auth profile "${params.profileId}" could not refresh. Sign in again with OpenClaw, then retry.`);
 		assertCodexOAuthRefreshWorkspace(params.profileId, refreshed, params.expectedAccountId);
 		if (!isDeepStrictEqual(params.store.profiles[params.profileId], credential)) throw new Error(`Codex app-server auth profile "${params.profileId}" changed while refreshing. Retry with the newly selected OpenAI profile.`);
@@ -1422,15 +1486,6 @@ function isCodexSubscriptionCredential(credential) {
 	if (!credential || !isCodexAppServerAuthProvider(credential.provider)) return false;
 	return credential.type === "oauth" || credential.type === "token";
 }
-function withClearedEnvironmentVariables(startOptions, envVars) {
-	const clearEnv = startOptions.clearEnv ?? [];
-	const missingEnvVars = envVars.filter((envVar) => !clearEnv.includes(envVar));
-	if (missingEnvVars.length === 0) return startOptions;
-	return {
-		...startOptions,
-		clearEnv: [...clearEnv, ...missingEnvVars]
-	};
-}
 function buildChatgptAuthTokensParams(profileId, credential, accessToken) {
 	const storedAccountId = resolveExplicitChatgptAccountId(credential);
 	const tokenAccountId = resolveOpenAICodexAuthIdentity({ access: accessToken }).accountId;
@@ -1462,6 +1517,65 @@ function resolveExplicitChatgptAccountId(credential) {
 	}
 }
 //#endregion
+//#region extensions/codex/src/app-server/client-thread-owner.ts
+function createThreadOwnerToken(threadId, onInvalidated) {
+	const owner = {
+		invalidated: false,
+		invalidate: () => {
+			if (owner.invalidated) return;
+			owner.invalidated = true;
+			try {
+				onInvalidated?.();
+			} catch (error) {
+				embeddedAgentLog$1.warn("codex thread ownership invalidation failed", {
+					threadId,
+					reason: formatErrorMessage(error)
+				});
+			}
+		}
+	};
+	return owner;
+}
+function hasThreadOwnership(runtime, threadId) {
+	return runtime !== void 0 && !runtime.closed && (runtime.retainedThreads.get(threadId) !== void 0 || runtime.releasingThreads.get(threadId) !== void 0 || runtime.claimedThreads.get(threadId) !== void 0);
+}
+function hasSiblingThreadWork(runtime, threadId) {
+	if (!runtime || runtime.closed) return false;
+	if (runtime.protectedThreads.size > 0) return true;
+	for (const [retainedThreadId, retained] of runtime.retainedThreads) if (retainedThreadId !== threadId && retained.ephemeralPolicy !== void 0) return true;
+	for (const claimedThreadId of runtime.claimedThreads.keys()) if (claimedThreadId !== threadId) return true;
+	return false;
+}
+function invalidateThreadOwnership(runtime, threadId) {
+	const retainedOwner = runtime.retainedThreads.get(threadId)?.ownerToken;
+	const claimedOwner = runtime.claimedThreads.get(threadId);
+	const releasing = runtime.releasingThreads.get(threadId);
+	if (releasing) releasing.invalidated = true;
+	runtime.retainedThreads.delete(threadId);
+	runtime.claimedThreads.delete(threadId);
+	retainedOwner?.invalidate();
+	claimedOwner?.invalidate();
+	releasing?.retainedOwnerToken?.invalidate();
+}
+function forgetThreadOwnership(runtime, threadId, owner) {
+	let forgotten = false;
+	if (runtime.claimedThreads.get(threadId) === owner) {
+		runtime.claimedThreads.delete(threadId);
+		forgotten = true;
+	}
+	if (runtime.retainedThreads.get(threadId)?.ownerToken === owner) {
+		runtime.retainedThreads.delete(threadId);
+		forgotten = true;
+	}
+	const releasing = runtime.releasingThreads.get(threadId);
+	if (releasing?.retainedOwnerToken === owner) {
+		releasing.invalidated = true;
+		forgotten = true;
+	}
+	if (forgotten) owner.invalidate();
+	return forgotten;
+}
+//#endregion
 //#region extensions/codex/src/app-server/rate-limit-cache.ts
 const DEFAULT_CODEX_RATE_LIMIT_CACHE_MAX_AGE_MS = 6e5;
 const SPARSE_ACCOUNT_METADATA_KEYS = [
@@ -1655,8 +1769,11 @@ function ensureCodexAppServerClientRuntime(client, context) {
 			clearTimeout(runtime.evictionTimer);
 			runtime.evictionTimer = void 0;
 		}
-		runtime.retainedThreads.clear();
-		runtime.claimedThreads.clear();
+		for (const threadId of /* @__PURE__ */ new Set([
+			...runtime.retainedThreads.keys(),
+			...runtime.claimedThreads.keys(),
+			...runtime.releasingThreads.keys()
+		])) invalidateThreadOwnership(runtime, threadId);
 		runtime.protectedThreads.clear();
 		runtime.sessionMetadata.clear();
 		runtime.workspaceReferences.clear();
@@ -1664,6 +1781,7 @@ function ensureCodexAppServerClientRuntime(client, context) {
 	client.addRequestHandler(async (request) => {
 		if (request.method !== "account/chatgptAuthTokens/refresh") return;
 		if (runtime.context.authMode === "prepared-api-key") throw new Error("ChatGPT token refresh is unavailable for prepared Codex API-key auth.");
+		if (!runtime.context.agentDir) throw new Error("ChatGPT token refresh requires an OpenClaw-owned auth profile.");
 		const previousAccountId = isJsonObject(request.params) && typeof request.params.previousAccountId === "string" ? request.params.previousAccountId.trim() || void 0 : void 0;
 		const authHandoff = runtime.authHandoff;
 		try {
@@ -1703,10 +1821,7 @@ function ensureCodexAppServerClientRuntime(client, context) {
 		if (notification.method === "thread/archived" || notification.method === "thread/deleted" || notification.method === "thread/closed") {
 			const threadId = notification.params?.threadId;
 			if (typeof threadId === "string") {
-				const releasing = runtime.releasingThreads.get(threadId);
-				if (releasing) releasing.invalidated = true;
-				runtime.retainedThreads.delete(threadId);
-				runtime.claimedThreads.delete(threadId);
+				invalidateThreadOwnership(runtime, threadId);
 				runtime.sessionMetadata.delete(threadId);
 				runtime.workspaceReferences.delete(threadId);
 				scheduleRetainedThreadEviction(client, runtime);
@@ -1747,14 +1862,18 @@ async function releaseRetainedThread(client, runtime, threadId, assertCurrent) {
 	}
 	runtime.retainedThreads.delete(threadId);
 	scheduleRetainedThreadEviction(client, runtime);
-	const transition = { completion: Promise.resolve().then(() => {
-		assertCurrent?.();
-		return assertCurrent ? retained.release(threadId, assertCurrent) : retained.release(threadId);
-	}) };
+	const transition = {
+		retainedOwnerToken: retained.ownerToken,
+		completion: Promise.resolve().then(() => {
+			assertCurrent?.();
+			return assertCurrent ? retained.release(threadId, assertCurrent) : retained.release(threadId);
+		})
+	};
 	runtime.releasingThreads.set(threadId, transition);
 	try {
 		await transition.completion;
 		runtime.workspaceReferences.delete(threadId);
+		retained.ownerToken?.invalidate();
 		return true;
 	} catch (error) {
 		if (!runtime.closed && !transition.invalidated && runtime.releasingThreads.get(threadId) === transition && !runtime.retainedThreads.has(threadId) && !runtime.claimedThreads.has(threadId)) {
@@ -1788,14 +1907,17 @@ async function retainCodexAppServerLiveThread(client, threadId, releaseThread, c
 	const runtime = configuredClients.get(client);
 	if (!runtime || runtime.closed) return false;
 	const claimed = runtime.claimedThreads.get(threadId);
-	if (claimed !== void 0 && (releaseThread === void 0 || claimedThreadReleaseTokens.get(releaseThread) !== claimed)) return false;
+	const ownerToken = releaseThread ? claimedThreadReleaseTokens.get(releaseThread) : void 0;
+	if (claimed !== ownerToken || ownerToken?.invalidated) return false;
 	const pendingRelease = runtime.releasingThreads.get(threadId);
 	if (pendingRelease) {
 		await pendingRelease.completion;
 		return false;
 	}
+	const previousOwner = runtime.retainedThreads.get(threadId)?.ownerToken;
 	runtime.retainedThreads.delete(threadId);
 	const retained = {
+		ownerToken,
 		configFingerprint,
 		ephemeralPolicy,
 		serviceTier,
@@ -1805,6 +1927,7 @@ async function retainCodexAppServerLiveThread(client, threadId, releaseThread, c
 		})
 	};
 	runtime.retainedThreads.set(threadId, retained);
+	if (previousOwner !== ownerToken) previousOwner?.invalidate();
 	try {
 		await evictExcessIdleThreads(client, runtime);
 	} catch (error) {
@@ -1834,8 +1957,8 @@ async function consumeCodexAppServerLiveThread(client, threadId, configFingerpri
 	if (!retained || configFingerprint !== void 0 && retained.configFingerprint !== configFingerprint) return;
 	return claimCodexAppServerThreadOwnership(client, runtime, threadId, retained);
 }
-/** Claims an observed Codex auto-subscription without exposing a temporarily idle owner. */
-async function claimCodexAppServerLiveThread(client, threadId) {
+/** Claims an auto-subscription; invalidation ends the handle after replacement or release. */
+async function claimCodexAppServerLiveThread(client, threadId, onInvalidated) {
 	const runtime = configuredClients.get(client);
 	if (!runtime || runtime.closed || runtime.claimedThreads.has(threadId)) return;
 	const pendingRelease = runtime.releasingThreads.get(threadId);
@@ -1848,21 +1971,33 @@ async function claimCodexAppServerLiveThread(client, threadId) {
 		release: async (releasedThreadId, assertCurrent) => {
 			await unsubscribeCodexAppServerLiveThread(client, releasedThreadId, 5e3, assertCurrent);
 		}
-	});
+	}, onInvalidated);
 }
-function claimCodexAppServerThreadOwnership(client, runtime, threadId, retained) {
+function claimCodexAppServerThreadOwnership(client, runtime, threadId, retained, onInvalidated) {
+	const previousClaim = runtime.claimedThreads.get(threadId);
 	runtime.retainedThreads.delete(threadId);
-	const claimed = Symbol(threadId);
+	const claimed = createThreadOwnerToken(threadId, onInvalidated);
 	runtime.claimedThreads.set(threadId, claimed);
+	previousClaim?.invalidate();
+	retained.ownerToken?.invalidate();
 	scheduleRetainedThreadEviction(client, runtime);
 	const assertCurrent = () => {
-		if (runtime.closed || runtime.claimedThreads.get(threadId) !== claimed) throw new Error(`Codex thread subscription ownership changed: ${threadId}`);
+		if (claimed.invalidated || runtime.closed || runtime.claimedThreads.get(threadId) !== claimed) throw new Error(`Codex thread subscription ownership changed: ${threadId}`);
 	};
 	const release = async (releasedThreadId, assertReleaseCurrent) => {
-		if (releasedThreadId !== threadId || runtime.claimedThreads.get(threadId) !== claimed) {
+		if (releasedThreadId !== threadId || claimed.invalidated) {
 			assertReleaseCurrent?.();
 			return;
 		}
+		if (runtime.claimedThreads.get(threadId) !== claimed) {
+			if (runtime.retainedThreads.get(threadId)?.ownerToken === claimed) await releaseRetainedThread(client, runtime, threadId, assertReleaseCurrent);
+			else {
+				const pendingRelease = runtime.releasingThreads.get(threadId);
+				if (pendingRelease?.retainedOwnerToken === claimed) await pendingRelease.completion;
+				assertReleaseCurrent?.();
+			}
+			return;
+		}
 		const pendingRelease = runtime.releasingThreads.get(threadId);
 		if (pendingRelease) {
 			await pendingRelease.completion;
@@ -1882,6 +2017,7 @@ function claimCodexAppServerThreadOwnership(client, runtime, threadId, retained)
 			if (runtime.claimedThreads.get(threadId) === claimed) {
 				runtime.claimedThreads.delete(threadId);
 				runtime.workspaceReferences.delete(threadId);
+				claimed.invalidate();
 			}
 		} finally {
 			if (runtime.releasingThreads.get(threadId) === transition) runtime.releasingThreads.delete(threadId);
@@ -1894,18 +2030,26 @@ function claimCodexAppServerThreadOwnership(client, runtime, threadId, retained)
 		configFingerprint: retained.configFingerprint,
 		ephemeralPolicy: retained.ephemeralPolicy,
 		serviceTier: retained.serviceTier,
-		release
+		release,
+		forget: () => {
+			if (forgetThreadOwnership(runtime, threadId, claimed)) {
+				runtime.workspaceReferences.delete(threadId);
+				scheduleRetainedThreadEviction(client, runtime);
+			}
+		}
 	};
 }
 /** Distinguish active claimed ownership from an already-evicted idle subscription. */
 function hasCodexAppServerLiveThread(client, threadId) {
-	const runtime = configuredClients.get(client);
-	return runtime !== void 0 && !runtime.closed && (runtime.retainedThreads.has(threadId) || runtime.releasingThreads.has(threadId) || runtime.claimedThreads.has(threadId));
+	return hasThreadOwnership(configuredClients.get(client), threadId);
 }
 function isCodexAppServerLiveThreadClaimed(client, threadId) {
 	const runtime = configuredClients.get(client);
 	return runtime !== void 0 && !runtime.closed && runtime.claimedThreads.has(threadId);
 }
+function hasCodexAppServerSiblingThreadWork(client, threadId) {
+	return hasSiblingThreadWork(configuredClients.get(client), threadId);
+}
 /** Release the exact physical subscription and finish only its observed ownership generation. */
 async function unsubscribeCodexAppServerLiveThread(client, threadId, timeoutMs, assertCurrent) {
 	const runtime = configuredClients.get(client);
@@ -1943,9 +2087,13 @@ async function unsubscribeCodexAppServerLiveThread(client, threadId, timeoutMs,
 		await physicalRelease;
 		if (retained !== void 0 && runtime?.retainedThreads.get(threadId) === retained) {
 			runtime.retainedThreads.delete(threadId);
+			retained.ownerToken?.invalidate();
 			scheduleRetainedThreadEviction(client, runtime);
 		}
-		if (claimed !== void 0 && runtime?.claimedThreads.get(threadId) === claimed) runtime.claimedThreads.delete(threadId);
+		if (claimed !== void 0 && runtime?.claimedThreads.get(threadId) === claimed) {
+			runtime.claimedThreads.delete(threadId);
+			claimed.invalidate();
+		}
 	} finally {
 		if (ownsTransition && runtime.releasingThreads.get(threadId) === transition) runtime.releasingThreads.delete(threadId);
 	}
@@ -1986,81 +2134,6 @@ function protectCodexAppServerLiveThread(client, threadId) {
 	};
 }
 //#endregion
-//#region extensions/codex/src/app-server/attempt-timeouts.ts
-/**
-* Timeout defaults and normalizers for Codex app-server startup and turn
-* liveness watches.
-*/
-/** Minimum startup timeout accepted by the Codex app-server harness. */
-const CODEX_APP_SERVER_STARTUP_TIMEOUT_FLOOR_MS = 100;
-const TURN_TERMINAL_SETTLEMENT_TIMEOUT_MS = 12e4;
-const TURN_FINALIZE_DRAIN_ABORT_GRACE_MS = 5e3;
-var CodexAppServerStartupError = class extends Error {
-	constructor(reason, message = reason === "timed_out" ? "codex app-server startup timed out" : "codex app-server startup aborted") {
-		super(message);
-		this.reason = reason;
-		this.code = "CODEX_APP_SERVER_STARTUP_CANCELLED";
-		this.name = "CodexAppServerStartupError";
-	}
-};
-function isCodexAppServerStartupError(error, reason) {
-	return error instanceof Error && "code" in error && error.code === "CODEX_APP_SERVER_STARTUP_CANCELLED" && "reason" in error && (error.reason === "aborted" || error.reason === "timed_out") && (reason === void 0 || error.reason === reason);
-}
-function resolvePositiveIntegerTimeoutMs(value, fallbackMs) {
-	const fallback = resolveTimerTimeoutMs(fallbackMs, 1);
-	return resolveTimerTimeoutMs(value, fallback);
-}
-/** Runs startup work with abort and timeout handling plus optional cleanup. */
-async function withCodexStartupTimeout(params) {
-	if (params.signal.aborted) throw new CodexAppServerStartupError("aborted");
-	let timeout;
-	let abortCleanup;
-	let timeoutError;
-	let timeoutCleanup;
-	try {
-		return await Promise.race([params.operation(), new Promise((_, reject) => {
-			const rejectOnce = (error) => {
-				if (timeout) {
-					clearTimeout(timeout);
-					timeout = void 0;
-				}
-				reject(error);
-			};
-			timeout = setTimeout(() => {
-				timeoutError = new CodexAppServerStartupError("timed_out");
-				timeoutCleanup = Promise.resolve(params.onTimeout?.()).then(() => void 0, () => void 0);
-				timeoutCleanup.finally(() => {
-					rejectOnce(timeoutError);
-				});
-			}, params.timeoutMs);
-			const abortListener = () => rejectOnce(new CodexAppServerStartupError("aborted"));
-			params.signal.addEventListener("abort", abortListener, { once: true });
-			abortCleanup = () => params.signal.removeEventListener("abort", abortListener);
-		})]);
-	} catch (error) {
-		if (timeoutError) {
-			await timeoutCleanup;
-			throw timeoutError;
-		}
-		throw error;
-	} finally {
-		if (timeout) clearTimeout(timeout);
-		abortCleanup?.();
-	}
-}
-/** Resolves startup timeout while honoring the configured floor. */
-function resolveCodexStartupTimeoutMs(params) {
-	const timeoutFloorMs = resolvePositiveIntegerTimeoutMs(params.timeoutFloorMs, CODEX_APP_SERVER_STARTUP_TIMEOUT_FLOOR_MS);
-	const timeoutMs = resolvePositiveIntegerTimeoutMs(params.timeoutMs, timeoutFloorMs);
-	return Math.max(timeoutFloorMs, timeoutMs);
-}
-/** Adds gateway grace time to a caller timeout without overflowing invalid values. */
-function resolveCodexGatewayTimeoutWithGraceMs(timeoutMs, graceMs = 1e4) {
-	const timeout = resolvePositiveIntegerTimeoutMs(timeoutMs, 1);
-	const grace = resolveTimerTimeoutMs(graceMs, 0, 0);
-	return addTimerTimeoutGraceMs(timeout, grace) ?? timeout;
-}
-//#endregion
 //#region extensions/codex/src/app-server/inference-routing.ts
 const owners = defineCodexBuildState("openclaw.codexAppServerInferenceOwners", () => /* @__PURE__ */ new WeakMap())();
 const MAX_ROUTES = 8;
@@ -2125,7 +2198,7 @@ async function prepareCodexInferenceRoute(params) {
 		assertCurrent
 	});
 	assertCurrent();
-	const type = isJsonObject(account.account) ? account.account.type : void 0;
+	const type = account.account?.type;
 	if (type !== "apiKey" && type !== "chatgpt") return;
 	if (owner.authRoute && owner.authRoute !== type) throw new Error("Codex native account route changed; reconnect before retrying");
 	owner.authRoute = type;
@@ -2134,7 +2207,7 @@ async function prepareCodexInferenceRoute(params) {
 	let pending = owner.routes.get(key);
 	if (!pending) {
 		if (owner.routes.size >= MAX_ROUTES) throw new Error("Codex inference route limit reached");
-		pending = import("./inference-proxy-HGXKUIre.js").then(({ createCodexInferenceProxy }) => {
+		pending = import("./inference-proxy-b-aJMSxm.mjs").then(({ createCodexInferenceProxy }) => {
 			assertClient();
 			return createCodexInferenceProxy({
 				upstream: target,
@@ -2263,6 +2336,50 @@ async function waitForPreviousFence(previous, options) {
 	});
 }
 //#endregion
+//#region extensions/codex/src/app-server/native-hook-relay-state.ts
+const pending = /* @__PURE__ */ new Set();
+const closing = /* @__PURE__ */ new Set();
+/** Owns delayed hook-relay cleanup across runtime scheduling and test teardown. */
+const nativeHookRelayUnregisterQueue = {
+	add(entry) {
+		pending.add(entry);
+	},
+	delete(entry) {
+		return pending.delete(entry);
+	},
+	track(operation) {
+		closing.add(operation);
+		operation.then(() => closing.delete(operation), () => closing.delete(operation));
+	},
+	async flush() {
+		while (pending.size > 0) {
+			const entry = pending.values().next().value;
+			if (!entry) break;
+			clearTimeout(entry.timeout);
+			entry.unregister();
+		}
+		while (closing.size > 0) await Promise.allSettled(closing);
+	},
+	async clear() {
+		for (const entry of pending) clearTimeout(entry.timeout);
+		pending.clear();
+		while (closing.size > 0) await Promise.allSettled(closing);
+	}
+};
+//#endregion
+//#region extensions/codex/src/app-server/spawn-identity.ts
+/** Resolves non-secret spawn identity before startup; argv is represented only by its hash. */
+function resolveCodexAppServerSpawnIdentity(startOptions, resolvedNativeCommand) {
+	const nativeCommand = resolvedNativeCommand ?? (startOptions.commandSource === "resolved-managed" ? resolveManagedCodexNativeCommand(startOptions.command) : void 0);
+	return {
+		command: startOptions.command,
+		argsFingerprint: createHash("sha256").update(JSON.stringify(startOptions.args)).digest("hex"),
+		...startOptions.commandSource ? { commandSource: startOptions.commandSource } : {},
+		...startOptions.managedCommandOrder ? { managedCommandOrder: startOptions.managedCommandOrder } : {},
+		...nativeCommand ? { nativeCommand } : {}
+	};
+}
+//#endregion
 //#region extensions/codex/src/app-server/thread-lifecycle-errors.ts
 var CodexThreadStartRequestError = class extends Error {
 	constructor(cause) {
@@ -2270,6 +2387,12 @@ var CodexThreadStartRequestError = class extends Error {
 		this.name = "CodexThreadStartRequestError";
 	}
 };
+var CodexThreadClientReplacementError = class extends AgentHarnessPreflightError$1 {
+	constructor() {
+		super("Codex did not confirm unloading its previous configuration after a settled failure; a fresh client is required.");
+		this.name = "CodexThreadClientReplacementError";
+	}
+};
 var CodexThreadBindingConflictError = class extends Error {
 	constructor(threadId, operation) {
 		super(`Codex thread binding changed while ${operation}: ${threadId}`);
@@ -2305,7 +2428,6 @@ var shared_client_exports = /* @__PURE__ */ __exportAll({
 	readCodexAppServerClientProcessIdentity: () => readCodexAppServerClientProcessIdentity,
 	releaseCodexAppServerClientLease: () => releaseCodexAppServerClientLease,
 	releaseLeasedSharedCodexAppServerClient: () => releaseLeasedSharedCodexAppServerClient,
-	resolveCodexAppServerSpawnIdentity: () => resolveCodexAppServerSpawnIdentity,
 	resolveCodexNativeConfigFenceKey: () => resolveCodexNativeConfigFenceKey,
 	retainSharedCodexAppServerClientByInstanceId: () => retainSharedCodexAppServerClientByInstanceId,
 	retainSharedCodexAppServerClientIfCurrent: () => retainSharedCodexAppServerClientIfCurrent,
@@ -2328,7 +2450,7 @@ async function prepareCodexAppServerClient(options) {
 		if (abandonSignal.aborted) throw new CodexAppServerStartupError("aborted", "codex app-server initialize aborted");
 	};
 	assertCurrent();
-	const startedAt = Date.now();
+	const startedAt = performance.now();
 	return {
 		context: await withCodexAppServerAcquireDeadline(options?.timeoutMs ?? 0, ownCodexStartup(lifetime, resolveCodexAppServerClientStartContext(options)), abandonSignal),
 		lifetime,
@@ -2372,17 +2494,6 @@ async function waitForCodexAppServerClientDesktopGenerationDrain(params) {
 		drain.cancel();
 	}
 }
-/** Resolves non-secret spawn identity before startup; argv is represented only by its hash. */
-function resolveCodexAppServerSpawnIdentity(startOptions, resolvedNativeCommand) {
-	const nativeCommand = resolvedNativeCommand ?? (startOptions.commandSource === "resolved-managed" ? resolveManagedCodexNativeCommand(startOptions.command) : void 0);
-	return {
-		command: startOptions.command,
-		argsFingerprint: createHash("sha256").update(JSON.stringify(startOptions.args)).digest("hex"),
-		...startOptions.commandSource ? { commandSource: startOptions.commandSource } : {},
-		...startOptions.managedCommandOrder ? { managedCommandOrder: startOptions.managedCommandOrder } : {},
-		...nativeCommand ? { nativeCommand } : {}
-	};
-}
 var CodexAppServerStartSelectionChangedError = class extends Error {
 	constructor() {
 		super("Codex app-server managed executable selection changed during startup");
@@ -2416,26 +2527,21 @@ function resolveCodexNativeConfigFenceKey(params) {
 	const metadata = params.client ? getSharedCodexAppServerClientState().startMetadata.get(params.client) : void 0;
 	const startOptions = metadata?.startOptions ?? params.startOptions;
 	if (!startOptions || startOptions.transport !== "stdio") return;
-	const configuredHome = startOptions.env?.CODEX_HOME?.trim();
-	const agentDir = params.agentDir ?? metadata?.agentDir ?? resolveDefaultAgentDir(params.config ?? {});
-	const codexHome = configuredHome ? configuredHome : startOptions.homeScope === "user" ? resolveCodexAppServerUserHomeDir() : agentDir ? resolveCodexAppServerHomeDir(agentDir) : void 0;
+	const configuredHome = startOptions.codexHome ?? startOptions.env?.CODEX_HOME?.trim();
+	const codexHome = configuredHome ? configuredHome : startOptions.homeScope === "user" ? resolveCodexAppServerUserHomeDir() : resolveCodexAppServerHomeDir(params.agentDir ?? metadata?.agentDir ?? resolveDefaultAgentDir(params.config ?? {}));
 	return codexHome ? `codex-home:${path.resolve(codexHome)}` : void 0;
 }
-function inferAuthRequirement(preparedAuth) {
-	if (preparedAuth?.kind === "api-key") return "api-key";
-	return preparedAuth?.kind === "profile" ? "subscription" : void 0;
-}
 async function resolveCodexAppServerClientStartContext(options) {
-	const agentDir = options?.agentDir ?? resolveDefaultAgentDir(options?.config ?? {});
-	const requestedStartOptions = options?.startOptions ?? resolveCodexAppServerRuntimeOptions().start;
+	const requestedStartOptions = options?.startOptions ?? resolveCodexAppServerRuntimeOptions({ pluginConfig: options?.pluginConfig }).start;
+	const agentDir = options?.agentDir ?? (requestedStartOptions.homeScope === "user" ? void 0 : resolveDefaultAgentDir(options?.config ?? {}));
 	const desktopGeneration = shouldTrackDesktopGeneration(requestedStartOptions, options?.pluginConfig) ? await waitForCodexDesktopGeneration() : void 0;
 	const preparedAuth = options?.preparedAuth;
 	const preparedApiKey = preparedAuth?.kind === "api-key" ? preparedAuth.apiKey.trim() : void 0;
 	if (preparedAuth && options?.authProfileId !== void 0) throw new Error("Prepared Codex auth cannot also select a legacy auth profile.");
-	if (preparedAuth?.kind === "profile" && !preparedAuth.store.profiles[preparedAuth.profileId]) throw new Error(`Prepared Codex auth profile "${preparedAuth.profileId}" was not found. Select an existing OpenAI profile or sign in again with OpenClaw, then retry.`);
+	if (preparedAuth?.kind === "profile" && !preparedAuth.store.profiles[preparedAuth.profileId]) throw new CodexAppServerAuthProfileUnavailableError(formatCodexAuthProfileUnavailableMessage(preparedAuth.profileId));
 	if (preparedAuth?.kind === "api-key" && !preparedApiKey) throw new Error("Prepared Codex API-key auth is missing its resolved key.");
 	if (preparedAuth && requestedStartOptions.homeScope === "user") throw new Error("Prepared Codex auth requires an isolated app-server home.");
-	const preparedAuthRequirement = inferAuthRequirement(preparedAuth);
+	const preparedAuthRequirement = preparedAuth && (preparedAuth.kind === "api-key" ? "api-key" : "subscription");
 	if (options?.authRequirement && preparedAuthRequirement && options.authRequirement !== preparedAuthRequirement) throw new Error("Prepared Codex auth does not satisfy the requested auth requirement.");
 	const authRequirement = options?.authRequirement ?? preparedAuthRequirement;
 	const usesNativeAuth = !preparedAuth && (options?.authProfileId === null || requestedStartOptions.homeScope === "user");
@@ -2458,7 +2564,7 @@ async function resolveCodexAppServerClientStartContext(options) {
 		agentDir,
 		config: options?.config
 	}) : void 0;
-	if (preparedAuth?.kind === "profile" && !preparedAuthProfileSnapshot) throw new Error(`Prepared Codex auth profile "${preparedAuth.profileId}" is unusable. Repair or replace the selected OpenAI profile, then retry.`);
+	if (preparedAuth?.kind === "profile" && !preparedAuthProfileSnapshot) throw new CodexAppServerAuthProfileUnavailableError(`Prepared Codex auth profile "${preparedAuth.profileId}" is unusable. Repair or replace the selected OpenAI profile, then retry.`);
 	const resolvedPreparedAuth = preparedAuth?.kind === "api-key" ? {
 		kind: "api-key",
 		apiKey: preparedApiKey
@@ -2527,11 +2633,11 @@ async function withLeasedCodexAppServerClientStartSelectionRetry(params) {
 	let client = params.lease.client;
 	if (!client) throw new Error("Codex app-server selection retry requires an active client lease");
 	const timeoutMs = params.options?.timeoutMs ?? 6e4;
-	const deadline = Date.now() + timeoutMs;
+	const deadline = performance.now() + timeoutMs;
 	const signal = params.signal ?? params.options?.abandonSignal;
 	const requestOptions = () => {
 		if (signal?.aborted) throw new CodexAppServerStartupError("aborted", "Codex app-server selection retry aborted");
-		const remainingTimeoutMs = deadline - Date.now();
+		const remainingTimeoutMs = deadline - performance.now();
 		if (remainingTimeoutMs <= 0) throw new CodexAppServerStartupError("timed_out", "Codex app-server selection retry timed out");
 		return {
 			timeoutMs: remainingTimeoutMs,
@@ -2680,7 +2786,7 @@ function buildCodexAppServerInitializeTimeoutError(client) {
 }
 function resolveRemainingAcquireTimeout(timeoutMs, startedAt) {
 	if (!(timeoutMs > 0)) return timeoutMs;
-	const remaining = timeoutMs - (Date.now() - startedAt);
+	const remaining = timeoutMs - (performance.now() - startedAt);
 	if (remaining <= 0) throw new CodexAppServerStartupError("timed_out", "codex app-server initialize timed out");
 	return remaining;
 }
@@ -2760,7 +2866,7 @@ function trackIsolatedCodexAppServerClient(client) {
 	});
 }
 async function startInitializedCodexAppServerClient(params) {
-	const acquireStartedAt = Date.now();
+	const acquireStartedAt = performance.now();
 	const timeoutMs = params.timeoutMs ?? 0;
 	const abandonSignal = params.abandonSignal ? AbortSignal.any([params.lifetime.controller.signal, params.abandonSignal]) : params.lifetime.controller.signal;
 	const waitForStartup = (operation, timeoutMessage = CODEX_APP_SERVER_INITIALIZE_TIMEOUT_MESSAGE, timeoutErrorFactory) => {
@@ -2805,7 +2911,7 @@ async function startInitializedCodexAppServerClient(params) {
 		} finally {
 			artifactDrain?.cancel();
 		}
-		const runtimeArtifactModule = params.runtimeArtifactMode ? await import("./runtime-artifact-BJ0rXBZ_.js") : void 0;
+		const runtimeArtifactModule = params.runtimeArtifactMode ? await import("./runtime-artifact-CLZ8udh-.mjs") : void 0;
 		const runtimeArtifactBeforeStart = runtimeArtifactModule ? await runtimeArtifactModule.captureCodexAppServerRuntimeArtifactBeforeStart({
 			startOptions,
 			spawnIdentity: resolveCodexAppServerSpawnIdentity(startOptions),
@@ -2847,6 +2953,10 @@ async function startInitializedCodexAppServerClient(params) {
 			}
 			assertStartupCurrent();
 			params.onInitializedClient?.();
+			await waitForStartup(() => observeCodexCatalogClient(client, {
+				startOptions: params.requestedStartOptions,
+				agentDir: params.agentDir
+			}));
 			let runtimeArtifact;
 			if (runtimeArtifactModule && runtimeArtifactBeforeStart) {
 				runtimeArtifact = await runtimeArtifactModule.finalizeCodexAppServerRuntimeArtifact({
@@ -2892,7 +3002,7 @@ async function startInitializedCodexAppServerClient(params) {
 					release();
 					throw error;
 				}
-			});
+			}, () => Boolean(retireSharedCodexAppServerClientIfCurrent(client)));
 			ready = true;
 			return client;
 		} finally {
@@ -2967,8 +3077,8 @@ function retainSharedCodexAppServerClientByInstanceId(clientId) {
 function captureCodexAppServerClientLifetime(client, requiredOwnership) {
 	const state = getSharedCodexAppServerClientState();
 	const start = state.startMetadata.get(client)?.startOptions;
-	if (requiredOwnership === "native-process" && (start?.transport !== "stdio" || isCodexAppServerProxyLaunch(start.args))) throw new AgentHarnessPreflightError("Codex ordinary configuration refresh requires an OpenClaw-managed local stdio process, not an external socket or app-server proxy. No turn was sent; reconnect through managed local stdio before continuing.");
-	const isCurrent = requiredOwnership === "native-process" && state.isolatedClients.has(client) ? () => state.isolatedClients.has(client) && !client.getCloseError() : captureSharedClientRegistration(client);
+	if (requiredOwnership === "native-process" && (start?.transport !== "stdio" || isCodexAppServerProxyLaunch(start.args))) throw new AgentHarnessPreflightError("Codex manual thread adoption requires an OpenClaw-managed local stdio process, not an external socket or app-server proxy. No turn was sent; reconnect through managed local stdio before continuing.");
+	const isCurrent = requiredOwnership !== "connection" && state.isolatedClients.has(client) ? () => state.isolatedClients.has(client) && !client.getCloseError() : captureSharedClientRegistration(client);
 	const assertCurrent = () => {
 		if (!isCurrent()) throw new CodexAdoptedThreadActiveError("Codex app-server connection changed during thread preparation; reconnect before continuing");
 		assertCodexAppServerClientStartSelectionCurrent({ client });
@@ -3044,6 +3154,7 @@ async function clearSharedCodexAppServerClientAndWait(options) {
 	try {
 		while (lifetime.pending.size > 0) await Promise.allSettled(lifetime.pending);
 		await closing;
+		await nativeHookRelayUnregisterQueue.flush();
 	} finally {
 		if (state.startup === lifetime) state.startup = createCodexAppServerStartupLifetime();
 	}
@@ -3106,4 +3217,4 @@ function retirePendingSharedClientEntryIfUnclaimed(entry) {
 	closeRetiredSharedClientEntry(entry);
 }
 //#endregion
-export { reconcileCodexComputerUseStartArtifacts as $, CodexAppServerStartupError as A, forgetCodexWorkspaceReferences as B, CodexThreadBindingConflictError as C, bindCodexInferenceThread as D, assertCodexInferenceRouteConfig as E, resolveCodexStartupTimeoutMs as F, protectCodexAppServerLiveThread as G, isCodexAppServerClientRuntimeLive as H, withCodexStartupTimeout as I, retainCodexAppServerLiveThread as J, readCodexClientSessionMeta as K, claimCodexAppServerLiveThread as L, TURN_TERMINAL_SETTLEMENT_TIMEOUT_MS as M, isCodexAppServerStartupError as N, getCodexInferenceThread as O, resolveCodexGatewayTimeoutWithGraceMs as P, rememberCodexRateLimitsRead as Q, consumeCodexAppServerLiveThread as R, CodexAdoptedThreadActiveError as S, acquireCodexNativeConfigFence as T, isCodexAppServerLiveThreadClaimed as U, hasCodexAppServerLiveThread as V, prepareCodexWorkspaceReferences as W, readCodexRateLimitsRevision as X, unsubscribeCodexAppServerLiveThread as Y, readRecentCodexRateLimits as Z, retainSharedCodexAppServerClientByInstanceId as _, clearSharedCodexAppServerClientIfCurrentAndUnclaimed as a, waitForCodexAppServerClientDesktopGenerationDrain as b, getLeasedSharedCodexAppServerClient as c, readCodexAppServerClientDesktopGeneration as d, resolveCodexAppServerAuthAccountCacheKey as et, readCodexAppServerClientDesktopGenerationFingerprint as f, resolveCodexNativeConfigFenceKey as g, releaseLeasedSharedCodexAppServerClient as h, clearSharedCodexAppServerClientIfCurrent as i, TURN_FINALIZE_DRAIN_ABORT_GRACE_MS as j, prepareCodexInferenceThreadConfig as k, getSharedCodexAppServerClient as l, releaseCodexAppServerClientLease as m, captureCodexAppServerClientLifetime as n, resolveCodexManagedBundledMarketplacePath as nt, clearSharedCodexAppServerClientIfCurrentAndWait as o, readCodexAppServerClientProcessIdentity as p, releaseCodexAppServerLiveThread as q, captureSharedCodexAppServerCatalogLifetime as r, assertNotSymlink as rt, createIsolatedCodexAppServerClient as s, assertCodexAppServerClientStartSelectionCurrent as t, resolveCodexAppServerPreparedAuthHandoff as tt, isCodexAppServerStartSelectionChangedError as u, retainSharedCodexAppServerClientIfCurrent as v, CodexThreadStartRequestError as w, withLeasedCodexAppServerClientStartSelectionRetry as x, shared_client_exports as y, ensureCodexAppServerClientRuntime as z };
+export { assertNotSymlink as $, getCodexInferenceThread as A, prepareCodexWorkspaceReferences as B, CodexThreadBindingConflictError as C, acquireCodexNativeConfigFence as D, nativeHookRelayUnregisterQueue as E, forgetCodexWorkspaceReferences as F, unsubscribeCodexAppServerLiveThread as G, readCodexClientSessionMeta as H, hasCodexAppServerLiveThread as I, rememberCodexRateLimitsRead as J, readCodexRateLimitsRevision as K, hasCodexAppServerSiblingThreadWork as L, claimCodexAppServerLiveThread as M, consumeCodexAppServerLiveThread as N, assertCodexInferenceRouteConfig as O, ensureCodexAppServerClientRuntime as P, resolveCodexManagedBundledMarketplacePath as Q, isCodexAppServerClientRuntimeLive as R, CodexAdoptedThreadActiveError as S, CodexThreadStartRequestError as T, releaseCodexAppServerLiveThread as U, protectCodexAppServerLiveThread as V, retainCodexAppServerLiveThread as W, resolveCodexAppServerAuthAccountCacheKey as X, reconcileCodexComputerUseStartArtifacts as Y, resolveCodexAppServerPreparedAuthHandoff as Z, retainSharedCodexAppServerClientByInstanceId as _, clearSharedCodexAppServerClientIfCurrentAndUnclaimed as a, resolveCodexStartupTimeoutMs as at, waitForCodexAppServerClientDesktopGenerationDrain as b, getLeasedSharedCodexAppServerClient as c, readCodexAppServerClientDesktopGeneration as d, CodexAppServerStartupError as et, readCodexAppServerClientDesktopGenerationFingerprint as f, resolveCodexNativeConfigFenceKey as g, releaseLeasedSharedCodexAppServerClient as h, clearSharedCodexAppServerClientIfCurrent as i, resolveCodexGatewayTimeoutWithGraceMs as it, prepareCodexInferenceThreadConfig as j, bindCodexInferenceThread as k, getSharedCodexAppServerClient as l, releaseCodexAppServerClientLease as m, captureCodexAppServerClientLifetime as n, TURN_TERMINAL_SETTLEMENT_TIMEOUT_MS as nt, clearSharedCodexAppServerClientIfCurrentAndWait as o, withCodexStartupTimeout as ot, readCodexAppServerClientProcessIdentity as p, readRecentCodexRateLimits as q, captureSharedCodexAppServerCatalogLifetime as r, isCodexAppServerStartupError as rt, createIsolatedCodexAppServerClient as s, assertCodexAppServerClientStartSelectionCurrent as t, TURN_FINALIZE_DRAIN_ABORT_GRACE_MS as tt, isCodexAppServerStartSelectionChangedError as u, retainSharedCodexAppServerClientIfCurrent as v, CodexThreadClientReplacementError as w, withLeasedCodexAppServerClientStartSelectionRetry as x, shared_client_exports as y, isCodexAppServerLiveThreadClaimed as z };