@openclaw/codex 2026.9.5 → 2026.9.6

package/dist/.setup/attempt-workspace-context-DUVEn_CS.mjs

@@ -0,0 +1,331 @@
+import { r as flattenCodexDynamicToolFunctions } from "./protocol-CANUwXJ3.mjs";
+import { ct as isMessageOnlyCodexSourceReply } from "./thread-requests-BLvGkP2R.mjs";
+import { readNonBlankString } from "openclaw/plugin-sdk/string-coerce-runtime";
+import path from "node:path";
+import { resolveAgentWorkspaceDir } from "openclaw/plugin-sdk/agent-runtime";
+import { buildBootstrapContextForFiles, embeddedAgentLog, resolveBootstrapFilesForRun } from "openclaw/plugin-sdk/agent-harness-runtime";
+import { resolveBootstrapFilesForPreparation } from "openclaw/plugin-sdk/codex-mcp-projection";
+import { prepareMemorySystemPromptAddition } from "openclaw/plugin-sdk/core";
+//#region extensions/codex/src/app-server/attempt-workspace-context.ts
+/** Workspace snapshots, per-turn workspace context, and memory-tool routing for Codex. */
+const CODEX_NATIVE_PROJECT_DOC_BASENAMES = /* @__PURE__ */ new Set(["agents.md"]);
+const CODEX_TURN_SCOPED_WORKSPACE_DEVELOPER_CONTEXT_BASENAMES = /* @__PURE__ */ new Set([
+	"identity.md",
+	"soul.md",
+	"user.md"
+]);
+const CODEX_WORKSPACE_DEVELOPER_CONTEXT_BASENAMES = new Set(CODEX_TURN_SCOPED_WORKSPACE_DEVELOPER_CONTEXT_BASENAMES);
+const CODEX_MEMORY_CONTEXT_BASENAME = "memory.md";
+const CODEX_MEMORY_TOOL_NAMES = /* @__PURE__ */ new Set(["memory_search", "memory_get"]);
+const CODEX_BOOTSTRAP_CONTEXT_ORDER = /* @__PURE__ */ new Map([
+	["soul.md", 10],
+	["identity.md", 20],
+	["user.md", 30],
+	["bootstrap.md", 50],
+	["memory.md", 60]
+]);
+/** A child baseline reads the bounded workspace snapshot without invoking admission hooks. */
+async function prepareCodexWorkspaceDeveloperInstructions(params) {
+	if (isSameCodexWorkspacePath(params.workspaceDir, params.cwd)) return;
+	const files = await resolveBootstrapFilesForPreparation(params);
+	return renderCodexWorkspaceDeveloperInstructions({
+		files: selectCodexWorkspaceAgentProjectInstructionFiles(buildBootstrapContextForFiles(files, {
+			config: params.config,
+			agentId: params.agentId
+		}), params.workspaceDir),
+		header: "## OpenClaw Agent Workspace Instructions",
+		preamble: "OpenClaw loaded this bounded snapshot from the configured agent workspace."
+	}) ?? "";
+}
+/** Loads and partitions workspace snapshots, turn instructions, and memory references. */
+async function buildCodexWorkspaceBootstrapContext(params) {
+	const inheritsAgentWorkspace = (params.executionWorkspace ?? params.resolvedWorkspace) !== params.resolvedWorkspace;
+	const injectOpenClawContext = shouldInjectCodexOpenClawPromptContext(params.params);
+	const restrictedProjectDocNeedsOpenClawCarrier = params.params.pluginHarnessToolPolicyRestricted === true && !params.params.disableTools && !isMessageOnlyCodexSourceReply(params.params) && params.params.bootstrapContextMode !== "lightweight";
+	const includeAgentWorkspaceInstructions = injectOpenClawContext && !params.ringZeroActive && (inheritsAgentWorkspace || restrictedProjectDocNeedsOpenClawCarrier);
+	try {
+		const promptWorkspace = inheritsAgentWorkspace ? params.resolvedWorkspace : params.effectiveWorkspace;
+		const memoryToolsAvailable = params.memoryToolNames.length > 0 && canRouteCodexWorkspaceMemoryThroughTools({
+			config: params.params.config,
+			agentId: params.params.agentId ?? params.sessionAgentId,
+			workspaceDir: inheritsAgentWorkspace ? params.resolvedWorkspace : params.effectiveWorkspace
+		});
+		const bootstrapFiles = await resolveBootstrapFilesForRun({
+			workspaceDir: params.resolvedWorkspace,
+			config: params.params.config,
+			sessionKey: params.sessionKey,
+			sessionId: params.params.sessionId,
+			bootstrapUserProfileId: params.params.bootstrapUserProfileId,
+			chatType: params.params.chatType,
+			agentId: params.params.agentId ?? params.sessionAgentId,
+			warn: (message) => embeddedAgentLog.warn(message),
+			contextMode: params.params.bootstrapContextMode,
+			runKind: params.params.bootstrapContextRunKind
+		});
+		const memoryToolRoutedBootstrapFiles = memoryToolsAvailable ? selectCodexWorkspaceMemoryReferenceFiles({
+			bootstrapFiles,
+			workspaceDir: params.resolvedWorkspace
+		}) : [];
+		const memoryReferenceFiles = memoryToolRoutedBootstrapFiles.map((file) => remapCodexContextFilePath({
+			file: toCodexEmbeddedContextFile(file),
+			sourceWorkspaceDir: params.resolvedWorkspace,
+			targetWorkspaceDir: promptWorkspace
+		}));
+		const contextFiles = buildBootstrapContextForFiles(memoryToolsAvailable ? bootstrapFiles.filter((file) => !isCodexWorkspaceRootMemoryBootstrapFile({
+			file,
+			workspaceDir: params.resolvedWorkspace
+		})) : bootstrapFiles, {
+			config: params.params.config,
+			agentId: params.params.agentId ?? params.sessionAgentId,
+			warn: (message) => embeddedAgentLog.warn(message)
+		}).map((file) => remapCodexContextFilePath({
+			file,
+			sourceWorkspaceDir: params.resolvedWorkspace,
+			targetWorkspaceDir: promptWorkspace
+		}));
+		const promptContextFiles = selectCodexWorkspacePromptContextFiles(contextFiles, {
+			excludeMemory: memoryToolsAvailable,
+			memoryWorkspaceDir: params.effectiveWorkspace
+		});
+		const threadDeveloperInstructionFiles = includeAgentWorkspaceInstructions ? selectCodexWorkspaceAgentProjectInstructionFiles(contextFiles, params.resolvedWorkspace) : [];
+		const turnScopedDeveloperInstructionFiles = injectOpenClawContext ? selectCodexWorkspaceTurnScopedDeveloperInstructionFiles(contextFiles) : [];
+		return {
+			bootstrapFiles,
+			contextFiles,
+			inheritsAgentWorkspace,
+			promptContextFiles,
+			threadDeveloperInstructionFiles,
+			turnScopedDeveloperInstructionFiles,
+			memoryReferenceFiles,
+			memoryToolRoutedBootstrapFiles,
+			memoryToolNames: [...params.memoryToolNames],
+			memoryToolRouted: memoryToolsAvailable,
+			promptContext: renderCodexWorkspaceBootstrapPromptContext(promptContextFiles),
+			threadDeveloperInstructions: includeAgentWorkspaceInstructions ? params.agentWorkspaceDeveloperInstructions ?? renderCodexWorkspaceDeveloperInstructions({
+				files: threadDeveloperInstructionFiles,
+				header: "## OpenClaw Agent Workspace Instructions",
+				preamble: "OpenClaw loaded this bounded snapshot from the configured agent workspace."
+			}) ?? "" : void 0,
+			turnScopedDeveloperInstructions: renderCodexWorkspaceCollaborationDeveloperInstructions(turnScopedDeveloperInstructionFiles),
+			memoryCollaborationInstructions: injectOpenClawContext ? await renderCodexWorkspaceMemoryCollaborationInstructions({
+				files: memoryReferenceFiles,
+				toolNames: params.memoryToolNames,
+				memoryToolRouted: memoryToolsAvailable,
+				citationsMode: params.params.config?.memory?.citations,
+				agentId: params.params.agentId ?? params.sessionAgentId,
+				agentSessionKey: params.sessionKey,
+				sandboxed: params.sandboxed
+			}) : void 0
+		};
+	} catch (error) {
+		embeddedAgentLog.warn("failed to load codex workspace bootstrap instructions", { error });
+		return {
+			bootstrapFiles: [],
+			contextFiles: [],
+			inheritsAgentWorkspace,
+			threadDeveloperInstructions: includeAgentWorkspaceInstructions ? params.agentWorkspaceDeveloperInstructions : void 0
+		};
+	}
+}
+function shouldInjectCodexOpenClawPromptContext(params) {
+	return !(params.bootstrapContextMode === "lightweight" && params.bootstrapContextRunKind === "cron");
+}
+function renderCodexWorkspaceBootstrapPromptContext(contextFiles) {
+	const files = contextFiles;
+	if (files.length === 0) return;
+	const lines = [
+		"OpenClaw loaded these user-editable workspace files for the current turn. Codex loads project-local AGENTS.md natively. When execution uses another folder, OpenClaw supplies the agent workspace AGENTS.md as thread-level developer instructions. SOUL.md, IDENTITY.md, and USER.md are prepared separately from user input and are not repeated here.",
+		"",
+		"# Project Context",
+		"",
+		"The following project context files have been loaded:"
+	];
+	lines.push("");
+	for (const file of files) lines.push(`## ${file.path}`, "", file.content, "");
+	return lines.join("\n").trim();
+}
+function selectCodexWorkspacePromptContextFiles(contextFiles, options = {}) {
+	const excludeMemory = options.excludeMemory ?? true;
+	return contextFiles.filter((file) => {
+		const baseName = getCodexContextFileBasename(file.path);
+		return baseName && !CODEX_NATIVE_PROJECT_DOC_BASENAMES.has(baseName) && !CODEX_WORKSPACE_DEVELOPER_CONTEXT_BASENAMES.has(baseName) && (!excludeMemory || !isCodexWorkspaceRootMemoryContextFile({
+			file,
+			workspaceDir: options.memoryWorkspaceDir
+		})) && !isMissingCodexBootstrapContextFile(file);
+	}).toSorted(compareCodexContextFiles);
+}
+function selectCodexWorkspaceTurnScopedDeveloperInstructionFiles(contextFiles) {
+	return selectCodexWorkspaceDeveloperInstructionFiles(contextFiles, CODEX_TURN_SCOPED_WORKSPACE_DEVELOPER_CONTEXT_BASENAMES);
+}
+function selectCodexWorkspaceAgentProjectInstructionFiles(contextFiles, agentWorkspaceDir) {
+	const agentProjectDocPath = path.join(path.resolve(agentWorkspaceDir), "AGENTS.md");
+	return selectCodexWorkspaceDeveloperInstructionFiles(contextFiles, CODEX_NATIVE_PROJECT_DOC_BASENAMES).filter((file) => path.resolve(file.path) === agentProjectDocPath);
+}
+function selectCodexWorkspaceDeveloperInstructionFiles(contextFiles, basenames) {
+	return contextFiles.filter((file) => {
+		const baseName = getCodexContextFileBasename(file.path);
+		return baseName && basenames.has(baseName) && !isMissingCodexBootstrapContextFile(file) && file.content.trim().length > 0;
+	}).toSorted(compareCodexContextFiles);
+}
+function renderCodexWorkspaceCollaborationDeveloperInstructions(files) {
+	return renderCodexWorkspaceDeveloperInstructions({
+		files,
+		header: "## OpenClaw Agent Soul",
+		preamble: "OpenClaw loaded these workspace instruction files from the active agent workspace. They are the canonical definitions of who you are, how you think and work, and the human you work alongside. Internalize and follow them accordingly." + (files.some((file) => file.personalUser === true) ? " The personal users/<profile-id>/USER.md belongs to this session's selected person (assigned human owner, otherwise human creator). It supplements shared USER.md and overrides conflicting shared preferences, not higher-priority rules. Other participants do not change this personal context." : ""),
+		wrapperTag: "AGENT_SOUL"
+	});
+}
+function renderCodexWorkspaceDeveloperInstructions(params) {
+	const { files, header, preamble, wrapperTag } = params;
+	if (files.length === 0) return;
+	const lines = [
+		header,
+		"",
+		preamble,
+		""
+	];
+	if (wrapperTag) lines.push(`<${wrapperTag}>`, "");
+	for (const file of files) lines.push(`### ${file.path}`, "", file.content, "");
+	if (wrapperTag) lines.push(`</${wrapperTag}>`);
+	return lines.join("\n").trim();
+}
+function selectCodexWorkspaceMemoryReferenceFiles(params) {
+	return params.bootstrapFiles.filter((file) => {
+		return isCodexWorkspaceRootMemoryBootstrapFile({
+			file,
+			workspaceDir: params.workspaceDir
+		}) && !file.missing && (file.content ?? "").trim().length > 0;
+	}).toSorted(compareCodexBootstrapFiles);
+}
+/**
+* Renders a memory-file reference that points Codex at memory tools instead of
+* embedding MEMORY.md contents.
+*/
+function renderCodexWorkspaceMemoryReference(params) {
+	if (params.files.length === 0) return;
+	const lines = [
+		"## OpenClaw Workspace Memory",
+		"",
+		`MEMORY.md exists in the active agent workspace as a memory file, not an instruction file. OpenClaw does not paste its contents into native Codex turns; use ${(params.toolNames?.length ? params.toolNames : Array.from(CODEX_MEMORY_TOOL_NAMES)).join(" or ")} when durable memory is relevant and the tools are available.`,
+		""
+	];
+	for (const file of params.files) lines.push(`- ${file.path}`);
+	return lines.join("\n").trim();
+}
+async function renderCodexWorkspaceMemoryCollaborationInstructions(params) {
+	const sections = [params.memoryToolRouted ? await renderCodexMemoryRecallInstructions({
+		toolNames: params.toolNames,
+		citationsMode: params.citationsMode,
+		agentId: params.agentId,
+		agentSessionKey: params.agentSessionKey,
+		sandboxed: params.sandboxed
+	}) : void 0, renderCodexWorkspaceMemoryReference({
+		files: params.files,
+		toolNames: params.toolNames
+	})].filter(isNonEmptyString);
+	return sections.length > 0 ? sections.join("\n\n") : void 0;
+}
+async function renderCodexMemoryRecallInstructions(params) {
+	const availableTools = new Set(params.toolNames);
+	const memoryPrompt = await prepareMemorySystemPromptAddition({
+		availableTools,
+		citationsMode: params.citationsMode,
+		agentId: params.agentId,
+		agentSessionKey: params.agentSessionKey,
+		sandboxed: params.sandboxed
+	}).catch((error) => {
+		embeddedAgentLog.warn("failed to prepare codex memory recall instructions", { error });
+	});
+	if (!memoryPrompt) return;
+	return [memoryPrompt, renderCodexMemoryToolSearchBridge(params.toolNames)].filter(isNonEmptyString).join("\n").trim();
+}
+function renderCodexMemoryToolSearchBridge(toolNames) {
+	const memoryToolNames = toolNames.map((name) => normalizeCodexDynamicToolName(name)).filter((name) => CODEX_MEMORY_TOOL_NAMES.has(name)).toSorted();
+	if (memoryToolNames.length === 0) return;
+	return `Codex may expose ${memoryToolNames.join(" and ")} as deferred tools. When the memory guidance above calls for memory recall, use an already-loaded memory tool directly. If the needed memory tool is deferred and not currently callable, use \`tool_search\` to load it, then call that memory tool.`;
+}
+/** Lists available memory tool names understood by Codex workspace memory routing. */
+function getCodexWorkspaceMemoryToolNames(tools) {
+	const availableToolNames = new Set(flattenCodexDynamicToolFunctions(tools).map((tool) => normalizeCodexDynamicToolName(tool.name)));
+	return Array.from(CODEX_MEMORY_TOOL_NAMES).filter((name) => availableToolNames.has(name));
+}
+function canRouteCodexWorkspaceMemoryThroughTools(params) {
+	if (!params.config) return false;
+	return isSameCodexWorkspacePath(resolveAgentWorkspaceDir(params.config, params.agentId), params.workspaceDir);
+}
+function isMissingCodexBootstrapContextFile(file) {
+	return file.content.trimStart().startsWith("[MISSING] Expected at:");
+}
+function toCodexEmbeddedContextFile(file) {
+	return {
+		path: readNonBlankString(file.path) ?? readNonBlankString(file.name) ?? "",
+		content: file.content ?? "",
+		...file.personalUser === true ? { personalUser: true } : {}
+	};
+}
+function isCodexWorkspaceRootMemoryBootstrapFile(params) {
+	return isCodexWorkspaceRootMemoryPath({
+		filePath: readNonBlankString(params.file.path) ?? readNonBlankString(params.file.name) ?? "",
+		workspaceDir: params.workspaceDir
+	});
+}
+function isCodexWorkspaceRootMemoryContextFile(params) {
+	if (!params.workspaceDir) return false;
+	return isCodexWorkspaceRootMemoryPath({
+		filePath: params.file.path,
+		workspaceDir: params.workspaceDir
+	});
+}
+function isCodexWorkspaceRootMemoryPath(params) {
+	const filePath = params.filePath.trim();
+	if (!filePath) return false;
+	return (path.isAbsolute(filePath) ? path.resolve(filePath) : path.resolve(params.workspaceDir, filePath)) === path.join(path.resolve(params.workspaceDir), "MEMORY.md");
+}
+function isSameCodexWorkspacePath(left, right) {
+	return path.resolve(left) === path.resolve(right);
+}
+/**
+* Remaps bootstrap file paths from the resolved workspace to the effective Codex
+* workspace while preserving platform path separators.
+*/
+function remapCodexContextFilePath(params) {
+	const relativePath = path.relative(params.sourceWorkspaceDir, params.file.path);
+	if (!relativePath || relativePath === ".." || relativePath.startsWith(`..${path.sep}`) || path.isAbsolute(relativePath) || params.sourceWorkspaceDir === params.targetWorkspaceDir) return params.file;
+	const targetUsesPosixSeparators = params.targetWorkspaceDir.includes("/") && !params.targetWorkspaceDir.includes("\\");
+	const normalizedRelativePath = targetUsesPosixSeparators ? relativePath.replaceAll("\\", "/") : relativePath.replaceAll("/", "\\");
+	return {
+		...params.file,
+		path: targetUsesPosixSeparators ? path.posix.join(params.targetWorkspaceDir, normalizedRelativePath) : path.win32.join(params.targetWorkspaceDir, normalizedRelativePath)
+	};
+}
+function compareCodexContextFiles(left, right) {
+	const leftPath = normalizeCodexContextFilePath(left.path);
+	const rightPath = normalizeCodexContextFilePath(right.path);
+	const leftBase = getCodexContextFileBasename(left.path);
+	const rightBase = getCodexContextFileBasename(right.path);
+	const leftOrder = CODEX_BOOTSTRAP_CONTEXT_ORDER.get(leftBase) ?? Number.MAX_SAFE_INTEGER;
+	const rightOrder = CODEX_BOOTSTRAP_CONTEXT_ORDER.get(rightBase) ?? Number.MAX_SAFE_INTEGER;
+	if (leftOrder !== rightOrder) return leftOrder - rightOrder;
+	if (leftBase !== rightBase) return leftBase.localeCompare(rightBase);
+	return leftBase === "user.md" ? 0 : leftPath.localeCompare(rightPath);
+}
+function compareCodexBootstrapFiles(left, right) {
+	return compareCodexContextFiles(toCodexEmbeddedContextFile(left), toCodexEmbeddedContextFile(right));
+}
+function normalizeCodexContextFilePath(filePath) {
+	return filePath.trim().replaceAll("\\", "/").toLowerCase();
+}
+function getCodexContextFileDisplayBasename(filePath) {
+	return filePath.trim().replaceAll("\\", "/").split("/").pop()?.trim() ?? "";
+}
+function getCodexContextFileBasename(filePath) {
+	return normalizeCodexContextFilePath(filePath).split("/").pop() ?? "";
+}
+function normalizeCodexDynamicToolName(name) {
+	return name.trim().toLowerCase();
+}
+function isNonEmptyString(value) {
+	return typeof value === "string" && value.length > 0;
+}
+//#endregion
+export { getCodexContextFileDisplayBasename as a, normalizeCodexContextFilePath as c, shouldInjectCodexOpenClawPromptContext as d, getCodexContextFileBasename as i, normalizeCodexDynamicToolName as l, CODEX_NATIVE_PROJECT_DOC_BASENAMES as n, getCodexWorkspaceMemoryToolNames as o, buildCodexWorkspaceBootstrapContext as r, isNonEmptyString as s, CODEX_MEMORY_CONTEXT_BASENAME as t, prepareCodexWorkspaceDeveloperInstructions as u };

package/dist/.setup/{auth-cache-key-QirmgiCo.mjs → auth-cache-key-B2mpaI9D.mjs}

@@ -1,11 +1,12 @@
-import { n as defineCodexBuildState } from "./build-state-Xx9ybZqa.mjs";
-import { c as resolveMacOSDesktopCodexAppPathCandidates } from "./managed-binary-DP6Rib3P.mjs";
-import { n as resolveCodexAppServerSpawnEnv } from "./transport-stdio-Cmx94Oiy.mjs";
+import { n as defineCodexBuildState } from "./build-state-C7EnDVgr.mjs";
+import { u as resolveMacOSDesktopCodexAppPathCandidates } from "./managed-binary-BnshlFag.mjs";
+import { n as resolveCodexAppServerSpawnEnv } from "./transport-stdio-h2VHOskC.mjs";
 import { createHash } from "node:crypto";
 import fs, { constants, existsSync, watch } from "node:fs";
 import path from "node:path";
 import os from "node:os";
 import fs$1 from "node:fs/promises";
+import { sha256File } from "openclaw/plugin-sdk/file-access-runtime";
 import { readSecretFile } from "openclaw/plugin-sdk/secret-file";
 //#region extensions/codex/src/app-server/desktop-generation-fingerprint.ts
 const MAX_COMPUTER_USE_PLUGIN_TREE_ENTRIES = 4096;
@@ -94,10 +95,10 @@ async function readFileFingerprint(filePath, expected, followsSymlink) {
 	try {
 		const before = await handle.stat({ bigint: true });
 		if (!sameStat(before, expected)) throw new Error(`Codex desktop artifact changed while fingerprinting: ${filePath}`);
-		const hash = createHash("sha256");
-		for await (const chunk of handle.createReadStream({ autoClose: false })) hash.update(chunk);
-		if (!sameStat(before, await handle.stat({ bigint: true }))) throw new Error(`Codex desktop artifact changed while fingerprinting: ${filePath}`);
-		return hash.digest("hex");
+		const hash = await sha256File(handle, { maxBytes: Number(before.size) });
+		const after = await handle.stat({ bigint: true });
+		if (BigInt(hash.bytes) !== before.size || !sameStat(before, after)) throw new Error(`Codex desktop artifact changed while fingerprinting: ${filePath}`);
+		return hash.digest;
 	} finally {
 		await handle.close();
 	}
@@ -321,79 +322,6 @@ function closeWatchers(current) {
 	for (const watcher of watchers ?? []) watcher.close();
 }
 //#endregion
-//#region extensions/codex/src/app-server/shared-client-lifecycle.ts
-/** Client ownership and synchronous retirement, independent of startup/auth execution. */
-const createCodexAppServerStartupLifetime = () => ({
-	controller: new AbortController(),
-	pending: /* @__PURE__ */ new Set()
-});
-const getSharedCodexAppServerClientState = defineCodexBuildState("openclaw.codexAppServerClientState", () => ({
-	clients: /* @__PURE__ */ new Map(),
-	liveClients: /* @__PURE__ */ new Set(),
-	isolatedClients: /* @__PURE__ */ new Set(),
-	entriesByClient: /* @__PURE__ */ new WeakMap(),
-	desktopGenerationDrainChecks: /* @__PURE__ */ new Set(),
-	startup: createCodexAppServerStartupLifetime(),
-	startMetadata: /* @__PURE__ */ new WeakMap()
-}));
-function getCurrentSharedClientEntry(client) {
-	const state = getSharedCodexAppServerClientState();
-	const entry = client ? state.entriesByClient.get(client) : void 0;
-	return entry && entry.client === client && state.clients.get(entry.key) === entry ? entry : void 0;
-}
-/**
-* Retires a matching shared client. Default is graceful: detach from the map
-* (future acquisitions get a fresh client) and close once leases drain.
-* `failActiveLeases` is for suspect clients only (timed-out turns): it closes
-* the physical connection immediately so co-leased attempts hit the normal
-* client-closed retry path, and pending acquires reject instead of leasing
-* the poisoned process. Routine cleanup must NOT use it — it would abort
-* healthy sibling turns on a working client.
-*/
-function retireSharedCodexAppServerClientIfCurrent(client, opts) {
-	if (!client) return;
-	const state = getSharedCodexAppServerClientState();
-	const currentEntry = getCurrentSharedClientEntry(client);
-	const entry = currentEntry ?? state.entriesByClient.get(client);
-	if (!entry || entry.client !== client && !entry.closeError) return;
-	if (currentEntry) {
-		state.clients.delete(entry.key);
-		entry.closeWhenIdle = true;
-	}
-	if (opts?.failActiveLeases && (currentEntry || !entry.closeError)) {
-		entry.closeError = /* @__PURE__ */ new Error("codex app-server client is closed");
-		return {
-			activeLeases: entry.activeLeases,
-			closed: closeRetiredSharedClientEntry(entry)
-		};
-	}
-	return {
-		activeLeases: entry.activeLeases,
-		closed: currentEntry ? closeRetiredSharedClientEntryIfIdle(entry) : false
-	};
-}
-/** Gracefully retires exact clients attached to an older desktop generation. */
-function retireSharedCodexAppServerClientsBeforeDesktopGeneration(generation) {
-	const state = getSharedCodexAppServerClientState();
-	for (const entry of state.clients.values()) {
-		const client = entry.client;
-		const attached = client ? state.startMetadata.get(client) : void 0;
-		if (client && attached?.desktopGeneration && attached.desktopGeneration.epoch < generation.epoch) retireSharedCodexAppServerClientIfCurrent(client);
-	}
-}
-function closeRetiredSharedClientEntryIfIdle(entry) {
-	if (!entry.closeWhenIdle || entry.activeLeases > 0 || entry.pendingAcquires > 0 || !entry.client) return false;
-	entry.closeWhenIdle = false;
-	return closeRetiredSharedClientEntry(entry);
-}
-function closeRetiredSharedClientEntry(entry) {
-	const client = entry.client;
-	if (!client) return false;
-	entry.client = void 0;
-	client.close();
-	return true;
-}
-//#endregion
 //#region extensions/codex/src/app-server/auth-cache-key.ts
 /** Auth cache identity and native CLI credential reads, without login or refresh. */
 const CODEX_HOME_ENV_VAR = "CODEX_HOME";
@@ -495,4 +423,4 @@ function readFirstNonEmptyEnvEntry(env, keys) {
 	}
 }
 //#endregion
-export { isCodexDesktopGenerationCurrent as _, readCodexCliAuthFileApiKey as a, resolveCodexAppServerPreparedApiKeyCacheKey as c, createCodexAppServerStartupLifetime as d, getCurrentSharedClientEntry as f, createCodexDesktopGenerationService as g, retireSharedCodexAppServerClientsBeforeDesktopGeneration as h, fingerprintTokenAuthProfileCacheKey as i, closeRetiredSharedClientEntry as l, retireSharedCodexAppServerClientIfCurrent as m, CODEX_AUTH_JSON_FILENAME as n, readFirstNonEmptyEnv as o, getSharedCodexAppServerClientState as p, fingerprintApiKeyAuthProfileCacheKey as r, resolveCodexAppServerFallbackApiKeyCacheKey as s, CODEX_APP_SERVER_API_KEY_ENV_VARS as t, closeRetiredSharedClientEntryIfIdle as u, waitForCodexDesktopGeneration as v };
+export { readCodexCliAuthFileApiKey as a, resolveCodexAppServerPreparedApiKeyCacheKey as c, waitForCodexDesktopGeneration as d, fingerprintTokenAuthProfileCacheKey as i, createCodexDesktopGenerationService as l, CODEX_AUTH_JSON_FILENAME as n, readFirstNonEmptyEnv as o, fingerprintApiKeyAuthProfileCacheKey as r, resolveCodexAppServerFallbackApiKeyCacheKey as s, CODEX_APP_SERVER_API_KEY_ENV_VARS as t, isCodexDesktopGenerationCurrent as u };

package/dist/.setup/auth-profile-health-oHizqgye.mjs

@@ -0,0 +1,53 @@
+import { r as formatCodexAuthProfileUnavailableMessage, t as CODEX_NATIVE_PROFILE_IMPORT_COMMAND } from "./auth-profile-recovery-BREezV0L.mjs";
+//#region extensions/codex/src/auth-profile-health.ts
+const CHECK_ID = "codex/native-profile-recovery";
+const PROFILE_ID = "openai:default";
+async function collectFindings(config, env) {
+	const declared = config.auth?.profiles?.[PROFILE_ID];
+	if (declared?.provider !== "openai" || declared.mode !== "oauth") return [];
+	const [{ loadAuthProfileStoreForRuntime }, { listAgentIds, resolveAgentDir }] = await Promise.all([import("openclaw/plugin-sdk/agent-runtime"), import("openclaw/plugin-sdk/agent-scope-runtime")]);
+	const findings = [];
+	const missing = [];
+	for (const agentId of listAgentIds(config)) try {
+		if (!loadAuthProfileStoreForRuntime(resolveAgentDir(config, agentId, env), {
+			readOnly: true,
+			config,
+			externalCli: { mode: "none" }
+		}, env).profiles[PROFILE_ID]) missing.push(agentId);
+	} catch (error) {
+		findings.push({
+			checkId: CHECK_ID,
+			source: "codex",
+			severity: "warning",
+			message: `Could not inspect OpenAI auth profiles for agent "${agentId}": ${error instanceof Error ? error.message : String(error)}`,
+			fixHint: "openclaw doctor --fix"
+		});
+	}
+	if (missing.length > 0) findings.push({
+		checkId: CHECK_ID,
+		source: "codex",
+		severity: "warning",
+		message: `${formatCodexAuthProfileUnavailableMessage(PROFILE_ID)} Affected agents: ${missing.join(", ")}.`,
+		fixHint: CODEX_NATIVE_PROFILE_IMPORT_COMMAND
+	});
+	return findings;
+}
+const codexNativeProfileRecoveryHealthCheck = {
+	id: CHECK_ID,
+	kind: "plugin",
+	source: "codex",
+	description: "Explain recovery for a configured profile formerly supplied by native Codex login.",
+	detect: (ctx) => collectFindings(ctx.cfg, ctx.env ?? process.env)
+};
+const codexNativeProfileRecoveryService = {
+	id: CHECK_ID,
+	async start(ctx) {
+		const findings = await collectFindings(ctx.config, {
+			...process.env,
+			OPENCLAW_STATE_DIR: ctx.stateDir
+		});
+		for (const finding of findings) ctx.logger.warn(finding.message);
+	}
+};
+//#endregion
+export { codexNativeProfileRecoveryService as n, codexNativeProfileRecoveryHealthCheck as t };

package/dist/.setup/auth-profile-recovery-BREezV0L.mjs

@@ -0,0 +1,14 @@
+//#region extensions/codex/src/app-server/auth-profile-recovery.ts
+const CODEX_NATIVE_PROFILE_IMPORT_COMMAND = "openclaw models auth login --provider openai --method device-code";
+var CodexAppServerAuthProfileUnavailableError = class extends Error {
+	constructor(..._args) {
+		super(..._args);
+		this.code = "selected_auth_profile_unavailable";
+	}
+};
+function formatCodexAuthProfileUnavailableMessage(profileId) {
+	const missing = `Codex app-server auth profile "${profileId}" was not found in the OpenClaw credential store. This is a local credential lookup failure.`;
+	return profileId === "openai:default" ? `${missing} Since 2026.9.5, OpenClaw no longer supplies this profile from the native Codex login. Run \`${CODEX_NATIVE_PROFILE_IMPORT_COMMAND}\` to import that login or sign in through OpenClaw, then retry. For multiple agents, add \`--agent <id>\`.` : `${missing} Restore or select an existing OpenAI profile, then retry.`;
+}
+//#endregion
+export { CodexAppServerAuthProfileUnavailableError as n, formatCodexAuthProfileUnavailableMessage as r, CODEX_NATIVE_PROFILE_IMPORT_COMMAND as t };

package/dist/.setup/{binding-connection-Bm38niE8.mjs → binding-connection-ThoatDcb.mjs}

@@ -44,7 +44,7 @@ function requireCodexSupervisionModelSelection(binding) {
 }
 /** Registration publishes the resolver; connection policy loads only for an actual request. */
 async function resolveCodexBindingAppServerConnection(params) {
-	return (await import("./binding-connection.runtime-CnRMC0ta.mjs")).resolveCodexBindingAppServerConnection(params, catalogHomes.tryGetRuntime());
+	return (await import("./binding-connection.runtime-yoHrABt-.mjs")).resolveCodexBindingAppServerConnection(params, catalogHomes.tryGetRuntime());
 }
 //#endregion
 export { setCodexCatalogConnectionHomeResolver as a, resolveCodexBindingAppServerConnection as i, binding_connection_exports as n, requireCodexSupervisionModelSelection as r, assertCodexSessionRuntimeOwnership as t };

package/dist/.setup/{binding-connection.runtime-CnRMC0ta.mjs → binding-connection.runtime-yoHrABt-.mjs}

@@ -1,7 +1,7 @@
-import { g as resolveCodexAppServerLocalHomeDir } from "./config-security-BRQ2mgW9.mjs";
+import { f as resolveCodexAppServerLocalHomeDir } from "./config-security-BEReZ6go.mjs";
 import { d as readCodexPluginConfig } from "./config-parsing-CcB9iPoq.mjs";
-import { t as buildCodexAppServerConnectionFingerprint } from "./plugin-app-cache-key-BOxKP7db.mjs";
-import { n as resolveCodexAppServerRuntimeOptions, r as resolveCodexSupervisionAppServerRuntimeOptions } from "./config-runtime-CeAhl_h4.mjs";
+import { t as buildCodexAppServerConnectionFingerprint } from "./plugin-app-cache-key-B2CsSdnV.mjs";
+import { n as resolveCodexAppServerRuntimeOptions, r as resolveCodexSupervisionAppServerRuntimeOptions } from "./config-runtime-C8Rw1m1m.mjs";
 //#region extensions/codex/src/app-server/binding-connection.runtime.ts
 /** Resolves connection and auth ownership exclusively from the private thread binding. */
 async function resolveCodexBindingAppServerConnection(params, discoverHomes) {
@@ -41,7 +41,7 @@ async function resolveCodexBindingAppServerConnection(params, discoverHomes) {
 		appServer,
 		usesSupervisionConnection,
 		requestAuthProfileId: usesSupervisionConnection ? void 0 : authProfileId,
-		clientAuthProfileId: usesSupervisionConnection ? null : authProfileId
+		clientAuthProfileId: usesSupervisionConnection || appServer.start.homeScope === "user" ? null : authProfileId
 	};
 }
 //#endregion