@openclaw/codex 2026.9.5 → 2026.9.6

package/dist/.setup/{shared-client-BpTtuLQ5.mjs → shared-client-DA4VR4Eb.mjs}

@@ -1,17 +1,19 @@
 import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.mjs";
-import { n as defineCodexBuildState, t as codexBuildSymbol } from "./build-state-Xx9ybZqa.mjs";
+import { n as defineCodexBuildState, t as codexBuildSymbol } from "./build-state-C7EnDVgr.mjs";
 import { t as CODEX_APP_SERVER_AUTH_PROVIDER } from "./auth-profile-selection-DFu9e167.mjs";
-import { _ as resolveCodexAppServerUserHomeDir, g as resolveCodexAppServerLocalHomeDir, h as resolveCodexAppServerHomeDir, m as isJsonObject, v as withEphemeralCodexAuthStore } from "./config-security-BRQ2mgW9.mjs";
-import { n as isCodexAppServerProxyLaunch } from "./launch-args-DnMak49W.mjs";
-import { f as isUnsupportedCodexAppServerVersionError, t as CodexAppServerClient } from "./client-vXs2929Q.mjs";
-import { a as resolveCodexAppServerStartOptionsForAgent, d as readCodexEffectiveConfig, o as resolveCodexComputerUseConfig, t as codexAppServerStartOptionsKey, u as CODEX_SESSION_OVERRIDABLE_LAYER_TYPES } from "./config-options-BsanJ8QG.mjs";
-import { c as resolveMacOSDesktopCodexAppPathCandidates, i as resolveManagedCodexNativeCommand, l as resolveMacOSDesktopCodexBundledMarketplaceCandidates, r as resolveManagedCodexAppServerStartOptions, s as resolveFirstExistingMacOSDesktopCodexBundledMarketplacePath, t as isManagedCodexDesktopCommand, u as resolveMacOSDesktopCodexComputerUseServiceAppCandidates } from "./managed-binary-DP6Rib3P.mjs";
-import { _ as isCodexDesktopGenerationCurrent, a as readCodexCliAuthFileApiKey, c as resolveCodexAppServerPreparedApiKeyCacheKey, d as createCodexAppServerStartupLifetime, f as getCurrentSharedClientEntry, i as fingerprintTokenAuthProfileCacheKey, l as closeRetiredSharedClientEntry, m as retireSharedCodexAppServerClientIfCurrent, n as CODEX_AUTH_JSON_FILENAME, o as readFirstNonEmptyEnv, p as getSharedCodexAppServerClientState, r as fingerprintApiKeyAuthProfileCacheKey, s as resolveCodexAppServerFallbackApiKeyCacheKey, t as CODEX_APP_SERVER_API_KEY_ENV_VARS, u as closeRetiredSharedClientEntryIfIdle, v as waitForCodexDesktopGeneration } from "./auth-cache-key-QirmgiCo.mjs";
-import { n as resolveCodexAppServerSpawnEnv } from "./transport-stdio-Cmx94Oiy.mjs";
-import { n as withTimeout } from "./timeout-DZF05XrR.mjs";
-import { c as readCodexSessionMeta, n as observeCodexCatalogClient } from "./session-catalog-events-jMcYfQyd.mjs";
-import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-CeAhl_h4.mjs";
+import { d as resolveCodexAppServerHomeDir, f as resolveCodexAppServerLocalHomeDir, h as withEphemeralCodexAuthStore, m as withClearedEnvironmentVariables, p as resolveCodexAppServerUserHomeDir } from "./config-security-BEReZ6go.mjs";
+import { n as isCodexAppServerProxyLaunch } from "./launch-args-DbFCehO7.mjs";
+import { i as isJsonObject } from "./protocol-CANUwXJ3.mjs";
+import { a as resolveCodexAppServerStartOptionsForAgent, d as readCodexEffectiveConfig, o as resolveCodexComputerUseConfig, t as codexAppServerStartOptionsKey, u as CODEX_SESSION_OVERRIDABLE_LAYER_TYPES } from "./config-options-BvaRs51b.mjs";
+import { d as resolveMacOSDesktopCodexBundledMarketplaceCandidates, f as resolveMacOSDesktopCodexComputerUseServiceAppCandidates, i as resolveManagedCodexNativeCommand, l as resolveFirstExistingMacOSDesktopCodexBundledMarketplacePath, r as resolveManagedCodexAppServerStartOptions, t as isManagedCodexDesktopCommand, u as resolveMacOSDesktopCodexAppPathCandidates } from "./managed-binary-BnshlFag.mjs";
+import { a as readCodexCliAuthFileApiKey, c as resolveCodexAppServerPreparedApiKeyCacheKey, d as waitForCodexDesktopGeneration, i as fingerprintTokenAuthProfileCacheKey, n as CODEX_AUTH_JSON_FILENAME, o as readFirstNonEmptyEnv, r as fingerprintApiKeyAuthProfileCacheKey, s as resolveCodexAppServerFallbackApiKeyCacheKey, t as CODEX_APP_SERVER_API_KEY_ENV_VARS, u as isCodexDesktopGenerationCurrent } from "./auth-cache-key-B2mpaI9D.mjs";
+import { d as createCodexAppServerStartupLifetime, f as getCurrentSharedClientEntry, h as retireSharedCodexAppServerClientIfCurrent, l as closeRetiredSharedClientEntry, n as observeCodexCatalogClient, o as readCodexSessionMeta, p as getSharedCodexAppServerClientState, u as closeRetiredSharedClientEntryIfIdle } from "./session-catalog-events-Bj6j94E_.mjs";
+import { n as resolveCodexAppServerSpawnEnv } from "./transport-stdio-h2VHOskC.mjs";
+import { n as CodexAppServerAuthProfileUnavailableError, r as formatCodexAuthProfileUnavailableMessage } from "./auth-profile-recovery-BREezV0L.mjs";
+import { i as withTimeout } from "./timeout-C910MdAB.mjs";
+import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-C8Rw1m1m.mjs";
 import { a as resolveCodexAppServerAuthProfileStore, i as resolveCodexAppServerAuthProfileIdForAgent, r as resolveCodexAppServerAuthProfileId, t as isCodexAppServerNativeAuthProfile } from "./auth-profile-WqZtZfXN.mjs";
+import { f as isUnsupportedCodexAppServerVersionError, t as CodexAppServerClient } from "./client-Cs08OXVQ.mjs";
 import { isRecord } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { createHash } from "node:crypto";
 import { isDeepStrictEqual } from "node:util";
@@ -880,7 +882,10 @@ const scopedOAuthRefreshQueues = /* @__PURE__ */ new WeakMap();
 async function bridgeCodexAppServerStartOptions(params) {
 	if (params.startOptions.transport !== "stdio") return params.startOptions;
 	const scopeStartOptions = () => withCodexHomeEnvironment(withEphemeralCodexAuthStore(params), params.agentDir);
-	if (params.preparedAuth) return withClearedEnvironmentVariables(await scopeStartOptions(), CODEX_APP_SERVER_PREPARED_AUTH_ENV_VARS);
+	if (params.preparedAuth) {
+		const scopedStartOptions = await scopeStartOptions();
+		return withClearedEnvironmentVariables(scopedStartOptions, CODEX_APP_SERVER_PREPARED_AUTH_ENV_VARS);
+	}
 	if (params.authProfileId === null) return scopeStartOptions();
 	const store = resolveCodexAppServerAuthProfileStore({
 		agentDir: params.agentDir,
@@ -964,6 +969,7 @@ async function resolveCodexAppServerPreparedAuthHandoff(params) {
 		};
 	}
 	const authProfileId = params.authProfileId?.trim() || void 0;
+	if (authProfileId && !params.authProfileStore.profiles[authProfileId]) throw new CodexAppServerAuthProfileUnavailableError(formatCodexAuthProfileUnavailableMessage(authProfileId));
 	const nativeAuthProfile = isCodexAppServerNativeAuthProfile({
 		authProfileId,
 		authProfileStore: params.authProfileStore,
@@ -1009,23 +1015,16 @@ async function resolveCodexAppServerAuthAccountCacheKey(params) {
 	if (!profileId) return;
 	const credential = store.profiles[profileId];
 	if (!credential || !isCodexAppServerAuthProfileCredential(credential)) return;
-	if (credential.type === "api_key") {
-		const apiKey = (await resolveApiKeyForProfile({
-			store,
-			profileId,
-			agentDir
-		}))?.apiKey?.trim();
-		return apiKey ? `${resolveChatgptAccountId(profileId, credential)}:${fingerprintApiKeyAuthProfileCacheKey(apiKey)}` : resolveChatgptAccountId(profileId, credential);
-	}
-	if (credential.type === "token") {
-		const accessToken = (await resolveApiKeyForProfile({
-			store,
-			profileId,
-			agentDir
-		}))?.apiKey?.trim();
-		return accessToken ? `${resolveChatgptAccountId(profileId, credential)}:${fingerprintTokenAuthProfileCacheKey(accessToken)}` : resolveChatgptAccountId(profileId, credential);
-	}
-	return resolveChatgptAccountId(profileId, credential);
+	const accountId = resolveChatgptAccountId(profileId, credential);
+	if (credential.type === "oauth") return accountId;
+	const value = (await resolveApiKeyForProfile({
+		cfg: params.config,
+		store,
+		profileId,
+		agentDir
+	}))?.apiKey?.trim();
+	if (!value) return accountId;
+	return `${accountId}:${credential.type === "api_key" ? fingerprintApiKeyAuthProfileCacheKey(value) : fingerprintTokenAuthProfileCacheKey(value)}`;
 }
 async function withCodexHomeEnvironment(startOptions, agentDir) {
 	const codexHome = resolveCodexAppServerLocalHomeDir(startOptions, agentDir);
@@ -1231,8 +1230,7 @@ async function applyCodexAppServerAuthProfile(params) {
 */
 async function assertNativeCodexAccountMatchesRoute(client, authRequirement, assertCurrent) {
 	if (!authRequirement) return;
-	const response = await client.request("account/read", { refreshToken: false }, { assertCurrent });
-	const accountType = isJsonObject(response.account) ? response.account.type : void 0;
+	const accountType = (await client.request("account/read", { refreshToken: false }, { assertCurrent })).account?.type;
 	if (authRequirement === "subscription") {
 		if (accountType !== "chatgpt") throw createCodexAppServerAuthError("Codex subscription route requires ChatGPT auth in the native Codex home. Run `codex login` for that home, or use appServer.homeScope=\"agent\" with an OpenClaw OAuth profile, then retry.");
 		return;
@@ -1243,23 +1241,8 @@ function createCodexAppServerAuthError(message, cause) {
 	const error = cause === void 0 ? new Error(message) : new Error(message, { cause });
 	return Object.assign(error, { status: 401 });
 }
-var CodexAppServerAuthProfileUnavailableError = class extends Error {
-	constructor(..._args) {
-		super(..._args);
-		this.status = 401;
-		this.code = "selected_auth_profile_unavailable";
-	}
-};
 async function resolveCodexAppServerAuthProfileLoginParams(params) {
 	const store = resolveCodexAppServerAuthProfileStore(params);
-	const profileId = resolveCodexAppServerAuthProfileId({
-		authProfileId: params.authProfileId,
-		store,
-		config: params.config
-	});
-	const profile = profileId ? store.profiles[profileId] : void 0;
-	if (profileId && !profile) throw new CodexAppServerAuthProfileUnavailableError(`Codex app-server auth profile "${profileId}" was not found. Select an existing OpenAI profile or sign in again with OpenClaw, then retry.`);
-	if (profileId && profile && !isCodexAppServerAuthProfileCredential(profile)) throw new CodexAppServerAuthProfileUnavailableError(`Codex app-server auth profile "${profileId}" must use the canonical OpenAI auth provider; run "openclaw doctor --fix" to migrate legacy provider IDs.`);
 	return await resolveCodexAppServerAuthProfileLoginParamsInternal({
 		...params,
 		authProfileStore: store
@@ -1307,7 +1290,7 @@ async function resolveCodexAppServerAuthProfileLoginParamsInternal(params) {
 	});
 	if (!profileId) return;
 	const credential = store.profiles[profileId];
-	if (!credential) throw new CodexAppServerAuthProfileUnavailableError(`Codex app-server auth profile "${profileId}" was not found. Select an existing OpenAI profile or sign in again with OpenClaw, then retry.`);
+	if (!credential) throw new CodexAppServerAuthProfileUnavailableError(formatCodexAuthProfileUnavailableMessage(profileId));
 	if (!isCodexAppServerAuthProfileCredential(credential)) throw new CodexAppServerAuthProfileUnavailableError(`Codex app-server auth profile "${profileId}" must use the canonical OpenAI auth provider; run "openclaw doctor --fix" to migrate legacy provider IDs.`);
 	const loginParams = await resolveLoginParamsForCredential(profileId, credential, {
 		agentDir: params.agentDir,
@@ -1331,30 +1314,22 @@ async function resolveCodexAppServerFallbackApiKeyLoginParams(params) {
 	};
 }
 async function resolveLoginParamsForCredential(profileId, credential, params) {
-	if (credential.type === "api_key") {
-		const apiKey = (await resolveApiKeyForProfile({
+	if (credential.type === "api_key" || credential.type === "token") {
+		const value = (await resolveApiKeyForProfile({
+			cfg: params.config,
 			store: params.preferStoreCredential ? params.store : ensureAuthProfileStore(params.agentDir, {
 				allowKeychainPrompt: false,
-				profileId
+				profileId,
+				config: params.config
 			}),
 			profileId,
 			agentDir: params.agentDir
 		}))?.apiKey?.trim();
-		return apiKey ? {
+		if (!value) return;
+		return credential.type === "api_key" ? {
 			type: "apiKey",
-			apiKey
-		} : void 0;
-	}
-	if (credential.type === "token") {
-		const accessToken = (await resolveApiKeyForProfile({
-			store: params.preferStoreCredential ? params.store : ensureAuthProfileStore(params.agentDir, {
-				allowKeychainPrompt: false,
-				profileId
-			}),
-			profileId,
-			agentDir: params.agentDir
-		}))?.apiKey?.trim();
-		return accessToken ? buildChatgptAuthTokensParams(profileId, credential, accessToken) : void 0;
+			apiKey: value
+		} : buildChatgptAuthTokensParams(profileId, credential, value);
 	}
 	if (credential.type !== "oauth") return;
 	const resolvedCredential = await resolveOAuthCredentialForCodexAppServer(profileId, credential, {
@@ -1384,7 +1359,7 @@ async function resolveOAuthCredentialForCodexAppServer(profileId, credential, pa
 		persistedCredential,
 		suppliedCredential: credential
 	});
-	if (params.preferStoreCredential && params.store.runtimePersistedProfileIds?.includes(profileId) && (persistedCredential?.type !== "oauth" || !isCodexAppServerAuthProvider(persistedCredential.provider))) throw new CodexAppServerAuthProfileUnavailableError(`Codex app-server auth profile "${profileId}" is no longer available. Sign in again with OpenClaw, then retry.`);
+	if (params.preferStoreCredential && params.store.runtimePersistedProfileIds?.includes(profileId) && (persistedCredential?.type !== "oauth" || !isCodexAppServerAuthProvider(persistedCredential.provider))) throw new CodexAppServerAuthProfileUnavailableError(`Codex app-server auth profile "${profileId}" is no longer an OpenAI OAuth credential in its persisted OpenClaw store. Run "openclaw doctor" to inspect credential ownership, or select an existing OpenAI profile.`);
 	const store = useScopedCredential ? params.store : resolveCodexAppServerAuthProfileStore({
 		agentDir: ownerAgentDir,
 		authProfileId: profileId,
@@ -1408,17 +1383,22 @@ async function resolveOAuthCredentialForCodexAppServer(profileId, credential, pa
 		profileId,
 		credential: overlaidOAuthCredential,
 		forceRefresh: params.forceRefresh && !reuseCompletedRotation,
-		expectedAccountId
+		expectedAccountId,
+		config: params.config
 	});
 	if (params.forceRefresh && !persistedOAuthCredential && overlaidOAuthCredential) {
 		if (reuseCompletedRotation) return overlaidOAuthCredential;
-		const refreshedRuntimeCredential = await refreshOAuthCredentialForRuntime({ credential: overlaidOAuthCredential });
+		const refreshedRuntimeCredential = await refreshOAuthCredentialForRuntime({
+			credential: overlaidOAuthCredential,
+			cfg: params.config
+		});
 		if (!refreshedRuntimeCredential?.access?.trim()) throw new Error(`Codex app-server auth profile "${profileId}" could not refresh. Sign in again with OpenClaw, then retry.`);
 		assertCodexOAuthRefreshWorkspace(profileId, refreshedRuntimeCredential, expectedAccountId);
 		store.profiles[profileId] = refreshedRuntimeCredential;
 		return refreshedRuntimeCredential;
 	}
 	const resolved = await resolveApiKeyForProfile({
+		cfg: params.config,
 		store,
 		profileId,
 		agentDir: ownerAgentDir,
@@ -1426,7 +1406,7 @@ async function resolveOAuthCredentialForCodexAppServer(profileId, credential, pa
 		allowProfileFallback: false,
 		...expectedAccountId ? { validateOAuthCredential: (candidate) => assertCodexOAuthRefreshWorkspace(profileId, candidate, expectedAccountId) } : {}
 	});
-	if (!resolved || resolved.credential?.type !== "oauth" || !isCodexAppServerAuthProvider(resolved.credential.provider) || !resolved.apiKey.trim()) throw new CodexAppServerAuthProfileUnavailableError(`Codex app-server auth profile "${profileId}" is no longer available. Sign in again with OpenClaw, then retry.`);
+	if (!resolved || resolved.credential?.type !== "oauth" || !isCodexAppServerAuthProvider(resolved.credential.provider) || !resolved.apiKey.trim()) throw new CodexAppServerAuthProfileUnavailableError(`Codex app-server auth profile "${profileId}" could not resolve usable OAuth credentials from its OpenClaw credential store. Run "openclaw doctor" to inspect credential ownership, or select an existing OpenAI profile.`);
 	const candidate = {
 		...resolved.credential,
 		access: resolved.apiKey
@@ -1470,7 +1450,10 @@ async function resolveScopedOAuthCredential(params) {
 		const current = params.store.profiles[params.profileId];
 		const credential = current?.type === "oauth" ? current : params.credential;
 		if (!params.forceRefresh && hasUsableOAuthCredential(credential)) return credential;
-		const refreshed = await refreshOAuthCredentialForRuntime({ credential });
+		const refreshed = await refreshOAuthCredentialForRuntime({
+			credential,
+			cfg: params.config
+		});
 		if (!refreshed?.access?.trim()) throw new Error(`Codex app-server auth profile "${params.profileId}" could not refresh. Sign in again with OpenClaw, then retry.`);
 		assertCodexOAuthRefreshWorkspace(params.profileId, refreshed, params.expectedAccountId);
 		if (!isDeepStrictEqual(params.store.profiles[params.profileId], credential)) throw new Error(`Codex app-server auth profile "${params.profileId}" changed while refreshing. Retry with the newly selected OpenAI profile.`);
@@ -1503,15 +1486,6 @@ function isCodexSubscriptionCredential(credential) {
 	if (!credential || !isCodexAppServerAuthProvider(credential.provider)) return false;
 	return credential.type === "oauth" || credential.type === "token";
 }
-function withClearedEnvironmentVariables(startOptions, envVars) {
-	const clearEnv = startOptions.clearEnv ?? [];
-	const missingEnvVars = envVars.filter((envVar) => !clearEnv.includes(envVar));
-	if (missingEnvVars.length === 0) return startOptions;
-	return {
-		...startOptions,
-		clearEnv: [...clearEnv, ...missingEnvVars]
-	};
-}
 function buildChatgptAuthTokensParams(profileId, credential, accessToken) {
 	const storedAccountId = resolveExplicitChatgptAccountId(credential);
 	const tokenAccountId = resolveOpenAICodexAuthIdentity({ access: accessToken }).accountId;
@@ -2224,7 +2198,7 @@ async function prepareCodexInferenceRoute(params) {
 		assertCurrent
 	});
 	assertCurrent();
-	const type = isJsonObject(account.account) ? account.account.type : void 0;
+	const type = account.account?.type;
 	if (type !== "apiKey" && type !== "chatgpt") return;
 	if (owner.authRoute && owner.authRoute !== type) throw new Error("Codex native account route changed; reconnect before retrying");
 	owner.authRoute = type;
@@ -2233,7 +2207,7 @@ async function prepareCodexInferenceRoute(params) {
 	let pending = owner.routes.get(key);
 	if (!pending) {
 		if (owner.routes.size >= MAX_ROUTES) throw new Error("Codex inference route limit reached");
-		pending = import("./inference-proxy-CC15HuSi.mjs").then(({ createCodexInferenceProxy }) => {
+		pending = import("./inference-proxy-b-aJMSxm.mjs").then(({ createCodexInferenceProxy }) => {
 			assertClient();
 			return createCodexInferenceProxy({
 				upstream: target,
@@ -2553,14 +2527,10 @@ function resolveCodexNativeConfigFenceKey(params) {
 	const metadata = params.client ? getSharedCodexAppServerClientState().startMetadata.get(params.client) : void 0;
 	const startOptions = metadata?.startOptions ?? params.startOptions;
 	if (!startOptions || startOptions.transport !== "stdio") return;
-	const configuredHome = startOptions.env?.CODEX_HOME?.trim();
+	const configuredHome = startOptions.codexHome ?? startOptions.env?.CODEX_HOME?.trim();
 	const codexHome = configuredHome ? configuredHome : startOptions.homeScope === "user" ? resolveCodexAppServerUserHomeDir() : resolveCodexAppServerHomeDir(params.agentDir ?? metadata?.agentDir ?? resolveDefaultAgentDir(params.config ?? {}));
 	return codexHome ? `codex-home:${path.resolve(codexHome)}` : void 0;
 }
-function inferAuthRequirement(preparedAuth) {
-	if (preparedAuth?.kind === "api-key") return "api-key";
-	return preparedAuth?.kind === "profile" ? "subscription" : void 0;
-}
 async function resolveCodexAppServerClientStartContext(options) {
 	const requestedStartOptions = options?.startOptions ?? resolveCodexAppServerRuntimeOptions({ pluginConfig: options?.pluginConfig }).start;
 	const agentDir = options?.agentDir ?? (requestedStartOptions.homeScope === "user" ? void 0 : resolveDefaultAgentDir(options?.config ?? {}));
@@ -2568,10 +2538,10 @@ async function resolveCodexAppServerClientStartContext(options) {
 	const preparedAuth = options?.preparedAuth;
 	const preparedApiKey = preparedAuth?.kind === "api-key" ? preparedAuth.apiKey.trim() : void 0;
 	if (preparedAuth && options?.authProfileId !== void 0) throw new Error("Prepared Codex auth cannot also select a legacy auth profile.");
-	if (preparedAuth?.kind === "profile" && !preparedAuth.store.profiles[preparedAuth.profileId]) throw new Error(`Prepared Codex auth profile "${preparedAuth.profileId}" was not found. Select an existing OpenAI profile or sign in again with OpenClaw, then retry.`);
+	if (preparedAuth?.kind === "profile" && !preparedAuth.store.profiles[preparedAuth.profileId]) throw new CodexAppServerAuthProfileUnavailableError(formatCodexAuthProfileUnavailableMessage(preparedAuth.profileId));
 	if (preparedAuth?.kind === "api-key" && !preparedApiKey) throw new Error("Prepared Codex API-key auth is missing its resolved key.");
 	if (preparedAuth && requestedStartOptions.homeScope === "user") throw new Error("Prepared Codex auth requires an isolated app-server home.");
-	const preparedAuthRequirement = inferAuthRequirement(preparedAuth);
+	const preparedAuthRequirement = preparedAuth && (preparedAuth.kind === "api-key" ? "api-key" : "subscription");
 	if (options?.authRequirement && preparedAuthRequirement && options.authRequirement !== preparedAuthRequirement) throw new Error("Prepared Codex auth does not satisfy the requested auth requirement.");
 	const authRequirement = options?.authRequirement ?? preparedAuthRequirement;
 	const usesNativeAuth = !preparedAuth && (options?.authProfileId === null || requestedStartOptions.homeScope === "user");
@@ -2594,7 +2564,7 @@ async function resolveCodexAppServerClientStartContext(options) {
 		agentDir,
 		config: options?.config
 	}) : void 0;
-	if (preparedAuth?.kind === "profile" && !preparedAuthProfileSnapshot) throw new Error(`Prepared Codex auth profile "${preparedAuth.profileId}" is unusable. Repair or replace the selected OpenAI profile, then retry.`);
+	if (preparedAuth?.kind === "profile" && !preparedAuthProfileSnapshot) throw new CodexAppServerAuthProfileUnavailableError(`Prepared Codex auth profile "${preparedAuth.profileId}" is unusable. Repair or replace the selected OpenAI profile, then retry.`);
 	const resolvedPreparedAuth = preparedAuth?.kind === "api-key" ? {
 		kind: "api-key",
 		apiKey: preparedApiKey
@@ -2941,7 +2911,7 @@ async function startInitializedCodexAppServerClient(params) {
 		} finally {
 			artifactDrain?.cancel();
 		}
-		const runtimeArtifactModule = params.runtimeArtifactMode ? await import("./runtime-artifact-Dy38Z5iU.mjs") : void 0;
+		const runtimeArtifactModule = params.runtimeArtifactMode ? await import("./runtime-artifact-CLZ8udh-.mjs") : void 0;
 		const runtimeArtifactBeforeStart = runtimeArtifactModule ? await runtimeArtifactModule.captureCodexAppServerRuntimeArtifactBeforeStart({
 			startOptions,
 			spawnIdentity: resolveCodexAppServerSpawnIdentity(startOptions),