@openclaw/codex 2026.9.5 → 2026.9.7

package/dist/.setup/attempt-workspace-context-C5HigshI.mjs

@@ -0,0 +1,164 @@
+import { r as flattenCodexDynamicToolFunctions } from "./protocol-CANUwXJ3.mjs";
+import { lt as isMessageOnlyCodexSourceReply } from "./thread-requests-B_bRnMGN.mjs";
+import path from "node:path";
+import { buildAgentWorkspaceInstructionSnapshot, buildBootstrapContextForFiles, embeddedAgentLog, prepareAgentWorkspaceContext } from "openclaw/plugin-sdk/agent-harness-runtime";
+import { resolveAgentWorkspaceMemoryRouting, shouldIncludeAgentHarnessRuntimeContext } from "openclaw/plugin-sdk/agent-harness-attempt-runtime";
+import { resolveBootstrapFilesForPreparation } from "openclaw/plugin-sdk/codex-mcp-projection";
+//#region extensions/codex/src/app-server/attempt-workspace-context.ts
+const CODEX_NATIVE_PROJECT_DOC_BASENAMES = /* @__PURE__ */ new Set(["agents.md"]);
+const CODEX_MEMORY_CONTEXT_BASENAME = "memory.md";
+const CODEX_MEMORY_TOOL_NAMES = /* @__PURE__ */ new Set(["memory_search", "memory_get"]);
+const CODEX_BOOTSTRAP_CONTEXT_ORDER = /* @__PURE__ */ new Map([
+	["soul.md", 10],
+	["identity.md", 20],
+	["user.md", 30],
+	["bootstrap.md", 50],
+	["memory.md", 60]
+]);
+/** A child baseline reads the bounded workspace snapshot without invoking admission hooks. */
+async function prepareCodexWorkspaceDeveloperInstructions(params) {
+	if (isSameCodexWorkspacePath(params.workspaceDir, params.cwd)) return;
+	const files = await resolveBootstrapFilesForPreparation(params);
+	const contextFiles = buildBootstrapContextForFiles(files, {
+		config: params.config,
+		agentId: params.agentId
+	});
+	return buildAgentWorkspaceInstructionSnapshot(contextFiles, params.workspaceDir).instructions;
+}
+async function buildCodexWorkspaceBootstrapContext(params) {
+	const availableToolNames = new Set(flattenCodexDynamicToolFunctions(params.tools).map((tool) => normalizeCodexDynamicToolName(tool.name)));
+	const inheritsAgentWorkspace = (params.executionWorkspace ?? params.resolvedWorkspace) !== params.resolvedWorkspace;
+	const injectOpenClawContext = shouldIncludeAgentHarnessRuntimeContext(params.params);
+	const restrictedProjectDocNeedsOpenClawCarrier = params.params.pluginHarnessToolPolicyRestricted === true && !params.params.disableTools && !isMessageOnlyCodexSourceReply(params.params) && params.params.bootstrapContextMode !== "lightweight";
+	const includeAgentWorkspaceInstructions = injectOpenClawContext && !params.ringZeroActive && (inheritsAgentWorkspace || restrictedProjectDocNeedsOpenClawCarrier);
+	try {
+		const promptWorkspace = inheritsAgentWorkspace ? params.resolvedWorkspace : params.effectiveWorkspace;
+		const { memoryToolNames, memoryToolRouted } = resolveAgentWorkspaceMemoryRouting({
+			config: params.params.config,
+			agentId: params.params.agentId ?? params.sessionAgentId,
+			workspaceDir: promptWorkspace,
+			toolNames: availableToolNames
+		});
+		const prepared = await prepareAgentWorkspaceContext({
+			scope: "full",
+			workspaceDir: params.resolvedWorkspace,
+			config: params.params.config,
+			sessionKey: params.sessionKey,
+			sessionId: params.params.sessionId,
+			bootstrapUserProfileId: params.params.bootstrapUserProfileId,
+			chatType: params.params.chatType,
+			agentId: params.params.agentId ?? params.sessionAgentId,
+			warn: (message) => embeddedAgentLog.warn(message),
+			contextMode: params.params.bootstrapContextMode,
+			runKind: params.params.bootstrapContextRunKind,
+			memoryToolRouted,
+			onMemoryPreparationError: (error) => embeddedAgentLog.warn("failed to prepare codex memory recall instructions", { error }),
+			memoryTools: injectOpenClawContext ? {
+				toolNames: [...availableToolNames],
+				citationsMode: params.params.config?.memory?.citations,
+				sandboxed: params.sandboxed
+			} : void 0,
+			projectPath: (filePath) => remapCodexContextFilePath({
+				filePath,
+				sourceWorkspaceDir: params.resolvedWorkspace,
+				targetWorkspaceDir: promptWorkspace
+			}),
+			nativeProjectDocBasenames: CODEX_NATIVE_PROJECT_DOC_BASENAMES,
+			contextFileOrder: CODEX_BOOTSTRAP_CONTEXT_ORDER,
+			promptMemoryWorkspaceDir: params.effectiveWorkspace
+		});
+		const { bootstrapFiles, contextFiles, promptContextFiles, memoryReferenceFiles, memoryToolRoutedBootstrapFiles } = prepared;
+		return {
+			bootstrapFiles,
+			contextFiles,
+			inheritsAgentWorkspace,
+			promptContextFiles,
+			threadDeveloperInstructionFiles: includeAgentWorkspaceInstructions ? prepared.instructionSnapshot.files : [],
+			turnScopedDeveloperInstructionFiles: injectOpenClawContext ? prepared.personaFiles : [],
+			memoryReferenceFiles,
+			memoryToolRoutedBootstrapFiles,
+			memoryToolNames,
+			memoryToolRouted,
+			promptContext: renderCodexWorkspaceBootstrapPromptContext(promptContextFiles),
+			threadDeveloperInstructions: includeAgentWorkspaceInstructions ? params.agentWorkspaceDeveloperInstructions ?? prepared.instructionSnapshot.instructions : void 0,
+			turnScopedDeveloperInstructions: injectOpenClawContext ? prepared.personaInstructions : void 0,
+			memoryCollaborationInstructions: injectOpenClawContext ? renderCodexWorkspaceMemoryCollaborationInstructions({
+				files: memoryReferenceFiles,
+				toolNames: memoryToolNames,
+				memoryRecallInstructions: prepared.memoryRecallInstructions
+			}) : void 0
+		};
+	} catch (error) {
+		embeddedAgentLog.warn("failed to load codex workspace bootstrap instructions", { error });
+		return {
+			bootstrapFiles: [],
+			contextFiles: [],
+			inheritsAgentWorkspace,
+			threadDeveloperInstructions: includeAgentWorkspaceInstructions ? params.agentWorkspaceDeveloperInstructions : void 0
+		};
+	}
+}
+function renderCodexWorkspaceBootstrapPromptContext(contextFiles) {
+	if (contextFiles.length === 0) return;
+	const lines = [
+		"OpenClaw loaded these user-editable workspace files for the current turn. Codex loads project-local AGENTS.md natively. When execution uses another folder, OpenClaw supplies the agent workspace AGENTS.md as thread-level developer instructions. SOUL.md, IDENTITY.md, and USER.md are prepared separately from user input and are not repeated here.",
+		"",
+		"# Project Context",
+		"",
+		"The following project context files have been loaded:",
+		""
+	];
+	for (const file of contextFiles) lines.push(`## ${file.path}`, "", file.content, "");
+	return lines.join("\n").trim();
+}
+function renderCodexWorkspaceMemoryReference(params) {
+	if (params.files.length === 0) return;
+	const lines = [
+		"## OpenClaw Workspace Memory",
+		"",
+		`MEMORY.md exists in the active agent workspace as a memory file, not an instruction file. OpenClaw does not paste its contents into native Codex turns; use ${(params.toolNames?.length ? params.toolNames : Array.from(CODEX_MEMORY_TOOL_NAMES)).join(" or ")} when durable memory is relevant and the tools are available.`,
+		""
+	];
+	for (const file of params.files) lines.push(`- ${file.path}`);
+	return lines.join("\n").trim();
+}
+function renderCodexWorkspaceMemoryCollaborationInstructions(params) {
+	const sections = [params.memoryRecallInstructions ? [params.memoryRecallInstructions, renderCodexMemoryToolSearchBridge(params.toolNames)].filter(isNonEmptyString).join("\n").trim() : void 0, renderCodexWorkspaceMemoryReference(params)].filter(isNonEmptyString);
+	return sections.length > 0 ? sections.join("\n\n") : void 0;
+}
+function renderCodexMemoryToolSearchBridge(toolNames) {
+	const memoryToolNames = toolNames.map((name) => normalizeCodexDynamicToolName(name)).filter((name) => CODEX_MEMORY_TOOL_NAMES.has(name)).toSorted();
+	if (memoryToolNames.length === 0) return;
+	return `Codex may expose ${memoryToolNames.join(" and ")} as deferred tools. When the memory guidance above calls for memory recall, use an already-loaded memory tool directly. If the needed memory tool is deferred and not currently callable, use \`tool_search\` to load it, then call that memory tool.`;
+}
+function isSameCodexWorkspacePath(left, right) {
+	return path.resolve(left) === path.resolve(right);
+}
+/**
+* Remaps bootstrap file paths from the resolved workspace to the effective Codex
+* workspace while preserving platform path separators.
+*/
+function remapCodexContextFilePath(params) {
+	const relativePath = path.relative(params.sourceWorkspaceDir, params.filePath);
+	if (!relativePath || relativePath === ".." || relativePath.startsWith(`..${path.sep}`) || path.isAbsolute(relativePath) || params.sourceWorkspaceDir === params.targetWorkspaceDir) return params.filePath;
+	const targetUsesPosixSeparators = params.targetWorkspaceDir.includes("/") && !params.targetWorkspaceDir.includes("\\");
+	const normalizedRelativePath = targetUsesPosixSeparators ? relativePath.replaceAll("\\", "/") : relativePath.replaceAll("/", "\\");
+	return targetUsesPosixSeparators ? path.posix.join(params.targetWorkspaceDir, normalizedRelativePath) : path.win32.join(params.targetWorkspaceDir, normalizedRelativePath);
+}
+function normalizeCodexContextFilePath(filePath) {
+	return filePath.trim().replaceAll("\\", "/").toLowerCase();
+}
+function getCodexContextFileDisplayBasename(filePath) {
+	return filePath.trim().replaceAll("\\", "/").split("/").pop()?.trim() ?? "";
+}
+function getCodexContextFileBasename(filePath) {
+	return normalizeCodexContextFilePath(filePath).split("/").pop() ?? "";
+}
+function normalizeCodexDynamicToolName(name) {
+	return name.trim().toLowerCase();
+}
+function isNonEmptyString(value) {
+	return typeof value === "string" && value.length > 0;
+}
+//#endregion
+export { getCodexContextFileDisplayBasename as a, normalizeCodexDynamicToolName as c, getCodexContextFileBasename as i, prepareCodexWorkspaceDeveloperInstructions as l, CODEX_NATIVE_PROJECT_DOC_BASENAMES as n, isNonEmptyString as o, buildCodexWorkspaceBootstrapContext as r, normalizeCodexContextFilePath as s, CODEX_MEMORY_CONTEXT_BASENAME as t };

package/dist/.setup/{auth-binding-DhLWa_7K.mjs → auth-binding-BLWz7stm.mjs}

@@ -1,4 +1,5 @@
-import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.mjs";
+import { i as isCodexResponsesOAuthCredential, o as resolveCodexResponsesOAuthProfileFingerprint } from "./responses-oauth-twnuTaAa.mjs";
+import { t as __exportAll } from "./session-binding-sidecars-jo6H8dFr.mjs";
 import { resolveApiKeyForProfile } from "openclaw/plugin-sdk/agent-runtime";
 import { fingerprintResolvedAuthProfileCredential } from "openclaw/plugin-sdk/agent-harness-runtime";
 import { resolveOpenAICodexAuthIdentity } from "openclaw/plugin-sdk/provider-auth";
@@ -29,6 +30,18 @@ async function prepareCodexAppServerAuthBinding(params) {
 	const credential = params.authProfileStore.profiles[params.authProfileId];
 	if (!credential) return;
 	if (credential.type === "oauth") {
+		if (isCodexResponsesOAuthCredential(credential)) {
+			const store = structuredClone(params.authProfileStore);
+			return {
+				fingerprint: await resolveCodexResponsesOAuthProfileFingerprint({
+					profileId: params.authProfileId,
+					store,
+					agentDir: params.agentDir,
+					config: params.config
+				}),
+				authProfileStore: store
+			};
+		}
 		const fingerprint = fingerprintResolvedAuthProfileCredential({
 			profileId: params.authProfileId,
 			credential: {

package/dist/.setup/{auth-cache-key-QirmgiCo.mjs → auth-cache-key-Dbvq-QgB.mjs}

@@ -1,23 +1,27 @@
-import { n as defineCodexBuildState } from "./build-state-Xx9ybZqa.mjs";
-import { c as resolveMacOSDesktopCodexAppPathCandidates } from "./managed-binary-DP6Rib3P.mjs";
-import { n as resolveCodexAppServerSpawnEnv } from "./transport-stdio-Cmx94Oiy.mjs";
+import { n as defineCodexBuildState } from "./build-state-Da1_z0kd.mjs";
+import { u as resolveMacOSDesktopCodexAppPathCandidates } from "./managed-binary-kiWRhNRE.mjs";
+import { n as resolveCodexAppServerSpawnEnv } from "./transport-stdio-Bdegpn2V.mjs";
 import { createHash } from "node:crypto";
 import fs, { constants, existsSync, watch } from "node:fs";
 import path from "node:path";
 import os from "node:os";
 import fs$1 from "node:fs/promises";
+import { extractErrorCode } from "openclaw/plugin-sdk/error-runtime";
+import { sha256File } from "openclaw/plugin-sdk/file-access-runtime";
 import { readSecretFile } from "openclaw/plugin-sdk/secret-file";
 //#region extensions/codex/src/app-server/desktop-generation-fingerprint.ts
 const MAX_COMPUTER_USE_PLUGIN_TREE_ENTRIES = 4096;
 /** Fingerprints every desktop candidate that can own a managed fallback artifact. */
 async function readMacOSDesktopGenerationFingerprint(candidates = resolveMacOSDesktopCodexAppPathCandidates("darwin")) {
 	const entries = [];
+	const bundles = /* @__PURE__ */ new Set();
 	for (const candidate of candidates) {
 		const command = await statFingerprint(candidate.appServerCommandPath);
 		entries.push(`candidate:${candidate.appName}:${candidate.appServerCommandPath}:${command}`);
+		if (bundles.has(candidate.appBundlePath)) continue;
+		bundles.add(candidate.appBundlePath);
 		for (const artifactPath of resolveMacOSDesktopGenerationPaths(candidate)) entries.push(`${artifactPath}\0${await statFingerprint(artifactPath)}`);
-		const pluginRoot = resolveComputerUsePluginRoot(candidate);
-		entries.push(`${pluginRoot}\0${await directoryTreeFingerprint(pluginRoot)}`);
+		for (const pluginRoot of resolveComputerUseArtifactRoots(candidate)) entries.push(`${pluginRoot}\0${await readCodexDesktopArtifactTreeFingerprint(pluginRoot)}`);
 	}
 	return createHash("sha256").update(entries.join("\0")).digest("hex");
 }
@@ -25,6 +29,8 @@ function resolveMacOSDesktopGenerationPaths(candidate) {
 	return [
 		candidate.appBundlePath,
 		path.join(candidate.bundledMarketplacePath, ".agents", "plugins", "marketplace.json"),
+		path.join(candidate.appBundlePath, "Contents", "Resources", "cua_node", "bin", "node"),
+		path.join(candidate.appBundlePath, "Contents", "Resources", "cua_node", "bin", "node_repl"),
 		...candidate.computerUseServiceAppPaths.flatMap((servicePath) => [
 			servicePath,
 			path.join(servicePath, "Contents", "Info.plist"),
@@ -32,8 +38,15 @@ function resolveMacOSDesktopGenerationPaths(candidate) {
 		])
 	];
 }
-function resolveComputerUsePluginRoot(candidate) {
-	return path.join(candidate.bundledMarketplacePath, "plugins", "computer-use");
+function resolveComputerUseArtifactRoots(candidate) {
+	const modules = path.join(candidate.appBundlePath, "Contents", "Resources", "cua_node", "lib", "node_modules", "@oai");
+	return [
+		path.join(candidate.bundledMarketplacePath, "plugins", "computer-use"),
+		path.join(candidate.bundledMarketplacePath, "plugins", "unified-computer-use"),
+		path.join(modules, "cua-repl"),
+		path.join(modules, "cua"),
+		path.join(modules, "sky", "dist")
+	];
 }
 /** Stable roots that cover bundle replacement and recursive artifact updates. */
 function resolveMacOSDesktopGenerationWatchPaths(candidates = resolveMacOSDesktopCodexAppPathCandidates("darwin")) {
@@ -41,12 +54,13 @@ function resolveMacOSDesktopGenerationWatchPaths(candidates = resolveMacOSDeskto
 	for (const candidate of candidates) watched.add(candidate.appBundlePath);
 	return [...watched];
 }
-async function directoryTreeFingerprint(root) {
+async function readCodexDesktopArtifactTreeFingerprint(root) {
 	let rootStat;
 	try {
 		rootStat = await fs$1.lstat(root, { bigint: true });
 	} catch (error) {
-		if (isNodeError(error, "ENOENT") || isNodeError(error, "ENOTDIR")) return "missing";
+		const code = extractErrorCode(error);
+		if (code === "ENOENT" || code === "ENOTDIR") return "missing";
 		throw error;
 	}
 	if (!rootStat.isDirectory()) return statFingerprint(root);
@@ -84,7 +98,8 @@ async function statFingerprint(filePath) {
 		const content = target.isFile() ? await readFileFingerprint(filePath, target, true) : "";
 		return `${type}:${own}:${link}:${realPath}:${statTuple(target)}:${content}`;
 	} catch (error) {
-		if (isNodeError(error, "ENOENT") || isNodeError(error, "ENOTDIR")) return "missing";
+		const code = extractErrorCode(error);
+		if (code === "ENOENT" || code === "ENOTDIR") return "missing";
 		throw error;
 	}
 }
@@ -94,10 +109,10 @@ async function readFileFingerprint(filePath, expected, followsSymlink) {
 	try {
 		const before = await handle.stat({ bigint: true });
 		if (!sameStat(before, expected)) throw new Error(`Codex desktop artifact changed while fingerprinting: ${filePath}`);
-		const hash = createHash("sha256");
-		for await (const chunk of handle.createReadStream({ autoClose: false })) hash.update(chunk);
-		if (!sameStat(before, await handle.stat({ bigint: true }))) throw new Error(`Codex desktop artifact changed while fingerprinting: ${filePath}`);
-		return hash.digest("hex");
+		const hash = await sha256File(handle, { maxBytes: Number(before.size) });
+		const after = await handle.stat({ bigint: true });
+		if (BigInt(hash.bytes) !== before.size || !sameStat(before, after)) throw new Error(`Codex desktop artifact changed while fingerprinting: ${filePath}`);
+		return hash.digest;
 	} finally {
 		await handle.close();
 	}
@@ -115,9 +130,6 @@ function statTuple(stat) {
 		stat.ctimeNs
 	].join(":");
 }
-function isNodeError(error, code) {
-	return Boolean(error && typeof error === "object" && "code" in error && error.code === code);
-}
 //#endregion
 //#region extensions/codex/src/app-server/desktop-generation-owner.ts
 const SETTLE_DELAY_MS = 1e3;
@@ -203,12 +215,9 @@ function createCodexDesktopGenerationService(params, runtime = {
 			if (runtime.platform !== "darwin") return;
 			const current = state();
 			current.context = ctx;
-			current.readFingerprint = runtime.readFingerprint;
-			current.resolveWatchPaths = runtime.resolveWatchPaths;
-			current.pathExists = runtime.pathExists;
-			current.watchPath = runtime.watchPath;
+			current.runtime = { ...runtime };
 			current.owner = createCodexDesktopGenerationOwner({
-				readFingerprint: current.readFingerprint,
+				readFingerprint: runtime.readFingerprint,
 				onGenerationChange: params.onGenerationChange,
 				initialGeneration: current.lastGeneration
 			});
@@ -222,10 +231,7 @@ function createCodexDesktopGenerationService(params, runtime = {
 			current.owner = void 0;
 			current.armEpoch = (current.armEpoch ?? 0) + 1;
 			current.context = void 0;
-			current.readFingerprint = void 0;
-			current.resolveWatchPaths = void 0;
-			current.pathExists = void 0;
-			current.watchPath = void 0;
+			current.runtime = void 0;
 			current.watchHealthy = void 0;
 			current.rearmDelayMs = void 0;
 			if (current.rearmTimer) {
@@ -245,10 +251,10 @@ function armWatchers(current) {
 	current.watchers = watchers;
 	const candidateNames = new Set(resolveMacOSDesktopCodexAppPathCandidates("darwin").map((candidate) => candidate.appName));
 	let complete = true;
-	for (const watchedPath of current.resolveWatchPaths?.() ?? []) {
-		if (!current.pathExists?.(watchedPath)) continue;
+	for (const watchedPath of current.runtime?.resolveWatchPaths() ?? []) {
+		if (!current.runtime?.pathExists(watchedPath)) continue;
 		try {
-			const watcher = current.watchPath?.(watchedPath, { recursive: watchedPath !== APPLICATIONS_PATH }, (_eventType, filename) => {
+			const watcher = current.runtime?.watchPath(watchedPath, { recursive: watchedPath !== APPLICATIONS_PATH }, (_eventType, filename) => {
 				if (!isCurrentArm(current, owner, watchers, armEpoch)) return;
 				if (watchedPath === APPLICATIONS_PATH && filename && !candidateNames.has(filename.toString().split(path.sep)[0] ?? "")) return;
 				owner.markDirty();
@@ -303,17 +309,14 @@ function scheduleRearm(current, owner) {
 	}, delayMs);
 	current.rearmTimer.unref();
 }
-function logRefreshFailure(current, owner) {
-	return (error) => {
-		if (current.owner !== owner) return;
-		current.context?.serviceHealth?.reportFailure(error);
-		current.context?.logger.warn(`codex desktop generation refresh failed: ${String(error)}`);
-	};
-}
 function refreshGeneration(current, owner, refresh) {
 	refresh.then(() => {
 		if (current.owner === owner && current.watchHealthy) current.context?.serviceHealth?.clearFailure();
-	}).catch(logRefreshFailure(current, owner));
+	}).catch((error) => {
+		if (current.owner !== owner) return;
+		current.context?.serviceHealth?.reportFailure(error);
+		current.context?.logger.warn(`codex desktop generation refresh failed: ${String(error)}`);
+	});
 }
 function closeWatchers(current) {
 	const watchers = current.watchers;
@@ -321,79 +324,6 @@ function closeWatchers(current) {
 	for (const watcher of watchers ?? []) watcher.close();
 }
 //#endregion
-//#region extensions/codex/src/app-server/shared-client-lifecycle.ts
-/** Client ownership and synchronous retirement, independent of startup/auth execution. */
-const createCodexAppServerStartupLifetime = () => ({
-	controller: new AbortController(),
-	pending: /* @__PURE__ */ new Set()
-});
-const getSharedCodexAppServerClientState = defineCodexBuildState("openclaw.codexAppServerClientState", () => ({
-	clients: /* @__PURE__ */ new Map(),
-	liveClients: /* @__PURE__ */ new Set(),
-	isolatedClients: /* @__PURE__ */ new Set(),
-	entriesByClient: /* @__PURE__ */ new WeakMap(),
-	desktopGenerationDrainChecks: /* @__PURE__ */ new Set(),
-	startup: createCodexAppServerStartupLifetime(),
-	startMetadata: /* @__PURE__ */ new WeakMap()
-}));
-function getCurrentSharedClientEntry(client) {
-	const state = getSharedCodexAppServerClientState();
-	const entry = client ? state.entriesByClient.get(client) : void 0;
-	return entry && entry.client === client && state.clients.get(entry.key) === entry ? entry : void 0;
-}
-/**
-* Retires a matching shared client. Default is graceful: detach from the map
-* (future acquisitions get a fresh client) and close once leases drain.
-* `failActiveLeases` is for suspect clients only (timed-out turns): it closes
-* the physical connection immediately so co-leased attempts hit the normal
-* client-closed retry path, and pending acquires reject instead of leasing
-* the poisoned process. Routine cleanup must NOT use it — it would abort
-* healthy sibling turns on a working client.
-*/
-function retireSharedCodexAppServerClientIfCurrent(client, opts) {
-	if (!client) return;
-	const state = getSharedCodexAppServerClientState();
-	const currentEntry = getCurrentSharedClientEntry(client);
-	const entry = currentEntry ?? state.entriesByClient.get(client);
-	if (!entry || entry.client !== client && !entry.closeError) return;
-	if (currentEntry) {
-		state.clients.delete(entry.key);
-		entry.closeWhenIdle = true;
-	}
-	if (opts?.failActiveLeases && (currentEntry || !entry.closeError)) {
-		entry.closeError = /* @__PURE__ */ new Error("codex app-server client is closed");
-		return {
-			activeLeases: entry.activeLeases,
-			closed: closeRetiredSharedClientEntry(entry)
-		};
-	}
-	return {
-		activeLeases: entry.activeLeases,
-		closed: currentEntry ? closeRetiredSharedClientEntryIfIdle(entry) : false
-	};
-}
-/** Gracefully retires exact clients attached to an older desktop generation. */
-function retireSharedCodexAppServerClientsBeforeDesktopGeneration(generation) {
-	const state = getSharedCodexAppServerClientState();
-	for (const entry of state.clients.values()) {
-		const client = entry.client;
-		const attached = client ? state.startMetadata.get(client) : void 0;
-		if (client && attached?.desktopGeneration && attached.desktopGeneration.epoch < generation.epoch) retireSharedCodexAppServerClientIfCurrent(client);
-	}
-}
-function closeRetiredSharedClientEntryIfIdle(entry) {
-	if (!entry.closeWhenIdle || entry.activeLeases > 0 || entry.pendingAcquires > 0 || !entry.client) return false;
-	entry.closeWhenIdle = false;
-	return closeRetiredSharedClientEntry(entry);
-}
-function closeRetiredSharedClientEntry(entry) {
-	const client = entry.client;
-	if (!client) return false;
-	entry.client = void 0;
-	client.close();
-	return true;
-}
-//#endregion
 //#region extensions/codex/src/app-server/auth-cache-key.ts
 /** Auth cache identity and native CLI credential reads, without login or refresh. */
 const CODEX_HOME_ENV_VAR = "CODEX_HOME";
@@ -495,4 +425,4 @@ function readFirstNonEmptyEnvEntry(env, keys) {
 	}
 }
 //#endregion
-export { isCodexDesktopGenerationCurrent as _, readCodexCliAuthFileApiKey as a, resolveCodexAppServerPreparedApiKeyCacheKey as c, createCodexAppServerStartupLifetime as d, getCurrentSharedClientEntry as f, createCodexDesktopGenerationService as g, retireSharedCodexAppServerClientsBeforeDesktopGeneration as h, fingerprintTokenAuthProfileCacheKey as i, closeRetiredSharedClientEntry as l, retireSharedCodexAppServerClientIfCurrent as m, CODEX_AUTH_JSON_FILENAME as n, readFirstNonEmptyEnv as o, getSharedCodexAppServerClientState as p, fingerprintApiKeyAuthProfileCacheKey as r, resolveCodexAppServerFallbackApiKeyCacheKey as s, CODEX_APP_SERVER_API_KEY_ENV_VARS as t, closeRetiredSharedClientEntryIfIdle as u, waitForCodexDesktopGeneration as v };
+export { readCodexCliAuthFileApiKey as a, resolveCodexAppServerPreparedApiKeyCacheKey as c, waitForCodexDesktopGeneration as d, readCodexDesktopArtifactTreeFingerprint as f, fingerprintTokenAuthProfileCacheKey as i, createCodexDesktopGenerationService as l, CODEX_AUTH_JSON_FILENAME as n, readFirstNonEmptyEnv as o, fingerprintApiKeyAuthProfileCacheKey as r, resolveCodexAppServerFallbackApiKeyCacheKey as s, CODEX_APP_SERVER_API_KEY_ENV_VARS as t, isCodexDesktopGenerationCurrent as u };

package/dist/.setup/{auth-profile-WqZtZfXN.mjs → auth-profile-B0okYl2D.mjs}

@@ -10,7 +10,6 @@ const { resolveCodexAppServerAuthProfileId, resolveCodexAppServerAuthProfileIdFo
 	ensureAuthProfileStore,
 	resolveAuthProfileOrder
 });
-/** Returns true when an auth profile uses native Codex/OpenAI app-server auth. */
 function isCodexAppServerNativeAuthProfile(lookup) {
 	const authProfileId = lookup.authProfileId?.trim();
 	if (!authProfileId) return false;
@@ -21,7 +20,7 @@ function isCodexAppServerNativeAuthProfile(lookup) {
 			externalCliProviderIds: [CODEX_APP_SERVER_NATIVE_AUTH_PROVIDER],
 			externalCliProfileIds: [authProfileId]
 		})).profiles[authProfileId];
-		if (!credential || credential.type === "api_key") return false;
+		if (!credential || credential.type === "api_key" || credential.type === "oauth" && (credential.authFlow === "chatgpt-token-sharing" || credential.authFlow === "chatgpt-identity")) return false;
 		const provider = credential.provider?.trim();
 		return Boolean(provider && resolveProviderIdForAuth(provider, { config: lookup.config }) === CODEX_APP_SERVER_NATIVE_AUTH_PROVIDER);
 	} catch (error) {

package/dist/.setup/auth-profile-health-oHizqgye.mjs

@@ -0,0 +1,53 @@
+import { r as formatCodexAuthProfileUnavailableMessage, t as CODEX_NATIVE_PROFILE_IMPORT_COMMAND } from "./auth-profile-recovery-BREezV0L.mjs";
+//#region extensions/codex/src/auth-profile-health.ts
+const CHECK_ID = "codex/native-profile-recovery";
+const PROFILE_ID = "openai:default";
+async function collectFindings(config, env) {
+	const declared = config.auth?.profiles?.[PROFILE_ID];
+	if (declared?.provider !== "openai" || declared.mode !== "oauth") return [];
+	const [{ loadAuthProfileStoreForRuntime }, { listAgentIds, resolveAgentDir }] = await Promise.all([import("openclaw/plugin-sdk/agent-runtime"), import("openclaw/plugin-sdk/agent-scope-runtime")]);
+	const findings = [];
+	const missing = [];
+	for (const agentId of listAgentIds(config)) try {
+		if (!loadAuthProfileStoreForRuntime(resolveAgentDir(config, agentId, env), {
+			readOnly: true,
+			config,
+			externalCli: { mode: "none" }
+		}, env).profiles[PROFILE_ID]) missing.push(agentId);
+	} catch (error) {
+		findings.push({
+			checkId: CHECK_ID,
+			source: "codex",
+			severity: "warning",
+			message: `Could not inspect OpenAI auth profiles for agent "${agentId}": ${error instanceof Error ? error.message : String(error)}`,
+			fixHint: "openclaw doctor --fix"
+		});
+	}
+	if (missing.length > 0) findings.push({
+		checkId: CHECK_ID,
+		source: "codex",
+		severity: "warning",
+		message: `${formatCodexAuthProfileUnavailableMessage(PROFILE_ID)} Affected agents: ${missing.join(", ")}.`,
+		fixHint: CODEX_NATIVE_PROFILE_IMPORT_COMMAND
+	});
+	return findings;
+}
+const codexNativeProfileRecoveryHealthCheck = {
+	id: CHECK_ID,
+	kind: "plugin",
+	source: "codex",
+	description: "Explain recovery for a configured profile formerly supplied by native Codex login.",
+	detect: (ctx) => collectFindings(ctx.cfg, ctx.env ?? process.env)
+};
+const codexNativeProfileRecoveryService = {
+	id: CHECK_ID,
+	async start(ctx) {
+		const findings = await collectFindings(ctx.config, {
+			...process.env,
+			OPENCLAW_STATE_DIR: ctx.stateDir
+		});
+		for (const finding of findings) ctx.logger.warn(finding.message);
+	}
+};
+//#endregion
+export { codexNativeProfileRecoveryService as n, codexNativeProfileRecoveryHealthCheck as t };

package/dist/.setup/auth-profile-recovery-BREezV0L.mjs

@@ -0,0 +1,14 @@
+//#region extensions/codex/src/app-server/auth-profile-recovery.ts
+const CODEX_NATIVE_PROFILE_IMPORT_COMMAND = "openclaw models auth login --provider openai --method device-code";
+var CodexAppServerAuthProfileUnavailableError = class extends Error {
+	constructor(..._args) {
+		super(..._args);
+		this.code = "selected_auth_profile_unavailable";
+	}
+};
+function formatCodexAuthProfileUnavailableMessage(profileId) {
+	const missing = `Codex app-server auth profile "${profileId}" was not found in the OpenClaw credential store. This is a local credential lookup failure.`;
+	return profileId === "openai:default" ? `${missing} Since 2026.9.5, OpenClaw no longer supplies this profile from the native Codex login. Run \`${CODEX_NATIVE_PROFILE_IMPORT_COMMAND}\` to import that login or sign in through OpenClaw, then retry. For multiple agents, add \`--agent <id>\`.` : `${missing} Restore or select an existing OpenAI profile, then retry.`;
+}
+//#endregion
+export { CodexAppServerAuthProfileUnavailableError as n, formatCodexAuthProfileUnavailableMessage as r, CODEX_NATIVE_PROFILE_IMPORT_COMMAND as t };

package/dist/.setup/auth-start-options-BPIPeEX8.mjs

@@ -0,0 +1,44 @@
+import { r as normalizeCodexAppServerArgs } from "./launch-args-DbFCehO7.mjs";
+import { normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
+import path from "node:path";
+import { homedir } from "node:os";
+//#region extensions/codex/src/app-server/auth-start-options.ts
+const CODEX_APP_SERVER_HOME_DIRNAME = "codex-home";
+const CODEX_EPHEMERAL_AUTH_STORE_OVERRIDE = "cli_auth_credentials_store=\"ephemeral\"";
+function resolveCodexAppServerHomeDir(agentDir) {
+	if (!agentDir) throw new Error("Agent-scoped Codex requires an OpenClaw agent directory");
+	return path.join(path.resolve(agentDir), CODEX_APP_SERVER_HOME_DIRNAME);
+}
+/** Resolves the native user Codex home used by Desktop and the CLI. */
+function resolveCodexAppServerUserHomeDir(env = process.env, homedir$1 = homedir) {
+	const configured = normalizeOptionalString(env.CODEX_HOME);
+	return path.resolve(configured ?? path.join(homedir$1(), ".codex"));
+}
+/** Resolves the local CODEX_HOME used when starting one app-server connection. */
+function resolveCodexAppServerLocalHomeDir(startOptions, agentDir, env = process.env) {
+	if (startOptions.codexHome) return startOptions.codexHome;
+	const configured = startOptions.env?.CODEX_HOME;
+	if (configured?.trim()) return configured;
+	return startOptions.homeScope === "user" ? resolveCodexAppServerUserHomeDir(env) : resolveCodexAppServerHomeDir(agentDir);
+}
+/** Forces OpenClaw-owned Codex auth to remain process-local. */
+function withEphemeralCodexAuthStore(params) {
+	const { startOptions } = params;
+	if (!params.preparedAuth && params.authProfileId === null) return startOptions;
+	const args = normalizeCodexAppServerArgs(startOptions.args, CODEX_EPHEMERAL_AUTH_STORE_OVERRIDE);
+	return args === startOptions.args ? startOptions : {
+		...startOptions,
+		args
+	};
+}
+function withClearedEnvironmentVariables(startOptions, envVars) {
+	const clearEnv = startOptions.clearEnv ?? [];
+	const missingEnvVars = envVars.filter((envVar) => !clearEnv.includes(envVar));
+	if (missingEnvVars.length === 0) return startOptions;
+	return {
+		...startOptions,
+		clearEnv: [...clearEnv, ...missingEnvVars]
+	};
+}
+//#endregion
+export { withEphemeralCodexAuthStore as a, withClearedEnvironmentVariables as i, resolveCodexAppServerLocalHomeDir as n, resolveCodexAppServerUserHomeDir as r, resolveCodexAppServerHomeDir as t };

package/dist/.setup/{binding-connection-Bm38niE8.mjs → binding-connection-DTtN1KrX.mjs}

@@ -1,4 +1,4 @@
-import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.mjs";
+import { t as __exportAll } from "./session-binding-sidecars-jo6H8dFr.mjs";
 import { AgentHarnessPreflightError } from "openclaw/plugin-sdk/agent-harness-registration";
 import { createPluginRuntimeStore } from "openclaw/plugin-sdk/runtime-store";
 //#region extensions/codex/src/app-server/binding-connection.ts
@@ -44,7 +44,7 @@ function requireCodexSupervisionModelSelection(binding) {
 }
 /** Registration publishes the resolver; connection policy loads only for an actual request. */
 async function resolveCodexBindingAppServerConnection(params) {
-	return (await import("./binding-connection.runtime-CnRMC0ta.mjs")).resolveCodexBindingAppServerConnection(params, catalogHomes.tryGetRuntime());
+	return (await import("./binding-connection.runtime-6TpgD1M6.mjs")).resolveCodexBindingAppServerConnection(params, catalogHomes.tryGetRuntime());
 }
 //#endregion
 export { setCodexCatalogConnectionHomeResolver as a, resolveCodexBindingAppServerConnection as i, binding_connection_exports as n, requireCodexSupervisionModelSelection as r, assertCodexSessionRuntimeOwnership as t };

package/dist/.setup/{binding-connection.runtime-CnRMC0ta.mjs → binding-connection.runtime-6TpgD1M6.mjs}

@@ -1,7 +1,7 @@
-import { g as resolveCodexAppServerLocalHomeDir } from "./config-security-BRQ2mgW9.mjs";
-import { d as readCodexPluginConfig } from "./config-parsing-CcB9iPoq.mjs";
-import { t as buildCodexAppServerConnectionFingerprint } from "./plugin-app-cache-key-BOxKP7db.mjs";
-import { n as resolveCodexAppServerRuntimeOptions, r as resolveCodexSupervisionAppServerRuntimeOptions } from "./config-runtime-CeAhl_h4.mjs";
+import { d as readCodexPluginConfig } from "./config-parsing-b088LyhT.mjs";
+import { n as resolveCodexAppServerLocalHomeDir } from "./auth-start-options-BPIPeEX8.mjs";
+import { t as buildCodexAppServerConnectionFingerprint } from "./plugin-app-cache-key-BL9B5H0L.mjs";
+import { n as resolveCodexAppServerRuntimeOptions, r as resolveCodexSupervisionAppServerRuntimeOptions } from "./config-runtime-C0NbLms1.mjs";
 //#region extensions/codex/src/app-server/binding-connection.runtime.ts
 /** Resolves connection and auth ownership exclusively from the private thread binding. */
 async function resolveCodexBindingAppServerConnection(params, discoverHomes) {
@@ -41,7 +41,7 @@ async function resolveCodexBindingAppServerConnection(params, discoverHomes) {
 		appServer,
 		usesSupervisionConnection,
 		requestAuthProfileId: usesSupervisionConnection ? void 0 : authProfileId,
-		clientAuthProfileId: usesSupervisionConnection ? null : authProfileId
+		clientAuthProfileId: usesSupervisionConnection || appServer.start.homeScope === "user" ? null : authProfileId
 	};
 }
 //#endregion