@openclaw/codex 2026.9.5 → 2026.9.7

package/dist/.setup/{incognito-session-uhrBF6wJ.mjs → thread-ownership-queue-Dp24d7-F.mjs}

@@ -1,6 +1,5 @@
 import { resolveGlobalSingleton } from "openclaw/plugin-sdk/global-singleton";
 import { KeyedAsyncQueue } from "openclaw/plugin-sdk/keyed-async-queue";
-import { isIncognitoSessionKey as isIncognitoSessionKey$1 } from "openclaw/plugin-sdk/session-key-runtime";
 //#region extensions/codex/src/app-server/thread-ownership-queue.ts
 const nativeThreadOwners = resolveGlobalSingleton(Symbol.for("openclaw.codexNativeThreadOwners"), () => new KeyedAsyncQueue());
 /** Serialize OpenClaw-owned lifecycle changes, not native-internal thread controllers. */
@@ -12,4 +11,4 @@ async function withCodexConversationThreadActivity(bindingId, run) {
 	return await nativeThreadOwners.enqueue(`conversation:${bindingId}`, run);
 }
 //#endregion
-export { withCodexAppServerThreadMutation as n, withCodexConversationThreadActivity as r, isIncognitoSessionKey$1 as t };
+export { withCodexConversationThreadActivity as n, withCodexAppServerThreadMutation as t };

package/dist/.setup/{thread-ownership-skomxnIt.mjs → thread-ownership-roNP0l1c.mjs}

@@ -1,7 +1,10 @@
-import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.mjs";
-import { n as withCodexAppServerThreadMutation } from "./incognito-session-uhrBF6wJ.mjs";
-import { U as releaseCodexAppServerLiveThread, W as retainCodexAppServerLiveThread, _ as retainSharedCodexAppServerClientByInstanceId, z as isCodexAppServerLiveThreadClaimed } from "./shared-client-BpTtuLQ5.mjs";
-import { a as closeCodexStartupClientBestEffort, f as unsubscribeCodexThreadBestEffort, r as CodexAppServerUnsafeSubscriptionError } from "./attempt-client-cleanup-BpYKdTA0.mjs";
+import { l as retainSharedCodexAppServerClientByInstanceId } from "./shared-client-lifecycle-DJIgqgMw.mjs";
+import { t as withCodexAppServerThreadMutation } from "./thread-ownership-queue-Dp24d7-F.mjs";
+import { G as releaseCodexAppServerLiveThread, K as retainCodexAppServerLiveThread, V as isCodexAppServerLiveThreadClaimed } from "./shared-client-DqyTMYug.mjs";
+import { o as closeCodexStartupClientBestEffort, p as unsubscribeCodexThreadBestEffort, r as CodexAppServerUnsafeSubscriptionError } from "./attempt-client-cleanup-DOP-cW5j.mjs";
+import { t as __exportAll } from "./session-binding-sidecars-jo6H8dFr.mjs";
+import { createDeferred } from "openclaw/plugin-sdk/extension-shared";
+import { runWithAsyncWorkResources } from "openclaw/plugin-sdk/agent-harness-tool-runtime";
 //#region extensions/codex/src/app-server/thread-ownership.ts
 var thread_ownership_exports = /* @__PURE__ */ __exportAll({
 	isSameCodexAppServerThreadOwner: () => isSameCodexAppServerThreadOwner,
@@ -9,8 +12,36 @@ var thread_ownership_exports = /* @__PURE__ */ __exportAll({
 	retainCodexAppServerBindingSubscription: () => retainCodexAppServerBindingSubscription,
 	retireCodexConversationThreadBinding: () => retireCodexConversationThreadBinding,
 	rollbackCodexAppServerBindingSubscription: () => rollbackCodexAppServerBindingSubscription,
+	withCodexAppServerThreadMutationHold: () => withCodexAppServerThreadMutationHold,
 	withExclusiveCodexAppServerThread: () => withExclusiveCodexAppServerThread
 });
+/** Queued cancellation settles the caller without letting successors overtake its lane. */
+async function withCodexAppServerThreadMutationHold(threadId, run, signal) {
+	return await runWithAsyncWorkResources(async (onAcquired) => {
+		signal?.throwIfAborted();
+		const { promise, resolve, reject } = createDeferred();
+		const abort = () => reject(signal?.reason instanceof Error ? signal.reason : /* @__PURE__ */ new Error("compaction aborted"));
+		signal?.addEventListener("abort", abort, { once: true });
+		const start = () => signal?.removeEventListener("abort", abort);
+		const queued = withCodexAppServerThreadMutation(threadId, async () => {
+			let heldUntil;
+			try {
+				signal?.throwIfAborted();
+				resolve(await run((until) => {
+					heldUntil ??= until;
+				}, start));
+			} catch (error) {
+				reject(error);
+			}
+			await heldUntil;
+		});
+		onAcquired({ release: async () => {
+			await Promise.allSettled([queued]);
+		} });
+		queued.finally(start).catch(reject);
+		return promise;
+	});
+}
 /** Codex subscriptions belong to a physical connection, not the native thread ID alone. */
 function isSameCodexAppServerThreadOwner(current, expected) {
 	return current !== void 0 && expected !== void 0 && current.threadId === expected.threadId && current.clientId === expected.clientId;
@@ -48,7 +79,7 @@ async function rollbackCodexAppServerBindingSubscription(client, threadId, retai
 /** Releases only the physical client and native thread recorded by the displaced binding owner. */
 async function releaseCodexAppServerBindingSubscription(binding, options = {}) {
 	options.assertCurrent?.();
-	const clientLease = retainSharedCodexAppServerClientByInstanceId(binding.clientId);
+	const clientLease = await retainSharedCodexAppServerClientByInstanceId(binding.clientId);
 	if (!clientLease) return;
 	try {
 		if (await releaseCodexAppServerLiveThread(clientLease.client, binding.threadId, options.assertCurrent)) return;
@@ -64,23 +95,29 @@ async function releaseCodexAppServerBindingSubscription(binding, options = {}) {
 			throw new CodexAppServerUnsafeSubscriptionError(`Codex retired thread subscription could not be released: ${binding.threadId}`);
 		}
 	} finally {
-		clientLease.release();
+		await clientLease.release(binding.clientId !== options.retainedClientId && !isCodexAppServerLiveThreadClaimed(clientLease.client, binding.threadId));
 	}
 }
 /** Clears and releases one exact conversation generation without touching its replacement. */
 async function retireCodexConversationThreadBinding(params) {
+	const assertCurrent = params.assertCurrent;
 	const expected = params.bindingStore.read(params.identity);
 	if (!expected || params.expectedThreadId && expected.threadId !== params.expectedThreadId) return false;
 	return await withCodexAppServerThreadMutation(expected.threadId, () => params.bindingStore.withLease(params.identity, async () => {
 		const current = params.bindingStore.read(params.identity);
 		if (!current || !isSameCodexAppServerThreadOwner(current, expected) || params.expectedStartId && current?.conversationStartId !== params.expectedStartId) return false;
-		await releaseCodexAppServerBindingSubscription(current, { allowUntracked: params.allowUntracked });
+		assertCurrent?.();
+		await releaseCodexAppServerBindingSubscription(current, {
+			allowUntracked: params.allowUntracked,
+			assertCurrent
+		});
 		const cleared = await params.bindingStore.mutate(params.identity, {
 			kind: "clear",
 			threadId: current.threadId
-		});
+		}, assertCurrent);
 		if (!cleared || !params.afterClear) return cleared;
 		try {
+			assertCurrent?.();
 			await params.afterClear();
 			return true;
 		} catch (error) {
@@ -89,7 +126,7 @@ async function retireCodexConversationThreadBinding(params) {
 					kind: "set",
 					binding: current,
 					if: { kind: "absent" }
-				})) throw new Error("the previous Codex binding generation could not be restored", { cause: error });
+				}, assertCurrent)) throw new Error("the previous Codex binding generation could not be restored", { cause: error });
 			} catch (restorationError) {
 				throw new AggregateError([error, restorationError], `Codex conversation detachment failed and native thread ${current.threadId} could not be restored; run /codex resume ${current.threadId} to recover it`, { cause: restorationError });
 			}
@@ -98,4 +135,4 @@ async function retireCodexConversationThreadBinding(params) {
 	}));
 }
 //#endregion
-export { rollbackCodexAppServerBindingSubscription as a, retireCodexConversationThreadBinding as i, releaseCodexAppServerBindingSubscription as n, thread_ownership_exports as o, retainCodexAppServerBindingSubscription as r, withExclusiveCodexAppServerThread as s, isSameCodexAppServerThreadOwner as t };
+export { rollbackCodexAppServerBindingSubscription as a, withExclusiveCodexAppServerThread as c, retireCodexConversationThreadBinding as i, releaseCodexAppServerBindingSubscription as n, thread_ownership_exports as o, retainCodexAppServerBindingSubscription as r, withCodexAppServerThreadMutationHold as s, isSameCodexAppServerThreadOwner as t };

package/dist/.setup/thread-policy-DTd-DtkX.mjs

@@ -0,0 +1,109 @@
+import { r as requestCodexAppServerClientJson, t as CodexAppServerScopedRequestRejectedError } from "./request-BHZ1nz8d.mjs";
+import { S as CodexAdoptedThreadActiveError } from "./shared-client-DqyTMYug.mjs";
+import { l as isCodexAppServerOverloadError, u as isCodexAppServerPrewriteRequestCancellationError, v as assertCodexThreadAcceptsDirectInput } from "./client-N0JpgSzF.mjs";
+import { AgentHarnessPreflightError, embeddedAgentLog, formatErrorMessage } from "openclaw/plugin-sdk/agent-harness-runtime";
+//#region extensions/codex/src/app-server/thread-policy.ts
+/** A refusal, not a failed native write: the ephemeral conversation must stay alive. */
+var CodexIncognitoPolicyChangeError = class extends AgentHarnessPreflightError {
+	constructor() {
+		super("Codex cannot change generic instructions in a live incognito conversation. No turn was sent and the conversation is preserved. Restore the previous instructions to continue it, or start a new incognito conversation for the changed policy.");
+		this.name = "CodexIncognitoPolicyChangeError";
+	}
+};
+/** Never replay a handoff: native persistence can precede an unsuccessful RPC response. */
+var CodexThreadPolicyHandoffError = class extends AgentHarnessPreflightError {
+	constructor(outcome, cause) {
+		super(`Codex session policy handoff failed: ${cause instanceof Error ? cause.message : String(cause)}. The conversation is preserved; reconnect before retrying.`, { cause });
+		this.outcome = outcome;
+		this.name = "CodexThreadPolicyHandoffError";
+	}
+};
+/** The complete body remains generic configuration for compaction and native child inheritance. */
+async function refreshCodexThreadPolicy(params) {
+	await injectCodexThreadDeveloperHandoff(params, "The following is the complete current OpenClaw-supplied generic instruction policy. It replaces earlier OpenClaw-supplied generic policy, including sections removed from that generic policy. Parent-local instructions supplied for the current inference request are outside this policy replacement. Independently supplied native managed, guardian, security, collaboration, and project instructions retain their authority. User requests retain their own authority.\n\n" + (params.developerInstructions === "" ? "The current OpenClaw generic policy is empty; earlier OpenClaw generic policy is withdrawn." : params.developerInstructions));
+}
+/**
+* Refreshes only the skill catalog on a live thread whose generic policy cannot
+* change (ephemeral threads have no resume source). The refresh is a client-authored
+* developer message, so it must be re-delivered after every compaction.
+*/
+async function refreshCodexThreadSkillsCatalog(params) {
+	await injectCodexThreadDeveloperHandoff(params, "The following is the complete current OpenClaw skills catalog. It replaces the earlier OpenClaw skills catalog in this conversation.\n\n" + (params.skillsInstructions ?? "The current OpenClaw skills catalog is empty; the earlier catalog is withdrawn."));
+}
+/**
+* Compaction rebuilds initial context from the thread's creation-time developer
+* instructions and drops client-authored developer messages unless
+* `retain_client_developer_messages` is enabled, which is off by default
+* (codex-rs/core/src/compact_remote_v2.rs). A catalog refreshed in place therefore
+* reverts to the creation-time catalog, while the host still records the refreshed
+* value as delivered and skips reinjection on later turns. Re-deliver the current
+* catalog after every compaction, including compaction inside an active turn.
+*/
+async function restoreCodexThreadSkillsCatalogAfterCompaction(params) {
+	const policy = params.ephemeralPolicy;
+	if (!policy || policy.skillsInstructions === policy.nativeSkillsInstructions) return policy;
+	try {
+		await refreshCodexThreadSkillsCatalog({
+			...params,
+			skillsInstructions: policy.skillsInstructions
+		});
+		return policy;
+	} catch (error) {
+		embeddedAgentLog.warn("failed to restore Codex skill catalog after compaction", {
+			threadId: params.threadId,
+			error: formatErrorMessage(error)
+		});
+		return {
+			...policy,
+			skillsInstructions: policy.nativeSkillsInstructions
+		};
+	}
+}
+async function injectCodexThreadDeveloperHandoff(params, text) {
+	let outcome = "unknown";
+	try {
+		await requestCodexAppServerClientJson({
+			...params,
+			method: "thread/inject_items",
+			requestParams: {
+				threadId: params.threadId,
+				items: [{
+					type: "message",
+					role: "developer",
+					content: [{
+						type: "input_text",
+						text
+					}]
+				}]
+			}
+		});
+		outcome = "acknowledged";
+		params.assertCurrent?.();
+		params.signal?.throwIfAborted();
+	} catch (cause) {
+		if (outcome !== "acknowledged" && (cause instanceof CodexAppServerScopedRequestRejectedError || isCodexAppServerPrewriteRequestCancellationError(cause) || isCodexAppServerOverloadError(cause))) outcome = "not-written";
+		throw new CodexThreadPolicyHandoffError(outcome, cause);
+	}
+}
+/** Native lineage classifies the exact bound thread; it never grants session authority. */
+function assertCodexSupervisionThreadLineage(binding, thread) {
+	if (binding.connectionScope !== "supervision" || binding.pendingSupervisionBranch) return;
+	if (thread.id !== binding.threadId || !binding.supervisionSourceThreadId || thread.forkedFromId !== null && (typeof thread.forkedFromId !== "string" || !thread.forkedFromId.trim() || thread.forkedFromId === thread.id)) throw new Error("Codex supervision lineage could not be verified; reconnect before continuing.");
+}
+/** Passive refusal must precede releasing or acquiring any native subscription. */
+async function assertAdoptedCodexThreadResumeAllowed(params, threadId, context, assertCurrent) {
+	const { thread } = await context.lifecycleTiming.measure("thread-read-adoption-status", () => params.client.request("thread/read", {
+		threadId,
+		includeTurns: false
+	}, {
+		signal: params.signal,
+		assertCurrent
+	}));
+	context.throwIfAborted();
+	if (thread.id !== threadId) throw new Error("Codex returned another thread during adoption status read");
+	assertCodexThreadAcceptsDirectInput(thread);
+	if (thread.status?.type === "active") throw new CodexAdoptedThreadActiveError();
+	return thread;
+}
+//#endregion
+export { refreshCodexThreadPolicy as a, assertCodexSupervisionThreadLineage as i, CodexThreadPolicyHandoffError as n, refreshCodexThreadSkillsCatalog as o, assertAdoptedCodexThreadResumeAllowed as r, restoreCodexThreadSkillsCatalogAfterCompaction as s, CodexIncognitoPolicyChangeError as t };