@openclaw/codex 2026.9.5 → 2026.9.7

package/dist/.setup/{command-handlers-BtAJEW1X.mjs → command-handlers-ylTMS00z.mjs}

@@ -1,102 +1,93 @@
-import { n as isCodexFastServiceTier } from "./config-utils-DujwEnhg.mjs";
-import { c as CODEX_PLUGINS_MARKETPLACE_NAME, i as pluginReadParams, r as isOpenAiCuratedMarketplaceName, t as findCodexMarketplacePluginSummary } from "./plugin-inventory-DUle8DLz.mjs";
-import { n as assertCodexBindingMayBeReplaced, p as sessionBindingIdentity, r as bindingStoreKey } from "./session-binding-record-TH3xA0zj.mjs";
-import { m as isJsonObject } from "./config-security-BRQ2mgW9.mjs";
-import { _ as assertCodexThreadAcceptsDirectInput, s as isCodexAppServerIndeterminateRequestCancellationError, u as isCodexAppServerPrewriteRequestCancellationError, y as assertCodexThreadResumeResponse } from "./client-vXs2929Q.mjs";
-import { c as resolveCodexAppServerPreparedApiKeyCacheKey, s as resolveCodexAppServerFallbackApiKeyCacheKey } from "./auth-cache-key-QirmgiCo.mjs";
-import { r as withCodexConversationThreadActivity, t as isIncognitoSessionKey } from "./incognito-session-uhrBF6wJ.mjs";
-import { a as CODEX_HOST_INSPECTION_AUTH_ERROR, c as hasCodexAdminScope, i as CODEX_FULL_PERMISSIONS_AUTH_ERROR, n as filterCodexMarketplacePlugins, o as CODEX_NATIVE_EXECUTION_AUTH_ERROR, r as parseCodexPluginMarketplaceId, s as canMutateCodexHost, t as discoverCodexMarketplacePlugins } from "./plugin-marketplace-discovery-P-Vndfqq.mjs";
-import { s as summarizeCodexAccountUsage } from "./rate-limits-DOEGYRNs.mjs";
-import { a as formatCodexAccountLine, c as formatCodexTextForDisplay, d as formatModels, f as formatSkills, i as formatAccount, l as formatComputerUseStatus, n as buildHelp, o as formatCodexDisplayText, p as formatThreads, r as escapeCodexChatText, s as formatCodexStatus, t as CODEX_RESUME_SAFE_THREAD_ID_PATTERN, u as formatList } from "./command-formatters-CGEkdawF.mjs";
-import { i as readCodexConversationBindingData, n as createCodexCliNodeConversationBindingData, o as resolveCodexDefaultWorkspaceDir, r as createCodexConversationBindingData } from "./conversation-binding-data-CrcyZk6O.mjs";
-import { i as CodexAppServerRpcError } from "./timeout-DZF05XrR.mjs";
-import { t as CODEX_CONTROL_METHODS } from "./capabilities-_vXcZGSx.mjs";
-import { i as formatCodexCliSessions } from "./node-cli-sessions-Cl8b2ZF3.mjs";
-import { a as defaultCodexAppInventoryCache, r as buildCodexPluginAppCacheKey } from "./plugin-app-cache-key-BOxKP7db.mjs";
-import { i as resolveCodexBindingAppServerConnection } from "./binding-connection-Bm38niE8.mjs";
-import { o as withCodexAppServerJsonClient } from "./request-BioXJLYa.mjs";
-import "./config-CedDWjM-.mjs";
-import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-CeAhl_h4.mjs";
-import { a as resolveCodexAppServerAuthProfileStore, i as resolveCodexAppServerAuthProfileIdForAgent, n as normalizeCodexAppServerBindingModelProvider } from "./auth-profile-WqZtZfXN.mjs";
-import { n as fingerprintCodexAppServerAuthBinding } from "./auth-binding-DhLWa_7K.mjs";
-import { I as hasCodexAppServerLiveThread, N as consumeCodexAppServerLiveThread, X as resolveCodexAppServerAuthAccountCacheKey, c as getLeasedSharedCodexAppServerClient, h as releaseLeasedSharedCodexAppServerClient } from "./shared-client-BpTtuLQ5.mjs";
-import { a as closeCodexStartupClientBestEffort } from "./attempt-client-cleanup-BpYKdTA0.mjs";
-import { t as listAllCodexAppServerModels } from "./models-BDFgm_G-.mjs";
-import { n as refreshCodexAppRuntimeState, r as refreshCodexPluginRuntimeState } from "./plugin-activation-r8nq5Jzp.mjs";
-import { n as createCodexSessionGenerationSupersededError, o as resolveCodexSessionBinding } from "./session-binding-_0W_fHRr.mjs";
-import { r as assertCodexSupervisionThreadLineage } from "./thread-policy-Cjs4B8xf.mjs";
-import { a as rollbackCodexAppServerBindingSubscription, i as retireCodexConversationThreadBinding, n as releaseCodexAppServerBindingSubscription, r as retainCodexAppServerBindingSubscription, s as withExclusiveCodexAppServerThread, t as isSameCodexAppServerThreadOwner } from "./thread-ownership-skomxnIt.mjs";
-import { n as resolveCodexNativeSandboxBlock, t as resolveCodexNativeExecutionBlock } from "./sandbox-guard-BBP-RbTf.mjs";
-import { i as readCodexComputerUseStatus, r as installCodexComputerUse, t as defaultCodexPluginMetadataCache } from "./plugin-metadata-cache-DsS5buNa.mjs";
-import { a as requestOptions, i as readCodexStatusProbes, o as safeCodexControlRequest, r as prepareCodexControlSessionAuth, t as codexControlRequest } from "./command-rpc-DHFpn4le.mjs";
-import { a as setCodexConversationFastMode, c as steerCodexConversationTurn, i as readCodexConversationActiveTurn, l as stopCodexConversationTurn, n as parseCodexFastModeArg, o as setCodexConversationModel, r as parseCodexPermissionsModeArg, s as setCodexConversationPermissions, t as formatPermissionsMode } from "./conversation-control-DN53ns41.mjs";
+import { n as isCodexFastServiceTier } from "./config-utils-D0CXecki.mjs";
+import { o as pluginReadParams, r as isOpenAiCuratedMarketplaceName, t as findCodexMarketplacePluginSummary, u as CODEX_PLUGINS_MARKETPLACE_NAME } from "./plugin-inventory-Cky2XJUw.mjs";
+import { i as isJsonObject } from "./protocol-CANUwXJ3.mjs";
+import { n as assertCodexBindingMayBeReplaced, r as bindingStoreKey, v as sessionBindingIdentity } from "./session-binding-record-Oe9L-CNY.mjs";
+import { c as resolveCodexAppServerPreparedApiKeyCacheKey, s as resolveCodexAppServerFallbackApiKeyCacheKey } from "./auth-cache-key-Dbvq-QgB.mjs";
+import { n as withCodexConversationThreadActivity } from "./thread-ownership-queue-Dp24d7-F.mjs";
+import { a as CODEX_HOST_INSPECTION_AUTH_ERROR, c as canMutateCodexHost, i as CODEX_FULL_PERMISSIONS_AUTH_ERROR, l as hasCodexAdminScope, n as filterCodexMarketplacePlugins, o as CODEX_NATIVE_EXECUTION_AUTH_ERROR, r as parseCodexPluginMarketplaceId, s as assertCodexHostOwnerCurrent, t as discoverCodexMarketplacePlugins } from "./plugin-marketplace-discovery-D_dV9FXa.mjs";
+import { l as formatRelativeDuration, s as summarizeCodexAccountUsage } from "./rate-limits-B7-X2TgG.mjs";
+import { a as formatCodexAccountLine, c as formatCodexTextForDisplay, d as formatModels, f as formatSkills, i as formatAccount, l as formatComputerUseStatus, n as buildHelp, o as formatCodexDisplayText, p as formatThreads, r as escapeCodexChatText, s as formatCodexStatus, t as CODEX_RESUME_SAFE_THREAD_ID_PATTERN, u as formatList } from "./command-formatters-R3ckE3Co.mjs";
+import { i as readCodexConversationBindingData, n as createCodexCliNodeConversationBindingData, o as resolveCodexDefaultWorkspaceDir, r as createCodexConversationBindingData } from "./conversation-binding-data-C746z5Pn.mjs";
+import { t as isIncognitoSessionKey } from "./incognito-session-DWYapfwf.mjs";
+import { n as CodexAppServerRpcError } from "./rpc-error-BlD2vuzn.mjs";
+import { t as CODEX_CONTROL_METHODS } from "./capabilities-B3WEZl4e.mjs";
+import { o as formatCodexCliSessions } from "./node-cli-sessions-HC4W6FLI.mjs";
+import { a as defaultCodexAppInventoryCache, r as buildCodexPluginAppCacheKey } from "./plugin-app-cache-key-BL9B5H0L.mjs";
+import { i as resolveCodexBindingAppServerConnection } from "./binding-connection-DTtN1KrX.mjs";
+import { o as withCodexAppServerJsonClient } from "./request-BHZ1nz8d.mjs";
+import "./config-DKhXquav.mjs";
+import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-C0NbLms1.mjs";
+import { a as resolveCodexAppServerAuthProfileStore, i as resolveCodexAppServerAuthProfileIdForAgent, n as normalizeCodexAppServerBindingModelProvider } from "./auth-profile-B0okYl2D.mjs";
+import { F as consumeCodexAppServerLiveThread, R as hasCodexAppServerLiveThread, c as getLeasedSharedCodexAppServerClient, et as resolveCodexAppServerAuthAccountCacheKey, h as releaseLeasedSharedCodexAppServerClient } from "./shared-client-DqyTMYug.mjs";
+import { b as assertCodexThreadResumeResponse, s as isCodexAppServerIndeterminateRequestCancellationError, u as isCodexAppServerPrewriteRequestCancellationError, v as assertCodexThreadAcceptsDirectInput } from "./client-N0JpgSzF.mjs";
+import { o as closeCodexStartupClientBestEffort } from "./attempt-client-cleanup-DOP-cW5j.mjs";
+import { n as fingerprintCodexAppServerAuthBinding } from "./auth-binding-BLWz7stm.mjs";
+import { n as listAllCodexAppServerModels } from "./models-DHXZtVVk.mjs";
+import { n as refreshCodexAppRuntimeState, r as refreshCodexPluginRuntimeState } from "./plugin-activation-cNHRfaxU.mjs";
+import { n as createCodexSessionGenerationSupersededError, o as resolveCodexSessionBinding } from "./session-binding-DGCYAfvD.mjs";
+import { i as assertCodexSupervisionThreadLineage } from "./thread-policy-DTd-DtkX.mjs";
+import { a as rollbackCodexAppServerBindingSubscription, c as withExclusiveCodexAppServerThread, i as retireCodexConversationThreadBinding, n as releaseCodexAppServerBindingSubscription, r as retainCodexAppServerBindingSubscription, t as isSameCodexAppServerThreadOwner } from "./thread-ownership-roNP0l1c.mjs";
+import { n as resolveCodexNativeSandboxBlock, t as resolveCodexNativeExecutionBlock } from "./sandbox-guard-DjCz2eOw.mjs";
+import { i as readCodexComputerUseStatus, r as installCodexComputerUse, t as defaultCodexPluginMetadataCache } from "./plugin-metadata-cache-DsjsL1dr.mjs";
+import { a as requestOptions, i as readCodexStatusProbes, o as safeCodexControlRequest, r as prepareCodexControlSessionAuth, t as codexControlRequest } from "./command-rpc-CGJGUQ6Y.mjs";
+import { a as setCodexConversationFastMode, c as steerCodexConversationTurn, i as readCodexConversationActiveTurn, l as stopCodexConversationTurn, n as parseCodexFastModeArg, o as setCodexConversationModel, r as parseCodexPermissionsModeArg, s as setCodexConversationPermissions, t as formatPermissionsMode } from "./conversation-control-CEP8X5JC.mjs";
 import { normalizeOptionalString, normalizeUniqueStringEntries } from "openclaw/plugin-sdk/string-coerce-runtime";
 import crypto from "node:crypto";
 import { isDeepStrictEqual } from "node:util";
 import { resolveSessionAgentIdsStrict } from "openclaw/plugin-sdk/agent-scope-runtime";
 import { parseStrictPositiveInteger } from "openclaw/plugin-sdk/number-runtime";
+import { coerceErrorMessage } from "openclaw/plugin-sdk/error-runtime";
 import { expectDefined } from "openclaw/plugin-sdk/expect-runtime";
+import { parseAgentSessionKey } from "openclaw/plugin-sdk/routing";
 import { truncateUtf16Safe } from "openclaw/plugin-sdk/text-utility-runtime";
 import { ensureAuthProfileStore, resolveAgentDir as resolveAgentDir$1, resolveAgentWorkspaceDir, resolveAuthProfileEligibility, resolveProfileUnusableUntilForDisplay } from "openclaw/plugin-sdk/agent-runtime";
 import { getSessionEntry, resolveStorePath } from "openclaw/plugin-sdk/session-store-runtime";
 import { findNormalizedProviderValue, resolveAuthProfileOrder } from "openclaw/plugin-sdk/provider-auth";
-import { parseAgentSessionKey } from "openclaw/plugin-sdk/routing";
 import { renderMessagePresentationFallbackText } from "openclaw/plugin-sdk/interactive-runtime";
 import { MODEL_SELECTION_LOCKED_MESSAGE, isModelSelectionLocked, resolvePersistedSessionRuntimeId } from "openclaw/plugin-sdk/model-session-runtime";
 //#region extensions/codex/src/command-account.ts
 const OPENAI_PROVIDER_ID = "openai";
-const OPENAI_CODEX_PROVIDER_ID = OPENAI_PROVIDER_ID;
 async function readCodexAccountAuthOverview(params) {
+	if (!params.account.ok && !params.limits.ok) return;
 	const config = params.ctx.config;
 	const agentDir = params.agentDir;
 	const store = ensureAuthProfileStore(agentDir, {
 		allowKeychainPrompt: false,
 		config
 	});
-	const { order, explicit: explicitOrder } = resolveDisplayAuthOrder({
+	const order = resolveDisplayAuthOrder({
 		config,
 		store
 	});
+	const activeProfileId = params.authProfileId ?? void 0;
+	if (activeProfileId && !order.includes(activeProfileId)) order.unshift(activeProfileId);
 	if (order.length === 0) return;
 	const now = Date.now();
-	const activeProfileId = resolveActiveProfileId({
-		store,
-		order,
-		explicitOrder,
-		config,
-		account: params.account,
-		limits: params.limits,
-		now
-	});
 	const activeIsSubscription = activeProfileId !== void 0 && isChatGptSubscriptionProfile(store.profiles[activeProfileId]);
-	const subscriptionProfileId = activeIsSubscription ? activeProfileId : order.find((profileId) => isChatGptSubscriptionProfile(store.profiles[profileId]));
+	const subscriptionProfileId = activeIsSubscription ? activeProfileId : activeProfileId ? order.find((profileId) => isChatGptSubscriptionProfile(store.profiles[profileId])) : void 0;
 	const activeUsage = activeIsSubscription && params.limits.ok ? summarizeCodexAccountUsage(params.limits.value, now) : void 0;
-	const subscriptionUsage = subscriptionProfileId && (!activeIsSubscription || subscriptionProfileId !== activeProfileId) ? await readSubscriptionUsage({
+	const subscriptionUsage = subscriptionProfileId && !activeIsSubscription ? await readSubscriptionUsage({
 		...params,
 		agentDir,
 		config,
 		subscriptionProfileId,
 		now
 	}) : activeUsage;
-	if (!params.account.ok && !params.limits.ok && !subscriptionUsage) return;
-	const rows = order.map((profileId, index) => buildProfileRow({
+	const rows = order.map((profileId) => buildProfileRow({
 		store,
 		config,
 		profileId,
 		activeProfileId,
-		activeIndex: activeProfileId ? order.indexOf(activeProfileId) : -1,
-		index,
 		now,
 		usage: profileId === subscriptionProfileId ? subscriptionUsage : void 0
 	}));
 	const activeRow = rows.find((row) => row.active);
 	if (!activeRow) return {
-		currentLine: "OpenAI credentials: no working credential",
 		orderTitle: "Auth order",
 		rows
 	};
 	const activeIsApiKey = store.profiles[activeRow.profileId]?.type === "api_key";
-	const subscriptionLabel = subscriptionProfileId ? formatProfileLabel(subscriptionProfileId, store.profiles[subscriptionProfileId]) : activeIsSubscription ? activeRow.label : void 0;
+	const subscriptionLabel = subscriptionProfileId ? formatProfileLabel(subscriptionProfileId, store.profiles[subscriptionProfileId]) : void 0;
 	const subscriptionUsageLine = formatSubscriptionUsageLine(subscriptionUsage);
 	return {
 		...activeIsApiKey ? { currentLine: buildApiKeyActiveLine(activeRow, subscriptionUsage) } : {},
@@ -107,92 +98,13 @@ async function readCodexAccountAuthOverview(params) {
 	};
 }
 function resolveDisplayAuthOrder(params) {
-	const codexOrder = resolveOrder(params.store.order, OPENAI_CODEX_PROVIDER_ID) ?? resolveOrder(params.config?.auth?.order, OPENAI_CODEX_PROVIDER_ID);
-	if (codexOrder && codexOrder.length > 0) return {
-		order: normalizeUniqueStringEntries(codexOrder),
-		explicit: true
-	};
-	return {
-		order: resolveAuthProfileOrder({
-			cfg: params.config,
-			store: params.store,
-			provider: OPENAI_CODEX_PROVIDER_ID
-		}),
-		explicit: hasExplicitOpenAiAuthOrder(params)
-	};
-}
-function hasExplicitOpenAiAuthOrder(params) {
-	const sources = [params.store.order, params.config?.auth?.order];
-	for (const source of sources) {
-		const codex = resolveOrder(source, OPENAI_CODEX_PROVIDER_ID);
-		if (codex && codex.length > 0) return true;
-		const openai = resolveOrder(source, OPENAI_PROVIDER_ID);
-		if (openai && openai.length > 0) return true;
-	}
-	return false;
-}
-function resolveOrder(order, provider) {
-	return findNormalizedProviderValue(order, provider);
-}
-function resolveActiveProfileId(params) {
-	const liveProfileId = resolveLiveAccountProfileId({
-		account: params.account,
-		store: params.store,
-		order: params.order
-	});
-	if (liveProfileId) return liveProfileId;
-	if (params.explicitOrder) return params.order.find((profileId) => isActiveProfileCandidate(params, profileId) && resolveAuthProfileEligibility({
-		cfg: params.config,
-		store: params.store,
-		provider: OPENAI_CODEX_PROVIDER_ID,
-		profileId,
-		now: params.now
-	}).eligible);
-	const lastGood = [params.store.lastGood?.[OPENAI_PROVIDER_ID], params.store.lastGood?.[OPENAI_CODEX_PROVIDER_ID]].find((profileId) => typeof profileId === "string" && params.order.includes(profileId) && isActiveProfileCandidate(params, profileId));
-	if (lastGood) return lastGood;
-	const mostRecent = params.order.map((profileId) => ({
-		profileId,
-		lastUsed: params.store.usageStats?.[profileId]?.lastUsed ?? 0
-	})).filter((entry) => entry.lastUsed > 0 && isActiveProfileCandidate(params, entry.profileId)).toSorted((left, right) => right.lastUsed - left.lastUsed)[0]?.profileId;
-	if (mostRecent) return mostRecent;
-	if (shouldInferApiKeyActiveFromRateLimitProbe(params.limits)) {
-		const apiKeyProfile = params.order.find((profileId) => params.store.profiles[profileId]?.type === "api_key");
-		if (apiKeyProfile) return apiKeyProfile;
-	}
+	const explicitOrder = findNormalizedProviderValue(params.store.order, OPENAI_PROVIDER_ID) ?? findNormalizedProviderValue(params.config?.auth?.order, OPENAI_PROVIDER_ID);
+	if (explicitOrder && explicitOrder.length > 0) return normalizeUniqueStringEntries(explicitOrder);
 	return resolveAuthProfileOrder({
 		cfg: params.config,
 		store: params.store,
-		provider: OPENAI_CODEX_PROVIDER_ID
-	})[0];
-}
-function isActiveProfileCandidate(params, profileId) {
-	return !isActiveUntil(resolveProfileUnusableUntilForDisplay(params.store, profileId) ?? void 0, params.now);
-}
-function resolveLiveAccountProfileId(params) {
-	if (!params.account.ok || !isJsonObject(params.account.value)) return;
-	const account = isJsonObject(params.account.value.account) ? params.account.value.account : params.account.value;
-	const type = normalizeOptionalString(account.type)?.toLowerCase();
-	if (type === "chatgpt") {
-		const email = normalizeOptionalString(account.email)?.toLowerCase();
-		const accountId = normalizeOptionalString(account.accountId ?? account.chatgptAccountId);
-		const subscriptionProfiles = params.order.filter((profileId) => isChatGptSubscriptionProfile(params.store.profiles[profileId]));
-		if (accountId) {
-			const exactWorkspace = subscriptionProfiles.find((profileId) => {
-				const credential = params.store.profiles[profileId];
-				return credential && "accountId" in credential && credential.accountId === accountId;
-			});
-			if (exactWorkspace) return exactWorkspace;
-		}
-		const matchingProfiles = email ? subscriptionProfiles.filter((profileId) => {
-			return (params.store.profiles[profileId]?.email?.trim().toLowerCase() ?? extractEmailFromProfileId(profileId))?.toLowerCase() === email;
-		}) : subscriptionProfiles;
-		const lastGood = params.store.lastGood?.[OPENAI_PROVIDER_ID];
-		return (lastGood && matchingProfiles.includes(lastGood) ? lastGood : void 0) ?? matchingProfiles[0] ?? subscriptionProfiles[0];
-	}
-	if (type === "apikey" || type === "api_key") return params.order.find((profileId) => params.store.profiles[profileId]?.type === "api_key");
-}
-function shouldInferApiKeyActiveFromRateLimitProbe(limits) {
-	return !limits.ok && limits.error.toLowerCase().includes("chatgpt authentication required");
+		provider: OPENAI_PROVIDER_ID
+	});
 }
 async function readSubscriptionUsage(params) {
 	const limits = await params.safeCodexControlRequest(params.pluginConfig, CODEX_CONTROL_METHODS.rateLimits, void 0, {
@@ -209,13 +121,12 @@ function buildProfileRow(params) {
 	const label = formatProfileLabel(params.profileId, credential);
 	const kind = formatProfileKind(credential);
 	const active = params.profileId === params.activeProfileId;
-	const status = active ? "active now" : params.usage?.blocked ? formatUsageBlockedStatus(params.usage) : describeInactiveProfileStatus({
+	const status = active ? "active now" : params.usage?.blocked ? "rate-limited" : describeInactiveProfileStatus({
 		store: params.store,
 		config: params.config,
 		profileId: params.profileId,
 		credential,
-		now: params.now,
-		afterActive: params.activeIndex >= 0 && params.index > params.activeIndex
+		now: params.now
 	});
 	return {
 		profileId: params.profileId,
@@ -223,22 +134,18 @@ function buildProfileRow(params) {
 		kind,
 		status,
 		active,
-		...credential?.type === "api_key" && active ? { billingNote: "billed per token" } : {},
-		...params.usage?.usageLine ? { usage: params.usage.usageLine } : {}
+		...credential?.type === "api_key" && active ? { billingNote: "billed per token" } : {}
 	};
 }
-function formatUsageBlockedStatus(usage) {
-	return usage.blocked ? "rate-limited" : "available if needed";
-}
 function describeInactiveProfileStatus(params) {
 	const stats = params.store.usageStats?.[params.profileId];
 	const blockedUntil = stats?.blockedUntil;
-	if (isActiveUntil(blockedUntil, params.now)) return `rate-limited - resets ${formatRelativeReset(blockedUntil, params.now)}`;
+	if (isActiveUntil(blockedUntil, params.now)) return `rate-limited - resets in ${formatRelativeDuration(Math.max(6e4, blockedUntil - params.now))}`;
 	if (isActiveUntil(resolveProfileUnusableUntilForDisplay(params.store, params.profileId) ?? void 0, params.now)) return describeFailureStatus(stats?.disabledReason ?? stats?.cooldownReason, params.credential);
 	const eligibility = resolveAuthProfileEligibility({
 		cfg: params.config,
 		store: params.store,
-		provider: OPENAI_CODEX_PROVIDER_ID,
+		provider: OPENAI_PROVIDER_ID,
 		profileId: params.profileId,
 		now: params.now
 	});
@@ -324,22 +231,6 @@ function describeEligibilityStatus(reason, credential) {
 function isActiveUntil(value, now) {
 	return typeof value === "number" && Number.isFinite(value) && value > now;
 }
-function formatRelativeReset(untilMs, nowMs) {
-	const durationMs = Math.max(1e3, untilMs - nowMs);
-	const minuteMs = 6e4;
-	const hourMs = 60 * minuteMs;
-	const dayMs = 24 * hourMs;
-	if (durationMs < hourMs) {
-		const minutes = Math.ceil(durationMs / minuteMs);
-		return `in ${minutes} ${minutes === 1 ? "minute" : "minutes"}`;
-	}
-	if (durationMs < dayMs) {
-		const hours = Math.ceil(durationMs / hourMs);
-		return `in ${hours} ${hours === 1 ? "hour" : "hours"}`;
-	}
-	const days = Math.ceil(durationMs / dayMs);
-	return `in ${days} ${days === 1 ? "day" : "days"}`;
-}
 function buildCodexPluginAppLinks(apps, options = {}) {
 	const blocks = apps.slice(0, 5).map((app) => {
 		const name = formatCodexDisplayText((app.name.trim() || app.id).slice(0, 80));
@@ -379,6 +270,24 @@ function buildCodexPluginAppLinks(apps, options = {}) {
 	});
 	return blocks;
 }
+function buildCodexPluginStatusButtons(pluginId, canRefreshHostedApps) {
+	return {
+		type: "buttons",
+		buttons: [...canRefreshHostedApps ? [{
+			label: "Refresh hosted apps",
+			action: {
+				type: "command",
+				command: "/codex plugins refresh"
+			}
+		}] : [], {
+			label: "Check status",
+			action: {
+				type: "command",
+				command: `/codex plugins status ${pluginId}`
+			}
+		}]
+	};
+}
 function safeCodexAppLink(value) {
 	if (!value || value.length > 2048 || /[\s\p{Cc}\p{Cf}<>]/u.test(value)) return;
 	try {
@@ -686,22 +595,7 @@ function formatCodexPluginReadiness(readiness, page = 1) {
 				type: "text",
 				text: "Flags reflect Codex's runtime snapshot; status does not refresh hosted tools. After connecting, /codex plugins refresh refreshes hosted inventory for the current Codex account/runtime, across all apps. Use Check status separately to inspect this plugin without refreshing. OpenClaw app-access changes take effect on your next message; use /new or /reset after connecting."
 			});
-			blocks.push({
-				type: "buttons",
-				buttons: [...canRefreshHostedApps ? [{
-					label: "Refresh hosted apps",
-					action: {
-						type: "command",
-						command: "/codex plugins refresh"
-					}
-				}] : [], {
-					label: "Check status",
-					action: {
-						type: "command",
-						command: `/codex plugins status ${readiness.commandId}`
-					}
-				}]
-			});
+			blocks.push(buildCodexPluginStatusButtons(readiness.commandId, canRefreshHostedApps));
 		}
 	}
 	const presentation = {
@@ -872,73 +766,59 @@ function buildCodexSubcommandPickerReply() {
 	};
 }
 function buildCodexFastMenuReply() {
-	const modes = [
-		"on",
-		"off",
-		"status"
-	];
-	const buttons = [...modes.map((mode) => ({
-		label: mode,
-		command: `/codex fast ${mode}`
-	})), {
-		label: "back",
-		command: "/codex"
-	}];
-	return {
-		text: [
-			"Codex fast mode. Pick one or type /codex fast <mode>:",
-			"",
-			...modes.map((m, i) => `  ${i + 1}. /codex fast ${m}`),
-			"",
-			"Type '/codex' to go back to the main menu."
-		].join("\n"),
-		presentation: buildCodexCommandPickerPresentation("Codex fast mode", "Pick a Codex fast mode:", buttons)
-	};
+	return buildCodexChoiceMenuReply({
+		title: "Codex fast mode",
+		prompt: "Pick a Codex fast mode:",
+		introduction: "Codex fast mode. Pick one or type /codex fast <mode>:",
+		command: "/codex fast",
+		choices: [
+			"on",
+			"off",
+			"status"
+		]
+	});
 }
 function buildCodexPermissionsMenuReply() {
-	const modes = [
-		"default",
-		"yolo",
-		"status"
-	];
-	const buttons = [...modes.map((mode) => ({
-		label: mode,
-		command: `/codex permissions ${mode}`
-	})), {
-		label: "back",
-		command: "/codex"
-	}];
-	return {
-		text: [
-			"Codex permissions. Pick one or type /codex permissions <mode>:",
-			"",
-			...modes.map((m, i) => `  ${i + 1}. /codex permissions ${m}`),
-			"",
-			"Type '/codex' to go back to the main menu."
-		].join("\n"),
-		presentation: buildCodexCommandPickerPresentation("Codex permissions", "Pick a Codex permissions mode:", buttons)
-	};
+	return buildCodexChoiceMenuReply({
+		title: "Codex permissions",
+		prompt: "Pick a Codex permissions mode:",
+		introduction: "Codex permissions. Pick one or type /codex permissions <mode>:",
+		command: "/codex permissions",
+		choices: [
+			"default",
+			"yolo",
+			"status"
+		]
+	});
 }
 function buildCodexComputerUseMenuReply() {
-	const actions = ["status", "install"];
-	const buttons = [...actions.map((action) => ({
-		label: action,
-		command: `/codex computer-use ${action}`
+	return buildCodexChoiceMenuReply({
+		title: "Codex computer-use",
+		prompt: "Pick a Codex computer-use action:",
+		introduction: "Codex computer-use. Pick one or type /codex computer-use <action>:",
+		command: "/codex computer-use",
+		choices: ["status", "install"],
+		hint: "Flag-driven invocations (--source, --marketplace-path, --marketplace) are not in the picker. Type '/codex computer-use' or read '/codex help' for the full surface."
+	});
+}
+function buildCodexChoiceMenuReply(params) {
+	const buttons = [...params.choices.map((choice) => ({
+		label: choice,
+		command: `${params.command} ${choice}`
 	})), {
 		label: "back",
 		command: "/codex"
 	}];
 	return {
 		text: [
-			"Codex computer-use. Pick one or type /codex computer-use <action>:",
-			"",
-			...actions.map((a, i) => `  ${i + 1}. /codex computer-use ${a}`),
+			params.introduction,
 			"",
-			"Flag-driven invocations (--source, --marketplace-path, --marketplace) are not in the picker. Type '/codex computer-use' or read '/codex help' for the full surface.",
+			...params.choices.map((choice, index) => `  ${index + 1}. ${params.command} ${choice}`),
 			"",
+			...params.hint ? [params.hint, ""] : [],
 			"Type '/codex' to go back to the main menu."
 		].join("\n"),
-		presentation: buildCodexCommandPickerPresentation("Codex computer-use", "Pick a Codex computer-use action:", buttons)
+		presentation: buildCodexCommandPickerPresentation(params.title, params.prompt, buttons)
 	};
 }
 function isMenuVerb(rest) {
@@ -990,54 +870,18 @@ function splitArgs(value) {
 	return args;
 }
 function parseBindArgs(args) {
-	const parsed = {};
-	for (let index = 0; index < args.length; index += 1) {
-		const arg = expectDefined(args[index], "current Codex bind argument");
-		if (arg === "--help" || arg === "-h") {
-			parsed.help = true;
-			continue;
-		}
-		if (arg === "--cwd") {
-			const value = readRequiredOptionValue(args, index);
-			if (!value || parsed.cwd !== void 0) {
-				parsed.help = true;
-				continue;
-			}
-			parsed.cwd = value;
-			index += 1;
-			continue;
-		}
-		if (arg === "--model") {
-			const value = readRequiredOptionValue(args, index);
-			if (!value || parsed.model !== void 0) {
-				parsed.help = true;
-				continue;
-			}
-			parsed.model = value;
-			index += 1;
-			continue;
-		}
-		if (arg === "--provider" || arg === "--model-provider") {
-			const value = readRequiredOptionValue(args, index);
-			if (!value || parsed.provider !== void 0) {
-				parsed.help = true;
-				continue;
-			}
-			parsed.provider = value;
-			index += 1;
-			continue;
-		}
-		if (!arg.startsWith("-") && !parsed.threadId) {
-			parsed.threadId = arg;
-			continue;
-		}
-		parsed.help = true;
-	}
-	parsed.threadId = normalizeOptionalString(parsed.threadId);
-	parsed.cwd = normalizeOptionalString(parsed.cwd);
-	parsed.model = normalizeOptionalString(parsed.model);
-	parsed.provider = normalizeOptionalString(parsed.provider);
-	return parsed;
+	const { parsed, values } = parseThreadArgs(args, /* @__PURE__ */ new Map([
+		["--cwd", "cwd"],
+		["--model", "model"],
+		["--provider", "provider"],
+		["--model-provider", "provider"]
+	]));
+	return {
+		...parsed,
+		cwd: normalizeOptionalString(values.get("cwd")),
+		model: normalizeOptionalString(values.get("model")),
+		provider: normalizeOptionalString(values.get("provider"))
+	};
 }
 function parseCodexCliSessionsArgs(args) {
 	const parsed = { filter: "" };
@@ -1080,29 +924,34 @@ function parseCodexCliSessionsArgs(args) {
 	return parsed;
 }
 function parseResumeArgs(args) {
+	const { parsed, values } = parseThreadArgs(args, /* @__PURE__ */ new Map([
+		["--host", "host"],
+		["--node", "host"],
+		["--bind", "bind"]
+	]));
+	return {
+		...parsed,
+		...values.has("bind") ? { bindHere: true } : {},
+		host: normalizeOptionalString(values.get("host"))
+	};
+}
+function parseThreadArgs(args, options) {
 	const parsed = {};
+	const values = /* @__PURE__ */ new Map();
 	for (let index = 0; index < args.length; index += 1) {
-		const arg = expectDefined(args[index], "current Codex resume argument");
+		const arg = expectDefined(args[index], "current Codex thread argument");
 		if (arg === "--help" || arg === "-h") {
 			parsed.help = true;
 			continue;
 		}
-		if (arg === "--host" || arg === "--node") {
+		const option = options.get(arg);
+		if (option) {
 			const value = readRequiredOptionValue(args, index);
-			if (!value || parsed.host !== void 0) {
-				parsed.help = true;
-				continue;
-			}
-			parsed.host = value;
-			index += 1;
-			continue;
-		}
-		if (arg === "--bind") {
-			if (readRequiredOptionValue(args, index) !== "here" || parsed.bindHere !== void 0) {
+			if (!value || values.has(option) || option === "bind" && value !== "here") {
 				parsed.help = true;
 				continue;
 			}
-			parsed.bindHere = true;
+			values.set(option, value);
 			index += 1;
 			continue;
 		}
@@ -1113,8 +962,10 @@ function parseResumeArgs(args) {
 		parsed.help = true;
 	}
 	parsed.threadId = normalizeOptionalString(parsed.threadId);
-	parsed.host = normalizeOptionalString(parsed.host);
-	return parsed;
+	return {
+		parsed,
+		values
+	};
 }
 function parseComputerUseArgs(args) {
 	const parsed = {
@@ -1139,33 +990,14 @@ function parseComputerUseArgs(args) {
 			parsed.action = arg;
 			continue;
 		}
-		if (arg === "--source" || arg === "--marketplace-source") {
-			const value = readRequiredOptionValue(args, index);
-			if (!value || parsed.overrides.marketplaceSource !== void 0) {
-				parsed.help = true;
-				continue;
-			}
-			parsed.overrides.marketplaceSource = value;
-			index += 1;
-			continue;
-		}
-		if (arg === "--marketplace-path" || arg === "--path") {
+		const option = arg === "--source" || arg === "--marketplace-source" ? "marketplaceSource" : arg === "--marketplace-path" || arg === "--path" ? "marketplacePath" : arg === "--marketplace" ? "marketplaceName" : void 0;
+		if (option) {
 			const value = readRequiredOptionValue(args, index);
-			if (!value || parsed.overrides.marketplacePath !== void 0) {
+			if (!value || parsed.overrides[option] !== void 0) {
 				parsed.help = true;
 				continue;
 			}
-			parsed.overrides.marketplacePath = value;
-			index += 1;
-			continue;
-		}
-		if (arg === "--marketplace") {
-			const value = readRequiredOptionValue(args, index);
-			if (!value || parsed.overrides.marketplaceName !== void 0) {
-				parsed.help = true;
-				continue;
-			}
-			parsed.overrides.marketplaceName = value;
+			parsed.overrides[option] = value;
 			index += 1;
 			continue;
 		}
@@ -1182,8 +1014,19 @@ function parseComputerUseArgs(args) {
 		}
 		parsed.help = true;
 	}
-	parsed.overrides = normalizeComputerUseStringOverrides(parsed.overrides);
-	parsed.hasOverrides = Object.values(parsed.overrides).some(Boolean);
+	const overrides = parsed.overrides;
+	parsed.overrides = {};
+	for (const key of [
+		"marketplaceSource",
+		"marketplacePath",
+		"marketplaceName"
+	]) {
+		const value = normalizeOptionalString(overrides[key]);
+		if (value) {
+			parsed.overrides[key] = value;
+			parsed.hasOverrides = true;
+		}
+	}
 	return parsed;
 }
 function formatComputerUsePersistentIdentityMigration(parsed) {
@@ -1203,16 +1046,6 @@ function readRequiredOptionValue(args, index) {
 	if (!normalized || normalized.startsWith("-")) return;
 	return value;
 }
-function normalizeComputerUseStringOverrides(overrides) {
-	const normalized = {};
-	const marketplaceSource = normalizeOptionalString(overrides.marketplaceSource);
-	if (marketplaceSource) normalized.marketplaceSource = marketplaceSource;
-	const marketplacePath = normalizeOptionalString(overrides.marketplacePath);
-	if (marketplacePath) normalized.marketplacePath = marketplacePath;
-	const marketplaceName = normalizeOptionalString(overrides.marketplaceName);
-	if (marketplaceName) normalized.marketplaceName = marketplaceName;
-	return normalized;
-}
 //#endregion
 //#region extensions/codex/src/command-diagnostics-support.ts
 const CODEX_DIAGNOSTICS_SOURCE = "openclaw-diagnostics";
@@ -1232,16 +1065,11 @@ function normalizeDiagnosticsReason(note) {
 }
 function parseDiagnosticsArgs(args) {
 	const [action, token, ...extra] = splitArgs(args);
-	const normalizedAction = action?.toLowerCase();
-	if ((normalizedAction === "confirm" || normalizedAction === "--confirm") && token && extra.length === 0) return {
-		action: "confirm",
+	const normalizedAction = action?.toLowerCase().replace(/^--/, "");
+	if (normalizedAction === "confirm" || normalizedAction === "cancel") return token && extra.length === 0 ? {
+		action: normalizedAction,
 		token
-	};
-	if ((normalizedAction === "cancel" || normalizedAction === "--cancel") && token && extra.length === 0) return {
-		action: "cancel",
-		token
-	};
-	if (normalizedAction === "confirm" || normalizedAction === "--confirm" || normalizedAction === "cancel" || normalizedAction === "--cancel") return { action: "usage" };
+	} : { action: "usage" };
 	return {
 		action: "request",
 		note: args
@@ -1297,27 +1125,14 @@ function readCodexDiagnosticsConfirmationScope(ctx) {
 }
 function readCodexDiagnosticsScopeMismatch(pending, ctx) {
 	const current = readCodexDiagnosticsConfirmationScope(ctx);
-	if (pending.accountId !== current.accountId) return {
-		confirmMessage: "This Codex diagnostics confirmation belongs to a different account.",
-		cancelMessage: "This Codex diagnostics confirmation belongs to a different account."
-	};
+	if (pending.accountId !== current.accountId) return "This Codex diagnostics confirmation belongs to a different account.";
 	if (pending.privateRouted) return;
-	if (pending.channelId !== current.channelId) return {
-		confirmMessage: "This Codex diagnostics confirmation belongs to a different channel instance.",
-		cancelMessage: "This Codex diagnostics confirmation belongs to a different channel instance."
-	};
-	if (pending.messageThreadId !== current.messageThreadId) return {
-		confirmMessage: "This Codex diagnostics confirmation belongs to a different thread.",
-		cancelMessage: "This Codex diagnostics confirmation belongs to a different thread."
-	};
-	if (pending.threadParentId !== current.threadParentId) return {
-		confirmMessage: "This Codex diagnostics confirmation belongs to a different parent thread.",
-		cancelMessage: "This Codex diagnostics confirmation belongs to a different parent thread."
-	};
-	if (pending.sessionKey !== current.sessionKey) return {
-		confirmMessage: "This Codex diagnostics confirmation belongs to a different session.",
-		cancelMessage: "This Codex diagnostics confirmation belongs to a different session."
-	};
+	for (const [field, label] of [
+		["channelId", "channel instance"],
+		["messageThreadId", "thread"],
+		["threadParentId", "parent thread"],
+		["sessionKey", "session"]
+	]) if (pending[field] !== current[field]) return `This Codex diagnostics confirmation belongs to a different ${label}.`;
 }
 function readPendingCodexDiagnosticsConfirmation(token, now) {
 	prunePendingCodexDiagnosticsConfirmations(now);
@@ -1394,13 +1209,13 @@ function formatCodexDiagnosticsTargetLine(target) {
 }
 function readCodexDiagnosticsTargetsCooldownMessage(targets, ctx, now, options = {}) {
 	for (const target of targets) {
-		const cooldownMs = readCodexDiagnosticsCooldownMs(target.threadId, now);
+		const cooldownMs = readCodexDiagnosticsCooldownMs(lastCodexDiagnosticsUploadByThread, target.threadId, now);
 		if (cooldownMs > 0) {
 			if (options.includeThreadId === false) return `Codex diagnostics were already sent for one of these Codex threads recently. Try again in ${Math.ceil(cooldownMs / 1e3)}s.`;
 			return `Codex diagnostics were already sent for thread ${formatCodexDisplayText(target.threadId)} recently. Try again in ${Math.ceil(cooldownMs / 1e3)}s.`;
 		}
 	}
-	const scopeCooldownMs = readCodexDiagnosticsScopeCooldownMs(options.cooldownScope ?? readCodexDiagnosticsCooldownScope(ctx), now);
+	const scopeCooldownMs = readCodexDiagnosticsCooldownMs(lastCodexDiagnosticsUploadByScope, options.cooldownScope ?? readCodexDiagnosticsCooldownScope(ctx), now);
 	if (scopeCooldownMs > 0) return `Codex diagnostics were already sent for this account or channel recently. Try again in ${Math.ceil(scopeCooldownMs / 1e3)}s.`;
 }
 function recordCodexDiagnosticsUpload(threadId, ctx, now, cooldownScope) {
@@ -1422,30 +1237,22 @@ function readCodexDiagnosticsCooldownScope(ctx) {
 	return crypto.createHash("sha256").update(payload).digest("hex");
 }
 function buildDiagnosticsTags(ctx) {
-	const tags = { source: CODEX_DIAGNOSTICS_SOURCE };
-	addTag(tags, "channel", ctx.channel);
-	return tags;
-}
-function addTag(tags, key, value) {
-	if (typeof value === "string" && value.trim()) tags[key] = value.trim();
+	const channel = normalizeOptionalString(ctx.channel);
+	return {
+		source: CODEX_DIAGNOSTICS_SOURCE,
+		...channel ? { channel } : {}
+	};
 }
 function formatCodexCopyableValueForDisplay(value) {
 	const safe = formatCodexTextForDisplay(value);
 	if (CODEX_RESUME_SAFE_THREAD_ID_PATTERN.test(safe)) return `\`${safe}\``;
 	return escapeCodexChatText(safe);
 }
-function readCodexDiagnosticsCooldownMs(threadId, now) {
-	const lastSentAt = lastCodexDiagnosticsUploadByThread.get(threadId);
+function readCodexDiagnosticsCooldownMs(map, key, now) {
+	const lastSentAt = map.get(key);
 	if (!lastSentAt) return 0;
 	const remainingMs = Math.max(0, CODEX_DIAGNOSTICS_COOLDOWN_MS - (now - lastSentAt));
-	if (remainingMs === 0) lastCodexDiagnosticsUploadByThread.delete(threadId);
-	return remainingMs;
-}
-function readCodexDiagnosticsScopeCooldownMs(scope, now) {
-	const lastSentAt = lastCodexDiagnosticsUploadByScope.get(scope);
-	if (!lastSentAt) return 0;
-	const remainingMs = Math.max(0, CODEX_DIAGNOSTICS_COOLDOWN_MS - (now - lastSentAt));
-	if (remainingMs === 0) lastCodexDiagnosticsUploadByScope.delete(scope);
+	if (remainingMs === 0) map.delete(key);
 	return remainingMs;
 }
 function recordBoundedCodexDiagnosticsCooldown(map, key, maxSize, now) {
@@ -1573,7 +1380,15 @@ async function resolvePreparedCodexCommandAuthority(deps, ctx) {
 		sessionKey,
 		storePath,
 		assertHostCurrent,
-		assertCurrent
+		assertCurrent,
+		assertMutationCurrent: () => {
+			assertCodexHostOwnerCurrent(ctx);
+			assertCurrent();
+		},
+		assertHostMutationCurrent: () => {
+			assertCodexHostOwnerCurrent(ctx);
+			assertHostCurrent();
+		}
 	};
 }
 async function resolveCommandAppServerContext(deps, ctx, pluginConfig) {
@@ -1631,7 +1446,9 @@ function resolveCodexConversationControlScope(ctx) {
 }
 //#endregion
 //#region extensions/codex/src/command-diagnostics.ts
-async function handleCodexDiagnosticsFeedback(deps, ctx, pluginConfig, args, commandPrefix) {
+const NO_DIAGNOSTICS_THREAD = ["No Codex thread is attached to this OpenClaw session yet.", "Use /codex threads to find a thread, then /codex resume <thread-id> before sending diagnostics."].join("\n");
+async function handleCodexDiagnosticsFeedback(deps, context, pluginConfig, args, commandPrefix) {
+	const ctx = { ...context };
 	if (ctx.senderIsOwner !== true) return { text: "Only an owner can send Codex diagnostics." };
 	const parsed = parseDiagnosticsArgs(args);
 	if (parsed.action === "usage") return { text: formatDiagnosticsUsage(commandPrefix) };
@@ -1642,9 +1459,8 @@ async function handleCodexDiagnosticsFeedback(deps, ctx, pluginConfig, args, com
 	return await requestCodexDiagnosticsFeedbackApproval(deps, ctx, parsed.note, commandPrefix);
 }
 async function requestCodexDiagnosticsFeedbackApproval(deps, ctx, note, commandPrefix) {
-	if (!await hasAnyCodexDiagnosticsIdentity(ctx)) return { text: "Cannot send Codex diagnostics because this command did not include a stable session identity." };
-	const targets = await resolveCodexDiagnosticsTargets(deps, ctx);
-	if (targets.length === 0) return { text: ["No Codex thread is attached to this OpenClaw session yet.", "Use /codex threads to find a thread, then /codex resume <thread-id> before sending diagnostics."].join("\n") };
+	const targets = await requireCodexDiagnosticsTargets(deps, ctx);
+	if (typeof targets === "string") return { text: targets };
 	const now = Date.now();
 	const cooldownMessage = readCodexDiagnosticsTargetsCooldownMessage(targets, ctx, now);
 	if (cooldownMessage) return { text: cooldownMessage };
@@ -1698,9 +1514,8 @@ async function requestCodexDiagnosticsFeedbackApproval(deps, ctx, note, commandP
 	};
 }
 async function previewCodexDiagnosticsFeedbackApproval(deps, ctx, note) {
-	if (!await hasAnyCodexDiagnosticsIdentity(ctx)) return "Cannot send Codex diagnostics because this command did not include a stable session identity.";
-	const targets = await resolveCodexDiagnosticsTargets(deps, ctx);
-	if (targets.length === 0) return ["No Codex thread is attached to this OpenClaw session yet.", "Use /codex threads to find a thread, then /codex resume <thread-id> before sending diagnostics."].join("\n");
+	const targets = await requireCodexDiagnosticsTargets(deps, ctx);
+	if (typeof targets === "string") return targets;
 	const cooldownMessage = readCodexDiagnosticsTargetsCooldownMessage(targets, ctx, Date.now(), { includeThreadId: false });
 	if (cooldownMessage) return cooldownMessage;
 	const reason = normalizeDiagnosticsReason(note);
@@ -1714,28 +1529,16 @@ async function previewCodexDiagnosticsFeedbackApproval(deps, ctx, note) {
 	].join("\n");
 }
 async function confirmCodexDiagnosticsFeedback(deps, ctx, pluginConfig, token) {
-	const pending = readPendingCodexDiagnosticsConfirmation(token, Date.now());
-	if (!pending) return "No pending Codex diagnostics confirmation was found. Run /diagnostics again to create a fresh request.";
-	if (!pending.senderId || !ctx.senderId) return "Cannot confirm Codex diagnostics because this command did not include the original sender identity.";
-	if (pending.senderId !== ctx.senderId) return "Only the user who requested these Codex diagnostics can confirm the upload.";
-	if (pending.channel !== ctx.channel) return "This Codex diagnostics confirmation belongs to a different channel.";
-	const scopeMismatch = readCodexDiagnosticsScopeMismatch(pending, ctx);
-	if (scopeMismatch) return scopeMismatch.confirmMessage;
-	deletePendingCodexDiagnosticsConfirmation(token);
+	const pending = consumeCodexDiagnosticsConfirmation(ctx, token, "confirm");
+	if (typeof pending === "string") return pending;
 	if (!pending.privateRouted && !await hasAnyCodexDiagnosticsIdentity(ctx)) return "Cannot send Codex diagnostics because this command did not include a stable session identity.";
 	const currentTargets = pending.privateRouted ? resolvePendingCodexDiagnosticsTargets(deps, pending.targets, ctx.config) : await resolveCodexDiagnosticsTargets(deps, ctx);
 	if (!codexDiagnosticsTargetsMatch(pending.targets, currentTargets)) return "The Codex diagnostics sessions changed before confirmation. Run /diagnostics again for the current threads.";
 	return await sendCodexDiagnosticsFeedbackForTargets(deps, ctx, pluginConfig, pending.note ?? "", currentTargets, { cooldownScope: pending.scopeKey });
 }
 function cancelCodexDiagnosticsFeedback(ctx, token) {
-	const pending = readPendingCodexDiagnosticsConfirmation(token, Date.now());
-	if (!pending) return "No pending Codex diagnostics confirmation was found.";
-	if (!pending.senderId || !ctx.senderId) return "Cannot cancel Codex diagnostics because this command did not include the original sender identity.";
-	if (pending.senderId !== ctx.senderId) return "Only the user who requested these Codex diagnostics can cancel the upload.";
-	if (pending.channel !== ctx.channel) return "This Codex diagnostics confirmation belongs to a different channel.";
-	const scopeMismatch = readCodexDiagnosticsScopeMismatch(pending, ctx);
-	if (scopeMismatch) return scopeMismatch.cancelMessage;
-	deletePendingCodexDiagnosticsConfirmation(token);
+	const pending = consumeCodexDiagnosticsConfirmation(ctx, token, "cancel");
+	if (typeof pending === "string") return pending;
 	return [
 		"Codex diagnostics upload canceled.",
 		"Codex sessions:",
@@ -1743,13 +1546,12 @@ function cancelCodexDiagnosticsFeedback(ctx, token) {
 	].join("\n");
 }
 async function sendCodexDiagnosticsFeedbackForContext(deps, ctx, pluginConfig, note) {
-	if (!await hasAnyCodexDiagnosticsIdentity(ctx)) return "Cannot send Codex diagnostics because this command did not include a stable session identity.";
-	const targets = await resolveCodexDiagnosticsTargets(deps, ctx);
-	if (targets.length === 0) return ["No Codex thread is attached to this OpenClaw session yet.", "Use /codex threads to find a thread, then /codex resume <thread-id> before sending diagnostics."].join("\n");
+	const targets = await requireCodexDiagnosticsTargets(deps, ctx);
+	if (typeof targets === "string") return targets;
 	return await sendCodexDiagnosticsFeedbackForTargets(deps, ctx, pluginConfig, note, targets);
 }
 async function sendCodexDiagnosticsFeedbackForTargets(deps, ctx, pluginConfig, note, targets, options = {}) {
-	if (targets.length === 0) return ["No Codex thread is attached to this OpenClaw session yet.", "Use /codex threads to find a thread, then /codex resume <thread-id> before sending diagnostics."].join("\n");
+	if (targets.length === 0) return NO_DIAGNOSTICS_THREAD;
 	const now = Date.now();
 	const cooldownMessage = readCodexDiagnosticsTargetsCooldownMessage(targets, ctx, now, { cooldownScope: options.cooldownScope });
 	if (cooldownMessage) return cooldownMessage;
@@ -1758,6 +1560,7 @@ async function sendCodexDiagnosticsFeedbackForTargets(deps, ctx, pluginConfig, n
 	const failed = [];
 	for (const target of targets) {
 		const assertCurrent = () => {
+			ctx.assertOwnerCurrent?.();
 			const current = resolvePendingCodexDiagnosticsTargets(deps, [target], ctx.config);
 			if (!codexDiagnosticsTargetsMatch([target], current)) throw new Error("The Codex diagnostics session changed before upload; request it again.");
 		};
@@ -1809,6 +1612,22 @@ async function sendCodexDiagnosticsFeedbackForTargets(deps, ctx, pluginConfig, n
 	}
 	return formatCodexDiagnosticsUploadResult(sent, failed);
 }
+function consumeCodexDiagnosticsConfirmation(ctx, token, action) {
+	const pending = readPendingCodexDiagnosticsConfirmation(token, Date.now());
+	if (!pending) return action === "confirm" ? "No pending Codex diagnostics confirmation was found. Run /diagnostics again to create a fresh request." : "No pending Codex diagnostics confirmation was found.";
+	if (!pending.senderId || !ctx.senderId) return `Cannot ${action} Codex diagnostics because this command did not include the original sender identity.`;
+	if (pending.senderId !== ctx.senderId) return `Only the user who requested these Codex diagnostics can ${action} the upload.`;
+	if (pending.channel !== ctx.channel) return "This Codex diagnostics confirmation belongs to a different channel.";
+	const scopeMismatch = readCodexDiagnosticsScopeMismatch(pending, ctx);
+	if (scopeMismatch) return scopeMismatch;
+	deletePendingCodexDiagnosticsConfirmation(token);
+	return pending;
+}
+async function requireCodexDiagnosticsTargets(deps, ctx) {
+	if (!await hasAnyCodexDiagnosticsIdentity(ctx)) return "Cannot send Codex diagnostics because this command did not include a stable session identity.";
+	const targets = await resolveCodexDiagnosticsTargets(deps, ctx);
+	return targets.length > 0 ? targets : NO_DIAGNOSTICS_THREAD;
+}
 async function hasAnyCodexDiagnosticsIdentity(ctx) {
 	if (await resolveControlTarget(ctx)) return true;
 	return (ctx.diagnosticsSessions ?? []).some((session) => Boolean(session.sessionId));
@@ -1955,6 +1774,7 @@ async function bindConversation(deps, ctx, pluginConfig, args) {
 		}
 	});
 	const threadLabel = parsed.threadId ?? "a new thread";
+	assertCodexHostOwnerCurrent(ctx);
 	const request = await ctx.requestConversationBinding({
 		summary: `Codex app-server thread ${formatCodexDisplayText(threadLabel)} in ${formatCodexDisplayText(workspaceDir)}`,
 		detachHint: "/codex detach",
@@ -1988,6 +1808,7 @@ async function detachConversation(deps, ctx) {
 			bindingStore: deps.bindingStore,
 			identity,
 			expectedThreadId,
+			assertCurrent: () => assertCodexHostOwnerCurrent(ctx),
 			...expectedStartId ? { expectedStartId } : {},
 			...isIncognitoSessionKey(sourceSessionKey) ? { allowUntracked: true } : {},
 			afterClear: async () => {
@@ -1996,6 +1817,7 @@ async function detachConversation(deps, ctx) {
 		})) return "This Codex conversation binding changed while detaching; try again.";
 		return detachedPublicConversation;
 	});
+	assertCodexHostOwnerCurrent(ctx);
 	return await detachPublicConversation();
 }
 async function describeConversationBinding(deps, ctx) {
@@ -2119,7 +1941,10 @@ async function resumeThread(deps, ctx, pluginConfig, args) {
 					retained = await retainCodexAppServerBindingSubscription(client, effectiveThreadId, knownOwnership);
 					assertCurrent();
 					if (!retained) throw new Error("Codex resumed thread lost its native subscription owner.");
-					if (bindingBeforeCommit && !sameOwner) await releaseCodexAppServerBindingSubscription(bindingBeforeCommit, { assertCurrent });
+					if (bindingBeforeCommit && !sameOwner) await releaseCodexAppServerBindingSubscription(bindingBeforeCommit, {
+						assertCurrent,
+						retainedClientId: clientId
+					});
 					assertCurrent();
 					if (!await deps.bindingStore.mutate(identity, {
 						kind: "set",
@@ -2155,6 +1980,7 @@ async function resumeThread(deps, ctx, pluginConfig, args) {
 				sessionId: ctx.sessionId,
 				storePath: ctx.sessionTarget?.storePath,
 				assertCurrent: assertHostGeneration,
+				assertOwnerCurrent: () => assertCodexHostOwnerCurrent(ctx),
 				beforeRequest: async (request) => {
 					const { thread } = await request({
 						method: "thread/read",
@@ -2199,6 +2025,7 @@ async function bindCodexCliNodeSession(deps, ctx, parsed) {
 		cwd: resolved.session?.cwd
 	});
 	const summary = `Codex CLI session ${formatCodexDisplayText(parsed.threadId)} on ${formatCodexDisplayText(nodeId)}`;
+	assertCodexHostOwnerCurrent(ctx);
 	const request = await ctx.requestConversationBinding({
 		summary,
 		detachHint: "/codex detach",
@@ -2291,7 +2118,10 @@ async function handleComputerUseCommand(deps, ctx, pluginConfig, args) {
 		forceEnable: parsed.action === "install" || parsed.hasOverrides,
 		...Object.keys(parsed.overrides).length > 0 ? { overrides: parsed.overrides } : {}
 	};
-	if (parsed.action === "install") return formatComputerUseStatus(await deps.installCodexComputerUse(params));
+	if (parsed.action === "install") return formatComputerUseStatus(await deps.installCodexComputerUse({
+		...params,
+		assertCurrent: () => assertCodexHostOwnerCurrent(ctx)
+	}));
 	return formatComputerUseStatus(await deps.readCodexComputerUseStatus(params));
 }
 async function handleNativeGoal(deps, ctx, pluginConfig, args) {
@@ -2325,7 +2155,10 @@ async function handleNativeGoal(deps, ctx, pluginConfig, args) {
 	}
 	if (action === "clear") {
 		if (args.length > 1) return "Usage: /codex goal clear";
-		const response = await deps.codexControlRequest(pluginConfig, CODEX_CONTROL_METHODS.clearThreadGoal, { threadId: binding.threadId }, goalRequestOptions);
+		const response = await deps.codexControlRequest(pluginConfig, CODEX_CONTROL_METHODS.clearThreadGoal, { threadId: binding.threadId }, {
+			...goalRequestOptions,
+			assertOwnerCurrent: () => assertCodexHostOwnerCurrent(ctx)
+		});
 		return isJsonObject(response) && response.cleared === true ? "Cleared the Codex goal." : "No Codex goal was active.";
 	}
 	const requestedStatus = action === "pause" ? "paused" : action === "resume" ? "active" : action === "block" ? "blocked" : action === "complete" ? "complete" : void 0;
@@ -2338,6 +2171,7 @@ async function handleNativeGoal(deps, ctx, pluginConfig, args) {
 		...requestedStatus ? { status: requestedStatus } : {}
 	}, {
 		...goalRequestOptions,
+		assertOwnerCurrent: () => assertCodexHostOwnerCurrent(ctx),
 		...(isObjectiveUpdate || requestedStatus === "active") && connection.usesSupervisionConnection ? { beforeRequest: supervisedCommandGuard(deps, target.identity, binding) } : {}
 	})));
 }
@@ -2354,20 +2188,17 @@ function formatNativeGoal(response) {
 		`- Tokens: ${tokensUsed}${tokenBudget === void 0 ? "" : ` / ${tokenBudget}`}`
 	].join("\n");
 }
-async function stopConversationTurn(deps, ctx, pluginConfig) {
+async function stopConversationTurn(deps, ctx) {
 	const authority = await resolvePreparedCodexCommandAuthority(deps, ctx);
 	const { target, binding } = authority;
 	if (!target) return "Cannot stop Codex because this command did not include a stable binding identity.";
 	return (await deps.stopCodexConversationTurn({
 		identity: target.identity,
 		binding,
-		pluginConfig,
-		agentDir: target.agentDir,
-		config: ctx.config,
-		assertCurrent: authority.assertCurrent
+		assertCurrent: authority.assertMutationCurrent
 	})).message;
 }
-async function steerConversationTurn(deps, ctx, pluginConfig, message) {
+async function steerConversationTurn(deps, ctx, message) {
 	const authority = await resolvePreparedCodexCommandAuthority(deps, ctx);
 	const { target, binding } = authority;
 	if (!target) return "Cannot steer Codex because this command did not include a stable binding identity.";
@@ -2375,10 +2206,7 @@ async function steerConversationTurn(deps, ctx, pluginConfig, message) {
 		identity: target.identity,
 		binding,
 		message,
-		pluginConfig,
-		agentDir: target.agentDir,
-		config: ctx.config,
-		assertCurrent: authority.assertCurrent
+		assertCurrent: authority.assertMutationCurrent
 	})).message;
 }
 async function setConversationModel(deps, ctx, pluginConfig, args) {
@@ -2410,7 +2238,8 @@ async function setConversationModel(deps, ctx, pluginConfig, args) {
 		config: ctx.config,
 		binding,
 		storePath: authority.storePath,
-		assertCurrent: authority.assertCurrent
+		assertCurrent: authority.assertCurrent,
+		assertCommitAllowed: authority.assertMutationCurrent
 	});
 }
 async function setConversationFastMode(deps, ctx, args) {
@@ -2426,7 +2255,7 @@ async function setConversationFastMode(deps, ctx, args) {
 		bindingStore: deps.bindingStore,
 		binding,
 		enabled: parsed,
-		assertCurrent: authority.assertCurrent
+		assertCurrent: parsed === void 0 ? authority.assertCurrent : authority.assertMutationCurrent
 	});
 }
 async function setConversationPermissions(deps, ctx, args) {
@@ -2442,7 +2271,7 @@ async function setConversationPermissions(deps, ctx, args) {
 		mode: parsed,
 		config: ctx.config,
 		storePath: authority.storePath,
-		assertCurrent: authority.assertHostCurrent,
+		assertCurrent: parsed ? authority.assertHostMutationCurrent : authority.assertHostCurrent,
 		session: {
 			agentId: target.agentId,
 			sessionId: ctx.sessionId,
@@ -2471,7 +2300,7 @@ async function startThreadAction(deps, ctx, pluginConfig, kind, args) {
 		}
 		const compactCurrent = ctx.runtimeContext?.compactCurrent;
 		if (!compactCurrent) return "Codex compaction is unavailable because this command is not bound to a session.";
-		authority.assertCurrent();
+		authority.assertMutationCurrent();
 		const result = await compactCurrent();
 		return result.compacted ? `Compacted Codex session (${result.tokensAfter ?? "unknown"} tokens after).` : `Codex compaction did not complete: ${formatCodexDisplayText(result.reason ?? "no reason returned")}.`;
 	}
@@ -2494,6 +2323,7 @@ async function startThreadAction(deps, ctx, pluginConfig, kind, args) {
 		sessionKey: authority.sessionKey,
 		storePath: authority.storePath,
 		assertCurrent: authority.assertCurrent,
+		assertOwnerCurrent: () => assertCodexHostOwnerCurrent(ctx),
 		...connection.usesSupervisionConnection ? {
 			startOptions: connection.appServer.start,
 			beforeRequest: supervisedCommandGuard(deps, target.identity, binding)
@@ -2569,7 +2399,11 @@ function formatCodexAvailablePlugins(plugins, warnings, query, page) {
 //#region extensions/codex/src/command-plugins-management.ts
 const POLICY_REFRESH_HINT = "Takes effect on your next message.";
 const AVAILABLE_USAGE = "Usage: /codex plugins available [query] [--page <positive integer>]. Search text must be at most 100 characters; use -- before literal query text that contains options.";
-async function handleCodexPluginsSubcommand(ctx, rest, io, runtime) {
+async function handleCodexPluginsSubcommand(input, rest, io, runtime) {
+	const ctx = {
+		...input,
+		gatewayClientScopes: input.gatewayClientScopes?.slice()
+	};
 	const [verb = "list", ...args] = rest;
 	const normalized = verb.toLowerCase();
 	if (normalized === "menu") {
@@ -2611,7 +2445,7 @@ async function handleCodexPluginsSubcommand(ctx, rest, io, runtime) {
 			});
 			return formatCodexAvailablePlugins(discovered.plugins, discovered.warnings, query, page);
 		} catch (error) {
-			return { text: `Could not list Codex plugins: ${formatCodexDisplayText(errorMessage(error))}` };
+			return { text: `Could not list Codex plugins: ${formatCodexDisplayText(coerceErrorMessage(error))}` };
 		}
 	}
 	if (normalized === "status") {
@@ -2635,7 +2469,7 @@ async function handleCodexPluginsSubcommand(ctx, rest, io, runtime) {
 		if (args.length !== 1 || !args[0]) return { text: "Usage: /codex plugins install <plugin>@<marketplace>" };
 		if (!canMutateCodexHost(ctx)) return { text: "Only an owner or operator.admin gateway client can run /codex plugins install." };
 		if (!runtime) return { text: "Codex plugin installation is unavailable for this command." };
-		return await installCodexPlugin(args[0], io, runtime);
+		return await installCodexPlugin(args[0], io, runtime, ctx);
 	}
 	const target = args[0];
 	if (normalized === "enable" || normalized === "disable") {
@@ -2653,6 +2487,7 @@ async function handleCodexPluginsSubcommand(ctx, rest, io, runtime) {
 		if (configured.status === "ambiguous" || configured.status === "mismatched") return { text: describeConfiguredPluginIdentityConflict(target, configured.status) };
 		if (configured.status === "missing") return { text: `Codex sub-plugin '${formatCodexDisplayText(target)}' is not configured. Run '/codex plugins list' to see configured plugins.` };
 		const configKey = configured.configKey;
+		assertCodexHostOwnerCurrent(ctx);
 		await io.mutate((block) => {
 			if (wantEnabled) block.enabled = true;
 			block.plugins ??= {};
@@ -2660,7 +2495,7 @@ async function handleCodexPluginsSubcommand(ctx, rest, io, runtime) {
 				...block.plugins[configKey],
 				enabled: wantEnabled
 			};
-		});
+		}, () => assertCodexHostOwnerCurrent(ctx));
 		return { text: `${formatCodexDisplayText(configKey)}: ${wantEnabled ? "enabled" : "disabled"} in openclaw.json. ${POLICY_REFRESH_HINT}` };
 	}
 	return { text: `Unknown /codex plugins subcommand: ${formatCodexDisplayText(verb)}\n\n${buildPluginsHelp()}` };
@@ -2766,7 +2601,7 @@ function buildPluginsHelp() {
 		"Only an owner or operator.admin can discover, inspect, refresh hosted apps, install, enable, or disable plugins."
 	].join("\n");
 }
-async function installCodexPlugin(requestedId, io, runtime) {
+async function installCodexPlugin(requestedId, io, runtime, ctx) {
 	const requested = parseCodexPluginMarketplaceId(requestedId);
 	if (!requested) return { text: "Invalid plugin identifier. Use /codex plugins install <plugin>@<marketplace>. Both names allow ASCII letters, digits, underscores, and hyphens. Plugin names may also contain dots between nonempty segments." };
 	let plugin;
@@ -2782,7 +2617,7 @@ async function installCodexPlugin(requestedId, io, runtime) {
 			if (!plugin) return { text: `Multiple available Codex plugins match '${formatCodexDisplayText(requestedId)}'; the marketplace identity must be unique.` };
 		} else plugin = matching[0];
 	} catch (error) {
-		return { text: `Could not verify the requested Codex plugin: ${formatCodexDisplayText(errorMessage(error))}` };
+		return { text: `Could not verify the requested Codex plugin: ${formatCodexDisplayText(coerceErrorMessage(error))}` };
 	}
 	if (!plugin) return { text: `${formatCodexDisplayText(requestedId)} was not found. Run /codex plugins available to inspect the current marketplaces.` };
 	if (!plugin.available) return { text: `${formatCodexDisplayText(requestedId)} is unavailable or disabled by its marketplace administrator.` };
@@ -2795,7 +2630,7 @@ async function installCodexPlugin(requestedId, io, runtime) {
 		const configured = resolveInstalledPluginKey((await io.readConfig()).plugins ?? {}, plugin);
 		if (configured.status === "ambiguous" || configured.status === "mismatched") return { text: describeConfiguredPluginIdentityConflict(requestedId, configured.status) };
 	} catch (error) {
-		return { text: `Could not verify existing Codex plugin authorization: ${formatCodexDisplayText(errorMessage(error))}` };
+		return { text: `Could not verify existing Codex plugin authorization: ${formatCodexDisplayText(coerceErrorMessage(error))}` };
 	}
 	let result;
 	if (!alreadyInstalled) {
@@ -2808,13 +2643,15 @@ async function installCodexPlugin(requestedId, io, runtime) {
 		} : void 0;
 		if (!requestParams) return { text: `${formatCodexDisplayText(requestedId)} cannot be installed because its marketplace did not provide a trusted local path or remote plugin identifier.` };
 		try {
+			assertCodexHostOwnerCurrent(ctx);
 			result = await runtime.install(requestParams);
 		} catch (error) {
-			return { text: `Could not install ${formatCodexDisplayText(requestedId)}: ${formatCodexDisplayText(errorMessage(error))}` };
+			return { text: `Could not install ${formatCodexDisplayText(requestedId)}: ${formatCodexDisplayText(coerceErrorMessage(error))}` };
 		}
 	}
 	const selectedPlugin = plugin;
 	try {
+		assertCodexHostOwnerCurrent(ctx);
 		await io.mutate((block) => {
 			block.plugins ??= {};
 			const configured = resolveInstalledPluginKey(block.plugins, selectedPlugin);
@@ -2831,15 +2668,15 @@ async function installCodexPlugin(requestedId, io, runtime) {
 				pluginName: existing?.pluginName ?? (curated ? selectedPlugin.pluginName : persistedPluginName(selectedPlugin))
 			};
 			block.plugins[configKey] = updated;
-		});
+		}, () => assertCodexHostOwnerCurrent(ctx));
 	} catch (error) {
-		return { text: `${formatCodexDisplayText(requestedId)} was installed in Codex but could not be authorized in OpenClaw and will not be exposed: ${formatCodexDisplayText(errorMessage(error))}` };
+		return { text: `${formatCodexDisplayText(requestedId)} was installed in Codex but could not be authorized in OpenClaw and will not be exposed: ${formatCodexDisplayText(coerceErrorMessage(error))}` };
 	}
 	let refreshWarning = "";
 	if (runtime.refresh) try {
 		refreshWarning = (await runtime.refresh(workspaceDir)).diagnostics.map((diagnostic) => ` ${formatCodexDisplayText(diagnostic.message)}`).join("");
 	} catch (error) {
-		refreshWarning = ` Runtime refresh requires a new conversation: ${formatCodexDisplayText(errorMessage(error))}`;
+		refreshWarning = ` Runtime refresh requires a new conversation: ${formatCodexDisplayText(coerceErrorMessage(error))}`;
 	}
 	const appsNeedingAuth = result?.appsNeedingAuth ?? [];
 	if (appsNeedingAuth.length > 0) {
@@ -2871,22 +2708,7 @@ async function installCodexPlugin(requestedId, io, runtime) {
 					type: "text",
 					text: `Some app setup permissions could not be confirmed. Run /codex plugins status ${requestedId} to check the current account and restrictions.`
 				}] : [],
-				{
-					type: "buttons",
-					buttons: [...appLinks.length > 0 ? [{
-						label: "Refresh hosted apps",
-						action: {
-							type: "command",
-							command: "/codex plugins refresh"
-						}
-					}] : [], {
-						label: "Check status",
-						action: {
-							type: "command",
-							command: `/codex plugins status ${requestedId}`
-						}
-					}]
-				},
+				buildCodexPluginStatusButtons(requestedId, appLinks.length > 0),
 				{
 					type: "context",
 					text: `${refreshWarning.trim()} ${POLICY_REFRESH_HINT}`.trim()
@@ -2902,9 +2724,6 @@ async function installCodexPlugin(requestedId, io, runtime) {
 	const status = alreadyInstalled ? "bundle was already installed in Codex" : "bundle was installed in Codex";
 	return { text: `${formatCodexDisplayText(requestedId)} ${status}. OpenClaw app access is configured.${refreshWarning} ${POLICY_REFRESH_HINT}` };
 }
-function errorMessage(error) {
-	return error instanceof Error ? error.message : String(error);
-}
 function formatPluginList(plugins, options = {}) {
 	const globalEnabled = options.globalEnabled === true;
 	const keys = Object.keys(plugins).toSorted();
@@ -2935,7 +2754,11 @@ function formatPluginList(plugins, options = {}) {
 //#region extensions/codex/src/command-plugins-runtime.ts
 const SCOPE_CHANGED_MESSAGE = "Codex account, conversation, or plugin policy changed. Run the command again.";
 async function withCodexPluginCommandContext(params, run) {
-	const { deps, ctx, pluginConfig } = params;
+	const { deps, pluginConfig } = params;
+	const ctx = {
+		...params.ctx,
+		gatewayClientScopes: params.ctx.gatewayClientScopes?.slice()
+	};
 	const current = await deps.codexPluginsManagementIo?.readConfig() ?? {};
 	const initialPolicy = JSON.stringify(current);
 	const { scope, target, binding } = await resolveCommandAppServerContext(deps, ctx, pluginConfig);
@@ -3016,7 +2839,10 @@ async function withCodexPluginCommandContext(params, run) {
 					const response = await request({
 						method,
 						requestParams,
-						assertCurrent
+						assertCurrent: () => {
+							assertCurrent();
+							assertCodexHostOwnerCurrent(ctx);
+						}
 					});
 					await validateCurrent();
 					return response;
@@ -3065,6 +2891,17 @@ async function handleCodexSubcommand(ctx, options) {
 	if (CODEX_NATIVE_CONTROL_SUBCOMMANDS.has(normalized) && !returnsBeforeNativeCodexExecution(normalized, rest) && !isReadOnlyCodexGoalCommand(normalized, rest) && !canMutateCodexHost(ctx)) return { text: CODEX_NATIVE_EXECUTION_AUTH_ERROR };
 	const sandboxBlock = resolveCodexNativeCommandSandboxBlock(ctx, normalized, rest);
 	if (sandboxBlock) return { text: sandboxBlock };
+	const usageCommand = normalized === "unbind" ? "detach" : normalized;
+	if (rest.length > 0 && [
+		"status",
+		"models",
+		"detach",
+		"binding",
+		"stop",
+		"mcp",
+		"skills",
+		"account"
+	].includes(usageCommand)) return { text: `Usage: /codex ${usageCommand}` };
 	if (normalized === "plugins") {
 		if (rest[0]?.toLowerCase() === "refresh") {
 			if (rest.length !== 1) return { text: "Usage: /codex plugins refresh — refresh hosted app inventory for the current Codex account/runtime." };
@@ -3099,7 +2936,8 @@ async function handleCodexSubcommand(ctx, options) {
 				const scope = await getAppServerScope();
 				return await deps.codexControlRequest(options.pluginConfig, CODEX_CONTROL_METHODS.installPlugin, requestParams, {
 					...scope,
-					config: ctx.config
+					config: ctx.config,
+					assertOwnerCurrent: () => assertCodexHostOwnerCurrent(ctx)
 				});
 			},
 			refresh: async (workspaceDir) => {
@@ -3132,7 +2970,6 @@ async function handleCodexSubcommand(ctx, options) {
 						appServerVersion: client.getServerVersion(),
 						runtimeIdentity: client.getRuntimeIdentity()
 					});
-					defaultCodexPluginMetadataCache.invalidate(appCacheKey);
 					return await refreshCodexPluginRuntimeState({
 						configCwd: workspaceDir,
 						appCache: defaultCodexAppInventoryCache,
@@ -3153,12 +2990,10 @@ async function handleCodexSubcommand(ctx, options) {
 		});
 	}
 	if (normalized === "status") {
-		if (rest.length > 0) return { text: "Usage: /codex status" };
 		const { agentDir } = resolveCodexConversationControlScope(ctx);
 		return { text: formatCodexStatus(await deps.readCodexStatusProbes(options.pluginConfig, ctx.config, agentDir)) };
 	}
 	if (normalized === "models") {
-		if (rest.length > 0) return { text: "Usage: /codex models" };
 		const { agentDir } = resolveCodexConversationControlScope(ctx);
 		return { text: formatModels(await deps.listCodexAppServerModels(deps.requestOptions(options.pluginConfig, 100, ctx.config, agentDir))) };
 	}
@@ -3167,19 +3002,10 @@ async function handleCodexSubcommand(ctx, options) {
 	if (normalized === "sessions") return { text: await buildCodexCliSessions(deps, rest) };
 	if (normalized === "resume") return { text: await resumeThread(deps, ctx, options.pluginConfig, rest) };
 	if (normalized === "bind") return await bindConversation(deps, ctx, options.pluginConfig, rest);
-	if (normalized === "detach" || normalized === "unbind") {
-		if (rest.length > 0) return { text: "Usage: /codex detach" };
-		return { text: await detachConversation(deps, ctx) };
-	}
-	if (normalized === "binding") {
-		if (rest.length > 0) return { text: "Usage: /codex binding" };
-		return { text: await describeConversationBinding(deps, ctx) };
-	}
-	if (normalized === "stop") {
-		if (rest.length > 0) return { text: "Usage: /codex stop" };
-		return { text: await stopConversationTurn(deps, ctx, options.pluginConfig) };
-	}
-	if (normalized === "steer") return { text: await steerConversationTurn(deps, ctx, options.pluginConfig, rest.join(" ")) };
+	if (normalized === "detach" || normalized === "unbind") return { text: await detachConversation(deps, ctx) };
+	if (normalized === "binding") return { text: await describeConversationBinding(deps, ctx) };
+	if (normalized === "stop") return { text: await stopConversationTurn(deps, ctx) };
+	if (normalized === "steer") return { text: await steerConversationTurn(deps, ctx, rest.join(" ")) };
 	if (normalized === "model") return { text: await setConversationModel(deps, ctx, options.pluginConfig, rest) };
 	if (normalized === "fast") {
 		if (isMenuVerb(rest)) return buildCodexFastMenuReply();
@@ -3189,31 +3015,21 @@ async function handleCodexSubcommand(ctx, options) {
 		if (isMenuVerb(rest)) return buildCodexPermissionsMenuReply();
 		return { text: await setConversationPermissions(deps, ctx, rest) };
 	}
-	if (normalized === "compact") return { text: await startThreadAction(deps, ctx, options.pluginConfig, "compact", rest) };
-	if (normalized === "review") return { text: await startThreadAction(deps, ctx, options.pluginConfig, "review", rest) };
+	if (normalized === "compact" || normalized === "review") return { text: await startThreadAction(deps, ctx, options.pluginConfig, normalized, rest) };
 	if (normalized === "diagnostics") return await handleCodexDiagnosticsFeedback(deps, ctx, options.pluginConfig, rest.join(" "), "/codex diagnostics");
 	if (normalized === "computer-use" || normalized === "computeruse") {
 		if (isMenuVerb(rest)) return buildCodexComputerUseMenuReply();
 		return { text: await handleComputerUseCommand(deps, ctx, options.pluginConfig, rest) };
 	}
-	if (normalized === "mcp") {
-		if (rest.length > 0) return { text: "Usage: /codex mcp" };
+	if (normalized === "mcp" || normalized === "skills") {
 		const scope = await resolveCommandAppServerScope(deps, ctx, options.pluginConfig);
-		return { text: formatList(await deps.codexControlRequest(options.pluginConfig, CODEX_CONTROL_METHODS.listMcpServers, { limit: 100 }, {
+		const response = await deps.codexControlRequest(options.pluginConfig, normalized === "mcp" ? CODEX_CONTROL_METHODS.listMcpServers : CODEX_CONTROL_METHODS.listSkills, normalized === "mcp" ? { limit: 100 } : {}, {
 			config: ctx.config,
 			...scope
-		}), "MCP servers") };
-	}
-	if (normalized === "skills") {
-		if (rest.length > 0) return { text: "Usage: /codex skills" };
-		const scope = await resolveCommandAppServerScope(deps, ctx, options.pluginConfig);
-		return { text: formatSkills(await deps.codexControlRequest(options.pluginConfig, CODEX_CONTROL_METHODS.listSkills, {}, {
-			config: ctx.config,
-			...scope
-		})) };
+		});
+		return { text: normalized === "mcp" ? formatList(response, "MCP servers") : formatSkills(response) };
 	}
 	if (normalized === "account") {
-		if (rest.length > 0) return { text: "Usage: /codex account" };
 		const scope = await resolveCommandAppServerScope(deps, ctx, options.pluginConfig);
 		const requestScope = {
 			config: ctx.config,
@@ -3223,6 +3039,7 @@ async function handleCodexSubcommand(ctx, options) {
 		return { text: formatAccount(account, limits, await readCodexAccountAuthOverview({
 			ctx,
 			agentDir: scope.agentDir,
+			authProfileId: scope.authProfileId,
 			pluginConfig: options.pluginConfig,
 			safeCodexControlRequest: deps.safeCodexControlRequest,
 			account,
@@ -3234,11 +3051,7 @@ async function handleCodexSubcommand(ctx, options) {
 function resolvePluginRuntimeRefreshMethod(method) {
 	const recognized = [
 		CODEX_CONTROL_METHODS.listPlugins,
-		CODEX_CONTROL_METHODS.listSkills,
-		CODEX_CONTROL_METHODS.listHooks,
-		CODEX_CONTROL_METHODS.reloadMcpServers,
 		CODEX_CONTROL_METHODS.installedApps,
-		CODEX_CONTROL_METHODS.listApps,
 		CODEX_CONTROL_METHODS.readApps
 	].find((candidate) => candidate === method);
 	if (!recognized) throw new Error(`Unexpected Codex plugin refresh method: ${method}`);