@openclaw/codex 2026.9.6 → 2026.9.7

package/dist/.setup/{auth-cache-key-B2mpaI9D.mjs → auth-cache-key-Dbvq-QgB.mjs}

@@ -1,11 +1,12 @@
-import { n as defineCodexBuildState } from "./build-state-C7EnDVgr.mjs";
-import { u as resolveMacOSDesktopCodexAppPathCandidates } from "./managed-binary-BnshlFag.mjs";
-import { n as resolveCodexAppServerSpawnEnv } from "./transport-stdio-h2VHOskC.mjs";
+import { n as defineCodexBuildState } from "./build-state-Da1_z0kd.mjs";
+import { u as resolveMacOSDesktopCodexAppPathCandidates } from "./managed-binary-kiWRhNRE.mjs";
+import { n as resolveCodexAppServerSpawnEnv } from "./transport-stdio-Bdegpn2V.mjs";
 import { createHash } from "node:crypto";
 import fs, { constants, existsSync, watch } from "node:fs";
 import path from "node:path";
 import os from "node:os";
 import fs$1 from "node:fs/promises";
+import { extractErrorCode } from "openclaw/plugin-sdk/error-runtime";
 import { sha256File } from "openclaw/plugin-sdk/file-access-runtime";
 import { readSecretFile } from "openclaw/plugin-sdk/secret-file";
 //#region extensions/codex/src/app-server/desktop-generation-fingerprint.ts
@@ -13,12 +14,14 @@ const MAX_COMPUTER_USE_PLUGIN_TREE_ENTRIES = 4096;
 /** Fingerprints every desktop candidate that can own a managed fallback artifact. */
 async function readMacOSDesktopGenerationFingerprint(candidates = resolveMacOSDesktopCodexAppPathCandidates("darwin")) {
 	const entries = [];
+	const bundles = /* @__PURE__ */ new Set();
 	for (const candidate of candidates) {
 		const command = await statFingerprint(candidate.appServerCommandPath);
 		entries.push(`candidate:${candidate.appName}:${candidate.appServerCommandPath}:${command}`);
+		if (bundles.has(candidate.appBundlePath)) continue;
+		bundles.add(candidate.appBundlePath);
 		for (const artifactPath of resolveMacOSDesktopGenerationPaths(candidate)) entries.push(`${artifactPath}\0${await statFingerprint(artifactPath)}`);
-		const pluginRoot = resolveComputerUsePluginRoot(candidate);
-		entries.push(`${pluginRoot}\0${await directoryTreeFingerprint(pluginRoot)}`);
+		for (const pluginRoot of resolveComputerUseArtifactRoots(candidate)) entries.push(`${pluginRoot}\0${await readCodexDesktopArtifactTreeFingerprint(pluginRoot)}`);
 	}
 	return createHash("sha256").update(entries.join("\0")).digest("hex");
 }
@@ -26,6 +29,8 @@ function resolveMacOSDesktopGenerationPaths(candidate) {
 	return [
 		candidate.appBundlePath,
 		path.join(candidate.bundledMarketplacePath, ".agents", "plugins", "marketplace.json"),
+		path.join(candidate.appBundlePath, "Contents", "Resources", "cua_node", "bin", "node"),
+		path.join(candidate.appBundlePath, "Contents", "Resources", "cua_node", "bin", "node_repl"),
 		...candidate.computerUseServiceAppPaths.flatMap((servicePath) => [
 			servicePath,
 			path.join(servicePath, "Contents", "Info.plist"),
@@ -33,8 +38,15 @@ function resolveMacOSDesktopGenerationPaths(candidate) {
 		])
 	];
 }
-function resolveComputerUsePluginRoot(candidate) {
-	return path.join(candidate.bundledMarketplacePath, "plugins", "computer-use");
+function resolveComputerUseArtifactRoots(candidate) {
+	const modules = path.join(candidate.appBundlePath, "Contents", "Resources", "cua_node", "lib", "node_modules", "@oai");
+	return [
+		path.join(candidate.bundledMarketplacePath, "plugins", "computer-use"),
+		path.join(candidate.bundledMarketplacePath, "plugins", "unified-computer-use"),
+		path.join(modules, "cua-repl"),
+		path.join(modules, "cua"),
+		path.join(modules, "sky", "dist")
+	];
 }
 /** Stable roots that cover bundle replacement and recursive artifact updates. */
 function resolveMacOSDesktopGenerationWatchPaths(candidates = resolveMacOSDesktopCodexAppPathCandidates("darwin")) {
@@ -42,12 +54,13 @@ function resolveMacOSDesktopGenerationWatchPaths(candidates = resolveMacOSDeskto
 	for (const candidate of candidates) watched.add(candidate.appBundlePath);
 	return [...watched];
 }
-async function directoryTreeFingerprint(root) {
+async function readCodexDesktopArtifactTreeFingerprint(root) {
 	let rootStat;
 	try {
 		rootStat = await fs$1.lstat(root, { bigint: true });
 	} catch (error) {
-		if (isNodeError(error, "ENOENT") || isNodeError(error, "ENOTDIR")) return "missing";
+		const code = extractErrorCode(error);
+		if (code === "ENOENT" || code === "ENOTDIR") return "missing";
 		throw error;
 	}
 	if (!rootStat.isDirectory()) return statFingerprint(root);
@@ -85,7 +98,8 @@ async function statFingerprint(filePath) {
 		const content = target.isFile() ? await readFileFingerprint(filePath, target, true) : "";
 		return `${type}:${own}:${link}:${realPath}:${statTuple(target)}:${content}`;
 	} catch (error) {
-		if (isNodeError(error, "ENOENT") || isNodeError(error, "ENOTDIR")) return "missing";
+		const code = extractErrorCode(error);
+		if (code === "ENOENT" || code === "ENOTDIR") return "missing";
 		throw error;
 	}
 }
@@ -116,9 +130,6 @@ function statTuple(stat) {
 		stat.ctimeNs
 	].join(":");
 }
-function isNodeError(error, code) {
-	return Boolean(error && typeof error === "object" && "code" in error && error.code === code);
-}
 //#endregion
 //#region extensions/codex/src/app-server/desktop-generation-owner.ts
 const SETTLE_DELAY_MS = 1e3;
@@ -204,12 +215,9 @@ function createCodexDesktopGenerationService(params, runtime = {
 			if (runtime.platform !== "darwin") return;
 			const current = state();
 			current.context = ctx;
-			current.readFingerprint = runtime.readFingerprint;
-			current.resolveWatchPaths = runtime.resolveWatchPaths;
-			current.pathExists = runtime.pathExists;
-			current.watchPath = runtime.watchPath;
+			current.runtime = { ...runtime };
 			current.owner = createCodexDesktopGenerationOwner({
-				readFingerprint: current.readFingerprint,
+				readFingerprint: runtime.readFingerprint,
 				onGenerationChange: params.onGenerationChange,
 				initialGeneration: current.lastGeneration
 			});
@@ -223,10 +231,7 @@ function createCodexDesktopGenerationService(params, runtime = {
 			current.owner = void 0;
 			current.armEpoch = (current.armEpoch ?? 0) + 1;
 			current.context = void 0;
-			current.readFingerprint = void 0;
-			current.resolveWatchPaths = void 0;
-			current.pathExists = void 0;
-			current.watchPath = void 0;
+			current.runtime = void 0;
 			current.watchHealthy = void 0;
 			current.rearmDelayMs = void 0;
 			if (current.rearmTimer) {
@@ -246,10 +251,10 @@ function armWatchers(current) {
 	current.watchers = watchers;
 	const candidateNames = new Set(resolveMacOSDesktopCodexAppPathCandidates("darwin").map((candidate) => candidate.appName));
 	let complete = true;
-	for (const watchedPath of current.resolveWatchPaths?.() ?? []) {
-		if (!current.pathExists?.(watchedPath)) continue;
+	for (const watchedPath of current.runtime?.resolveWatchPaths() ?? []) {
+		if (!current.runtime?.pathExists(watchedPath)) continue;
 		try {
-			const watcher = current.watchPath?.(watchedPath, { recursive: watchedPath !== APPLICATIONS_PATH }, (_eventType, filename) => {
+			const watcher = current.runtime?.watchPath(watchedPath, { recursive: watchedPath !== APPLICATIONS_PATH }, (_eventType, filename) => {
 				if (!isCurrentArm(current, owner, watchers, armEpoch)) return;
 				if (watchedPath === APPLICATIONS_PATH && filename && !candidateNames.has(filename.toString().split(path.sep)[0] ?? "")) return;
 				owner.markDirty();
@@ -304,17 +309,14 @@ function scheduleRearm(current, owner) {
 	}, delayMs);
 	current.rearmTimer.unref();
 }
-function logRefreshFailure(current, owner) {
-	return (error) => {
-		if (current.owner !== owner) return;
-		current.context?.serviceHealth?.reportFailure(error);
-		current.context?.logger.warn(`codex desktop generation refresh failed: ${String(error)}`);
-	};
-}
 function refreshGeneration(current, owner, refresh) {
 	refresh.then(() => {
 		if (current.owner === owner && current.watchHealthy) current.context?.serviceHealth?.clearFailure();
-	}).catch(logRefreshFailure(current, owner));
+	}).catch((error) => {
+		if (current.owner !== owner) return;
+		current.context?.serviceHealth?.reportFailure(error);
+		current.context?.logger.warn(`codex desktop generation refresh failed: ${String(error)}`);
+	});
 }
 function closeWatchers(current) {
 	const watchers = current.watchers;
@@ -423,4 +425,4 @@ function readFirstNonEmptyEnvEntry(env, keys) {
 	}
 }
 //#endregion
-export { readCodexCliAuthFileApiKey as a, resolveCodexAppServerPreparedApiKeyCacheKey as c, waitForCodexDesktopGeneration as d, fingerprintTokenAuthProfileCacheKey as i, createCodexDesktopGenerationService as l, CODEX_AUTH_JSON_FILENAME as n, readFirstNonEmptyEnv as o, fingerprintApiKeyAuthProfileCacheKey as r, resolveCodexAppServerFallbackApiKeyCacheKey as s, CODEX_APP_SERVER_API_KEY_ENV_VARS as t, isCodexDesktopGenerationCurrent as u };
+export { readCodexCliAuthFileApiKey as a, resolveCodexAppServerPreparedApiKeyCacheKey as c, waitForCodexDesktopGeneration as d, readCodexDesktopArtifactTreeFingerprint as f, fingerprintTokenAuthProfileCacheKey as i, createCodexDesktopGenerationService as l, CODEX_AUTH_JSON_FILENAME as n, readFirstNonEmptyEnv as o, fingerprintApiKeyAuthProfileCacheKey as r, resolveCodexAppServerFallbackApiKeyCacheKey as s, CODEX_APP_SERVER_API_KEY_ENV_VARS as t, isCodexDesktopGenerationCurrent as u };

package/dist/.setup/{auth-profile-WqZtZfXN.mjs → auth-profile-B0okYl2D.mjs}

@@ -10,7 +10,6 @@ const { resolveCodexAppServerAuthProfileId, resolveCodexAppServerAuthProfileIdFo
 	ensureAuthProfileStore,
 	resolveAuthProfileOrder
 });
-/** Returns true when an auth profile uses native Codex/OpenAI app-server auth. */
 function isCodexAppServerNativeAuthProfile(lookup) {
 	const authProfileId = lookup.authProfileId?.trim();
 	if (!authProfileId) return false;
@@ -21,7 +20,7 @@ function isCodexAppServerNativeAuthProfile(lookup) {
 			externalCliProviderIds: [CODEX_APP_SERVER_NATIVE_AUTH_PROVIDER],
 			externalCliProfileIds: [authProfileId]
 		})).profiles[authProfileId];
-		if (!credential || credential.type === "api_key") return false;
+		if (!credential || credential.type === "api_key" || credential.type === "oauth" && (credential.authFlow === "chatgpt-token-sharing" || credential.authFlow === "chatgpt-identity")) return false;
 		const provider = credential.provider?.trim();
 		return Boolean(provider && resolveProviderIdForAuth(provider, { config: lookup.config }) === CODEX_APP_SERVER_NATIVE_AUTH_PROVIDER);
 	} catch (error) {

package/dist/.setup/auth-start-options-BPIPeEX8.mjs

@@ -0,0 +1,44 @@
+import { r as normalizeCodexAppServerArgs } from "./launch-args-DbFCehO7.mjs";
+import { normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
+import path from "node:path";
+import { homedir } from "node:os";
+//#region extensions/codex/src/app-server/auth-start-options.ts
+const CODEX_APP_SERVER_HOME_DIRNAME = "codex-home";
+const CODEX_EPHEMERAL_AUTH_STORE_OVERRIDE = "cli_auth_credentials_store=\"ephemeral\"";
+function resolveCodexAppServerHomeDir(agentDir) {
+	if (!agentDir) throw new Error("Agent-scoped Codex requires an OpenClaw agent directory");
+	return path.join(path.resolve(agentDir), CODEX_APP_SERVER_HOME_DIRNAME);
+}
+/** Resolves the native user Codex home used by Desktop and the CLI. */
+function resolveCodexAppServerUserHomeDir(env = process.env, homedir$1 = homedir) {
+	const configured = normalizeOptionalString(env.CODEX_HOME);
+	return path.resolve(configured ?? path.join(homedir$1(), ".codex"));
+}
+/** Resolves the local CODEX_HOME used when starting one app-server connection. */
+function resolveCodexAppServerLocalHomeDir(startOptions, agentDir, env = process.env) {
+	if (startOptions.codexHome) return startOptions.codexHome;
+	const configured = startOptions.env?.CODEX_HOME;
+	if (configured?.trim()) return configured;
+	return startOptions.homeScope === "user" ? resolveCodexAppServerUserHomeDir(env) : resolveCodexAppServerHomeDir(agentDir);
+}
+/** Forces OpenClaw-owned Codex auth to remain process-local. */
+function withEphemeralCodexAuthStore(params) {
+	const { startOptions } = params;
+	if (!params.preparedAuth && params.authProfileId === null) return startOptions;
+	const args = normalizeCodexAppServerArgs(startOptions.args, CODEX_EPHEMERAL_AUTH_STORE_OVERRIDE);
+	return args === startOptions.args ? startOptions : {
+		...startOptions,
+		args
+	};
+}
+function withClearedEnvironmentVariables(startOptions, envVars) {
+	const clearEnv = startOptions.clearEnv ?? [];
+	const missingEnvVars = envVars.filter((envVar) => !clearEnv.includes(envVar));
+	if (missingEnvVars.length === 0) return startOptions;
+	return {
+		...startOptions,
+		clearEnv: [...clearEnv, ...missingEnvVars]
+	};
+}
+//#endregion
+export { withEphemeralCodexAuthStore as a, withClearedEnvironmentVariables as i, resolveCodexAppServerLocalHomeDir as n, resolveCodexAppServerUserHomeDir as r, resolveCodexAppServerHomeDir as t };

package/dist/.setup/{binding-connection-ThoatDcb.mjs → binding-connection-DTtN1KrX.mjs}

@@ -1,4 +1,4 @@
-import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.mjs";
+import { t as __exportAll } from "./session-binding-sidecars-jo6H8dFr.mjs";
 import { AgentHarnessPreflightError } from "openclaw/plugin-sdk/agent-harness-registration";
 import { createPluginRuntimeStore } from "openclaw/plugin-sdk/runtime-store";
 //#region extensions/codex/src/app-server/binding-connection.ts
@@ -44,7 +44,7 @@ function requireCodexSupervisionModelSelection(binding) {
 }
 /** Registration publishes the resolver; connection policy loads only for an actual request. */
 async function resolveCodexBindingAppServerConnection(params) {
-	return (await import("./binding-connection.runtime-yoHrABt-.mjs")).resolveCodexBindingAppServerConnection(params, catalogHomes.tryGetRuntime());
+	return (await import("./binding-connection.runtime-6TpgD1M6.mjs")).resolveCodexBindingAppServerConnection(params, catalogHomes.tryGetRuntime());
 }
 //#endregion
 export { setCodexCatalogConnectionHomeResolver as a, resolveCodexBindingAppServerConnection as i, binding_connection_exports as n, requireCodexSupervisionModelSelection as r, assertCodexSessionRuntimeOwnership as t };

package/dist/.setup/{binding-connection.runtime-yoHrABt-.mjs → binding-connection.runtime-6TpgD1M6.mjs}

@@ -1,7 +1,7 @@
-import { f as resolveCodexAppServerLocalHomeDir } from "./config-security-BEReZ6go.mjs";
-import { d as readCodexPluginConfig } from "./config-parsing-CcB9iPoq.mjs";
-import { t as buildCodexAppServerConnectionFingerprint } from "./plugin-app-cache-key-B2CsSdnV.mjs";
-import { n as resolveCodexAppServerRuntimeOptions, r as resolveCodexSupervisionAppServerRuntimeOptions } from "./config-runtime-C8Rw1m1m.mjs";
+import { d as readCodexPluginConfig } from "./config-parsing-b088LyhT.mjs";
+import { n as resolveCodexAppServerLocalHomeDir } from "./auth-start-options-BPIPeEX8.mjs";
+import { t as buildCodexAppServerConnectionFingerprint } from "./plugin-app-cache-key-BL9B5H0L.mjs";
+import { n as resolveCodexAppServerRuntimeOptions, r as resolveCodexSupervisionAppServerRuntimeOptions } from "./config-runtime-C0NbLms1.mjs";
 //#region extensions/codex/src/app-server/binding-connection.runtime.ts
 /** Resolves connection and auth ownership exclusively from the private thread binding. */
 async function resolveCodexBindingAppServerConnection(params, discoverHomes) {

package/dist/.setup/{bounded-turn-B2HScEgT.mjs → bounded-turn-CbjoN2OW.mjs}

@@ -1,16 +1,16 @@
-import { a as resolveCodexPrivateLauncher, i as readCodexAppServerConfigOptions } from "./launch-args-DbFCehO7.mjs";
 import { i as isJsonObject } from "./protocol-CANUwXJ3.mjs";
-import { d as readCodexEffectiveConfig } from "./config-options-BvaRs51b.mjs";
-import "./config-BoTP_mrL.mjs";
-import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-C8Rw1m1m.mjs";
-import { u as isCodexAppServerStartSelectionChangedError } from "./shared-client-DA4VR4Eb.mjs";
-import { E as createCodexElicitationResponse, S as assertCodexTurnStartResponse, w as readCodexErrorNotification, x as assertCodexThreadStartResponse } from "./client-Cs08OXVQ.mjs";
-import { o as closeCodexStartupClientBestEffort, s as interruptCodexTurnAndWaitBestEffort, t as CODEX_APP_SERVER_INTERRUPT_TIMEOUT_MS } from "./attempt-client-cleanup-CEv1cKwF.mjs";
-import { t as CodexEphemeralTurn } from "./ephemeral-turn-poidXgek.mjs";
-import { r as readModelListResult } from "./models-KnqBv0hE.mjs";
-import { L as attestCodexRestrictedToolSurfaceMcpServersDisabled, l as readCodexInheritedMcpServerNames, n as buildCodexRingZeroThreadConfigPatch, r as buildCodexRuntimeThreadConfig, t as assertCodexManagedRequirementsDoNotOverrideToolPolicy, xt as mergeCodexThreadConfigs } from "./thread-requests-BLvGkP2R.mjs";
-import { M as resolveCodexAppServerReasoningEffort } from "./thread-lifecycle-B3mfz1TG.mjs";
-import { a as resolveCodexPromptError } from "./usage-limit-error-DUMbefVY.mjs";
+import { a as resolveCodexPrivateLauncher, i as readCodexAppServerConfigOptions } from "./launch-args-DbFCehO7.mjs";
+import { d as readCodexEffectiveConfig } from "./config-options-CzyWLTJt.mjs";
+import "./config-DKhXquav.mjs";
+import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-C0NbLms1.mjs";
+import { u as isCodexAppServerStartSelectionChangedError } from "./shared-client-DqyTMYug.mjs";
+import { S as assertCodexTurnStartResponse, T as readCodexErrorNotification, k as createCodexElicitationResponse, x as assertCodexThreadStartResponse } from "./client-N0JpgSzF.mjs";
+import { o as closeCodexStartupClientBestEffort, s as interruptCodexTurnAndWaitBestEffort, t as CODEX_APP_SERVER_INTERRUPT_TIMEOUT_MS } from "./attempt-client-cleanup-DOP-cW5j.mjs";
+import { t as CodexEphemeralTurn } from "./ephemeral-turn-CDsPJOa2.mjs";
+import { i as readModelListResult } from "./models-DHXZtVVk.mjs";
+import { R as attestCodexRestrictedToolSurfaceMcpServersDisabled, St as mergeCodexThreadConfigs, l as readCodexInheritedMcpServerNames, n as buildCodexRingZeroThreadConfigPatch, r as buildCodexRuntimeThreadConfig, t as assertCodexManagedRequirementsDoNotOverrideToolPolicy } from "./thread-requests-B_bRnMGN.mjs";
+import { S as resolveCodexAppServerReasoningEffort } from "./thread-lifecycle-DPflntEJ.mjs";
+import { a as resolveCodexPromptError } from "./usage-limit-error-QXerDo3i.mjs";
 import { resolveTimerTimeoutMs } from "openclaw/plugin-sdk/number-runtime";
 import { parse } from "smol-toml";
 import path from "node:path";
@@ -144,7 +144,7 @@ async function runBoundedCodexAppServerTurnInWorkspace(params, appServer, worksp
 		assertCurrent: params.assertCurrent,
 		...params.signal ? { abandonSignal: params.signal } : {}
 	};
-	const client = params.options.clientFactory ? await params.options.clientFactory(clientOptions) : await import("./shared-client-DA4VR4Eb.mjs").then((n) => n.y).then(({ createIsolatedCodexAppServerClient }) => createIsolatedCodexAppServerClient({
+	const client = params.options.clientFactory ? await params.options.clientFactory(clientOptions) : await import("./shared-client-DqyTMYug.mjs").then((n) => n.v).then(({ createIsolatedCodexAppServerClient }) => createIsolatedCodexAppServerClient({
 		...clientOptions,
 		authProfileStore: params.authProfileStore
 	}));
@@ -171,7 +171,6 @@ async function runBoundedCodexAppServerTurnInWorkspace(params, appServer, worksp
 	if (remainingRunMs <= 0) abortRun(timeoutError);
 	const timeout = setTimeout(() => abortRun(timeoutError), Math.max(1, remainingRunMs));
 	timeout.unref?.();
-	let retrySelection = false;
 	const requestOptions = {
 		timeoutMs,
 		signal: abortController.signal,
@@ -272,19 +271,17 @@ async function runBoundedCodexAppServerTurnInWorkspace(params, appServer, worksp
 		}
 	} catch (error) {
 		if (abortController.signal.aborted) throw resolveCodexBoundedTurnAbortError(abortController.signal, params.taskLabel, timeoutError);
-		if (ownsClient && isCodexAppServerStartSelectionChangedError(error) && selectionAttempt === 0) retrySelection = true;
-		else throw error;
+		if (!ownsClient || !isCodexAppServerStartSelectionChangedError(error) || selectionAttempt !== 0) throw error;
 	} finally {
 		clearTimeout(timeout);
 		params.signal?.removeEventListener("abort", abortFromCaller);
 		await interruptPromise;
 		if (ownsClient) await closeCodexStartupClientBestEffort(client);
 	}
-	if (retrySelection) return await runBoundedCodexAppServerTurnInWorkspace(params, appServer, workspace, selectionAttempt + 1, {
+	return await runBoundedCodexAppServerTurnInWorkspace(params, appServer, workspace, selectionAttempt + 1, {
 		deadline,
 		timeoutMs: totalTimeoutMs
 	});
-	throw new Error("Codex bounded turn selection retry exited unexpectedly");
 }
 function resolveBoundedThreadConfig(params, workspace, inheritedMcpServerNames, enableManagedHooks) {
 	const boundedConfig = mergeCodexThreadConfigs(CODEX_BOUNDED_THREAD_CONFIG, params.threadConfig) ?? CODEX_BOUNDED_THREAD_CONFIG;

package/dist/.setup/bounded-turn-isolation-B8K_ylqk.mjs

@@ -0,0 +1,14 @@
+import { d as readCodexPluginConfig } from "./config-parsing-b088LyhT.mjs";
+import { n as isCodexAppServerProxyLaunch } from "./launch-args-DbFCehO7.mjs";
+import { i as resolveCodexAppServerHomeScope } from "./config-options-CzyWLTJt.mjs";
+import "./config-DKhXquav.mjs";
+import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-C0NbLms1.mjs";
+//#region extensions/codex/src/app-server/bounded-turn-isolation.ts
+function resolveCodexBoundedTurnIsolation(options) {
+	const pluginConfig = readCodexPluginConfig(options.pluginConfig);
+	const homeScope = resolveCodexAppServerHomeScope({ appServer: pluginConfig.appServer });
+	const { start } = resolveCodexAppServerRuntimeOptions({ pluginConfig: options.pluginConfig });
+	return start.transport === "stdio" && (homeScope === "agent" || options.requireIsolatedAuth === true) && !isCodexAppServerProxyLaunch(start.args) ? "private-stdio" : "configured-transport";
+}
+//#endregion
+export { resolveCodexBoundedTurnIsolation as t };

package/dist/.setup/{build-state-C7EnDVgr.mjs → build-state-Da1_z0kd.mjs}

@@ -1,5 +1,5 @@
 //#region extensions/codex/package.json
-var version = "2026.9.6";
+var version = "2026.9.7";
 //#endregion
 //#region extensions/codex/src/build-state.ts
 /**

package/dist/.setup/{capabilities-CDXOOFdZ.mjs → capabilities-B3WEZl4e.mjs}

@@ -1,9 +1,5 @@
-import { o as CodexAppServerRpcError } from "./timeout-C910MdAB.mjs";
+import { n as CodexAppServerRpcError } from "./rpc-error-BlD2vuzn.mjs";
 //#region extensions/codex/src/app-server/capabilities.ts
-/**
-* Capability helpers for optional Codex app-server control-plane methods.
-*/
-/** Known app-server methods used by OpenClaw control surfaces. */
 const CODEX_CONTROL_METHODS = {
 	account: "account/read",
 	installedApps: "app/installed",
@@ -31,13 +27,9 @@ const CODEX_CONTROL_METHODS = {
 	setThreadGoal: "thread/goal/set",
 	clearThreadGoal: "thread/goal/clear"
 };
-/** Formats unsupported control calls differently from ordinary RPC failures. */
 function describeControlFailure(error) {
-	if (isUnsupportedControlError(error)) return "unsupported by this Codex app-server";
+	if (error instanceof CodexAppServerRpcError && error.code === -32601) return "unsupported by this Codex app-server";
 	return error instanceof Error ? error.message : String(error);
 }
-function isUnsupportedControlError(error) {
-	return error instanceof CodexAppServerRpcError && error.code === -32601;
-}
 //#endregion
 export { describeControlFailure as n, CODEX_CONTROL_METHODS as t };