@openclaw/codex 2026.9.6 → 2026.9.7

package/dist/index.js

@@ -1,42 +1,44 @@
 import { registerCodexCliMetadata } from "./cli-metadata.js";
-import { n as createCodexAppServerNativeCompaction, t as createCodexAppServerAgentHarness } from "./.setup/harness-a_MsE4-_.mjs";
-import { d as readCurrentCodexNativeSubagentSubmissions, l as readCurrentCodexAppServerBinding, m as sessionBindingIdentity, n as assertCodexBindingMayBeReplaced, u as readCurrentCodexAppServerBindings } from "./.setup/session-binding-record-BGoz8wOK.mjs";
-import { n as defineCodexBuildState } from "./.setup/build-state-C7EnDVgr.mjs";
+import { j as CODEX_INTERACTIVE_THREAD_SOURCE_KINDS } from "./.setup/session-catalog-parsing-CPGaPYr-.mjs";
+import { i as isJsonObject } from "./.setup/protocol-CANUwXJ3.mjs";
+import { f as readCurrentCodexAppServerBinding, h as readCurrentNativePendingAssignments, m as readCurrentCodexNativeSubagentSubmissions, n as assertCodexBindingMayBeReplaced, p as readCurrentCodexAppServerBindings, v as sessionBindingIdentity } from "./.setup/session-binding-record-Oe9L-CNY.mjs";
+import { n as defineCodexBuildState } from "./.setup/build-state-Da1_z0kd.mjs";
+import { createCodexAppServerAgentHarness, createCodexAppServerNativeCompaction } from "./harness.js";
 import { buildCodexMediaUnderstandingProvider } from "./media-understanding-provider.js";
 import codexProviderDiscovery from "./provider-discovery.js";
 import { n as createCodexAuthProfileSelection } from "./.setup/auth-profile-selection-DFu9e167.mjs";
-import { t as assertCodexAppServerConnectionSecurity } from "./.setup/config-security-BEReZ6go.mjs";
-import { d as readCodexPluginConfig } from "./.setup/config-parsing-CcB9iPoq.mjs";
-import { K as CODEX_INTERACTIVE_THREAD_SOURCE_KINDS, U as CODEX_CATALOG_MAX_ROWS } from "./.setup/session-catalog-native-projection-DowriLid.mjs";
-import { i as isJsonObject } from "./.setup/protocol-CANUwXJ3.mjs";
-import { r as createCodexAppServerConfig, t as codexAppServerStartOptionsKey } from "./.setup/config-options-BvaRs51b.mjs";
-import { o as setManagedCodexPluginRoot } from "./.setup/managed-binary-BnshlFag.mjs";
-import { l as createCodexDesktopGenerationService, s as resolveCodexAppServerFallbackApiKeyCacheKey } from "./.setup/auth-cache-key-B2mpaI9D.mjs";
+import { t as assertCodexAppServerConnectionSecurity } from "./.setup/config-security-CE-FcGw9.mjs";
+import { d as readCodexPluginConfig } from "./.setup/config-parsing-b088LyhT.mjs";
+import { r as createCodexAppServerConfig, t as codexAppServerStartOptionsKey } from "./.setup/config-options-CzyWLTJt.mjs";
+import { o as setManagedCodexPluginRoot } from "./.setup/managed-binary-kiWRhNRE.mjs";
+import { l as createCodexDesktopGenerationService, s as resolveCodexAppServerFallbackApiKeyCacheKey } from "./.setup/auth-cache-key-Dbvq-QgB.mjs";
 import { n as CODEX_MANAGED_THREAD_NAMESPACE, r as createCodexManagedThreadStore, t as CODEX_MANAGED_THREAD_MAX_ENTRIES } from "./.setup/managed-thread-store-BMqgThVL.mjs";
 import { n as CODEX_APP_SERVER_BINDING_NAMESPACE, t as CODEX_APP_SERVER_BINDING_MAX_ENTRIES } from "./.setup/session-binding-meta-B7aEMU7g.mjs";
-import { g as retireSharedCodexAppServerClientsBeforeDesktopGeneration } from "./.setup/session-catalog-events-Bj6j94E_.mjs";
-import { s as createCodexAppServerProcessReaperService } from "./.setup/transport-stdio-h2VHOskC.mjs";
+import { f as retireSharedCodexAppServerClientsBeforeDesktopGeneration } from "./.setup/shared-client-lifecycle-DJIgqgMw.mjs";
+import { s as createCodexAppServerProcessReaperService } from "./.setup/transport-stdio-Bdegpn2V.mjs";
 import { n as codexNativeProfileRecoveryService } from "./.setup/auth-profile-health-oHizqgye.mjs";
-import { r as withCodexConversationThreadActivity, t as isIncognitoSessionKey } from "./.setup/incognito-session-uhrBF6wJ.mjs";
-import { c as canMutateCodexHost, n as filterCodexMarketplacePlugins, o as CODEX_NATIVE_EXECUTION_AUTH_ERROR, t as discoverCodexMarketplacePlugins } from "./.setup/plugin-marketplace-discovery-CDOi8IFs.mjs";
-import { o as formatCodexDisplayText } from "./.setup/command-formatters-Bmqvr9tO.mjs";
-import { a as readCodexConversationBindingDataRecord, i as readCodexConversationBindingData, o as resolveCodexDefaultWorkspaceDir } from "./.setup/conversation-binding-data-CrcyZk6O.mjs";
-import { t as buildCodexMigrationProvider } from "./.setup/provider-BOsxQHOM.mjs";
-import { t as CODEX_CONTROL_METHODS } from "./.setup/capabilities-CDXOOFdZ.mjs";
+import { n as withCodexConversationThreadActivity } from "./.setup/thread-ownership-queue-Dp24d7-F.mjs";
+import { c as canMutateCodexHost, n as filterCodexMarketplacePlugins, o as CODEX_NATIVE_EXECUTION_AUTH_ERROR, t as discoverCodexMarketplacePlugins } from "./.setup/plugin-marketplace-discovery-D_dV9FXa.mjs";
+import { o as formatCodexDisplayText } from "./.setup/command-formatters-R3ckE3Co.mjs";
+import { a as readCodexConversationBindingDataRecord, i as readCodexConversationBindingData, o as resolveCodexDefaultWorkspaceDir } from "./.setup/conversation-binding-data-C746z5Pn.mjs";
+import { t as isIncognitoSessionKey } from "./.setup/incognito-session-DWYapfwf.mjs";
+import { t as buildCodexMigrationProvider } from "./.setup/provider-DH8NSzGt.mjs";
+import { t as CODEX_CONTROL_METHODS } from "./.setup/capabilities-B3WEZl4e.mjs";
 import { t as assertCodexArchiveDescendantsUnowned } from "./.setup/thread-archive-guard-C9frICzX.mjs";
-import { a as createCodexCliSessionNodeInvokePolicies, c as resolveCodexCliSessionForBindingOnNode, i as createCodexCliSessionNodeHostCommands, l as resumeCodexCliSessionOnNode, s as listCodexCliSessionsOnNode } from "./.setup/node-cli-sessions-r3avj02l.mjs";
-import { t as CODEX_CATALOG_STATE_NAMESPACE } from "./.setup/session-catalog-index-state-Dgh8ORJm.mjs";
-import { i as createCodexSessionCatalogNodeHostCommands, n as createCodexSessionCatalogNodeInvokePolicies, r as createCodexSessionCatalogControl, t as codexSessionCatalogRuntime } from "./.setup/session-catalog-Pno1xGcl.mjs";
-import { i as requestCodexAppServerJson } from "./.setup/request-D2L0zMrq.mjs";
+import { a as createCodexCliSessionNodeInvokePolicies, c as resolveCodexCliSessionForBindingOnNode, i as createCodexCliSessionNodeHostCommands, l as resumeCodexCliSessionOnNode, s as listCodexCliSessionsOnNode } from "./.setup/node-cli-sessions-HC4W6FLI.mjs";
+import { t as CODEX_CATALOG_MAX_ROWS } from "./.setup/session-catalog-limits-DDxOsQeC.mjs";
+import { t as CODEX_CATALOG_STATE_NAMESPACE } from "./.setup/session-catalog-index-state-TeO7EyO-.mjs";
+import { i as createCodexSessionCatalogNodeHostCommands, n as createCodexSessionCatalogNodeInvokePolicies, r as createCodexSessionCatalogControl, t as codexSessionCatalogRuntime } from "./.setup/session-catalog-4sCdv5qx.mjs";
+import { i as requestCodexAppServerJson } from "./.setup/request-BHZ1nz8d.mjs";
 import { t as createCodexWebSearchProviderBase } from "./.setup/web-search-provider.shared-BrZmlqyR.mjs";
 import { normalizePluginsConfig, resolveEffectiveEnableState, resolveLivePluginConfigObject, resolvePluginConfigObject } from "openclaw/plugin-sdk/plugin-config-runtime";
 import { definePluginEntry } from "openclaw/plugin-sdk/plugin-entry";
 import { asBoolean, asOptionalRecord, asSafeIntegerInRange, isRecord } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { isDeepStrictEqual } from "node:util";
 import { resolveDefaultAgentDir } from "openclaw/plugin-sdk/agent-harness-registration";
+import { coerceErrorMessage, formatErrorMessage } from "openclaw/plugin-sdk/error-runtime";
 import { expectDefined } from "openclaw/plugin-sdk/expect-runtime";
 import { KeyedAsyncQueue } from "openclaw/plugin-sdk/keyed-async-queue";
-import { formatErrorMessage } from "openclaw/plugin-sdk/error-runtime";
 import { jsonResult } from "openclaw/plugin-sdk/tool-results";
 import { Type } from "typebox";
 import { readStringParam } from "openclaw/plugin-sdk/param-readers";
@@ -44,7 +46,7 @@ import { createLazyRuntimeModule } from "openclaw/plugin-sdk/lazy-runtime";
 //#region extensions/codex/src/account-usage.ts
 function registerCodexAccountUsage(api) {
 	api.registerGatewayMethod("codex.accountUsage", async (options) => {
-		const { handleCodexAccountUsage } = await import("./.setup/account-usage-runtime-Eem_WGqY.mjs");
+		const { handleCodexAccountUsage } = await import("./.setup/account-usage-runtime-DFhbh1zz.mjs");
 		await handleCodexAccountUsage(options);
 	}, { scope: "operator.admin" });
 }
@@ -56,7 +58,7 @@ function createCodexAppServerConnectionHealthService(options) {
 	let abortController;
 	let monitor;
 	const run = async (ctx, signal) => {
-		const { resolveCodexAppServerRuntimeOptions } = await import("./.setup/config-runtime-C8Rw1m1m.mjs").then((n) => n.t);
+		const { resolveCodexAppServerRuntimeOptions } = await import("./.setup/config-runtime-C0NbLms1.mjs").then((n) => n.t);
 		let consecutiveFailures = 0;
 		while (!signal.aborted) {
 			let pluginConfig;
@@ -72,8 +74,8 @@ function createCodexAppServerConnectionHealthService(options) {
 				return;
 			}
 			if (runtime.start.transport !== "websocket") return;
-			const { getLeasedSharedCodexAppServerClient, releaseLeasedSharedCodexAppServerClient } = await import("./.setup/shared-client-DA4VR4Eb.mjs").then((n) => n.y);
-			const { isUnsupportedCodexAppServerVersionError } = await import("./.setup/client-Cs08OXVQ.mjs").then((n) => n.n);
+			const { getLeasedSharedCodexAppServerClient, releaseLeasedSharedCodexAppServerClient } = await import("./.setup/shared-client-DqyTMYug.mjs").then((n) => n.v);
+			const { isUnsupportedCodexAppServerVersionError } = await import("./.setup/client-N0JpgSzF.mjs").then((n) => n.n);
 			if (signal.aborted) return;
 			let leasedClient;
 			try {
@@ -174,7 +176,7 @@ function waitForReconnect(delayMs, signal) {
 /** Keeps lifecycle/auth loading behind mutations while sharing the canonical read codec. */
 function createLazyCodexAppServerBindingStore(state, managedThreadState) {
 	let resolved;
-	const store = () => resolved ??= import("./.setup/session-binding-Cm0apEbd.mjs").then((n) => n.s).then(({ createCodexAppServerBindingStore }) => createCodexAppServerBindingStore(state));
+	const store = () => resolved ??= import("./.setup/session-binding-DGCYAfvD.mjs").then((n) => n.s).then(({ createCodexAppServerBindingStore }) => createCodexAppServerBindingStore(state));
 	const managedThreads = managedThreadState ? createCodexManagedThreadStore(managedThreadState) : void 0;
 	return {
 		...managedThreads ? { managedThreads } : {},
@@ -182,6 +184,7 @@ function createLazyCodexAppServerBindingStore(state, managedThreadState) {
 		get readMany() {
 			return state.lookupMany ? (identities) => readCurrentCodexAppServerBindings(state, identities) : void 0;
 		},
+		readNativeSubagentAssignments: (identity, owner) => readCurrentNativePendingAssignments(state, identity, owner),
 		readNativeSubagentSubmissions: (identity, owner) => readCurrentCodexNativeSubagentSubmissions(state, identity, owner),
 		hasOtherThreadOwner: async (threadId, currentIdentity) => (await store()).hasOtherThreadOwner(threadId, currentIdentity),
 		mutate: async (identity, mutation, assertCurrent) => (await store()).mutate(identity, mutation, assertCurrent),
@@ -223,7 +226,7 @@ function createCodexCommand(options) {
 				...ctx,
 				gatewayClientScopes: ctx.gatewayClientScopes?.slice()
 			};
-			const { handleCodexCommand } = await import("./.setup/command-dispatch-B4JuOsOk.mjs");
+			const { handleCodexCommand } = await import("./.setup/command-dispatch-BeAoaovI.mjs");
 			return handleCodexCommand(commandContext, options);
 		}
 	};
@@ -255,7 +258,7 @@ async function handleCodexConversationInboundClaim(event, ctx, options) {
 		return {
 			handled: true,
 			reply: (await getNodeConversationState().queue.enqueue(`${data.nodeId}:${data.sessionId}`, async () => {
-				const { resolveCodexNativeSandboxBlock } = await import("./.setup/sandbox-guard-C2sRMOEY.mjs").then((n) => n.r);
+				const { resolveCodexNativeSandboxBlock } = await import("./.setup/sandbox-guard-DjCz2eOw.mjs").then((n) => n.r);
 				const blocked = resolveCodexNativeSandboxBlock({
 					config: options.config,
 					sessionKey,
@@ -292,7 +295,7 @@ async function handleCodexConversationInboundClaim(event, ctx, options) {
 		return {
 			handled: true,
 			reply: (await withCodexConversationThreadActivity(data.bindingId, async () => {
-				const { resolveCodexNativeExecutionBlock } = await import("./.setup/sandbox-guard-C2sRMOEY.mjs").then((n) => n.r);
+				const { resolveCodexNativeExecutionBlock } = await import("./.setup/sandbox-guard-DjCz2eOw.mjs").then((n) => n.r);
 				const nativeExecutionBlock = resolveCodexNativeExecutionBlock({
 					config: options.config,
 					sessionKey,
@@ -301,7 +304,7 @@ async function handleCodexConversationInboundClaim(event, ctx, options) {
 				});
 				if (nativeExecutionBlock) return { reply: { text: nativeExecutionBlock } };
 				const { getSessionBindingService } = await import("openclaw/plugin-sdk/conversation-binding-runtime");
-				const { runBoundTurnWithMissingThreadRecovery } = await import("./.setup/conversation-binding-DP-gMrBP.mjs");
+				const { runBoundTurnWithMissingThreadRecovery } = await import("./.setup/conversation-binding-3Min8qvP.mjs");
 				const current = options.bindingStore.read(identity);
 				if (!isCurrentPublicBinding(publicBinding, getSessionBindingService()) || expected && (!current || current.threadId !== expected.threadId || current.conversationStartId !== expected.conversationStartId) || !expected && current && data.start?.id && current.conversationStartId !== data.start.id) return { reply: { text: "This Codex conversation was detached or changed before its message could run." } };
 				return await runBoundTurnWithMissingThreadRecovery({
@@ -335,7 +338,7 @@ async function handleCodexConversationBindingResolved(event, options) {
 	const binding = options.bindingStore.read(identity);
 	assertCodexBindingMayBeReplaced(binding, "clearing a denied conversation binding");
 	if (binding && (!data.start?.id || binding.conversationStartId === data.start.id)) await withCodexConversationThreadActivity(identity.bindingId, async () => {
-		const { retireCodexConversationThreadBinding } = await import("./.setup/thread-ownership-DcTtAcXj.mjs").then((n) => n.o);
+		const { retireCodexConversationThreadBinding } = await import("./.setup/thread-ownership-roNP0l1c.mjs").then((n) => n.o);
 		return retireCodexConversationThreadBinding({
 			bindingStore: options.bindingStore,
 			identity,
@@ -370,7 +373,7 @@ function createCodexPluginsTool(options) {
 			const query = typeof params.query === "string" ? params.query : "";
 			const marketplace = typeof params.marketplace === "string" ? params.marketplace.trim() : void 0;
 			const limit = typeof params.limit === "number" && Number.isInteger(params.limit) ? Math.max(1, Math.min(params.limit, 20)) : 12;
-			const { codexBindingConnectionSelection, resolveCodexBindingAppServerConnection } = await import("./.setup/binding-connection-ThoatDcb.mjs").then((n) => n.n);
+			const { codexBindingConnectionSelection, resolveCodexBindingAppServerConnection } = await import("./.setup/binding-connection-DTtN1KrX.mjs").then((n) => n.n);
 			const pluginConfig = options.getPluginConfig();
 			const config = runtimeConfig();
 			const identity = options.context.sessionId ? sessionBindingIdentity({
@@ -387,7 +390,7 @@ function createCodexPluginsTool(options) {
 				if (runtimeConfig() !== config || !isDeepStrictEqual(options.getPluginConfig(), pluginConfig) || !isDeepStrictEqual(codexBindingConnectionSelection(readBinding()), selection)) throw new Error("Codex plugin discovery ownership changed; retry the request.");
 			};
 			const workspaceDir = binding?.cwd?.trim() || options.context.workspaceDir?.trim() || resolveCodexDefaultWorkspaceDir(pluginConfig);
-			const request = options.request ?? (await import("./.setup/command-rpc-DixIj3HW.mjs").then((n) => n.n)).codexControlRequest;
+			const request = options.request ?? (await import("./.setup/command-rpc-CGJGUQ6Y.mjs").then((n) => n.n)).codexControlRequest;
 			const connection = await resolveCodexBindingAppServerConnection({
 				binding,
 				pluginConfig,
@@ -420,7 +423,7 @@ function createCodexPluginsTool(options) {
 	};
 }
 function projectAvailablePlugin(plugin) {
-	const projected = {
+	return {
 		id: plugin.id,
 		pluginName: plugin.pluginName,
 		marketplaceName: plugin.marketplaceName,
@@ -428,13 +431,12 @@ function projectAvailablePlugin(plugin) {
 		untrustedDeveloperName: plugin.developerName,
 		installed: plugin.installed,
 		enabled: plugin.enabled,
-		available: plugin.available
+		available: plugin.available,
+		...plugin.description ? { untrustedDescription: plugin.description } : {},
+		...plugin.installPolicy ? { installPolicy: plugin.installPolicy } : {},
+		...plugin.authPolicy ? { authPolicy: plugin.authPolicy } : {},
+		...plugin.mustShowInstallationInterstitial !== void 0 ? { mustShowInstallationInterstitial: plugin.mustShowInstallationInterstitial } : {}
 	};
-	if (plugin.description) projected.untrustedDescription = plugin.description;
-	if (plugin.installPolicy) projected.installPolicy = plugin.installPolicy;
-	if (plugin.authPolicy) projected.authPolicy = plugin.authPolicy;
-	if (plugin.mustShowInstallationInterstitial !== void 0) projected.mustShowInstallationInterstitial = plugin.mustShowInstallationInterstitial;
-	return projected;
 }
 //#endregion
 //#region extensions/codex/src/native-thread-tool.ts
@@ -492,22 +494,12 @@ function readThreadId(params) {
 		label: "thread_id"
 	});
 }
-function readThreadStatusType(value) {
-	if (!isJsonObject(value) || !isJsonObject(value.thread) || !isJsonObject(value.thread.status)) return;
-	return typeof value.thread.status.type === "string" ? value.thread.status.type : void 0;
-}
-function assertThreadMayBeArchived(value, expectedThreadId) {
-	if (!isJsonObject(value) || !isJsonObject(value.thread)) throw new Error("Codex app-server returned an invalid thread/read response");
-	if (value.thread.id !== expectedThreadId) throw new Error("Codex app-server returned a different thread than requested");
-	const status = readThreadStatusType(value);
-	if (status === "active") throw new Error("cannot archive an active Codex thread; wait for its turn to finish");
-	if (status !== "idle" && status !== "notLoaded") throw new Error("cannot verify that the Codex thread is idle; refusing to archive");
-}
-function assertThreadMayBeForked(value, expectedThreadId) {
+function assertThreadIdle(value, expectedThreadId, action) {
 	if (!isJsonObject(value) || !isJsonObject(value.thread)) throw new Error("Codex app-server returned an invalid thread/read response");
 	if (value.thread.id !== expectedThreadId) throw new Error("Codex app-server returned a different thread than requested");
-	const status = readThreadStatusType(value);
-	if (status !== "idle" && status !== "notLoaded") throw new Error("cannot fork a Codex thread unless it is idle or not loaded");
+	const status = isJsonObject(value.thread.status) ? value.thread.status.type : void 0;
+	if (action === "archive" && status === "active") throw new Error("cannot archive an active Codex thread; wait for its turn to finish");
+	if (status !== "idle" && status !== "notLoaded") throw new Error(action === "archive" ? "cannot verify that the Codex thread is idle; refusing to archive" : "cannot fork a Codex thread unless it is idle or not loaded");
 }
 function redactNativeThreadTranscriptFields(value) {
 	if (!isJsonObject(value)) return value;
@@ -575,11 +567,12 @@ function createCodexThreadsTool(options) {
 			const mayReadRawTranscripts = supervision?.enabled !== true || supervision.allowRawTranscripts === true;
 			if ((action === "fork" || action === "rename" || action === "archive" || action === "unarchive") && supervision?.enabled === true && supervision.allowWriteControls !== true) throw new Error("Codex native thread mutations are disabled for this codex plugin supervision config.");
 			const run = async (archiveAdmission) => {
-				const request = options.request ?? (await import("./.setup/command-rpc-DixIj3HW.mjs").then((n) => n.n)).codexControlRequest;
+				const request = options.request ?? (await import("./.setup/command-rpc-CGJGUQ6Y.mjs").then((n) => n.n)).codexControlRequest;
 				const { isModelSelectionLocked, ModelSelectionLockedError } = await import("openclaw/plugin-sdk/model-session-runtime");
-				const { codexBindingConnectionSelection, resolveCodexBindingAppServerConnection } = await import("./.setup/binding-connection-ThoatDcb.mjs").then((n) => n.n);
-				const { resolveCodexSupervisionAppServerRuntimeOptions } = await import("./.setup/config-runtime-C8Rw1m1m.mjs").then((n) => n.t);
-				const requestOptions = async (pluginConfig) => {
+				const { codexBindingConnectionSelection, resolveCodexBindingAppServerConnection } = await import("./.setup/binding-connection-DTtN1KrX.mjs").then((n) => n.n);
+				const { resolveCodexSupervisionAppServerRuntimeOptions } = await import("./.setup/config-runtime-C0NbLms1.mjs").then((n) => n.t);
+				const requestOptions = async () => {
+					const pluginConfig = admissionConfig;
 					const plugin = readCodexPluginConfig(pluginConfig);
 					const base = baseRequestOptions();
 					const session = currentSession();
@@ -615,11 +608,12 @@ function createCodexThreadsTool(options) {
 						assertCurrent
 					};
 				};
+				const scopedRequest = async (method, requestParams) => request(admissionConfig, method, requestParams, await requestOptions());
 				if (action === "list") {
 					const cursor = readStringParam(params, "cursor");
 					const searchTerm = readStringParam(params, "search");
 					if (searchTerm && !mayReadRawTranscripts) throw new Error("Codex native thread search is disabled while raw transcript access is disabled.");
-					const response = await request(admissionConfig, CODEX_CONTROL_METHODS.listThreads, {
+					const response = await scopedRequest(CODEX_CONTROL_METHODS.listThreads, {
 						archived: asBoolean(params.archived) ?? false,
 						limit: asSafeIntegerInRange(params.limit, {
 							min: 1,
@@ -631,17 +625,17 @@ function createCodexThreadsTool(options) {
 						sourceKinds: [...CODEX_INTERACTIVE_THREAD_SOURCE_KINDS],
 						...cursor ? { cursor } : {},
 						...searchTerm ? { searchTerm } : {}
-					}, await requestOptions(admissionConfig));
+					});
 					return jsonResult(mayReadRawTranscripts ? response : redactNativeThreadResponse(response));
 				}
 				const threadId = archiveAdmission?.threadId ?? readThreadId(params);
 				if (action === "read") {
 					const includeTurns = asBoolean(params.include_turns) ?? false;
 					if (includeTurns && !mayReadRawTranscripts) throw new Error("Codex raw transcript reads are disabled for this codex plugin supervision config.");
-					const response = await request(admissionConfig, CODEX_CONTROL_METHODS.readThread, {
+					const response = await scopedRequest(CODEX_CONTROL_METHODS.readThread, {
 						threadId,
 						includeTurns
-					}, await requestOptions(admissionConfig));
+					});
 					return jsonResult(mayReadRawTranscripts ? response : redactNativeThreadResponse(response));
 				}
 				if (action === "rename") {
@@ -649,10 +643,10 @@ function createCodexThreadsTool(options) {
 						required: true,
 						label: "name"
 					});
-					await request(admissionConfig, CODEX_CONTROL_METHODS.renameThread, {
+					await scopedRequest(CODEX_CONTROL_METHODS.renameThread, {
 						threadId,
 						name
-					}, await requestOptions(admissionConfig));
+					});
 					return jsonResult({
 						action,
 						threadId,
@@ -660,7 +654,7 @@ function createCodexThreadsTool(options) {
 					});
 				}
 				if (action === "unarchive") {
-					const response = await request(admissionConfig, CODEX_CONTROL_METHODS.unarchiveThread, { threadId }, await requestOptions(admissionConfig));
+					const response = await scopedRequest(CODEX_CONTROL_METHODS.unarchiveThread, { threadId });
 					return jsonResult(mayReadRawTranscripts ? response : redactNativeThreadResponse(response));
 				}
 				const session = archiveAdmission?.session ?? currentSession();
@@ -672,23 +666,23 @@ function createCodexThreadsTool(options) {
 						if (isModelSelectionLocked(admittedSession.entry)) throw new ModelSelectionLockedError();
 						assertCodexBindingMayBeReplaced(archivedBinding, "archiving its bound native thread");
 					}
-					assertThreadMayBeArchived(await request(admissionConfig, CODEX_CONTROL_METHODS.readThread, {
+					assertThreadIdle(await scopedRequest(CODEX_CONTROL_METHODS.readThread, {
 						threadId,
 						includeTurns: false
-					}, await requestOptions(admissionConfig)), threadId);
+					}), threadId, "archive");
 					if (await options.bindingStore.hasOtherThreadOwner(threadId, identity)) throw new Error("cannot archive a native Codex thread owned by another OpenClaw session");
 					await assertCodexArchiveDescendantsUnowned({
 						bindingStore: options.bindingStore,
 						threadId,
-						listPage: async (listParams) => await request(admissionConfig, CODEX_CONTROL_METHODS.listThreads, listParams, await requestOptions(admissionConfig)),
+						listPage: async (listParams) => await scopedRequest(CODEX_CONTROL_METHODS.listThreads, listParams),
 						assertDescendantIdle: async (descendantThreadId) => {
-							assertThreadMayBeArchived(await request(admissionConfig, CODEX_CONTROL_METHODS.readThread, {
+							assertThreadIdle(await scopedRequest(CODEX_CONTROL_METHODS.readThread, {
 								threadId: descendantThreadId,
 								includeTurns: false
-							}, await requestOptions(admissionConfig)), descendantThreadId);
+							}), descendantThreadId, "archive");
 						}
 					});
-					await request(admissionConfig, CODEX_CONTROL_METHODS.archiveThread, { threadId }, await requestOptions(admissionConfig));
+					await scopedRequest(CODEX_CONTROL_METHODS.archiveThread, { threadId });
 					if (archivedBinding?.threadId === threadId) await options.bindingStore.mutate(identity, {
 						kind: "clear",
 						threadId
@@ -704,15 +698,15 @@ function createCodexThreadsTool(options) {
 				if (attach && isModelSelectionLocked(session?.entry)) throw new ModelSelectionLockedError();
 				const usesSupervisionConnection = binding?.connectionScope === "supervision" || admissionPlugin.appServer?.homeScope !== "user" && supervision?.enabled === true;
 				if (attach && usesSupervisionConnection) throw new Error("Supervised Codex forks must stay detached; set attach=false.");
-				const forkOptions = await requestOptions(admissionConfig);
-				const { retainCodexAppServerBindingSubscription, rollbackCodexAppServerBindingSubscription } = await import("./.setup/thread-ownership-DcTtAcXj.mjs").then((n) => n.o);
-				const { closeCodexStartupClientBestEffort } = await import("./.setup/attempt-client-cleanup-CEv1cKwF.mjs").then((n) => n.a);
+				const forkOptions = await requestOptions();
+				const { retainCodexAppServerBindingSubscription, rollbackCodexAppServerBindingSubscription } = await import("./.setup/thread-ownership-roNP0l1c.mjs").then((n) => n.o);
+				const { closeCodexStartupClientBestEffort } = await import("./.setup/attempt-client-cleanup-DOP-cW5j.mjs").then((n) => n.a);
 				if (attach) {
 					assertCodexBindingMayBeReplaced(binding, "attaching a different native fork");
-					assertThreadMayBeForked(await request(admissionConfig, CODEX_CONTROL_METHODS.readThread, {
+					assertThreadIdle(await request(admissionConfig, CODEX_CONTROL_METHODS.readThread, {
 						threadId,
 						includeTurns: false
-					}, forkOptions), threadId);
+					}, forkOptions), threadId, "fork");
 				}
 				const response = await request(admissionConfig, CODEX_CONTROL_METHODS.forkThread, {
 					threadId,
@@ -823,19 +817,31 @@ function createCodexNodeExecServerCommand() {
 			}
 			if (!isRecord(request) || Object.keys(request).length !== 2 || request.authorization !== "human-approved" && request.authorization !== "session-full") throw new Error("Codex node exec-server requires an authorized managed placement workspace launch.");
 			const placement = parseCodexNodePlacementWorkspace(request.placement);
-			if (!context?.acquireManagedWorkspace || context.sessionKey !== placement.sessionKey || io.signal.aborted) throw new Error("Codex node exec-server requires active managed placement authority.");
+			if (!context?.acquireManagedWorkspaceAsync || context.sessionKey !== placement.sessionKey || io.signal.aborted) throw new Error("Codex node exec-server requires active managed placement authority.");
 			if (!context.prepareExecAuthorization) throw new Error("Codex node execution requires node-local exec policy support; update the node.");
+			const runtimeIo = context.signal ? {
+				...io,
+				signal: AbortSignal.any([io.signal, context.signal])
+			} : io;
 			const assertExecAuthorized = context.prepareExecAuthorization(request.authorization);
-			const { runCodexNodeExecServer } = await import("./.setup/node-exec-server.runtime-BDwWXVpK.mjs");
+			const { runCodexNodeExecServer } = await import("./.setup/node-exec-server.runtime-BgBfWQqo.mjs");
+			runtimeIo.signal.throwIfAborted();
+			const workspace = await context.acquireManagedWorkspaceAsync({
+				workspaceDir: placement.cwd,
+				environmentId: placement.environmentId,
+				sessionId: placement.sessionId,
+				ownerEpoch: placement.ownerEpoch,
+				sessionKey: placement.sessionKey
+			});
+			try {
+				runtimeIo.signal.throwIfAborted();
+			} catch (error) {
+				workspace.release();
+				throw error;
+			}
 			return await runCodexNodeExecServer({
-				workspace: context.acquireManagedWorkspace({
-					workspaceDir: placement.cwd,
-					environmentId: placement.environmentId,
-					sessionId: placement.sessionId,
-					ownerEpoch: placement.ownerEpoch,
-					sessionKey: placement.sessionKey
-				}),
-				io,
+				workspace,
+				io: runtimeIo,
 				activeProcesses,
 				assertExecAuthorized
 			});
@@ -1031,9 +1037,6 @@ function readStoredThreads(data, maxEntries) {
 		return entry;
 	});
 }
-function readBooleanParam(params, key) {
-	return params[key] === true;
-}
 function readIntegerParam(params, key) {
 	const value = params[key];
 	if (value === void 0) return;
@@ -1125,25 +1128,23 @@ function readLegacyEnvEndpoints(env) {
 function resolveEndpoints(pluginConfig, env, runtimeConfig, resolveAuthProfileId, resolveRuntimeOptions) {
 	const configured = readCodexPluginConfig(pluginConfig).supervision?.endpoints;
 	const endpoints = configured?.length ? configured : readLegacyEnvEndpoints(env);
-	return (endpoints ? requireUniqueEndpointIds(endpoints.map(normalizeConfiguredEndpoint)) : [{
+	const normalized = endpoints ? requireUniqueEndpointIds(endpoints.map(normalizeConfiguredEndpoint)) : [{
 		id: "local",
 		label: "local Codex app-server"
-	}]).map((endpoint) => {
-		const resolved = {
-			id: endpoint.id,
-			connectionKey: supervisionEndpointConnectionKey({
-				endpoint,
-				pluginConfig,
-				env,
-				runtimeConfig,
-				resolveAuthProfileId,
-				resolveRuntimeOptions
-			})
-		};
-		if (endpoint.label !== void 0) resolved.label = endpoint.label;
-		if (endpoint.configured !== void 0) resolved.configured = endpoint.configured;
-		return resolved;
+	}];
+	const resolved = [];
+	for (const endpoint of normalized) resolved.push({
+		...endpoint,
+		connectionKey: supervisionEndpointConnectionKey({
+			endpoint,
+			pluginConfig,
+			env,
+			runtimeConfig,
+			resolveAuthProfileId,
+			resolveRuntimeOptions
+		})
 	});
+	return resolved;
 }
 function resolveEndpointStartOptions(params) {
 	const base = params.resolveRuntimeOptions({
@@ -1262,7 +1263,7 @@ function threadFromRead(value) {
 	return isRecord(value) && isRecord(value.thread) ? value.thread : void 0;
 }
 function isLoadedThreadReadMiss(error) {
-	const message = error instanceof Error ? error.message : String(error);
+	const message = coerceErrorMessage(error);
 	return message.includes("thread not found") || message.includes("thread not loaded");
 }
 async function readThread(params) {
@@ -1283,86 +1284,63 @@ async function readThread(params) {
 		return thread;
 	}
 }
-async function listLoadedSessions(request, endpoint) {
+async function listSessions(request, endpoint, storedLimit) {
+	const loaded = storedLimit === void 0;
+	const method = loaded ? "thread/loaded/list" : "thread/list";
+	const limit = storedLimit ?? Infinity;
 	const sessions = [];
 	const seenCursors = /* @__PURE__ */ new Set();
 	let cursor;
 	for (let pageIndex = 0; pageIndex < MAX_COMPAT_PAGINATION_PAGES; pageIndex += 1) {
-		const listed = await request(endpoint, "thread/loaded/list", {
-			limit: PAGE_LIMIT,
+		const remaining = limit - sessions.length;
+		if (remaining <= 0) break;
+		const pageLimit = Math.min(PAGE_LIMIT, remaining);
+		const listed = await request(endpoint, method, {
+			...loaded ? {} : {
+				archived: false,
+				sourceKinds: [...ALL_CODEX_THREAD_SOURCE_KINDS],
+				modelProviders: [],
+				sortKey: "recency_at",
+				sortDirection: "desc",
+				useStateDbOnly: true
+			},
+			limit: pageLimit,
 			...cursor ? { cursor } : {}
 		});
-		if (!isRecord(listed) || !Array.isArray(listed.data)) throw new Error("Codex thread/loaded/list returned an invalid response");
-		const threadIds = readLoadedThreadIds(listed.data);
-		for (const threadId of threadIds) {
-			if (sessions.some((entry) => entry.threadId === threadId)) continue;
+		if (!isRecord(listed) || !Array.isArray(listed.data)) throw new Error(`Codex ${method} returned an invalid response`);
+		const entries = loaded ? readLoadedThreadIds(listed.data) : readStoredThreads(listed.data, pageLimit);
+		for (const entry of entries) {
+			if (typeof entry === "string" && sessions.some((session) => session.threadId === entry)) continue;
 			try {
-				const thread = await readThread({
+				const thread = typeof entry === "string" ? await readThread({
 					request,
 					endpoint,
-					threadId,
+					threadId: entry,
 					includeTurns: false
-				});
-				const session = toSession(endpoint.id, thread, true);
-				if (session) sessions.push(session);
+				}) : entry;
+				const session = toSession(endpoint.id, thread, loaded ? true : void 0);
+				if (session && (loaded || !sessions.some((existing) => existing.threadId === session.threadId))) sessions.push(session);
 			} catch (error) {
-				if (!isLoadedThreadReadMiss(error)) throw error;
+				if (!loaded || !isLoadedThreadReadMiss(error)) throw error;
 			}
 		}
-		const nextCursor = readCompatNextCursor(listed.nextCursor, "thread/loaded/list");
-		if (nextCursor && seenCursors.has(nextCursor)) throw new Error(`Codex thread/loaded/list returned repeated cursor ${nextCursor}`);
-		if (nextCursor) seenCursors.add(nextCursor);
-		cursor = nextCursor;
-		if (!cursor) break;
-	}
-	if (cursor) throw new Error(`Codex thread/loaded/list exceeded ${MAX_COMPAT_PAGINATION_PAGES} pages with a continuation cursor`);
-	return sessions;
-}
-async function listStoredSessions(params) {
-	const sessions = [];
-	const seenCursors = /* @__PURE__ */ new Set();
-	let cursor;
-	for (let pageIndex = 0; pageIndex < MAX_COMPAT_PAGINATION_PAGES; pageIndex += 1) {
-		const remaining = params.limit - sessions.length;
-		if (remaining <= 0) break;
-		const pageLimit = Math.min(PAGE_LIMIT, remaining);
-		const listed = await params.request(params.endpoint, "thread/list", {
-			archived: false,
-			limit: pageLimit,
-			sourceKinds: [...ALL_CODEX_THREAD_SOURCE_KINDS],
-			modelProviders: [],
-			sortKey: "recency_at",
-			sortDirection: "desc",
-			useStateDbOnly: true,
-			...cursor ? { cursor } : {}
-		});
-		if (!isRecord(listed) || !Array.isArray(listed.data)) throw new Error("Codex thread/list returned an invalid response");
-		for (const thread of readStoredThreads(listed.data, pageLimit)) {
-			if (sessions.length >= params.limit) break;
-			const session = toSession(params.endpoint.id, thread);
-			if (session && !sessions.some((entry) => entry.threadId === session.threadId)) sessions.push(session);
-		}
-		const nextCursor = readCompatNextCursor(listed.nextCursor, "thread/list");
-		if (nextCursor && sessions.length < params.limit && seenCursors.has(nextCursor)) throw new Error(`Codex thread/list returned repeated cursor ${nextCursor}`);
+		const nextCursor = readCompatNextCursor(listed.nextCursor, method);
+		if (nextCursor && sessions.length < limit && seenCursors.has(nextCursor)) throw new Error(`Codex ${method} returned repeated cursor ${nextCursor}`);
 		if (nextCursor) seenCursors.add(nextCursor);
 		cursor = nextCursor;
-		if (!cursor || sessions.length >= params.limit) break;
+		if (!cursor || sessions.length >= limit) break;
 	}
-	if (cursor && sessions.length < params.limit) throw new Error(`Codex thread/list exceeded ${MAX_COMPAT_PAGINATION_PAGES} pages with a continuation cursor`);
+	if (cursor && sessions.length < limit) throw new Error(`Codex ${method} exceeded ${MAX_COMPAT_PAGINATION_PAGES} pages with a continuation cursor`);
 	return sessions;
 }
 async function listSessionSnapshot(params) {
 	const sessions = [];
 	const errors = [];
 	for (const endpoint of params.endpoints) try {
-		const loaded = await listLoadedSessions(params.request, endpoint);
+		const loaded = await listSessions(params.request, endpoint);
 		sessions.push(...loaded);
 		if (params.includeStored) {
-			const stored = await listStoredSessions({
-				request: params.request,
-				endpoint,
-				limit: params.maxStoredSessions ?? DEFAULT_MAX_STORED_SESSIONS
-			});
+			const stored = await listSessions(params.request, endpoint, params.maxStoredSessions ?? DEFAULT_MAX_STORED_SESSIONS);
 			for (const session of stored) if (!sessions.some((entry) => entry.endpointId === endpoint.id && entry.threadId === session.threadId)) sessions.push(session);
 		}
 	} catch (error) {
@@ -1370,7 +1348,7 @@ async function listSessionSnapshot(params) {
 		errors.push({
 			endpointId: endpoint.id,
 			ok: false,
-			detail: error instanceof Error ? error.message : String(error)
+			detail: coerceErrorMessage(error)
 		});
 	}
 	return {
@@ -1394,7 +1372,6 @@ async function resolveEndpointForThread(params) {
 		})).id === params.threadId) matches.push(endpoint);
 	} catch (error) {
 		if (error instanceof CodexSupervisionPolicyError) throw error;
-		if (!isLoadedThreadReadMiss(error)) continue;
 	}
 	if (matches.length === 1) return expectDefined(matches[0], "single matching Codex supervision endpoint");
 	if (matches.length > 1) throw new Error(`Codex thread id is ambiguous across endpoints: ${params.threadId}`);
@@ -1443,27 +1420,16 @@ function redactEndpointUrl(value) {
 	}
 }
 function endpointResult(endpoint, pluginConfig, env, resolveRuntimeOptions) {
-	const configured = endpoint.configured;
-	if (configured && (configured.transport === "stdio-proxy" || configured.transport === void 0)) return {
-		id: endpoint.id,
-		transport: "stdio-proxy",
-		...endpoint.label ? { label: endpoint.label } : {}
-	};
-	if (configured?.transport === "websocket") return {
-		id: endpoint.id,
-		transport: "websocket",
-		...endpoint.label ? { label: endpoint.label } : {},
-		url: redactEndpointUrl(configured.url)
-	};
-	const start = resolveRuntimeOptions({
+	const start = endpoint.configured ?? resolveRuntimeOptions({
 		pluginConfig,
 		env
 	}).start;
+	const remote = start.transport === "websocket" || start.transport === "unix" ? { url: redactEndpointUrl(start.url ?? (start.transport === "unix" ? "unix://" : "")) } : void 0;
 	return {
 		id: endpoint.id,
-		transport: start.transport === "stdio" ? "stdio-proxy" : "websocket",
+		transport: remote ? "websocket" : "stdio-proxy",
 		...endpoint.label ? { label: endpoint.label } : {},
-		...start.transport === "stdio" ? {} : { url: redactEndpointUrl(start.transport === "unix" ? start.url ?? "unix://" : start.url ?? "") }
+		...remote
 	};
 }
 function sanitizeSessionListResult(result, includeTranscriptDerivedFields) {
@@ -1512,8 +1478,26 @@ function createCodexSupervisionTools(options) {
 	const request = createPolicyGuardedRequest(options, "enabled");
 	const rawTranscriptRequest = createPolicyGuardedRequest(options, "raw-transcripts");
 	const writeRequest = createPolicyGuardedRequest(options, "write-controls");
-	const current = () => {
-		return requireLiveToolPolicy(options, "enabled");
+	const current = () => requireLiveToolPolicy(options, "enabled");
+	const readActiveThread = async (endpoints, params, threadId, idleError) => {
+		const endpoint = await resolveEndpointForThread({
+			endpoints,
+			request: writeRequest,
+			endpointId: readStringParam(params, "endpoint_id"),
+			threadId
+		});
+		const thread = await readThread({
+			request: writeRequest,
+			endpoint,
+			threadId,
+			includeTurns: true
+		});
+		requireCurrentEndpoint(options, "write-controls", endpoint);
+		if (statusType(thread) !== "active") throw idleError();
+		return {
+			endpoint,
+			thread
+		};
 	};
 	return [
 		{
@@ -1556,7 +1540,7 @@ function createCodexSupervisionTools(options) {
 				const result = await listSessionSnapshot({
 					endpoints,
 					request,
-					includeStored: readBooleanParam(params, "include_stored"),
+					includeStored: params.include_stored === true,
 					maxStoredSessions: readIntegerParam(params, "max_stored_sessions")
 				});
 				const { pluginConfig } = requireCurrentEndpointSet(options, endpoints);
@@ -1586,7 +1570,7 @@ function createCodexSupervisionTools(options) {
 					request: rawTranscriptRequest,
 					endpoint,
 					threadId,
-					includeTurns: readBooleanParam(params, "include_turns")
+					includeTurns: params.include_turns === true
 				});
 				requireCurrentEndpoint(options, "raw-transcripts", endpoint);
 				return jsonResult({
@@ -1610,20 +1594,7 @@ function createCodexSupervisionTools(options) {
 					allowEmpty: false
 				});
 				if ((readModeParam(params) ?? "auto") === "start") throw idleContinuationError(threadId);
-				const endpoint = await resolveEndpointForThread({
-					endpoints,
-					request: writeRequest,
-					endpointId: readStringParam(params, "endpoint_id"),
-					threadId
-				});
-				const thread = await readThread({
-					request: writeRequest,
-					endpoint,
-					threadId,
-					includeTurns: true
-				});
-				requireCurrentEndpoint(options, "write-controls", endpoint);
-				if (statusType(thread) !== "active") throw idleContinuationError(threadId);
+				const { endpoint, thread } = await readActiveThread(endpoints, params, threadId, () => idleContinuationError(threadId));
 				const turnId = await resolveInProgressTurnId({
 					request: writeRequest,
 					endpoint,
@@ -1662,20 +1633,7 @@ function createCodexSupervisionTools(options) {
 				requireWriteAccess(pluginConfig);
 				const params = isRecord(rawParams) ? rawParams : {};
 				const threadId = readStringParam(params, "thread_id", { required: true });
-				const endpoint = await resolveEndpointForThread({
-					endpoints,
-					request: writeRequest,
-					endpointId: readStringParam(params, "endpoint_id"),
-					threadId
-				});
-				const thread = await readThread({
-					request: writeRequest,
-					endpoint,
-					threadId,
-					includeTurns: true
-				});
-				requireCurrentEndpoint(options, "write-controls", endpoint);
-				if (statusType(thread) !== "active") throw new Error(`Codex thread ${threadId} has no active turn to interrupt`);
+				const { endpoint, thread } = await readActiveThread(endpoints, params, threadId, () => /* @__PURE__ */ new Error(`Codex thread ${threadId} has no active turn to interrupt`));
 				const turnId = readStringParam(params, "turn_id") ?? await resolveInProgressTurnId({
 					request: writeRequest,
 					endpoint,
@@ -1702,7 +1660,7 @@ function createCodexSupervisionTools(options) {
 }
 //#endregion
 //#region extensions/codex/src/web-search-provider.ts
-const loadCodexWebSearchRuntime = createLazyRuntimeModule(() => import("./.setup/web-search-provider.runtime-CDKlN-Rv.mjs"));
+const loadCodexWebSearchRuntime = createLazyRuntimeModule(() => import("./.setup/web-search-provider.runtime-P77OUeoo.mjs"));
 const CodexWebSearchSchema = {
 	type: "object",
 	properties: { query: {
@@ -1773,12 +1731,15 @@ var codex_default = definePluginEntry({
 			getRuntimeConfig: resolveCurrentConfig
 		}));
 		let bindingStateStore;
+		let bindingMutationStore;
 		let managedThreadStateStore;
-		const openBindingStateStore = () => bindingStateStore ??= api.runtime.state.openSyncKeyedStore({
+		const bindingStateOptions = {
 			namespace: CODEX_APP_SERVER_BINDING_NAMESPACE,
 			maxEntries: CODEX_APP_SERVER_BINDING_MAX_ENTRIES,
 			overflowPolicy: "reject-new"
-		});
+		};
+		const openBindingStateStore = () => bindingStateStore ??= api.runtime.state.openSyncKeyedStore(bindingStateOptions);
+		const openBindingMutationStore = () => bindingMutationStore ??= api.runtime.state.openKeyedStore(bindingStateOptions);
 		const lazyBindingStateStore = {
 			deleteIf: (key, predicate) => openBindingStateStore().deleteIf(key, predicate),
 			entries: () => openBindingStateStore().entries(),
@@ -1788,9 +1749,10 @@ var codex_default = definePluginEntry({
 				return store.lookupMany?.bind(store);
 			},
 			registerIfAbsent: (key, value, options) => openBindingStateStore().registerIfAbsent(key, value, options),
-			get update() {
-				const store = openBindingStateStore();
-				return store.update?.bind(store);
+			withCurrent: (authority) => {
+				const store = openBindingMutationStore();
+				if (!store.withCurrent) throw new Error("Codex bindings require action-bound plugin-state mutations");
+				return store.withCurrent(authority);
 			}
 		};
 		const openManagedThreadStateStore = () => managedThreadStateStore ??= api.runtime.state.openKeyedStore({
@@ -1918,21 +1880,13 @@ var codex_default = definePluginEntry({
 				}),
 				codexPluginsManagementIo: {
 					readConfig: () => {
-						const plugins = (api.runtime.config?.current?.() ?? {}).plugins;
-						if (!plugins || typeof plugins !== "object") return Promise.resolve({});
-						const entries = plugins.entries;
-						if (!entries || typeof entries !== "object") return Promise.resolve({});
-						const codexEntry = entries.codex;
-						if (!codexEntry || typeof codexEntry !== "object") return Promise.resolve({});
-						const config = codexEntry.config;
-						if (!config || typeof config !== "object") return Promise.resolve({});
-						const codexPlugins = config.codexPlugins;
+						const codexPlugins = resolveCurrentConfig()?.plugins?.entries?.codex?.config?.codexPlugins;
 						if (!codexPlugins || typeof codexPlugins !== "object") return Promise.resolve({});
-						const declared = codexPlugins.plugins;
-						if (!declared || typeof declared !== "object") return Promise.resolve({ enabled: codexPlugins.enabled === true });
+						const enabled = "enabled" in codexPlugins && codexPlugins.enabled === true;
+						const declared = "plugins" in codexPlugins ? codexPlugins.plugins : void 0;
 						return Promise.resolve({
-							enabled: codexPlugins.enabled === true,
-							plugins: declared
+							enabled,
+							...declared && typeof declared === "object" ? { plugins: declared } : {}
 						});
 					},
 					mutate: async (update, assertCurrent) => {
@@ -1940,18 +1894,12 @@ var codex_default = definePluginEntry({
 						await mutateConfigFile({
 							writeOptions: { assertCurrent },
 							mutate: (draft) => {
-								const root = draft;
-								root.plugins = root.plugins ?? {};
-								const pluginsBlock = root.plugins;
-								pluginsBlock.entries = pluginsBlock.entries ?? {};
-								const entries = pluginsBlock.entries;
-								entries.codex = entries.codex ?? {};
-								const codexEntry = entries.codex;
-								codexEntry.config = codexEntry.config ?? {};
-								const config = codexEntry.config;
-								config.codexPlugins = config.codexPlugins ?? {};
-								const codexPlugins = config.codexPlugins;
-								codexPlugins.plugins = codexPlugins.plugins ?? {};
+								draft.plugins ??= {};
+								draft.plugins.entries ??= {};
+								const entry = draft.plugins.entries.codex ??= {};
+								const config = entry.config ??= {};
+								const codexPlugins = config.codexPlugins ??= {};
+								codexPlugins.plugins ??= {};
 								update(codexPlugins);
 							}
 						});
@@ -1977,7 +1925,7 @@ var codex_default = definePluginEntry({
 			if (endedSessionKey && nextSessionKey && nextSessionKey !== endedSessionKey) return;
 			if (event.nextSessionId?.trim() === event.sessionId.trim()) return;
 			const config = resolveCurrentConfig();
-			const [{ sessionBindingIdentity }, { retireCodexAppServerSessionGeneration }] = await Promise.all([import("./.setup/session-binding-Cm0apEbd.mjs").then((n) => n.s), import("./.setup/session-retirement-BH-S6qkJ.mjs")]);
+			const [{ sessionBindingIdentity }, { retireCodexAppServerSessionGeneration }] = await Promise.all([import("./.setup/session-binding-DGCYAfvD.mjs").then((n) => n.s), import("./.setup/session-retirement-qMTxkNx2.mjs")]);
 			await retireCodexAppServerSessionGeneration({
 				bindingStore,
 				identity: sessionBindingIdentity({