@openclaw/codex 2026.9.8 → 2026.10.1-beta.1

package/dist/.setup/{provider-capabilities-DG5qbsUZ.mjs → shell-dynamic-tools-Do9lIAT1.mjs}

@@ -1,11 +1,19 @@
-import { h as releaseLeasedSharedCodexAppServerClient } from "./shared-client-CJCTeFpQ.mjs";
-import { dt as normalizeCodexDynamicToolName } from "./thread-requests-OWGOiDaV.mjs";
+import { ft as normalizeCodexDynamicToolName } from "./thread-requests-COrRJcZb.mjs";
 import { pinExecToolTarget } from "openclaw/plugin-sdk/codex-mcp-projection";
 import { loadNodeExecAvailability } from "openclaw/plugin-sdk/node-selection-runtime";
 //#region extensions/codex/src/app-server/shell-dynamic-tools.ts
 const CODEX_NODE_EXEC_DYNAMIC_TOOL_NAME = "node_exec";
 const CODEX_GATEWAY_EXEC_DYNAMIC_TOOL_NAME = "gateway_exec";
 const CODEX_GATEWAY_PROCESS_DYNAMIC_TOOL_NAME = "gateway_process";
+const CODEX_DISABLED_NATIVE_SHELL_DYNAMIC_TOOLS = /* @__PURE__ */ new Set([
+	"exec",
+	"process",
+	"sandbox_exec",
+	"sandbox_process",
+	CODEX_GATEWAY_EXEC_DYNAMIC_TOOL_NAME,
+	CODEX_GATEWAY_PROCESS_DYNAMIC_TOOL_NAME,
+	CODEX_NODE_EXEC_DYNAMIC_TOOL_NAME
+]);
 const PROCESS_FOLLOWUP_TEXT = "Use process (list/poll/log/write/send-keys/submit/paste/kill/clear/remove) for follow-up.";
 function isCodexDynamicToolExcluded(config, names) {
 	const normalizedNames = new Set(names.map((name) => normalizeCodexDynamicToolName(name)));
@@ -67,58 +75,11 @@ function createSandboxProcessProjection(processTool) {
 		description: "Manage background shell sessions through OpenClaw's configured sandbox backend for this session: list, poll, log, write, send-keys, submit, paste, kill, clear, or remove. Use only for sandbox follow-up; use Codex's native shell session handling only when no OpenClaw sandbox is active and native Code Mode is available."
 	};
 }
-//#endregion
-//#region extensions/codex/src/app-server/provider-capabilities.ts
-function resolveOverriddenProviderWebSearchSupport(modelProviderOverride) {
-	const provider = modelProviderOverride?.trim().toLowerCase();
-	if (!provider) return;
-	return provider === "openai" ? "supported" : "unsupported";
-}
-async function readConfiguredProviderWebSearchSupport(params) {
-	if (params.expectedNativeModelProvider) {
-		if (((await params.client.request("config/read", { includeLayers: false }, {
-			timeoutMs: params.timeoutMs,
-			signal: params.signal
-		})).config.model_provider ?? "openai") !== params.expectedNativeModelProvider) return "unknown";
-	}
-	return (await params.client.request("modelProvider/capabilities/read", {}, {
-		timeoutMs: params.timeoutMs,
-		signal: params.signal
-	})).webSearch ? "supported" : "unsupported";
-}
-async function resolveCodexProviderWebSearchSupportForClient(params) {
-	const overrideSupport = resolveOverriddenProviderWebSearchSupport(params.modelProviderOverride);
-	if (overrideSupport) return overrideSupport;
-	try {
-		return await readConfiguredProviderWebSearchSupport(params);
-	} catch {
-		return "unknown";
-	}
-}
-async function resolveCodexProviderWebSearchSupport(params) {
-	const overrideSupport = resolveOverriddenProviderWebSearchSupport(params.modelProviderOverride);
-	if (overrideSupport) return overrideSupport;
-	let client;
-	try {
-		client = await params.clientFactory({
-			startOptions: params.appServer.start,
-			...params.preparedAuth ? { preparedAuth: params.preparedAuth } : { authProfileId: params.authProfileId },
-			agentDir: params.agentDir,
-			config: params.config,
-			timeoutMs: params.appServer.requestTimeoutMs
-		});
-		return await resolveCodexProviderWebSearchSupportForClient({
-			client,
-			timeoutMs: params.appServer.requestTimeoutMs,
-			modelProviderOverride: params.modelProviderOverride,
-			expectedNativeModelProvider: params.expectedNativeModelProvider,
-			signal: params.signal
-		});
-	} catch {
-		return "unknown";
-	} finally {
-		if (client) releaseLeasedSharedCodexAppServerClient(client);
-	}
+/** Keeps replacement shell tools direct even when model metadata mandates Codex Code Mode. */
+function placeDisabledNativeShellToolsInDirectNamespace(tools, nativeToolSurfaceEnabled) {
+	if (nativeToolSurfaceEnabled !== false) return tools;
+	for (const tool of tools) if (CODEX_DISABLED_NATIVE_SHELL_DYNAMIC_TOOLS.has(normalizeCodexDynamicToolName(tool.name))) tool.catalogMode = "direct-only";
+	return tools;
 }
 //#endregion
-export { CODEX_NODE_EXEC_DYNAMIC_TOOL_NAME as a, createNodeExecAliasDynamicTool as c, isCodexDynamicToolExcluded as d, CODEX_GATEWAY_PROCESS_DYNAMIC_TOOL_NAME as i, createSandboxExecProjection as l, resolveCodexProviderWebSearchSupportForClient as n, createGatewayExecProjection as o, CODEX_GATEWAY_EXEC_DYNAMIC_TOOL_NAME as r, createGatewayProcessProjection as s, resolveCodexProviderWebSearchSupport as t, createSandboxProcessProjection as u };
+export { createGatewayProcessProjection as a, createSandboxProcessProjection as c, createGatewayExecProjection as i, isCodexDynamicToolExcluded as l, CODEX_GATEWAY_PROCESS_DYNAMIC_TOOL_NAME as n, createNodeExecAliasDynamicTool as o, CODEX_NODE_EXEC_DYNAMIC_TOOL_NAME as r, createSandboxExecProjection as s, CODEX_GATEWAY_EXEC_DYNAMIC_TOOL_NAME as t, placeDisabledNativeShellToolsInDirectNamespace as u };

package/dist/.setup/{side-question-BLeGj7TQ.mjs → side-question-B7T0_GEC.mjs}

@@ -1,30 +1,32 @@
 import { i as isJsonObject } from "./protocol-CANUwXJ3.mjs";
-import { v as sessionBindingIdentity } from "./session-binding-record-Oe9L-CNY.mjs";
-import { c as shouldAutoApproveCodexAppServerApprovals, l as withMcpElicitationsApprovalPolicy, m as readCodexRequirementsToml, n as hasCodexMcpToolApprovalOverrides } from "./config-security-CE-FcGw9.mjs";
-import { c as isCodexPairedNodeRemoteExecPlacementSandbox, d as readCodexPluginConfig, l as isCodexRemoteExecPlacementSandbox, u as isCodexSandboxExecServerEnabled } from "./config-parsing-b088LyhT.mjs";
-import { i as resolveCodexAppServerHomeScope, l as resolveCodexModelBackedReviewerPolicyContext } from "./config-options-CzyWLTJt.mjs";
-import { n as formatCodexUsageLimitErrorMessage } from "./rate-limits-B7-X2TgG.mjs";
-import { i as resolveCodexBindingAppServerConnection, r as requireCodexSupervisionModelSelection } from "./binding-connection-DTtN1KrX.mjs";
-import { n as canUseCodexModelBackedApprovalsReviewerForModel, r as resolveOpenClawExecPolicyForCodexAppServer } from "./config-DKhXquav.mjs";
-import { X as readRecentCodexRateLimits, b as withLeasedCodexAppServerClientStartSelectionRetry, c as getLeasedSharedCodexAppServerClient, m as releaseCodexAppServerClientLease, tt as resolveCodexAppServerPreparedAuthHandoff } from "./shared-client-CJCTeFpQ.mjs";
-import { A as handleDynamicToolCallWithTimeout, B as resolveCodexToolAbortTerminalReason, P as resolveDynamicToolCallTimeoutMs, S as assertCodexTurnStartResponse, i as isCodexAppServerApprovalRequest, k as createCodexElicitationResponse, s as isCodexAppServerIndeterminateRequestCancellationError, w as readCodexDynamicToolCallParams, y as assertCodexThreadForkResponse, z as toCodexDynamicToolProtocolResponse } from "./client-qyUBJlGZ.mjs";
-import { f as terminateCodexBackgroundTerminals, p as unsubscribeCodexThreadBestEffort, s as interruptCodexTurnAndWaitBestEffort, u as retireUnsafeCodexTurnClientBestEffort } from "./attempt-client-cleanup-B-S7ngS_.mjs";
-import { t as CodexEphemeralTurn } from "./ephemeral-turn-DiCS1ijR.mjs";
-import { Ct as refreshCodexPluginAppApprovalPolicy, D as buildCodexNativeHookRelayConfig, M as resolveCodexNativeHookRelayEvents, N as resolveCodexNativeHookRelayTtlMs, O as buildCodexNativeHookRelayDisabledConfig, St as mergeCodexThreadConfigs, ft as resolveCodexDynamicToolsLoading, g as CODEX_NATIVE_PERSONALITY_NONE, p as resolveCodexWebSearchPlan, r as buildCodexRuntimeThreadConfig, y as resolveCodexAppServerThreadModelSelection } from "./thread-requests-OWGOiDaV.mjs";
-import { S as resolveCodexAppServerReasoningEffort, o as buildCodexUserInput, r as buildCodexTemporalAdditionalContext, x as readCodexSupportedReasoningEfforts } from "./thread-lifecycle-_bAbjedG.mjs";
-import { o as resolveCodexSessionBinding } from "./session-binding-DGCYAfvD.mjs";
-import { a as refreshCodexThreadPolicy, i as assertCodexSupervisionThreadLineage, n as CodexThreadPolicyHandoffError } from "./thread-policy-gNPzzpVp.mjs";
-import { t as resolveCodexNativeExecutionBlock } from "./sandbox-guard-DjCz2eOw.mjs";
-import { E as CodexNativeToolLifecycleProjector, a as emitDynamicToolStartedDiagnostic, b as createCodexNativePreToolUseFailureBuffer, c as buildDynamicTools, f as resolveCodexExternalSandboxPolicyForOpenClawSandbox, g as shouldRequireCodexSandboxExecServerEnvironment, h as shouldEnableCodexAppServerNativeToolSurface, i as emitDynamicToolErrorDiagnostic, m as resolveCodexSandboxEnvironmentSelection, o as emitDynamicToolTerminalDiagnostic, p as resolveCodexMessageToolProvider, r as routeCodexAppServerElicitationRequest, s as handleCodexAppServerApprovalRequest, t as createCodexDynamicToolBridge, v as ensureCodexSandboxExecServerEnvironment, y as releaseCodexSandboxExecServerEnvironment } from "./dynamic-tools-Db2sY5cZ.mjs";
-import { a as resolveCodexAppServerForModelProvider, i as resolveCodexSessionPermissionCwd, n as applyCodexSessionPermissionPolicy, r as resolveCodexEffectiveSessionPermissionPolicy, t as CODEX_SESSION_PERMISSION_EXEC_MODES } from "./session-permission-policy-Ci_fVX6y.mjs";
-import { n as resolveCodexProviderWebSearchSupportForClient } from "./provider-capabilities-DG5qbsUZ.mjs";
+import { m as sessionBindingIdentity } from "./session-binding-record-BZB8RgcF.mjs";
+import { c as shouldAutoApproveCodexAppServerApprovals, f as readCodexRequirementsToml, l as withMcpElicitationsApprovalPolicy, n as hasCodexMcpToolApprovalOverrides } from "./config-security-KAPScztc.mjs";
+import { c as isCodexPairedNodeRemoteExecPlacementSandbox, d as readCodexPluginConfig, l as isCodexRemoteExecPlacementSandbox, u as isCodexSandboxExecServerEnabled } from "./config-parsing-BQq-CHTF.mjs";
+import { i as resolveCodexAppServerHomeScope, l as resolveCodexModelBackedReviewerPolicyContext } from "./config-options-HG_Rr3W_.mjs";
+import { n as formatCodexUsageLimitErrorMessage } from "./rate-limits-CMPy24F5.mjs";
+import { i as resolveCodexBindingAppServerConnection, r as requireCodexSupervisionModelSelection } from "./binding-connection-C-08ez1w.mjs";
+import { n as canUseCodexModelBackedApprovalsReviewerForModel, r as resolveOpenClawExecPolicyForCodexAppServer } from "./config-0Gxk3_eq.mjs";
+import { X as readRecentCodexRateLimits, b as withLeasedCodexAppServerClientStartSelectionRetry, c as getLeasedSharedCodexAppServerClient, m as releaseCodexAppServerClientLease, tt as resolveCodexAppServerPreparedAuthHandoff } from "./shared-client-DJJ3ljH2.mjs";
+import { N as toCodexDynamicToolProtocolResponse, P as resolveCodexToolAbortTerminalReason, T as handleDynamicToolCallWithTimeout, _ as assertCodexTurnStartResponse, a as isCodexAppServerIndeterminateRequestCancellationError, k as resolveDynamicToolCallTimeoutMs, m as assertCodexThreadForkResponse, r as isCodexAppServerApprovalRequest, w as createCodexElicitationResponse, y as readCodexDynamicToolCallParams } from "./client-CBzEVDyb.mjs";
+import { d as terminateCodexBackgroundTerminals, f as unsubscribeCodexThreadBestEffort, l as retireUnsafeCodexTurnClientBestEffort, s as interruptCodexTurnAndWaitBestEffort } from "./attempt-client-cleanup-yLjGwbwT.mjs";
+import { t as CodexEphemeralTurn } from "./ephemeral-turn-oPKxs3ia.mjs";
+import { Ct as mergeCodexThreadConfigs, N as resolveCodexNativeHookRelayEvents, O as buildCodexNativeHookRelayConfig, P as resolveCodexNativeHookRelayTtlMs, _ as CODEX_NATIVE_PERSONALITY_NONE, b as resolveCodexAppServerThreadModelSelection, k as buildCodexNativeHookRelayDisabledConfig, m as resolveCodexWebSearchPlan, pt as resolveCodexDynamicToolsLoading, r as buildCodexRuntimeThreadConfig, wt as refreshCodexPluginAppApprovalPolicy } from "./thread-requests-COrRJcZb.mjs";
+import { b as resolveCodexAppServerReasoningEffort, o as buildCodexUserInput, r as buildCodexTemporalAdditionalContext, y as readCodexSupportedReasoningEfforts } from "./thread-lifecycle-DkcoX9q-.mjs";
+import { r as resolveCodexSessionBinding } from "./session-binding-Ce7BqiPN.mjs";
+import { i as assertCodexSupervisionThreadLineage, n as CodexThreadPolicyHandoffError, o as refreshCodexThreadPolicy } from "./thread-policy-CXZV97TS.mjs";
+import { t as resolveCodexNativeExecutionBlock } from "./sandbox-guard-WqE8yPge.mjs";
+import { a as resolveCodexExternalSandboxPolicyForOpenClawSandbox, c as shouldEnableCodexAppServerNativeToolSurface, l as shouldRequireCodexSandboxExecServerEnvironment, o as resolveCodexMessageToolProvider, s as resolveCodexSandboxEnvironmentSelection, t as buildDynamicTools } from "./dynamic-tool-build-CVrx02cH.mjs";
+import { i as resolveCodexSessionPermissionCwd, n as applyCodexSessionPermissionPolicy, r as resolveCodexEffectiveSessionPermissionPolicy, t as CODEX_SESSION_PERMISSION_EXEC_MODES } from "./session-permission-policy-BxIUJ0Zd.mjs";
+import { a as emitDynamicToolStartedDiagnostic, c as ensureCodexSandboxExecServerEnvironment, i as emitDynamicToolErrorDiagnostic, l as releaseCodexSandboxExecServerEnvironment, m as CodexNativeToolLifecycleProjector, o as emitDynamicToolTerminalDiagnostic, r as routeCodexAppServerElicitationRequest, s as handleCodexAppServerApprovalRequest, t as createCodexDynamicToolBridge, u as createCodexNativePreToolUseFailureBuffer } from "./dynamic-tools-DdsymYGQ.mjs";
+import { t as resolveCodexAppServerForModelProvider } from "./app-server-policy-Bg4FZw1f.mjs";
+import { n as resolveCodexProviderWebSearchSupportForClient } from "./provider-capabilities-Z5ZbBxqP.mjs";
 import { readStringField } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { randomUUID } from "node:crypto";
 import { isDeepStrictEqual } from "node:util";
 import { resolveSessionAgentIdsStrict } from "openclaw/plugin-sdk/agent-scope-runtime";
 import { formatErrorMessage } from "openclaw/plugin-sdk/error-runtime";
-import { resolveAgentWorkspaceDir } from "openclaw/plugin-sdk/agent-runtime";
 import { buildAgentHookContextChannelFields, embeddedAgentLog, formatErrorMessage as formatErrorMessage$1, resolveSandboxContext, runAgentCleanupStep } from "openclaw/plugin-sdk/agent-harness-runtime";
+import { resolveAgentWorkspaceDir } from "openclaw/plugin-sdk/agent-runtime";
 import { loadExecApprovals } from "openclaw/plugin-sdk/exec-approvals-runtime";
 import { loadCodexBundleMcpApprovalConfig, resolveCodexMcpToolOverridesForAgent } from "openclaw/plugin-sdk/codex-mcp-projection";
 import { registerNativeHookRelayForBundledRuntime } from "openclaw/plugin-sdk/native-hook-relay-runtime";
@@ -81,6 +83,69 @@ You may perform non-mutating inspection, including reading or searching files an
 
 Do not modify files, source, git state, permissions, configuration, workspace state, or external state unless the user explicitly requests that mutation in this side conversation. Do not request escalated permissions or broader sandbox access unless the user explicitly requests a mutation that requires it. If the user explicitly requests a mutation, keep it minimal, local to the request, and avoid disrupting the main thread.`;
 //#endregion
+//#region extensions/codex/src/app-server/side-question-run-params.ts
+function buildSideRunAttemptParams(params, options) {
+	return {
+		params,
+		config: params.cfg,
+		agentDir: params.agentDir,
+		provider: params.provider,
+		modelId: params.model,
+		model: params.runtimeModel ?? {
+			id: params.model,
+			provider: params.provider
+		},
+		prompt: params.question,
+		timeoutMs: options.timeoutMs,
+		sessionId: params.sessionId,
+		sessionFile: params.sessionFile,
+		sessionKey: params.sessionKey,
+		...params.sandboxSessionKey ? { sandboxSessionKey: params.sandboxSessionKey } : {},
+		agentId: params.agentId,
+		...params.messageChannel ? { messageChannel: params.messageChannel } : {},
+		...params.messageProvider ? { messageProvider: params.messageProvider } : {},
+		...params.chatType ? { chatType: params.chatType } : {},
+		...params.agentAccountId ? { agentAccountId: params.agentAccountId } : {},
+		...params.messageTo ? { messageTo: params.messageTo } : {},
+		...params.messageThreadId !== void 0 ? { messageThreadId: params.messageThreadId } : {},
+		...params.chatId ? { chatId: params.chatId } : {},
+		...params.messageActionTurnCapability ? { messageActionTurnCapability: params.messageActionTurnCapability } : {},
+		...params.groupId !== void 0 ? { groupId: params.groupId } : {},
+		...params.groupChannel !== void 0 ? { groupChannel: params.groupChannel } : {},
+		...params.groupSpace !== void 0 ? { groupSpace: params.groupSpace } : {},
+		...params.memberRoleIds ? { memberRoleIds: params.memberRoleIds } : {},
+		...params.spawnedBy !== void 0 ? { spawnedBy: params.spawnedBy } : {},
+		...params.senderId !== void 0 ? { senderId: params.senderId } : {},
+		...params.senderName !== void 0 ? { senderName: params.senderName } : {},
+		...params.senderUsername !== void 0 ? { senderUsername: params.senderUsername } : {},
+		...params.senderE164 !== void 0 ? { senderE164: params.senderE164 } : {},
+		...params.senderIsOwner !== void 0 ? { senderIsOwner: params.senderIsOwner } : {},
+		...params.currentChannelId ? { currentChannelId: params.currentChannelId } : {},
+		...params.toolsAllow ? { toolsAllow: params.toolsAllow } : {},
+		workspaceDir: options.cwd,
+		authProfileId: options.authProfileId,
+		authProfileIdSource: options.authProfileId ? params.preparedRuntimeAuth.plan.forwardedAuthProfileSource : void 0,
+		thinkLevel: params.resolvedThinkLevel ?? "off",
+		resolvedReasoningLevel: params.resolvedReasoningLevel,
+		authStorage: params.preparedRuntimeAuth.authStorage,
+		authProfileStore: params.preparedRuntimeAuth.authProfileStore,
+		modelRegistry: params.preparedRuntimeAuth.modelRegistry,
+		preparedModelRuntime: params.preparedModelRuntime,
+		...params.preparedRuntimeAuth.resolvedApiKey ? { resolvedApiKey: params.preparedRuntimeAuth.resolvedApiKey } : {},
+		runId: options.runId,
+		abortSignal: params.opts?.abortSignal,
+		onAgentEvent: (event) => {
+			if (event.stream === "approval") params.opts?.onApprovalEvent?.(event.data);
+		},
+		onBlockReply: params.opts?.onBlockReply,
+		onPartialReply: params.opts?.onPartialReply,
+		onToolResult: params.opts?.onToolResult,
+		requireExplicitMessageTarget: true,
+		hostCapabilities: params.hostCapabilities,
+		sandbox: params.sandbox
+	};
+}
+//#endregion
 //#region extensions/codex/src/app-server/side-question.ts
 const SIDE_QUESTION_COMPLETION_TIMEOUT_MS = 6e5;
 var CodexSideQuestionTimeoutError = class extends Error {
@@ -97,7 +162,7 @@ async function runCodexAppServerSideQuestion(params, options) {
 		config: params.cfg
 	});
 	const hostCapabilities = params.hostCapabilities;
-	const { binding, assertCurrent } = await resolveCodexSessionBinding({
+	const { binding, authority } = await resolveCodexSessionBinding({
 		bindingStore: options.bindingStore,
 		identity: bindingIdentity,
 		config: params.cfg,
@@ -105,6 +170,7 @@ async function runCodexAppServerSideQuestion(params, options) {
 		assertCurrent: hostCapabilities.assertActive,
 		signal: params.opts?.abortSignal
 	});
+	const assertCurrent = authority.assertCurrent;
 	if (!binding?.threadId) throw new Error("Codex /btw needs an active Codex thread. Send a normal message first, then try /btw again.");
 	if (isCodexPairedNodeRemoteExecPlacementSandbox(params.sandbox)) throw new Error("Normal Codex turns are supported on nodes, but /btw is not yet bound to the active placement.");
 	const pluginConfig = readCodexPluginConfig(options.pluginConfig);
@@ -256,7 +322,7 @@ async function runCodexAppServerSideQuestion(params, options) {
 	if (nativeExecutionBlock) throw new Error(nativeExecutionBlock);
 	if (!nativeToolSurfaceEnabled) throw new Error("Codex-native /btw side-question mode is unavailable because the effective tool policy restricts Codex native tools for this session.");
 	const clientOptions = {
-		assertCurrent,
+		assertCurrent: authority.assertLegacyCurrent,
 		startOptions: appServer.start,
 		timeoutMs: appServer.requestTimeoutMs,
 		authRequirement: preparedRuntimeAuth.plan.modelRoute?.authRequirement,
@@ -370,7 +436,7 @@ async function runCodexAppServerSideQuestion(params, options) {
 				});
 				return approvalResult.kind === "handled" ? approvalResult.response : createCodexElicitationResponse("decline", null, { message: "OpenClaw Codex side questions do not support interactive MCP input." });
 			}
-			if (request.method === "item/tool/requestUserInput") return isSideUserInputRequest(request.params, childThreadId, turnId) ? { answers: {} } : void 0;
+			if (request.method === "item/tool/requestUserInput") return isJsonObject(request.params) && request.params.threadId === childThreadId && request.params.turnId === turnId ? { answers: {} } : void 0;
 			if (isCodexAppServerApprovalRequest(request.method)) return handleCodexAppServerApprovalRequest({
 				method: request.method,
 				requestParams: request.params,
@@ -459,7 +525,7 @@ async function runCodexAppServerSideQuestion(params, options) {
 				}),
 				signal: runAbortController.signal,
 				runBeforeToolCall: sideRunParams.hostCapabilities.runBeforeToolCall,
-				assertActive: assertCurrent,
+				assertActive: authority.assertLegacyCurrent,
 				onPreToolUseFailure: (failure) => {
 					if (!nativePreToolUseFailures.active && nativeToolLifecycleProjector) nativeToolLifecycleProjector.recordPreToolUseFailure(failure, nativeToolRunWasAbortedBeforeCleanup);
 					else nativePreToolUseFailures.record(failure);
@@ -493,6 +559,7 @@ async function runCodexAppServerSideQuestion(params, options) {
 					const scoped = requestOptions();
 					return {
 						...scoped,
+						withCurrent: authority.withCurrent,
 						assertCurrent: () => {
 							scoped.assertCurrent();
 							assertCurrentBinding();
@@ -567,6 +634,7 @@ async function runCodexAppServerSideQuestion(params, options) {
 						threadId: childThreadId,
 						developerInstructions: SIDE_DEVELOPER_INSTRUCTIONS,
 						...scoped,
+						withCurrent: authority.withCurrent,
 						signal: runAbortController.signal,
 						assertCurrent: () => {
 							assertCurrent();
@@ -579,6 +647,9 @@ async function runCodexAppServerSideQuestion(params, options) {
 					throw error instanceof CodexThreadPolicyHandoffError ? error : new CodexThreadPolicyHandoffError("not-written", error);
 				}
 				return response.thread.id;
+			}, {
+				assertCurrent,
+				authority
 			}),
 			onClientChange: (nextClient) => {
 				client = nextClient;
@@ -615,7 +686,8 @@ async function runCodexAppServerSideQuestion(params, options) {
 		}, {
 			timeoutMs: appServer.requestTimeoutMs,
 			signal: runAbortController.signal,
-			assertCurrent
+			assertCurrent,
+			withCurrent: authority.withCurrent
 		}).catch((error) => {
 			if (isCodexAppServerIndeterminateRequestCancellationError(error)) turnId = "";
 			throw error;
@@ -650,10 +722,10 @@ async function runCodexAppServerSideQuestion(params, options) {
 		if (result.turn?.status === "interrupted") throw new Error("Codex /btw side thread was interrupted.");
 		assertCurrent();
 		if (!result.text) throw new Error("Codex /btw completed without an answer.");
-		return {
+		return await authority.withCurrent(() => ({
 			text: result.text,
 			usage: result.usage
-		};
+		}));
 	} catch (error) {
 		primaryFailure = { error };
 		throw error;
@@ -693,67 +765,6 @@ async function runCodexAppServerSideQuestion(params, options) {
 		});
 	}
 }
-function buildSideRunAttemptParams(params, options) {
-	return {
-		params,
-		config: params.cfg,
-		agentDir: params.agentDir,
-		provider: params.provider,
-		modelId: params.model,
-		model: params.runtimeModel ?? {
-			id: params.model,
-			provider: params.provider
-		},
-		prompt: params.question,
-		timeoutMs: options.timeoutMs,
-		sessionId: params.sessionId,
-		sessionFile: params.sessionFile,
-		sessionKey: params.sessionKey,
-		...params.sandboxSessionKey ? { sandboxSessionKey: params.sandboxSessionKey } : {},
-		agentId: params.agentId,
-		...params.messageChannel ? { messageChannel: params.messageChannel } : {},
-		...params.messageProvider ? { messageProvider: params.messageProvider } : {},
-		...params.chatType ? { chatType: params.chatType } : {},
-		...params.agentAccountId ? { agentAccountId: params.agentAccountId } : {},
-		...params.messageTo ? { messageTo: params.messageTo } : {},
-		...params.messageThreadId !== void 0 ? { messageThreadId: params.messageThreadId } : {},
-		...params.chatId ? { chatId: params.chatId } : {},
-		...params.messageActionTurnCapability ? { messageActionTurnCapability: params.messageActionTurnCapability } : {},
-		...params.groupId !== void 0 ? { groupId: params.groupId } : {},
-		...params.groupChannel !== void 0 ? { groupChannel: params.groupChannel } : {},
-		...params.groupSpace !== void 0 ? { groupSpace: params.groupSpace } : {},
-		...params.memberRoleIds ? { memberRoleIds: params.memberRoleIds } : {},
-		...params.spawnedBy !== void 0 ? { spawnedBy: params.spawnedBy } : {},
-		...params.senderId !== void 0 ? { senderId: params.senderId } : {},
-		...params.senderName !== void 0 ? { senderName: params.senderName } : {},
-		...params.senderUsername !== void 0 ? { senderUsername: params.senderUsername } : {},
-		...params.senderE164 !== void 0 ? { senderE164: params.senderE164 } : {},
-		...params.senderIsOwner !== void 0 ? { senderIsOwner: params.senderIsOwner } : {},
-		...params.currentChannelId ? { currentChannelId: params.currentChannelId } : {},
-		...params.toolsAllow ? { toolsAllow: params.toolsAllow } : {},
-		workspaceDir: options.cwd,
-		authProfileId: options.authProfileId,
-		authProfileIdSource: options.authProfileId ? params.preparedRuntimeAuth.plan.forwardedAuthProfileSource : void 0,
-		thinkLevel: params.resolvedThinkLevel ?? "off",
-		resolvedReasoningLevel: params.resolvedReasoningLevel,
-		authStorage: params.preparedRuntimeAuth.authStorage,
-		authProfileStore: params.preparedRuntimeAuth.authProfileStore,
-		modelRegistry: params.preparedRuntimeAuth.modelRegistry,
-		preparedModelRuntime: params.preparedModelRuntime,
-		...params.preparedRuntimeAuth.resolvedApiKey ? { resolvedApiKey: params.preparedRuntimeAuth.resolvedApiKey } : {},
-		runId: options.runId,
-		abortSignal: params.opts?.abortSignal,
-		onAgentEvent: (event) => {
-			if (event.stream === "approval") params.opts?.onApprovalEvent?.(event.data);
-		},
-		onBlockReply: params.opts?.onBlockReply,
-		onPartialReply: params.opts?.onPartialReply,
-		onToolResult: params.opts?.onToolResult,
-		requireExplicitMessageTarget: true,
-		hostCapabilities: params.hostCapabilities,
-		sandbox: params.sandbox
-	};
-}
 async function createCodexSideToolBridge(input) {
 	const { params } = input;
 	const sandboxSessionKey = params.sandboxSessionKey?.trim() || params.sessionKey?.trim() || params.sessionId || input.sessionAgentId;
@@ -811,9 +822,6 @@ async function createCodexSideToolBridge(input) {
 		webSearchPlan
 	};
 }
-function isSideUserInputRequest(value, threadId, turnId) {
-	return isJsonObject(value) && value.threadId === threadId && value.turnId === turnId;
-}
 async function forkCodexSideThread(client, params, options) {
 	try {
 		return await client.request("thread/fork", params, options);

package/dist/.setup/{source-CJis_1EF.mjs → source-DH70LqN0.mjs}

@@ -1,13 +1,13 @@
-import { a as marketplaceRef, n as isOpenAiCuratedMarketplace, o as pluginReadParams, u as CODEX_PLUGINS_MARKETPLACE_NAME } from "./plugin-inventory-Cky2XJUw.mjs";
-import { a as defaultCodexAppInventoryCache, r as buildCodexPluginAppCacheKey } from "./plugin-app-cache-key-BL9B5H0L.mjs";
-import { o as withCodexAppServerJsonClient } from "./request-BZOfsSXW.mjs";
-import "./config-DKhXquav.mjs";
-import { t as __exportAll } from "./session-binding-sidecars-jo6H8dFr.mjs";
+import { a as defaultCodexAppInventoryCache, r as buildCodexPluginAppCacheKey } from "./plugin-app-cache-key-BW8rd98k.mjs";
+import { a as withCodexAppServerJsonClient } from "./request-BH3FvYUE.mjs";
+import { a as pluginReadParams, i as marketplaceRef, l as CODEX_PLUGINS_MARKETPLACE_NAME, n as isOpenAiCuratedMarketplaceName } from "./plugin-inventory-Bf0_piTw.mjs";
+import "./config-0Gxk3_eq.mjs";
+import { t as __exportAll } from "./session-binding-sidecars-BrdV95Fg.mjs";
 import { asNonArrayRecord } from "openclaw/plugin-sdk/string-coerce-runtime";
 import path from "node:path";
 import os from "node:os";
 import fs from "node:fs/promises";
-import { coerceErrorMessage } from "openclaw/plugin-sdk/error-runtime";
+import { coerceErrorMessage, extractErrorCode } from "openclaw/plugin-sdk/error-runtime";
 import { isPathInside } from "openclaw/plugin-sdk/file-access-runtime";
 import { pathExists } from "openclaw/plugin-sdk/security-runtime";
 import { tryReadJson } from "@openclaw/fs-safe/json";
@@ -82,7 +82,7 @@ async function discoverCodexMemoryFile(candidate) {
 		if (!stat.isFile()) throw new Error(`Codex memory source must be a regular file: ${candidate.path}`);
 		return candidate;
 	} catch (error) {
-		if (error && typeof error === "object" && "code" in error && error.code === "ENOENT") return;
+		if (extractErrorCode(error) === "ENOENT") return;
 		throw error;
 	}
 }
@@ -114,9 +114,6 @@ function defaultCodexHome() {
 	const configuredHome = process.env.CODEX_HOME;
 	return resolveHomePath(configuredHome !== void 0 && configuredHome.length > 0 ? configuredHome : "~/.codex");
 }
-function personalAgentsSkillsDir() {
-	return path.join(resolveUserHomeDir(), ".agents", "skills");
-}
 async function discoverInstalledCuratedPlugins(codexHome, options = {}) {
 	const startOptions = sourceCodexAppServerStartOptions(codexHome);
 	try {
@@ -175,7 +172,7 @@ function sourceCodexAppServerStartOptions(codexHome) {
 function discoverInstalledCuratedPluginSources(response) {
 	const installedByName = /* @__PURE__ */ new Map();
 	for (const marketplace of response.marketplaces) {
-		if (!isOpenAiCuratedMarketplace(marketplace)) continue;
+		if (!isOpenAiCuratedMarketplaceName(marketplace.name)) continue;
 		const remote = !marketplace.path;
 		for (const summary of marketplace.plugins) {
 			if (!summary.installed) continue;
@@ -194,7 +191,7 @@ function discoverInstalledCuratedPluginSources(response) {
 					enabled: summary.enabled
 				},
 				marketplace: marketplaceRef(marketplace, CODEX_PLUGINS_MARKETPLACE_NAME),
-				...remote ? { readPluginName: summary.remotePluginId?.trim() || void 0 } : { readPluginName: pluginName },
+				readPluginName: remote ? summary.remotePluginId?.trim() || void 0 : pluginName,
 				remote
 			});
 		}
@@ -214,27 +211,34 @@ async function withPluginMigrationEligibility(params) {
 			});
 			continue;
 		}
-		const detail = await readPluginDetail(params.requestOptions, marketplace, plugin, readPluginName);
-		if (!detail.ok) {
+		let detail;
+		try {
+			if (!readPluginName) throw new Error(`Codex remote plugin "${plugin.pluginName ?? plugin.name}" has no readable remote plugin id.`);
+			detail = (await params.requestOptions.request({
+				method: "plugin/read",
+				requestParams: pluginReadParams(marketplace, readPluginName)
+			})).plugin;
+		} catch (error) {
+			const message = coerceErrorMessage(error);
 			evaluated.push({
 				...plugin,
 				migratable: false,
 				migrationBlock: {
 					code: "plugin_read_unavailable",
-					error: detail.error
+					error: message
 				},
-				message: `Codex plugin "${plugin.pluginName ?? plugin.name}" detail could not be read: ${detail.error}`
+				message: `Codex plugin "${plugin.pluginName ?? plugin.name}" detail could not be read: ${message}`
 			});
 			continue;
 		}
-		if (detail.detail.apps.length === 0) {
+		if (detail.apps.length === 0) {
 			evaluated.push({
 				...plugin,
 				migratable: true
 			});
 			continue;
 		}
-		const apps = detail.detail.apps.map(({ id, name }) => ({
+		const apps = detail.apps.map(({ id, name }) => ({
 			id,
 			name
 		})).toSorted((left, right) => left.id.localeCompare(right.id));
@@ -279,7 +283,7 @@ async function withPluginMigrationEligibility(params) {
 	const appInfoById = new Map(snapshot.apps.map((app) => [app.id, app]));
 	const installedAppsById = new Map(snapshot.installedApps.map((app) => [app.id, app]));
 	for (const { plugin, apps: declaredApps } of pending) {
-		const apps = declaredApps.map((app) => sourcePluginAppFactWithInventory(app, appInfoById.get(app.id), installedAppsById.get(app.id))).toSorted((left, right) => left.id.localeCompare(right.id));
+		const apps = declaredApps.map((app) => sourcePluginAppFactWithInventory(app, appInfoById.get(app.id), installedAppsById.get(app.id)));
 		const blockCode = migrationBlockCodeForApps(apps);
 		if (!blockCode) {
 			evaluated.push({
@@ -312,26 +316,6 @@ async function readSourceCodexAccount(options) {
 		default: return "missing";
 	}
 }
-async function readPluginDetail(options, marketplace, plugin, readPluginName) {
-	if (!readPluginName) return {
-		ok: false,
-		error: `Codex remote plugin "${plugin.pluginName ?? plugin.name}" has no readable remote plugin id.`
-	};
-	try {
-		return {
-			ok: true,
-			detail: (await options.request({
-				method: "plugin/read",
-				requestParams: pluginReadParams(marketplace, readPluginName)
-			})).plugin
-		};
-	} catch (error) {
-		return {
-			ok: false,
-			error: coerceErrorMessage(error)
-		};
-	}
-}
 async function refreshSourceAppInventory(options) {
 	const key = buildCodexPluginAppCacheKey({ appServer: { start: options.startOptions } });
 	const request = async (method, requestParams) => await options.request({
@@ -397,7 +381,7 @@ function pluginNameFromSummary(summary) {
 async function discoverCodexSource(options = {}) {
 	const codexHome = resolveHomePath(options.input?.trim() || defaultCodexHome());
 	const codexSkillsDir = path.join(codexHome, "skills");
-	const agentsSkillsDir = personalAgentsSkillsDir();
+	const agentsSkillsDir = path.join(resolveUserHomeDir(), ".agents", "skills");
 	const configPath = path.join(codexHome, "config.toml");
 	const authPath = path.join(codexHome, "auth.json");
 	const modelsCachePath = path.join(codexHome, "models_cache.json");