@openclaw/codex 2026.9.8 → 2026.10.1-beta.2

package/dist/.setup/{auth-cache-key-Dnps4W4_.mjs → auth-cache-key-CGm0UJOr.mjs}

@@ -1,6 +1,7 @@
-import { n as defineCodexBuildState } from "./build-state-DIQ5O_-S.mjs";
-import { u as resolveMacOSDesktopCodexAppPathCandidates } from "./managed-binary-kiWRhNRE.mjs";
-import { n as resolveCodexAppServerSpawnEnv } from "./transport-stdio-Bdegpn2V.mjs";
+import { n as defineCodexBuildState } from "./build-state-CqQnsg7T.mjs";
+import { u as resolveMacOSDesktopCodexAppPathCandidates } from "./managed-binary-C1VFoVPf.mjs";
+import { n as resolveCodexAppServerSpawnEnv } from "./transport-stdio-a0HDa2Mj.mjs";
+import { isRecord, normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { createHash } from "node:crypto";
 import fs, { constants, existsSync, watch } from "node:fs";
 import path from "node:path";
@@ -8,6 +9,7 @@ import os from "node:os";
 import fs$1 from "node:fs/promises";
 import { extractErrorCode } from "openclaw/plugin-sdk/error-runtime";
 import { sha256File } from "openclaw/plugin-sdk/file-access-runtime";
+import { sleepWithAbort } from "openclaw/plugin-sdk/retry-runtime";
 import { readSecretFile } from "openclaw/plugin-sdk/secret-file";
 //#region extensions/codex/src/app-server/desktop-generation-fingerprint.ts
 const MAX_COMPUTER_USE_PLUGIN_TREE_ENTRIES = 4096;
@@ -139,7 +141,6 @@ function createCodexDesktopGenerationOwner(params) {
 	let invalidation = 0;
 	let dirty = false;
 	let refresh;
-	let stopped = false;
 	const markDirty = () => {
 		invalidation += 1;
 		dirty = true;
@@ -148,13 +149,13 @@ function createCodexDesktopGenerationOwner(params) {
 		if (refresh) return refresh;
 		refresh = (async () => {
 			for (;;) {
-				if (stopped) throw new Error("Codex desktop generation owner stopped");
+				params.signal.throwIfAborted();
 				const observedInvalidation = invalidation;
 				const first = await params.readFingerprint();
-				await delay(SETTLE_DELAY_MS);
-				if (stopped) throw new Error("Codex desktop generation owner stopped");
+				await sleepWithAbort(SETTLE_DELAY_MS, params.signal, { ref: false });
+				params.signal.throwIfAborted();
 				const second = await params.readFingerprint();
-				if (stopped) throw new Error("Codex desktop generation owner stopped");
+				params.signal.throwIfAborted();
 				if (observedInvalidation !== invalidation || first !== second) continue;
 				const previous = generation;
 				generation = previous?.fingerprint === second ? previous : {
@@ -178,17 +179,12 @@ function createCodexDesktopGenerationOwner(params) {
 			markDirty();
 			return reconcile();
 		},
-		isCurrent: (candidate) => Boolean(candidate && !dirty && generation && candidate.epoch === generation.epoch && candidate.fingerprint === generation.fingerprint),
-		stop: () => {
-			stopped = true;
+		isCurrent: (candidate) => Boolean(candidate && !params.signal.aborted && !dirty && generation && candidate.epoch === generation.epoch && candidate.fingerprint === generation.fingerprint),
+		waitForIdle: async () => {
+			await refresh?.catch(() => {});
 		}
 	};
 }
-function delay(ms) {
-	return new Promise((resolve) => {
-		setTimeout(resolve, ms);
-	});
-}
 //#endregion
 //#region extensions/codex/src/app-server/desktop-generation.ts
 /** Lifecycle-owned generation for managed macOS Codex desktop artifacts. */
@@ -210,6 +206,7 @@ function createCodexDesktopGenerationService(params, runtime = {
 	watchPath: (watchedPath, options, listener) => watch(watchedPath, options, listener)
 }) {
 	return {
+		apiVersion: 2,
 		id: "codex-desktop-generation",
 		async start(ctx) {
 			if (runtime.platform !== "darwin") return;
@@ -217,6 +214,7 @@ function createCodexDesktopGenerationService(params, runtime = {
 			current.context = ctx;
 			current.runtime = { ...runtime };
 			current.owner = createCodexDesktopGenerationOwner({
+				signal: ctx.scheduler.signal,
 				readFingerprint: runtime.readFingerprint,
 				onGenerationChange: params.onGenerationChange,
 				initialGeneration: current.lastGeneration
@@ -226,46 +224,41 @@ function createCodexDesktopGenerationService(params, runtime = {
 		},
 		async stop() {
 			const current = state();
+			const owner = current.owner;
+			const scheduler = current.context?.scheduler;
+			scheduler?.beginClose();
 			current.lastGeneration = current.owner?.read() ?? current.lastGeneration;
-			current.owner?.stop();
 			current.owner = void 0;
 			current.armEpoch = (current.armEpoch ?? 0) + 1;
 			current.context = void 0;
 			current.runtime = void 0;
 			current.watchHealthy = void 0;
 			current.rearmDelayMs = void 0;
-			if (current.rearmTimer) {
-				clearTimeout(current.rearmTimer);
-				current.rearmTimer = void 0;
-			}
+			current.rearmPending = false;
 			closeWatchers(current);
+			await Promise.all([scheduler?.stop(), owner?.waitForIdle()]);
 		}
 	};
 }
 function armWatchers(current) {
 	const owner = current.owner;
-	if (!owner || current.watchers) return false;
+	const runtime = current.runtime;
+	if (!owner || !runtime || current.watchers) return false;
 	const armEpoch = (current.armEpoch ?? 0) + 1;
 	current.armEpoch = armEpoch;
 	const watchers = /* @__PURE__ */ new Set();
 	current.watchers = watchers;
 	const candidateNames = new Set(resolveMacOSDesktopCodexAppPathCandidates("darwin").map((candidate) => candidate.appName));
 	let complete = true;
-	for (const watchedPath of current.runtime?.resolveWatchPaths() ?? []) {
-		if (!current.runtime?.pathExists(watchedPath)) continue;
+	for (const watchedPath of runtime.resolveWatchPaths()) {
+		if (!runtime.pathExists(watchedPath)) continue;
 		try {
-			const watcher = current.runtime?.watchPath(watchedPath, { recursive: watchedPath !== APPLICATIONS_PATH }, (_eventType, filename) => {
+			const watcher = runtime.watchPath(watchedPath, { recursive: watchedPath !== APPLICATIONS_PATH }, (_eventType, filename) => {
 				if (!isCurrentArm(current, owner, watchers, armEpoch)) return;
 				if (watchedPath === APPLICATIONS_PATH && filename && !candidateNames.has(filename.toString().split(path.sep)[0] ?? "")) return;
 				owner.markDirty();
 				scheduleRearm(current, owner);
 			});
-			if (!watcher) {
-				complete = false;
-				reportWatcherFailure(current, owner, /* @__PURE__ */ new Error(`Could not watch ${watchedPath}`));
-				scheduleRearm(current, owner);
-				continue;
-			}
 			watchers.add(watcher);
 			watcher.on("error", (error) => {
 				if (!isCurrentArm(current, owner, watchers, armEpoch)) return;
@@ -290,30 +283,31 @@ function reportWatcherFailure(current, owner, error) {
 	current.context?.logger.warn(`codex desktop generation watcher failed: ${String(error)}`);
 }
 function isCurrentArm(current, owner, watchers, armEpoch) {
-	return current.owner === owner && current.watchers === watchers && current.armEpoch === armEpoch;
+	return current.owner === owner && !current.context?.scheduler.signal.aborted && current.watchers === watchers && current.armEpoch === armEpoch;
 }
 function scheduleRearm(current, owner) {
-	if (current.rearmTimer) {
-		if (current.watchHealthy === false) return;
-		clearTimeout(current.rearmTimer);
-	}
+	if (current.rearmPending && current.watchHealthy === false) return;
 	const delayMs = current.watchHealthy === false ? current.rearmDelayMs ?? REARM_INITIAL_DELAY_MS : REARM_INITIAL_DELAY_MS;
 	if (current.watchHealthy === false) current.rearmDelayMs = Math.min(delayMs * 2, REARM_MAX_DELAY_MS);
-	current.rearmTimer = setTimeout(() => {
-		current.rearmTimer = void 0;
-		if (current.owner !== owner) return;
-		const wasUnhealthy = current.watchHealthy === false;
-		closeWatchers(current);
-		if (!armWatchers(current) || wasUnhealthy) owner.markDirty();
-		refreshGeneration(current, owner, owner.wait());
-	}, delayMs);
-	current.rearmTimer.unref();
+	current.rearmPending = true;
+	current.context?.scheduler.schedule({
+		id: "watcher-rearm",
+		delayMs,
+		run: async () => {
+			current.rearmPending = false;
+			if (current.owner !== owner || current.context?.scheduler.signal.aborted) return;
+			const wasUnhealthy = current.watchHealthy === false;
+			closeWatchers(current);
+			if (!armWatchers(current) || wasUnhealthy) owner.markDirty();
+			await refreshGeneration(current, owner, owner.wait());
+		}
+	});
 }
 function refreshGeneration(current, owner, refresh) {
-	refresh.then(() => {
-		if (current.owner === owner && current.watchHealthy) current.context?.serviceHealth?.clearFailure();
+	return refresh.then(() => {
+		if (current.owner === owner && !current.context?.scheduler.signal.aborted && current.watchHealthy) current.context?.serviceHealth?.clearFailure();
 	}).catch((error) => {
-		if (current.owner !== owner) return;
+		if (current.owner !== owner || current.context?.scheduler.signal.aborted) return;
 		current.context?.serviceHealth?.reportFailure(error);
 		current.context?.logger.warn(`codex desktop generation refresh failed: ${String(error)}`);
 	});
@@ -324,6 +318,198 @@ function closeWatchers(current) {
 	for (const watcher of watchers ?? []) watcher.close();
 }
 //#endregion
+//#region extensions/codex/src/app-server/shared-client-lifecycle.ts
+/** Client ownership and synchronous retirement, independent of startup/auth execution. */
+function observeAcquire(options, observation) {
+	try {
+		options?.onAcquireObservation?.(observation);
+	} catch {}
+}
+function observeSharedClientAcquire(entry, options) {
+	const observer = (boundary) => observeAcquire(options, { boundary });
+	if (options?.onAcquireObservation) (entry.acquireBoundaryObservers ??= /* @__PURE__ */ new Set()).add(observer);
+	observeAcquire(options, {
+		boundary: entry.acquireBoundary ?? "entry-selection",
+		startup: entry.startup ? entry.acquireBoundary === "ready" ? "ready-cache-hit" : "joined-shared" : "created-shared"
+	});
+	return () => entry.acquireBoundaryObservers?.delete(observer);
+}
+function recordSharedClientAcquireBoundary(entry, boundary) {
+	entry.acquireBoundary = boundary;
+	for (const observer of entry.acquireBoundaryObservers ?? []) observer(boundary);
+}
+function getOrCreateSharedClientEntry(state, key) {
+	let entry = state.clients.get(key);
+	if (!entry) {
+		entry = {
+			key,
+			activeLeases: 0,
+			anonymousLeases: 0,
+			pendingAcquires: 0,
+			closeWhenIdle: false,
+			onStartedClientCallbacks: /* @__PURE__ */ new Set()
+		};
+		state.clients.set(key, entry);
+	}
+	return entry;
+}
+function closeSharedClientEntryIfUnclaimed(entry) {
+	if (entry.activeLeases > 0 || entry.pendingAcquires > 0) return false;
+	const state = getSharedCodexAppServerClientState();
+	if (state.clients.get(entry.key) !== entry) return false;
+	state.clients.delete(entry.key);
+	entry.client?.close();
+	return Boolean(entry.client);
+}
+const createCodexAppServerStartupLifetime = () => ({
+	controller: new AbortController(),
+	pending: /* @__PURE__ */ new Set()
+});
+function ownCodexStartup(lifetime, operation) {
+	lifetime.pending.add(operation);
+	const release = () => lifetime.pending.delete(operation);
+	operation.then(release, release);
+	return operation;
+}
+const getSharedCodexAppServerClientState = defineCodexBuildState("openclaw.codexAppServerClientState", () => ({
+	clients: /* @__PURE__ */ new Map(),
+	liveClients: /* @__PURE__ */ new Set(),
+	isolatedClients: /* @__PURE__ */ new Set(),
+	entriesByClient: /* @__PURE__ */ new WeakMap(),
+	desktopGenerationDrainChecks: /* @__PURE__ */ new Set(),
+	startup: createCodexAppServerStartupLifetime(),
+	startMetadata: /* @__PURE__ */ new WeakMap()
+}));
+function hasActiveSharedCodexAppServerWork() {
+	const state = getSharedCodexAppServerClientState();
+	if (state.startup.pending.size > 0 || state.startup.controller.signal.aborted) return true;
+	for (const entry of state.clients.values()) if (entry.activeLeases > 0 || entry.pendingAcquires > 0) return true;
+	for (const client of state.liveClients) {
+		const entry = state.entriesByClient.get(client);
+		if (entry && (entry.activeLeases > 0 || entry.pendingAcquires > 0)) return true;
+	}
+	return false;
+}
+function getCurrentSharedClientEntry(client) {
+	const state = getSharedCodexAppServerClientState();
+	const entry = client ? state.entriesByClient.get(client) : void 0;
+	return entry && entry.client === client && state.clients.get(entry.key) === entry ? entry : void 0;
+}
+/**
+* Retires a matching shared client. Default is graceful: detach from the map
+* (future acquisitions get a fresh client) and close once leases drain.
+* `failActiveLeases` is for suspect clients only (timed-out turns): it closes
+* the physical connection immediately so co-leased attempts hit the normal
+* client-closed retry path, and pending acquires reject instead of leasing
+* the poisoned process. Routine cleanup must NOT use it — it would abort
+* healthy sibling turns on a working client.
+*/
+function retireSharedCodexAppServerClientIfCurrent(client, opts) {
+	if (!client) return;
+	const state = getSharedCodexAppServerClientState();
+	const currentEntry = getCurrentSharedClientEntry(client);
+	const entry = currentEntry ?? state.entriesByClient.get(client);
+	if (!entry || entry.client !== client && !entry.closeError) return;
+	if (currentEntry) {
+		state.clients.delete(entry.key);
+		entry.closeWhenIdle = true;
+	}
+	if (opts?.failActiveLeases && (currentEntry || !entry.closeError)) {
+		entry.closeError = /* @__PURE__ */ new Error("codex app-server client is closed");
+		return {
+			activeLeases: entry.activeLeases,
+			closed: closeRetiredSharedClientEntry(entry)
+		};
+	}
+	return {
+		activeLeases: entry.activeLeases,
+		closed: currentEntry ? closeRetiredSharedClientEntryIfIdle(entry) : false
+	};
+}
+/** Gracefully retires exact clients attached to an older desktop generation. */
+function retireSharedCodexAppServerClientsBeforeDesktopGeneration(generation) {
+	const state = getSharedCodexAppServerClientState();
+	for (const entry of state.clients.values()) {
+		const client = entry.client;
+		const attached = client ? state.startMetadata.get(client) : void 0;
+		if (client && attached?.desktopGeneration && attached.desktopGeneration.epoch < generation.epoch) retireSharedCodexAppServerClientIfCurrent(client);
+	}
+}
+function closeRetiredSharedClientEntryIfIdle(entry) {
+	if (!entry.closeWhenIdle || entry.activeLeases > 0 || entry.pendingAcquires > 0 || !entry.client) return false;
+	entry.closeWhenIdle = false;
+	return closeRetiredSharedClientEntry(entry);
+}
+function closeRetiredSharedClientEntry(entry) {
+	const client = entry.client;
+	if (!client) return false;
+	entry.client = void 0;
+	client.close();
+	return true;
+}
+function retirePendingSharedClientEntryIfUnclaimed(entry) {
+	if (entry.activeLeases > 0 || entry.pendingAcquires > 0) return;
+	entry.startupAbort?.abort(/* @__PURE__ */ new Error("Codex app-server startup was abandoned"));
+	entry.closeWhenIdle = true;
+	const state = getSharedCodexAppServerClientState();
+	if (state.clients.get(entry.key) === entry) state.clients.delete(entry.key);
+	if (!entry.client) return;
+	closeRetiredSharedClientEntry(entry);
+}
+/** Failed final claimants join physical cleanup; healthy peers keep their startup. */
+async function waitForUnclaimedSharedClientStartup(entry) {
+	if (!entry.startupTransport || entry.activeLeases > 0 || entry.pendingAcquires > 0) return;
+	await entry.startupTransport.then((client) => client.closeAndWait(), () => {});
+}
+/** Exit registration also observes transports that have already terminated. */
+function waitForCodexAppServerClientExit(client) {
+	const metadata = getSharedCodexAppServerClientState().startMetadata.get(client);
+	const exited = metadata?.transportExit ?? new Promise((resolve) => {
+		client.addTransportExitHandler(() => resolve());
+	});
+	if (metadata) metadata.transportExit = exited;
+	return exited;
+}
+/** Acquire the recorded owner atomically, or join its exit before a replacement writes. */
+async function retainSharedCodexAppServerClientByInstanceId(clientId) {
+	const id = clientId?.trim();
+	if (!id) return;
+	const state = getSharedCodexAppServerClientState();
+	for (const client of state.liveClients) {
+		if (client.getInstanceId() !== id) continue;
+		const entry = state.entriesByClient.get(client);
+		if (entry?.client !== client || entry.closeError || client.getCloseError()) {
+			await waitForCodexAppServerClientExit(client);
+			return;
+		}
+		const release = retainSharedClientEntry(entry);
+		return {
+			client,
+			release: (waitForRetirement = false) => {
+				release();
+				return client.getCloseError() || waitForRetirement && entry.closeWhenIdle ? waitForCodexAppServerClientExit(client) : void 0;
+			}
+		};
+	}
+}
+function notifyDesktopGenerationDrainChecks(state) {
+	for (const check of state.desktopGenerationDrainChecks) check();
+}
+function retainSharedClientEntry(entry, counter = "activeLeases") {
+	let released = false;
+	entry[counter] += 1;
+	return () => {
+		if (released) return;
+		released = true;
+		releaseSharedClientEntry(entry, counter);
+	};
+}
+function releaseSharedClientEntry(entry, counter) {
+	entry[counter] -= 1;
+	closeRetiredSharedClientEntryIfIdle(entry);
+	notifyDesktopGenerationDrainChecks(getSharedCodexAppServerClientState());
+}
+//#endregion
 //#region extensions/codex/src/app-server/auth-cache-key.ts
 /** Auth cache identity and native CLI credential reads, without login or refresh. */
 const CODEX_HOME_ENV_VAR = "CODEX_HOME";
@@ -331,21 +517,11 @@ const HOME_ENV_VAR = "HOME";
 const CODEX_HOME_DIRNAME = ".codex";
 const CODEX_AUTH_JSON_FILENAME = "auth.json";
 const CODEX_APP_SERVER_API_KEY_ENV_VARS = ["CODEX_API_KEY", "OPENAI_API_KEY"];
-function resolveCodexAppServerEnvApiKeyCacheKey(params) {
-	if (params.startOptions.transport !== "stdio") return;
-	const apiKey = readFirstNonEmptyEnvEntry(resolveCodexAppServerSpawnEnv(params.startOptions, params.baseEnv ?? process.env, params.platform ?? process.platform), CODEX_APP_SERVER_API_KEY_ENV_VARS);
-	if (!apiKey) return;
-	const hash = createHash("sha256");
-	hash.update("openclaw:codex:app-server-env-api-key:v1");
-	hash.update("\0");
-	hash.update(apiKey.key);
-	hash.update("\0");
-	hash.update(apiKey.value);
-	return `${apiKey.key}:sha256:${hash.digest("hex")}`;
-}
 function resolveCodexAppServerFallbackApiKeyCacheKey(params) {
 	if (params.startOptions.transport !== "stdio") return;
-	return resolveCodexAppServerEnvApiKeyCacheKey(params) ?? resolveCodexCliAuthFileApiKeyCacheKey(params.baseEnv ?? process.env);
+	const apiKey = readFirstNonEmptyEnvEntry(resolveCodexAppServerSpawnEnv(params.startOptions, params.baseEnv ?? process.env, params.platform ?? process.platform), CODEX_APP_SERVER_API_KEY_ENV_VARS);
+	if (!apiKey) return resolveCodexCliAuthFileApiKeyCacheKey(params.baseEnv ?? process.env);
+	return fingerprintAuthCacheKey(apiKey.key, "env-api-key", apiKey.key, apiKey.value);
 }
 /** Secret-free cache identity for an API key already resolved by the runtime plan. */
 function resolveCodexAppServerPreparedApiKeyCacheKey(apiKey) {
@@ -353,25 +529,13 @@ function resolveCodexAppServerPreparedApiKeyCacheKey(apiKey) {
 	return resolved ? fingerprintApiKeyAuthProfileCacheKey(resolved) : void 0;
 }
 function fingerprintApiKeyAuthProfileCacheKey(apiKey) {
-	const hash = createHash("sha256");
-	hash.update("openclaw:codex:app-server-auth-profile-api-key:v1");
-	hash.update("\0");
-	hash.update(apiKey);
-	return `api_key:sha256:${hash.digest("hex")}`;
+	return fingerprintAuthCacheKey("api_key", "auth-profile-api-key", apiKey);
 }
 function fingerprintTokenAuthProfileCacheKey(accessToken) {
-	const hash = createHash("sha256");
-	hash.update("openclaw:codex:app-server-auth-profile-token:v1");
-	hash.update("\0");
-	hash.update(accessToken);
-	return `token:sha256:${hash.digest("hex")}`;
+	return fingerprintAuthCacheKey("token", "auth-profile-token", accessToken);
 }
-function fingerprintCodexCliAuthFileApiKeyCacheKey(apiKey) {
-	const hash = createHash("sha256");
-	hash.update("openclaw:codex:app-server-cli-auth-json-api-key:v1");
-	hash.update("\0");
-	hash.update(apiKey);
-	return `CODEX_AUTH_JSON:sha256:${hash.digest("hex")}`;
+function fingerprintAuthCacheKey(prefix, domain, ...parts) {
+	return `${prefix}:sha256:${createHash("sha256").update(`openclaw:codex:app-server-${domain}:v1\0`).update(parts.join("\0")).digest("hex")}`;
 }
 function resolveCodexCliAuthFilePath(env) {
 	const configuredCodexHome = env[CODEX_HOME_ENV_VAR]?.trim();
@@ -393,9 +557,7 @@ function parseCodexCliAuthFileApiKey(raw) {
 	} catch {
 		return;
 	}
-	if (!parsed || typeof parsed !== "object") return;
-	const apiKey = parsed.OPENAI_API_KEY;
-	return typeof apiKey === "string" && apiKey.trim() ? apiKey.trim() : void 0;
+	return isRecord(parsed) ? normalizeOptionalString(parsed.OPENAI_API_KEY) : void 0;
 }
 async function readCodexCliAuthFileApiKey(env) {
 	try {
@@ -407,7 +569,7 @@ async function readCodexCliAuthFileApiKey(env) {
 function resolveCodexCliAuthFileApiKeyCacheKey(env) {
 	try {
 		const apiKey = parseCodexCliAuthFileApiKey(fs.readFileSync(resolveCodexCliAuthFilePath(env), "utf8"));
-		return apiKey ? fingerprintCodexCliAuthFileApiKeyCacheKey(apiKey) : void 0;
+		return apiKey ? fingerprintAuthCacheKey("CODEX_AUTH_JSON", "cli-auth-json-api-key", apiKey) : void 0;
 	} catch {
 		return;
 	}
@@ -425,4 +587,4 @@ function readFirstNonEmptyEnvEntry(env, keys) {
 	}
 }
 //#endregion
-export { readCodexCliAuthFileApiKey as a, resolveCodexAppServerPreparedApiKeyCacheKey as c, waitForCodexDesktopGeneration as d, readCodexDesktopArtifactTreeFingerprint as f, fingerprintTokenAuthProfileCacheKey as i, createCodexDesktopGenerationService as l, CODEX_AUTH_JSON_FILENAME as n, readFirstNonEmptyEnv as o, fingerprintApiKeyAuthProfileCacheKey as r, resolveCodexAppServerFallbackApiKeyCacheKey as s, CODEX_APP_SERVER_API_KEY_ENV_VARS as t, isCodexDesktopGenerationCurrent as u };
+export { waitForCodexDesktopGeneration as A, retirePendingSharedClientEntryIfUnclaimed as C, waitForUnclaimedSharedClientStartup as D, waitForCodexAppServerClientExit as E, createCodexDesktopGenerationService as O, retainSharedCodexAppServerClientByInstanceId as S, retireSharedCodexAppServerClientsBeforeDesktopGeneration as T, observeSharedClientAcquire as _, readCodexCliAuthFileApiKey as a, releaseSharedClientEntry as b, resolveCodexAppServerPreparedApiKeyCacheKey as c, getCurrentSharedClientEntry as d, getOrCreateSharedClientEntry as f, observeAcquire as g, notifyDesktopGenerationDrainChecks as h, fingerprintTokenAuthProfileCacheKey as i, readCodexDesktopArtifactTreeFingerprint as j, isCodexDesktopGenerationCurrent as k, closeSharedClientEntryIfUnclaimed as l, hasActiveSharedCodexAppServerWork as m, CODEX_AUTH_JSON_FILENAME as n, readFirstNonEmptyEnv as o, getSharedCodexAppServerClientState as p, fingerprintApiKeyAuthProfileCacheKey as r, resolveCodexAppServerFallbackApiKeyCacheKey as s, CODEX_APP_SERVER_API_KEY_ENV_VARS as t, createCodexAppServerStartupLifetime as u, ownCodexStartup as v, retireSharedCodexAppServerClientIfCurrent as w, retainSharedClientEntry as x, recordSharedClientAcquireBoundary as y };

package/dist/.setup/{auth-profile-B0okYl2D.mjs → auth-profile-CgHQ8Vot.mjs}

@@ -1,4 +1,4 @@
-import { n as createCodexAuthProfileSelection } from "./auth-profile-selection-DFu9e167.mjs";
+import { n as createCodexAuthProfileSelection } from "./auth-profile-selection-hr8ocLtz.mjs";
 import { embeddedAgentLog, resolveDefaultAgentDir } from "openclaw/plugin-sdk/agent-harness-registration";
 import { resolveProviderIdForAuth } from "openclaw/plugin-sdk/provider-auth-aliases";
 import { ensureAuthProfileStore, resolveAuthProfileOrder } from "openclaw/plugin-sdk/provider-auth";
@@ -10,6 +10,7 @@ const { resolveCodexAppServerAuthProfileId, resolveCodexAppServerAuthProfileIdFo
 	ensureAuthProfileStore,
 	resolveAuthProfileOrder
 });
+/** Returns true when an auth profile uses native Codex/OpenAI app-server auth. */
 function isCodexAppServerNativeAuthProfile(lookup) {
 	const authProfileId = lookup.authProfileId?.trim();
 	if (!authProfileId) return false;

package/dist/.setup/{auth-profile-selection-DFu9e167.mjs → auth-profile-selection-hr8ocLtz.mjs}

@@ -13,16 +13,14 @@ function createCodexAuthProfileSelection({ ensureAuthProfileStore, resolveAuthPr
 		})[0]?.trim();
 	}
 	function resolveCodexAppServerAuthProfileIdForAgent(params) {
+		const agentDir = params.agentDir?.trim() || resolveDefaultAgentDir(params.config ?? {});
 		const store = resolveCodexAppServerAuthProfileStore({
-			agentDir: params.agentDir?.trim() || resolveDefaultAgentDir(params.config ?? {}),
-			authProfileId: params.authProfileId,
-			authProfileStore: params.authProfileStore,
-			config: params.config
+			...params,
+			agentDir
 		});
 		return resolveCodexAppServerAuthProfileId({
-			authProfileId: params.authProfileId,
-			store,
-			config: params.config
+			...params,
+			store
 		});
 	}
 	function resolveCodexAppServerAuthProfileStore(params) {

package/dist/.setup/{binding-connection-DTtN1KrX.mjs → binding-connection-C-08ez1w.mjs}

@@ -1,4 +1,4 @@
-import { t as __exportAll } from "./session-binding-sidecars-jo6H8dFr.mjs";
+import { t as __exportAll } from "./session-binding-sidecars-BrdV95Fg.mjs";
 import { AgentHarnessPreflightError } from "openclaw/plugin-sdk/agent-harness-registration";
 import { createPluginRuntimeStore } from "openclaw/plugin-sdk/runtime-store";
 //#region extensions/codex/src/app-server/binding-connection.ts
@@ -44,7 +44,7 @@ function requireCodexSupervisionModelSelection(binding) {
 }
 /** Registration publishes the resolver; connection policy loads only for an actual request. */
 async function resolveCodexBindingAppServerConnection(params) {
-	return (await import("./binding-connection.runtime-6TpgD1M6.mjs")).resolveCodexBindingAppServerConnection(params, catalogHomes.tryGetRuntime());
+	return (await import("./binding-connection.runtime-Dn2p-fdy.mjs")).resolveCodexBindingAppServerConnection(params, catalogHomes.tryGetRuntime());
 }
 //#endregion
 export { setCodexCatalogConnectionHomeResolver as a, resolveCodexBindingAppServerConnection as i, binding_connection_exports as n, requireCodexSupervisionModelSelection as r, assertCodexSessionRuntimeOwnership as t };

package/dist/.setup/{binding-connection.runtime-6TpgD1M6.mjs → binding-connection.runtime-Dn2p-fdy.mjs}

@@ -1,7 +1,7 @@
-import { d as readCodexPluginConfig } from "./config-parsing-b088LyhT.mjs";
+import { d as readCodexPluginConfig } from "./config-parsing-BQq-CHTF.mjs";
 import { n as resolveCodexAppServerLocalHomeDir } from "./auth-start-options-BPIPeEX8.mjs";
-import { t as buildCodexAppServerConnectionFingerprint } from "./plugin-app-cache-key-BL9B5H0L.mjs";
-import { n as resolveCodexAppServerRuntimeOptions, r as resolveCodexSupervisionAppServerRuntimeOptions } from "./config-runtime-C0NbLms1.mjs";
+import { t as buildCodexAppServerConnectionFingerprint } from "./plugin-app-cache-key-BW8rd98k.mjs";
+import { n as resolveCodexAppServerRuntimeOptions, r as resolveCodexSupervisionAppServerRuntimeOptions } from "./config-runtime-cUYrqu_a.mjs";
 //#region extensions/codex/src/app-server/binding-connection.runtime.ts
 /** Resolves connection and auth ownership exclusively from the private thread binding. */
 async function resolveCodexBindingAppServerConnection(params, discoverHomes) {

package/dist/.setup/{bounded-turn-isolation-B8K_ylqk.mjs → bounded-turn-isolation-DklXNk3k.mjs}

@@ -1,8 +1,8 @@
-import { d as readCodexPluginConfig } from "./config-parsing-b088LyhT.mjs";
+import { d as readCodexPluginConfig } from "./config-parsing-BQq-CHTF.mjs";
 import { n as isCodexAppServerProxyLaunch } from "./launch-args-DbFCehO7.mjs";
-import { i as resolveCodexAppServerHomeScope } from "./config-options-CzyWLTJt.mjs";
-import "./config-DKhXquav.mjs";
-import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-C0NbLms1.mjs";
+import { i as resolveCodexAppServerHomeScope } from "./config-options-HG_Rr3W_.mjs";
+import "./config-0Gxk3_eq.mjs";
+import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-cUYrqu_a.mjs";
 //#region extensions/codex/src/app-server/bounded-turn-isolation.ts
 function resolveCodexBoundedTurnIsolation(options) {
 	const pluginConfig = readCodexPluginConfig(options.pluginConfig);

package/dist/.setup/{bounded-turn-BNunZPtz.mjs → bounded-turn-pGsfXcmH.mjs}

@@ -1,16 +1,17 @@
 import { i as isJsonObject } from "./protocol-CANUwXJ3.mjs";
 import { a as resolveCodexPrivateLauncher, i as readCodexAppServerConfigOptions } from "./launch-args-DbFCehO7.mjs";
-import { d as readCodexEffectiveConfig } from "./config-options-CzyWLTJt.mjs";
-import "./config-DKhXquav.mjs";
-import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-C0NbLms1.mjs";
-import { u as isCodexAppServerStartSelectionChangedError } from "./shared-client-CJCTeFpQ.mjs";
-import { S as assertCodexTurnStartResponse, T as readCodexErrorNotification, k as createCodexElicitationResponse, x as assertCodexThreadStartResponse } from "./client-qyUBJlGZ.mjs";
-import { o as closeCodexStartupClientBestEffort, s as interruptCodexTurnAndWaitBestEffort, t as CODEX_APP_SERVER_INTERRUPT_TIMEOUT_MS } from "./attempt-client-cleanup-B-S7ngS_.mjs";
-import { t as CodexEphemeralTurn } from "./ephemeral-turn-DiCS1ijR.mjs";
-import { i as readModelListResult } from "./models-DfLmPV0k.mjs";
-import { R as attestCodexRestrictedToolSurfaceMcpServersDisabled, St as mergeCodexThreadConfigs, l as readCodexInheritedMcpServerNames, n as buildCodexRingZeroThreadConfigPatch, r as buildCodexRuntimeThreadConfig, t as assertCodexManagedRequirementsDoNotOverrideToolPolicy } from "./thread-requests-OWGOiDaV.mjs";
-import { S as resolveCodexAppServerReasoningEffort } from "./thread-lifecycle-_bAbjedG.mjs";
-import { a as resolveCodexPromptError } from "./usage-limit-error-wSMQkbpV.mjs";
+import { d as readCodexEffectiveConfig } from "./config-options-HG_Rr3W_.mjs";
+import { a as codexPrewriteRejectionCause } from "./rpc-error-hmWM21RB.mjs";
+import "./config-0Gxk3_eq.mjs";
+import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-cUYrqu_a.mjs";
+import { u as isCodexAppServerStartSelectionChangedError } from "./shared-client-qhyYWbew.mjs";
+import { _ as assertCodexTurnStartResponse, b as readCodexErrorNotification, g as assertCodexThreadStartResponse, w as createCodexElicitationResponse } from "./client-C8lgBOoO.mjs";
+import { o as closeCodexStartupClientBestEffort, s as interruptCodexTurnAndWaitBestEffort, t as CODEX_APP_SERVER_INTERRUPT_TIMEOUT_MS } from "./attempt-client-cleanup-BH0hW2xU.mjs";
+import { t as CodexEphemeralTurn } from "./ephemeral-turn-D8VcDTNo.mjs";
+import { i as readModelListResult } from "./models-DSseKSMg.mjs";
+import { Ct as mergeCodexThreadConfigs, n as buildCodexRingZeroThreadConfigPatch, r as buildCodexRuntimeThreadConfig, t as assertCodexManagedRequirementsDoNotOverrideToolPolicy, u as readCodexInheritedMcpServerNames, z as attestCodexRestrictedToolSurfaceMcpServersDisabled } from "./thread-requests-CL1e8Wmx.mjs";
+import { b as resolveCodexAppServerReasoningEffort } from "./thread-lifecycle-Cbz_7ySv.mjs";
+import { a as resolveCodexPromptError } from "./usage-limit-error-GbT-5NcW.mjs";
 import { resolveTimerTimeoutMs } from "openclaw/plugin-sdk/number-runtime";
 import { parse } from "smol-toml";
 import path from "node:path";
@@ -144,7 +145,7 @@ async function runBoundedCodexAppServerTurnInWorkspace(params, appServer, worksp
 		assertCurrent: params.assertCurrent,
 		...params.signal ? { abandonSignal: params.signal } : {}
 	};
-	const client = params.options.clientFactory ? await params.options.clientFactory(clientOptions) : await import("./shared-client-CJCTeFpQ.mjs").then((n) => n.v).then(({ createIsolatedCodexAppServerClient }) => createIsolatedCodexAppServerClient({
+	const client = params.options.clientFactory ? await params.options.clientFactory(clientOptions) : await import("./shared-client-qhyYWbew.mjs").then((n) => n.v).then(({ createIsolatedCodexAppServerClient }) => createIsolatedCodexAppServerClient({
 		...clientOptions,
 		authProfileStore: params.authProfileStore
 	}));
@@ -271,7 +272,7 @@ async function runBoundedCodexAppServerTurnInWorkspace(params, appServer, worksp
 		}
 	} catch (error) {
 		if (abortController.signal.aborted) throw resolveCodexBoundedTurnAbortError(abortController.signal, params.taskLabel, timeoutError);
-		if (!ownsClient || !isCodexAppServerStartSelectionChangedError(error) || selectionAttempt !== 0) throw error;
+		if (!ownsClient || !isCodexAppServerStartSelectionChangedError(error) || selectionAttempt !== 0) throw codexPrewriteRejectionCause(error);
 	} finally {
 		clearTimeout(timeout);
 		params.signal?.removeEventListener("abort", abortFromCaller);

package/dist/.setup/{build-state-DIQ5O_-S.mjs → build-state-CqQnsg7T.mjs}

@@ -1,5 +1,5 @@
 //#region extensions/codex/package.json
-var version = "2026.9.8";
+var version = "2026.10.1-beta.2";
 //#endregion
 //#region extensions/codex/src/build-state.ts
 /**

package/dist/.setup/{capabilities-B3WEZl4e.mjs → capabilities-kQntafj_.mjs}

@@ -1,4 +1,4 @@
-import { n as CodexAppServerRpcError } from "./rpc-error-BlD2vuzn.mjs";
+import { r as CodexAppServerRpcError } from "./rpc-error-hmWM21RB.mjs";
 //#region extensions/codex/src/app-server/capabilities.ts
 const CODEX_CONTROL_METHODS = {
 	account: "account/read",