Codex review: needs real behavior proof before merge.

Summary
The PR re-arms the Codex app-server short completion idle watchdog after the final non-assistant current-turn item completes and adds a regression test for that stall.

Reproducibility: yes. by source inspection: the current-main branch disarms the short completion watchdog after the reduced final item/completed sequence, so it waits for the longer terminal guard. I did not execute the test because this review was constrained to read-only inspection.

Real behavior proof
Needs real behavior proof before merge: The PR body provides test and build commands only, with no after-fix proof from a real Codex/OpenClaw run. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, ask a maintainer to comment @clawsweeper re-review.

Next step before merge
Contributor action is needed for real behavior proof before normal maintainer review or merge; there is no narrow automated repair to make on the branch.

Security
Cleared: The diff only changes Codex app-server timeout control flow and a colocated test; it does not touch dependencies, CI, secrets, permissions, downloads, or publishing paths.

Maintainer proof for landing #82172.

Behavior addressed: Codex app-server can go quiet after the last non-assistant current-turn item/completed without sending turn/completed; current main waits for the outer attempt timeout instead of the short turn-completion idle watchdog.

Before proof on current main:

• Command: node scripts/run-vitest.mjs extensions/codex/src/app-server/run-attempt.test.ts -t 'times out promptly when the last completed non-assistant current-turn item is not followed by turn completion' --reporter=verbose with only the new regression test temporarily applied.
• Result: failed as expected; actual promptError was codex app-server attempt timed out, not codex app-server turn idle timed out waiting for turn/completed.

After-fix proof on PR logic:

• Command: node scripts/run-vitest.mjs extensions/codex/src/app-server/run-attempt.test.ts -t 'keeps the post-tool completion watchdog armed across dynamic tool completion bookkeeping|times out promptly when the last completed non-assistant current-turn item is not followed by turn completion|does not release the session after only a raw assistant response item|releases the session when a completed agent message item goes quiet|keeps waiting when a current-turn item is still active' --reporter=verbose
• Result: 5 passed, 115 skipped.
• Command: git diff --check
• Result: passed.

Real environment tested:

• Local OpenClaw CLI turn using the real local embedded agent path and WebSocket app-server transport, with an isolated config and a minimal local WebSocket app-server that responds to initialize, thread/start, and turn/start, then emits item/started plus final non-assistant item/completed and deliberately omits turn/completed.
• Command shape: pnpm openclaw agent --local --agent main --message 'prove watchdog' --model codex/gpt-5.5 --json --timeout 5 with plugins.entries.codex.config.appServer.transport=websocket and turnCompletionIdleTimeoutMs=50.
• Observed transport sequence: initialize -> thread/start -> turn/start -> item/started -> item/completed -> turn/interrupt.
• Observed runtime log: codex app-server turn idle timed out waiting for completion.
• Observed JSON result: meta.aborted: true, agentMeta.provider: codex, agentHarnessId: codex, toolSummary.tools: [sessions_list].

CI/proof gaps:

• Did not run full suite locally; this is a narrow Codex app-server watchdog change with focused regression and transport-level proof.
• GitHub Real behavior proof check failed only because the external PR body lacked structured proof; applying maintainer proof: override based on the above local real-run proof.

Thanks @funmerlin.

Re-review progress:

• State: Complete
• Detail: The targeted re-review finished, the durable review comment was updated, and the synced verdict was routed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/25925536086
• Updated: 2026-05-15T15:17:41.969Z

Landed in 127156a from source head d73b187.

Verification before merge:

• node scripts/run-vitest.mjs extensions/codex/src/app-server/run-attempt.test.ts -t 'keeps the post-tool completion watchdog armed across dynamic tool completion bookkeeping|times out promptly when the last completed non-assistant current-turn item is not followed by turn completion|does not release the session after only a raw assistant response item|releases the session when a completed agent message item goes quiet|keeps waiting when a current-turn item is still active' --reporter=verbose: 5 passed, 115 skipped on the rebased head.
• git diff --check origin/main..HEAD: passed.
• Real behavior proof: local OpenClaw CLI turn over WebSocket app-server transport emitted turn/interrupt after the short idle watchdog when the fake app-server sent final non-assistant item/completed and omitted turn/completed.

Thanks @funmerlin.