Summary

• Problem: mirrorCodexAppServerTranscript builds its idempotency key as `${idempotencyScope}:${message.role}:${index}`, where index is the position of the message inside the per-turn messagesSnapshot. The snapshot itself is built dynamically by event-projector.ts:188 — it always starts with the user prompt, then conditionally pushes a Codex reasoning mirror, a Codex plan mirror, and the final assistant reply. If mirrorCodexAppServerTranscript runs more than once for the same logical turn (a retried turn, or any flow that re-mirrors the just-finished turn) and the second snapshot includes a reasoning record that the first didn't, every assistant-role record after the inserted slot shifts by one index. The original assistant entry's first-call key (:assistant:1) collides with the new reasoning entry's key (also :assistant:1), so the legitimately-new reasoning record is silently dropped at the dedupe gate, and the assistant content gets re-appended under :assistant:2 — the on-disk transcript ends up with a duplicate assistant entry and a missing reasoning entry. Files involved: extensions/codex/src/app-server/transcript-mirror.ts:33 and the call site in extensions/codex/src/app-server/run-attempt.ts:1782.

• Root Cause: Positional index is not a stable identity for a logical message. The dedupe key needs to be invariant under snapshot reordering inside a fixed scope. The cross-turn dimension is already handled correctly by the existing call-site scope `codex-app-server:${threadId}:${turnId}` — distinct turns produce distinct scopes and therefore can never collide, even when role+content match (which is what preserves repeated-message turns such as a user typing "yes" twice in one thread).

• Fix: A three-part change across three files:

  1. event-projector.ts — each entry in messagesSnapshot is now tagged with attachCodexMirrorIdentity before the snapshot is passed to mirrorCodexAppServerTranscript. Tags use a ${turnId}:${kind} shape (:prompt, :reasoning, :plan, :assistant) so each logical message carries a stable per-turn identity that is invariant under snapshot reordering and across re-invocations.
  2. transcript-mirror.ts — the dedupe key is rebuilt: when a message carries an explicit identity tag (set by attachCodexMirrorIdentity), the key is `${scope}:${identity}`; when no tag is present (fallback for callers that did not tag), the key falls back to `${scope}:${role}:${sha256({role,content}).slice(0,16)}`. The messages filter is narrowed via MirroredAgentMessage = Extract<AgentMessage, { role: "user" | "assistant" }>.
  3. run-attempt.ts — the call-site idempotencyScope is shortened from `codex-app-server:${threadId}:${turnId}` to `codex-app-server:${threadId}`. Per-turn distinction is now carried by the ${turnId}:${kind} identity tag on each individual entry, so the scope no longer needs to embed turnId. Dropping turnId from the scope is what makes a re-emitted prior-turn entry — which still carries its original ${turnId}:${kind} identity — collide with its existing on-disk key and become a true no-op.

• What changed:

  • extensions/codex/src/app-server/event-projector.ts — import attachCodexMirrorIdentity; wrap each messagesSnapshot push (user prompt, reasoning mirror, plan mirror, assistant) with attachCodexMirrorIdentity(message, \${turnId}:${kind}`)`.
  • extensions/codex/src/app-server/transcript-mirror.ts — add attachCodexMirrorIdentity (exported, for event-projector.ts), readMirrorIdentity, fingerprintMirrorMessageContent, and buildMirrorDedupeIdentity; replace :${index} suffix with buildMirrorDedupeIdentity(message) (identity tag when present, content fingerprint fallback); narrow filter via the MirroredAgentMessage type predicate.
  • extensions/codex/src/app-server/run-attempt.ts — change idempotencyScope from `codex-app-server:${params.threadId}:${params.turnId}` to `codex-app-server:${params.threadId}`. Per-turn distinctness is now provided by the ${turnId}:${kind} identity tag on each entry; keeping turnId in the scope would be redundant and would break cross-turn re-emit idempotency.
  • extensions/codex/src/app-server/transcript-mirror.test.ts — update the three existing key-format assertions to match the identity-tag shape; add dedupes mirrored messages despite snapshot positional shifts (asserts the exact text sequence after a re-mirror that inserts a reasoning record; pre-fix code produces ["hello", "hi there", "hi there"] with reasoning dropped and assistant duplicated); add keeps repeated same-content turns distinct (verifies that two turns with identical role+content but different turnId segments produce two full user+assistant pairs, not one).

• What did NOT change (scope boundary):

  • The on-disk JSONL schema is unchanged: entries still carry { type, id, parentId, timestamp, message } with message.idempotencyKey as a flat string. Pre-existing transcripts with the old :role:index keys remain valid; their old keys never collide with new identity-tag keys, which is the expected behaviour for a pre-existing entry under any dedupe scheme.
  • appendSessionTranscriptMessage, migrateLinearTranscriptToParentLinked, selectBoundedActiveTailRecords, the session write-lock, and the gateway-injected assistant write path are untouched.
  • Telegram and BlueBubbles channels (different mirror paths) are unaffected. No public API surface changes; mirrorCodexAppServerTranscript's parameter shape is identical. No any types are introduced.

Honest scope vs. #77012

This PR addresses one mechanism that produces transcript drift in the Codex app-server mirror: re-invocation of mirror for a logical turn whose snapshot has reordered between calls. The end-user-visible symptom in the linked issue is a sibling-branch on disk where a new user message shares its parentId with the prior assistant entry, after which the active-tail walker orphans the prior assistant. A hermetic two-turn mirror reproducer with the production per-turn snapshot pattern does not produce that sibling-branch state on current main — the parent chain stays well-formed, which means a single mirror call per turn with disjoint per-turn content is not by itself the proximate cause of the on-disk shape reported there. The within-scope index collision fixed in this PR is therefore one contributing factor, not the full root cause; this PR is intentionally Refs rather than Fixes.

Reproduction

Hermetic, against current main:

git clone https://github.com/openclaw/openclaw && cd openclaw
# Apply this PR
pnpm install
pnpm vitest run extensions/codex/src/app-server/transcript-mirror.test.ts
#   Test Files  1 passed (1)
#        Tests  9 passed (9)

Verify the new test is a real regression (it would fail without the fix):

# Temporarily revert just the production change
git stash push extensions/codex/src/app-server/transcript-mirror.ts
pnpm vitest run extensions/codex/src/app-server/transcript-mirror.test.ts
#   FAIL  > dedupes mirrored messages despite snapshot positional shifts
#     AssertionError: expected [ 'hello', 'hi there', 'hi there' ]
#       to deeply equal [ 'hello', 'hi there', '[Codex reasoning] thinking' ]
#   Tests:  4 failed | 5 passed (9)
git stash pop

Risk / Mitigation

• Risk: a thread-only scope would collapse distinct same-content turns. Each entry's identity tag already includes turnId, so distinct turns produce distinct keys even when role+content match. Covered by keeps repeated same-content turns distinct.
• Risk: hash collision (fallback path). SHA-256 truncated to 16 hex chars (64 bits) is well above any practical threshold for the small number of records inside a single (threadId, turnId) scope.
• Risk: JSON.stringify field ordering (fallback path). The fingerprint hashes { role, content } in a fixed object literal — ordering is deterministic on every supported Node version (engines.node >= 22.14.0).
• Risk: hook-driven content mutation. The fingerprint is computed before runAgentHarnessBeforeMessageWriteHook, so a hook that mutates content does not destabilize the dedupe anchor on retries.
• Mitigation: Two regression tests cover both halves of the design — within-scope reorder (the bug being fixed) and cross-scope distinctness (the regression that mustn't be introduced). pnpm tsgo:extensions and pnpm tsgo:extensions:test are clean.

Change Type (select all)

• Bug fix

Scope (select all touched areas)

• Codex (app-server transcript mirror — extensions/codex/src/app-server/transcript-mirror.ts, event-projector.ts, run-attempt.ts)
• Tests (regression coverage in transcript-mirror.test.ts)

Linked Issue/PR

Refs #77012 — addresses the within-scope index-collision contributing factor; the broader sibling-branch symptom in that issue likely involves at least one additional path and should remain open until that path is identified and fixed.