@openclaw/codex 2026.10.1-beta.2 → 2026.10.5-beta.1

package/dist/.setup/{dynamic-tools-DyERJnR6.mjs → dynamic-tools-D0pYbxHH.mjs}

@@ -1,39 +1,46 @@
 import { i as isJsonObject, r as flattenCodexDynamicToolFunctions, t as CODEX_OPENCLAW_DIRECT_DYNAMIC_TOOL_NAMESPACE } from "./protocol-CANUwXJ3.mjs";
-import { o as formatCodexDisplayText } from "./command-formatters-DV3DHhdr.mjs";
-import { o as readItem } from "./event-projector-values-DTqZHizf.mjs";
-import { s as codexAppIdentityKey } from "./plugin-app-cache-key-BW8rd98k.mjs";
-import { r as invalidInlineImageText } from "./session-history-read-CNN8zwbD.mjs";
-import { U as protectCodexAppServerLiveThread, _ as retainSharedCodexAppServerClientIfCurrent } from "./shared-client-qhyYWbew.mjs";
-import { F as createFailedDynamicToolResponse, I as failedToolResult, P as resolveCodexToolAbortTerminalReason, l as CodexServerRequestResolvedError, w as createCodexElicitationResponse, x as readCodexTurnCompletedNotification } from "./client-C8lgBOoO.mjs";
+import { n as codexSandboxPolicyForTurn } from "./config-options-DDzeNQ8m.mjs";
+import { o as formatCodexDisplayText } from "./command-formatters-xW9KpoSZ.mjs";
+import { o as readItem } from "./event-projector-values-CLvG1Hil.mjs";
+import { s as codexAppIdentityKey } from "./plugin-app-cache-key-Bg9DbDI6.mjs";
+import "./config-C1YVVLEA.mjs";
+import { r as invalidInlineImageText } from "./session-history-read-BI_2jRED.mjs";
+import { o as neutralizeCodexExplicitMentionSigils } from "./context-engine-projection-ps-yn_ci.mjs";
+import { U as protectCodexAppServerLiveThread, _ as retainSharedCodexAppServerClientIfCurrent } from "./shared-client-ByIwuAC-.mjs";
+import { A as createFailedDynamicToolResponse, j as failedToolResult, k as resolveCodexToolAbortTerminalReason, l as CodexServerRequestResolvedError, w as createCodexElicitationResponse, x as readCodexTurnCompletedNotification } from "./client-y7nO6X9c.mjs";
 import { t as codexWebSocketDataToBuffer } from "./websocket-data-XlRvt8Ys.mjs";
-import { _ as itemStatus, a as isCodexNotificationForTurn, b as shouldClearTerminalPresentationForNativeItem, c as auditNativeToolName, g as itemName, l as auditNativeToolTerminalStatus, o as readCodexNotificationThreadId, s as readCodexNotificationTurnId, u as auditNativeToolUnfinishedStatus } from "./turn-router-sS69wYnI.mjs";
-import { M as emitCodexNativePreToolUseFailureDiagnostic } from "./thread-requests-CL1e8Wmx.mjs";
-import { a as requestPluginApprovalOutcome, c as truncateCodexApprovalDisplayText, i as requestPluginApproval, l as waitForPluginApprovalDecision, n as codexApprovalTimeoutText, o as sanitizeCodexApprovalVisibleText, r as mapExecDecisionToOutcome, s as stripDanglingCodexApprovalTerminalSequence, t as approvalRequestExplicitlyUnavailable } from "./plugin-approval-roundtrip-CuahdPLC.mjs";
-import { d as isCodexPassThroughMediaSource, f as mapCodexAppServerLocalWorkspacePath, p as mapCodexAppServerRemoteWorkspacePath } from "./dynamic-tool-build-C8xGEXmR.mjs";
+import { S as shouldClearTerminalPresentationForNativeItem, _ as itemName, a as isCodexNotificationForTurn, c as readCodexNotificationTurnId, d as auditNativeToolUnfinishedStatus, l as auditNativeToolName, s as readCodexNotificationThreadId, u as auditNativeToolTerminalStatus, v as itemStatus } from "./turn-router-DKDAziUW.mjs";
+import { n as resolveCodexAppServerReasoningEffort, t as readCodexSupportedReasoningEfforts } from "./reasoning-effort-CS9kKWB9.mjs";
+import { V as joinPresentSections } from "./thread-requests-BgzJwJtS.mjs";
+import { r as resolveCodexAppServerRequestModelSelection, t as CODEX_NATIVE_PERSONALITY_NONE } from "./thread-model-selection-DcVebr8N.mjs";
+import { a as requestPluginApprovalOutcome, c as truncateCodexApprovalDisplayText, i as requestPluginApproval, l as waitForPluginApprovalDecision, n as codexApprovalTimeoutText, o as sanitizeCodexApprovalVisibleText, r as mapExecDecisionToOutcome, s as stripDanglingCodexApprovalTerminalSequence, t as approvalRequestExplicitlyUnavailable } from "./plugin-approval-roundtrip-BSV-51ig.mjs";
+import { d as isCodexPassThroughMediaSource, f as mapCodexAppServerLocalWorkspacePath, p as mapCodexAppServerRemoteWorkspacePath } from "./dynamic-tool-build-D731PCdv.mjs";
+import { c as emitCodexNativePreToolUseFailureDiagnostic } from "./native-hook-relay-BUWIOrSr.mjs";
 import { createRequire } from "node:module";
-import { asNonArrayRecord, asOptionalRecord, filterStringEntries, isRecord, normalizeTrimmedStringList, readNonBlankString, readStringField } from "openclaw/plugin-sdk/string-coerce-runtime";
+import { asNonArrayRecord, asOptionalRecord, filterStringEntries, isRecord, normalizeOptionalString, normalizeTrimmedStringList, readNonBlankString, readStringField } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { createHash, randomUUID } from "node:crypto";
 import { validateJsonSchemaValue } from "openclaw/plugin-sdk/json-schema-runtime";
 import { asDateTimestampMs } from "openclaw/plugin-sdk/number-runtime";
 import { signalProcessTree, spawnTerminalPty } from "openclaw/plugin-sdk/process-runtime";
+import { DEFAULT_MAX_LIVE_TOOL_RESULT_CHARS, estimateToolResultTextChars, resolveLiveToolResultMaxChars, safeParseJson, sliceToolResultTextToBudget, sliceUtf16Safe, truncateUtf16Safe } from "openclaw/plugin-sdk/text-utility-runtime";
 import path, { posix } from "node:path";
 import { coerceErrorMessage } from "openclaw/plugin-sdk/error-runtime";
 import { createBoundedRemoteFileReader, isPathStrictlyInside, root } from "openclaw/plugin-sdk/file-access-runtime";
 import { once } from "node:events";
 import { spawn } from "node:child_process";
 import { expectDefined } from "openclaw/plugin-sdk/expect-runtime";
-import { DEFAULT_MAX_LIVE_TOOL_RESULT_CHARS, estimateToolResultTextChars, resolveLiveToolResultMaxChars, safeParseJson, sliceToolResultTextToBudget, sliceUtf16Safe, truncateUtf16Safe } from "openclaw/plugin-sdk/text-utility-runtime";
-import { emitTrustedDiagnosticEvent } from "openclaw/plugin-sdk/diagnostic-runtime";
+import { emitTrustedDiagnosticEvent, hasPendingInternalDiagnosticEvent } from "openclaw/plugin-sdk/diagnostic-runtime";
 import { createDeferred } from "openclaw/plugin-sdk/extension-shared";
-import { createAgentToolResultMiddlewareRunner, createCodexAppServerToolResultExtensionRunner, embeddedAgentLog, extractMessagingToolSend, extractMessagingToolSendResult, finalizeAgentToolAvailability, finalizeToolTerminalPresentation, formatApprovalDisplayPath, formatToolExecutionErrorMessage, getBeforeToolCallFailureDisposition, getChannelAgentToolMeta, getPluginToolMeta, getPluginToolSideEffectOwnerKey, hasNativeHookRelayInvocation, invokeNativeHookRelay, isDeliveredMessageToolOnlySourceReplyResult, isDeliveredMessagingToolResult, isDeliveredMessagingToolSendToCurrentSource, isMessagingTool, isReplaySafeToolCall, isToolResultError, isToolWrappedWithBeforeToolCallHook, projectPluginMessageDeliveryFact, projectRuntimeToolInputSchema, readEmbeddedMessageDeliveryFact, readToolOperatorHint, resolveNativeHookRelayDeferredToolApproval, resolveToolExecutionErrorKind, runAgentHarnessAfterToolCallHook, sanitizeToolResult, setBeforeToolCallDiagnosticsEnabled, wrapToolWithBeforeToolCallHook } from "openclaw/plugin-sdk/agent-harness-runtime";
+import { raceWithTimeout } from "openclaw/plugin-sdk/time-runtime";
 import { fileURLToPath, pathToFileURL } from "node:url";
+import { buildHarnessVisibleReplyGuidance, buildTemporalContextText, captureToolAuthoredSourceReply, createAgentToolResultMiddlewareRunner, createCodexAppServerToolResultExtensionRunner, embeddedAgentLog, extractMessagingToolSend, extractMessagingToolSendResult, finalizeAgentToolAvailability, finalizeToolTerminalPresentation, formatApprovalDisplayPath, formatToolExecutionErrorMessage, getBeforeToolCallFailureDisposition, getChannelAgentToolMeta, getPluginToolMeta, getPluginToolSideEffectOwnerKey, hasNativeHookRelayInvocation, invokeNativeHookRelay, isDeliveredMessageToolOnlySourceReplyResult, isDeliveredMessagingToolResult, isDeliveredMessagingToolSendToCurrentSource, isMessagingTool, isReplaySafeToolCall, isToolResultError, isToolWrappedWithBeforeToolCallHook, projectPluginMessageDeliveryFact, projectRuntimeToolInputSchema, readEmbeddedMessageDeliveryFact, readToolOperatorHint, resolveNativeHookRelayDeferredToolApproval, resolveToolExecutionErrorKind, runAgentHarnessAfterToolCallHook, sanitizeToolResult, setBeforeToolCallDiagnosticsEnabled, wrapToolWithBeforeToolCallHook } from "openclaw/plugin-sdk/agent-harness-runtime";
 import { sanitizeInlineImageDataUrl } from "openclaw/plugin-sdk/inline-image-data-url-runtime";
 import { redactToolPayloadText } from "openclaw/plugin-sdk/logging-core";
 import { formatErrorMessage as formatErrorMessage$2, redactSensitiveText as redactSensitiveText$1 } from "openclaw/plugin-sdk/security-runtime";
 import { collectAgentHarnessMessagingMediaUrls, copyInternalToolResultState, createAgentHarnessToolExecutionBoundaryRegistry, extractMessagingToolSourceReplyPayload, getCoreTtsToolResultMediaUrls, mapAgentHarnessMessagingMediaValues, normalizeAcceptedSessionSpawnResult, recordAgentHarnessToolResultTelemetry, runAgentHarnessToolInvocation } from "openclaw/plugin-sdk/agent-harness-tool-runtime";
 import { isIP } from "node:net";
-import { formatMcpCodexApprovalRemedy, requiresMcpCodexToolApproval, resolveProjectedMcpCodexToolApprovalMode } from "openclaw/plugin-sdk/codex-mcp-projection";
 import { SANDBOX_COMMAND_MAX_BUFFER_BYTES, buildRemoteCommand, prepareSandboxProcessCleanup, sanitizeEnvVars } from "openclaw/plugin-sdk/sandbox";
+import { formatMcpCodexApprovalRemedy, requiresMcpCodexToolApproval, resolveProjectedMcpCodexToolApprovalMode } from "openclaw/plugin-sdk/codex-mcp-projection";
 import { SsrFBlockedError, isBlockedHostnameOrIp } from "openclaw/plugin-sdk/ssrf-runtime";
 import { getMediaDir } from "openclaw/plugin-sdk/media-runtime";
 import { normalizeMediaReferenceForComparison, saveMediaBuffer } from "openclaw/plugin-sdk/media-store";
@@ -86,10 +93,10 @@ var CodexNativeToolLifecycleProjector = class {
 			if (candidate) return;
 			candidate = mcpToolCall;
 		}
-		if (!candidate || candidate.status !== "inProgress" || typeof candidate.server !== "string" || !candidate.server.trim() || typeof candidate.tool !== "string" || !candidate.tool.trim() || candidate.arguments === void 0 || candidate.appContext != null || candidate.pluginId != null) return;
+		if (!candidate || candidate.status !== "inProgress" || !serverName.trim() || typeof candidate.tool !== "string" || !candidate.tool.trim() || candidate.arguments === void 0 || candidate.appContext != null || candidate.pluginId != null) return;
 		return {
 			id: candidate.id,
-			server: candidate.server,
+			server: serverName,
 			tool: candidate.tool,
 			arguments: candidate.arguments
 		};
@@ -410,6 +417,55 @@ async function assertGatewayManagedMediaPath(value, mediaRoot) {
 	}
 }
 //#endregion
+//#region extensions/codex/src/app-server/computer-context.ts
+function invalidateCodexComputerFrame(contextEpoch) {
+	contextEpoch.value += 1;
+	delete contextEpoch.frameToolCallId;
+	delete contextEpoch.frameImageIdentity;
+}
+//#endregion
+//#region extensions/codex/src/app-server/user-input.ts
+/** Builds ordered Codex user input for both new turns and same-turn steering. */
+function buildCodexUserInput(text, images, contextImageGroups, historyProvenancePrefix) {
+	if (text !== void 0 && contextImageGroups?.length) {
+		let offset = 0;
+		return prependHistoryProvenance([...contextImageGroups.flatMap((group) => {
+			const parts = buildCodexUserInput(text.slice(offset, group.end), group.images);
+			offset = group.end;
+			return parts;
+		}), ...buildCodexUserInput(text.slice(offset), images)]);
+	}
+	const imageInputs = (images ?? []).map((image) => {
+		const imageUrl = sanitizeInlineImageDataUrl(`data:${image.mimeType};base64,${image.data}`);
+		return imageUrl ? {
+			type: "image",
+			url: imageUrl
+		} : {
+			type: "text",
+			text: invalidInlineImageText("codex user input"),
+			text_elements: []
+		};
+	});
+	return prependHistoryProvenance([...text === void 0 ? [] : [{
+		type: "text",
+		text,
+		text_elements: []
+	}], ...imageInputs]);
+	function prependHistoryProvenance(input) {
+		if (!historyProvenancePrefix) return input;
+		const firstTextIndex = input.findIndex((item) => item.type === "text");
+		if (firstTextIndex === -1) return [{
+			type: "text",
+			text: historyProvenancePrefix,
+			text_elements: []
+		}, ...input];
+		return input.map((item, index) => index === firstTextIndex && item.type === "text" ? {
+			...item,
+			text: `${historyProvenancePrefix}${item.text}`
+		} : item);
+	}
+}
+//#endregion
 //#region extensions/codex/src/app-server/native-process-authority.ts
 const clients = /* @__PURE__ */ new WeakMap();
 /** A physical client joins native call receipts to its concrete sandbox processes. */
@@ -458,7 +514,15 @@ var CodexNativeProcessClient = class {
 			const threadId = readCodexNotificationThreadId(notification.params);
 			const turnId = readCodexNotificationTurnId(notification.params);
 			const commands = threadId ? this.threads.get(threadId) : void 0;
-			if (!commands || !turnId) return;
+			if (!commands) return;
+			if (notification.method === "thread/closed" || notification.method === "thread/archived" || notification.method === "thread/deleted") {
+				for (const command of commands.values()) {
+					command.background = void 0;
+					this.closeAdmission(command);
+				}
+				return;
+			}
+			if (!turnId) return;
 			if (notification.method === "turn/completed") {
 				for (const command of commands.values()) if (command.turnId === turnId) this.closeAdmission(command);
 			} else if (notification.method === "item/completed") {
@@ -516,17 +580,14 @@ var CodexNativeProcessClient = class {
 		assertAdmission();
 		const process = { terminate };
 		command.processes.add(process);
-		let settled = false;
 		return {
 			assertAdmission,
 			assertCurrent: () => {
 				command.owner.assertCurrent();
-				if (this.closed || settled) throw new Error("Codex native process authority has ended");
+				if (this.closed || !command.processes.has(process)) throw new Error("Codex native process authority has ended");
 			},
 			settle: () => {
-				if (settled) return;
-				settled = true;
-				command.processes.delete(process);
+				if (!command.processes.delete(process)) return;
 				this.forgetSettled(command);
 			},
 			fail: (error) => command.owner.reportSettlementFailure(error)
@@ -681,16 +742,133 @@ var CodexNativeProcessAuthority = class {
 	}
 };
 //#endregion
+//#region extensions/codex/src/app-server/turn-params.ts
+const CODEX_CURRENT_SENDER_FIELD_MAX_CHARS = 256;
+function readCodexCurrentSender(params) {
+	const metadata = asOptionalRecord(asOptionalRecord(params.userTurnTranscriptRecorder?.message)?.["__openclaw"]);
+	const fields = [
+		"senderId",
+		"senderName",
+		"senderUsername"
+	];
+	const recorded = fields.map((key) => normalizeOptionalString(metadata?.[key]));
+	const [id, name, username] = recorded.some(Boolean) ? recorded : fields.map((key) => normalizeOptionalString(params[key]));
+	if (!id && !name && !username) return;
+	const bound = (value) => truncateUtf16Safe(value, CODEX_CURRENT_SENDER_FIELD_MAX_CHARS);
+	return {
+		...id ? { id: bound(id) } : {},
+		...name ? { name: bound(name) } : {},
+		...username ? { username: bound(username) } : {}
+	};
+}
+function buildCodexHistoryProvenancePrefix(params) {
+	const sender = readCodexCurrentSender(params);
+	return sender?.id ? neutralizeCodexExplicitMentionSigils(`[OpenClaw conversation info: sender=${JSON.stringify(sender)}]\n`) : void 0;
+}
+function buildTurnStartParams(params, options) {
+	const modelSelection = options.preserveNativeTurnSettings ? void 0 : resolveCodexAppServerRequestModelSelection({
+		homeScope: options.appServer.start.homeScope,
+		model: options.model ?? params.modelId,
+		modelProvider: options.modelProvider,
+		authProfileId: params.authProfileId,
+		authProfileStore: params.authProfileStore,
+		agentDir: params.agentDir,
+		config: params.config
+	});
+	const collaborationMode = modelSelection ? buildTurnCollaborationMode(params, { model: modelSelection.model }) : void 0;
+	if (collaborationMode && options.parentLocalEgress) collaborationMode.settings.developer_instructions = null;
+	const useThreadPermissionProfile = options.appServer.networkProxy && !options.sandboxPolicy;
+	const currentSender = params.trigger === "user" ? readCodexCurrentSender(params) : void 0;
+	const additionalContext = {
+		...buildCodexTemporalAdditionalContext(params, { sessionStatusAvailable: options.sessionStatusAvailable === true }),
+		openclaw_active_computer: {
+			kind: "application",
+			value: params.hostCapabilities.activeComputerContext?.() ?? "Current active computer: active_node=unknown (host presence unavailable)"
+		},
+		openclaw_source_delivery: {
+			kind: "application",
+			value: ["Current source-delivery policy for this turn (replaces earlier source-delivery guidance):", buildHarnessVisibleReplyGuidance({
+				sourceReplyDeliveryMode: params.sourceReplyDeliveryMode,
+				messageToolAvailable: options.messageToolAvailable === true,
+				requireExplicitMessageTarget: options.requireExplicitMessageTarget
+			})].join("\n")
+		}
+	};
+	if (currentSender) additionalContext.openclaw_current_sender = {
+		kind: "untrusted",
+		value: JSON.stringify({ sender: currentSender })
+	};
+	if (params.permissionChange?.notice) additionalContext.openclaw_permission_change = {
+		kind: "application",
+		value: params.permissionChange.notice
+	};
+	return {
+		threadId: options.threadId,
+		...params.trigger ? { turnTrigger: params.trigger } : {},
+		input: [...buildCodexUserInput(options.promptText ?? params.prompt, params.images, options.contextImageGroups, options.historyProvenancePrefix ?? (params.trigger === "user" ? buildCodexHistoryProvenancePrefix(params) : void 0)), ...options.explicitSkillInputs ?? []],
+		additionalContext,
+		cwd: options.cwd,
+		...options.appServer.sessionRoot ? { runtimeWorkspaceRoots: [options.appServer.sessionRoot] } : {},
+		approvalPolicy: options.appServer.approvalPolicy,
+		approvalsReviewer: options.appServer.approvalsReviewer,
+		...useThreadPermissionProfile ? {} : { sandboxPolicy: options.sandboxPolicy ?? codexSandboxPolicyForTurn(options.appServer.sandbox, options.appServer.sessionRoot ?? options.cwd, options.appServer.start?.args) },
+		...modelSelection ? {
+			model: modelSelection.model,
+			personality: CODEX_NATIVE_PERSONALITY_NONE
+		} : {},
+		...options.appServer.serviceTier !== void 0 ? { serviceTier: options.appServer.serviceTier } : options.clearInheritedServiceTier ? { serviceTier: null } : {},
+		...collaborationMode ? {
+			effort: collaborationMode.settings.reasoning_effort,
+			collaborationMode
+		} : {},
+		...params.requireWorkspaceOnly === true ? { environments: [] } : options.environmentSelection ? { environments: options.environmentSelection } : {}
+	};
+}
+function buildCodexTemporalAdditionalContext(params, options) {
+	return { openclaw_temporal_context: {
+		kind: "application",
+		value: buildTemporalContextText({
+			configuredTimezone: params.config?.agents?.defaults?.userTimezone,
+			sessionStatusAvailable: options.sessionStatusAvailable
+		})
+	} };
+}
+function buildTurnCollaborationMode(params, options = {}) {
+	const model = options.model ?? params.modelId;
+	return {
+		mode: "default",
+		settings: {
+			model,
+			reasoning_effort: resolveCodexAppServerReasoningEffort({
+				thinkLevel: params.thinkLevel,
+				modelId: model,
+				supportedReasoningEfforts: readCodexSupportedReasoningEfforts(params.model?.compat)
+			}),
+			developer_instructions: params.trigger === "cron" ? CRON_COLLABORATION_INSTRUCTIONS : null
+		}
+	};
+}
+function buildCodexParentLocalInstructions(params, options = {}) {
+	const contextInstructions = joinPresentSections(options.personaInstructions, options.skillsInstructions, options.memoryInstructions);
+	if (params.trigger === "cron") return joinPresentSections(CRON_COLLABORATION_INSTRUCTIONS, contextInstructions);
+	return contextInstructions || null;
+}
+const CRON_COLLABORATION_INSTRUCTIONS = [
+	"This is an OpenClaw cron automation turn. Apply these instructions only to this scheduled job; ordinary chat turns should stay in Codex Default mode.",
+	"Execute the cron payload directly. If it asks you to run an exact command, run that command before doing any investigation, planning, memory review, or workspace bootstrap.",
+	"Use context already provided by the runtime, but do not spend time loading or re-reading workspace bootstrap, memory, or project-doc files before executing the cron payload. Inspect those files only if the payload asks for them or the command fails and they are needed to diagnose it.",
+	"Keep output concise and automation-oriented. Prefer the final command result or a short failure summary over status narration."
+].join("\n\n");
+//#endregion
 //#region extensions/codex/src/app-server/native-pre-tool-use-failures.ts
 /** Holds failures until a projector or terminal diagnostic owns their delivery. */
 function createCodexNativePreToolUseFailureBuffer(params) {
 	const pending = [];
-	let active = false;
-	let terminalReason;
+	let fallback;
 	const emit = (failure) => emitCodexNativePreToolUseFailureDiagnostic({
 		...params,
 		failure,
-		...active ? { terminalReason: terminalReason ?? failure.disposition } : {}
+		...fallback ? { terminalReason: fallback.terminalReason ?? failure.disposition } : {}
 	});
 	const flush = () => {
 		for (const failure of pending.splice(0)) emit(failure);
@@ -698,17 +876,14 @@ function createCodexNativePreToolUseFailureBuffer(params) {
 	return {
 		pending,
 		get active() {
-			return active;
+			return fallback !== void 0;
 		},
 		record(failure) {
-			if (active) emit(failure);
+			if (fallback) emit(failure);
 			else pending.push(failure);
 		},
 		activateFallback(wasAborted) {
-			if (!active) {
-				terminalReason = wasAborted ? resolveCodexToolAbortTerminalReason(params.signal) : void 0;
-				active = true;
-			}
+			fallback ??= { terminalReason: wasAborted ? resolveCodexToolAbortTerminalReason(params.signal) : void 0 };
 			flush();
 		},
 		flush
@@ -1063,11 +1238,6 @@ function requireString(value, label) {
 	if (typeof value !== "string" || !value) throw new Error(`${label} must be a non-empty string.`);
 	return value;
 }
-/** Validates a base64 payload parameter as a string; decoding happens at call sites. */
-function requireBase64String(value, label) {
-	if (typeof value !== "string") throw new Error(`${label} must be a string.`);
-	return value;
-}
 function requireNumber(value, label) {
 	if (typeof value !== "number" || !Number.isFinite(value)) throw new Error(`${label} must be a finite number.`);
 	return value;
@@ -1110,34 +1280,28 @@ function sendError(send, id, code, message) {
 const WINDOWS_DRIVE_PATH_RE = /^\/[A-Za-z]:(?:\/|$)/u;
 /** Resolves one Codex exec-server PathUri into a POSIX sandbox path. */
 function resolveExecServerPath(rawPath, label) {
-	let pathUrl;
-	try {
-		pathUrl = new URL(rawPath);
-	} catch (error) {
-		throw new Error(`${label} must be a valid file URI: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
-	}
+	const pathUrl = parseSandboxPath(() => new URL(rawPath), `${label} must be a valid file URI`);
 	if (pathUrl.protocol !== "file:") throw new Error(`${label} URI must use the file scheme, received ${pathUrl.protocol.slice(0, -1)}.`);
 	if (pathUrl.search || pathUrl.hash) throw new Error(`${label} file URI must not include a query or fragment.`);
-	let resolved;
-	try {
-		resolved = fileURLToPath(pathUrl, { windows: false });
-	} catch (error) {
-		throw new Error(`${label} file URI is not valid for the sandbox: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
-	}
+	const resolved = parseSandboxPath(() => fileURLToPath(pathUrl, { windows: false }), `${label} file URI is not valid for the sandbox`);
 	if (WINDOWS_DRIVE_PATH_RE.test(resolved)) throw new Error(`${label} Windows file URI is not supported by the sandbox.`);
 	if (resolved.includes("\0")) throw new Error(`${label} file URI must not contain a null byte.`);
 	return resolved;
 }
+function parseSandboxPath(parse, message) {
+	try {
+		return parse();
+	} catch (error) {
+		throw new Error(`${message}: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
+	}
+}
 //#endregion
 //#region extensions/codex/src/app-server/sandbox-exec-server/fs-policy.ts
-/**
-* Resolves Codex filesystem sandbox policy payloads into OpenClaw path/glob
-* checks for sandbox exec-server filesystem operations.
-*/
-/** Resolves request-local sandbox policy and asserts each requested path has the needed access. */
-function assertFsSandboxAccess(execServer, record, requests) {
-	assertResolvedFsSandboxAccess(resolveFsSandboxPolicy(execServer, record), requests);
-}
+const FS_ACCESS_RANK = {
+	read: 0,
+	write: 1,
+	none: 2
+};
 /** Parses a Codex managed filesystem sandbox context into normalized access entries. */
 function resolveFsSandboxPolicy(execServer, record) {
 	if (record.sandbox === void 0 || record.sandbox === null) return;
@@ -1174,13 +1338,8 @@ function resolveFsSandboxEntry(entry, cwd) {
 	const access = readFsAccessMode(entry.access);
 	const pathSpec = requireObject(entry.path, "fs sandbox entry path");
 	const pathType = requireString(pathSpec.type, "fs sandbox entry path type");
-	if (pathType === "path") return {
-		kind: "path",
-		path: normalizeSandboxAbsolutePath(resolveExecServerPath(requireString(pathSpec.path, "fs sandbox path"), "fs sandbox path"), "fs sandbox path"),
-		access
-	};
-	if (pathType === "special") {
-		const path = resolveFsSpecialPath(requireObject(pathSpec.value, "fs sandbox special path"), cwd);
+	if (pathType === "path" || pathType === "special") {
+		const path = pathType === "path" ? normalizeSandboxAbsolutePath(resolveExecServerPath(requireString(pathSpec.path, "fs sandbox path"), "fs sandbox path"), "fs sandbox path") : resolveFsSpecialPath(requireObject(pathSpec.value, "fs sandbox special path"), cwd);
 		return path === void 0 ? void 0 : {
 			kind: "path",
 			path,
@@ -1220,18 +1379,17 @@ function resolveFsSpecialPath(value, cwd) {
 function assertResolvedFsSandboxAccess(policy, requests) {
 	if (!policy?.unrestricted && policy) for (const request of requests) {
 		const access = resolveFsAccess(policy, request.path);
-		if (request.access === "read" && access === "none") throw new Error(`Codex fs sandbox denied read access to ${request.path}`);
-		if (request.access === "write" && access !== "write") throw new Error(`Codex fs sandbox denied write access to ${request.path}`);
+		if (request.access === "read" ? access === "none" : access !== "write") throw new Error(`Codex fs sandbox denied ${request.access} access to ${request.path}`);
 	}
 }
 function resolveFsAccess(policy, rawPath) {
 	const target = normalizeSandboxAbsolutePath(rawPath, "fs path");
 	let selected;
 	for (const entry of policy.entries) {
-		if (!fsSandboxEntryMatches(entry, target)) continue;
+		if (!(entry.kind === "path" ? pathContains(entry.path, target) : entry.matcher.test(target))) continue;
 		const candidate = {
-			specificity: fsSandboxEntrySpecificity(entry),
-			rank: fsAccessRank(entry.access),
+			specificity: (entry.kind === "path" ? entry.path : entry.literalPrefix).split("/").filter(Boolean).length,
+			rank: FS_ACCESS_RANK[entry.access],
 			access: entry.access
 		};
 		if (!selected || candidate.specificity > selected.specificity || candidate.specificity === selected.specificity && candidate.rank > selected.rank) selected = candidate;
@@ -1243,10 +1401,10 @@ function assertNoReadOnlyDescendant(policy, rawPath, operation) {
 	if (!policy || policy.unrestricted) return;
 	const target = normalizeSandboxAbsolutePath(rawPath, "fs path");
 	const protectedDescendant = policy.entries.find((entry) => {
-		if (entry.access === "write" || !fsSandboxEntryCanAffectDescendant(entry, target)) return false;
-		if (entry.kind === "glob") return true;
+		if (entry.access === "write") return false;
+		if (entry.kind === "glob") return pathContains(target, entry.literalPrefix) || pathContains(entry.literalPrefix, target);
 		const protectedPath = entry.path;
-		return protectedPath && resolveFsAccess(policy, protectedPath) !== "write";
+		return pathContains(target, protectedPath) && target !== protectedPath && protectedPath && resolveFsAccess(policy, protectedPath) !== "write";
 	});
 	if (protectedDescendant) {
 		const protectedPath = protectedDescendant.kind === "path" ? protectedDescendant.path : protectedDescendant.pattern;
@@ -1256,32 +1414,11 @@ function assertNoReadOnlyDescendant(policy, rawPath, operation) {
 /** Normalizes and validates an absolute POSIX path inside the sandbox namespace. */
 function normalizeSandboxAbsolutePath(rawPath, label) {
 	if (!rawPath || rawPath.includes("\0") || !rawPath.startsWith("/")) throw new Error(`${label} must be an absolute sandbox path.`);
-	const normalized = posix.normalize(rawPath);
-	return normalized === "//" ? "/" : normalized;
+	return posix.normalize(rawPath);
 }
-/** Returns true when target is root itself or a descendant of root. */
 function pathContains(root, target) {
 	return root === "/" || target === root || target.startsWith(`${root}/`);
 }
-function fsSandboxEntryMatches(entry, target) {
-	if (entry.kind === "path") return pathContains(entry.path, target);
-	return entry.matcher.test(target);
-}
-function fsSandboxEntryCanAffectDescendant(entry, target) {
-	if (entry.kind === "path") return pathContains(target, entry.path) && target !== entry.path;
-	return pathContains(target, entry.literalPrefix) || pathContains(entry.literalPrefix, target);
-}
-function fsSandboxEntrySpecificity(entry) {
-	return pathSpecificity(entry.kind === "path" ? entry.path : entry.literalPrefix);
-}
-function pathSpecificity(filePath) {
-	return filePath === "/" ? 0 : filePath.split("/").filter(Boolean).length;
-}
-function fsAccessRank(access) {
-	if (access === "none") return 2;
-	if (access === "write") return 1;
-	return 0;
-}
 function normalizeSandboxGlobPattern(pattern) {
 	if (!pattern || pattern.includes("\0") || !pattern.startsWith("/")) throw new Error("fs sandbox glob pattern must be absolute.");
 	return pattern.replace(/\/{2,}/gu, "/");
@@ -1321,15 +1458,10 @@ function compileSandboxGlobCharacterClass(pattern, startIndex) {
 			endIndex: index
 		};
 		if (!char || char === "/") throw new Error("fs sandbox glob character class cannot match path separators.");
-		body += escapeSandboxGlobCharacterClassChar(char, body.length === 0);
+		body += char === "\\" || char === "]" || body.length === 0 && char === "^" ? `\\${char}` : char;
 	}
 	throw new Error("fs sandbox glob character class must be closed.");
 }
-function escapeSandboxGlobCharacterClassChar(char, first) {
-	if (char === "\\" || char === "]") return `\\${char}`;
-	if (first && char === "^") return "\\^";
-	return char;
-}
 function sandboxGlobLiteralPrefix(pattern) {
 	const wildcardIndex = pattern.search(/[*?[]/u);
 	const prefix = wildcardIndex === -1 ? pattern : pattern.slice(0, wildcardIndex);
@@ -1369,6 +1501,9 @@ async function openFile(execServer, handles, params) {
 		reservedBytes: 0
 	};
 	handles.set(handleId, handle);
+	const assertCurrent = () => {
+		if (handles.get(handleId) !== handle || handle.closeRequested || handles.closed) throw new JsonRpcProtocolError(JSON_RPC_NOT_FOUND, `unknown file read handle \`${handleId}\``);
+	};
 	try {
 		const readPolicy = await authorizePhysicalReadPath(fsBridge, fsSandboxPolicy, filePath, handle.abortController.signal);
 		const stat = await fsBridge.stat({
@@ -1376,7 +1511,7 @@ async function openFile(execServer, handles, params) {
 			signal: handle.abortController.signal,
 			...readPolicy
 		});
-		if (handles.get(handleId) !== handle || handle.closeRequested || handles.closed) throw new JsonRpcProtocolError(JSON_RPC_NOT_FOUND, `unknown file read handle \`${handleId}\``);
+		assertCurrent();
 		if (!stat) throw new JsonRpcProtocolError(JSON_RPC_NOT_FOUND, "file not found");
 		if (stat.type !== "file") throw new JsonRpcProtocolError(-32600, "file read handle requires a regular file");
 		if (!Number.isSafeInteger(stat.size) || stat.size < 0) throw new JsonRpcProtocolError(-32600, "file size must be a non-negative safe integer");
@@ -1388,7 +1523,7 @@ async function openFile(execServer, handles, params) {
 			signal: handle.abortController.signal,
 			...readPolicy
 		});
-		if (handles.get(handleId) !== handle || handle.closeRequested || handles.closed) throw new JsonRpcProtocolError(JSON_RPC_NOT_FOUND, `unknown file read handle \`${handleId}\``);
+		assertCurrent();
 		if (data.byteLength > handle.reservedBytes) throw new JsonRpcProtocolError(-32600, "sandbox file read exceeds the per-connection buffered file limit");
 		handle.reservedBytes = data.byteLength;
 		handle.data = data;
@@ -1444,9 +1579,10 @@ function requireFileReadHandleId(value) {
 	if (Buffer.byteLength(handleId, "utf8") > CODEX_SANDBOX_EXEC_SERVER_MAX_FILE_READ_HANDLE_ID_BYTES) throw new JsonRpcProtocolError(-32600, `file read handle ID must not exceed ${CODEX_SANDBOX_EXEC_SERVER_MAX_FILE_READ_HANDLE_ID_BYTES} bytes`);
 	return handleId;
 }
-async function readFile(execServer, params) {
-	const record = requireObject(params, "fs/readFile params");
-	const filePath = resolveExecServerPath(requireString(record.path, "path"), "read path");
+async function readFileOrMetadata(execServer, params, method) {
+	const record = requireObject(params, `${method} params`);
+	const metadataOnly = method === "fs/getMetadata";
+	const filePath = resolveExecServerPath(requireString(record.path, "path"), metadataOnly ? "metadata path" : "read path");
 	const fsSandboxPolicy = resolveFsSandboxPolicy(execServer, record);
 	assertResolvedFsSandboxAccess(fsSandboxPolicy, [{
 		path: filePath,
@@ -1454,11 +1590,19 @@ async function readFile(execServer, params) {
 	}]);
 	const fsBridge = execServer.fsBridge;
 	const readPolicy = await authorizePhysicalReadPath(fsBridge, fsSandboxPolicy, filePath);
-	const stat = await fsBridge.stat({
+	const stat = await (metadataOnly ? execServer.fsBridge : fsBridge).stat({
 		filePath,
 		...readPolicy
 	});
 	if (!stat) throw new JsonRpcProtocolError(JSON_RPC_NOT_FOUND, "file not found");
+	if (metadataOnly) return {
+		isDirectory: stat.type === "directory",
+		isFile: stat.type === "file",
+		isSymlink: false,
+		size: stat.size,
+		createdAtMs: 0,
+		modifiedAtMs: stat.mtimeMs ?? 0
+	};
 	assertSandboxFileReadWithinLimit(stat);
 	return { dataBase64: (await fsBridge.readFile({
 		filePath,
@@ -1466,75 +1610,39 @@ async function readFile(execServer, params) {
 		...readPolicy
 	})).toString("base64") };
 }
-async function writeFile(execServer, params) {
-	const record = requireObject(params, "fs/writeFile params");
-	const filePath = resolveExecServerPath(requireString(record.path, "path"), "write path");
+async function writeFileOrDirectory(execServer, params, method) {
+	const record = requireObject(params, `${method} params`);
+	const directory = method === "fs/createDirectory";
+	const filePath = resolveExecServerPath(requireString(record.path, "path"), directory ? "create-directory path" : "write path");
 	const fsBridge = execServer.fsBridge;
 	const canonicalDestination = await fsBridge.resolvePinnedMutationTarget?.({
 		filePath,
-		action: "write"
+		action: directory ? "mkdir" : "write"
 	});
-	assertFsSandboxAccess(execServer, record, [{
+	assertResolvedFsSandboxAccess(resolveFsSandboxPolicy(execServer, record), [{
 		path: filePath,
 		access: "write"
 	}, ...canonicalDestination ? [{
 		path: canonicalDestination.policyPath,
 		access: "write"
 	}] : []]);
-	if ((await fsBridge.stat({ filePath: posix.dirname(filePath) }))?.type !== "directory") throw new JsonRpcProtocolError(JSON_RPC_NOT_FOUND, "parent directory not found");
-	await fsBridge.writeFile({
+	if (!directory || record.recursive === false) {
+		if ((await fsBridge.stat({ filePath: posix.dirname(filePath) }))?.type !== "directory") throw new JsonRpcProtocolError(JSON_RPC_NOT_FOUND, "parent directory not found");
+	}
+	if (directory) await fsBridge.mkdirp({
 		filePath,
-		data: Buffer.from(requireBase64String(record.dataBase64, "dataBase64"), "base64"),
-		mkdir: false,
 		pinnedPath: canonicalDestination?.pinnedPath
 	});
-}
-async function createDirectory(execServer, params) {
-	const record = requireObject(params, "fs/createDirectory params");
-	const filePath = resolveExecServerPath(requireString(record.path, "path"), "create-directory path");
-	const fsBridge = execServer.fsBridge;
-	const canonicalDestination = await fsBridge.resolvePinnedMutationTarget?.({
-		filePath,
-		action: "mkdir"
-	});
-	assertFsSandboxAccess(execServer, record, [{
-		path: filePath,
-		access: "write"
-	}, ...canonicalDestination ? [{
-		path: canonicalDestination.policyPath,
-		access: "write"
-	}] : []]);
-	if (record.recursive === false) {
-		const parentPath = posix.dirname(filePath);
-		if ((await fsBridge.stat({ filePath: parentPath }))?.type !== "directory") throw new JsonRpcProtocolError(JSON_RPC_NOT_FOUND, "parent directory not found");
-	}
-	await fsBridge.mkdirp({
+	else await fsBridge.writeFile({
 		filePath,
+		data: decodeFileData(record.dataBase64),
+		mkdir: false,
 		pinnedPath: canonicalDestination?.pinnedPath
 	});
 }
-async function getMetadata(execServer, params) {
-	const record = requireObject(params, "fs/getMetadata params");
-	const filePath = resolveExecServerPath(requireString(record.path, "path"), "metadata path");
-	const fsSandboxPolicy = resolveFsSandboxPolicy(execServer, record);
-	assertResolvedFsSandboxAccess(fsSandboxPolicy, [{
-		path: filePath,
-		access: "read"
-	}]);
-	const readPolicy = await authorizePhysicalReadPath(execServer.fsBridge, fsSandboxPolicy, filePath);
-	const stat = await execServer.fsBridge.stat({
-		filePath,
-		...readPolicy
-	});
-	if (!stat) throw new JsonRpcProtocolError(JSON_RPC_NOT_FOUND, "file not found");
-	return {
-		isDirectory: stat.type === "directory",
-		isFile: stat.type === "file",
-		isSymlink: false,
-		size: stat.size,
-		createdAtMs: 0,
-		modifiedAtMs: stat.mtimeMs ?? 0
-	};
+function decodeFileData(value) {
+	if (typeof value !== "string") throw new Error("dataBase64 must be a string.");
+	return Buffer.from(value, "base64");
 }
 async function readDirectory(execServer, params) {
 	const record = requireObject(params, "fs/readDirectory params");
@@ -1775,7 +1883,7 @@ async function spawnSandboxChild(params) {
 					escalation = setTimeout(() => signalLocal("SIGKILL"), SANDBOX_CHILD_TERM_GRACE_MS);
 					escalation.unref?.();
 				}
-				const reaped = await Promise.race([closed.promise.then(() => true), delay(SANDBOX_CHILD_REAP_TIMEOUT_MS).then(() => false)]).finally(() => clearTimeout(escalation));
+				const reaped = await raceWithTimeout(closed.promise.then(() => true), SANDBOX_CHILD_REAP_TIMEOUT_MS, () => false, { ref: false }).finally(() => clearTimeout(escalation));
 				await Promise.all(localSignals);
 				if (!reaped) throw new Error(`Sandbox child process tree ${pty?.pid ?? child?.pid ?? "unknown"} survived SIGKILL; tear down the sandbox environment and inspect the surviving process tree before retrying.`);
 			}
@@ -1785,7 +1893,8 @@ async function spawnSandboxChild(params) {
 		})()
 	};
 	params.owners.add(owner);
-	settled.then(() => params.owners.delete(owner), () => params.owners.delete(owner));
+	const releaseOwner = () => params.owners.delete(owner);
+	settled.then(releaseOwner, releaseOwner);
 	const interrupt = async () => {
 		await ready.promise;
 		const interruptRemote = params.interruptRemote;
@@ -1798,7 +1907,7 @@ async function spawnSandboxChild(params) {
 				if (remainingMs <= 0) throw new Error("Sandbox process interrupt timed out waiting for remote process admission");
 				assertCurrent();
 				if (await interruptRemote(remainingMs)) return;
-				await Promise.race([delay(Math.min(SANDBOX_CHILD_INTERRUPT_POLL_MS, Math.max(0, deadline - performance.now()))), exited.promise]);
+				await raceWithTimeout(exited.promise, Math.min(SANDBOX_CHILD_INTERRUPT_POLL_MS, Math.max(0, deadline - performance.now())), () => void 0, { ref: false });
 			}
 		})();
 		interruptions.add(interruption);
@@ -1865,11 +1974,6 @@ async function spawnSandboxChild(params) {
 		ready.resolve();
 	}
 }
-function delay(ms) {
-	return new Promise((resolve) => {
-		setTimeout(resolve, ms).unref?.();
-	});
-}
 //#endregion
 //#region extensions/codex/src/app-server/sandbox-exec-server/http.ts
 const SANDBOX_HTTP_STREAM_LINE_MAX_CHARS = 262144;
@@ -1953,11 +2057,12 @@ async function runSandboxHttpRequest(execServer, notifications, requestId, param
 		}
 		return termination;
 	};
+	const cleanup = () => terminate().catch((error) => {
+		embeddedAgentLog.warn("codex sandbox http/request cleanup failed", { error });
+	});
 	const abortOnSessionClose = () => {
 		lifecycle.failed = true;
-		terminate().catch((error) => {
-			embeddedAgentLog.warn("codex sandbox http/request cleanup failed", { error });
-		});
+		cleanup();
 	};
 	notifications.signal.addEventListener("abort", abortOnSessionClose, { once: true });
 	child.once("close", () => {
@@ -1967,35 +2072,8 @@ async function runSandboxHttpRequest(execServer, notifications, requestId, param
 		if (error.code === "EPIPE" || error.code === "ERR_STREAM_DESTROYED") return;
 		embeddedAgentLog.warn("codex sandbox http/request stdin write failed", { error });
 	});
-	readSandboxHttpResponse({
-		child,
-		lifecycle,
-		terminate,
-		requestId,
-		notifications,
-		streamResponse: params.streamResponse
-	}).then(response.resolve, response.reject);
-	try {
-		if (notifications.signal.aborted) abortOnSessionClose();
-		else {
-			owner.assertCurrent();
-			child.stdin.end(JSON.stringify(params));
-		}
-		await completion.promise;
-		await termination;
-	} catch (error) {
-		lifecycle.failed = true;
-		response.reject(error);
-		await terminate().catch((cleanupError) => {
-			embeddedAgentLog.warn("codex sandbox http/request cleanup failed", { error: cleanupError });
-		});
-		throw error;
-	} finally {
-		notifications.signal.removeEventListener("abort", abortOnSessionClose);
-	}
-}
-function readSandboxHttpResponse(params) {
-	return new Promise((resolve, reject) => {
+	const { streamResponse } = params;
+	new Promise((resolve, reject) => {
 		let headerResolved = false;
 		let failed = false;
 		let childFailure = null;
@@ -2015,13 +2093,11 @@ function readSandboxHttpResponse(params) {
 		const fail = (message) => {
 			if (failed) return;
 			failed = true;
-			params.lifecycle.failed = true;
-			params.terminate().catch((error) => {
-				embeddedAgentLog.warn("codex sandbox http/request cleanup failed", { error });
-			});
+			lifecycle.failed = true;
+			cleanup();
 			if (headerResolved) {
-				params.notifications.send("http/request/bodyDelta", {
-					requestId: params.requestId,
+				notifications.send("http/request/bodyDelta", {
+					requestId,
 					seq: lastBodySeq + 1,
 					deltaBase64: "",
 					done: true,
@@ -2041,64 +2117,58 @@ function readSandboxHttpResponse(params) {
 			}
 			output.chunks.push(buffer);
 		};
-		if (params.streamResponse) {
-			params.child.stdout.setEncoding("utf8");
-			params.child.stderr.setEncoding("utf8");
-		}
-		params.child.stdout.on("data", (chunk) => {
-			if (failed) return;
-			if (!params.streamResponse) {
-				bufferOutput("stdout", chunk);
-				return;
-			}
-			const text = typeof chunk === "string" ? chunk : chunk.toString("utf8");
-			stdoutBuffer += text;
-			let newline = stdoutBuffer.indexOf("\n");
-			while (newline >= 0) {
-				const line = stdoutBuffer.slice(0, newline).trim();
-				stdoutBuffer = stdoutBuffer.slice(newline + 1);
-				if (line) try {
-					const message = requireObject(JSON.parse(line), "http stream message");
-					const type = requireString(message.type, "http stream message type");
-					if (type === "headers") {
-						headerResolved = true;
-						resolve({
-							status: requireNumber(message.status, "http status"),
-							headers: readHttpHeaders(message.headers),
-							bodyBase64: ""
-						});
-					} else if (type === "bodyDelta") {
-						const seq = requireNumber(message.seq, "http body sequence");
-						lastBodySeq = Math.max(lastBodySeq, seq);
-						params.notifications.send("http/request/bodyDelta", {
-							requestId: params.requestId,
-							seq,
-							deltaBase64: typeof message.deltaBase64 === "string" ? message.deltaBase64 : "",
-							done: message.done === true,
-							error: typeof message.error === "string" ? message.error : null
-						});
+		for (const stream of ["stdout", "stderr"]) {
+			if (streamResponse) child[stream].setEncoding("utf8");
+			child[stream].on("data", (chunk) => {
+				if (failed) return;
+				if (!streamResponse) {
+					bufferOutput(stream, chunk);
+					return;
+				}
+				const text = typeof chunk === "string" ? chunk : chunk.toString("utf8");
+				if (stream === "stderr") {
+					stderr = sliceUtf16Safe(`${stderr}${text}`, -4096);
+					return;
+				}
+				stdoutBuffer += text;
+				let newline = stdoutBuffer.indexOf("\n");
+				while (newline >= 0) {
+					const line = stdoutBuffer.slice(0, newline).trim();
+					stdoutBuffer = stdoutBuffer.slice(newline + 1);
+					if (line) try {
+						const message = requireObject(JSON.parse(line), "http stream message");
+						const type = requireString(message.type, "http stream message type");
+						if (type === "headers") {
+							headerResolved = true;
+							resolve({
+								status: requireNumber(message.status, "http status"),
+								headers: readHttpHeaders(message.headers),
+								bodyBase64: ""
+							});
+						} else if (type === "bodyDelta") {
+							const seq = requireNumber(message.seq, "http body sequence");
+							lastBodySeq = Math.max(lastBodySeq, seq);
+							notifications.send("http/request/bodyDelta", {
+								requestId,
+								seq,
+								deltaBase64: typeof message.deltaBase64 === "string" ? message.deltaBase64 : "",
+								done: message.done === true,
+								error: typeof message.error === "string" ? message.error : null
+							});
+						}
+					} catch (error) {
+						fail(error instanceof Error ? error.message : String(error));
 					}
-				} catch (error) {
-					fail(error instanceof Error ? error.message : String(error));
+					newline = stdoutBuffer.indexOf("\n");
 				}
-				newline = stdoutBuffer.indexOf("\n");
-			}
-			if (stdoutBuffer.length > SANDBOX_HTTP_STREAM_LINE_MAX_CHARS) fail(`sandbox http/request produced an unterminated stdout line longer than ${SANDBOX_HTTP_STREAM_LINE_MAX_CHARS} characters`);
-		});
-		params.child.stderr.on("data", (chunk) => {
-			if (failed) return;
-			if (!params.streamResponse) {
-				bufferOutput("stderr", chunk);
-				return;
-			}
-			const text = typeof chunk === "string" ? chunk : chunk.toString("utf8");
-			stderr = sliceUtf16Safe(`${stderr}${text}`, -4096);
-		});
-		params.child.once("error", (error) => {
+				if (stdoutBuffer.length > SANDBOX_HTTP_STREAM_LINE_MAX_CHARS) fail(`sandbox http/request produced an unterminated stdout line longer than ${SANDBOX_HTTP_STREAM_LINE_MAX_CHARS} characters`);
+			});
+		}
+		child.once("error", (error) => {
 			childFailure ??= error.message;
-			params.lifecycle.failed = true;
+			lifecycle.failed = true;
 		});
-		params.child.once("close", (code) => {
+		child.once("close", (code) => {
 			const exitCode = code ?? 1;
 			if (failed) return;
 			if (childFailure) {
@@ -2106,7 +2176,7 @@ function readSandboxHttpResponse(params) {
 				return;
 			}
 			if (exitCode === 0) {
-				if (!params.streamResponse) {
+				if (!streamResponse) {
 					try {
 						const parsed = JSON.parse(Buffer.concat(buffered.stdout.chunks).toString("utf8"));
 						if (typeof parsed.status !== "number" || !Array.isArray(parsed.headers)) throw new Error("sandbox http/request returned an invalid response envelope");
@@ -2121,15 +2191,31 @@ function readSandboxHttpResponse(params) {
 					return;
 				}
 				if (!headerResolved) {
-					params.lifecycle.failed = true;
+					lifecycle.failed = true;
 					reject(/* @__PURE__ */ new Error("sandbox http/request exited before returning headers"));
 				}
 				return;
 			}
-			if (!params.streamResponse) stderr = Buffer.concat(buffered.stderr.chunks).toString("utf8");
+			if (!streamResponse) stderr = Buffer.concat(buffered.stderr.chunks).toString("utf8");
 			fail(stderr.trim() || `sandbox http/request failed with code ${exitCode}`);
 		});
-	});
+	}).then(response.resolve, response.reject);
+	try {
+		if (notifications.signal.aborted) abortOnSessionClose();
+		else {
+			owner.assertCurrent();
+			child.stdin.end(JSON.stringify(params));
+		}
+		await completion.promise;
+		await termination;
+	} catch (error) {
+		lifecycle.failed = true;
+		response.reject(error);
+		await cleanup();
+		throw error;
+	} finally {
+		notifications.signal.removeEventListener("abort", abortOnSessionClose);
+	}
 }
 const SANDBOX_HTTP_REQUEST_SCRIPT = String.raw`
 tmp=$(mktemp "$TMPDIR/openclaw-http.XXXXXX.py" 2>/dev/null || mktemp "/tmp/openclaw-http.XXXXXX.py") || exit 1
@@ -2147,9 +2233,6 @@ import urllib.request
 def emit(payload):
     print(json.dumps(payload, separators=(",", ":")), flush=True)
 
-def response_headers(response):
-    return [{"name": name, "value": value} for name, value in response.headers.items()]
-
 BLOCKED_HOSTNAMES = {
     "localhost",
     "localhost.localdomain",
@@ -2185,9 +2268,7 @@ def is_blocked_hostname(hostname):
     normalized = normalize_hostname(hostname)
     return (
         normalized in BLOCKED_HOSTNAMES
-        or normalized.endswith(".localhost")
-        or normalized.endswith(".local")
-        or normalized.endswith(".internal")
+        or normalized.endswith((".localhost", ".local", ".internal"))
     )
 
 def is_blocked_ip(address):
@@ -2200,12 +2281,9 @@ def is_blocked_ip(address):
         return True
     if str(parsed).lower() in CLOUD_METADATA_IP_ADDRESSES:
         return True
-    if isinstance(parsed, ipaddress.IPv4Address):
-        if any(parsed in network for network in BLOCKED_IPV4_NETWORKS):
-            return True
-    else:
-        if any(parsed in network for network in BLOCKED_IPV6_NETWORKS):
-            return True
+    networks = BLOCKED_IPV4_NETWORKS if isinstance(parsed, ipaddress.IPv4Address) else BLOCKED_IPV6_NETWORKS
+    if any(parsed in network for network in networks):
+        return True
     return (
         parsed.is_loopback
         or parsed.is_private
@@ -2306,7 +2384,7 @@ def pinned_getaddrinfo(original_getaddrinfo):
     return getaddrinfo
 
 def handle_response(input_data, response):
-    headers = response_headers(response)
+    headers = [{"name": name, "value": value} for name, value in response.headers.items()]
     status = int(getattr(response, "status", getattr(response, "code", 0)))
     if input_data.get("streamResponse"):
         emit({"type": "headers", "status": status, "headers": headers})
@@ -2376,7 +2454,7 @@ async function startProcess(execServer, processes, notify, params, processAuthor
 	if (processes.has(processId)) throw new Error(`process already exists: ${processId}`);
 	const argv = requireStringArray(record.argv, "argv");
 	const cwd = resolveExecServerPath(requireString(record.cwd, "cwd"), "process cwd");
-	rejectUnsupportedArg0(record.arg0);
+	if (record.arg0 !== void 0 && record.arg0 !== null) throw new Error(typeof record.arg0 === "string" ? "Codex sandbox exec-server does not support arg0 overrides." : "arg0 must be a string or null.");
 	assertSupportedProcessSandbox(execServer, record);
 	const env = readProcessEnv(record);
 	const managed = {
@@ -2441,7 +2519,7 @@ async function startProcess(execServer, processes, notify, params, processAuthor
 		notifyProcessWaiters(managed);
 		throw error;
 	} finally {
-		if (managed.startPromise === startPromise) managed.startPromise = void 0;
+		managed.startPromise = void 0;
 	}
 	return {
 		processId,
@@ -2453,8 +2531,7 @@ function assertSupportedProcessSandbox(execServer, record) {
 	if (record.enforceManagedNetwork === true || record.managedNetwork !== void 0 && record.managedNetwork !== null) throw new Error("Codex managed network restrictions cannot be enforced by the sandbox backend.");
 	if (resolveFsSandboxPolicy(execServer, record)?.unrestricted === false) throw new Error("Codex process filesystem sandbox restrictions cannot be enforced by the backend.");
 	if (record.sandbox === void 0 || record.sandbox === null) return;
-	if (requireObject(requireObject(record.sandbox, "process sandbox context").permissions, "process sandbox permissions").network !== "restricted") return;
-	if (!execServer.networkIsolated) throw new Error("Codex network restrictions cannot be enforced by the sandbox backend.");
+	if (requireObject(requireObject(record.sandbox, "process sandbox context").permissions, "process sandbox permissions").network === "restricted" && !execServer.networkIsolated) throw new Error("Codex network restrictions cannot be enforced by the sandbox backend.");
 }
 async function runProcess(execServer, managed, params) {
 	const backend = execServer.backend;
@@ -2514,14 +2591,12 @@ async function runProcess(execServer, managed, params) {
 	const child = owner.process;
 	child.stdout.on("data", (chunk) => appendProcessChunk(managed, "stdout", chunk));
 	child.stderr.on("data", (chunk) => appendProcessChunk(managed, "stderr", chunk));
-	child.once("error", (error) => {
-		managed.failure ??= error.message;
-		notifyProcessWaiters(managed);
-	});
-	child.stdin.on("error", (error) => {
+	const onError = (error) => {
 		managed.failure ??= error.message;
 		notifyProcessWaiters(managed);
-	});
+	};
+	child.once("error", onError);
+	child.stdin.on("error", onError);
 	owner.assertCurrent();
 	if (!managed.tty && !managed.pipeStdin) child.stdin.end();
 }
@@ -2580,26 +2655,25 @@ function emitProcessClosed(managed, exitCode) {
 	managed.evictProcess();
 	notifyProcessWaiters(managed);
 }
-function limitProcessChunks(chunks, maxBytes) {
-	if (!maxBytes) return chunks;
-	const retained = [];
-	let retainedBytes = 0;
-	for (const chunk of chunks) {
-		const byteLength = Buffer.from(chunk.chunk, "base64").byteLength;
-		if (retained.length > 0 && retainedBytes + byteLength > maxBytes) break;
-		retained.push(chunk);
-		retainedBytes += byteLength;
-		if (retainedBytes >= maxBytes) break;
-	}
-	return retained;
-}
 async function readProcess(processes, params) {
 	const record = requireObject(params, "process/read params");
-	const managed = requireProcess(processes, requireString(record.processId, "processId"));
+	const processId = requireString(record.processId, "processId");
+	const managed = processes.get(processId);
+	if (!managed) throw new Error(`unknown process: ${processId}`);
 	const afterSeq = typeof record.afterSeq === "number" ? record.afterSeq : 0;
 	const waitMs = typeof record.waitMs === "number" && record.waitMs > 0 ? record.waitMs : 0;
 	if (!managed.closed && managed.nextSeq - 1 <= afterSeq && waitMs > 0) await waitForProcessUpdate(managed, waitMs);
-	const chunks = limitProcessChunks(managed.chunks.filter((chunk) => chunk.seq > afterSeq), typeof record.maxBytes === "number" && record.maxBytes > 0 ? record.maxBytes : void 0);
+	const maxBytes = typeof record.maxBytes === "number" && record.maxBytes > 0 ? record.maxBytes : void 0;
+	const chunks = [];
+	let retainedBytes = 0;
+	for (const chunk of managed.chunks) {
+		if (!(chunk.seq > afterSeq)) continue;
+		const byteLength = maxBytes ? Buffer.from(chunk.chunk, "base64").byteLength : 0;
+		if (maxBytes && chunks.length > 0 && retainedBytes + byteLength > maxBytes) break;
+		chunks.push(chunk);
+		retainedBytes += byteLength;
+		if (maxBytes && retainedBytes >= maxBytes) break;
+	}
 	const lastChunk = chunks.at(-1);
 	return {
 		chunks,
@@ -2643,8 +2717,7 @@ async function signalProcess(processes, params) {
 async function terminateProcess(processes, params) {
 	const processId = requireString(requireObject(params, "process/terminate params").processId, "processId");
 	const managed = processes.get(processId);
-	if (!managed) return { running: false };
-	return await terminateManagedProcess(managed);
+	return managed ? await terminateManagedProcess(managed) : { running: false };
 }
 async function terminateManagedProcess(managed) {
 	const running = !managed.exited;
@@ -2670,16 +2743,6 @@ function notifyProcessWaiters(managed) {
 	managed.waiters = [];
 	for (const waiter of waiters) waiter();
 }
-function requireProcess(processes, processId) {
-	const managed = processes.get(processId);
-	if (!managed) throw new Error(`unknown process: ${processId}`);
-	return managed;
-}
-function rejectUnsupportedArg0(value) {
-	if (value === void 0 || value === null) return;
-	if (typeof value === "string") throw new Error("Codex sandbox exec-server does not support arg0 overrides.");
-	throw new Error("arg0 must be a string or null.");
-}
 function readEnv(value) {
 	if (!value || typeof value !== "object" || Array.isArray(value)) return {};
 	const env = {};
@@ -2687,22 +2750,18 @@ function readEnv(value) {
 	return env;
 }
 function readProcessEnv(record) {
-	const requestedEnv = {
-		...buildEnvFromPolicy(record.envPolicy),
-		...readEnv(record.env)
-	};
-	return sanitizeEnvVars(requestedEnv).allowed;
-}
-function buildEnvFromPolicy(value) {
-	if (!value || typeof value !== "object" || Array.isArray(value)) return {};
-	const policy = value;
-	const inheritedEnv = readEnv(policy.set);
-	const includeOnly = filterStringEntries(policy.includeOnly);
+	const value = record.envPolicy;
+	const policy = value && typeof value === "object" && !Array.isArray(value) ? value : void 0;
+	const inheritedEnv = readEnv(policy?.set);
+	const includeOnly = filterStringEntries(policy?.includeOnly);
 	if (includeOnly.length > 0) {
 		const regexes = includeOnly.map(wildcardPatternToRegex);
 		for (const key of Object.keys(inheritedEnv)) if (!regexes.some((regex) => regex.test(key))) delete inheritedEnv[key];
 	}
-	return inheritedEnv;
+	return sanitizeEnvVars({
+		...inheritedEnv,
+		...readEnv(record.env)
+	}).allowed;
 }
 function wildcardPatternToRegex(pattern) {
 	const escaped = pattern.replace(/[.+^${}()|[\]\\]/gu, "\\$&");
@@ -2780,14 +2839,12 @@ var CodexSandboxExecSession = class {
 			case "fs/open": return await openFile(this.execServer, this.fileReads, params);
 			case "fs/readBlock": return readFileBlock(this.fileReads, params);
 			case "fs/close": return closeFile(this.fileReads, params);
-			case "fs/readFile": return await readFile(this.execServer, params);
+			case "fs/readFile":
+			case "fs/getMetadata": return await readFileOrMetadata(this.execServer, params, method);
 			case "fs/writeFile":
-				await writeFile(this.execServer, params);
-				return {};
 			case "fs/createDirectory":
-				await createDirectory(this.execServer, params);
+				await writeFileOrDirectory(this.execServer, params, method);
 				return {};
-			case "fs/getMetadata": return await getMetadata(this.execServer, params);
 			case "fs/readDirectory": return await readDirectory(this.execServer, params);
 			case "fs/remove":
 				await removePath(this.execServer, params);
@@ -2817,10 +2874,8 @@ async function ensureCodexSandboxExecServerEnvironment(params) {
 	if (placementNodeId && !params.runtime) throw new Error("Codex node execution requires its active plugin runtime.");
 	if (!canExposeLocalExecServerToAppServer(params.appServerStartOptions)) throw new Error("OpenClaw Codex exec-server uses a local loopback URL and cannot be registered with a remote Codex app-server.");
 	const { server: execServer, nodeLease } = await acquireOpenClawExecServer({
-		sandbox: params.sandbox,
-		runtime: params.runtime,
-		signal: params.signal,
-		onExecutionDisconnect: params.onExecutionDisconnect
+		...params,
+		sandbox: params.sandbox
 	});
 	const processAuthority = params.requireProcessAuthority && !("node" in execServer) ? getCodexNativeProcessClient(params.client) : void 0;
 	if (processAuthority && !("node" in execServer)) {
@@ -2877,7 +2932,16 @@ async function acquireOpenClawExecServer(params) {
 	const { sandbox, runtime, signal, onExecutionDisconnect } = params;
 	const key = sandbox.runtimeId;
 	while (true) {
-		const promise = sandboxExecServerRegistry.servers.get(key) ?? startAndRememberOpenClawExecServer(sandbox);
+		let promise = sandboxExecServerRegistry.servers.get(key);
+		if (!promise) {
+			const created = startOpenClawExecServer(sandbox);
+			const createdKey = sandbox.runtimeId;
+			sandboxExecServerRegistry.servers.set(createdKey, created);
+			created.catch(() => {
+				if (sandboxExecServerRegistry.servers.get(createdKey) === created) sandboxExecServerRegistry.servers.delete(createdKey);
+			});
+			promise = created;
+		}
 		const server = await promise;
 		if (!server.closed && sandboxExecServerRegistry.servers.get(key) === promise) {
 			server.refCount += 1;
@@ -2930,15 +2994,6 @@ async function acquireOpenClawExecServer(params) {
 		}
 	}
 }
-function startAndRememberOpenClawExecServer(sandbox) {
-	const created = startOpenClawExecServer(sandbox);
-	const key = sandbox.runtimeId;
-	sandboxExecServerRegistry.servers.set(key, created);
-	created.catch(() => {
-		if (sandboxExecServerRegistry.servers.get(key) === created) sandboxExecServerRegistry.servers.delete(key);
-	});
-	return created;
-}
 async function startOpenClawExecServer(sandbox) {
 	const backend = sandbox.backend;
 	const fsBridge = sandbox.fsBridge;
@@ -2965,7 +3020,7 @@ async function startOpenClawExecServer(sandbox) {
 	await once(server, "listening");
 	const address = server.address();
 	if (!address || typeof address === "string") throw new Error("OpenClaw Codex exec-server did not bind to a TCP port.");
-	const environmentId = buildEnvironmentId(sandbox);
+	const environmentId = `openclaw-sandbox-${createHash("sha256").update(sandbox.runtimeId).digest("hex").slice(0, 16)}`;
 	const authPath = `/openclaw-${randomUUID()}`;
 	const common = {
 		authPath,
@@ -2991,7 +3046,9 @@ async function startOpenClawExecServer(sandbox) {
 		networkIsolated: (connection.backend.id === "docker" || connection.backend.id === "podman") && sandbox.docker.network.trim().toLowerCase() === "none"
 	};
 	server.on("connection", (socket, request) => {
-		socket.on("error", handleExecServerSocketError);
+		socket.on("error", (error) => {
+			embeddedAgentLog.debug("codex sandbox exec-server websocket failed", { error });
+		});
 		const requestUrl = new URL(request.url ?? "", "ws://127.0.0.1");
 		if (requestUrl.pathname !== execServer.authPath && ("node" in execServer || !execServer.processAuthorities?.has(requestUrl.pathname))) {
 			socket.close(1008, "unauthorized");
@@ -3019,15 +3076,12 @@ async function releaseOpenClawExecServer(execServer) {
 	if (current === execServer) sandboxExecServerRegistry.servers.delete(execServer.sandbox.runtimeId);
 	await sandboxExecServerRegistry.close(execServer);
 }
-function buildEnvironmentId(sandbox) {
-	return `openclaw-sandbox-${createHash("sha256").update(sandbox.runtimeId).digest("hex").slice(0, 16)}`;
-}
 function readCodexPlacementNodeId(sandbox) {
 	if (!("placementExecutionMode" in sandbox) || sandbox.placementExecutionMode !== "remote-exec" || !("placementNodeId" in sandbox) || typeof sandbox.placementNodeId !== "string" || !sandbox.placementNodeId) return;
 	return sandbox.placementNodeId;
 }
 function readCodexPlacementWorkspaceIdentity(sandbox) {
-	if (!("placementEnvironmentId" in sandbox) || typeof sandbox.placementEnvironmentId !== "string" || !sandbox.placementEnvironmentId || sandbox.placementEnvironmentId.trim() !== sandbox.placementEnvironmentId || !("placementSessionId" in sandbox) || typeof sandbox.placementSessionId !== "string" || !sandbox.placementSessionId || sandbox.placementSessionId.trim() !== sandbox.placementSessionId || !("placementOwnerEpoch" in sandbox) || typeof sandbox.placementOwnerEpoch !== "number" || !Number.isSafeInteger(sandbox.placementOwnerEpoch) || sandbox.placementOwnerEpoch < 1 || !sandbox.sessionKey || sandbox.sessionKey.trim() !== sandbox.sessionKey) throw new Error("Codex node execution requires its exact placement workspace identity.");
+	if (!("placementEnvironmentId" in sandbox) || !isWorkspaceIdentityString(sandbox.placementEnvironmentId) || !("placementSessionId" in sandbox) || !isWorkspaceIdentityString(sandbox.placementSessionId) || !("placementOwnerEpoch" in sandbox) || typeof sandbox.placementOwnerEpoch !== "number" || !Number.isSafeInteger(sandbox.placementOwnerEpoch) || sandbox.placementOwnerEpoch < 1 || !sandbox.sessionKey || sandbox.sessionKey.trim() !== sandbox.sessionKey) throw new Error("Codex node execution requires its exact placement workspace identity.");
 	return {
 		environmentId: sandbox.placementEnvironmentId,
 		sessionId: sandbox.placementSessionId,
@@ -3035,6 +3089,9 @@ function readCodexPlacementWorkspaceIdentity(sandbox) {
 		sessionKey: sandbox.sessionKey
 	};
 }
+function isWorkspaceIdentityString(value) {
+	return typeof value === "string" && value.length > 0 && value.trim() === value;
+}
 function handleNodeConnection(execServer, socket, requestUrl) {
 	const leaseId = requestUrl.searchParams.get("lease");
 	const lease = leaseId ? execServer.node.leases.get(leaseId) : void 0;
@@ -3089,9 +3146,6 @@ function trackExecServerCleanup(execServer, cleanup, failureMessage) {
 		embeddedAgentLog.warn(failureMessage, { error: error instanceof Error ? error.message : String(error) });
 	});
 }
-function handleExecServerSocketError(error) {
-	embeddedAgentLog.debug("codex sandbox exec-server websocket failed", { error });
-}
 async function handleMessage(session, data) {
 	await session.handleRequest(parseRequest(codexWebSocketDataToBuffer(data).toString("utf8")));
 }
@@ -3189,10 +3243,19 @@ async function handleCodexAppServerApprovalRequest(params) {
 			}
 		});
 	};
+	const finishApproval = (outcome, { message, ...details }) => {
+		emitEvent({
+			phase: "resolved",
+			...details,
+			...params.method === "item/permissions/requestApproval" ? { scope: outcome === "approved-session" ? "session" : "turn" } : {},
+			message
+		});
+		return buildApprovalResponse(params.method, requestParams, outcome);
+	};
 	if (params.signal?.aborted) {
 		if (params.signal.reason instanceof CodexServerRequestResolvedError) return;
 		recordNativeToolFailureDisposition(params, context, "cancelled");
-		return buildApprovalResponse(params.method, context.requestParams, "cancelled");
+		return buildApprovalResponse(params.method, requestParams, "cancelled");
 	}
 	let revalidateMutableFileApproval;
 	let mutableFileApprovalRequiresOneShot = false;
@@ -3212,7 +3275,7 @@ async function handleCodexAppServerApprovalRequest(params) {
 			resolvedMessage = "Codex app-server approval granted for this byte-bound command only.";
 		}
 		if (params.method === "item/commandExecution/requestApproval" && resolvedOutcome !== "denied") {
-			const resolution = resolveCommandApproval(context.requestParams, resolvedOutcome);
+			const resolution = resolveCommandApproval(requestParams, resolvedOutcome);
 			if (resolution.scope === "denied") {
 				resolvedOutcome = "denied";
 				resolvedMessage = "Codex app-server request does not offer the approved scope.";
@@ -3223,17 +3286,14 @@ async function handleCodexAppServerApprovalRequest(params) {
 		}
 		params.signal?.throwIfAborted();
 		if (resolvedOutcome !== "denied") params.paramsForRun.hostCapabilities.assertActive();
-		emitEvent({
-			phase: "resolved",
+		return finishApproval(resolvedOutcome, {
 			status: resolvedOutcome === "denied" ? "denied" : "approved",
 			...resolvedApprovalId ? {
 				approvalId: resolvedApprovalId,
 				approvalSlug: resolvedApprovalId
 			} : {},
-			...approvalEventScope(params.method, resolvedOutcome),
 			message: resolvedMessage
 		});
-		return buildApprovalResponse(params.method, context.requestParams, resolvedOutcome);
 	};
 	try {
 		if (params.method === "item/commandExecution/requestApproval" && !readNetworkApprovalContext(requestParams)) {
@@ -3263,7 +3323,7 @@ async function handleCodexAppServerApprovalRequest(params) {
 			recordNativeToolFailureDisposition(params, context, policyOutcome.failureDisposition);
 			return await resolvePolicyApproval("denied", policyOutcome.reason);
 		}
-		if (policyOutcome?.outcome === "approved-once" || policyOutcome?.outcome === "approved-session") return await resolvePolicyApproval(policyOutcome.outcome);
+		if (policyOutcome?.outcome === "approved-once") return await resolvePolicyApproval(policyOutcome.outcome);
 		if (CONCRETE_TOOL_AUTO_APPROVAL_METHODS.has(params.method) && !readNetworkApprovalContext(requestParams) && params.autoApprove === true) return await resolvePolicyApproval("approved-once", "Codex app-server approval auto-approved by runtime policy.");
 		const allowedDecisions = nativeApprovalAllowedDecisions({
 			method: params.method,
@@ -3285,13 +3345,10 @@ async function handleCodexAppServerApprovalRequest(params) {
 		params.signal?.throwIfAborted();
 		if (!approvalId) {
 			recordNativeToolFailureDisposition(params, context, "failed");
-			emitEvent({
-				phase: "resolved",
+			return finishApproval("denied", {
 				status: "unavailable",
-				...approvalEventScope(params.method, "denied"),
 				message: "Codex app-server approval route unavailable."
 			});
-			return buildApprovalResponse(params.method, context.requestParams, "denied");
 		}
 		emitEvent({
 			phase: "requested",
@@ -3311,30 +3368,24 @@ async function handleCodexAppServerApprovalRequest(params) {
 		if (approvalTimedOut) recordNativeToolFailureDisposition(params, context, "timed_out", context.approvalKind);
 		else if (outcome === "unavailable") recordNativeToolFailureDisposition(params, context, "failed");
 		if (outcome === "approved-once" || outcome === "approved-session") return await resolvePolicyApproval(outcome, approvalResolutionMessage(outcome), approvalId);
-		emitEvent({
-			phase: "resolved",
+		return finishApproval(outcome, {
 			status: outcome,
 			approvalId,
 			approvalSlug: approvalId,
-			...approvalEventScope(params.method, outcome),
 			message: approvalTimedOut ? codexApprovalTimeoutText(context.approvalKind) : approvalResolutionMessage(outcome)
 		});
-		return buildApprovalResponse(params.method, context.requestParams, outcome);
 	} catch (error) {
 		if (params.signal?.reason instanceof CodexServerRequestResolvedError) return;
 		const cancelled = params.signal?.aborted === true;
 		recordNativeToolFailureDisposition(params, context, cancelled && params.signal ? resolveCodexToolAbortTerminalReason(params.signal) : "failed");
-		emitEvent({
-			phase: "resolved",
+		return finishApproval(cancelled ? "cancelled" : "denied", {
 			status: cancelled ? "failed" : "unavailable",
 			...approvalId ? {
 				approvalId,
 				approvalSlug: approvalId
 			} : {},
-			...approvalEventScope(params.method, cancelled ? "cancelled" : "denied"),
 			message: cancelled ? "Codex app-server approval cancelled because the run stopped." : `Codex app-server approval route failed: ${formatCodexDisplayText(coerceErrorMessage(error))}`
 		});
-		return buildApprovalResponse(params.method, context.requestParams, cancelled ? "cancelled" : "denied");
 	}
 }
 function recordNativeToolFailureDisposition(params, context, disposition, approvalKind) {
@@ -3346,17 +3397,17 @@ function recordNativeToolFailureDisposition(params, context, disposition, approv
 }
 function buildApprovalResponse(method, requestParams, outcome) {
 	if (method === "item/commandExecution/requestApproval") return { decision: resolveCommandApproval(requestParams, outcome).decision };
-	if (method === "item/fileChange/requestApproval") return { decision: fileChangeApprovalDecision(outcome) };
-	if (method === "item/permissions/requestApproval") {
-		if (outcome === "approved-session" || outcome === "approved-once") return {
-			permissions: requestedPermissions(requestParams),
-			scope: outcome === "approved-session" ? "session" : "turn"
-		};
-		return {
-			permissions: {},
-			scope: "turn"
-		};
-	}
+	if (method === "item/fileChange/requestApproval") return { decision: {
+		cancelled: "cancel",
+		denied: "decline",
+		unavailable: "decline",
+		"approved-session": "acceptForSession",
+		"approved-once": "accept"
+	}[outcome] };
+	if (method === "item/permissions/requestApproval") return {
+		permissions: outcome === "approved-session" || outcome === "approved-once" ? requestedPermissions(requestParams) : {},
+		scope: outcome === "approved-session" ? "session" : "turn"
+	};
 	return {
 		decision: "decline",
 		reason: "OpenClaw codex app-server bridge does not grant native approvals yet."
@@ -3366,7 +3417,7 @@ function buildApprovalContext(params) {
 	const itemId = readStringField(params.requestParams, "itemId") ?? readStringField(params.requestParams, "callId") ?? readStringField(params.requestParams, "approvalId");
 	const approvalId = readStringField(params.requestParams, "approvalId") ?? itemId;
 	const commandDetailLines = params.method === "item/commandExecution/requestApproval" ? describeCommandApprovalDetails(params.requestParams) : [];
-	const commandPreview = sanitizeApprovalPreview(readCommandActionsPreview(params.requestParams) ?? readCommandPreview(params.requestParams), commandDetailLines.length > 0 ? COMMAND_PREVIEW_WITH_DETAILS_MAX_LENGTH : 180);
+	const commandPreview = sanitizeApprovalPreview(readJoinedPreview(readCommandActions(params.requestParams), " && ") ?? readCommandPreview(params.requestParams), commandDetailLines.length > 0 ? COMMAND_PREVIEW_WITH_DETAILS_MAX_LENGTH : 180);
 	const reasonPreview = sanitizeApprovalPreview(readStringPreview(params.requestParams, "reason"), 180);
 	const command = commandPreview.text;
 	const reason = reasonPreview.text;
@@ -3374,7 +3425,8 @@ function buildApprovalContext(params) {
 	const approvalKind = params.method.includes("commandExecution") ? "command" : params.method.includes("fileChange") ? "file-change" : params.method.includes("permissions") ? "permissions" : "other";
 	const kind = approvalKind === "command" ? "exec" : approvalKind === "other" ? "unknown" : "plugin";
 	const permissionLines = params.method === "item/permissions/requestApproval" ? describePermissionProfile(requestedPermissions(params.requestParams), "Permissions") : [];
-	const title = networkApproval ? "Codex app-server network approval" : kind === "exec" ? "Codex app-server command approval" : params.method === "item/permissions/requestApproval" ? "Codex app-server permission approval" : kind === "plugin" ? "Codex app-server file approval" : "Codex app-server approval";
+	const approvalType = networkApproval ? "network" : kind === "exec" ? "command" : params.method === "item/permissions/requestApproval" ? "permission" : kind === "plugin" ? "file" : void 0;
+	const title = `Codex app-server ${approvalType ? `${approvalType} ` : ""}approval`;
 	const subject = (networkApproval ? `Network: ${sanitizeCodexApprovalVisibleText(networkApproval.protocol)}://${sanitizePermissionHostValue(networkApproval.host)}` : void 0) ?? permissionLines[0] ?? (command ? `Command: ${formatApprovalPreviewSubject(command, commandPreview.omitted)}` : commandPreview.omitted ? `Command: ${APPROVAL_PREVIEW_OMITTED}` : reason ? `Reason: ${formatApprovalPreviewSubject(reason, reasonPreview.omitted)}` : reasonPreview.omitted ? `Reason: ${APPROVAL_PREVIEW_OMITTED}` : `Request method: ${params.method}`);
 	return {
 		approvalKind,
@@ -3382,10 +3434,9 @@ function buildApprovalContext(params) {
 		title,
 		description: permissionLines.length > 0 ? joinDescriptionLinesWithinLimit(permissionLines, PERMISSION_DESCRIPTION_MAX_LENGTH) : [subject, ...commandDetailLines].join("\n"),
 		severity: kind === "exec" ? "warning" : "info",
-		toolName: networkApproval ? "codex_network_approval" : kind === "exec" ? "codex_command_approval" : params.method === "item/permissions/requestApproval" ? "codex_permission_approval" : "codex_file_approval",
+		toolName: `codex_${approvalType ?? "file"}_approval`,
 		itemId,
 		approvalId,
-		requestParams: params.requestParams,
 		eventDetails: {
 			...itemId ? { itemId } : {},
 			...command ? { command } : {},
@@ -3399,24 +3450,9 @@ async function runOpenClawToolPolicyForApprovalRequest(params) {
 	const policyRequest = buildOpenClawToolPolicyRequest(params.method, params.requestParams);
 	if (!policyRequest) return;
 	const cwd = readStringField(params.requestParams, "cwd") ?? params.paramsForRun.workspaceDir;
-	const nativeRelayOutcome = await runNativeRelayToolPolicyForApprovalRequest({
-		method: params.method,
-		requestParams: params.requestParams,
-		context: params.context,
-		policyRequest,
-		nativeHookRelay: params.nativeHookRelay,
-		autoApprove: params.autoApprove,
-		assertActive: params.paramsForRun.hostCapabilities.assertActive,
-		cwd,
-		signal: params.signal
-	});
-	if (nativeRelayOutcome?.blocked) return {
-		outcome: "denied",
-		reason: nativeRelayOutcome.reason,
-		...nativeRelayOutcome.failureDisposition ? { failureDisposition: nativeRelayOutcome.failureDisposition } : {}
-	};
-	if (nativeRelayOutcome?.outcome === "approved-once" || nativeRelayOutcome?.outcome === "approved-session") return { outcome: nativeRelayOutcome.outcome };
-	if (nativeRelayOutcome?.handled) return { outcome: "allowed" };
+	const assertActive = params.paramsForRun.hostCapabilities.assertActive;
+	const nativeRelayOutcome = await runNativeRelayPolicy(policyRequest.params);
+	if (nativeRelayOutcome) return nativeRelayOutcome;
 	const outcome = await params.paramsForRun.hostCapabilities.runBeforeToolCall({
 		toolName: policyRequest.toolName,
 		params: policyRequest.params,
@@ -3435,105 +3471,86 @@ async function runOpenClawToolPolicyForApprovalRequest(params) {
 	};
 	if (outcome.approvalResolution) return { outcome: "approved-once" };
 	return { outcome: "allowed" };
-}
-async function runNativeRelayToolPolicyForApprovalRequest(params) {
-	const nativeHookRelay = params.nativeHookRelay;
-	if (params.method !== "item/commandExecution/requestApproval" || !nativeHookRelay?.allowedEvents.includes("pre_tool_use")) return;
-	const payload = buildNativeRelayPreToolUsePayload({
-		requestParams: params.requestParams,
-		policyRequest: params.policyRequest,
-		context: params.context,
-		cwd: params.cwd
-	});
-	if (!payload) return;
-	const resolveDeferredApproval = async () => {
-		const approvalOutcome = await resolveNativeHookRelayDeferredToolApproval({
-			relayId: nativeHookRelay.relayId,
-			toolUseId: params.context.approvalId,
-			signal: params.signal
-		});
-		params.assertActive();
-		if (approvalOutcome?.outcome === "denied") return {
-			handled: true,
-			blocked: true,
-			reason: approvalOutcome.reason,
-			...approvalOutcome.failureDisposition ? { failureDisposition: approvalOutcome.failureDisposition } : {}
+	async function runNativeRelayPolicy(toolParams) {
+		const nativeHookRelay = params.nativeHookRelay;
+		if (params.method !== "item/commandExecution/requestApproval" || !nativeHookRelay?.allowedEvents.includes("pre_tool_use")) return;
+		const command = readStringField(toolParams, "command");
+		if (!command) return;
+		const turnId = readStringField(params.requestParams, "turnId");
+		const payload = {
+			hook_event_name: "PreToolUse",
+			openclaw_approval_mode: "report",
+			tool_name: "exec_command",
+			...params.context.approvalId ? { tool_use_id: params.context.approvalId } : {},
+			...cwd ? { cwd } : {},
+			...turnId ? { turn_id: turnId } : {},
+			tool_input: {
+				...toolParams,
+				command,
+				cmd: command
+			}
 		};
-		return approvalOutcome?.outcome === "approved-once" ? {
-			handled: true,
-			outcome: approvalOutcome.outcome
-		} : { handled: true };
-	};
-	if (hasNativeHookRelayInvocation({
-		relayId: nativeHookRelay.relayId,
-		event: "pre_tool_use",
-		toolUseId: params.context.approvalId
-	})) return resolveDeferredApproval();
-	try {
-		const decision = readNativeRelayPreToolUseDecision(await invokeNativeHookRelay({
-			provider: "codex",
-			relayId: nativeHookRelay.relayId,
-			generation: nativeHookRelay.generation,
-			event: "pre_tool_use",
-			rawPayload: payload,
-			requireGeneration: true
-		}));
-		if (decision.blocked) return {
-			handled: true,
-			blocked: true,
-			reason: decision.reason,
-			...decision.failureDisposition ? { failureDisposition: decision.failureDisposition } : {}
+		const resolveDeferredApproval = async () => {
+			const approvalOutcome = await resolveNativeHookRelayDeferredToolApproval({
+				relayId: nativeHookRelay.relayId,
+				toolUseId: params.context.approvalId,
+				signal: params.signal
+			});
+			assertActive();
+			if (approvalOutcome?.outcome === "denied") return {
+				outcome: "denied",
+				reason: approvalOutcome.reason,
+				...approvalOutcome.failureDisposition ? { failureDisposition: approvalOutcome.failureDisposition } : {}
+			};
+			return approvalOutcome?.outcome === "approved-once" ? { outcome: approvalOutcome.outcome } : { outcome: "allowed" };
 		};
-		return await resolveDeferredApproval();
-	} catch (error) {
-		if (params.autoApprove === true && !hasNativeHookRelayInvocation({
+		if (hasNativeHookRelayInvocation({
 			relayId: nativeHookRelay.relayId,
 			event: "pre_tool_use",
 			toolUseId: params.context.approvalId
-		})) return;
-		return {
-			handled: true,
-			blocked: true,
-			reason: `OpenClaw native hook relay unavailable for Codex app-server approval: ${formatCodexDisplayText(coerceErrorMessage(error))}`,
-			failureDisposition: "failed"
-		};
-	}
-}
-function buildNativeRelayPreToolUsePayload(params) {
-	const command = readStringField(params.policyRequest.params, "command");
-	if (!command) return;
-	const turnId = readStringField(params.requestParams, "turnId");
-	return {
-		hook_event_name: "PreToolUse",
-		openclaw_approval_mode: "report",
-		tool_name: "exec_command",
-		...params.context.approvalId ? { tool_use_id: params.context.approvalId } : {},
-		...params.cwd ? { cwd: params.cwd } : {},
-		...turnId ? { turn_id: turnId } : {},
-		tool_input: {
-			...params.policyRequest.params,
-			command,
-			cmd: command
+		})) return resolveDeferredApproval();
+		try {
+			const denial = readNativeRelayPreToolUseDenial(await invokeNativeHookRelay({
+				provider: "codex",
+				relayId: nativeHookRelay.relayId,
+				generation: nativeHookRelay.generation,
+				event: "pre_tool_use",
+				rawPayload: payload,
+				requireGeneration: true
+			}));
+			if (denial) return denial;
+			return await resolveDeferredApproval();
+		} catch (error) {
+			if (params.autoApprove === true && !hasNativeHookRelayInvocation({
+				relayId: nativeHookRelay.relayId,
+				event: "pre_tool_use",
+				toolUseId: params.context.approvalId
+			})) return;
+			return {
+				outcome: "denied",
+				reason: `OpenClaw native hook relay unavailable for Codex app-server approval: ${formatCodexDisplayText(coerceErrorMessage(error))}`,
+				failureDisposition: "failed"
+			};
 		}
-	};
+	}
 }
-function readNativeRelayPreToolUseDecision(response) {
+function readNativeRelayPreToolUseDenial(response) {
 	if (!response || response.exitCode !== 0) return {
-		blocked: true,
+		outcome: "denied",
 		reason: sanitizeRelayDecisionReason(response?.stderr) || sanitizeRelayDecisionReason(response?.stdout) || "OpenClaw native hook relay failed for Codex app-server approval.",
 		failureDisposition: response?.failureDisposition ?? "failed"
 	};
 	const stdout = response.stdout?.trim();
-	if (!stdout) return { blocked: false };
+	if (!stdout) return;
 	const parsed = safeParseJson(stdout);
 	const output = isJsonObject(parsed) && isJsonObject(parsed.hookSpecificOutput) ? parsed.hookSpecificOutput : void 0;
 	if (output?.permissionDecision === "deny") return {
-		blocked: true,
+		outcome: "denied",
 		reason: readStringField(output, "permissionDecisionReason") || "OpenClaw native hook policy denied Codex app-server approval.",
 		...response.failureDisposition ? { failureDisposition: response.failureDisposition } : {}
 	};
 	return {
-		blocked: true,
+		outcome: "denied",
 		reason: output ? "OpenClaw native hook relay returned a non-deny Codex app-server approval decision." : "OpenClaw native hook relay returned an unreadable Codex app-server approval result.",
 		failureDisposition: "failed"
 	};
@@ -3597,34 +3614,22 @@ function nativeApprovalAllowedDecisions(params) {
 	];
 	return params.method === "item/commandExecution/requestApproval" ? commandApprovalAllowedDecisions(params.requestParams, params.requiresOneShot) : void 0;
 }
-function fileChangeApprovalDecision(outcome) {
-	if (outcome === "cancelled") return "cancel";
-	if (outcome === "denied" || outcome === "unavailable") return "decline";
-	return outcome === "approved-session" ? "acceptForSession" : "accept";
-}
 function requestedPermissions(requestParams) {
 	const permissions = isJsonObject(requestParams?.permissions) ? requestParams.permissions : {};
-	const granted = {};
-	if (isJsonObject(permissions.network)) granted.network = permissions.network;
-	if (isJsonObject(permissions.fileSystem)) granted.fileSystem = permissions.fileSystem;
-	return granted;
+	return Object.fromEntries(["network", "fileSystem"].flatMap((key) => isJsonObject(permissions[key]) ? [[key, permissions[key]]] : []));
 }
 function describeCommandApprovalDetails(requestParams) {
-	const lines = [];
 	const additionalPermissions = isJsonObject(requestParams?.additionalPermissions) ? requestParams.additionalPermissions : void 0;
-	if (additionalPermissions) lines.push(...describePermissionProfile(additionalPermissions, "Additional permissions"));
-	const execpolicySummary = summarizeStringArray(requestParams?.proposedExecpolicyAmendment, "Proposed exec policy", sanitizeCodexApprovalVisibleText);
-	if (execpolicySummary) lines.push(execpolicySummary);
-	const networkAmendmentSummary = summarizeNetworkPolicyAmendments(requestParams?.proposedNetworkPolicyAmendments);
-	if (networkAmendmentSummary) lines.push(networkAmendmentSummary);
-	return lines;
+	return [
+		...additionalPermissions ? describePermissionProfile(additionalPermissions, "Additional permissions") : [],
+		summarizeExecPolicyAmendment(requestParams?.proposedExecpolicyAmendment),
+		summarizePermissionTargets(requestParams?.proposedNetworkPolicyAmendments, { kind: "network" })
+	].filter((line) => Boolean(line));
 }
 function describePermissionProfile(permissions, label) {
 	const lines = [];
-	const kinds = [];
 	const risks = /* @__PURE__ */ new Set();
-	if (isJsonObject(permissions.network)) kinds.push("network");
-	if (isJsonObject(permissions.fileSystem)) kinds.push("fileSystem");
+	const kinds = ["network", "fileSystem"].filter((kind) => isJsonObject(permissions[kind]));
 	if (kinds.length > 0) lines.push(`${label}: ${kinds.join(", ")}`);
 	let networkSummary;
 	if (isJsonObject(permissions.network)) {
@@ -3646,7 +3651,10 @@ function describePermissionProfile(permissions, label) {
 		].map((key) => summarizePermissionArray(fileSystem[key], key, risks, {
 			sanitize: sanitizePermissionPathValue,
 			risksFor: permissionPathRisks
-		})), summarizeFileSystemEntries(fileSystem, risks)].filter((summary) => Boolean(summary));
+		})), summarizePermissionTargets(fileSystem.entries, {
+			kind: "file-system",
+			risks
+		})].filter((summary) => Boolean(summary));
 		fileSystemSummary = summaries.length > 0 ? summaries.join("; ") : void 0;
 	}
 	if (risks.size > 0) lines.push(`High-risk targets: ${[...risks].join(", ")}`);
@@ -3660,21 +3668,24 @@ function summarizeNetworkEnabledPermission(permission, risks) {
 	if (enabled) risks.add("network access");
 	return `enabled: ${enabled}`;
 }
-function summarizeFileSystemEntries(permission, risks) {
-	const entries = permission.entries;
+function summarizePermissionTargets(entries, format) {
 	if (!Array.isArray(entries)) return;
+	const fileSystem = format.kind === "file-system";
+	const sanitizeTarget = fileSystem ? sanitizePermissionPathValue : sanitizePermissionHostValue;
 	const samples = [];
 	let count = 0;
 	for (const entry of entries) {
 		const item = isJsonObject(entry) ? entry : void 0;
-		const path = typeof item?.path === "string" ? item.path.trim() : "";
-		const access = typeof item?.access === "string" ? item.access.trim() : "";
-		if (!path || !access) continue;
+		const rawTarget = item?.[fileSystem ? "path" : "host"];
+		const rawAction = item?.[fileSystem ? "access" : "action"];
+		const target = typeof rawTarget === "string" ? fileSystem ? rawTarget.trim() : rawTarget : "";
+		const action = typeof rawAction === "string" ? fileSystem ? rawAction.trim() : rawAction : "";
+		if (!target || !action) continue;
 		count += 1;
-		if (access !== "none") for (const risk of permissionPathRisks(path)) risks.add(risk);
-		if (samples.length < PERMISSION_SAMPLE_LIMIT) samples.push(`${sanitizeCodexApprovalVisibleText(access)} ${sanitizePermissionPathValue(path)}`);
+		if (format.kind === "file-system" && action !== "none") for (const risk of permissionPathRisks(target)) format.risks.add(risk);
+		if (samples.length < PERMISSION_SAMPLE_LIMIT) samples.push(`${sanitizeCodexApprovalVisibleText(action)} ${sanitizeTarget(target)}`);
 	}
-	return formatPermissionSamples("entries", samples, count);
+	return formatPermissionSamples(fileSystem ? "entries" : "Proposed network policy", samples, count);
 }
 function summarizePermissionArray(input, label, risks, format) {
 	const values = normalizeTrimmedStringList(input);
@@ -3682,24 +3693,10 @@ function summarizePermissionArray(input, label, risks, format) {
 	for (const value of values) for (const risk of format.risksFor(value)) risks.add(risk);
 	return formatPermissionSamples(label, values.slice(0, PERMISSION_SAMPLE_LIMIT).map(format.sanitize).filter(Boolean), values.length);
 }
-function summarizeStringArray(value, label, sanitize) {
+function summarizeExecPolicyAmendment(value) {
 	if (!Array.isArray(value)) return;
-	const values = value.filter((entry) => typeof entry === "string").map((entry) => sanitize(entry)).filter(Boolean);
-	return formatPermissionSamples(label, values.slice(0, PERMISSION_SAMPLE_LIMIT), values.length);
-}
-function summarizeNetworkPolicyAmendments(value) {
-	if (!Array.isArray(value)) return;
-	const samples = [];
-	let count = 0;
-	for (const entry of value) {
-		const amendment = isJsonObject(entry) ? entry : void 0;
-		const host = typeof amendment?.host === "string" ? amendment.host : "";
-		const action = typeof amendment?.action === "string" ? amendment.action : "";
-		if (!host || !action) continue;
-		count += 1;
-		if (samples.length < PERMISSION_SAMPLE_LIMIT) samples.push(`${sanitizeCodexApprovalVisibleText(action)} ${sanitizePermissionHostValue(host)}`);
-	}
-	return formatPermissionSamples("Proposed network policy", samples, count);
+	const values = value.filter((entry) => typeof entry === "string").map((entry) => sanitizeCodexApprovalVisibleText(entry)).filter(Boolean);
+	return formatPermissionSamples("Proposed exec policy", values.slice(0, PERMISSION_SAMPLE_LIMIT), values.length);
 }
 function formatPermissionSamples(label, samples, count) {
 	if (count === 0) return;
@@ -3719,18 +3716,12 @@ function sanitizePermissionPathValue(value) {
 }
 function permissionHostRisks(value) {
 	const normalized = value.trim().toLowerCase();
-	const risks = [];
-	if (normalized.includes("*")) {
-		risks.push("wildcard hosts");
-		if (isPrivateNetworkHostPattern(normalized)) risks.push("private-network wildcards");
-	}
-	return risks;
+	if (!normalized.includes("*")) return [];
+	return isPrivateNetworkHostPattern(normalized) ? ["wildcard hosts", "private-network wildcards"] : ["wildcard hosts"];
 }
 function permissionPathRisks(value) {
 	const normalized = sanitizeCodexApprovalVisibleText(value);
-	const risks = [];
-	if (normalized === "/" || normalized === "\\" || /^[A-Za-z]:[\\/]*$/.test(normalized)) risks.push("filesystem root");
-	return risks;
+	return normalized === "/" || normalized === "\\" || /^[A-Za-z]:[\\/]*$/.test(normalized) ? ["filesystem root"] : [];
 }
 function isPrivateNetworkHostPattern(value) {
 	const wildcardStripped = value.toLowerCase().replace(/^\*\./, "");
@@ -3742,8 +3733,12 @@ function isPrivateNetworkHostPattern(value) {
 		"corp",
 		"private"
 	].some((suffix) => wildcardStripped === suffix || wildcardStripped.endsWith(`.${suffix}`))) return true;
-	if (wildcardStripped.startsWith("10.") || wildcardStripped.startsWith("127.") || wildcardStripped.startsWith("192.168.") || wildcardStripped.startsWith("169.254.")) return true;
-	return /^172\.(1[6-9]|2\d|3[0-1])\./.test(wildcardStripped);
+	return [
+		"10.",
+		"127.",
+		"192.168.",
+		"169.254."
+	].some((prefix) => wildcardStripped.startsWith(prefix)) || /^172\.(1[6-9]|2\d|3[0-1])\./.test(wildcardStripped);
 }
 function approvalResolutionMessage(outcome) {
 	return {
@@ -3754,15 +3749,11 @@ function approvalResolutionMessage(outcome) {
 		denied: "Codex app-server approval denied."
 	}[outcome];
 }
-function approvalEventScope(method, outcome) {
-	return method === "item/permissions/requestApproval" ? { scope: outcome === "approved-session" ? "session" : "turn" } : {};
-}
 function readPolicyCommand(record) {
 	const command = record?.command;
 	if (typeof command === "string") return command;
 	if (Array.isArray(command) && command.every((part) => typeof part === "string")) return command.join(" ");
-	const actionCommands = readCommandActions(record);
-	if (actionCommands.length > 0) return actionCommands.join(" && ");
+	return readCommandActions(record).join(" && ") || void 0;
 }
 function readNetworkApprovalContext(record) {
 	const context = isJsonObject(record?.networkApprovalContext) ? record.networkApprovalContext : void 0;
@@ -3778,22 +3769,16 @@ function readCommandActions(record) {
 	if (!Array.isArray(actions)) return [];
 	return actions.map((action) => isJsonObject(action) ? readStringField(action, "command") : void 0).filter((command) => Boolean(command));
 }
-function readCommandActionsPreview(record) {
-	let source;
-	for (const command of readCommandActions(record)) {
-		source = appendPreviewPart(source, command, " && ");
-		if (source.clipped) break;
-	}
-	return source;
-}
 function readCommandPreview(record) {
 	const command = record?.command;
 	if (typeof command === "string") return previewSource(command);
-	if (!Array.isArray(command)) return;
+	return Array.isArray(command) ? readJoinedPreview(command, " ") : void 0;
+}
+function readJoinedPreview(parts, separator) {
 	let source;
-	for (const part of command) {
+	for (const part of parts) {
 		if (typeof part !== "string") return;
-		source = appendPreviewPart(source, part, " ");
+		source = previewSource(`${source?.value ? `${source.value}${separator}` : ""}${part}`);
 		if (source.clipped) break;
 	}
 	return source;
@@ -3808,14 +3793,6 @@ function previewSource(value) {
 		clipped: value.length > APPROVAL_PREVIEW_SCAN_MAX_LENGTH
 	};
 }
-function appendPreviewPart(source, part, separator) {
-	const value = `${source?.value ? `${source.value}${separator}` : ""}${part}`;
-	const clipped = source?.clipped === true || value.length > APPROVAL_PREVIEW_SCAN_MAX_LENGTH;
-	return {
-		value: sliceUtf16Safe(value, 0, APPROVAL_PREVIEW_SCAN_MAX_LENGTH),
-		clipped
-	};
-}
 function sanitizeApprovalPreview(source, maxLength) {
 	if (!source || !source.value) return { omitted: false };
 	const rawPreview = stripDanglingCodexApprovalTerminalSequence(source.value);
@@ -3857,45 +3834,49 @@ function diagnosticToolIdentity(params) {
 		toolCallId: params.call.callId
 	};
 }
-function emitDynamicToolStartedDiagnostic(params) {
-	emitTrustedDiagnosticEvent({
-		type: "tool.execution.started",
-		...diagnosticToolIdentity(params)
-	});
-}
-function emitDynamicToolErrorDiagnostic(params) {
-	emitTrustedDiagnosticEvent({
-		type: "tool.execution.error",
-		...diagnosticToolIdentity(params),
-		durationMs: params.durationMs,
-		errorCategory: "codex_dynamic_tool_error",
-		terminalReason: params.terminalReason ?? "failed"
-	});
-}
-/** Emits the terminal event matching a dynamic tool response's diagnostic type. */
-function emitDynamicToolTerminalDiagnostic(params) {
-	const terminalType = params.response.diagnosticTerminalType ?? (params.response.success ? "completed" : "error");
-	if (terminalType === "completed") {
-		emitTrustedDiagnosticEvent({
-			type: "tool.execution.completed",
-			...diagnosticToolIdentity(params),
-			durationMs: params.durationMs
-		});
-		return;
-	}
-	if (terminalType === "blocked") {
+function createCodexDynamicToolDiagnostics(params) {
+	const matchesTerminal = (event) => {
+		if (event.type !== "tool.execution.completed" && event.type !== "tool.execution.error" && event.type !== "tool.execution.blocked" || event.toolCallId !== params.call.callId || event.toolName !== params.call.tool) return false;
+		if (params.runId !== void 0) return event.runId === params.runId;
+		if (params.sessionId !== void 0) return event.sessionId === params.sessionId;
+		if (params.sessionKey !== void 0) return event.sessionKey === params.sessionKey;
+		return event.runId === void 0 && event.sessionId === void 0 && event.sessionKey === void 0;
+	};
+	const error = (durationMs, terminalReason = "failed") => {
 		emitTrustedDiagnosticEvent({
-			type: "tool.execution.blocked",
+			type: "tool.execution.error",
 			...diagnosticToolIdentity(params),
-			deniedReason: "plugin-before-tool-call",
-			reason: "Tool call blocked"
+			durationMs,
+			errorCategory: "codex_dynamic_tool_error",
+			terminalReason
 		});
-		return;
-	}
-	emitDynamicToolErrorDiagnostic({
-		...params,
-		terminalReason: params.response.diagnosticTerminalReason ?? "failed"
-	});
+	};
+	return {
+		matchesTerminal,
+		hasPendingTerminal: () => hasPendingInternalDiagnosticEvent(matchesTerminal),
+		started() {
+			emitTrustedDiagnosticEvent({
+				type: "tool.execution.started",
+				...diagnosticToolIdentity(params)
+			});
+		},
+		error,
+		terminal(response, durationMs) {
+			const type = response.diagnosticTerminalType ?? (response.success ? "completed" : "error");
+			if (type === "completed") emitTrustedDiagnosticEvent({
+				type: "tool.execution.completed",
+				...diagnosticToolIdentity(params),
+				durationMs
+			});
+			else if (type === "blocked") emitTrustedDiagnosticEvent({
+				type: "tool.execution.blocked",
+				...diagnosticToolIdentity(params),
+				deniedReason: "plugin-before-tool-call",
+				reason: "Tool call blocked"
+			});
+			else error(durationMs, response.diagnosticTerminalReason ?? "failed");
+		}
+	};
 }
 //#endregion
 //#region extensions/codex/src/app-server/elicitation-bridge.ts
@@ -4043,7 +4024,8 @@ function resolvePluginElicitation(params) {
 	const context = params.pluginAppPolicyContext;
 	const entries = context ? Object.values(context.apps) : [];
 	const pluginEntries = entries.filter(isPluginAppPolicyContextEntry);
-	const appId = readFirstString(meta, PLUGIN_APP_ID_META_KEYS) ?? readFirstString(requestParams, PLUGIN_APP_ID_META_KEYS);
+	const readIdentity = (keys) => readFirstString(meta, keys) ?? readFirstString(requestParams, keys);
+	const appId = readIdentity(PLUGIN_APP_ID_META_KEYS);
 	const connectorId = readFirstString(meta, PLUGIN_CONNECTOR_ID_META_KEYS);
 	const isCodexConnectorApproval = isCodexConnectorApprovalElicitation(requestParams, meta);
 	if (isCodexConnectorApproval && appId && connectorId && codexAppIdentityKey(appId) !== codexAppIdentityKey(connectorId)) return {
@@ -4068,9 +4050,9 @@ function resolvePluginElicitation(params) {
 		const matches = entries.filter((entry) => entry.mcpServerNames.includes(serverName));
 		if (matches.length > 0) return uniquePluginMatch(matches, "server_name");
 	}
-	const pluginName = readFirstString(meta, PLUGIN_NAME_META_KEYS) ?? readFirstString(requestParams, PLUGIN_NAME_META_KEYS);
-	const configKey = readFirstString(meta, PLUGIN_CONFIG_KEY_META_KEYS) ?? readFirstString(requestParams, PLUGIN_CONFIG_KEY_META_KEYS);
-	const marketplaceName = readFirstString(meta, PLUGIN_MARKETPLACE_NAME_META_KEYS) ?? readFirstString(requestParams, PLUGIN_MARKETPLACE_NAME_META_KEYS);
+	const pluginName = readIdentity(PLUGIN_NAME_META_KEYS);
+	const configKey = readIdentity(PLUGIN_CONFIG_KEY_META_KEYS);
+	const marketplaceName = readIdentity(PLUGIN_MARKETPLACE_NAME_META_KEYS);
 	if (pluginName || configKey) {
 		if (!context) return {
 			kind: "decline",
@@ -4165,31 +4147,19 @@ function readApprovalElicitation(requestParams, source) {
 		meta,
 		...source.kind !== "computer-use" ? {
 			persistHintsMode: "explicit",
-			allowedDecisions: buildApprovalAllowedDecisions(requestedSchema, meta, source.kind === "mcp")
+			allowedDecisions: canMapPersistentApproval(requestedSchema, meta, source.kind === "mcp") ? [
+				"allow-once",
+				"allow-always",
+				"deny"
+			] : ["allow-once", "deny"]
 		} : {}
 	};
 }
-function buildApprovalAllowedDecisions(requestedSchema, meta, allowSession = false) {
-	return canMapPersistentApproval(requestedSchema, meta, allowSession) ? [
-		"allow-once",
-		"allow-always",
-		"deny"
-	] : ["allow-once", "deny"];
-}
 function canMapPersistentApproval(requestedSchema, meta, allowSession) {
 	const persistHints = readPersistHints(meta, "explicit");
 	if (allowSession) return choosePersistHint(persistHints) !== void 0;
 	if (persistHints.length > 0) return persistHints.includes("always");
-	const properties = isJsonObject(requestedSchema.properties) ? requestedSchema.properties : {};
-	return Object.entries(properties).some(([name, value]) => {
-		const schema = isJsonObject(value) ? value : void 0;
-		if (!schema) return false;
-		return isPersistField({
-			name,
-			schema,
-			required: false
-		}) && chooseAlwaysPersistOptionValue(readEnumOptions(schema)) !== void 0;
-	});
+	return readApprovalProperties(isJsonObject(requestedSchema.properties) ? requestedSchema.properties : {}).some((property) => isPersistField(property) && chooseAlwaysPersistOptionValue(readEnumOptions(property.schema)) !== void 0);
 }
 function logPluginElicitationDecline(reason, requestParams) {
 	embeddedAgentLog.debug("codex plugin elicitation declined", {
@@ -4219,25 +4189,26 @@ function buildApprovalDescription(params) {
 	].filter(Boolean).join("\n\n");
 }
 function readPropertyDescriptionLines(requestedSchema) {
-	const properties = isJsonObject(requestedSchema.properties) ? requestedSchema.properties : {};
-	return Object.entries(properties).map(([name, value]) => {
-		const schema = isJsonObject(value) ? value : void 0;
-		if (!schema) return;
+	return readApprovalProperties(isJsonObject(requestedSchema.properties) ? requestedSchema.properties : {}).map(({ name, schema }) => {
 		const propTitle = sanitizeDisplayText(readNonBlankString(schema.title) ?? "") || sanitizeDisplayText(name) || "field";
 		const description = sanitizeOptionalDisplayText(readNonBlankString(schema.description));
 		return description ? `- ${propTitle}: ${description}` : `- ${propTitle}`;
-	}).filter((line) => Boolean(line));
+	});
+}
+function readApprovalProperties(properties) {
+	return Object.entries(properties).flatMap(([name, schema]) => isJsonObject(schema) ? [{
+		name,
+		schema
+	}] : []);
 }
 function readDisplayParamLines(meta) {
 	const displayParams = meta[MCP_TOOL_APPROVAL_TOOL_PARAMS_DISPLAY_KEY];
 	if (!Array.isArray(displayParams)) return [];
-	const lines = displayParams.slice(0, MAX_DISPLAY_PARAM_ENTRIES).map((entry) => {
-		const param = isJsonObject(entry) ? entry : void 0;
-		if (!param) return;
+	const lines = displayParams.slice(0, MAX_DISPLAY_PARAM_ENTRIES).flatMap((param) => {
+		if (!isJsonObject(param)) return [];
 		const name = sanitizeOptionalDisplayText(readNonBlankString(param.display_name)) ?? sanitizeOptionalDisplayText(readNonBlankString(param.name));
-		if (!name) return;
-		return `- ${name}: ${formatDisplayParamValue(param.value)}`;
-	}).filter((line) => Boolean(line));
+		return name ? [`- ${name}: ${formatDisplayParamValue(param.value)}`] : [];
+	});
 	const remaining = displayParams.length - MAX_DISPLAY_PARAM_ENTRIES;
 	return remaining > 0 ? [...lines, `- Additional parameters: ${remaining} more`] : lines;
 }
@@ -4260,19 +4231,15 @@ function formatDisplayJsonValue(value, depth = MAX_DISPLAY_VALUE_DEPTH) {
 	if (typeof value === "object") {
 		if (depth <= 0) return "{truncated}";
 		const parts = [];
-		let count = 0;
-		let truncated = false;
 		for (const key in value) {
 			if (!Object.hasOwn(value, key)) continue;
-			if (count >= MAX_DISPLAY_VALUE_OBJECT_KEYS) {
-				truncated = true;
+			if (parts.length >= MAX_DISPLAY_VALUE_OBJECT_KEYS) {
+				parts.push("...");
 				break;
 			}
 			const safeKey = truncateCodexApprovalDisplayText(sanitizeDisplayText(key), 80);
 			parts.push(`${JSON.stringify(safeKey)}:${formatDisplayJsonValue(value[key] ?? null, depth - 1)}`);
-			count += 1;
 		}
-		if (truncated) parts.push("...");
 		return `{${parts.join(",")}}`;
 	}
 	return "null";
@@ -4310,41 +4277,28 @@ function buildAcceptedContent(approvalPrompt, outcome) {
 	const content = {};
 	let sawApprovalField = false;
 	const persist = choosePersistHint(readPersistHints(meta, approvalPrompt.persistHintsMode));
-	for (const [name, value] of Object.entries(properties)) {
-		const schema = isJsonObject(value) ? value : void 0;
-		if (!schema) continue;
-		const property = {
-			name,
-			schema,
-			required: required.has(name)
-		};
-		const next = readApprovalFieldValue(property, outcome, persist) ?? readPersistFieldValue(property, meta, outcome, approvalPrompt.persistHintsMode ?? "legacy") ?? (outcome === "approved-once" && isPersistField(property) ? void 0 : property.schema.default);
+	for (const property of readApprovalProperties(properties)) {
+		const next = readAcceptedPropertyValue(property, outcome, persist, approvalPrompt.persistHintsMode ?? "legacy");
 		if (isApprovalField(property)) sawApprovalField = true;
 		if (next === void 0) {
-			if (property.required) return;
+			if (required.has(property.name)) return;
 			continue;
 		}
-		content[name] = next;
+		content[property.name] = next;
 	}
 	return sawApprovalField ? content : void 0;
 }
-function readApprovalFieldValue(property, outcome, persist) {
-	if (!isApprovalField(property)) return;
-	if (readNonBlankString(property.schema.type) === "boolean") return true;
-	const options = readEnumOptions(property.schema);
-	if (options.length === 0) return;
-	const acceptChoice = options.find((option) => isPositiveApprovalOption(option));
-	if (outcome === "approved-session") return options.find((option) => isPersistentApprovalOption(option, persist))?.value ?? acceptChoice?.value;
-	return acceptChoice?.value;
-}
-function readPersistFieldValue(property, meta, outcome, persistHintsMode) {
-	if (!isPersistField(property) || outcome !== "approved-session") return;
-	const persistHints = readPersistHints(meta, persistHintsMode);
+function readAcceptedPropertyValue(property, outcome, persist, persistHintsMode) {
+	if (isApprovalField(property)) {
+		if (readNonBlankString(property.schema.type) === "boolean") return true;
+		const options = readEnumOptions(property.schema);
+		const choice = (outcome === "approved-session" ? options.find((option) => isPersistentApprovalOption(option, persist)) : void 0) ?? options.find(isPositiveApprovalOption);
+		if (choice) return choice.value;
+	}
+	if (!isPersistField(property)) return property.schema.default;
+	if (outcome === "approved-once") return;
 	const options = readEnumOptions(property.schema);
-	if (options.length === 0) return;
-	const preferred = choosePersistHint(persistHints);
-	if (preferred) return options.find((option) => option.value === preferred || option.label === preferred)?.value;
-	if (persistHintsMode === "explicit") return chooseAlwaysPersistOptionValue(options);
+	return (persist ? options.find((option) => option.value === persist || option.label === persist)?.value : persistHintsMode === "explicit" ? chooseAlwaysPersistOptionValue(options) : void 0) ?? property.schema.default;
 }
 function isApprovalField(property) {
 	const haystack = propertyText(property).toLowerCase();
@@ -4373,14 +4327,10 @@ function buildAcceptedMeta(meta, outcome, persistHintsMode) {
 	return persist ? { persist } : null;
 }
 function choosePersistHint(persistHints) {
-	if (persistHints.includes("always")) return "always";
-	if (persistHints.includes("session")) return "session";
+	return ["always", "session"].find((hint) => persistHints.includes(hint));
 }
 function chooseAlwaysPersistOptionValue(options) {
-	return options.find((option) => optionMatchesPersist(option, "always"))?.value;
-}
-function optionMatchesPersist(option, persist) {
-	return option.value.toLowerCase() === persist || option.label.toLowerCase() === persist;
+	return options.find((option) => option.value.toLowerCase() === "always" || option.label.toLowerCase() === "always")?.value;
 }
 function hasNoSchemaProperties(requestedSchema) {
 	const properties = isJsonObject(requestedSchema.properties) ? requestedSchema.properties : {};
@@ -4395,15 +4345,14 @@ function readEnumOptions(schema) {
 			label: labels[index] ?? value
 		}));
 	}
-	if (Array.isArray(schema.oneOf)) return schema.oneOf.map((entry) => {
+	if (Array.isArray(schema.oneOf)) return schema.oneOf.flatMap((entry) => {
 		const option = isJsonObject(entry) ? entry : void 0;
 		const value = readNonBlankString(option?.const);
-		if (!value) return;
-		return {
+		return value ? [{
 			value,
 			label: readNonBlankString(option?.title) ?? value
-		};
-	}).filter((entry) => Boolean(entry));
+		}] : [];
+	});
 	return [];
 }
 function isPositiveApprovalOption(option) {
@@ -4555,7 +4504,7 @@ function projectCodexDynamicTools(tools) {
 			continue;
 		}
 		const descriptor = readCodexDynamicToolDescriptor(tool, toolIndex);
-		if (!descriptor.ok) {
+		if ("diagnostic" in descriptor) {
 			quarantinedTools.push(descriptor.diagnostic);
 			continue;
 		}
@@ -4589,13 +4538,10 @@ function projectCodexDynamicTools(tools) {
 }
 function readCodexDynamicToolDescriptor(tool, toolIndex) {
 	const fallbackName = `tool[${toolIndex}]`;
-	const invalid = (name, violation) => ({
-		ok: false,
-		diagnostic: {
-			tool: name,
-			violations: [`${name}.${violation}`]
-		}
-	});
+	const invalid = (name, violation) => ({ diagnostic: {
+		tool: name,
+		violations: [`${name}.${violation}`]
+	} });
 	let name;
 	try {
 		const rawName = tool.name;
@@ -4625,7 +4571,6 @@ function readCodexDynamicToolDescriptor(tool, toolIndex) {
 		return invalid(name, "inputSchema is unreadable");
 	}
 	return {
-		ok: true,
 		name,
 		description,
 		parameters
@@ -4777,6 +4722,39 @@ function projectCodexExecutableDynamicToolSurface(tools, hookContext) {
 	};
 }
 //#endregion
+//#region extensions/codex/src/app-server/dynamic-tool-source-reply.ts
+/**
+* Resolves the source-reply facts of one Codex dynamic tool result and records whether
+* it ends the Codex turn on `response`. A final reply
+* authored by a `canDeliverSourceReply` tool, read from the result after middleware and
+* extensions, is appended to `payloads`; the host delivers it and writes its transcript
+* row after the send. Only calls in the model-only namespace qualify: Codex never
+* exposes that namespace to Code Mode programs, so a program's intermediate call
+* cannot end the turn or reach the conversation.
+*/
+function resolveCodexToolResultSourceReply(params) {
+	const messageToolOnly = params.sourceReplyDeliveryMode === "message_tool_only" && params.toolName === "message";
+	const toolConfirmed = messageToolOnly && !params.resultIsError && (params.rawResult.terminate === true || params.result.terminate === true);
+	const confirmed = messageToolOnly && (toolConfirmed || params.deliveredSourceReply);
+	const final = confirmed ? params.executedArgs.final !== false : void 0;
+	const payload = params.canDeliverSourceReply === true && !params.resultIsError && params.call.namespace === "openclaw_direct" ? captureToolAuthoredSourceReply({
+		result: params.result,
+		toolCallId: params.call.callId,
+		idempotencyScope: params.runId ?? params.call.turnId
+	}) : void 0;
+	if (payload) params.payloads.push(payload);
+	const toolAuthoredFinal = Boolean(payload);
+	const continuesSourceReplyProgress = confirmed && final === false;
+	const terminate = toolAuthoredFinal || (params.rawResult.terminate === true || params.result.terminate === true) && !continuesSourceReplyProgress || [params.rawResult, params.result].some(({ details }) => isRecord(details) && typeof details.status === "string" && details.status.trim().toLowerCase() === "yielded") || confirmed && final === true || void 0;
+	params.response.terminate = terminate;
+	if (toolAuthoredFinal) params.response.toolAuthoredFinalReply = true;
+	return {
+		toolConfirmed,
+		final,
+		terminate
+	};
+}
+//#endregion
 //#region extensions/codex/src/app-server/dynamic-tools.ts
 const MAX_CODEX_DYNAMIC_TOOL_VALIDATION_ERRORS = 4;
 const MAX_CODEX_DYNAMIC_TOOL_VALIDATION_ERROR_CHARS = 160;
@@ -4813,11 +4791,6 @@ function computerFrameImageIdentity(content) {
 	const image = expectDefined(images[0], "single Codex computer frame image");
 	return createHash("sha256").update(JSON.stringify([image.mimeType, image.data])).digest("hex");
 }
-function invalidateComputerFrame(contextEpoch) {
-	contextEpoch.value += 1;
-	delete contextEpoch.frameToolCallId;
-	delete contextEpoch.frameImageIdentity;
-}
 function createCodexDynamicToolBridge(params) {
 	const toolResultHookContext = toToolResultHookContext(params.hookContext);
 	const contextWindowTokens = params.hookContext?.contextWindowTokens;
@@ -5081,7 +5054,7 @@ function createCodexDynamicToolBridge(params) {
 					const contentItems = convertToolContents(result.content, toolResultMaxChars);
 					const deliveredFrameImages = contentItems.filter((item) => item.type === "inputImage");
 					const finalFrameImageIdentity = computerFrameImageIdentity(result.content);
-					if (toolName === "computer" && params.computerContextEpoch?.frameToolCallId === call.callId && (deliveredFrameImages.length !== 1 || finalFrameImageIdentity === void 0 || finalFrameImageIdentity !== params.computerContextEpoch.frameImageIdentity)) invalidateComputerFrame(params.computerContextEpoch);
+					if (toolName === "computer" && params.computerContextEpoch?.frameToolCallId === call.callId && (deliveredFrameImages.length !== 1 || finalFrameImageIdentity === void 0 || finalFrameImageIdentity !== params.computerContextEpoch.frameImageIdentity)) invalidateCodexComputerFrame(params.computerContextEpoch);
 					const response = {
 						contentItems,
 						success: !resultIsError,
@@ -5089,9 +5062,20 @@ function createCodexDynamicToolBridge(params) {
 						diagnosticTerminalReason: resultFailureKind === "blocked" ? void 0 : resultFailureKind,
 						transcriptDetails: asOptionalRecord(sanitizeToolResult(result))?.details
 					};
-					const toolConfirmedSourceReply = params.hookContext?.sourceReplyDeliveryMode === "message_tool_only" && toolName === "message" && !resultIsError && (rawResult.terminate === true || result.terminate === true);
-					const confirmedSourceReply = params.hookContext?.sourceReplyDeliveryMode === "message_tool_only" && toolName === "message" && (toolConfirmedSourceReply || deliveredSourceReply);
-					const sourceReplyFinal = confirmedSourceReply ? executedArgs.final !== false : void 0;
+					const sourceReply = resolveCodexToolResultSourceReply({
+						sourceReplyDeliveryMode: params.hookContext?.sourceReplyDeliveryMode,
+						canDeliverSourceReply: toolEntry.tool.canDeliverSourceReply,
+						toolName,
+						call,
+						resultIsError,
+						rawResult,
+						result,
+						deliveredSourceReply,
+						executedArgs,
+						runId: toolResultHookContext.runId,
+						payloads: telemetry.messagingToolSourceReplyPayloads,
+						response
+					});
 					const autoDeliveryTtsMediaUrls = getCoreTtsToolResultMediaUrls(rawResult);
 					recordAgentHarnessToolResultTelemetry({
 						extractSourceReplyPayload: extractMessagingToolSourceReplyPayload,
@@ -5109,12 +5093,10 @@ function createCodexDynamicToolBridge(params) {
 						autoDeliveryTtsMediaUrls,
 						coreTtsToolResult: autoDeliveryTtsMediaUrls?.length ? rawResult : void 0,
 						messagingTarget: confirmedMessagingTarget,
-						sourceReplyFinal,
+						sourceReplyFinal: sourceReply.final,
 						trustedLocalMediaToolNames: pluginLocalMediaTrustByToolName.get(toolName)
 					});
-					if (deliveredSourceReply || toolConfirmedSourceReply) telemetry.didDeliverSourceReplyViaMessageTool = true;
-					const continuesSourceReplyProgress = confirmedSourceReply && sourceReplyFinal === false;
-					response.terminate = (rawResult.terminate === true || result.terminate === true) && !continuesSourceReplyProgress || isToolResultYield(rawResult) || isToolResultYield(result) || confirmedSourceReply && sourceReplyFinal === true || void 0;
+					if (deliveredSourceReply || sourceReply.toolConfirmed) telemetry.didDeliverSourceReplyViaMessageTool = true;
 					const asyncStarted = isAsyncStartedToolResult(rawResult) || isAsyncStartedToolResult(result);
 					response.asyncStarted = asyncStarted || void 0;
 					const replaySafe = executionBoundary.executionPrevented || !asyncStarted && isReplaySafeToolInstance(toolEntry.tool) && isReplaySafeToolCall(toolName, executedArgs);
@@ -5126,7 +5108,7 @@ function createCodexDynamicToolBridge(params) {
 					return response;
 				},
 				onError: ({ error, boundary: executionBoundary, executedArguments: executedArgs, startedAt }) => {
-					if (toolName === "computer" && params.computerContextEpoch?.frameToolCallId === call.callId) invalidateComputerFrame(params.computerContextEpoch);
+					if (toolName === "computer" && params.computerContextEpoch?.frameToolCallId === call.callId) invalidateCodexComputerFrame(params.computerContextEpoch);
 					const executionDisposition = getBeforeToolCallFailureDisposition(error) ?? (signal.aborted ? resolveCodexToolAbortTerminalReason(signal) : resolveToolExecutionErrorKind(error));
 					const errorMessage = formatToolExecutionErrorMessage(error, "OpenClaw dynamic tool call failed.");
 					const operatorHint = readToolOperatorHint(error);
@@ -5205,10 +5187,12 @@ function reportQuarantinedDynamicTools(params) {
 	});
 }
 function dedupeQuarantinedDynamicTools(tools) {
-	return [...new Map(tools.map((tool) => [tool.tool, {
-		tool: tool.tool,
-		violations: tool.violations
-	}])).values()];
+	const byName = /* @__PURE__ */ new Map();
+	for (const { tool, violations } of tools) byName.set(tool, {
+		tool,
+		violations
+	});
+	return [...byName.values()];
 }
 function toToolResultHookContext(ctx) {
 	const { agentId, sessionId, sessionKey, runId, channelId } = ctx ?? {};
@@ -5220,14 +5204,9 @@ function toToolResultHookContext(ctx) {
 		...channelId && { channelId }
 	};
 }
-function isToolResultYield(result) {
-	const details = result.details;
-	if (!isRecord(details) || typeof details.status !== "string") return false;
-	return details.status.trim().toLowerCase() === "yielded";
-}
 function isAsyncStartedToolResult(result) {
 	const details = result.details;
 	return isRecord(details) && details.async === true && details.status === "started";
 }
 //#endregion
-export { emitDynamicToolStartedDiagnostic as a, ensureCodexSandboxExecServerEnvironment as c, CodexNativeProcessAuthority as d, readCodexRetainedBackgroundCommands as f, emitDynamicToolErrorDiagnostic as i, releaseCodexSandboxExecServerEnvironment as l, CodexNativeToolLifecycleProjector as m, projectCodexExecutableDynamicTools as n, emitDynamicToolTerminalDiagnostic as o, createCodexRemoteWorkspaceFileReader as p, routeCodexAppServerElicitationRequest as r, handleCodexAppServerApprovalRequest as s, createCodexDynamicToolBridge as t, createCodexNativePreToolUseFailureBuffer as u };
+export { invalidateCodexComputerFrame as _, handleCodexAppServerApprovalRequest as a, createCodexNativePreToolUseFailureBuffer as c, buildCodexTemporalAdditionalContext as d, buildTurnCollaborationMode as f, buildCodexUserInput as g, readCodexRetainedBackgroundCommands as h, createCodexDynamicToolDiagnostics as i, buildCodexHistoryProvenancePrefix as l, CodexNativeProcessAuthority as m, projectCodexExecutableDynamicTools as n, ensureCodexSandboxExecServerEnvironment as o, buildTurnStartParams as p, routeCodexAppServerElicitationRequest as r, releaseCodexSandboxExecServerEnvironment as s, createCodexDynamicToolBridge as t, buildCodexParentLocalInstructions as u, createCodexRemoteWorkspaceFileReader as v, CodexNativeToolLifecycleProjector as y };