@openclaw/codex 2026.10.5-beta.4 → 2026.10.10-beta.1

package/dist/.setup/{dynamic-tool-build-DcaPmBlE.mjs → dynamic-tool-build-BjFAIG-f.mjs}

@@ -1,14 +1,14 @@
 import { CODEX_NATIVE_TOOL_REQUIREMENTS } from "../native-tool-policy.js";
 import { c as isCodexPairedNodeRemoteExecPlacementSandbox, d as readCodexPluginConfig, l as isCodexRemoteExecPlacementSandbox } from "./config-parsing-DsWSCPHO.mjs";
-import "./config-C1YVVLEA.mjs";
-import { a as isCodexResponsesOAuthRun } from "./responses-oauth-twnuTaAa.mjs";
-import { F as isForcedPrivateQaCodexRuntime, L as isSystemAgentOnlyCodexDynamicToolAllowlist, P as filterCodexDynamicTools, R as normalizeCodexDynamicToolName, h as resolveCodexWebSearchPlan } from "./thread-requests-BgzJwJtS.mjs";
-import { n as resolveCodexNativeExecutionPolicy, r as resolveCodexNodeExecToolOverrides } from "./native-execution-policy-MXEe7PB3.mjs";
-import { _ as createGatewayProcessProjection, b as isCodexDynamicToolExcluded, g as createGatewayExecProjection, v as createNodeExecAliasDynamicTool, x as placeDisabledNativeShellToolsInDirectNamespace, y as createSandboxShellProjection } from "./native-hook-relay-wq7jrNLk.mjs";
+import "./config-BfrAlTMT.mjs";
+import { a as isCodexResponsesOAuthRun } from "./responses-oauth-CCV7aVYF.mjs";
+import { F as isForcedPrivateQaCodexRuntime, L as isSystemAgentOnlyCodexDynamicToolAllowlist, P as filterCodexDynamicTools, R as normalizeCodexDynamicToolName, h as resolveCodexWebSearchPlan } from "./thread-requests-BjawdIVV.mjs";
+import { a as resolveCodexNodeExecToolOverrides, r as prepareCodexNativeExecutionPolicyForRun } from "./native-execution-policy-D09tLP-u.mjs";
+import { _ as createGatewayProcessProjection, b as isCodexDynamicToolExcluded, g as createGatewayExecProjection, v as createNodeExecAliasDynamicTool, x as placeDisabledNativeShellToolsInDirectNamespace, y as createSandboxShellProjection } from "./native-hook-relay-C7aaLJaP.mjs";
 import path from "node:path";
 import { createStageTimingTracker, formatStageTimings } from "openclaw/plugin-sdk/time-runtime";
 import { resolveAgentDir } from "openclaw/plugin-sdk/agent-runtime";
-import { applyEmbeddedAttemptToolsAllow, buildAgentHookContextChannelFields, buildEmbeddedAttemptToolRunContext, embeddedAgentLog, filterProviderNormalizableTools, getPluginToolMeta, isHostScopedAgentToolActive, isSubagentSessionKey, normalizeAgentRuntimeTools, resolveAttemptSpawnWorkspaceDir, resolveModelAuthMode, supportsModelTools } from "openclaw/plugin-sdk/agent-harness-runtime";
+import { applyEmbeddedAttemptToolsAllow, buildAgentHookContextChannelFields, buildEmbeddedAttemptToolRunContext, embeddedAgentLog, filterProviderNormalizableTools, getPluginToolMeta, isHostScopedAgentToolActive, isSubagentSessionKey, normalizeAgentRuntimeTools, resolveAttemptSpawnWorkspaceDir, resolveModelAuthModeAsync, supportsModelTools } from "openclaw/plugin-sdk/agent-harness-runtime";
 import { isToolAllowed } from "openclaw/plugin-sdk/sandbox";
 import { resolveCodexScheduledToolProjectionFactory, runWithCronCreatorAuthorityCapabilityResolver } from "openclaw/plugin-sdk/codex-mcp-projection";
 //#region extensions/codex/src/app-server/dynamic-tool-construction-plan.ts
@@ -138,238 +138,228 @@ async function buildDynamicTools(input) {
 	const toolBuildStages = createStageTimingTracker();
 	const modelHasVision = params.model.input?.includes("image") ?? false;
 	const agentDir = params.agentDir ?? resolveAgentDir(params.config ?? {}, input.sessionAgentId);
-	const nativeExecutionPolicy = resolveCodexNativeExecutionPolicyForRun(params, {
+	const preparedExecution = input.nativeExecutionPolicy ?? await prepareCodexNativeExecutionPolicyForRun(params, {
 		agentId: input.policyAgentId,
 		runtimeSessionKey: input.sandboxSessionKey,
 		sandbox: input.sandbox
 	});
-	const webSearchPlan = resolveCodexWebSearchPlan({
-		config: params.config,
-		disableTools: params.disableTools,
-		nativeToolSurfaceEnabled: isCodexResponsesOAuthRun(params) || input.nativeToolSurfaceEnabled,
-		nativeProviderWebSearchSupport: input.nativeProviderWebSearchSupport
-	});
-	const messageToolProvider = resolveCodexMessageToolProvider(params);
-	const webFetchHostnameAllowlistRef = {};
-	const toolConstructionPlan = resolveCodexToolConstructionPlan(input.sandbox, input.nativeToolSurfaceEnabled, params.requireWorkspaceOnly);
-	const options = {
-		agentId: input.sessionAgentId,
-		policyAgentId: input.policyAgentId,
-		...toolRunContext,
-		exec: {
-			...params.execOverrides,
-			...input.sessionPermissionPolicy ? { mode: input.sessionPermissionPolicy.execMode } : {},
-			...resolveCodexNodeExecToolOverrides(nativeExecutionPolicy),
+	try {
+		const nativeExecutionPolicy = preparedExecution.policy;
+		const webSearchPlan = resolveCodexWebSearchPlan({
 			config: params.config,
-			elevated: params.bashElevated
-		},
-		sessionPermissionPolicy: input.sessionPermissionPolicy ? {
-			mode: input.sessionPermissionPolicy.mode,
-			root: input.sessionPermissionPolicy.root
-		} : void 0,
-		sandbox: input.sandbox,
-		requireWorkspaceOnly: params.requireWorkspaceOnly,
-		...toolConstructionPlan ? { toolConstructionPlan } : {},
-		messageProvider: messageToolProvider,
-		toolPolicyMessageProvider: params.messageProvider ?? params.messageChannel,
-		...params.onToolResult ? { questionPrompt: {
-			send: params.onToolResult,
-			messageChannel: messageToolProvider
-		} } : {},
-		inputProvenance: params.inputProvenance,
-		trustedInternalHandoff: params.trustedInternalHandoff,
-		allowGatewaySubagentBinding: params.allowGatewaySubagentBinding || isForcedPrivateQaCodexRuntime(),
-		sessionKey: input.sandboxSessionKey,
-		runSessionKey: params.sessionKey && params.sessionKey !== input.sandboxSessionKey ? params.sessionKey : void 0,
-		sessionId: params.sessionId,
-		runId: params.runId,
-		memoryAudience: params.memoryAudience,
-		agentDir,
-		preparedModelRuntime: params.preparedModelRuntime,
-		cwd: input.effectiveCwd ?? input.effectiveWorkspace,
-		workspaceDir: input.effectiveWorkspace,
-		spawnWorkspaceDir: input.effectiveCwd && input.effectiveCwd !== input.effectiveWorkspace ? input.resolvedWorkspace : resolveAttemptSpawnWorkspaceDir({
+			disableTools: params.disableTools,
+			nativeToolSurfaceEnabled: isCodexResponsesOAuthRun(params) || input.nativeToolSurfaceEnabled,
+			nativeProviderWebSearchSupport: input.nativeProviderWebSearchSupport
+		});
+		const messageToolProvider = resolveCodexMessageToolProvider(params);
+		const webFetchHostnameAllowlistRef = {};
+		const toolConstructionPlan = resolveCodexToolConstructionPlan(input.sandbox, input.nativeToolSurfaceEnabled, params.requireWorkspaceOnly);
+		const options = {
+			agentId: input.sessionAgentId,
+			policyAgentId: input.policyAgentId,
+			...toolRunContext,
+			exec: {
+				...params.execOverrides,
+				...input.sessionPermissionPolicy ? { mode: input.sessionPermissionPolicy.execMode } : {},
+				...resolveCodexNodeExecToolOverrides(nativeExecutionPolicy),
+				config: params.config,
+				elevated: params.bashElevated
+			},
+			sessionPermissionPolicy: input.sessionPermissionPolicy ? {
+				mode: input.sessionPermissionPolicy.mode,
+				root: input.sessionPermissionPolicy.root
+			} : void 0,
 			sandbox: input.sandbox,
-			resolvedWorkspace: input.resolvedWorkspace
-		}),
-		config: params.config,
-		skillsSnapshot: params.skillsSnapshot,
-		...params.skillLibraryAuthoring ? { skillWorkshop: { libraryAuthoring: params.skillLibraryAuthoring } } : {},
-		authProfileStore: params.toolAuthProfileStore ?? params.authProfileStore,
-		abortSignal: input.runAbortController.signal,
-		emitBeforeToolCallDiagnostics: false,
-		modelProvider: params.model.provider,
-		modelId: params.modelId,
-		modelCompat: params.model.compat && typeof params.model.compat === "object" ? params.model.compat : void 0,
-		modelApi: params.model.api,
-		modelContextWindowTokens: params.model.contextWindow,
-		delegationCapability: params.delegationCapability,
-		modelAuthMode: resolveModelAuthMode(params.model.provider, params.config, params.toolAuthProfileStore ?? params.authProfileStore, { workspaceDir: input.effectiveWorkspace }),
-		suppressManagedWebSearch: false,
-		webFetchHostnameAllowlistRef,
-		hookChannelId: resolveCodexAppServerHookChannelId(params, input.sandboxSessionKey),
-		modelHasVision,
-		computerContextEpoch: input.computerContextEpoch,
-		oneShotCliRun: params.oneShotCliRun,
-		registerRunCleanup: input.registerRunCleanup,
-		requireExplicitMessageTarget: params.requireExplicitMessageTarget ?? isSubagentSessionKey(params.sessionKey),
-		disableMessageTool: input.ignoreDisableMessageTool ? false : params.disableMessageTool,
-		forceMessageTool: shouldForceMessageTool(messagePolicyParams),
-		enableHeartbeatTool: params.trigger === "heartbeat" || input.forceHeartbeatTool === true,
-		forceHeartbeatTool: params.trigger === "heartbeat" || input.forceHeartbeatTool === true,
-		onYield: (message, acknowledgment) => {
-			input.onYieldDetected(message, acknowledgment);
-			input.onCodexAppServerEvent?.({
-				stream: "codex_app_server.tool",
-				data: {
-					name: "sessions_yield",
-					message
-				}
-			});
-		},
-		claimYieldCompletion: input.claimYieldCompletion,
-		recordToolPrepStage: (name) => {
-			toolBuildStages.mark(name);
-		},
-		onToolOutcome: params.onToolOutcome,
-		isTurnTainted: params.isTurnTainted,
-		allocateToolOutcomeOrdinal: params.allocateToolOutcomeOrdinal,
-		cronCreatorToolAllowlistRef: input.cronCreatorToolAllowlistRef,
-		cronCreatorToolAllowlistCaptureRef: input.cronCreatorToolAllowlistCaptureRef,
-		cronCreatorAuthorityUnavailableReason: input.cronCreatorAuthorityUnavailableReason
-	};
-	input.onMessageToolTargetResolved?.(options.requireExplicitMessageTarget === true);
-	const allTools = await createCodexHostToolSurface(params, options, { cwd: input.effectiveCwd ?? input.effectiveWorkspace }, input.resolveCronCreatorToolAuthority);
-	toolBuildStages.mark("create-openclaw-coding-tools");
-	const preNormalizationDiagnostics = [];
-	const readableAllToolProjection = filterProviderNormalizableTools(allTools);
-	preNormalizationDiagnostics.push(...readableAllToolProjection.diagnostics);
-	const readableAllTools = [...readableAllToolProjection.tools];
-	const normallyProfiledTools = filterCodexDynamicTools(readableAllTools, input.pluginConfig, { disabledNativeSurface: input.nativeToolSurfaceEnabled === false ? { preserveShell: !isCodexMemoryFlushRun(params) && input.sandbox?.enabled !== true && nativeExecutionPolicy.effectiveExecHost !== "node" } : void 0 });
-	const systemAgentTool = (input.isHostScopedToolActive?.("openclaw") ?? isHostScopedAgentToolActive("openclaw")) && isSystemAgentOnlyCodexDynamicToolAllowlist(params.toolsAllow) && readableAllTools.find((tool) => tool.name === "openclaw" && tool.catalogMode === "direct-only");
-	const profileFilteredTools = systemAgentTool ? [systemAgentTool, ...normallyProfiledTools.filter((tool) => tool.name !== "openclaw")] : normallyProfiledTools;
-	const codexFilteredTools = await addShellDynamicTools(isCodexMemoryFlushRun(params) ? readableAllTools.filter((tool) => CODEX_MEMORY_FLUSH_DYNAMIC_TOOL_ALLOW.has(normalizeCodexDynamicToolName(tool.name))) : profileFilteredTools, readableAllTools, input, nativeExecutionPolicy);
-	toolBuildStages.mark("codex-filtering");
-	const visionFilteredTools = filterCodexVisionTools(codexFilteredTools, {
-		modelHasVision,
-		nativeImageInspectionEnabled: input.nativeToolSurfaceEnabled === true
-	});
-	toolBuildStages.mark("vision-filtering");
-	const webSearchPresent = visionFilteredTools.some((tool) => tool.name === "web_search");
-	const persistentCodexWebSearchSurface = params.config?.tools?.web?.search?.enabled !== false && !isCodexDynamicToolExcluded(input.pluginConfig, ["web_search"]);
-	const persistentHostedWebSearchEligible = resolveCodexWebSearchPlan({
-		config: params.config,
-		nativeProviderWebSearchSupport: input.nativeProviderWebSearchSupport
-	}).kind === "native-hosted";
-	let nativeWebSearchAllowed = false;
-	let persistentWebSearchAllowed = webSearchPresent;
-	if ((input.onPersistentWebSearchPolicyResolved || webSearchPlan.kind === "native-hosted" && (input.onWebSearchPolicyResolved || webSearchPlan.webFetchHostnameAllowlist)) && !webSearchPresent && persistentCodexWebSearchSurface) {
-		const webSearchPolicy = (await import("openclaw/plugin-sdk/agent-harness")).resolveWebSearchToolPolicy({
-			config: params.config,
-			modelProvider: params.model.provider,
-			modelId: params.modelId,
-			agentId: input.policyAgentId,
-			sessionKey: input.sandboxSessionKey,
-			sessionId: params.sessionId,
-			...persistentHostedWebSearchEligible ? { runtimeToolAllowlist: toolRunContext.runtimeToolAllowlist } : {},
-			sandboxToolPolicy: input.sandbox?.tools,
+			requireWorkspaceOnly: params.requireWorkspaceOnly,
+			...toolConstructionPlan ? { toolConstructionPlan } : {},
 			messageProvider: messageToolProvider,
-			agentAccountId: params.agentAccountId,
-			groupId: params.groupId,
-			groupChannel: params.groupChannel,
-			groupSpace: params.groupSpace,
-			spawnedBy: params.spawnedBy,
-			senderId: params.senderId,
-			senderName: params.senderName,
-			senderUsername: params.senderUsername,
-			senderE164: params.senderE164,
+			toolPolicyMessageProvider: params.messageProvider ?? params.messageChannel,
+			...params.onToolResult ? { questionPrompt: {
+				send: params.onToolResult,
+				messageChannel: messageToolProvider
+			} } : {},
 			inputProvenance: params.inputProvenance,
 			trustedInternalHandoff: params.trustedInternalHandoff,
-			scheduledToolPolicy: params.scheduledToolPolicy
+			allowGatewaySubagentBinding: params.allowGatewaySubagentBinding || isForcedPrivateQaCodexRuntime(),
+			sessionKey: input.sandboxSessionKey,
+			runSessionKey: params.sessionKey && params.sessionKey !== input.sandboxSessionKey ? params.sessionKey : void 0,
+			sessionId: params.sessionId,
+			runId: params.runId,
+			memoryAudience: params.memoryAudience,
+			agentDir,
+			preparedModelRuntime: params.preparedModelRuntime,
+			cwd: input.effectiveCwd ?? input.effectiveWorkspace,
+			workspaceDir: input.effectiveWorkspace,
+			spawnWorkspaceDir: input.effectiveCwd && input.effectiveCwd !== input.effectiveWorkspace ? input.resolvedWorkspace : resolveAttemptSpawnWorkspaceDir({
+				sandbox: input.sandbox,
+				resolvedWorkspace: input.resolvedWorkspace
+			}),
+			config: params.config,
+			skillsSnapshot: params.skillsSnapshot,
+			...params.skillLibraryAuthoring ? { skillWorkshop: { libraryAuthoring: params.skillLibraryAuthoring } } : {},
+			authProfileStore: params.toolAuthProfileStore ?? params.authProfileStore,
+			abortSignal: input.runAbortController.signal,
+			emitBeforeToolCallDiagnostics: false,
+			modelProvider: params.model.provider,
+			modelId: params.modelId,
+			modelCompat: params.model.compat && typeof params.model.compat === "object" ? params.model.compat : void 0,
+			modelApi: params.model.api,
+			modelContextWindowTokens: params.model.contextWindow,
+			delegationCapability: params.delegationCapability,
+			modelAuthMode: await resolveModelAuthModeAsync(params.model.provider, params.config, params.toolAuthProfileStore ?? params.authProfileStore, { workspaceDir: input.effectiveWorkspace }),
+			suppressManagedWebSearch: false,
+			webFetchHostnameAllowlistRef,
+			hookChannelId: resolveCodexAppServerHookChannelId(params, input.sandboxSessionKey),
+			modelHasVision,
+			computerContextEpoch: input.computerContextEpoch,
+			oneShotCliRun: params.oneShotCliRun,
+			registerRunCleanup: input.registerRunCleanup,
+			requireExplicitMessageTarget: params.requireExplicitMessageTarget ?? isSubagentSessionKey(params.sessionKey),
+			disableMessageTool: input.ignoreDisableMessageTool ? false : params.disableMessageTool,
+			forceMessageTool: shouldForceMessageTool(messagePolicyParams),
+			enableHeartbeatTool: params.trigger === "heartbeat" || input.forceHeartbeatTool === true,
+			forceHeartbeatTool: params.trigger === "heartbeat" || input.forceHeartbeatTool === true,
+			onYield: (message, acknowledgment) => {
+				input.onYieldDetected(message, acknowledgment);
+				input.onCodexAppServerEvent?.({
+					stream: "codex_app_server.tool",
+					data: {
+						name: "sessions_yield",
+						message
+					}
+				});
+			},
+			claimYieldCompletion: input.claimYieldCompletion,
+			recordToolPrepStage: (name) => {
+				toolBuildStages.mark(name);
+			},
+			onToolOutcome: params.onToolOutcome,
+			isTurnTainted: params.isTurnTainted,
+			allocateToolOutcomeOrdinal: params.allocateToolOutcomeOrdinal,
+			cronCreatorToolAllowlistRef: input.cronCreatorToolAllowlistRef,
+			cronCreatorToolAllowlistCaptureRef: input.cronCreatorToolAllowlistCaptureRef,
+			cronCreatorAuthorityUnavailableReason: input.cronCreatorAuthorityUnavailableReason
+		};
+		input.onMessageToolTargetResolved?.(options.requireExplicitMessageTarget === true);
+		const allTools = await createCodexHostToolSurface(params, options, { cwd: input.effectiveCwd ?? input.effectiveWorkspace }, input.resolveCronCreatorToolAuthority);
+		toolBuildStages.mark("create-openclaw-coding-tools");
+		const preNormalizationDiagnostics = [];
+		const readableAllToolProjection = filterProviderNormalizableTools(allTools);
+		preNormalizationDiagnostics.push(...readableAllToolProjection.diagnostics);
+		const readableAllTools = [...readableAllToolProjection.tools];
+		const normallyProfiledTools = filterCodexDynamicTools(readableAllTools, input.pluginConfig, { disabledNativeSurface: input.nativeToolSurfaceEnabled === false ? { preserveShell: !isCodexMemoryFlushRun(params) && input.sandbox?.enabled !== true && nativeExecutionPolicy.effectiveExecHost !== "node" } : void 0 });
+		const systemAgentTool = (input.isHostScopedToolActive?.("openclaw") ?? isHostScopedAgentToolActive("openclaw")) && isSystemAgentOnlyCodexDynamicToolAllowlist(params.toolsAllow) && readableAllTools.find((tool) => tool.name === "openclaw" && tool.catalogMode === "direct-only");
+		const profileFilteredTools = systemAgentTool ? [systemAgentTool, ...normallyProfiledTools.filter((tool) => tool.name !== "openclaw")] : normallyProfiledTools;
+		const codexFilteredTools = await addShellDynamicTools(isCodexMemoryFlushRun(params) ? readableAllTools.filter((tool) => CODEX_MEMORY_FLUSH_DYNAMIC_TOOL_ALLOW.has(normalizeCodexDynamicToolName(tool.name))) : profileFilteredTools, readableAllTools, input, nativeExecutionPolicy);
+		toolBuildStages.mark("codex-filtering");
+		const visionFilteredTools = filterCodexVisionTools(codexFilteredTools, {
+			modelHasVision,
+			nativeImageInspectionEnabled: input.nativeToolSurfaceEnabled === true
 		});
-		persistentWebSearchAllowed = webSearchPolicy.persistentAllowed && (persistentHostedWebSearchEligible || !webSearchPolicy.allowed || isCodexMemoryFlushRun(params));
-		nativeWebSearchAllowed = webSearchPlan.kind === "native-hosted" && webSearchPolicy.allowed && !isCodexMemoryFlushRun(params);
-	}
-	input.onPersistentWebSearchPolicyResolved?.(persistentWebSearchAllowed);
-	const filteredTools = applyEmbeddedAttemptToolsAllow(visionFilteredTools, toolRunContext.runtimeToolAllowlist, {
-		toolMeta: getPluginToolMeta,
-		toolAliases: (tool) => {
-			const normalized = normalizeCodexDynamicToolName(tool.name);
-			return normalized === "sandbox_exec" || normalized === "gateway_exec" || normalized === "node_exec" ? ["exec"] : normalized === "sandbox_process" || normalized === "gateway_process" ? ["exec", "process"] : [];
+		toolBuildStages.mark("vision-filtering");
+		const webSearchPresent = visionFilteredTools.some((tool) => tool.name === "web_search");
+		const persistentCodexWebSearchSurface = params.config?.tools?.web?.search?.enabled !== false && !isCodexDynamicToolExcluded(input.pluginConfig, ["web_search"]);
+		const persistentHostedWebSearchEligible = resolveCodexWebSearchPlan({
+			config: params.config,
+			nativeProviderWebSearchSupport: input.nativeProviderWebSearchSupport
+		}).kind === "native-hosted";
+		let nativeWebSearchAllowed = false;
+		let persistentWebSearchAllowed = webSearchPresent;
+		if ((input.onPersistentWebSearchPolicyResolved || webSearchPlan.kind === "native-hosted" && (input.onWebSearchPolicyResolved || webSearchPlan.webFetchHostnameAllowlist)) && !webSearchPresent && persistentCodexWebSearchSurface) {
+			const webSearchPolicy = (await import("openclaw/plugin-sdk/agent-harness")).resolveWebSearchToolPolicy({
+				config: params.config,
+				modelProvider: params.model.provider,
+				modelId: params.modelId,
+				agentId: input.policyAgentId,
+				sessionKey: input.sandboxSessionKey,
+				sessionId: params.sessionId,
+				...persistentHostedWebSearchEligible ? { runtimeToolAllowlist: toolRunContext.runtimeToolAllowlist } : {},
+				sandboxToolPolicy: input.sandbox?.tools,
+				messageProvider: messageToolProvider,
+				agentAccountId: params.agentAccountId,
+				groupId: params.groupId,
+				groupChannel: params.groupChannel,
+				groupSpace: params.groupSpace,
+				spawnedBy: params.spawnedBy,
+				senderId: params.senderId,
+				senderName: params.senderName,
+				senderUsername: params.senderUsername,
+				senderE164: params.senderE164,
+				inputProvenance: params.inputProvenance,
+				trustedInternalHandoff: params.trustedInternalHandoff,
+				scheduledToolPolicy: params.scheduledToolPolicy
+			});
+			persistentWebSearchAllowed = webSearchPolicy.persistentAllowed && (persistentHostedWebSearchEligible || !webSearchPolicy.allowed || isCodexMemoryFlushRun(params));
+			nativeWebSearchAllowed = webSearchPlan.kind === "native-hosted" && webSearchPolicy.allowed && !isCodexMemoryFlushRun(params);
 		}
-	});
-	toolBuildStages.mark("allowlist-filter");
-	const normalizedTools = normalizeAgentRuntimeTools({
-		runtimePlan: input.ignoreRuntimePlan ? void 0 : params.runtimePlan,
-		tools: filteredTools,
-		provider: params.provider,
-		config: params.config,
-		workspaceDir: input.effectiveWorkspace,
-		env: process.env,
-		modelId: params.modelId,
-		modelApi: params.model.api,
-		model: params.model,
-		allowProviderRuntimePluginLoad: input.ignoreRuntimePlan ? false : void 0,
-		onPreNormalizationSchemaDiagnostics: (diagnostics) => preNormalizationDiagnostics.push(...diagnostics)
-	});
-	toolBuildStages.mark("runtime-normalization");
-	const webSearchAllowed = nativeWebSearchAllowed || normalizedTools.some((tool) => tool.name === "web_search");
-	webFetchHostnameAllowlistRef.value = webSearchAllowed ? webSearchPlan.webFetchHostnameAllowlist : void 0;
-	input.onWebSearchPolicyResolved?.(webSearchAllowed);
-	const webSearchFilteredTools = webSearchPlan.suppressManagedWebSearch ? normalizedTools.filter((tool) => tool.name !== "web_search") : normalizedTools;
-	const exposedTools = placeDisabledNativeShellToolsInDirectNamespace(webSearchFilteredTools, input.nativeToolSurfaceEnabled);
-	if (preNormalizationDiagnostics.length > 0) embeddedAgentLog.warn(`codex app-server quarantined ${preNormalizationDiagnostics.length} unsupported runtime tool schema${preNormalizationDiagnostics.length === 1 ? "" : "s"} before dynamic tool registration`, {
-		runId: params.runId,
-		sessionId: params.sessionId,
-		diagnostics: preNormalizationDiagnostics.map((diagnostic) => ({
-			index: diagnostic.toolIndex,
-			tool: diagnostic.toolName,
-			violations: diagnostic.violations.slice(0, 12),
-			violationCount: diagnostic.violations.length
-		}))
-	});
-	const summary = toolBuildStages.snapshot();
-	if (shouldWarnCodexDynamicToolBuildStageSummary(summary, input.profilerEnabled)) {
-		const phase = input.forceHeartbeatTool ? "registered-tools" : "runtime-tools";
-		embeddedAgentLog.warn(`codex app-server dynamic tool build timings runId=${params.runId} sessionId=${params.sessionId} phase=${phase} totalMs=${summary.totalMs} stages=${formatStageTimings(summary.stages)}`, {
+		input.onPersistentWebSearchPolicyResolved?.(persistentWebSearchAllowed);
+		const filteredTools = applyEmbeddedAttemptToolsAllow(visionFilteredTools, toolRunContext.runtimeToolAllowlist, {
+			toolMeta: getPluginToolMeta,
+			toolAliases: (tool) => {
+				const normalized = normalizeCodexDynamicToolName(tool.name);
+				return normalized === "sandbox_exec" || normalized === "gateway_exec" || normalized === "node_exec" ? ["exec"] : normalized === "sandbox_process" || normalized === "gateway_process" ? ["exec", "process"] : [];
+			}
+		});
+		toolBuildStages.mark("allowlist-filter");
+		const normalizedTools = normalizeAgentRuntimeTools({
+			runtimePlan: input.ignoreRuntimePlan ? void 0 : params.runtimePlan,
+			tools: filteredTools,
+			provider: params.provider,
+			config: params.config,
+			workspaceDir: input.effectiveWorkspace,
+			env: process.env,
+			modelId: params.modelId,
+			modelApi: params.model.api,
+			model: params.model,
+			allowProviderRuntimePluginLoad: input.ignoreRuntimePlan ? false : void 0,
+			onPreNormalizationSchemaDiagnostics: (diagnostics) => preNormalizationDiagnostics.push(...diagnostics)
+		});
+		toolBuildStages.mark("runtime-normalization");
+		const webSearchAllowed = nativeWebSearchAllowed || normalizedTools.some((tool) => tool.name === "web_search");
+		webFetchHostnameAllowlistRef.value = webSearchAllowed ? webSearchPlan.webFetchHostnameAllowlist : void 0;
+		input.onWebSearchPolicyResolved?.(webSearchAllowed);
+		const webSearchFilteredTools = webSearchPlan.suppressManagedWebSearch ? normalizedTools.filter((tool) => tool.name !== "web_search") : normalizedTools;
+		const exposedTools = placeDisabledNativeShellToolsInDirectNamespace(webSearchFilteredTools, input.nativeToolSurfaceEnabled);
+		if (preNormalizationDiagnostics.length > 0) embeddedAgentLog.warn(`codex app-server quarantined ${preNormalizationDiagnostics.length} unsupported runtime tool schema${preNormalizationDiagnostics.length === 1 ? "" : "s"} before dynamic tool registration`, {
 			runId: params.runId,
 			sessionId: params.sessionId,
-			phase,
-			totalMs: summary.totalMs,
-			stages: summary.stages,
-			allToolCount: readableAllTools.length,
-			codexFilteredToolCount: codexFilteredTools.length,
-			visionFilteredToolCount: visionFilteredTools.length,
-			filteredToolCount: filteredTools.length,
-			normalizedToolCount: exposedTools.length,
-			forceHeartbeatTool: input.forceHeartbeatTool === true,
-			ignoreRuntimePlan: input.ignoreRuntimePlan === true,
-			nativeToolSurfaceEnabled: input.nativeToolSurfaceEnabled === true
+			diagnostics: preNormalizationDiagnostics.map((diagnostic) => ({
+				index: diagnostic.toolIndex,
+				tool: diagnostic.toolName,
+				violations: diagnostic.violations.slice(0, 12),
+				violationCount: diagnostic.violations.length
+			}))
 		});
+		const summary = toolBuildStages.snapshot();
+		if (shouldWarnCodexDynamicToolBuildStageSummary(summary, input.profilerEnabled)) {
+			const phase = input.forceHeartbeatTool ? "registered-tools" : "runtime-tools";
+			embeddedAgentLog.warn(`codex app-server dynamic tool build timings runId=${params.runId} sessionId=${params.sessionId} phase=${phase} totalMs=${summary.totalMs} stages=${formatStageTimings(summary.stages)}`, {
+				runId: params.runId,
+				sessionId: params.sessionId,
+				phase,
+				totalMs: summary.totalMs,
+				stages: summary.stages,
+				allToolCount: readableAllTools.length,
+				codexFilteredToolCount: codexFilteredTools.length,
+				visionFilteredToolCount: visionFilteredTools.length,
+				filteredToolCount: filteredTools.length,
+				normalizedToolCount: exposedTools.length,
+				forceHeartbeatTool: input.forceHeartbeatTool === true,
+				ignoreRuntimePlan: input.ignoreRuntimePlan === true,
+				nativeToolSurfaceEnabled: input.nativeToolSurfaceEnabled === true
+			});
+		}
+		return exposedTools;
+	} finally {
+		if (!input.nativeExecutionPolicy) preparedExecution.release();
 	}
-	return exposedTools;
 }
-function shouldEnableCodexAppServerNativeToolSurface(params, sandbox, options = {}) {
+function shouldEnableCodexAppServerNativeToolSurface(params, sandbox, options) {
 	if (isCodexResponsesOAuthRun(params) || params.requireWorkspaceOnly === true || params.pluginHarnessToolPolicyRestricted === true || isCodexMemoryFlushRun(params) || params.disableTools) return false;
-	if (!resolveCodexNativeExecutionPolicyForRun(params, {
-		agentId: options.agentId,
-		runtimeSessionKey: options.runtimeSessionKey,
-		sandbox
-	}).nativeToolSurfaceAllowed) return false;
+	if (!options.nativeExecutionPolicy.policy.nativeToolSurfaceAllowed) return false;
 	const toolsAllow = params.toolsAllow;
 	return (toolsAllow === void 0 || toolsAllow.some((name) => normalizeCodexDynamicToolName(name) === "*")) && canCodexAppServerNativeToolSurfaceHonorSandbox(sandbox, options);
 }
-function resolveCodexNativeExecutionPolicyForRun(params, options = {}) {
-	return resolveCodexNativeExecutionPolicy({
-		config: params.config,
-		sessionKey: options.runtimeSessionKey?.trim() || params.sandboxSessionKey?.trim() || params.sessionKey?.trim() || params.sessionId,
-		sessionId: params.sessionId,
-		agentId: options.agentId,
-		execOverrides: params.execOverrides,
-		sandboxAvailable: options.sandbox === null ? false : options.sandbox?.enabled,
-		readRuntimeSessionEntry: true
-	});
-}
 function canCodexAppServerNativeToolSurfaceHonorSandbox(sandbox, options = {}) {
 	if (!sandbox?.enabled) return true;
 	return options.sandboxExecServerEnabled === true && (sandbox.backend || isCodexRemoteExecPlacementSandbox(sandbox)) && CODEX_NATIVE_TOOL_REQUIREMENTS.every((toolName) => isToolAllowed(sandbox.tools, toolName));