@openclaw/codex 2026.5.16-beta.4 → 2026.5.16-beta.6

package/dist/{side-question-BYYJZq23.js → side-question-BzVnOoBU.js}

@@ -5,15 +5,19 @@ import { r as isCodexAppServerApprovalRequest } from "./client-6FkrXfaz.js";
 import { u as formatCodexUsageLimitErrorMessage } from "./command-formatters-BRW7_Nu7.js";
 import { i as getSharedCodexAppServerClient, s as refreshCodexAppServerAuthTokens } from "./shared-client-DlvmoLBJ.js";
 import { i as readCodexAppServerBinding } from "./session-binding-DqApZIgD.js";
-import { b as createCodexDynamicToolBridge, d as resolveReasoningEffort, n as buildCodexRuntimeThreadConfig, u as resolveCodexAppServerModelProvider, x as filterCodexDynamicTools } from "./thread-lifecycle-wcyYqwrl.js";
-import { n as handleCodexAppServerElicitationRequest, r as handleCodexAppServerApprovalRequest, t as filterToolsForVisionInputs } from "./vision-tools-Cm_YicZb.js";
+import { S as filterCodexDynamicTools, T as resolveCodexDynamicToolsLoading, b as createCodexDynamicToolBridge, d as resolveReasoningEffort, h as mergeCodexThreadConfigs, n as buildCodexRuntimeThreadConfig, u as resolveCodexAppServerModelProvider } from "./thread-lifecycle-Cc_ljZLZ.js";
+import { a as handleCodexAppServerElicitationRequest, i as buildCodexNativeHookRelayDisabledConfig, n as CODEX_NATIVE_HOOK_RELAY_EVENTS, o as handleCodexAppServerApprovalRequest, r as buildCodexNativeHookRelayConfig, t as filterToolsForVisionInputs } from "./vision-tools-BX9YuTEK.js";
 import { n as rememberCodexRateLimits, t as readRecentCodexRateLimits } from "./rate-limit-cache-dvhq-4pi.js";
-import { embeddedAgentLog, formatErrorMessage, resolveAgentDir, resolveAttemptSpawnWorkspaceDir, resolveModelAuthMode, resolveSandboxContext, resolveSessionAgentIds, supportsModelTools } from "openclaw/plugin-sdk/agent-harness-runtime";
+import { buildAgentHookContextChannelFields, embeddedAgentLog, formatErrorMessage, registerNativeHookRelay, resolveAgentDir, resolveAttemptSpawnWorkspaceDir, resolveModelAuthMode, resolveSandboxContext, resolveSessionAgentIds, supportsModelTools } from "openclaw/plugin-sdk/agent-harness-runtime";
 //#region extensions/codex/src/app-server/side-question.ts
 const CODEX_SIDE_DYNAMIC_TOOL_TIMEOUT_MS = 3e4;
 const CODEX_SIDE_DYNAMIC_TOOL_MAX_TIMEOUT_MS = 6e5;
 const CODEX_SIDE_DYNAMIC_IMAGE_TOOL_TIMEOUT_MS = 6e4;
 const SIDE_QUESTION_COMPLETION_TIMEOUT_MS = 6e5;
+const CODEX_SIDE_NATIVE_HOOK_RELAY_MIN_TTL_MS = 30 * 6e4;
+const CODEX_SIDE_NATIVE_HOOK_RELAY_TTL_GRACE_MS = 5 * 6e4;
+const CODEX_SIDE_NATIVE_HOOK_RELAY_STARTUP_REQUEST_COUNT = 3;
+const CODEX_SIDE_NATIVE_HOOK_RELAY_EVENTS_WITH_APP_SERVER_APPROVALS = CODEX_NATIVE_HOOK_RELAY_EVENTS.filter((event) => event !== "permission_request");
 const SIDE_BOUNDARY_PROMPT = `Side conversation boundary.
 
 Everything before this boundary is inherited history from the parent thread. It is reference context only. It is not your current task.
@@ -63,6 +67,7 @@ async function runCodexAppServerSideQuestion(params, options = {}) {
 	let childThreadId;
 	let turnId;
 	let removeRequestHandler;
+	let nativeHookRelay;
 	try {
 		const cwd = binding.cwd || params.workspaceDir || process.cwd();
 		const sideRunParams = buildSideRunAttemptParams(params, {
@@ -103,6 +108,7 @@ async function runCodexAppServerSideQuestion(params, options = {}) {
 				paramsForRun: sideRunParams,
 				threadId: childThreadId,
 				turnId,
+				nativeHookRelay,
 				signal: runAbortController.signal
 			});
 			if (request.method !== "item/tool/call") return;
@@ -122,6 +128,36 @@ async function runCodexAppServerSideQuestion(params, options = {}) {
 		const approvalPolicy = binding.approvalPolicy ?? appServer.approvalPolicy;
 		const sandbox = binding.sandbox ?? appServer.sandbox;
 		const serviceTier = binding.serviceTier ?? appServer.serviceTier;
+		const nativeHookRelayEvents = resolveCodexSideNativeHookRelayEvents({
+			configuredEvents: options.nativeHookRelay?.events,
+			approvalPolicy
+		});
+		nativeHookRelay = options.nativeHookRelay ? registerCodexSideNativeHookRelay({
+			options: options.nativeHookRelay,
+			events: nativeHookRelayEvents,
+			agentId: sessionAgentId,
+			sessionId: params.sessionId,
+			sessionKey: params.sessionKey,
+			config: params.cfg,
+			runId: sideRunParams.runId,
+			channelId: buildAgentHookContextChannelFields({
+				sessionKey: params.sessionKey,
+				messageChannel: params.messageChannel,
+				messageProvider: params.messageProvider,
+				currentChannelId: params.currentChannelId
+			}).channelId,
+			requestTimeoutMs: appServer.requestTimeoutMs,
+			completionTimeoutMs: Math.max(appServer.turnCompletionIdleTimeoutMs, SIDE_QUESTION_COMPLETION_TIMEOUT_MS),
+			signal: runAbortController.signal
+		}) : void 0;
+		const nativeHookRelayConfig = nativeHookRelay ? buildCodexNativeHookRelayConfig({
+			relay: nativeHookRelay,
+			events: nativeHookRelayEvents,
+			hookTimeoutSec: options.nativeHookRelay?.hookTimeoutSec,
+			clearOmittedEvents: true
+		}) : options.nativeHookRelay?.enabled === false ? buildCodexNativeHookRelayDisabledConfig() : void 0;
+		const runtimeThreadConfig = buildCodexRuntimeThreadConfig(void 0);
+		const threadConfig = mergeCodexThreadConfigs(nativeHookRelayConfig, runtimeThreadConfig) ?? runtimeThreadConfig;
 		const modelProvider = resolveCodexAppServerModelProvider({
 			provider: params.provider,
 			authProfileId,
@@ -137,7 +173,7 @@ async function runCodexAppServerSideQuestion(params, options = {}) {
 			approvalsReviewer: appServer.approvalsReviewer,
 			sandbox,
 			...serviceTier ? { serviceTier } : {},
-			config: buildCodexRuntimeThreadConfig(void 0),
+			config: threadConfig,
 			developerInstructions: SIDE_DEVELOPER_INSTRUCTIONS,
 			ephemeral: true,
 			threadSource: "user"
@@ -184,18 +220,51 @@ async function runCodexAppServerSideQuestion(params, options = {}) {
 		if (!trimmed) throw new Error("Codex /btw completed without an answer.");
 		return { text: trimmed };
 	} finally {
-		params.opts?.abortSignal?.removeEventListener("abort", abortFromUpstream);
-		if (!runAbortController.signal.aborted) runAbortController.abort("codex_side_question_finished");
-		removeNotificationHandler();
-		removeRequestHandler?.();
-		await cleanupCodexSideThread(client, {
-			threadId: childThreadId,
-			turnId,
-			interrupt: !collector.completed,
-			timeoutMs: appServer.requestTimeoutMs
-		});
+		try {
+			params.opts?.abortSignal?.removeEventListener("abort", abortFromUpstream);
+			if (!runAbortController.signal.aborted) runAbortController.abort("codex_side_question_finished");
+			removeNotificationHandler();
+			removeRequestHandler?.();
+			await cleanupCodexSideThread(client, {
+				threadId: childThreadId,
+				turnId,
+				interrupt: !collector.completed,
+				timeoutMs: appServer.requestTimeoutMs
+			});
+		} finally {
+			nativeHookRelay?.unregister();
+		}
 	}
 }
+function resolveCodexSideNativeHookRelayEvents(params) {
+	if (params.configuredEvents?.length) return params.configuredEvents;
+	return params.approvalPolicy === "never" ? CODEX_NATIVE_HOOK_RELAY_EVENTS : CODEX_SIDE_NATIVE_HOOK_RELAY_EVENTS_WITH_APP_SERVER_APPROVALS;
+}
+function registerCodexSideNativeHookRelay(params) {
+	if (params.options.enabled === false) return;
+	return registerNativeHookRelay({
+		provider: "codex",
+		...params.agentId ? { agentId: params.agentId } : {},
+		sessionId: params.sessionId,
+		...params.sessionKey ? { sessionKey: params.sessionKey } : {},
+		...params.config ? { config: params.config } : {},
+		runId: params.runId,
+		...params.channelId ? { channelId: params.channelId } : {},
+		allowedEvents: params.events,
+		ttlMs: resolveCodexSideNativeHookRelayTtlMs({
+			explicitTtlMs: params.options.ttlMs,
+			requestTimeoutMs: params.requestTimeoutMs,
+			completionTimeoutMs: params.completionTimeoutMs
+		}),
+		signal: params.signal,
+		command: { timeoutMs: params.options.gatewayTimeoutMs }
+	});
+}
+function resolveCodexSideNativeHookRelayTtlMs(params) {
+	if (params.explicitTtlMs !== void 0) return params.explicitTtlMs;
+	const relayBudgetMs = params.requestTimeoutMs * CODEX_SIDE_NATIVE_HOOK_RELAY_STARTUP_REQUEST_COUNT + params.completionTimeoutMs + CODEX_SIDE_NATIVE_HOOK_RELAY_TTL_GRACE_MS;
+	return Math.max(CODEX_SIDE_NATIVE_HOOK_RELAY_MIN_TTL_MS, Math.floor(relayBudgetMs));
+}
 function buildSideRunAttemptParams(params, options) {
 	return {
 		params,
@@ -211,6 +280,9 @@ function buildSideRunAttemptParams(params, options) {
 		sessionFile: params.sessionFile,
 		sessionKey: params.sessionKey,
 		agentId: params.agentId,
+		...params.messageChannel ? { messageChannel: params.messageChannel } : {},
+		...params.messageProvider ? { messageProvider: params.messageProvider } : {},
+		...params.currentChannelId ? { currentChannelId: params.currentChannelId } : {},
 		workspaceDir: options.cwd,
 		authProfileId: options.authProfileId,
 		authProfileIdSource: params.authProfileIdSource,
@@ -262,6 +334,14 @@ async function createCodexSideToolBridge(input) {
 			modelApi: runtimeModel.api,
 			modelContextWindowTokens: runtimeModel.contextWindow,
 			modelAuthMode: resolveModelAuthMode(runtimeModel.provider, input.params.cfg, void 0, { workspaceDir: input.cwd }),
+			...input.params.messageProvider || input.params.messageChannel ? { messageProvider: input.params.messageProvider ?? input.params.messageChannel } : {},
+			...input.params.currentChannelId ? { currentChannelId: input.params.currentChannelId } : {},
+			hookChannelId: buildAgentHookContextChannelFields({
+				sessionKey: input.params.sessionKey,
+				messageChannel: input.params.messageChannel,
+				messageProvider: input.params.messageProvider,
+				currentChannelId: input.params.currentChannelId
+			}).channelId,
 			sandbox,
 			modelHasVision: runtimeModel.input?.includes("image") ?? false,
 			requireExplicitMessageTarget: true
@@ -270,16 +350,23 @@ async function createCodexSideToolBridge(input) {
 			hasInboundImages: false
 		});
 	}
+	const hookChannelFields = buildAgentHookContextChannelFields({
+		sessionKey: input.params.sessionKey,
+		messageChannel: input.params.messageChannel,
+		messageProvider: input.params.messageProvider,
+		currentChannelId: input.params.currentChannelId
+	});
 	return createCodexDynamicToolBridge({
 		tools,
 		signal: input.signal,
-		loading: input.pluginConfig.codexDynamicToolsLoading ?? "searchable",
+		loading: resolveCodexDynamicToolsLoading(input.pluginConfig),
 		hookContext: {
 			agentId: input.sessionAgentId,
 			config: input.params.cfg,
 			sessionId: input.params.sessionId,
 			sessionKey: input.params.sessionKey,
-			runId: input.params.opts?.runId ?? `codex-btw:${input.params.sessionId}`
+			runId: input.params.opts?.runId ?? `codex-btw:${input.params.sessionId}`,
+			...hookChannelFields
 		}
 	});
 }

package/dist/test-api.js

@@ -1,5 +1,5 @@
 import { c as resolveCodexAppServerRuntimeOptions } from "./config-B5pq6hEz.js";
-import { a as buildThreadResumeParams, b as createCodexDynamicToolBridge, i as buildDeveloperInstructions, o as buildThreadStartParams, s as buildTurnStartParams, x as filterCodexDynamicTools } from "./thread-lifecycle-wcyYqwrl.js";
+import { S as filterCodexDynamicTools, a as buildThreadResumeParams, b as createCodexDynamicToolBridge, i as buildDeveloperInstructions, o as buildThreadStartParams, s as buildTurnStartParams } from "./thread-lifecycle-Cc_ljZLZ.js";
 //#region extensions/codex/test-api.ts
 function resolveCodexPromptSnapshotAppServerOptions(pluginConfig) {
 	return resolveCodexAppServerRuntimeOptions({

package/dist/{thread-lifecycle-wcyYqwrl.js → thread-lifecycle-Cc_ljZLZ.js}

@@ -8,6 +8,7 @@ import { i as readCodexAppServerBinding, n as isCodexAppServerNativeAuthProfile,
 import { a as defaultCodexAppInventoryCache, r as readCodexPluginInventory, t as ensureCodexPluginActivation } from "./plugin-activation-B49xb7pI.js";
 import crypto from "node:crypto";
 import { HEARTBEAT_RESPONSE_TOOL_NAME, createAgentToolResultMiddlewareRunner, createCodexAppServerToolResultExtensionRunner, embeddedAgentLog, extractToolResultMediaArtifact, filterToolResultMediaUrls, isActiveHarnessContextEngine, isMessagingTool, isMessagingToolSendAction, isToolWrappedWithBeforeToolCallHook, normalizeHeartbeatToolResponse, runAgentHarnessAfterToolCallHook, wrapToolWithBeforeToolCallHook } from "openclaw/plugin-sdk/agent-harness-runtime";
+import { normalizeAgentId } from "openclaw/plugin-sdk/routing";
 import { buildCodexUserMcpServersThreadConfigPatch } from "openclaw/plugin-sdk/codex-mcp-projection";
 import { redactSensitiveFieldValue, redactToolPayloadText } from "openclaw/plugin-sdk/logging-core";
 //#region extensions/codex/src/app-server/dynamic-tool-profile.ts
@@ -32,9 +33,15 @@ function normalizeCodexDynamicToolName(name) {
 	const normalized = name.trim().toLowerCase();
 	return DYNAMIC_TOOL_NAME_ALIASES[normalized] ?? normalized;
 }
-function filterCodexDynamicTools(tools, config) {
+function isForcedPrivateQaCodexRuntime(env = process.env) {
+	return env.OPENCLAW_BUILD_PRIVATE_QA === "1" && env.OPENCLAW_QA_FORCE_RUNTIME?.trim().toLowerCase() === "codex";
+}
+function resolveCodexDynamicToolsLoading(config, env = process.env) {
+	return isForcedPrivateQaCodexRuntime(env) ? "direct" : config.codexDynamicToolsLoading ?? "searchable";
+}
+function filterCodexDynamicTools(tools, config, env = process.env) {
 	const excludes = /* @__PURE__ */ new Set();
-	for (const name of CODEX_APP_SERVER_OWNED_DYNAMIC_TOOL_EXCLUDES) excludes.add(name);
+	if (!isForcedPrivateQaCodexRuntime(env)) for (const name of CODEX_APP_SERVER_OWNED_DYNAMIC_TOOL_EXCLUDES) excludes.add(name);
 	for (const name of config.codexDynamicToolsExclude ?? []) {
 		const trimmed = normalizeCodexDynamicToolName(name);
 		if (trimmed) excludes.add(trimmed);
@@ -42,11 +49,113 @@ function filterCodexDynamicTools(tools, config) {
 	return excludes.size === 0 ? tools : tools.filter((tool) => !excludes.has(normalizeCodexDynamicToolName(tool.name)));
 }
 //#endregion
+//#region extensions/codex/src/app-server/image-payload-sanitizer.ts
+const DATA_URL_PREFIX = "data:";
+const IMAGE_OMITTED_TEXT = "omitted image payload: invalid inline image data";
+function startsWithDataUrl(value) {
+	return value.slice(0, 5).toLowerCase() === DATA_URL_PREFIX;
+}
+function canonicalizeBase64(base64) {
+	let cleaned = "";
+	let padding = 0;
+	let sawPadding = false;
+	for (let i = 0; i < base64.length; i += 1) {
+		const code = base64.charCodeAt(i);
+		if (code <= 32) continue;
+		if (code === 61) {
+			padding += 1;
+			if (padding > 2) return;
+			sawPadding = true;
+			cleaned += "=";
+			continue;
+		}
+		if (sawPadding || !(code >= 65 && code <= 90 || code >= 97 && code <= 122 || code >= 48 && code <= 57 || code === 43 || code === 47)) return;
+		cleaned += base64[i];
+	}
+	if (!cleaned || cleaned.length % 4 !== 0) return;
+	return cleaned;
+}
+function sniffImageMime(buffer) {
+	if (buffer.length >= 8 && buffer[0] === 137 && buffer[1] === 80 && buffer[2] === 78 && buffer[3] === 71 && buffer[4] === 13 && buffer[5] === 10 && buffer[6] === 26 && buffer[7] === 10) return "image/png";
+	if (buffer.length >= 3 && buffer[0] === 255 && buffer[1] === 216 && buffer[2] === 255) return "image/jpeg";
+	if (buffer.length >= 12 && buffer.subarray(0, 4).toString("ascii") === "RIFF" && buffer.subarray(8, 12).toString("ascii") === "WEBP") return "image/webp";
+	if (buffer.length >= 6 && (buffer.subarray(0, 6).toString("ascii") === "GIF87a" || buffer.subarray(0, 6).toString("ascii") === "GIF89a")) return "image/gif";
+}
+function sanitizeInlineImageDataUrl(imageUrl) {
+	if (!startsWithDataUrl(imageUrl)) return imageUrl;
+	const commaIndex = imageUrl.indexOf(",");
+	if (commaIndex < 0) return;
+	const metadata = imageUrl.slice(5, commaIndex);
+	const payload = imageUrl.slice(commaIndex + 1);
+	const metadataParts = metadata.split(";").map((part) => part.trim());
+	if (!(metadataParts[0]?.toLowerCase())?.startsWith("image/")) return;
+	if (!metadataParts.slice(1).some((part) => part.toLowerCase() === "base64")) return;
+	const canonicalPayload = canonicalizeBase64(payload);
+	if (!canonicalPayload) return;
+	const sniffedMimeType = sniffImageMime(Buffer.from(canonicalPayload, "base64"));
+	if (!sniffedMimeType) return;
+	return `data:${sniffedMimeType};base64,${canonicalPayload}`;
+}
+function invalidInlineImageText(label) {
+	return `[${label}] ${IMAGE_OMITTED_TEXT}`;
+}
+function isRecord$1(value) {
+	return Boolean(value && typeof value === "object" && !Array.isArray(value));
+}
+function sanitizeImageContentRecord(record, label) {
+	if (record.type === "image" && typeof record.data === "string") {
+		const mimeType = typeof record.mimeType === "string" ? record.mimeType : "image/png";
+		const imageUrl = sanitizeInlineImageDataUrl(`data:${mimeType};base64,${record.data}`);
+		if (!imageUrl) return {
+			type: "text",
+			text: invalidInlineImageText(label)
+		};
+		const commaIndex = imageUrl.indexOf(",");
+		const mime = imageUrl.slice(5, commaIndex).split(";")[0] ?? mimeType;
+		return {
+			...record,
+			mimeType: mime,
+			data: imageUrl.slice(commaIndex + 1)
+		};
+	}
+	if (record.type === "inputImage" && typeof record.imageUrl === "string") {
+		const imageUrl = sanitizeInlineImageDataUrl(record.imageUrl);
+		return imageUrl ? {
+			...record,
+			imageUrl
+		} : {
+			type: "inputText",
+			text: invalidInlineImageText(label)
+		};
+	}
+	if (record.type === "input_image" && typeof record.image_url === "string") {
+		const imageUrl = sanitizeInlineImageDataUrl(record.image_url);
+		return imageUrl ? {
+			...record,
+			image_url: imageUrl
+		} : {
+			type: "input_text",
+			text: invalidInlineImageText(label)
+		};
+	}
+}
+function sanitizeCodexHistoryImagePayloads(value, label) {
+	if (Array.isArray(value)) return value.map((entry) => sanitizeCodexHistoryImagePayloads(entry, label));
+	if (!isRecord$1(value)) return value;
+	const imageRecord = sanitizeImageContentRecord(value, label);
+	if (imageRecord) return imageRecord;
+	const next = {};
+	for (const [key, child] of Object.entries(value)) next[key] = sanitizeCodexHistoryImagePayloads(child, label);
+	return next;
+}
+//#endregion
 //#region extensions/codex/src/app-server/dynamic-tools.ts
 const CODEX_OPENCLAW_DYNAMIC_TOOL_NAMESPACE = "openclaw";
 const ALWAYS_DIRECT_DYNAMIC_TOOL_NAMES = new Set(["sessions_yield"]);
+const DEFAULT_CODEX_DYNAMIC_TOOL_RESULT_MAX_CHARS = 16e3;
 function createCodexDynamicToolBridge(params) {
 	const toolResultHookContext = toToolResultHookContext(params.hookContext);
+	const toolResultMaxChars = resolveCodexDynamicToolResultMaxChars(params.hookContext);
 	const tools = params.tools.map((tool) => isToolWrappedWithBeforeToolCallHook(tool) ? tool : wrapToolWithBeforeToolCallHook(tool, params.hookContext));
 	const toolMap = new Map(tools.map((tool) => [tool.name, tool]));
 	const telemetry = {
@@ -120,12 +229,13 @@ function createCodexDynamicToolBridge(params) {
 					agentId: toolResultHookContext.agentId,
 					sessionId: toolResultHookContext.sessionId,
 					sessionKey: toolResultHookContext.sessionKey,
+					channelId: toolResultHookContext.channelId,
 					startArgs: args,
 					result,
 					startedAt
 				});
 				return {
-					contentItems: result.content.flatMap(convertToolContent),
+					contentItems: convertToolContents(result.content, toolResultMaxChars),
 					success: !resultIsError
 				};
 			} catch (error) {
@@ -143,6 +253,7 @@ function createCodexDynamicToolBridge(params) {
 					agentId: toolResultHookContext.agentId,
 					sessionId: toolResultHookContext.sessionId,
 					sessionKey: toolResultHookContext.sessionKey,
+					channelId: toolResultHookContext.channelId,
 					startArgs: args,
 					error: error instanceof Error ? error.message : String(error),
 					startedAt
@@ -172,14 +283,34 @@ function createCodexDynamicToolSpec(params) {
 	};
 }
 function toToolResultHookContext(ctx) {
-	const { agentId, sessionId, sessionKey, runId } = ctx ?? {};
+	const { agentId, sessionId, sessionKey, runId, channelId } = ctx ?? {};
 	return {
 		...agentId && { agentId },
 		...sessionId && { sessionId },
 		...sessionKey && { sessionKey },
-		...runId && { runId }
+		...runId && { runId },
+		...channelId && { channelId }
 	};
 }
+function resolveCodexDynamicToolResultMaxChars(ctx) {
+	return resolveAgentContextLimitValue({
+		config: ctx?.config,
+		agentId: ctx?.agentId,
+		key: "toolResultMaxChars"
+	}) ?? DEFAULT_CODEX_DYNAMIC_TOOL_RESULT_MAX_CHARS;
+}
+function resolveAgentContextLimitValue(params) {
+	const agents = readRecord(params.config?.agents);
+	const defaultValue = readPositiveInteger(readRecord(readRecord(agents?.defaults)?.contextLimits)?.[params.key]);
+	if (!params.agentId) return defaultValue;
+	const list = agents?.list;
+	if (!Array.isArray(list)) return defaultValue;
+	const normalizedAgentId = normalizeAgentId(params.agentId);
+	return readPositiveInteger(readRecord(readRecord(list.find((entry) => {
+		const entryId = readRecord(entry)?.id;
+		return typeof entryId === "string" && normalizeAgentId(entryId) === normalizedAgentId;
+	}))?.contextLimits)?.[params.key]) ?? defaultValue;
+}
 function composeAbortSignals(...signals) {
 	const activeSignals = signals.filter((signal) => Boolean(signal));
 	if (activeSignals.length === 0) return new AbortController().signal;
@@ -261,6 +392,13 @@ function extractInternalSourceReplyPayload(details) {
 function isRecord(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value);
 }
+function readRecord(value) {
+	return isRecord(value) ? value : void 0;
+}
+function readPositiveInteger(value) {
+	if (typeof value !== "number" || !Number.isFinite(value) || value <= 0) return;
+	return Math.floor(value);
+}
 function isToolResultError(result) {
 	const details = result.details;
 	if (!isRecord(details)) return false;
@@ -270,14 +408,66 @@ function isToolResultError(result) {
 	const status = details.status.trim().toLowerCase();
 	return status !== "" && status !== "0" && status !== "ok" && status !== "success" && status !== "completed" && status !== "recorded" && status !== "running";
 }
+function normalizeToolResultMaxChars(maxChars) {
+	return typeof maxChars === "number" && Number.isFinite(maxChars) && maxChars > 0 ? Math.floor(maxChars) : DEFAULT_CODEX_DYNAMIC_TOOL_RESULT_MAX_CHARS;
+}
+function convertToolContents(content, toolResultMaxChars = DEFAULT_CODEX_DYNAMIC_TOOL_RESULT_MAX_CHARS) {
+	const maxChars = normalizeToolResultMaxChars(toolResultMaxChars);
+	const totalTextChars = content.reduce((total, item) => total + (item.type === "text" ? item.text.length : 0), 0);
+	if (totalTextChars <= maxChars) return content.flatMap(convertToolContent);
+	const noticeText = `...(OpenClaw truncated dynamic tool result: original ${totalTextChars} chars, showing ${maxChars}; rerun with narrower args.)`;
+	const notice = `\n${noticeText}`;
+	let remainingTextBudget = Math.max(0, maxChars - notice.length);
+	let appendedNotice = false;
+	const output = [];
+	for (const item of content) {
+		if (item.type !== "text") {
+			output.push(...convertToolContent(item));
+			continue;
+		}
+		if (appendedNotice) continue;
+		if (notice.length >= maxChars) {
+			output.push({
+				type: "inputText",
+				text: noticeText.slice(0, maxChars)
+			});
+			appendedNotice = true;
+			continue;
+		}
+		const sliceLength = Math.min(item.text.length, remainingTextBudget);
+		remainingTextBudget -= sliceLength;
+		const shouldAppendNotice = remainingTextBudget <= 0;
+		const text = item.text.slice(0, sliceLength);
+		if (shouldAppendNotice) {
+			output.push({
+				type: "inputText",
+				text: `${text.trimEnd()}${notice}`.slice(0, maxChars)
+			});
+			appendedNotice = true;
+		} else if (text.length > 0) output.push({
+			type: "inputText",
+			text
+		});
+	}
+	if (!appendedNotice) output.push({
+		type: "inputText",
+		text: noticeText.slice(0, maxChars)
+	});
+	return output;
+}
 function convertToolContent(content) {
 	if (content.type === "text") return [{
 		type: "inputText",
 		text: content.text
 	}];
+	const imageUrl = sanitizeInlineImageDataUrl(`data:${content.mimeType};base64,${content.data}`);
+	if (!imageUrl) return [{
+		type: "inputText",
+		text: invalidInlineImageText("codex dynamic tool")
+	}];
 	return [{
 		type: "inputImage",
-		imageUrl: `data:${content.mimeType};base64,${content.data}`
+		imageUrl
 	}];
 }
 function toJsonValue(value) {
@@ -379,7 +569,7 @@ function projectContextEngineAssemblyForCodex(params) {
 		CONTEXT_SAFETY_NOTE,
 		"",
 		CONTEXT_OPEN,
-		truncateText(renderedContext, maxRenderedContextChars),
+		truncateOlderContext(renderedContext, maxRenderedContextChars),
 		CONTEXT_CLOSE,
 		"",
 		REQUEST_HEADER,
@@ -549,6 +739,17 @@ function resolveTextPartMaxChars(maxRenderedContextChars) {
 function truncateText(text, maxChars) {
 	return text.length > maxChars ? `${text.slice(0, maxChars)}\n[truncated ${text.length - maxChars} chars]` : text;
 }
+function truncateOlderContext(text, maxChars) {
+	if (text.length <= maxChars) return text;
+	if (maxChars <= 0) return "";
+	const buildMarker = (omittedChars) => `[truncated ${omittedChars} chars from older context]\n`;
+	let marker = buildMarker(text.length - maxChars);
+	let tailChars = Math.max(0, maxChars - marker.length);
+	marker = buildMarker(text.length - tailChars);
+	if (marker.length >= maxChars) return marker.slice(0, maxChars);
+	tailChars = maxChars - marker.length;
+	return `${marker}${text.slice(text.length - tailChars).trimStart()}`;
+}
 //#endregion
 //#region extensions/codex/src/app-server/plugin-thread-config.ts
 const CODEX_PLUGIN_THREAD_CONFIG_INPUT_FINGERPRINT_VERSION = 1;
@@ -787,11 +988,15 @@ const CODEX_CODE_MODE_THREAD_CONFIG = {
 	"features.code_mode": true,
 	"features.code_mode_only": true
 };
+const CODEX_CODE_MODE_DISABLED_THREAD_CONFIG = {
+	"features.code_mode": false,
+	"features.code_mode_only": false
+};
 const CODEX_LIGHTWEIGHT_CONTEXT_THREAD_CONFIG = { project_doc_max_bytes: 0 };
 async function startOrResumeThread(params) {
 	const dynamicToolsFingerprint = fingerprintDynamicTools(params.dynamicTools);
 	const contextEngineBinding = buildContextEngineBinding(params.params, params.contextEngineProjection);
-	const userMcpServersConfigPatch = buildCodexUserMcpServersThreadConfigPatch(params.params.config, { agentId: params.agentId ?? params.params.agentId });
+	const userMcpServersConfigPatch = params.userMcpServersEnabled === false ? void 0 : buildCodexUserMcpServersThreadConfigPatch(params.params.config, { agentId: params.agentId ?? params.params.agentId });
 	const userMcpServersFingerprint = fingerprintUserMcpServersConfigPatch(userMcpServersConfigPatch);
 	let binding = await readCodexAppServerBinding(params.params.sessionFile, {
 		authProfileStore: params.params.authProfileStore,
@@ -801,6 +1006,11 @@ async function startOrResumeThread(params) {
 	let preserveExistingBinding = false;
 	let rotatedContextEngineBinding = false;
 	let prebuiltPluginThreadConfig;
+	if (binding?.threadId && params.nativeCodeModeEnabled === false) {
+		embeddedAgentLog.debug("codex app-server native tool surface disabled for turn; starting transient thread", { threadId: binding.threadId });
+		preserveExistingBinding = true;
+		binding = void 0;
+	}
 	if (binding?.threadId && (binding.contextEngine || contextEngineBinding)) {
 		if (!contextEngineBinding || !isContextEngineBindingCompatible(binding.contextEngine, contextEngineBinding)) {
 			embeddedAgentLog.debug("codex app-server context-engine binding changed; starting a new thread", {
@@ -878,7 +1088,8 @@ async function startOrResumeThread(params) {
 			authProfileId,
 			appServer: params.appServer,
 			developerInstructions: params.developerInstructions,
-			config: resumeConfig
+			config: resumeConfig,
+			nativeCodeModeEnabled: params.nativeCodeModeEnabled
 		})));
 		const boundAuthProfileId = authProfileId;
 		const fallbackModelProvider = resolveCodexAppServerModelProvider({
@@ -945,7 +1156,8 @@ async function startOrResumeThread(params) {
 		dynamicTools: params.dynamicTools,
 		appServer: params.appServer,
 		developerInstructions: params.developerInstructions,
-		config
+		config,
+		nativeCodeModeEnabled: params.nativeCodeModeEnabled
 	})));
 	const modelProvider = resolveCodexAppServerModelProvider({
 		provider: params.params.provider,
@@ -1086,7 +1298,8 @@ function buildThreadStartParams(params, options) {
 		sandbox: options.appServer.sandbox,
 		...options.appServer.serviceTier ? { serviceTier: options.appServer.serviceTier } : {},
 		serviceName: "OpenClaw",
-		config: buildCodexRuntimeThreadConfigForRun(params, options.config),
+		config: buildCodexRuntimeThreadConfigForRun(params, options.config, { nativeCodeModeEnabled: options.nativeCodeModeEnabled }),
+		...options.nativeCodeModeEnabled === false ? { environments: [] } : {},
 		developerInstructions: options.developerInstructions ?? buildDeveloperInstructions(params),
 		dynamicTools: options.dynamicTools,
 		experimentalRawEvents: true,
@@ -1109,16 +1322,17 @@ function buildThreadResumeParams(params, options) {
 		approvalsReviewer: options.appServer.approvalsReviewer,
 		sandbox: options.appServer.sandbox,
 		...options.appServer.serviceTier ? { serviceTier: options.appServer.serviceTier } : {},
-		config: buildCodexRuntimeThreadConfigForRun(params, options.config),
+		config: buildCodexRuntimeThreadConfigForRun(params, options.config, { nativeCodeModeEnabled: options.nativeCodeModeEnabled }),
 		developerInstructions: options.developerInstructions ?? buildDeveloperInstructions(params),
 		persistExtendedHistory: true
 	};
 }
-function buildCodexRuntimeThreadConfig(config) {
-	return mergeCodexThreadConfigs(config, CODEX_CODE_MODE_THREAD_CONFIG) ?? { ...CODEX_CODE_MODE_THREAD_CONFIG };
+function buildCodexRuntimeThreadConfig(config, options = {}) {
+	const codeModeConfig = options.nativeCodeModeEnabled === false ? CODEX_CODE_MODE_DISABLED_THREAD_CONFIG : CODEX_CODE_MODE_THREAD_CONFIG;
+	return mergeCodexThreadConfigs(config, codeModeConfig) ?? { ...codeModeConfig };
 }
-function buildCodexRuntimeThreadConfigForRun(params, config) {
-	const runtimeConfig = buildCodexRuntimeThreadConfig(config);
+function buildCodexRuntimeThreadConfigForRun(params, config, options = {}) {
+	const runtimeConfig = buildCodexRuntimeThreadConfig(config, options);
 	if (params.bootstrapContextMode !== "lightweight") return runtimeConfig;
 	return mergeCodexThreadConfigs(runtimeConfig, CODEX_LIGHTWEIGHT_CONTEXT_THREAD_CONFIG) ?? {
 		...runtimeConfig,
@@ -1238,14 +1452,22 @@ function renderCodexRuntimePromptOverlay(params) {
 	].filter((section) => typeof section === "string" && section.trim().length > 0).join("\n\n");
 }
 function buildUserInput(params, promptText = params.prompt) {
+	const imageInputs = (params.images ?? []).map((image) => {
+		const imageUrl = sanitizeInlineImageDataUrl(`data:${image.mimeType};base64,${image.data}`);
+		return imageUrl ? {
+			type: "image",
+			url: imageUrl
+		} : {
+			type: "text",
+			text: invalidInlineImageText("codex user input"),
+			text_elements: []
+		};
+	});
 	return [{
 		type: "text",
 		text: promptText,
 		text_elements: []
-	}, ...(params.images ?? []).map((image) => ({
-		type: "image",
-		url: `data:${image.mimeType};base64,${image.data}`
-	}))];
+	}, ...imageInputs];
 }
 function resolveCodexAppServerModelProvider(params) {
 	const normalized = params.provider.trim();
@@ -1260,4 +1482,4 @@ function resolveReasoningEffort(thinkLevel, modelId) {
 	return null;
 }
 //#endregion
-export { normalizeCodexDynamicToolName as S, projectContextEngineAssemblyForCodex as _, buildThreadResumeParams as a, createCodexDynamicToolBridge as b, codexDynamicToolsFingerprint as c, resolveReasoningEffort as d, startOrResumeThread as f, shouldBuildCodexPluginThreadConfig as g, mergeCodexThreadConfigs as h, buildDeveloperInstructions as i, isContextEngineBindingCompatible as l, buildCodexPluginThreadConfigInputFingerprint as m, buildCodexRuntimeThreadConfig as n, buildThreadStartParams as o, buildCodexPluginThreadConfig as p, buildContextEngineBinding as r, buildTurnStartParams as s, areCodexDynamicToolFingerprintsCompatible as t, resolveCodexAppServerModelProvider as u, resolveCodexContextEngineProjectionMaxChars as v, filterCodexDynamicTools as x, resolveCodexContextEngineProjectionReserveTokens as y };
+export { isForcedPrivateQaCodexRuntime as C, filterCodexDynamicTools as S, resolveCodexDynamicToolsLoading as T, projectContextEngineAssemblyForCodex as _, buildThreadResumeParams as a, createCodexDynamicToolBridge as b, codexDynamicToolsFingerprint as c, resolveReasoningEffort as d, startOrResumeThread as f, shouldBuildCodexPluginThreadConfig as g, mergeCodexThreadConfigs as h, buildDeveloperInstructions as i, isContextEngineBindingCompatible as l, buildCodexPluginThreadConfigInputFingerprint as m, buildCodexRuntimeThreadConfig as n, buildThreadStartParams as o, buildCodexPluginThreadConfig as p, buildContextEngineBinding as r, buildTurnStartParams as s, areCodexDynamicToolFingerprintsCompatible as t, resolveCodexAppServerModelProvider as u, resolveCodexContextEngineProjectionMaxChars as v, normalizeCodexDynamicToolName as w, sanitizeCodexHistoryImagePayloads as x, resolveCodexContextEngineProjectionReserveTokens as y };