@openclaw/codex 2026.5.18 → 2026.5.19-beta.2

package/dist/{session-binding-DqApZIgD.js → session-binding-D9ejASYj.js}

@@ -1,5 +1,5 @@
 import { t as __exportAll } from "./rolldown-runtime-DUslC3ob.js";
-import { o as normalizeCodexServiceTier } from "./config-B5pq6hEz.js";
+import { o as normalizeCodexServiceTier } from "./config-B5rU0vP3.js";
 import { embeddedAgentLog } from "openclaw/plugin-sdk/agent-harness-runtime";
 import fs from "node:fs/promises";
 import { ensureAuthProfileStore, resolveDefaultAgentDir, resolveProviderIdForAuth } from "openclaw/plugin-sdk/agent-runtime";

package/dist/{shared-client-DlvmoLBJ.js → shared-client-DWgKldR5.js}

@@ -1,6 +1,6 @@
 import { t as __exportAll } from "./rolldown-runtime-DUslC3ob.js";
-import { c as resolveCodexAppServerRuntimeOptions, n as codexAppServerStartOptionsKey } from "./config-B5pq6hEz.js";
-import { a as MANAGED_CODEX_APP_SERVER_PACKAGE, o as resolveCodexAppServerSpawnEnv, t as CodexAppServerClient } from "./client-6FkrXfaz.js";
+import { c as resolveCodexAppServerRuntimeOptions, n as codexAppServerStartOptionsKey } from "./config-B5rU0vP3.js";
+import { a as MANAGED_CODEX_APP_SERVER_PACKAGE, o as resolveCodexAppServerSpawnEnv, t as CodexAppServerClient } from "./client-BCJaLwdZ.js";
 import { createRequire } from "node:module";
 import { createHash } from "node:crypto";
 import { constants, readFileSync } from "node:fs";

package/dist/{side-question-CfRPUq5X.js → side-question-DjyRnjPQ.js}

@@ -1,17 +1,18 @@
-import { c as resolveCodexAppServerRuntimeOptions, s as readCodexPluginConfig } from "./config-B5pq6hEz.js";
+import { c as resolveCodexAppServerRuntimeOptions, s as readCodexPluginConfig } from "./config-B5rU0vP3.js";
 import { a as readCodexDynamicToolCallParams, i as assertCodexTurnStartResponse, l as readCodexTurnCompletedNotification, t as assertCodexThreadForkResponse } from "./protocol-validators-BGBspNmF.js";
 import { t as isJsonObject } from "./protocol-C9UWI98H.js";
-import { r as isCodexAppServerApprovalRequest } from "./client-6FkrXfaz.js";
-import { u as formatCodexUsageLimitErrorMessage } from "./command-formatters-BRW7_Nu7.js";
-import { i as getSharedCodexAppServerClient, s as refreshCodexAppServerAuthTokens } from "./shared-client-DlvmoLBJ.js";
-import { i as readCodexAppServerBinding } from "./session-binding-DqApZIgD.js";
-import { S as filterCodexDynamicTools, T as resolveCodexDynamicToolsLoading, b as createCodexDynamicToolBridge, d as resolveReasoningEffort, h as mergeCodexThreadConfigs, n as buildCodexRuntimeThreadConfig, u as resolveCodexAppServerModelProvider } from "./thread-lifecycle-5SBrtWFl.js";
-import { a as handleCodexAppServerElicitationRequest, i as buildCodexNativeHookRelayDisabledConfig, n as CODEX_NATIVE_HOOK_RELAY_EVENTS, o as handleCodexAppServerApprovalRequest, r as buildCodexNativeHookRelayConfig, t as filterToolsForVisionInputs } from "./vision-tools-BX9YuTEK.js";
+import { r as isCodexAppServerApprovalRequest } from "./client-BCJaLwdZ.js";
+import { u as formatCodexUsageLimitErrorMessage } from "./command-formatters-BpPOTePl.js";
+import { i as getSharedCodexAppServerClient, s as refreshCodexAppServerAuthTokens } from "./shared-client-DWgKldR5.js";
+import { i as readCodexAppServerBinding } from "./session-binding-D9ejASYj.js";
+import { S as filterCodexDynamicTools, T as resolveCodexDynamicToolsLoading, b as createCodexDynamicToolBridge, d as resolveReasoningEffort, h as mergeCodexThreadConfigs, n as buildCodexRuntimeThreadConfig, u as resolveCodexAppServerModelProvider } from "./thread-lifecycle-C07GnPSH.js";
+import { a as handleCodexAppServerElicitationRequest, c as emitDynamicToolTerminalDiagnostic, i as buildCodexNativeHookRelayDisabledConfig, l as handleCodexAppServerApprovalRequest, n as CODEX_NATIVE_HOOK_RELAY_EVENTS, o as emitDynamicToolErrorDiagnostic, r as buildCodexNativeHookRelayConfig, s as emitDynamicToolStartedDiagnostic, t as filterToolsForVisionInputs } from "./vision-tools-CDoJ4rDN.js";
 import { n as rememberCodexRateLimits, t as readRecentCodexRateLimits } from "./rate-limit-cache-dvhq-4pi.js";
 import { buildAgentHookContextChannelFields, embeddedAgentLog, formatErrorMessage, registerNativeHookRelay, resolveAgentDir, resolveAttemptSpawnWorkspaceDir, resolveModelAuthMode, resolveSandboxContext, resolveSessionAgentIds, supportsModelTools } from "openclaw/plugin-sdk/agent-harness-runtime";
 //#region extensions/codex/src/app-server/side-question.ts
 const CODEX_SIDE_DYNAMIC_TOOL_TIMEOUT_MS = 3e4;
 const CODEX_SIDE_DYNAMIC_TOOL_MAX_TIMEOUT_MS = 6e5;
+const CODEX_SIDE_DYNAMIC_IMAGE_GENERATION_TOOL_TIMEOUT_MS = 12e4;
 const CODEX_SIDE_DYNAMIC_IMAGE_TOOL_TIMEOUT_MS = 6e4;
 const SIDE_QUESTION_COMPLETION_TIMEOUT_MS = 6e5;
 const CODEX_SIDE_NATIVE_HOOK_RELAY_MIN_TTL_MS = 30 * 6e4;
@@ -118,12 +119,37 @@ async function runCodexAppServerSideQuestion(params, options = {}) {
 				call,
 				config: params.cfg
 			});
-			return await handleSideDynamicToolCallWithTimeout({
+			const toolStartedAt = Date.now();
+			const diagnosticContext = {
 				call,
-				toolBridge,
-				signal: runAbortController.signal,
-				timeoutMs
-			});
+				runId: sideRunParams.runId,
+				sessionId: params.sessionId,
+				sessionKey: params.sessionKey
+			};
+			emitDynamicToolStartedDiagnostic(diagnosticContext);
+			try {
+				const response = await handleSideDynamicToolCallWithTimeout({
+					call,
+					toolBridge,
+					signal: runAbortController.signal,
+					timeoutMs
+				});
+				emitDynamicToolTerminalDiagnostic({
+					...diagnosticContext,
+					response,
+					durationMs: Math.max(0, Date.now() - toolStartedAt)
+				});
+				return {
+					contentItems: response.contentItems,
+					success: response.success
+				};
+			} catch (error) {
+				emitDynamicToolErrorDiagnostic({
+					...diagnosticContext,
+					durationMs: Math.max(0, Date.now() - toolStartedAt)
+				});
+				throw error;
+			}
 		});
 		const approvalPolicy = binding.approvalPolicy ?? appServer.approvalPolicy;
 		const sandbox = binding.sandbox ?? appServer.sandbox;
@@ -156,7 +182,7 @@ async function runCodexAppServerSideQuestion(params, options = {}) {
 			hookTimeoutSec: options.nativeHookRelay?.hookTimeoutSec,
 			clearOmittedEvents: true
 		}) : options.nativeHookRelay?.enabled === false ? buildCodexNativeHookRelayDisabledConfig() : void 0;
-		const runtimeThreadConfig = buildCodexRuntimeThreadConfig(void 0);
+		const runtimeThreadConfig = buildCodexRuntimeThreadConfig(void 0, { nativeCodeModeOnlyEnabled: appServer.codeModeOnly });
 		const threadConfig = mergeCodexThreadConfigs(nativeHookRelayConfig, runtimeThreadConfig) ?? runtimeThreadConfig;
 		const modelProvider = resolveCodexAppServerModelProvider({
 			provider: params.provider,
@@ -343,6 +369,7 @@ async function createCodexSideToolBridge(input) {
 				currentChannelId: input.params.currentChannelId
 			}).channelId,
 			sandbox,
+			emitBeforeToolCallDiagnostics: false,
 			modelHasVision: runtimeModel.input?.includes("image") ?? false,
 			requireExplicitMessageTarget: true
 		}), input.pluginConfig), {
@@ -409,13 +436,19 @@ async function handleSideDynamicToolCallWithTimeout(params) {
 	}
 }
 function failedSideDynamicToolResponse(message) {
-	return {
-		success: false,
+	const response = {
 		contentItems: [{
 			type: "inputText",
 			text: message
-		}]
+		}],
+		success: false
 	};
+	Object.defineProperty(response, "diagnosticTerminalType", {
+		configurable: true,
+		enumerable: false,
+		value: "error"
+	});
+	return response;
 }
 function emptySideUserInputResponse() {
 	return { answers: {} };
@@ -424,7 +457,7 @@ function isSideUserInputRequest(value, threadId, turnId) {
 	return isJsonObject(value) && value.threadId === threadId && value.turnId === turnId;
 }
 function resolveSideDynamicToolCallTimeoutMs(params) {
-	return clampSideDynamicToolTimeoutMs(readSideDynamicToolCallTimeoutMs(params.call.arguments) ?? (params.call.tool === "image_generate" ? readSideImageGenerationModelTimeoutMs(params.config) : void 0) ?? (params.call.tool === "image" ? readSideTimeoutSecondsAsMs(params.config?.tools?.media?.image?.timeoutSeconds) ?? CODEX_SIDE_DYNAMIC_IMAGE_TOOL_TIMEOUT_MS : void 0) ?? CODEX_SIDE_DYNAMIC_TOOL_TIMEOUT_MS);
+	return clampSideDynamicToolTimeoutMs(readSideDynamicToolCallTimeoutMs(params.call.arguments) ?? (params.call.tool === "image_generate" ? readSideImageGenerationModelTimeoutMs(params.config) ?? CODEX_SIDE_DYNAMIC_IMAGE_GENERATION_TOOL_TIMEOUT_MS : void 0) ?? (params.call.tool === "image" ? readSideTimeoutSecondsAsMs(params.config?.tools?.media?.image?.timeoutSeconds) ?? CODEX_SIDE_DYNAMIC_IMAGE_TOOL_TIMEOUT_MS : void 0) ?? CODEX_SIDE_DYNAMIC_TOOL_TIMEOUT_MS);
 }
 function readSideDynamicToolCallTimeoutMs(value) {
 	if (!isJsonObject(value)) return;

package/dist/test-api.js

@@ -1,5 +1,5 @@
-import { c as resolveCodexAppServerRuntimeOptions } from "./config-B5pq6hEz.js";
-import { S as filterCodexDynamicTools, a as buildThreadResumeParams, b as createCodexDynamicToolBridge, i as buildDeveloperInstructions, o as buildThreadStartParams, s as buildTurnStartParams } from "./thread-lifecycle-5SBrtWFl.js";
+import { c as resolveCodexAppServerRuntimeOptions } from "./config-B5rU0vP3.js";
+import { S as filterCodexDynamicTools, a as buildThreadResumeParams, b as createCodexDynamicToolBridge, i as buildDeveloperInstructions, o as buildThreadStartParams, s as buildTurnStartParams } from "./thread-lifecycle-C07GnPSH.js";
 //#region extensions/codex/test-api.ts
 function resolveCodexPromptSnapshotAppServerOptions(pluginConfig) {
 	return resolveCodexAppServerRuntimeOptions({
@@ -9,7 +9,7 @@ function resolveCodexPromptSnapshotAppServerOptions(pluginConfig) {
 	});
 }
 function buildCodexHarnessPromptSnapshot(params) {
-	const developerInstructions = buildDeveloperInstructions(params.attempt);
+	const developerInstructions = joinPresentSections(buildDeveloperInstructions(params.attempt, { dynamicTools: params.dynamicTools }), params.developerInstructionAdditions);
 	return {
 		developerInstructions,
 		threadStartParams: buildThreadStartParams(params.attempt, {
@@ -29,10 +29,14 @@ function buildCodexHarnessPromptSnapshot(params) {
 			threadId: params.threadId,
 			cwd: params.cwd,
 			appServer: params.appServer,
-			promptText: params.promptText
+			promptText: params.promptText,
+			heartbeatCollaborationInstructions: params.heartbeatCollaborationInstructions
 		})
 	};
 }
+function joinPresentSections(...sections) {
+	return sections.filter((section) => Boolean(section?.trim())).join("\n\n");
+}
 function createCodexDynamicToolSpecsForPromptSnapshot(params) {
 	return createCodexDynamicToolBridge({
 		tools: filterCodexDynamicTools(params.tools, params.pluginConfig ?? {}),

package/dist/{thread-lifecycle-5SBrtWFl.js → thread-lifecycle-C07GnPSH.js}

@@ -1,15 +1,16 @@
-import { r as codexSandboxPolicyForTurn, u as resolveCodexPluginsPolicy } from "./config-B5pq6hEz.js";
+import { r as codexSandboxPolicyForTurn, u as resolveCodexPluginsPolicy } from "./config-B5rU0vP3.js";
 import { n as assertCodexThreadResumeResponse, r as assertCodexThreadStartResponse } from "./protocol-validators-BGBspNmF.js";
 import { t as isJsonObject } from "./protocol-C9UWI98H.js";
-import { CODEX_GPT5_HEARTBEAT_PROMPT_OVERLAY, renderCodexPromptOverlay } from "./prompt-overlay.js";
+import { CODEX_GPT5_HEARTBEAT_PROMPT_OVERLAY } from "./prompt-overlay.js";
 import { isModernCodexModel } from "./provider.js";
-import { i as isCodexAppServerConnectionClosedError } from "./client-6FkrXfaz.js";
-import { i as readCodexAppServerBinding, n as isCodexAppServerNativeAuthProfile, o as writeCodexAppServerBinding, t as clearCodexAppServerBinding } from "./session-binding-DqApZIgD.js";
-import { a as defaultCodexAppInventoryCache, r as readCodexPluginInventory, t as ensureCodexPluginActivation } from "./plugin-activation-B49xb7pI.js";
+import { i as isCodexAppServerConnectionClosedError } from "./client-BCJaLwdZ.js";
+import { i as readCodexAppServerBinding, n as isCodexAppServerNativeAuthProfile, o as writeCodexAppServerBinding, t as clearCodexAppServerBinding } from "./session-binding-D9ejASYj.js";
+import { a as defaultCodexAppInventoryCache, o as serializeCodexAppInventoryError, r as readCodexPluginInventory, t as ensureCodexPluginActivation } from "./plugin-activation-Dtcfb3sk.js";
 import crypto from "node:crypto";
-import { HEARTBEAT_RESPONSE_TOOL_NAME, createAgentToolResultMiddlewareRunner, createCodexAppServerToolResultExtensionRunner, embeddedAgentLog, extractToolResultMediaArtifact, filterToolResultMediaUrls, isActiveHarnessContextEngine, isMessagingTool, isMessagingToolSendAction, isToolWrappedWithBeforeToolCallHook, normalizeHeartbeatToolResponse, runAgentHarnessAfterToolCallHook, wrapToolWithBeforeToolCallHook } from "openclaw/plugin-sdk/agent-harness-runtime";
+import { HEARTBEAT_RESPONSE_TOOL_NAME, createAgentToolResultMiddlewareRunner, createCodexAppServerToolResultExtensionRunner, embeddedAgentLog, extractToolResultMediaArtifact, filterToolResultMediaUrls, isActiveHarnessContextEngine, isMessagingTool, isMessagingToolSendAction, isToolWrappedWithBeforeToolCallHook, normalizeHeartbeatToolResponse, runAgentHarnessAfterToolCallHook, setBeforeToolCallDiagnosticsEnabled, wrapToolWithBeforeToolCallHook } from "openclaw/plugin-sdk/agent-harness-runtime";
 import { normalizeAgentId } from "openclaw/plugin-sdk/routing";
 import { buildCodexUserMcpServersThreadConfigPatch } from "openclaw/plugin-sdk/codex-mcp-projection";
+import { listRegisteredPluginAgentPromptGuidance } from "openclaw/plugin-sdk/plugin-runtime";
 import { redactSensitiveFieldValue, redactToolPayloadText } from "openclaw/plugin-sdk/logging-core";
 //#region extensions/codex/src/app-server/dynamic-tool-profile.ts
 const CODEX_APP_SERVER_OWNED_DYNAMIC_TOOL_EXCLUDES = [
@@ -156,7 +157,13 @@ const DEFAULT_CODEX_DYNAMIC_TOOL_RESULT_MAX_CHARS = 16e3;
 function createCodexDynamicToolBridge(params) {
 	const toolResultHookContext = toToolResultHookContext(params.hookContext);
 	const toolResultMaxChars = resolveCodexDynamicToolResultMaxChars(params.hookContext);
-	const tools = params.tools.map((tool) => isToolWrappedWithBeforeToolCallHook(tool) ? tool : wrapToolWithBeforeToolCallHook(tool, params.hookContext));
+	const tools = params.tools.map((tool) => {
+		if (isToolWrappedWithBeforeToolCallHook(tool)) {
+			setBeforeToolCallDiagnosticsEnabled(tool, false);
+			return tool;
+		}
+		return wrapToolWithBeforeToolCallHook(tool, params.hookContext, { emitDiagnostics: false });
+	});
 	const toolMap = new Map(tools.map((tool) => [tool.name, tool]));
 	const telemetry = {
 		didSendViaMessagingTool: false,
@@ -234,10 +241,10 @@ function createCodexDynamicToolBridge(params) {
 					result,
 					startedAt
 				});
-				return {
+				return withDiagnosticTerminalType({
 					contentItems: convertToolContents(result.content, toolResultMaxChars),
 					success: !resultIsError
-				};
+				}, inferToolResultDiagnosticTerminalType(result, resultIsError));
 			} catch (error) {
 				collectToolTelemetry({
 					toolName: tool.name,
@@ -258,13 +265,13 @@ function createCodexDynamicToolBridge(params) {
 					error: error instanceof Error ? error.message : String(error),
 					startedAt
 				});
-				return {
+				return withDiagnosticTerminalType({
 					contentItems: [{
 						type: "inputText",
 						text: error instanceof Error ? error.message : String(error)
 					}],
 					success: false
-				};
+				}, "error");
 			}
 		}
 	};
@@ -408,6 +415,21 @@ function isToolResultError(result) {
 	const status = details.status.trim().toLowerCase();
 	return status !== "" && status !== "0" && status !== "ok" && status !== "success" && status !== "completed" && status !== "recorded" && status !== "running";
 }
+function inferToolResultDiagnosticTerminalType(result, isError) {
+	const details = result.details;
+	if (isRecord(details) && typeof details.status === "string") {
+		if (details.status.trim().toLowerCase() === "blocked") return "blocked";
+	}
+	return isError ? "error" : "completed";
+}
+function withDiagnosticTerminalType(response, terminalType) {
+	Object.defineProperty(response, "diagnosticTerminalType", {
+		configurable: true,
+		enumerable: false,
+		value: terminalType
+	});
+	return response;
+}
 function normalizeToolResultMaxChars(maxChars) {
 	return typeof maxChars === "number" && Number.isFinite(maxChars) && maxChars > 0 ? Math.floor(maxChars) : DEFAULT_CODEX_DYNAMIC_TOOL_RESULT_MAX_CHARS;
 }
@@ -782,10 +804,14 @@ async function buildCodexPluginThreadConfig(params) {
 		request: params.request,
 		appCache,
 		appCacheKey: params.appCacheKey,
-		nowMs: params.nowMs
+		nowMs: params.nowMs,
+		suppressAppInventoryRefresh: true
 	});
 	if (shouldWaitForInitialAppInventory(params, policy, inventory)) {
-		await refreshAppInventoryNow(params, appCache);
+		await refreshAppInventoryNow(params, appCache, {
+			forceRefetch: true,
+			reason: "initial_missing"
+		});
 		inventory = await readCodexPluginInventory({
 			pluginConfig: params.pluginConfig,
 			policy,
@@ -817,7 +843,28 @@ async function buildCodexPluginThreadConfig(params) {
 		});
 	}
 	if (activationResults.some((activation) => activation.ok && activation.installAttempted)) {
-		await refreshAppInventoryNow(params, appCache, { forceRefetch: true });
+		await refreshAppInventoryNow(params, appCache, {
+			forceRefetch: true,
+			reason: "post_install"
+		});
+		inventory = await readCodexPluginInventory({
+			pluginConfig: params.pluginConfig,
+			policy,
+			request: params.request,
+			appCache,
+			appCacheKey: params.appCacheKey,
+			nowMs: params.nowMs
+		});
+		inputFingerprint = buildCodexPluginThreadConfigInputFingerprint({
+			pluginConfig: params.pluginConfig,
+			appCacheKey: params.appCacheKey
+		});
+	}
+	if (shouldForceRefreshForNotReadyPluginApps(params, policy, inventory)) {
+		await refreshAppInventoryNow(params, appCache, {
+			forceRefetch: true,
+			reason: "not_ready_plugin_apps"
+		});
 		inventory = await readCodexPluginInventory({
 			pluginConfig: params.pluginConfig,
 			policy,
@@ -845,7 +892,10 @@ async function buildCodexPluginThreadConfig(params) {
 		}
 		if (record.appOwnership !== "proven") continue;
 		pluginAppIds[record.policy.configKey] = [...record.ownedAppIds].toSorted();
-		for (const app of record.apps) {
+		for (const app of resolveThreadConfigAppsForRecord({
+			record,
+			inventory
+		})) {
 			if (!app.accessible || !app.enabled) {
 				diagnostics.push({
 					code: "app_not_ready",
@@ -942,13 +992,29 @@ async function refreshAppInventoryNow(params, appCache, options = {}) {
 	if (!appCacheKey) return;
 	const request = async (method, requestParams) => await params.request(method, requestParams);
 	try {
-		await appCache.refreshNow({
+		return await appCache.refreshNow({
 			key: appCacheKey,
 			request,
 			nowMs: params.nowMs,
 			forceRefetch: options.forceRefetch
 		});
-	} catch {}
+	} catch (error) {
+		embeddedAgentLog.warn("codex plugin thread config app inventory refresh failed", {
+			reason: options.reason,
+			forceRefetch: options.forceRefetch === true,
+			error: serializeCodexAppInventoryError(error)
+		});
+		return;
+	}
+}
+function resolveThreadConfigAppsForRecord(params) {
+	if (params.inventory.appInventory?.state === "missing") return [];
+	return params.record.apps;
+}
+function shouldForceRefreshForNotReadyPluginApps(params, policy, inventory) {
+	if (!params.appCacheKey || !policy.pluginPolicies.some((plugin) => plugin.enabled)) return false;
+	if (inventory.appInventory?.state === "missing") return false;
+	return inventory.records.some((record) => record.appOwnership === "proven" && record.ownedAppIds.length > 0 && (record.apps.length === 0 || record.apps.some((app) => !app.accessible || !app.enabled)));
 }
 function policyFingerprint(policy) {
 	return {
@@ -1087,9 +1153,11 @@ async function startOrResumeThread(params) {
 			threadId: binding.threadId,
 			authProfileId,
 			appServer: params.appServer,
+			dynamicTools: params.dynamicTools,
 			developerInstructions: params.developerInstructions,
 			config: resumeConfig,
-			nativeCodeModeEnabled: params.nativeCodeModeEnabled
+			nativeCodeModeEnabled: params.nativeCodeModeEnabled,
+			nativeCodeModeOnlyEnabled: params.nativeCodeModeOnlyEnabled
 		})));
 		const boundAuthProfileId = authProfileId;
 		const fallbackModelProvider = resolveCodexAppServerModelProvider({
@@ -1157,7 +1225,8 @@ async function startOrResumeThread(params) {
 		appServer: params.appServer,
 		developerInstructions: params.developerInstructions,
 		config,
-		nativeCodeModeEnabled: params.nativeCodeModeEnabled
+		nativeCodeModeEnabled: params.nativeCodeModeEnabled,
+		nativeCodeModeOnlyEnabled: params.nativeCodeModeOnlyEnabled
 	})));
 	const modelProvider = resolveCodexAppServerModelProvider({
 		provider: params.params.provider,
@@ -1298,9 +1367,12 @@ function buildThreadStartParams(params, options) {
 		sandbox: options.appServer.sandbox,
 		...options.appServer.serviceTier ? { serviceTier: options.appServer.serviceTier } : {},
 		serviceName: "OpenClaw",
-		config: buildCodexRuntimeThreadConfigForRun(params, options.config, { nativeCodeModeEnabled: options.nativeCodeModeEnabled }),
+		config: buildCodexRuntimeThreadConfigForRun(params, options.config, {
+			nativeCodeModeEnabled: options.nativeCodeModeEnabled,
+			nativeCodeModeOnlyEnabled: options.nativeCodeModeOnlyEnabled
+		}),
 		...options.nativeCodeModeEnabled === false ? { environments: [] } : {},
-		developerInstructions: options.developerInstructions ?? buildDeveloperInstructions(params),
+		developerInstructions: options.developerInstructions ?? buildDeveloperInstructions(params, { dynamicTools: options.dynamicTools }),
 		dynamicTools: options.dynamicTools,
 		experimentalRawEvents: true,
 		persistExtendedHistory: true
@@ -1322,14 +1394,25 @@ function buildThreadResumeParams(params, options) {
 		approvalsReviewer: options.appServer.approvalsReviewer,
 		sandbox: options.appServer.sandbox,
 		...options.appServer.serviceTier ? { serviceTier: options.appServer.serviceTier } : {},
-		config: buildCodexRuntimeThreadConfigForRun(params, options.config, { nativeCodeModeEnabled: options.nativeCodeModeEnabled }),
-		developerInstructions: options.developerInstructions ?? buildDeveloperInstructions(params),
+		config: buildCodexRuntimeThreadConfigForRun(params, options.config, {
+			nativeCodeModeEnabled: options.nativeCodeModeEnabled,
+			nativeCodeModeOnlyEnabled: options.nativeCodeModeOnlyEnabled
+		}),
+		developerInstructions: options.developerInstructions ?? buildDeveloperInstructions(params, { dynamicTools: options.dynamicTools }),
 		persistExtendedHistory: true
 	};
 }
 function buildCodexRuntimeThreadConfig(config, options = {}) {
-	if (options.nativeCodeModeEnabled === false) return mergeCodexThreadConfigs(CODEX_CODE_MODE_THREAD_CONFIG, config, CODEX_CODE_MODE_DISABLED_THREAD_CONFIG) ?? { ...CODEX_CODE_MODE_DISABLED_THREAD_CONFIG };
-	return mergeCodexThreadConfigs(CODEX_CODE_MODE_THREAD_CONFIG, config) ?? { ...CODEX_CODE_MODE_THREAD_CONFIG };
+	const codeModeConfig = {
+		...CODEX_CODE_MODE_THREAD_CONFIG,
+		"features.code_mode_only": options.nativeCodeModeOnlyEnabled === true
+	};
+	if (options.nativeCodeModeEnabled === false) return mergeCodexThreadConfigs(codeModeConfig, config, CODEX_CODE_MODE_DISABLED_THREAD_CONFIG) ?? { ...CODEX_CODE_MODE_DISABLED_THREAD_CONFIG };
+	if (options.nativeCodeModeOnlyEnabled === true) return mergeCodexThreadConfigs(codeModeConfig, config, { "features.code_mode_only": true }) ?? {
+		...codeModeConfig,
+		"features.code_mode_only": true
+	};
+	return mergeCodexThreadConfigs(codeModeConfig, config) ?? { ...codeModeConfig };
 }
 function buildCodexRuntimeThreadConfigForRun(params, config, options = {}) {
 	const runtimeConfig = buildCodexRuntimeThreadConfig(config, options);
@@ -1350,22 +1433,22 @@ function buildTurnStartParams(params, options) {
 		model: params.modelId,
 		...options.appServer.serviceTier ? { serviceTier: options.appServer.serviceTier } : {},
 		effort: resolveReasoningEffort(params.thinkLevel, params.modelId),
-		collaborationMode: buildTurnCollaborationMode(params)
+		collaborationMode: buildTurnCollaborationMode(params, { heartbeatCollaborationInstructions: options.heartbeatCollaborationInstructions })
 	};
 }
-function buildTurnCollaborationMode(params) {
+function buildTurnCollaborationMode(params, options = {}) {
 	return {
 		mode: "default",
 		settings: {
 			model: params.modelId,
 			reasoning_effort: resolveReasoningEffort(params.thinkLevel, params.modelId),
-			developer_instructions: buildTurnScopedCollaborationInstructions(params)
+			developer_instructions: buildTurnScopedCollaborationInstructions(params, options)
 		}
 	};
 }
-function buildTurnScopedCollaborationInstructions(params) {
+function buildTurnScopedCollaborationInstructions(params, options = {}) {
 	if (params.trigger === "cron") return buildCronCollaborationInstructions();
-	if (params.trigger === "heartbeat") return buildHeartbeatCollaborationInstructions();
+	if (params.trigger === "heartbeat") return joinPresentSections(buildHeartbeatCollaborationInstructions(), options.heartbeatCollaborationInstructions);
 	return null;
 }
 function buildCronCollaborationInstructions() {
@@ -1383,6 +1466,9 @@ function buildHeartbeatCollaborationInstructions() {
 		CODEX_GPT5_HEARTBEAT_PROMPT_OVERLAY
 	].join("\n\n");
 }
+function joinPresentSections(...sections) {
+	return sections.filter((section) => Boolean(section?.trim())).join("\n\n");
+}
 function codexDynamicToolsFingerprint(dynamicTools) {
 	return fingerprintDynamicTools(dynamicTools);
 }
@@ -1421,36 +1507,34 @@ function shouldStartTransientNoToolThread(params) {
 function compareJsonFingerprint(left, right) {
 	return JSON.stringify(left).localeCompare(JSON.stringify(right));
 }
-function buildDeveloperInstructions(params) {
+function buildDeveloperInstructions(params, options = {}) {
+	const nativeCommandGuidance = listRegisteredPluginAgentPromptGuidance({
+		surface: "codex_app_server",
+		includeLegacyGlobalGuidance: false
+	}).join("\n");
 	return [
-		"Running inside OpenClaw. Use dynamic tools for messaging, cron, sessions, media, gateway, and nodes when available.",
-		"Use Codex native `spawn_agent` for Codex subagents. Use OpenClaw `sessions_spawn` only for OpenClaw or ACP delegation; if it is not already loaded, search for `sessions_spawn` in the `openclaw` dynamic tool namespace before calling it.",
-		"Preserve channel/session context. Visible channel replies: use `message`, do not describe would-reply.",
-		renderCodexRuntimePromptOverlay(params),
-		params.extraSystemPrompt,
-		params.skillsSnapshot?.prompt
+		"You are a personal agent running inside OpenClaw. OpenClaw has dynamic tools for OpenClaw-owned messaging, cron, sessions, media, gateway, and nodes.",
+		buildDeferredDynamicToolManifest(options.dynamicTools),
+		"Use Codex native `spawn_agent` for Codex subagents. Use OpenClaw `sessions_spawn` only for OpenClaw or ACP delegation.",
+		buildVisibleReplyInstruction(params, options.dynamicTools),
+		nativeCommandGuidance,
+		params.extraSystemPrompt
 	].filter((section) => typeof section === "string" && section.trim()).join("\n\n");
 }
-function renderCodexRuntimePromptOverlay(params) {
-	const contribution = params.runtimePlan?.prompt.resolveSystemPromptContribution({
-		config: params.config,
-		agentDir: params.agentDir,
-		workspaceDir: params.workspaceDir,
-		provider: params.provider,
-		modelId: params.modelId,
-		promptMode: "full",
-		agentId: params.agentId
-	});
-	if (!contribution) return renderCodexPromptOverlay({
-		config: params.config,
-		providerId: params.provider,
-		modelId: params.modelId
-	});
-	return [
-		contribution.stablePrefix,
-		...Object.values(contribution.sectionOverrides ?? {}),
-		contribution.dynamicSuffix
-	].filter((section) => typeof section === "string" && section.trim().length > 0).join("\n\n");
+function buildDeferredDynamicToolManifest(dynamicTools) {
+	const deferredToolNames = [...new Set((dynamicTools ?? []).filter((tool) => tool.deferLoading === true).map((tool) => tool.name.trim()).filter(Boolean))].toSorted((left, right) => left.localeCompare(right));
+	if (deferredToolNames.length === 0) return;
+	return `Deferred searchable OpenClaw dynamic tools available: ${deferredToolNames.join(", ")}. Use \`tool_search\` to load exact callable specs before use.`;
+}
+function buildVisibleReplyInstruction(params, dynamicTools) {
+	const messageToolAvailable = dynamicTools ? dynamicTools.some((tool) => tool.name.trim() === "message") : params.disableMessageTool !== true;
+	if (params.sourceReplyDeliveryMode === "message_tool_only" && messageToolAvailable) return [
+		"Preserve channel/session context.",
+		"If this turn needs visible output in the current channel, call `message` with `action=\"send\"` before ending the turn.",
+		"Do not rely on normal final assistant text for visible delivery; final text is private to OpenClaw/Codex in this mode.",
+		"If no visible channel response is needed, do not call `message(action=\"send\")`."
+	].join(" ");
+	return "To send a visible reply, use the active Codex delivery path.";
 }
 function buildUserInput(params, promptText = params.prompt) {
 	const imageInputs = (params.images ?? []).map((image) => {

package/dist/{vision-tools-BX9YuTEK.js → vision-tools-CDoJ4rDN.js}

@@ -1,7 +1,8 @@
 import { t as isJsonObject } from "./protocol-C9UWI98H.js";
-import { r as formatCodexDisplayText } from "./command-formatters-BRW7_Nu7.js";
+import { r as formatCodexDisplayText } from "./command-formatters-BpPOTePl.js";
 import { createHash } from "node:crypto";
 import { buildAgentHookContextChannelFields, callGatewayTool, embeddedAgentLog, formatApprovalDisplayPath, hasNativeHookRelayInvocation, invokeNativeHookRelay, runBeforeToolCallHook } from "openclaw/plugin-sdk/agent-harness-runtime";
+import { emitTrustedDiagnosticEvent } from "openclaw/plugin-sdk/diagnostic-runtime";
 //#region extensions/codex/src/app-server/plugin-approval-roundtrip.ts
 const DEFAULT_CODEX_APPROVAL_TIMEOUT_MS = 12e4;
 const MAX_PLUGIN_APPROVAL_TITLE_LENGTH = 80;
@@ -743,6 +744,59 @@ function formatErrorMessage$1(error) {
 	return error instanceof Error ? error.message : String(error);
 }
 //#endregion
+//#region extensions/codex/src/app-server/dynamic-tool-diagnostics.ts
+function emitDynamicToolStartedDiagnostic(params) {
+	emitTrustedDiagnosticEvent({
+		type: "tool.execution.started",
+		runId: params.runId,
+		sessionId: params.sessionId,
+		sessionKey: params.sessionKey,
+		toolName: params.call.tool,
+		toolCallId: params.call.callId
+	});
+}
+function emitDynamicToolErrorDiagnostic(params) {
+	emitTrustedDiagnosticEvent({
+		type: "tool.execution.error",
+		runId: params.runId,
+		sessionId: params.sessionId,
+		sessionKey: params.sessionKey,
+		toolName: params.call.tool,
+		toolCallId: params.call.callId,
+		durationMs: params.durationMs,
+		errorCategory: "codex_dynamic_tool_error"
+	});
+}
+function emitDynamicToolTerminalDiagnostic(params) {
+	const terminalType = params.response.diagnosticTerminalType ?? (params.response.success ? "completed" : "error");
+	if (terminalType === "completed") {
+		emitTrustedDiagnosticEvent({
+			type: "tool.execution.completed",
+			runId: params.runId,
+			sessionId: params.sessionId,
+			sessionKey: params.sessionKey,
+			toolName: params.call.tool,
+			toolCallId: params.call.callId,
+			durationMs: params.durationMs
+		});
+		return;
+	}
+	if (terminalType === "blocked") {
+		emitTrustedDiagnosticEvent({
+			type: "tool.execution.blocked",
+			runId: params.runId,
+			sessionId: params.sessionId,
+			sessionKey: params.sessionKey,
+			toolName: params.call.tool,
+			toolCallId: params.call.callId,
+			deniedReason: "plugin-before-tool-call",
+			reason: "Tool call blocked"
+		});
+		return;
+	}
+	emitDynamicToolErrorDiagnostic(params);
+}
+//#endregion
 //#region extensions/codex/src/app-server/elicitation-bridge.ts
 const MCP_TOOL_APPROVAL_KIND = "mcp_tool_call";
 const MCP_TOOL_APPROVAL_KIND_KEY = "codex_approval_kind";
@@ -832,7 +886,7 @@ function hasExactTurnId(requestParams, turnId) {
 function resolvePluginElicitation(params) {
 	const requestParams = params.requestParams;
 	if (!requestParams) return { kind: "not_plugin" };
-	const meta = isJsonObject(requestParams._meta) ? requestParams._meta : {};
+	const meta = isJsonObject(requestParams["_meta"]) ? requestParams["_meta"] : {};
 	const context = params.pluginAppPolicyContext;
 	const entries = context ? Object.values(context.apps) : [];
 	const appId = readFirstString(meta, PLUGIN_APP_ID_META_KEYS) ?? readFirstString(requestParams, PLUGIN_APP_ID_META_KEYS);
@@ -923,7 +977,7 @@ function buildPluginPolicyElicitationResponse(entry, requestParams) {
 		logPluginElicitationDecline("unsupported_schema", requestParams);
 		return declineElicitationResponse();
 	}
-	const meta = isJsonObject(requestParams._meta) ? requestParams._meta : {};
+	const meta = isJsonObject(requestParams["_meta"]) ? requestParams["_meta"] : {};
 	const response = buildElicitationResponse(requestParams.requestedSchema, meta, "approved-once");
 	if (isJsonObject(response) && response.action === "accept") return response;
 	logPluginElicitationDecline("unmappable_schema", requestParams);
@@ -944,7 +998,7 @@ function logPluginElicitationDecline(reason, requestParams) {
 	});
 }
 function readBridgeableApprovalElicitation(requestParams) {
-	if (!requestParams || readString(requestParams, "mode") !== "form" || !isJsonObject(requestParams._meta) || requestParams._meta[MCP_TOOL_APPROVAL_KIND_KEY] !== MCP_TOOL_APPROVAL_KIND || !isJsonObject(requestParams.requestedSchema)) return;
+	if (!requestParams || readString(requestParams, "mode") !== "form" || !isJsonObject(requestParams["_meta"]) || requestParams["_meta"][MCP_TOOL_APPROVAL_KIND_KEY] !== MCP_TOOL_APPROVAL_KIND || !isJsonObject(requestParams.requestedSchema)) return;
 	const requestedSchema = requestParams.requestedSchema;
 	if (readString(requestedSchema, "type") !== "object" || !isJsonObject(requestedSchema.properties)) return;
 	const title = sanitizeDisplayText(readString(requestParams, "message") ?? "") || "Codex MCP tool approval";
@@ -952,12 +1006,12 @@ function readBridgeableApprovalElicitation(requestParams) {
 		title,
 		description: buildApprovalDescription({
 			title,
-			meta: requestParams._meta,
+			meta: requestParams["_meta"],
 			requestedSchema,
 			serverName: sanitizeOptionalDisplayText(readString(requestParams, "serverName"))
 		}),
 		requestedSchema,
-		meta: requestParams._meta
+		meta: requestParams["_meta"]
 	};
 }
 function buildApprovalDescription(params) {
@@ -1322,4 +1376,4 @@ function filterToolsForVisionInputs(tools, params) {
 	return tools.filter((tool) => tool.name !== "image");
 }
 //#endregion
-export { handleCodexAppServerElicitationRequest as a, buildCodexNativeHookRelayDisabledConfig as i, CODEX_NATIVE_HOOK_RELAY_EVENTS as n, handleCodexAppServerApprovalRequest as o, buildCodexNativeHookRelayConfig as r, filterToolsForVisionInputs as t };
+export { handleCodexAppServerElicitationRequest as a, emitDynamicToolTerminalDiagnostic as c, buildCodexNativeHookRelayDisabledConfig as i, handleCodexAppServerApprovalRequest as l, CODEX_NATIVE_HOOK_RELAY_EVENTS as n, emitDynamicToolErrorDiagnostic as o, buildCodexNativeHookRelayConfig as r, emitDynamicToolStartedDiagnostic as s, filterToolsForVisionInputs as t };

package/openclaw.plugin.json

@@ -161,6 +161,10 @@
             "type": "array",
             "items": { "type": "string" }
           },
+          "codeModeOnly": {
+            "type": "boolean",
+            "default": false
+          },
           "requestTimeoutMs": {
             "type": "number",
             "minimum": 1,
@@ -326,6 +330,11 @@
       "help": "Environment variable names removed from the spawned stdio app-server process after overrides are applied.",
       "advanced": true
     },
+    "appServer.codeModeOnly": {
+      "label": "Code Mode Only",
+      "help": "Expose Codex's code-mode-only tool surface. OpenClaw dynamic tools remain available through Codex nested tool calls.",
+      "advanced": true
+    },
     "appServer.requestTimeoutMs": {
       "label": "Request Timeout",
       "help": "Maximum time to wait for Codex app-server control-plane requests.",