@openclaw/codex 2026.5.24-beta.1 → 2026.5.25-beta.1

package/dist/{run-attempt-CT1N__qp.js → run-attempt-BjoI3hUJ.js}

@@ -1,21 +1,21 @@
-import { c as readCodexPluginConfig, d as resolveCodexPluginsPolicy, f as withMcpElicitationsApprovalPolicy, i as isCodexAppServerApprovalPolicyAllowedByRequirements, l as resolveCodexAppServerRuntimeOptions, o as isCodexSandboxExecServerEnabled, u as resolveCodexComputerUseConfig } from "./config-DDMrwfJl.js";
+import { t as defaultCodexAppServerClientFactory } from "./client-factory-A7DQkSLq.js";
+import { c as readCodexPluginConfig, d as resolveCodexPluginsPolicy, f as shouldAutoApproveCodexAppServerApprovals, i as isCodexAppServerApprovalPolicyAllowedByRequirements, l as resolveCodexAppServerRuntimeOptions, o as isCodexSandboxExecServerEnabled, p as withMcpElicitationsApprovalPolicy, u as resolveCodexComputerUseConfig } from "./config-D6TUuyo2.js";
 import { a as readCodexDynamicToolCallParams, c as readCodexTurn, i as assertCodexTurnStartResponse } from "./protocol-validators-_gKDcd0x.js";
-import { t as isJsonObject } from "./protocol-oeJQu4rs.js";
-import { a as isCodexAppServerConnectionClosedError, i as isCodexAppServerApprovalRequest, r as compareCodexAppServerVersions, s as MIN_CODEX_SANDBOX_EXEC_SERVER_APP_SERVER_VERSION } from "./client-1sSy4p3z.js";
-import { C as sanitizeCodexHistoryImagePayloads, D as resolveCodexContextEngineProjectionMaxChars, E as projectContextEngineAssemblyForCodex, O as resolveCodexContextEngineProjectionReserveTokens, _ as shouldBuildCodexPluginThreadConfig, c as buildTurnStartParams, g as mergeCodexThreadConfigs, h as buildCodexPluginThreadConfigInputFingerprint, i as buildDeveloperInstructions, l as codexDynamicToolsFingerprint, m as buildCodexPluginThreadConfig, p as startOrResumeThread, r as buildContextEngineBinding, s as buildTurnCollaborationMode, t as areCodexDynamicToolFingerprintsCompatible, u as isContextEngineBindingCompatible, x as defaultCodexAppInventoryCache } from "./thread-lifecycle-DGoaguJh.js";
-import { i as readCodexAppServerBinding, t as clearCodexAppServerBinding } from "./session-binding-Bw_mfIW2.js";
-import { n as buildCodexPluginAppCacheKey, r as CODEX_CONTROL_METHODS } from "./request-D93E78SA.js";
-import { g as shouldRefreshCodexRateLimitsForUsageLimitMessage, h as resolveCodexUsageLimitResetAtMs, i as readCodexNotificationTurnId, m as formatCodexUsageLimitErrorMessage, n as isCodexNotificationForTurn, r as readCodexNotificationThreadId, s as formatCodexDisplayText, t as describeCodexNotificationCorrelation } from "./notification-correlation-qKY_sgga.js";
-import { c as resolveCodexAppServerAuthAccountCacheKey, d as resolveCodexAppServerEnvApiKeyCacheKey, f as resolveCodexAppServerHomeDir, l as resolveCodexAppServerAuthProfileId, s as refreshCodexAppServerAuthTokens, t as clearSharedCodexAppServerClientIfCurrent, u as resolveCodexAppServerAuthProfileIdForAgent } from "./shared-client-CFCUGEVs.js";
+import { a as isCodexAppServerConnectionClosedError, i as isCodexAppServerApprovalRequest, l as isJsonObject, r as compareCodexAppServerVersions, s as MIN_CODEX_SANDBOX_EXEC_SERVER_APP_SERVER_VERSION } from "./client-SrtuTTVa.js";
+import { D as resolveCodexContextEngineProjectionMaxChars, E as projectContextEngineAssemblyForCodex, O as resolveCodexContextEngineProjectionReserveTokens, S as defaultCodexAppInventoryCache, _ as mergeCodexThreadConfigs, a as buildDeveloperInstructions, c as buildTurnCollaborationMode, d as isContextEngineBindingCompatible, g as buildCodexPluginThreadConfigInputFingerprint, h as buildCodexPluginThreadConfig, i as buildContextEngineBinding, l as buildTurnStartParams, m as startOrResumeThread, n as areCodexDynamicToolFingerprintsCompatible, u as codexDynamicToolsFingerprint, v as shouldBuildCodexPluginThreadConfig, w as sanitizeCodexHistoryImagePayloads } from "./thread-lifecycle-CXMd9UgJ.js";
+import { i as readCodexAppServerBinding, t as clearCodexAppServerBinding } from "./session-binding-CwNOIDP2.js";
+import { n as buildCodexPluginAppCacheKey, r as CODEX_CONTROL_METHODS } from "./request-BO0z3vA8.js";
+import { g as shouldRefreshCodexRateLimitsForUsageLimitMessage, h as resolveCodexUsageLimitResetAtMs, i as readCodexNotificationTurnId, m as formatCodexUsageLimitErrorMessage, n as isCodexNotificationForTurn, r as readCodexNotificationThreadId, s as formatCodexDisplayText, t as describeCodexNotificationCorrelation } from "./notification-correlation-D7tJW3FW.js";
+import { c as resolveCodexAppServerAuthAccountCacheKey, d as resolveCodexAppServerEnvApiKeyCacheKey, f as resolveCodexAppServerHomeDir, l as resolveCodexAppServerAuthProfileId, s as refreshCodexAppServerAuthTokens, t as clearSharedCodexAppServerClientIfCurrent, u as resolveCodexAppServerAuthProfileIdForAgent } from "./shared-client-CZP1DjaN.js";
 import { i as resolveCodexNativeExecutionPolicy } from "./sandbox-guard-CTnEWuor.js";
-import { a as resolveCodexDynamicToolsLoading, i as normalizeCodexDynamicToolName, n as filterCodexDynamicTools, r as isForcedPrivateQaCodexRuntime, t as createCodexDynamicToolBridge } from "./dynamic-tools-Bq717oJR.js";
-import { t as defaultCodexAppServerClientFactory } from "./client-factory-Bk6i4FnW.js";
-import { a as handleCodexAppServerElicitationRequest, c as emitDynamicToolTerminalDiagnostic, i as buildCodexNativeHookRelayDisabledConfig, l as handleCodexAppServerApprovalRequest, n as CODEX_NATIVE_HOOK_RELAY_EVENTS, o as emitDynamicToolErrorDiagnostic, r as buildCodexNativeHookRelayConfig, s as emitDynamicToolStartedDiagnostic, t as filterToolsForVisionInputs } from "./vision-tools-DOnxzH2y.js";
-import { t as ensureCodexComputerUse } from "./computer-use-Hdq1WgTA.js";
+import { a as resolveCodexDynamicToolsLoading, i as normalizeCodexDynamicToolName, n as filterCodexDynamicTools, r as isForcedPrivateQaCodexRuntime, t as createCodexDynamicToolBridge } from "./dynamic-tools-BXAE1U1-.js";
+import { a as handleCodexAppServerElicitationRequest, c as emitDynamicToolTerminalDiagnostic, i as buildCodexNativeHookRelayDisabledConfig, l as handleCodexAppServerApprovalRequest, n as CODEX_NATIVE_HOOK_RELAY_EVENTS, o as emitDynamicToolErrorDiagnostic, r as buildCodexNativeHookRelayConfig, s as emitDynamicToolStartedDiagnostic, t as filterToolsForVisionInputs } from "./vision-tools-CETeQgze.js";
+import { t as ensureCodexComputerUse } from "./computer-use-CVfE2Vfb.js";
 import { n as rememberCodexRateLimits, t as readRecentCodexRateLimits } from "./rate-limit-cache-N66I-Rd7.js";
 import { createHash, randomUUID } from "node:crypto";
 import nodeFs from "node:fs";
-import { CODEX_APP_SERVER_CONTEXT_ENGINE_HOST, PREEMPTIVE_OVERFLOW_ERROR_TEXT, TOOL_PROGRESS_OUTPUT_MAX_CHARS, acquireSessionWriteLock, appendSessionTranscriptMessage, assembleHarnessContextEngine, assertContextEngineHostSupport, awaitAgentHarnessAgentEndHook, bootstrapHarnessContextEngine, buildAgentHookContextChannelFields, buildEmbeddedAttemptToolRunContext, buildHarnessContextEngineRuntimeContext, buildHarnessContextEngineRuntimeContextFromUsage, classifyAgentHarnessTerminalOutcome, clearActiveEmbeddedRun, compactContextEngineWithSafetyTimeout, embeddedAgentLog, emitAgentEvent, emitSessionTranscriptUpdate, estimateRenderedLlmBoundaryTokenPressure, finalizeHarnessContextEngineTurn, formatErrorMessage, formatPrePromptPrecheckLog, formatToolAggregate, formatToolProgressOutput, hasBeforeToolCallPolicy, inferToolMetaFromArgs, isActiveHarnessContextEngine, isSubagentSessionKey, loadCodexBundleMcpThreadConfig, normalizeAgentRuntimeTools, normalizeUsage, registerNativeHookRelay, resolveAgentHarnessBeforePromptBuildResult, resolveAttemptSpawnWorkspaceDir, resolveBootstrapContextForRun, resolveCompactionTimeoutMs, resolveContextEngineOwnerPluginId, resolveModelAuthMode, resolveSandboxContext, resolveSessionAgentIds, resolveSessionWriteLockOptions, resolveUserPath, runAgentCleanupStep, runAgentHarnessAfterCompactionHook, runAgentHarnessAfterToolCallHook, runAgentHarnessAgentEndHook, runAgentHarnessBeforeCompactionHook, runAgentHarnessBeforeMessageWriteHook, runAgentHarnessLlmInputHook, runAgentHarnessLlmOutputHook, runHarnessContextEngineMaintenance, setActiveEmbeddedRun, shouldPreemptivelyCompactBeforePrompt, supportsModelTools } from "openclaw/plugin-sdk/agent-harness-runtime";
+import { asBoolean, asFiniteNumber, normalizeOptionalString, normalizeStringEntries } from "openclaw/plugin-sdk/string-coerce-runtime";
+import { CODEX_APP_SERVER_CONTEXT_ENGINE_HOST, TOOL_PROGRESS_OUTPUT_MAX_CHARS, acquireSessionWriteLock, appendSessionTranscriptMessage, assembleHarnessContextEngine, assertContextEngineHostSupport, awaitAgentHarnessAgentEndHook, bootstrapHarnessContextEngine, buildAgentHookContextChannelFields, buildEmbeddedAttemptToolRunContext, buildHarnessContextEngineRuntimeContext, buildHarnessContextEngineRuntimeContextFromUsage, classifyAgentHarnessTerminalOutcome, clearActiveEmbeddedRun, embeddedAgentLog, emitAgentEvent, emitSessionTranscriptUpdate, finalizeHarnessContextEngineTurn, formatErrorMessage, formatToolAggregate, formatToolProgressOutput, getBeforeToolCallPolicyDiagnosticState, inferToolMetaFromArgs, isActiveHarnessContextEngine, isSubagentSessionKey, loadCodexBundleMcpThreadConfig, normalizeAgentRuntimeTools, normalizeUsage, registerNativeHookRelay, resolveAgentHarnessBeforePromptBuildResult, resolveAttemptSpawnWorkspaceDir, resolveBootstrapContextForRun, resolveContextEngineOwnerPluginId, resolveModelAuthMode, resolveSandboxContext, resolveSessionAgentIds, resolveSessionWriteLockOptions, resolveUserPath, runAgentCleanupStep, runAgentHarnessAfterCompactionHook, runAgentHarnessAfterToolCallHook, runAgentHarnessAgentEndHook, runAgentHarnessBeforeCompactionHook, runAgentHarnessBeforeMessageWriteHook, runAgentHarnessLlmInputHook, runAgentHarnessLlmOutputHook, runHarnessContextEngineMaintenance, setActiveEmbeddedRun, supportsModelTools } from "openclaw/plugin-sdk/agent-harness-runtime";
 import { spawn } from "node:child_process";
 import { once } from "node:events";
 import { WebSocketServer } from "ws";
@@ -25,7 +25,7 @@ import path, { posix } from "node:path";
 import { markAuthProfileBlockedUntil, resolveAgentDir as resolveAgentDir$1 } from "openclaw/plugin-sdk/agent-runtime";
 import { isToolAllowed } from "openclaw/plugin-sdk/sandbox";
 import { appendRegularFile, pathExists } from "openclaw/plugin-sdk/security-runtime";
-import { emitTrustedDiagnosticEvent, hasPendingInternalDiagnosticEvent, onInternalDiagnosticEvent } from "openclaw/plugin-sdk/diagnostic-runtime";
+import { createDiagnosticTraceContextFromActiveScope, emitTrustedDiagnosticEvent, emitTrustedDiagnosticEventWithPrivateData, freezeDiagnosticTraceContext, hasPendingInternalDiagnosticEvent, onInternalDiagnosticEvent, resolveDiagnosticModelContentCapturePolicy } from "openclaw/plugin-sdk/diagnostic-runtime";
 import { buildSessionContext, migrateSessionEntries, parseSessionEntries } from "@earendil-works/pi-coding-agent";
 import { createAgentHarnessTaskRuntime, deliverAgentHarnessTaskCompletion, isDurableAgentHarnessCompletionDelivery } from "openclaw/plugin-sdk/agent-harness-task-runtime";
 import { isIP } from "node:net";
@@ -102,10 +102,6 @@ function inferCodexDynamicToolMeta(call, detailMode) {
 //#endregion
 //#region extensions/codex/src/app-server/transcript-mirror.ts
 const MIRROR_IDENTITY_META_KEY = "mirrorIdentity";
-function normalizeOptionalString$1(value) {
-	const normalized = value?.trim();
-	return normalized ? normalized : void 0;
-}
 function buildSenderLabel(params) {
 	const label = params.senderName ?? params.senderUsername ?? params.senderE164 ?? params.senderId;
 	if (!label) return;
@@ -113,17 +109,17 @@ function buildSenderLabel(params) {
 	return `${label} (${params.senderId})`;
 }
 function buildCodexUserPromptMessage(params) {
-	const senderId = normalizeOptionalString$1(params.senderId);
-	const senderName = normalizeOptionalString$1(params.senderName);
-	const senderUsername = normalizeOptionalString$1(params.senderUsername);
-	const senderE164 = normalizeOptionalString$1(params.senderE164);
+	const senderId = normalizeOptionalString(params.senderId);
+	const senderName = normalizeOptionalString(params.senderName);
+	const senderUsername = normalizeOptionalString(params.senderUsername);
+	const senderE164 = normalizeOptionalString(params.senderE164);
 	const senderLabel = buildSenderLabel({
 		senderId,
 		senderName,
 		senderUsername,
 		senderE164
 	});
-	const sourceChannel = normalizeOptionalString$1(params.inputProvenance?.sourceChannel ?? params.messageChannel ?? params.messageProvider);
+	const sourceChannel = normalizeOptionalString(params.inputProvenance?.sourceChannel ?? params.messageChannel ?? params.messageProvider);
 	return {
 		role: "user",
 		content: params.prompt,
@@ -183,12 +179,14 @@ async function mirrorCodexAppServerTranscript(params) {
 		sessionFile: params.sessionFile,
 		...resolveSessionWriteLockOptions(params.config)
 	});
+	const appendedUpdates = [];
 	try {
-		const existingIdempotencyKeys = await readTranscriptIdempotencyKeys(params.sessionFile);
+		const mirrorState = await readTranscriptMirrorState(params.sessionFile);
+		let nextMessageSeq = mirrorState.messageCount;
 		for (const message of messages) {
 			const dedupeIdentity = buildMirrorDedupeIdentity(message);
 			const idempotencyKey = params.idempotencyScope ? `${params.idempotencyScope}:${dedupeIdentity}` : void 0;
-			if (idempotencyKey && existingIdempotencyKeys.has(idempotencyKey)) continue;
+			if (idempotencyKey && mirrorState.idempotencyKeys.has(idempotencyKey)) continue;
 			const nextMessage = runAgentHarnessBeforeMessageWriteHook({
 				message: {
 					...message,
@@ -202,41 +200,57 @@ async function mirrorCodexAppServerTranscript(params) {
 				...nextMessage,
 				idempotencyKey
 			} : nextMessage;
-			await appendSessionTranscriptMessage({
+			const { messageId, message: appendedMessage } = await appendSessionTranscriptMessage({
 				transcriptPath: params.sessionFile,
 				message: messageToAppend,
 				config: params.config
 			});
-			if (idempotencyKey) existingIdempotencyKeys.add(idempotencyKey);
+			nextMessageSeq += 1;
+			appendedUpdates.push({
+				messageId,
+				message: appendedMessage,
+				messageSeq: nextMessageSeq
+			});
+			if (idempotencyKey) mirrorState.idempotencyKeys.add(idempotencyKey);
 		}
 	} finally {
 		await lock.release();
 	}
-	if (params.sessionKey) emitSessionTranscriptUpdate({
+	for (const update of appendedUpdates) emitSessionTranscriptUpdate({
 		sessionFile: params.sessionFile,
-		sessionKey: params.sessionKey
+		...params.sessionKey ? { sessionKey: params.sessionKey } : {},
+		message: update.message,
+		messageId: update.messageId,
+		messageSeq: update.messageSeq
 	});
-	else emitSessionTranscriptUpdate(params.sessionFile);
 }
-async function readTranscriptIdempotencyKeys(sessionFile) {
-	const keys = /* @__PURE__ */ new Set();
+async function readTranscriptMirrorState(sessionFile) {
+	const idempotencyKeys = /* @__PURE__ */ new Set();
+	let messageCount = 0;
 	let raw;
 	try {
 		raw = await fs.readFile(sessionFile, "utf8");
 	} catch (error) {
 		if (error.code !== "ENOENT") throw error;
-		return keys;
+		return {
+			idempotencyKeys,
+			messageCount
+		};
 	}
 	for (const line of raw.split(/\r?\n/)) {
 		if (!line.trim()) continue;
 		try {
 			const parsed = JSON.parse(line);
-			if (typeof parsed.message?.idempotencyKey === "string") keys.add(parsed.message.idempotencyKey);
+			if (parsed.type === "message") messageCount += 1;
+			if (typeof parsed.message?.idempotencyKey === "string") idempotencyKeys.add(parsed.message.idempotencyKey);
 		} catch {
 			continue;
 		}
 	}
-	return keys;
+	return {
+		idempotencyKeys,
+		messageCount
+	};
 }
 //#endregion
 //#region extensions/codex/src/app-server/event-projector.ts
@@ -463,6 +477,12 @@ var CodexAppServerEventProjector = class {
 		});
 	}
 	recordDynamicToolResult(params) {
+		const existingMeta = this.toolMetas.get(params.callId);
+		this.toolMetas.set(params.callId, {
+			toolName: params.tool,
+			...existingMeta?.meta ? { meta: existingMeta.meta } : {},
+			...existingMeta?.asyncStarted === true || params.asyncStarted === true ? { asyncStarted: true } : {}
+		});
 		this.recordToolTranscriptResult({
 			id: params.callId,
 			name: params.tool,
@@ -832,7 +852,7 @@ var CodexAppServerEventProjector = class {
 		if (savedPath) this.nativeGeneratedMediaUrls.add(savedPath);
 	}
 	buildToolMediaUrls(toolTelemetry) {
-		const mediaUrls = new Set(toolTelemetry.toolMediaUrls?.map((url) => url.trim()).filter(Boolean) ?? []);
+		const mediaUrls = new Set(normalizeStringEntries(toolTelemetry.toolMediaUrls ?? []));
 		if ((toolTelemetry.messagingToolSentMediaUrls?.length ?? 0) === 0) for (const mediaUrl of this.nativeGeneratedMediaUrls) mediaUrls.add(mediaUrl);
 		return mediaUrls.size > 0 ? [...mediaUrls] : toolTelemetry.toolMediaUrls;
 	}
@@ -1118,9 +1138,11 @@ var CodexAppServerEventProjector = class {
 		const toolName = itemName(item);
 		if (!toolName) return;
 		const meta = itemMeta(item, this.toolProgressDetailMode());
+		const existingMeta = this.toolMetas.get(item.id);
 		this.toolMetas.set(item.id, {
 			toolName,
-			...meta ? { meta } : {}
+			...meta ? { meta } : {},
+			...existingMeta?.asyncStarted === true ? { asyncStarted: true } : {}
 		});
 		if (isSideEffectingNativeToolItem(item)) this.sideEffectingToolItemIds.add(item.id);
 		else this.sideEffectingToolItemIds.delete(item.id);
@@ -1364,12 +1386,10 @@ function readNullableString$1(record, key) {
 	return typeof value === "string" ? value : void 0;
 }
 function readNumber$1(record, key) {
-	const value = record[key];
-	return typeof value === "number" && Number.isFinite(value) ? value : void 0;
+	return asFiniteNumber(record[key]);
 }
 function readBoolean$1(record, key) {
-	const value = record[key];
-	return typeof value === "boolean" ? value : void 0;
+	return asBoolean(record[key]);
 }
 function readBooleanAlias(record, keys) {
 	for (const key of keys) {
@@ -2616,9 +2636,6 @@ function readString$2(record, key) {
 	const value = record?.[key];
 	return typeof value === "string" ? value : void 0;
 }
-function normalizeOptionalString(value) {
-	return value?.trim() || void 0;
-}
 function readStringArray(value) {
 	if (!Array.isArray(value)) return [];
 	return value.filter((entry) => typeof entry === "string" && entry.trim() !== "");
@@ -2741,8 +2758,7 @@ function readTranscriptParentThreadId(payload) {
 	return readString$2(isJsonObject(subagent?.thread_spawn) ? subagent.thread_spawn : void 0, "parent_thread_id")?.trim();
 }
 function readNumber(record, key) {
-	const value = record[key];
-	return typeof value === "number" && Number.isFinite(value) ? value : void 0;
+	return asFiniteNumber(record[key]);
 }
 function secondsToMillis(value) {
 	return value === void 0 ? void 0 : Math.round(value * 1e3);
@@ -4669,6 +4685,13 @@ function readCodexAppServerRolloutTokenUsageLine(line) {
 		return;
 	}
 }
+function utf8JsonByteLength(value) {
+	try {
+		return Buffer.byteLength(JSON.stringify(value), "utf8");
+	} catch {
+		return;
+	}
+}
 function maxFiniteNumber(values) {
 	const nums = values.filter((value) => typeof value === "number" && Number.isFinite(value));
 	if (nums.length === 0) return;
@@ -4724,10 +4747,18 @@ async function runCodexAgentEndHook(params, hookParams) {
 }
 async function runCodexAppServerAttempt(params, options = {}) {
 	const attemptStartedAt = Date.now();
+	const codexModelCallTrace = freezeDiagnosticTraceContext(createDiagnosticTraceContextFromActiveScope());
+	const codexModelContentCapture = resolveDiagnosticModelContentCapturePolicy(params.config);
+	const codexModelCallId = `${params.runId}:codex-model:1`;
+	let codexModelCallStartedAt = attemptStartedAt;
+	let codexModelCallStarted = false;
+	let codexModelCallTerminalEmitted = false;
+	let codexModelCallRequestPayloadBytes;
 	const attemptClientFactory = options.clientFactory ?? defaultCodexAppServerClientFactory;
 	const pluginConfig = readCodexPluginConfig(options.pluginConfig);
 	const computerUseConfig = resolveCodexComputerUseConfig({ pluginConfig });
 	const configuredAppServer = resolveCodexAppServerRuntimeOptions({ pluginConfig });
+	const beforeToolCallPolicy = getBeforeToolCallPolicyDiagnosticState();
 	const resolvedWorkspace = resolveUserPath(params.workspaceDir);
 	await fs.mkdir(resolvedWorkspace, { recursive: true });
 	const sandboxSessionKey = params.sandboxSessionKey?.trim() || params.sessionKey?.trim() || params.sessionId;
@@ -4743,9 +4774,15 @@ async function runCodexAppServerAttempt(params, options = {}) {
 		appServer: configuredAppServer,
 		pluginConfig,
 		env: process.env,
-		shouldPromote: hasBeforeToolCallPolicy(),
+		shouldPromote: beforeToolCallPolicy.hasBeforeToolCallHook || beforeToolCallPolicy.trustedToolPolicies.length > 0,
 		canUseUntrustedApprovalPolicy: configuredAppServer.start.transport !== "stdio" || isCodexAppServerApprovalPolicyAllowedByRequirements("untrusted")
 	});
+	if (configuredAppServer.approvalPolicy === "never" && appServer.approvalPolicy === "untrusted") embeddedAgentLog.info("codex app-server approval policy promoted for OpenClaw tool policy", {
+		from: "never",
+		to: "untrusted",
+		beforeToolCallHook: beforeToolCallPolicy.hasBeforeToolCallHook,
+		trustedToolPolicies: beforeToolCallPolicy.trustedToolPolicies
+	});
 	let pluginAppServer = appServer;
 	const nativeHookRelayEvents = resolveCodexNativeHookRelayEvents({
 		configuredEvents: options.nativeHookRelay?.events,
@@ -4794,10 +4831,6 @@ async function runCodexAppServerAttempt(params, options = {}) {
 		sessionId: activeSessionId,
 		sessionFile: activeSessionFile
 	});
-	const adoptContextEngineCompactionTranscript = (compactResult) => {
-		if (compactResult.result?.sessionId) activeSessionId = compactResult.result.sessionId;
-		if (compactResult.result?.sessionFile) activeSessionFile = compactResult.result.sessionFile;
-	};
 	const startupAuthAccountCacheKey = await resolveCodexAppServerAuthAccountCacheKey({
 		authProfileId: startupAuthProfileId,
 		authProfileStore: params.authProfileStore,
@@ -4832,21 +4865,22 @@ async function runCodexAppServerAttempt(params, options = {}) {
 	});
 	const hookChannelId = resolveCodexAppServerHookChannelId(params, sandboxSessionKey);
 	let yieldDetected = false;
+	const tools = await buildDynamicTools({
+		params,
+		resolvedWorkspace,
+		effectiveWorkspace,
+		sandboxSessionKey,
+		sandbox,
+		nativeToolSurfaceEnabled,
+		runAbortController,
+		sessionAgentId,
+		pluginConfig,
+		onYieldDetected: () => {
+			yieldDetected = true;
+		}
+	});
 	const toolBridge = createCodexDynamicToolBridge({
-		tools: await buildDynamicTools({
-			params,
-			resolvedWorkspace,
-			effectiveWorkspace,
-			sandboxSessionKey,
-			sandbox,
-			nativeToolSurfaceEnabled,
-			runAbortController,
-			sessionAgentId,
-			pluginConfig,
-			onYieldDetected: () => {
-				yieldDetected = true;
-			}
-		}),
+		tools,
 		registeredTools: await buildDynamicTools({
 			params,
 			resolvedWorkspace,
@@ -4902,65 +4936,6 @@ async function runCodexAppServerAttempt(params, options = {}) {
 		contextEnginePluginId: activeContextEnginePluginId,
 		tokenBudget: params.contextTokenBudget
 	});
-	const forceContextEngineCompactionForCodexOverflow = async (error, options = {}) => {
-		if (!activeContextEngine?.info.ownsCompaction) return false;
-		embeddedAgentLog.warn("codex app-server context-engine prompt overflowed; forcing context-engine compaction", {
-			sessionId: activeSessionId,
-			sessionKey: contextSessionKey,
-			...options.threadId ? { threadId: options.threadId } : {},
-			engineId: activeContextEngine.info.id,
-			tokenBudget: params.contextTokenBudget,
-			error: formatErrorMessage(error)
-		});
-		try {
-			const runtimeContext = buildActiveContextEngineRuntimeContext();
-			const overflowTokenCount = params.contextTokenBudget ?? params.contextWindowInfo?.tokens;
-			const compactResult = await compactContextEngineWithSafetyTimeout(activeContextEngine, {
-				sessionId: activeSessionId,
-				sessionKey: contextSessionKey,
-				sessionFile: activeSessionFile,
-				tokenBudget: params.contextTokenBudget,
-				force: true,
-				...overflowTokenCount ? { currentTokenCount: overflowTokenCount } : {},
-				compactionTarget: "threshold",
-				runtimeContext: overflowTokenCount ? {
-					...runtimeContext,
-					currentTokenCount: overflowTokenCount
-				} : runtimeContext
-			}, resolveCompactionTimeoutMs(params.config), runAbortController.signal);
-			embeddedAgentLog.info("codex app-server context-engine forced compaction result", {
-				sessionId: activeSessionId,
-				sessionKey: contextSessionKey,
-				engineId: activeContextEngine.info.id,
-				ok: compactResult.ok,
-				compacted: compactResult.compacted,
-				reason: compactResult.reason,
-				tokensBefore: compactResult.result?.tokensBefore,
-				tokensAfter: compactResult.result?.tokensAfter
-			});
-			if (!compactResult.ok || !compactResult.compacted) return false;
-			adoptContextEngineCompactionTranscript(compactResult);
-			const maintenanceRuntimeContext = buildActiveContextEngineRuntimeContext();
-			await runHarnessContextEngineMaintenance({
-				contextEngine: activeContextEngine,
-				sessionId: activeSessionId,
-				sessionKey: contextSessionKey,
-				sessionFile: activeSessionFile,
-				reason: "compaction",
-				runtimeContext: maintenanceRuntimeContext,
-				config: params.config
-			});
-			return true;
-		} catch (compactErr) {
-			embeddedAgentLog.warn("codex app-server context-engine forced compaction failed", {
-				sessionId: params.sessionId,
-				sessionKey: contextSessionKey,
-				engineId: activeContextEngine.info.id,
-				error: formatErrorMessage(compactErr)
-			});
-			return false;
-		}
-	};
 	if (activeContextEngine) {
 		await bootstrapHarnessContextEngine({
 			hadSessionFile,
@@ -4992,12 +4967,6 @@ async function runCodexAppServerAttempt(params, options = {}) {
 	let developerInstructions = baseDeveloperInstructions;
 	let prePromptMessageCount = historyMessages.length;
 	let contextEngineProjection;
-	const resetCodexPromptInputs = () => {
-		promptText = params.prompt;
-		developerInstructions = baseDeveloperInstructions;
-		prePromptMessageCount = historyMessages.length;
-		contextEngineProjection = void 0;
-	};
 	const applyActiveContextEngineProjection = async (decisionStartupBinding) => {
 		if (!activeContextEngine) return;
 		const assembled = await assembleHarnessContextEngine({
@@ -5082,78 +5051,11 @@ async function runCodexAppServerAttempt(params, options = {}) {
 	let promptBuild = await buildPromptFromCurrentInputs();
 	const decorateCodexTurnPromptText = (prompt) => prependCodexOpenClawPromptContext(prompt, openClawPromptContext);
 	let codexTurnPromptText = decorateCodexTurnPromptText(promptBuild.prompt);
-	const refreshCodexTurnPromptText = () => {
-		codexTurnPromptText = decorateCodexTurnPromptText(promptBuild.prompt);
-	};
 	const buildCodexTurnCollaborationDeveloperInstructions = () => buildTurnCollaborationMode(params, {
 		turnScopedDeveloperInstructions: workspaceBootstrapContext.turnScopedDeveloperInstructions,
 		heartbeatCollaborationInstructions: workspaceBootstrapContext.heartbeatCollaborationInstructions
 	}).settings.developer_instructions ?? void 0;
 	const buildRenderedCodexDeveloperInstructions = () => joinPresentSections(promptBuild.developerInstructions, buildCodexTurnCollaborationDeveloperInstructions());
-	const rebuildPromptAfterContextEngineCompaction = async () => {
-		historyMessages = await readMirroredSessionHistoryMessages(activeSessionFile) ?? historyMessages;
-		resetCodexPromptInputs();
-		try {
-			await applyActiveContextEngineProjection(void 0);
-		} catch (assembleErr) {
-			embeddedAgentLog.warn("context engine assemble failed after forced compaction; using Codex baseline prompt", { error: formatErrorMessage(assembleErr) });
-		}
-		promptBuild = await buildPromptFromCurrentInputs();
-		refreshCodexTurnPromptText();
-	};
-	const buildCodexProviderBoundaryPrecheck = () => {
-		const contextTokenBudget = typeof params.contextTokenBudget === "number" && Number.isFinite(params.contextTokenBudget) ? Math.floor(params.contextTokenBudget) : typeof params.contextWindowInfo?.tokens === "number" && Number.isFinite(params.contextWindowInfo.tokens) ? Math.floor(params.contextWindowInfo.tokens) : void 0;
-		if (!contextTokenBudget || contextTokenBudget <= 0) return;
-		const reserveTokens = resolveCodexContextEngineProjectionReserveTokens({ config: params.config }) ?? 2e4;
-		const renderedDeveloperInstructions = buildRenderedCodexDeveloperInstructions();
-		const renderedChars = codexTurnPromptText.length + renderedDeveloperInstructions.length;
-		return shouldPreemptivelyCompactBeforePrompt({
-			messages: historyMessages,
-			systemPrompt: renderedDeveloperInstructions,
-			prompt: codexTurnPromptText,
-			contextTokenBudget,
-			reserveTokens,
-			llmBoundaryTokenPressure: {
-				estimatedPromptTokens: estimateRenderedLlmBoundaryTokenPressure({
-					systemPrompt: renderedDeveloperInstructions,
-					prompt: codexTurnPromptText
-				}),
-				source: "codex_app_server_rendered_prompt",
-				renderedChars
-			}
-		});
-	};
-	const maybeCompactContextEngineForProviderBoundaryPrecheck = async () => {
-		if (!activeContextEngine?.info.ownsCompaction || !contextEngineProjection) return;
-		const precheck = buildCodexProviderBoundaryPrecheck();
-		if (!precheck) return;
-		embeddedAgentLog.debug(formatPrePromptPrecheckLog({
-			result: precheck,
-			provider: params.provider,
-			modelId: params.modelId,
-			messageCount: historyMessages.length,
-			contextTokenBudget: typeof params.contextTokenBudget === "number" ? params.contextTokenBudget : params.contextWindowInfo?.tokens ?? 0,
-			reserveTokens: resolveCodexContextEngineProjectionReserveTokens({ config: params.config }) ?? 2e4,
-			...contextSessionKey ? { sessionKey: contextSessionKey } : {},
-			...activeSessionId ? { sessionId: activeSessionId } : {},
-			...activeSessionFile ? { sessionFile: activeSessionFile } : {}
-		}));
-		if (precheck.route === "fits") return;
-		if (!await forceContextEngineCompactionForCodexOverflow(PREEMPTIVE_OVERFLOW_ERROR_TEXT)) throw new Error(PREEMPTIVE_OVERFLOW_ERROR_TEXT);
-		await rebuildPromptAfterContextEngineCompaction();
-		const afterCompactionPrecheck = buildCodexProviderBoundaryPrecheck();
-		if (!afterCompactionPrecheck || afterCompactionPrecheck.route === "fits") return;
-		embeddedAgentLog.warn("codex app-server provider-boundary precheck still overflowed after compaction", {
-			sessionId: activeSessionId,
-			sessionKey: contextSessionKey,
-			route: afterCompactionPrecheck.route,
-			estimatedPromptTokens: afterCompactionPrecheck.estimatedPromptTokens,
-			promptBudgetBeforeReserve: afterCompactionPrecheck.promptBudgetBeforeReserve,
-			overflowTokens: afterCompactionPrecheck.overflowTokens
-		});
-		throw new Error(PREEMPTIVE_OVERFLOW_ERROR_TEXT);
-	};
-	await maybeCompactContextEngineForProviderBoundaryPrecheck();
 	const systemPromptReport = buildCodexSystemPromptReport({
 		attempt: params,
 		sessionKey: contextSessionKey,
@@ -5990,6 +5892,7 @@ async function runCodexAppServerAttempt(params, options = {}) {
 						threadId: thread.threadId,
 						turnId,
 						nativeHookRelay,
+						autoApprove: shouldAutoApproveCodexAppServerApprovals(appServer),
 						signal: runAbortController.signal
 					});
 				}
@@ -6083,22 +5986,26 @@ async function runCodexAppServerAttempt(params, options = {}) {
 				projector?.recordDynamicToolResult({
 					callId: call.callId,
 					tool: call.tool,
+					asyncStarted: response.asyncStarted === true,
 					success: protocolResponse.success,
 					terminalType: response.diagnosticTerminalType ?? (protocolResponse.success ? "completed" : "error"),
 					sideEffectEvidence: response.sideEffectEvidence === true,
 					contentItems: protocolResponse.contentItems
 				});
-				if (shouldEmitDynamicToolProgress) emitCodexAppServerEvent(params, {
-					stream: "tool",
-					data: {
-						phase: "result",
-						name: call.tool,
-						toolCallId: call.callId,
-						...toolMeta ? { meta: toolMeta } : {},
-						isError: !protocolResponse.success,
-						result: sanitizeCodexToolResponse(protocolResponse)
-					}
-				});
+				if (shouldEmitDynamicToolProgress) {
+					const progressResponse = toCodexDynamicToolProgressResponse(response, protocolResponse);
+					emitCodexAppServerEvent(params, {
+						stream: "tool",
+						data: {
+							phase: "result",
+							name: call.tool,
+							toolCallId: call.callId,
+							...toolMeta ? { meta: toolMeta } : {},
+							isError: !protocolResponse.success,
+							result: sanitizeCodexToolResponse(progressResponse)
+						}
+					});
+				}
 				if (!terminalDiagnosticObserved && !hasPendingDynamicToolTerminalDiagnostic({
 					call,
 					runId: params.runId,
@@ -6161,27 +6068,99 @@ async function runCodexAppServerAttempt(params, options = {}) {
 		systemPrompt: buildRenderedCodexDeveloperInstructions(),
 		prompt: codexTurnPromptText,
 		historyMessages,
-		imagesCount: params.images?.length ?? 0
+		imagesCount: params.images?.length ?? 0,
+		tools
 	});
 	const buildTurnStartFailureMessages = () => [...historyMessages, buildCodexUserPromptMessage({
 		...params,
 		prompt: codexTurnPromptText
 	})];
+	const codexModelCallBaseFields = {
+		runId: params.runId,
+		callId: codexModelCallId,
+		...params.sessionKey ? { sessionKey: params.sessionKey } : {},
+		sessionId: params.sessionId,
+		provider: params.provider,
+		model: params.modelId,
+		api: params.model.api,
+		transport: appServer.start.transport,
+		...hookContextWindowFields,
+		trace: codexModelCallTrace
+	};
+	const codexDiagnosticToolDefinitions = codexModelContentCapture.toolDefinitions ? buildCodexDiagnosticToolDefinitions(tools) : void 0;
+	const codexModelContentPrivateData = (modelContent) => modelContent && Object.keys(modelContent).length > 0 ? { modelContent } : void 0;
+	const buildCodexModelCallDiagnosticContent = () => {
+		const modelContent = {
+			...codexModelContentCapture.inputMessages ? { inputMessages: buildTurnStartFailureMessages() } : {},
+			...codexModelContentCapture.systemPrompt ? { systemPrompt: buildRenderedCodexDeveloperInstructions() } : {},
+			...codexDiagnosticToolDefinitions ? { toolDefinitions: codexDiagnosticToolDefinitions } : {}
+		};
+		return Object.keys(modelContent).length > 0 ? modelContent : void 0;
+	};
+	const emitCodexModelCallStarted = () => {
+		codexModelCallStartedAt = Date.now();
+		codexModelCallStarted = true;
+		emitTrustedDiagnosticEventWithPrivateData({
+			type: "model.call.started",
+			...codexModelCallBaseFields
+		}, codexModelContentPrivateData(buildCodexModelCallDiagnosticContent()));
+	};
+	const emitCodexModelCallCompleted = (result) => {
+		if (!codexModelCallStarted || codexModelCallTerminalEmitted) return;
+		codexModelCallTerminalEmitted = true;
+		emitTrustedDiagnosticEventWithPrivateData({
+			type: "model.call.completed",
+			...codexModelCallBaseFields,
+			durationMs: Math.max(0, Date.now() - codexModelCallStartedAt),
+			...codexModelCallRequestPayloadBytes !== void 0 ? { requestPayloadBytes: codexModelCallRequestPayloadBytes } : {}
+		}, codexModelContentPrivateData({
+			...buildCodexModelCallDiagnosticContent(),
+			...codexModelContentCapture.outputMessages ? { outputMessages: result.lastAssistant ? [result.lastAssistant] : result.assistantTexts } : {}
+		}));
+	};
+	const emitCodexModelCallError = (error, fields = {}) => {
+		if (!codexModelCallStarted || codexModelCallTerminalEmitted) return;
+		codexModelCallTerminalEmitted = true;
+		emitTrustedDiagnosticEventWithPrivateData({
+			type: "model.call.error",
+			...codexModelCallBaseFields,
+			durationMs: Math.max(0, Date.now() - codexModelCallStartedAt),
+			errorCategory: fields.failureKind ?? "error",
+			...fields.failureKind ? { failureKind: fields.failureKind } : {},
+			...codexModelCallRequestPayloadBytes !== void 0 ? { requestPayloadBytes: codexModelCallRequestPayloadBytes } : {}
+		}, codexModelContentPrivateData({
+			...buildCodexModelCallDiagnosticContent(),
+			...codexModelContentCapture.outputMessages ? { outputMessages: [] } : {}
+		}));
+		embeddedAgentLog.debug("codex app-server model call diagnostic ended with error", { error: formatErrorMessage(error) });
+	};
+	const classifyCodexModelCallFailureKind = (error) => {
+		if (timedOut || turnCompletionIdleTimedOut) return "timeout";
+		const errorMessage = error ? formatErrorMessage(error).toLowerCase() : "";
+		if (errorMessage.includes("timed out") || errorMessage.includes("timeout")) return "timeout";
+		if (runAbortController.signal.aborted && !clientClosedAbort) return String(runAbortController.signal.reason ?? "").toLowerCase().includes("timeout") ? "timeout" : "aborted";
+		return errorMessage.includes("aborted") ? "aborted" : void 0;
+	};
 	let turn;
-	const startCodexTurn = async () => assertCodexTurnStartResponse(await client.request("turn/start", buildTurnStartParams(params, {
-		threadId: thread.threadId,
-		cwd: codexExecutionCwd,
-		appServer: pluginAppServer,
-		promptText: codexTurnPromptText,
-		sandboxPolicy: codexSandboxPolicy,
-		environmentSelection: codexEnvironmentSelection,
-		turnScopedDeveloperInstructions: workspaceBootstrapContext.turnScopedDeveloperInstructions,
-		heartbeatCollaborationInstructions: workspaceBootstrapContext.heartbeatCollaborationInstructions
-	}), {
-		timeoutMs: params.timeoutMs,
-		signal: runAbortController.signal
-	}));
+	const startCodexTurn = async () => {
+		const turnStartParams = buildTurnStartParams(params, {
+			threadId: thread.threadId,
+			cwd: codexExecutionCwd,
+			appServer: pluginAppServer,
+			promptText: codexTurnPromptText,
+			sandboxPolicy: codexSandboxPolicy,
+			environmentSelection: codexEnvironmentSelection,
+			turnScopedDeveloperInstructions: workspaceBootstrapContext.turnScopedDeveloperInstructions,
+			heartbeatCollaborationInstructions: workspaceBootstrapContext.heartbeatCollaborationInstructions
+		});
+		codexModelCallRequestPayloadBytes = utf8JsonByteLength(turnStartParams);
+		return assertCodexTurnStartResponse(await client.request("turn/start", turnStartParams, {
+			timeoutMs: params.timeoutMs,
+			signal: runAbortController.signal
+		}));
+	};
 	try {
+		emitCodexModelCallStarted();
 		runAgentHarnessLlmInputHook({
 			event: buildLlmInputEvent(),
 			ctx: hookContext
@@ -6207,10 +6186,8 @@ async function runCodexAppServerAttempt(params, options = {}) {
 			});
 			try {
 				const preRetrySessionFile = activeSessionFile;
-				const compactedForRetry = await forceContextEngineCompactionForCodexOverflow(turnStartError, { threadId: thread.threadId });
 				await clearCodexAppServerBinding(preRetrySessionFile);
 				if (activeSessionFile !== preRetrySessionFile) await clearCodexAppServerBinding(activeSessionFile);
-				if (compactedForRetry) await rebuildPromptAfterContextEngineCompaction();
 				thread = await restartContextEngineCodexThread();
 				emitCodexAppServerEvent(params, {
 					stream: "codex_app_server.lifecycle",
@@ -6270,6 +6247,8 @@ async function runCodexAppServerAttempt(params, options = {}) {
 				},
 				ctx: hookContext
 			});
+			const turnStartFailureKind = classifyCodexModelCallFailureKind(turnStartError);
+			emitCodexModelCallError(turnStartErrorMessage, turnStartFailureKind ? { failureKind: turnStartFailureKind } : {});
 			await runCodexAgentEndHook(params, {
 				event: {
 					messages: buildTurnStartFailureMessages(),
@@ -6303,12 +6282,12 @@ async function runCodexAppServerAttempt(params, options = {}) {
 					authProfileId: startupAuthProfileId,
 					rateLimits: usageLimitError.rateLimitsForProfile
 				});
-				return buildCodexTurnStartFailureResult({
+				return { ...buildCodexTurnStartFailureResult({
 					params,
 					message: usageLimitError.message,
 					messagesSnapshot: buildTurnStartFailureMessages(),
 					systemPromptReport
-				});
+				}) };
 			}
 			throw turnStartError;
 		}
@@ -6380,10 +6359,18 @@ async function runCodexAppServerAttempt(params, options = {}) {
 		queueMessage: async (text, options) => activeSteeringQueue.queue(text, options),
 		isStreaming: () => !completed,
 		isCompacting: () => projector?.isCompacting() ?? false,
+		sourceReplyDeliveryMode: params.sourceReplyDeliveryMode,
 		cancel: () => runAbortController.abort("cancelled"),
 		abort: () => runAbortController.abort("aborted")
 	};
 	setActiveEmbeddedRun(params.sessionId, handle, params.sessionKey);
+	mirrorPromptAtTurnStartBestEffort({
+		params,
+		agentId: sessionAgentId,
+		sessionKey: sandboxSessionKey,
+		threadId: thread.threadId,
+		turnId: activeTurnId
+	});
 	turnAttemptIdleWatchArmed = true;
 	turnTerminalIdleWatchArmed = true;
 	touchTurnCompletionActivity("turn:start", { attemptProgress: true });
@@ -6432,6 +6419,10 @@ async function runCodexAppServerAttempt(params, options = {}) {
 			result,
 			turnCompletionIdleTimedOut
 		});
+		const modelCallFailureKind = classifyCodexModelCallFailureKind(finalPromptError) ?? (finalAborted ? "aborted" : void 0);
+		if (modelCallFailureKind) emitCodexModelCallError(finalPromptError ?? "codex app-server attempt interrupted", { failureKind: modelCallFailureKind });
+		else if (finalPromptError) emitCodexModelCallError(finalPromptError);
+		else emitCodexModelCallCompleted(result);
 		recordCodexTrajectoryCompletion(trajectoryRecorder, {
 			attempt: params,
 			result,
@@ -6542,6 +6533,7 @@ async function runCodexAppServerAttempt(params, options = {}) {
 			systemPromptReport
 		};
 	} finally {
+		emitCodexModelCallError("codex app-server run completed without model-call terminal event");
 		emitLifecycleTerminal({
 			phase: "error",
 			error: "codex app-server run completed without lifecycle terminal event"
@@ -6717,6 +6709,16 @@ function toCodexDynamicToolProtocolResponse(response) {
 		success: response.success
 	};
 }
+function toCodexDynamicToolProgressResponse(response, protocolResponse) {
+	if (response.asyncStarted !== true) return protocolResponse;
+	return {
+		...protocolResponse,
+		details: {
+			async: true,
+			status: "started"
+		}
+	};
+}
 function shouldReleaseTurnAfterTerminalDynamicTool(state) {
 	return !state.completed && !state.aborted && state.responseSuccess && !state.currentTurnHadNonTerminalDynamicToolResult && state.activeAppServerTurnRequests === 0 && state.activeTurnItemIdsCount === 0 && state.pendingOpenClawDynamicToolCompletionIdsCount === 0;
 }
@@ -7528,8 +7530,7 @@ function readString(record, key) {
 	return typeof value === "string" ? value : void 0;
 }
 function readBoolean(record, key) {
-	const value = record[key];
-	return typeof value === "boolean" ? value : void 0;
+	return asBoolean(record[key]);
 }
 async function readMirroredSessionHistoryMessages(sessionFile) {
 	const messages = await readCodexMirroredSessionHistoryMessages(sessionFile);
@@ -7596,7 +7597,8 @@ function buildCodexSystemPromptReport(params) {
 		systemPrompt: {
 			chars: params.developerInstructions.length,
 			projectContextChars: 0,
-			nonProjectContextChars: params.developerInstructions.length
+			nonProjectContextChars: params.developerInstructions.length,
+			hash: sha256Text(params.developerInstructions)
 		},
 		injectedWorkspaceFiles: buildCodexBootstrapInjectionStats({
 			bootstrapFiles: params.workspaceBootstrapContext.bootstrapFiles,
@@ -7605,6 +7607,7 @@ function buildCodexSystemPromptReport(params) {
 		}),
 		skills: {
 			promptChars: skillsPrompt.length,
+			hash: sha256Text(skillsPrompt),
 			entries: buildCodexSkillReportEntries(skillsPrompt)
 		},
 		tools: {
@@ -7621,17 +7624,30 @@ function buildCodexSkillReportEntries(skillsPrompt) {
 		blockChars: block.length
 	})).filter((entry) => entry.blockChars > 0);
 }
+function readCodexDiagnosticToolParameters(tool) {
+	return tool.inputSchema ?? tool.parameters;
+}
+function buildCodexDiagnosticToolDefinitions(tools) {
+	return tools.map((tool) => ({
+		name: tool.name,
+		description: tool.description,
+		parameters: readCodexDiagnosticToolParameters(tool)
+	}));
+}
 function buildCodexToolReportEntry(tool) {
 	const summary = tool.description.trim();
 	if (tool.deferLoading === true) return {
 		name: tool.name,
 		summaryChars: summary.length,
+		summaryHash: sha256Text(summary),
 		schemaChars: 0,
+		schemaHash: stableJsonHash(null),
 		propertiesCount: null
 	};
 	return {
 		name: tool.name,
 		summaryChars: summary.length,
+		summaryHash: sha256Text(summary),
 		...buildCodexToolSchemaStats(tool.inputSchema)
 	};
 }
@@ -7646,9 +7662,24 @@ function buildCodexToolSchemaStats(schema) {
 	const properties = isJsonObject(schema) && isJsonObject(schema.properties) ? schema.properties : null;
 	return {
 		schemaChars,
+		schemaHash: stableJsonHash(schema),
 		propertiesCount: properties ? Object.keys(properties).length : null
 	};
 }
+function sha256Text(value) {
+	return createHash("sha256").update(value).digest("hex");
+}
+function normalizeForStableHash(value) {
+	if (Array.isArray(value)) return value.map((entry) => normalizeForStableHash(entry));
+	if (value && typeof value === "object") {
+		const record = value;
+		return Object.fromEntries(Object.keys(record).toSorted((left, right) => left.localeCompare(right)).map((key) => [key, normalizeForStableHash(record[key])]));
+	}
+	return value;
+}
+function stableJsonHash(value) {
+	return sha256Text(JSON.stringify(normalizeForStableHash(value)) ?? "null");
+}
 function buildCodexBootstrapInjectionStats(params) {
 	const injectedIndex = indexCodexContextFileContent(params.injectedFiles);
 	const developerInstructionIndex = indexCodexContextFileContent(params.developerInstructionFiles ?? []);
@@ -7822,9 +7853,11 @@ function isMissingCodexBootstrapContextFile(file) {
 function remapCodexContextFilePath(params) {
 	const relativePath = path.relative(params.sourceWorkspaceDir, params.file.path);
 	if (!relativePath || relativePath === ".." || relativePath.startsWith(`..${path.sep}`) || path.isAbsolute(relativePath) || params.sourceWorkspaceDir === params.targetWorkspaceDir) return params.file;
+	const targetUsesPosixSeparators = params.targetWorkspaceDir.includes("/") && !params.targetWorkspaceDir.includes("\\");
+	const normalizedRelativePath = targetUsesPosixSeparators ? relativePath.replaceAll("\\", "/") : relativePath.replaceAll("/", "\\");
 	return {
 		...params.file,
-		path: path.join(params.targetWorkspaceDir, relativePath)
+		path: targetUsesPosixSeparators ? path.posix.join(params.targetWorkspaceDir, normalizedRelativePath) : path.win32.join(params.targetWorkspaceDir, normalizedRelativePath)
 	};
 }
 function compareCodexContextFiles(left, right) {
@@ -7861,6 +7894,21 @@ async function mirrorTranscriptBestEffort(params) {
 		embeddedAgentLog.warn("failed to mirror codex app-server transcript", { error });
 	}
 }
+async function mirrorPromptAtTurnStartBestEffort(params) {
+	if (params.params.suppressNextUserMessagePersistence) return;
+	try {
+		await mirrorCodexAppServerTranscript({
+			sessionFile: params.params.sessionFile,
+			agentId: params.agentId,
+			sessionKey: params.sessionKey,
+			messages: [attachCodexMirrorIdentity(buildCodexUserPromptMessage(params.params), `${params.turnId}:prompt`)],
+			idempotencyScope: `codex-app-server:${params.threadId}`,
+			config: params.params.config
+		});
+	} catch (error) {
+		embeddedAgentLog.warn("failed to mirror codex app-server prompt at turn start", { error });
+	}
+}
 function isNonEmptyString(value) {
 	return typeof value === "string" && value.length > 0;
 }
@@ -7907,6 +7955,7 @@ function handleApprovalRequest(params) {
 		threadId: params.threadId,
 		turnId: params.turnId,
 		nativeHookRelay: params.nativeHookRelay,
+		autoApprove: params.autoApprove,
 		signal: params.signal
 	});
 }