@openclaw/codex 2026.5.24-beta.2 → 2026.5.26-beta.1

package/dist/{run-attempt-CT1N__qp.js → run-attempt-CFBsGx1T.js}

@@ -1,31 +1,31 @@
-import { c as readCodexPluginConfig, d as resolveCodexPluginsPolicy, f as withMcpElicitationsApprovalPolicy, i as isCodexAppServerApprovalPolicyAllowedByRequirements, l as resolveCodexAppServerRuntimeOptions, o as isCodexSandboxExecServerEnabled, u as resolveCodexComputerUseConfig } from "./config-DDMrwfJl.js";
-import { a as readCodexDynamicToolCallParams, c as readCodexTurn, i as assertCodexTurnStartResponse } from "./protocol-validators-_gKDcd0x.js";
-import { t as isJsonObject } from "./protocol-oeJQu4rs.js";
-import { a as isCodexAppServerConnectionClosedError, i as isCodexAppServerApprovalRequest, r as compareCodexAppServerVersions, s as MIN_CODEX_SANDBOX_EXEC_SERVER_APP_SERVER_VERSION } from "./client-1sSy4p3z.js";
-import { C as sanitizeCodexHistoryImagePayloads, D as resolveCodexContextEngineProjectionMaxChars, E as projectContextEngineAssemblyForCodex, O as resolveCodexContextEngineProjectionReserveTokens, _ as shouldBuildCodexPluginThreadConfig, c as buildTurnStartParams, g as mergeCodexThreadConfigs, h as buildCodexPluginThreadConfigInputFingerprint, i as buildDeveloperInstructions, l as codexDynamicToolsFingerprint, m as buildCodexPluginThreadConfig, p as startOrResumeThread, r as buildContextEngineBinding, s as buildTurnCollaborationMode, t as areCodexDynamicToolFingerprintsCompatible, u as isContextEngineBindingCompatible, x as defaultCodexAppInventoryCache } from "./thread-lifecycle-DGoaguJh.js";
-import { i as readCodexAppServerBinding, t as clearCodexAppServerBinding } from "./session-binding-Bw_mfIW2.js";
-import { n as buildCodexPluginAppCacheKey, r as CODEX_CONTROL_METHODS } from "./request-D93E78SA.js";
-import { g as shouldRefreshCodexRateLimitsForUsageLimitMessage, h as resolveCodexUsageLimitResetAtMs, i as readCodexNotificationTurnId, m as formatCodexUsageLimitErrorMessage, n as isCodexNotificationForTurn, r as readCodexNotificationThreadId, s as formatCodexDisplayText, t as describeCodexNotificationCorrelation } from "./notification-correlation-qKY_sgga.js";
-import { c as resolveCodexAppServerAuthAccountCacheKey, d as resolveCodexAppServerEnvApiKeyCacheKey, f as resolveCodexAppServerHomeDir, l as resolveCodexAppServerAuthProfileId, s as refreshCodexAppServerAuthTokens, t as clearSharedCodexAppServerClientIfCurrent, u as resolveCodexAppServerAuthProfileIdForAgent } from "./shared-client-CFCUGEVs.js";
+import { t as defaultCodexAppServerClientFactory } from "./client-factory-CaOpX89B.js";
+import { c as readCodexPluginConfig, d as resolveCodexPluginsPolicy, f as shouldAutoApproveCodexAppServerApprovals, i as isCodexAppServerApprovalPolicyAllowedByRequirements, l as resolveCodexAppServerRuntimeOptions, o as isCodexSandboxExecServerEnabled, p as withMcpElicitationsApprovalPolicy, u as resolveCodexComputerUseConfig } from "./config-0-UN67Qg.js";
+import { a as readCodexDynamicToolCallParams, c as readCodexTurn, i as assertCodexTurnStartResponse } from "./protocol-validators-CSuFMLvY.js";
+import { a as isCodexAppServerConnectionClosedError, i as isCodexAppServerApprovalRequest, l as isJsonObject, r as compareCodexAppServerVersions, s as MIN_CODEX_SANDBOX_EXEC_SERVER_APP_SERVER_VERSION } from "./client-BVK_jmHW.js";
+import { C as defaultCodexAppInventoryCache, D as projectContextEngineAssemblyForCodex, O as resolveCodexContextEngineProjectionMaxChars, T as sanitizeCodexHistoryImagePayloads, _ as buildCodexPluginThreadConfigInputFingerprint, a as buildDeveloperInstructions, c as buildTurnCollaborationMode, d as isContextEngineBindingCompatible, g as buildCodexPluginThreadConfig, h as isCodexAppServerProfilerEnabled, i as buildContextEngineBinding, k as resolveCodexContextEngineProjectionReserveTokens, l as buildTurnStartParams, m as startOrResumeThread, n as areCodexDynamicToolFingerprintsCompatible, u as codexDynamicToolsFingerprint, v as mergeCodexThreadConfigs, y as shouldBuildCodexPluginThreadConfig } from "./thread-lifecycle-BapIT9Qs.js";
+import { i as readCodexAppServerBinding, t as clearCodexAppServerBinding } from "./session-binding-UFjjws4k.js";
+import { n as buildCodexPluginAppCacheKey, r as CODEX_CONTROL_METHODS } from "./request-DmBkYLPy.js";
+import { g as shouldRefreshCodexRateLimitsForUsageLimitMessage, h as resolveCodexUsageLimitResetAtMs, i as readCodexNotificationTurnId, m as formatCodexUsageLimitErrorMessage, n as isCodexNotificationForTurn, r as readCodexNotificationThreadId, s as formatCodexDisplayText, t as describeCodexNotificationCorrelation } from "./notification-correlation-YINts3PA.js";
+import { c as resolveCodexAppServerAuthAccountCacheKey, d as resolveCodexAppServerFallbackApiKeyCacheKey, f as resolveCodexAppServerHomeDir, l as resolveCodexAppServerAuthProfileId, s as refreshCodexAppServerAuthTokens, t as clearSharedCodexAppServerClientIfCurrent, u as resolveCodexAppServerAuthProfileIdForAgent } from "./shared-client-Fou5nAyt.js";
 import { i as resolveCodexNativeExecutionPolicy } from "./sandbox-guard-CTnEWuor.js";
-import { a as resolveCodexDynamicToolsLoading, i as normalizeCodexDynamicToolName, n as filterCodexDynamicTools, r as isForcedPrivateQaCodexRuntime, t as createCodexDynamicToolBridge } from "./dynamic-tools-Bq717oJR.js";
-import { t as defaultCodexAppServerClientFactory } from "./client-factory-Bk6i4FnW.js";
-import { a as handleCodexAppServerElicitationRequest, c as emitDynamicToolTerminalDiagnostic, i as buildCodexNativeHookRelayDisabledConfig, l as handleCodexAppServerApprovalRequest, n as CODEX_NATIVE_HOOK_RELAY_EVENTS, o as emitDynamicToolErrorDiagnostic, r as buildCodexNativeHookRelayConfig, s as emitDynamicToolStartedDiagnostic, t as filterToolsForVisionInputs } from "./vision-tools-DOnxzH2y.js";
-import { t as ensureCodexComputerUse } from "./computer-use-Hdq1WgTA.js";
+import { a as resolveCodexDynamicToolsLoading, i as normalizeCodexDynamicToolName, n as filterCodexDynamicTools, r as isForcedPrivateQaCodexRuntime, t as createCodexDynamicToolBridge } from "./dynamic-tools-BG9ICyU4.js";
+import { a as handleCodexAppServerElicitationRequest, c as emitDynamicToolTerminalDiagnostic, i as buildCodexNativeHookRelayDisabledConfig, l as handleCodexAppServerApprovalRequest, n as CODEX_NATIVE_HOOK_RELAY_EVENTS, o as emitDynamicToolErrorDiagnostic, r as buildCodexNativeHookRelayConfig, s as emitDynamicToolStartedDiagnostic, t as filterToolsForVisionInputs } from "./vision-tools-B30YCKRK.js";
+import { t as ensureCodexComputerUse } from "./computer-use-CDDlIBhY.js";
 import { n as rememberCodexRateLimits, t as readRecentCodexRateLimits } from "./rate-limit-cache-N66I-Rd7.js";
 import { createHash, randomUUID } from "node:crypto";
-import nodeFs from "node:fs";
-import { CODEX_APP_SERVER_CONTEXT_ENGINE_HOST, PREEMPTIVE_OVERFLOW_ERROR_TEXT, TOOL_PROGRESS_OUTPUT_MAX_CHARS, acquireSessionWriteLock, appendSessionTranscriptMessage, assembleHarnessContextEngine, assertContextEngineHostSupport, awaitAgentHarnessAgentEndHook, bootstrapHarnessContextEngine, buildAgentHookContextChannelFields, buildEmbeddedAttemptToolRunContext, buildHarnessContextEngineRuntimeContext, buildHarnessContextEngineRuntimeContextFromUsage, classifyAgentHarnessTerminalOutcome, clearActiveEmbeddedRun, compactContextEngineWithSafetyTimeout, embeddedAgentLog, emitAgentEvent, emitSessionTranscriptUpdate, estimateRenderedLlmBoundaryTokenPressure, finalizeHarnessContextEngineTurn, formatErrorMessage, formatPrePromptPrecheckLog, formatToolAggregate, formatToolProgressOutput, hasBeforeToolCallPolicy, inferToolMetaFromArgs, isActiveHarnessContextEngine, isSubagentSessionKey, loadCodexBundleMcpThreadConfig, normalizeAgentRuntimeTools, normalizeUsage, registerNativeHookRelay, resolveAgentHarnessBeforePromptBuildResult, resolveAttemptSpawnWorkspaceDir, resolveBootstrapContextForRun, resolveCompactionTimeoutMs, resolveContextEngineOwnerPluginId, resolveModelAuthMode, resolveSandboxContext, resolveSessionAgentIds, resolveSessionWriteLockOptions, resolveUserPath, runAgentCleanupStep, runAgentHarnessAfterCompactionHook, runAgentHarnessAfterToolCallHook, runAgentHarnessAgentEndHook, runAgentHarnessBeforeCompactionHook, runAgentHarnessBeforeMessageWriteHook, runAgentHarnessLlmInputHook, runAgentHarnessLlmOutputHook, runHarnessContextEngineMaintenance, setActiveEmbeddedRun, shouldPreemptivelyCompactBeforePrompt, supportsModelTools } from "openclaw/plugin-sdk/agent-harness-runtime";
+import fsSync from "node:fs";
+import { asBoolean, asFiniteNumber, normalizeOptionalString, normalizeStringEntries } from "openclaw/plugin-sdk/string-coerce-runtime";
+import { CODEX_APP_SERVER_CONTEXT_ENGINE_HOST, TOOL_PROGRESS_OUTPUT_MAX_CHARS, acquireSessionWriteLock, appendSessionTranscriptMessage, assembleHarnessContextEngine, assertContextEngineHostSupport, awaitAgentHarnessAgentEndHook, bootstrapHarnessContextEngine, buildAgentHookContextChannelFields, buildEmbeddedAttemptToolRunContext, buildHarnessContextEngineRuntimeContext, buildHarnessContextEngineRuntimeContextFromUsage, classifyAgentHarnessTerminalOutcome, clearActiveEmbeddedRun, embeddedAgentLog, emitAgentEvent, emitSessionTranscriptUpdate, finalizeHarnessContextEngineTurn, formatErrorMessage, formatToolAggregate, formatToolProgressOutput, getBeforeToolCallPolicyDiagnosticState, inferToolMetaFromArgs, isActiveHarnessContextEngine, isSubagentSessionKey, loadCodexBundleMcpThreadConfig, normalizeAgentRuntimeTools, normalizeUsage, registerNativeHookRelay, resolveAgentHarnessBeforePromptBuildResult, resolveAttemptSpawnWorkspaceDir, resolveBootstrapContextForRun, resolveContextEngineOwnerPluginId, resolveModelAuthMode, resolveSandboxContext, resolveSessionAgentIds, resolveSessionWriteLockOptions, resolveUserPath, runAgentCleanupStep, runAgentHarnessAfterCompactionHook, runAgentHarnessAfterToolCallHook, runAgentHarnessAgentEndHook, runAgentHarnessBeforeCompactionHook, runAgentHarnessBeforeMessageWriteHook, runAgentHarnessLlmInputHook, runAgentHarnessLlmOutputHook, runHarnessContextEngineMaintenance, setActiveEmbeddedRun, supportsModelTools } from "openclaw/plugin-sdk/agent-harness-runtime";
 import { spawn } from "node:child_process";
 import { once } from "node:events";
 import { WebSocketServer } from "ws";
 import { redactSensitiveFieldValue, redactToolPayloadText } from "openclaw/plugin-sdk/logging-core";
 import fs from "node:fs/promises";
 import path, { posix } from "node:path";
+import { createDiagnosticTraceContextFromActiveScope, emitTrustedDiagnosticEvent, emitTrustedDiagnosticEventWithPrivateData, freezeDiagnosticTraceContext, hasPendingInternalDiagnosticEvent, onInternalDiagnosticEvent, resolveDiagnosticModelContentCapturePolicy } from "openclaw/plugin-sdk/diagnostic-runtime";
 import { markAuthProfileBlockedUntil, resolveAgentDir as resolveAgentDir$1 } from "openclaw/plugin-sdk/agent-runtime";
 import { isToolAllowed } from "openclaw/plugin-sdk/sandbox";
 import { appendRegularFile, pathExists } from "openclaw/plugin-sdk/security-runtime";
-import { emitTrustedDiagnosticEvent, hasPendingInternalDiagnosticEvent, onInternalDiagnosticEvent } from "openclaw/plugin-sdk/diagnostic-runtime";
 import { buildSessionContext, migrateSessionEntries, parseSessionEntries } from "@earendil-works/pi-coding-agent";
 import { createAgentHarnessTaskRuntime, deliverAgentHarnessTaskCompletion, isDurableAgentHarnessCompletionDelivery } from "openclaw/plugin-sdk/agent-harness-task-runtime";
 import { isIP } from "node:net";
@@ -102,10 +102,6 @@ function inferCodexDynamicToolMeta(call, detailMode) {
 //#endregion
 //#region extensions/codex/src/app-server/transcript-mirror.ts
 const MIRROR_IDENTITY_META_KEY = "mirrorIdentity";
-function normalizeOptionalString$1(value) {
-	const normalized = value?.trim();
-	return normalized ? normalized : void 0;
-}
 function buildSenderLabel(params) {
 	const label = params.senderName ?? params.senderUsername ?? params.senderE164 ?? params.senderId;
 	if (!label) return;
@@ -113,17 +109,17 @@ function buildSenderLabel(params) {
 	return `${label} (${params.senderId})`;
 }
 function buildCodexUserPromptMessage(params) {
-	const senderId = normalizeOptionalString$1(params.senderId);
-	const senderName = normalizeOptionalString$1(params.senderName);
-	const senderUsername = normalizeOptionalString$1(params.senderUsername);
-	const senderE164 = normalizeOptionalString$1(params.senderE164);
+	const senderId = normalizeOptionalString(params.senderId);
+	const senderName = normalizeOptionalString(params.senderName);
+	const senderUsername = normalizeOptionalString(params.senderUsername);
+	const senderE164 = normalizeOptionalString(params.senderE164);
 	const senderLabel = buildSenderLabel({
 		senderId,
 		senderName,
 		senderUsername,
 		senderE164
 	});
-	const sourceChannel = normalizeOptionalString$1(params.inputProvenance?.sourceChannel ?? params.messageChannel ?? params.messageProvider);
+	const sourceChannel = normalizeOptionalString(params.inputProvenance?.sourceChannel ?? params.messageChannel ?? params.messageProvider);
 	return {
 		role: "user",
 		content: params.prompt,
@@ -183,12 +179,14 @@ async function mirrorCodexAppServerTranscript(params) {
 		sessionFile: params.sessionFile,
 		...resolveSessionWriteLockOptions(params.config)
 	});
+	const appendedUpdates = [];
 	try {
-		const existingIdempotencyKeys = await readTranscriptIdempotencyKeys(params.sessionFile);
+		const mirrorState = await readTranscriptMirrorState(params.sessionFile);
+		let nextMessageSeq = mirrorState.messageCount;
 		for (const message of messages) {
 			const dedupeIdentity = buildMirrorDedupeIdentity(message);
 			const idempotencyKey = params.idempotencyScope ? `${params.idempotencyScope}:${dedupeIdentity}` : void 0;
-			if (idempotencyKey && existingIdempotencyKeys.has(idempotencyKey)) continue;
+			if (idempotencyKey && mirrorState.idempotencyKeys.has(idempotencyKey)) continue;
 			const nextMessage = runAgentHarnessBeforeMessageWriteHook({
 				message: {
 					...message,
@@ -202,41 +200,57 @@ async function mirrorCodexAppServerTranscript(params) {
 				...nextMessage,
 				idempotencyKey
 			} : nextMessage;
-			await appendSessionTranscriptMessage({
+			const { messageId, message: appendedMessage } = await appendSessionTranscriptMessage({
 				transcriptPath: params.sessionFile,
 				message: messageToAppend,
 				config: params.config
 			});
-			if (idempotencyKey) existingIdempotencyKeys.add(idempotencyKey);
+			nextMessageSeq += 1;
+			appendedUpdates.push({
+				messageId,
+				message: appendedMessage,
+				messageSeq: nextMessageSeq
+			});
+			if (idempotencyKey) mirrorState.idempotencyKeys.add(idempotencyKey);
 		}
 	} finally {
 		await lock.release();
 	}
-	if (params.sessionKey) emitSessionTranscriptUpdate({
+	for (const update of appendedUpdates) emitSessionTranscriptUpdate({
 		sessionFile: params.sessionFile,
-		sessionKey: params.sessionKey
+		...params.sessionKey ? { sessionKey: params.sessionKey } : {},
+		message: update.message,
+		messageId: update.messageId,
+		messageSeq: update.messageSeq
 	});
-	else emitSessionTranscriptUpdate(params.sessionFile);
 }
-async function readTranscriptIdempotencyKeys(sessionFile) {
-	const keys = /* @__PURE__ */ new Set();
+async function readTranscriptMirrorState(sessionFile) {
+	const idempotencyKeys = /* @__PURE__ */ new Set();
+	let messageCount = 0;
 	let raw;
 	try {
 		raw = await fs.readFile(sessionFile, "utf8");
 	} catch (error) {
 		if (error.code !== "ENOENT") throw error;
-		return keys;
+		return {
+			idempotencyKeys,
+			messageCount
+		};
 	}
 	for (const line of raw.split(/\r?\n/)) {
 		if (!line.trim()) continue;
 		try {
 			const parsed = JSON.parse(line);
-			if (typeof parsed.message?.idempotencyKey === "string") keys.add(parsed.message.idempotencyKey);
+			if (parsed.type === "message") messageCount += 1;
+			if (typeof parsed.message?.idempotencyKey === "string") idempotencyKeys.add(parsed.message.idempotencyKey);
 		} catch {
 			continue;
 		}
 	}
-	return keys;
+	return {
+		idempotencyKeys,
+		messageCount
+	};
 }
 //#endregion
 //#region extensions/codex/src/app-server/event-projector.ts
@@ -463,6 +477,12 @@ var CodexAppServerEventProjector = class {
 		});
 	}
 	recordDynamicToolResult(params) {
+		const existingMeta = this.toolMetas.get(params.callId);
+		this.toolMetas.set(params.callId, {
+			toolName: params.tool,
+			...existingMeta?.meta ? { meta: existingMeta.meta } : {},
+			...existingMeta?.asyncStarted === true || params.asyncStarted === true ? { asyncStarted: true } : {}
+		});
 		this.recordToolTranscriptResult({
 			id: params.callId,
 			name: params.tool,
@@ -832,7 +852,7 @@ var CodexAppServerEventProjector = class {
 		if (savedPath) this.nativeGeneratedMediaUrls.add(savedPath);
 	}
 	buildToolMediaUrls(toolTelemetry) {
-		const mediaUrls = new Set(toolTelemetry.toolMediaUrls?.map((url) => url.trim()).filter(Boolean) ?? []);
+		const mediaUrls = new Set(normalizeStringEntries(toolTelemetry.toolMediaUrls ?? []));
 		if ((toolTelemetry.messagingToolSentMediaUrls?.length ?? 0) === 0) for (const mediaUrl of this.nativeGeneratedMediaUrls) mediaUrls.add(mediaUrl);
 		return mediaUrls.size > 0 ? [...mediaUrls] : toolTelemetry.toolMediaUrls;
 	}
@@ -1118,9 +1138,11 @@ var CodexAppServerEventProjector = class {
 		const toolName = itemName(item);
 		if (!toolName) return;
 		const meta = itemMeta(item, this.toolProgressDetailMode());
+		const existingMeta = this.toolMetas.get(item.id);
 		this.toolMetas.set(item.id, {
 			toolName,
-			...meta ? { meta } : {}
+			...meta ? { meta } : {},
+			...existingMeta?.asyncStarted === true ? { asyncStarted: true } : {}
 		});
 		if (isSideEffectingNativeToolItem(item)) this.sideEffectingToolItemIds.add(item.id);
 		else this.sideEffectingToolItemIds.delete(item.id);
@@ -1364,12 +1386,10 @@ function readNullableString$1(record, key) {
 	return typeof value === "string" ? value : void 0;
 }
 function readNumber$1(record, key) {
-	const value = record[key];
-	return typeof value === "number" && Number.isFinite(value) ? value : void 0;
+	return asFiniteNumber(record[key]);
 }
 function readBoolean$1(record, key) {
-	const value = record[key];
-	return typeof value === "boolean" ? value : void 0;
+	return asBoolean(record[key]);
 }
 function readBooleanAlias(record, keys) {
 	for (const key of keys) {
@@ -2616,9 +2636,6 @@ function readString$2(record, key) {
 	const value = record?.[key];
 	return typeof value === "string" ? value : void 0;
 }
-function normalizeOptionalString(value) {
-	return value?.trim() || void 0;
-}
 function readStringArray(value) {
 	if (!Array.isArray(value)) return [];
 	return value.filter((entry) => typeof entry === "string" && entry.trim() !== "");
@@ -2741,8 +2758,7 @@ function readTranscriptParentThreadId(payload) {
 	return readString$2(isJsonObject(subagent?.thread_spawn) ? subagent.thread_spawn : void 0, "parent_thread_id")?.trim();
 }
 function readNumber(record, key) {
-	const value = record[key];
-	return typeof value === "number" && Number.isFinite(value) ? value : void 0;
+	return asFiniteNumber(record[key]);
 }
 function secondsToMillis(value) {
 	return value === void 0 ? void 0 : Math.round(value * 1e3);
@@ -3930,7 +3946,7 @@ const JWT_VALUE_RE = /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]
 const COOKIE_PAIR_RE = /\b([A-Za-z][A-Za-z0-9_.-]{1,64})=([A-Za-z0-9+/._~%=-]{16,})(?=;|\s|$)/gu;
 const TRAJECTORY_RUNTIME_FILE_MAX_BYTES = 50 * 1024 * 1024;
 const TRAJECTORY_RUNTIME_EVENT_MAX_BYTES = 256 * 1024;
-function resolveCodexTrajectoryPointerFlags(constants = nodeFs.constants) {
+function resolveCodexTrajectoryPointerFlags(constants = fsSync.constants) {
 	const noFollow = constants.O_NOFOLLOW;
 	return constants.O_CREAT | constants.O_TRUNC | constants.O_WRONLY | (typeof noFollow === "number" ? noFollow : 0);
 }
@@ -3964,23 +3980,23 @@ function writeTrajectoryPointerBestEffort(params) {
 	const pointerPath = resolveTrajectoryPointerFilePath(params.sessionFile);
 	try {
 		const pointerDir = path.resolve(path.dirname(pointerPath));
-		if (nodeFs.lstatSync(pointerDir).isSymbolicLink()) return;
+		if (fsSync.lstatSync(pointerDir).isSymbolicLink()) return;
 		try {
-			if (nodeFs.lstatSync(pointerPath).isSymbolicLink()) return;
+			if (fsSync.lstatSync(pointerPath).isSymbolicLink()) return;
 		} catch (error) {
 			if (error.code !== "ENOENT") return;
 		}
-		const fd = nodeFs.openSync(pointerPath, resolveCodexTrajectoryPointerFlags(), 384);
+		const fd = fsSync.openSync(pointerPath, resolveCodexTrajectoryPointerFlags(), 384);
 		try {
-			nodeFs.writeFileSync(fd, `${JSON.stringify({
+			fsSync.writeFileSync(fd, `${JSON.stringify({
 				traceSchema: "openclaw-trajectory-pointer",
 				schemaVersion: 1,
 				sessionId: params.sessionId,
 				runtimeFile: params.filePath
 			}, null, 2)}\n`, "utf8");
-			nodeFs.fchmodSync(fd, 384);
+			fsSync.fchmodSync(fd, 384);
 		} finally {
-			nodeFs.closeSync(fd);
+			fsSync.closeSync(fd);
 		}
 	} catch {}
 }
@@ -4345,6 +4361,7 @@ const CODEX_BOOTSTRAP_CONTEXT_ORDER = new Map([
 	["memory.md", 60],
 	["heartbeat.md", 70]
 ]);
+const ensuredCodexWorkspaceDirs = /* @__PURE__ */ new Set();
 const pendingCodexNativeHookRelayUnregisters = /* @__PURE__ */ new Set();
 function scheduleCodexNativeHookRelayUnregister(params) {
 	let pending;
@@ -4367,6 +4384,19 @@ function resolveCodexNativeHookRelayUnregisterGraceMs(hookTimeoutSec) {
 	const hookTimeoutMs = typeof hookTimeoutSec === "number" && Number.isFinite(hookTimeoutSec) && hookTimeoutSec > 0 ? Math.ceil(hookTimeoutSec) * 1e3 : 0;
 	return Math.max(CODEX_NATIVE_HOOK_RELAY_UNREGISTER_GRACE_MS, hookTimeoutMs + CODEX_NATIVE_HOOK_RELAY_UNREGISTER_EXTRA_GRACE_MS);
 }
+async function ensureCodexWorkspaceDirOnce(workspaceDir) {
+	const normalized = path.resolve(workspaceDir);
+	if (ensuredCodexWorkspaceDirs.has(normalized)) {
+		try {
+			if ((await fs.stat(normalized)).isDirectory()) return;
+		} catch (error) {
+			if ((typeof error === "object" && error ? error.code : void 0) !== "ENOENT") throw error;
+		}
+		ensuredCodexWorkspaceDirs.delete(normalized);
+	}
+	await fs.mkdir(normalized, { recursive: true });
+	ensuredCodexWorkspaceDirs.add(normalized);
+}
 function emitCodexAppServerEvent(params, event) {
 	try {
 		emitAgentEvent({
@@ -4549,7 +4579,7 @@ function isCodexAppServerPolicyMode(value) {
 function isCodexAppServerApprovalPolicy(value) {
 	return value === "never" || value === "on-request" || value === "on-failure" || value === "untrusted";
 }
-const CODEX_APP_SERVER_NATIVE_THREAD_MAX_TOKENS = 7e4;
+const CODEX_APP_SERVER_NATIVE_THREAD_FALLBACK_MAX_TOKENS = 3e5;
 const CODEX_APP_SERVER_BYTE_UNITS = {
 	b: 1,
 	k: 1024,
@@ -4637,25 +4667,29 @@ async function readCodexSessionRecordForSessionFile(sessionFile) {
 		};
 	}
 }
-async function readCodexAppServerRolloutTokenUsage(file) {
+async function readCodexAppServerRolloutTokenSnapshot(file) {
 	let handle;
 	try {
 		handle = await fs.open(file, "r");
 	} catch {
 		return;
 	}
-	let totalTokens;
+	let snapshot;
 	try {
 		for await (const line of handle.readLines()) {
-			const lineTokens = readCodexAppServerRolloutTokenUsageLine(line);
-			if (lineTokens !== void 0) totalTokens = lineTokens;
+			const lineSnapshot = readCodexAppServerRolloutTokenSnapshotLine(line);
+			if (lineSnapshot !== void 0) {
+				snapshot ??= {};
+				if (lineSnapshot.totalTokens !== void 0) snapshot.totalTokens = lineSnapshot.totalTokens;
+				if (lineSnapshot.modelContextWindow !== void 0) snapshot.modelContextWindow = lineSnapshot.modelContextWindow;
+			}
 		}
 	} finally {
 		await handle.close();
 	}
-	return totalTokens;
+	return snapshot;
 }
-function readCodexAppServerRolloutTokenUsageLine(line) {
+function readCodexAppServerRolloutTokenSnapshotLine(line) {
 	if (!line.trim()) return;
 	try {
 		const parsed = JSON.parse(line);
@@ -4664,7 +4698,23 @@ function readCodexAppServerRolloutTokenUsageLine(line) {
 		if (!info) return;
 		const usage = isJsonObject(info.last_token_usage) ? info.last_token_usage : isJsonObject(info.total_token_usage) ? info.total_token_usage : void 0;
 		const value = usage?.total_tokens ?? usage?.totalTokens;
-		return typeof value === "number" && Number.isFinite(value) ? value : void 0;
+		const totalTokens = typeof value === "number" && Number.isFinite(value) ? value : void 0;
+		const windowValue = info.model_context_window ?? info.modelContextWindow;
+		const modelContextWindow = typeof windowValue === "number" && Number.isFinite(windowValue) && windowValue > 0 ? Math.floor(windowValue) : void 0;
+		const snapshot = {};
+		if (totalTokens !== void 0) snapshot.totalTokens = totalTokens;
+		if (modelContextWindow !== void 0) snapshot.modelContextWindow = modelContextWindow;
+		return snapshot.totalTokens !== void 0 || snapshot.modelContextWindow !== void 0 ? snapshot : void 0;
+	} catch {
+		return;
+	}
+}
+function resolveCodexAppServerNativeThreadTokenFuse(modelContextWindow) {
+	return modelContextWindow ?? CODEX_APP_SERVER_NATIVE_THREAD_FALLBACK_MAX_TOKENS;
+}
+function utf8JsonByteLength(value) {
+	try {
+		return Buffer.byteLength(JSON.stringify(value), "utf8");
 	} catch {
 		return;
 	}
@@ -4674,10 +4724,22 @@ function maxFiniteNumber(values) {
 	if (nums.length === 0) return;
 	return Math.max(...nums);
 }
+function hasContextEngineThreadBootstrapProjection(binding) {
+	return binding.contextEngine?.projection?.mode === "thread_bootstrap";
+}
 async function rotateOversizedCodexAppServerStartupBinding(params) {
 	const binding = params.binding;
 	if (!binding?.threadId) return binding;
 	if (params.config?.agents?.defaults?.compaction?.truncateAfterCompaction !== true) return binding;
+	if (params.contextEngineActive === true && hasContextEngineThreadBootstrapProjection(binding)) {
+		embeddedAgentLog.debug("codex app-server deferring native transcript size guard for context-engine thread bootstrap", {
+			threadId: binding.threadId,
+			engineId: binding.contextEngine?.engineId,
+			epoch: binding.contextEngine?.projection?.epoch,
+			fingerprint: binding.contextEngine?.projection?.fingerprint
+		});
+		return binding;
+	}
 	const sessionRecord = await readCodexSessionRecordForSessionFile(params.sessionFile);
 	const maxBytes = parseCodexAppServerByteLimit(params.config?.agents?.defaults?.compaction?.maxActiveTranscriptBytes);
 	const rolloutFiles = await listCodexAppServerRolloutFilesForThread(params.agentDir, binding.threadId, params.codexHome);
@@ -4696,16 +4758,20 @@ async function rotateOversizedCodexAppServerStartupBinding(params) {
 			return;
 		}
 	}
-	const nativeTokens = maxFiniteNumber(await Promise.all(rolloutFiles.map(async (file) => readCodexAppServerRolloutTokenUsage(file.path))));
+	const nativeTokenSnapshots = await Promise.all(rolloutFiles.map(async (file) => readCodexAppServerRolloutTokenSnapshot(file.path)));
+	const nativeTokens = maxFiniteNumber(nativeTokenSnapshots.map((snapshot) => snapshot?.totalTokens));
+	const nativeModelContextWindow = maxFiniteNumber(nativeTokenSnapshots.map((snapshot) => snapshot?.modelContextWindow));
+	const maxTokens = resolveCodexAppServerNativeThreadTokenFuse(nativeModelContextWindow);
 	const sessionTokens = sessionRecord?.totalTokensFresh !== false && typeof sessionRecord?.totalTokens === "number" && Number.isFinite(sessionRecord.totalTokens) ? sessionRecord.totalTokens : void 0;
 	const tokenCount = maxFiniteNumber([sessionTokens, nativeTokens]);
-	if (tokenCount !== void 0 && tokenCount >= CODEX_APP_SERVER_NATIVE_THREAD_MAX_TOKENS) {
+	if (tokenCount !== void 0 && tokenCount >= maxTokens) {
 		embeddedAgentLog.warn("codex app-server native transcript exceeded active token limit; starting a fresh thread", {
 			threadId: binding.threadId,
-			maxTokens: CODEX_APP_SERVER_NATIVE_THREAD_MAX_TOKENS,
+			maxTokens,
 			sessionKey: sessionRecord?.sessionKey,
 			sessionTokens,
-			nativeTokens
+			nativeTokens,
+			nativeModelContextWindow
 		});
 		await clearCodexAppServerBinding(params.sessionFile);
 		return;
@@ -4724,12 +4790,24 @@ async function runCodexAgentEndHook(params, hookParams) {
 }
 async function runCodexAppServerAttempt(params, options = {}) {
 	const attemptStartedAt = Date.now();
+	const profilerEnabled = isCodexAppServerProfilerEnabled(params.config);
+	const codexModelCallTrace = freezeDiagnosticTraceContext(createDiagnosticTraceContextFromActiveScope());
+	const codexModelContentCapture = resolveDiagnosticModelContentCapturePolicy(params.config);
+	const codexModelCallId = `${params.runId}:codex-model:1`;
+	let codexModelCallStartedAt = attemptStartedAt;
+	let codexModelCallStarted = false;
+	let codexModelCallTerminalEmitted = false;
+	let codexModelCallRequestPayloadBytes;
+	const preDynamicStartupStages = createCodexDynamicToolBuildStageTracker({ enabled: profilerEnabled });
 	const attemptClientFactory = options.clientFactory ?? defaultCodexAppServerClientFactory;
 	const pluginConfig = readCodexPluginConfig(options.pluginConfig);
 	const computerUseConfig = resolveCodexComputerUseConfig({ pluginConfig });
 	const configuredAppServer = resolveCodexAppServerRuntimeOptions({ pluginConfig });
+	const beforeToolCallPolicy = getBeforeToolCallPolicyDiagnosticState();
+	preDynamicStartupStages.mark("config");
 	const resolvedWorkspace = resolveUserPath(params.workspaceDir);
-	await fs.mkdir(resolvedWorkspace, { recursive: true });
+	await ensureCodexWorkspaceDirOnce(resolvedWorkspace);
+	preDynamicStartupStages.mark("workspace");
 	const sandboxSessionKey = params.sandboxSessionKey?.trim() || params.sessionKey?.trim() || params.sessionId;
 	const contextSessionKey = params.sessionKey?.trim() || sandboxSessionKey;
 	const sandbox = await resolveSandboxContext({
@@ -4737,20 +4815,30 @@ async function runCodexAppServerAttempt(params, options = {}) {
 		sessionKey: sandboxSessionKey,
 		workspaceDir: resolvedWorkspace
 	});
+	preDynamicStartupStages.mark("sandbox");
 	const effectiveWorkspace = sandbox?.enabled ? sandbox.workspaceAccess === "rw" ? resolvedWorkspace : sandbox.workspaceDir : resolvedWorkspace;
-	await fs.mkdir(effectiveWorkspace, { recursive: true });
+	await ensureCodexWorkspaceDirOnce(effectiveWorkspace);
+	preDynamicStartupStages.mark("effective-workspace");
 	const appServer = resolveCodexAppServerForOpenClawToolPolicy({
 		appServer: configuredAppServer,
 		pluginConfig,
 		env: process.env,
-		shouldPromote: hasBeforeToolCallPolicy(),
+		shouldPromote: beforeToolCallPolicy.hasBeforeToolCallHook || beforeToolCallPolicy.trustedToolPolicies.length > 0,
 		canUseUntrustedApprovalPolicy: configuredAppServer.start.transport !== "stdio" || isCodexAppServerApprovalPolicyAllowedByRequirements("untrusted")
 	});
+	if (configuredAppServer.approvalPolicy === "never" && appServer.approvalPolicy === "untrusted") embeddedAgentLog.info("codex app-server approval policy promoted for OpenClaw tool policy", {
+		from: "never",
+		to: "untrusted",
+		beforeToolCallHook: beforeToolCallPolicy.hasBeforeToolCallHook,
+		trustedToolPolicies: beforeToolCallPolicy.trustedToolPolicies
+	});
+	preDynamicStartupStages.mark("app-server-policy");
 	let pluginAppServer = appServer;
 	const nativeHookRelayEvents = resolveCodexNativeHookRelayEvents({
 		configuredEvents: options.nativeHookRelay?.events,
 		appServer
 	});
+	preDynamicStartupStages.mark("native-hook-relay");
 	const runAbortController = new AbortController();
 	const abortFromUpstream = () => {
 		runAbortController.abort(params.abortSignal?.reason ?? "upstream_abort");
@@ -4763,15 +4851,19 @@ async function runCodexAppServerAttempt(params, options = {}) {
 		agentId: params.agentId
 	});
 	const agentDir = params.agentDir ?? resolveAgentDir$1(params.config ?? {}, sessionAgentId);
+	preDynamicStartupStages.mark("session-agent");
 	let startupBinding = await readCodexAppServerBinding(params.sessionFile);
+	preDynamicStartupStages.mark("read-binding");
 	const startupBindingAuthProfileId = startupBinding?.authProfileId;
 	startupBinding = await rotateOversizedCodexAppServerStartupBinding({
 		binding: startupBinding,
 		sessionFile: params.sessionFile,
 		agentDir,
 		codexHome: appServer.start.env?.CODEX_HOME,
-		config: params.config
+		config: params.config,
+		contextEngineActive: isActiveHarnessContextEngine(params.contextEngine)
 	});
+	preDynamicStartupStages.mark("rotate-binding");
 	const startupAuthProfileCandidate = params.runtimePlan?.auth.forwardedAuthProfileId ?? params.authProfileId ?? startupBinding?.authProfileId ?? startupBindingAuthProfileId;
 	const startupAuthProfileId = params.authProfileStore ? resolveCodexAppServerAuthProfileId({
 		authProfileId: startupAuthProfileCandidate,
@@ -4782,6 +4874,7 @@ async function runCodexAppServerAttempt(params, options = {}) {
 		agentDir,
 		config: params.config
 	});
+	preDynamicStartupStages.mark("auth-profile");
 	const runtimeParams = {
 		...params,
 		sessionKey: contextSessionKey,
@@ -4794,22 +4887,20 @@ async function runCodexAppServerAttempt(params, options = {}) {
 		sessionId: activeSessionId,
 		sessionFile: activeSessionFile
 	});
-	const adoptContextEngineCompactionTranscript = (compactResult) => {
-		if (compactResult.result?.sessionId) activeSessionId = compactResult.result.sessionId;
-		if (compactResult.result?.sessionFile) activeSessionFile = compactResult.result.sessionFile;
-	};
 	const startupAuthAccountCacheKey = await resolveCodexAppServerAuthAccountCacheKey({
 		authProfileId: startupAuthProfileId,
 		authProfileStore: params.authProfileStore,
 		agentDir,
 		config: params.config
 	});
-	const startupEnvApiKeyCacheKey = startupAuthProfileId ? void 0 : resolveCodexAppServerEnvApiKeyCacheKey({ startOptions: appServer.start });
+	const startupEnvApiKeyCacheKey = startupAuthProfileId ? void 0 : resolveCodexAppServerFallbackApiKeyCacheKey({ startOptions: appServer.start });
+	preDynamicStartupStages.mark("auth-cache");
 	const nodeExecBlocksNativeExecution = isCodexNativeExecutionBlockedByNodeExecHost(params, {
 		agentId: sessionAgentId,
 		runtimeSessionKey: sandboxSessionKey,
 		sandbox
 	});
+	preDynamicStartupStages.mark("native-exec-policy");
 	const bundleMcpThreadConfig = await loadCodexBundleMcpThreadConfig({
 		workspaceDir: effectiveWorkspace,
 		cfg: params.config,
@@ -4817,12 +4908,14 @@ async function runCodexAppServerAttempt(params, options = {}) {
 		disableTools: params.disableTools,
 		toolsAllow: nodeExecBlocksNativeExecution ? [] : params.toolsAllow
 	});
+	preDynamicStartupStages.mark("bundle-mcp");
 	const sandboxExecServerEnabled = isCodexSandboxExecServerEnabled(pluginConfig);
 	const nativeToolSurfaceEnabled = shouldEnableCodexAppServerNativeToolSurface(params, sandbox, {
 		agentId: sessionAgentId,
 		runtimeSessionKey: sandboxSessionKey,
 		sandboxExecServerEnabled
 	});
+	preDynamicStartupStages.mark("native-tool-surface");
 	for (const diagnostic of bundleMcpThreadConfig.diagnostics) embeddedAgentLog.warn(`bundle-mcp: ${diagnostic.pluginId}: ${diagnostic.message}`);
 	const activeContextEngine = isActiveHarnessContextEngine(params.contextEngine) ? params.contextEngine : void 0;
 	if (activeContextEngine) assertContextEngineHostSupport({
@@ -4831,22 +4924,36 @@ async function runCodexAppServerAttempt(params, options = {}) {
 		host: CODEX_APP_SERVER_CONTEXT_ENGINE_HOST
 	});
 	const hookChannelId = resolveCodexAppServerHookChannelId(params, sandboxSessionKey);
+	preDynamicStartupStages.mark("context-engine-support");
+	const preDynamicSummary = preDynamicStartupStages.snapshot();
+	if (shouldWarnCodexDynamicToolBuildStageSummary(preDynamicSummary)) embeddedAgentLog.warn(`codex app-server pre-dynamic startup timings runId=${params.runId} sessionId=${params.sessionId} totalMs=${preDynamicSummary.totalMs} stages=${formatCodexDynamicToolBuildStageSummary(preDynamicSummary)}`, {
+		runId: params.runId,
+		sessionId: params.sessionId,
+		totalMs: preDynamicSummary.totalMs,
+		stages: preDynamicSummary.stages,
+		hasStartupBinding: Boolean(startupBinding?.threadId),
+		startupAuthProfileId: startupAuthProfileId ?? null,
+		bundleMcpDiagnosticCount: bundleMcpThreadConfig.diagnostics.length,
+		nativeToolSurfaceEnabled
+	});
 	let yieldDetected = false;
+	const tools = await buildDynamicTools({
+		params,
+		resolvedWorkspace,
+		effectiveWorkspace,
+		sandboxSessionKey,
+		sandbox,
+		nativeToolSurfaceEnabled,
+		runAbortController,
+		sessionAgentId,
+		pluginConfig,
+		profilerEnabled,
+		onYieldDetected: () => {
+			yieldDetected = true;
+		}
+	});
 	const toolBridge = createCodexDynamicToolBridge({
-		tools: await buildDynamicTools({
-			params,
-			resolvedWorkspace,
-			effectiveWorkspace,
-			sandboxSessionKey,
-			sandbox,
-			nativeToolSurfaceEnabled,
-			runAbortController,
-			sessionAgentId,
-			pluginConfig,
-			onYieldDetected: () => {
-				yieldDetected = true;
-			}
-		}),
+		tools,
 		registeredTools: await buildDynamicTools({
 			params,
 			resolvedWorkspace,
@@ -4857,6 +4964,7 @@ async function runCodexAppServerAttempt(params, options = {}) {
 			runAbortController,
 			sessionAgentId,
 			pluginConfig,
+			profilerEnabled,
 			forceHeartbeatTool: true,
 			ignoreRuntimePlan: true,
 			onYieldDetected: () => {
@@ -4902,65 +5010,6 @@ async function runCodexAppServerAttempt(params, options = {}) {
 		contextEnginePluginId: activeContextEnginePluginId,
 		tokenBudget: params.contextTokenBudget
 	});
-	const forceContextEngineCompactionForCodexOverflow = async (error, options = {}) => {
-		if (!activeContextEngine?.info.ownsCompaction) return false;
-		embeddedAgentLog.warn("codex app-server context-engine prompt overflowed; forcing context-engine compaction", {
-			sessionId: activeSessionId,
-			sessionKey: contextSessionKey,
-			...options.threadId ? { threadId: options.threadId } : {},
-			engineId: activeContextEngine.info.id,
-			tokenBudget: params.contextTokenBudget,
-			error: formatErrorMessage(error)
-		});
-		try {
-			const runtimeContext = buildActiveContextEngineRuntimeContext();
-			const overflowTokenCount = params.contextTokenBudget ?? params.contextWindowInfo?.tokens;
-			const compactResult = await compactContextEngineWithSafetyTimeout(activeContextEngine, {
-				sessionId: activeSessionId,
-				sessionKey: contextSessionKey,
-				sessionFile: activeSessionFile,
-				tokenBudget: params.contextTokenBudget,
-				force: true,
-				...overflowTokenCount ? { currentTokenCount: overflowTokenCount } : {},
-				compactionTarget: "threshold",
-				runtimeContext: overflowTokenCount ? {
-					...runtimeContext,
-					currentTokenCount: overflowTokenCount
-				} : runtimeContext
-			}, resolveCompactionTimeoutMs(params.config), runAbortController.signal);
-			embeddedAgentLog.info("codex app-server context-engine forced compaction result", {
-				sessionId: activeSessionId,
-				sessionKey: contextSessionKey,
-				engineId: activeContextEngine.info.id,
-				ok: compactResult.ok,
-				compacted: compactResult.compacted,
-				reason: compactResult.reason,
-				tokensBefore: compactResult.result?.tokensBefore,
-				tokensAfter: compactResult.result?.tokensAfter
-			});
-			if (!compactResult.ok || !compactResult.compacted) return false;
-			adoptContextEngineCompactionTranscript(compactResult);
-			const maintenanceRuntimeContext = buildActiveContextEngineRuntimeContext();
-			await runHarnessContextEngineMaintenance({
-				contextEngine: activeContextEngine,
-				sessionId: activeSessionId,
-				sessionKey: contextSessionKey,
-				sessionFile: activeSessionFile,
-				reason: "compaction",
-				runtimeContext: maintenanceRuntimeContext,
-				config: params.config
-			});
-			return true;
-		} catch (compactErr) {
-			embeddedAgentLog.warn("codex app-server context-engine forced compaction failed", {
-				sessionId: params.sessionId,
-				sessionKey: contextSessionKey,
-				engineId: activeContextEngine.info.id,
-				error: formatErrorMessage(compactErr)
-			});
-			return false;
-		}
-	};
 	if (activeContextEngine) {
 		await bootstrapHarnessContextEngine({
 			hadSessionFile,
@@ -4992,12 +5041,6 @@ async function runCodexAppServerAttempt(params, options = {}) {
 	let developerInstructions = baseDeveloperInstructions;
 	let prePromptMessageCount = historyMessages.length;
 	let contextEngineProjection;
-	const resetCodexPromptInputs = () => {
-		promptText = params.prompt;
-		developerInstructions = baseDeveloperInstructions;
-		prePromptMessageCount = historyMessages.length;
-		contextEngineProjection = void 0;
-	};
 	const applyActiveContextEngineProjection = async (decisionStartupBinding) => {
 		if (!activeContextEngine) return;
 		const assembled = await assembleHarnessContextEngine({
@@ -5082,78 +5125,11 @@ async function runCodexAppServerAttempt(params, options = {}) {
 	let promptBuild = await buildPromptFromCurrentInputs();
 	const decorateCodexTurnPromptText = (prompt) => prependCodexOpenClawPromptContext(prompt, openClawPromptContext);
 	let codexTurnPromptText = decorateCodexTurnPromptText(promptBuild.prompt);
-	const refreshCodexTurnPromptText = () => {
-		codexTurnPromptText = decorateCodexTurnPromptText(promptBuild.prompt);
-	};
 	const buildCodexTurnCollaborationDeveloperInstructions = () => buildTurnCollaborationMode(params, {
 		turnScopedDeveloperInstructions: workspaceBootstrapContext.turnScopedDeveloperInstructions,
 		heartbeatCollaborationInstructions: workspaceBootstrapContext.heartbeatCollaborationInstructions
 	}).settings.developer_instructions ?? void 0;
 	const buildRenderedCodexDeveloperInstructions = () => joinPresentSections(promptBuild.developerInstructions, buildCodexTurnCollaborationDeveloperInstructions());
-	const rebuildPromptAfterContextEngineCompaction = async () => {
-		historyMessages = await readMirroredSessionHistoryMessages(activeSessionFile) ?? historyMessages;
-		resetCodexPromptInputs();
-		try {
-			await applyActiveContextEngineProjection(void 0);
-		} catch (assembleErr) {
-			embeddedAgentLog.warn("context engine assemble failed after forced compaction; using Codex baseline prompt", { error: formatErrorMessage(assembleErr) });
-		}
-		promptBuild = await buildPromptFromCurrentInputs();
-		refreshCodexTurnPromptText();
-	};
-	const buildCodexProviderBoundaryPrecheck = () => {
-		const contextTokenBudget = typeof params.contextTokenBudget === "number" && Number.isFinite(params.contextTokenBudget) ? Math.floor(params.contextTokenBudget) : typeof params.contextWindowInfo?.tokens === "number" && Number.isFinite(params.contextWindowInfo.tokens) ? Math.floor(params.contextWindowInfo.tokens) : void 0;
-		if (!contextTokenBudget || contextTokenBudget <= 0) return;
-		const reserveTokens = resolveCodexContextEngineProjectionReserveTokens({ config: params.config }) ?? 2e4;
-		const renderedDeveloperInstructions = buildRenderedCodexDeveloperInstructions();
-		const renderedChars = codexTurnPromptText.length + renderedDeveloperInstructions.length;
-		return shouldPreemptivelyCompactBeforePrompt({
-			messages: historyMessages,
-			systemPrompt: renderedDeveloperInstructions,
-			prompt: codexTurnPromptText,
-			contextTokenBudget,
-			reserveTokens,
-			llmBoundaryTokenPressure: {
-				estimatedPromptTokens: estimateRenderedLlmBoundaryTokenPressure({
-					systemPrompt: renderedDeveloperInstructions,
-					prompt: codexTurnPromptText
-				}),
-				source: "codex_app_server_rendered_prompt",
-				renderedChars
-			}
-		});
-	};
-	const maybeCompactContextEngineForProviderBoundaryPrecheck = async () => {
-		if (!activeContextEngine?.info.ownsCompaction || !contextEngineProjection) return;
-		const precheck = buildCodexProviderBoundaryPrecheck();
-		if (!precheck) return;
-		embeddedAgentLog.debug(formatPrePromptPrecheckLog({
-			result: precheck,
-			provider: params.provider,
-			modelId: params.modelId,
-			messageCount: historyMessages.length,
-			contextTokenBudget: typeof params.contextTokenBudget === "number" ? params.contextTokenBudget : params.contextWindowInfo?.tokens ?? 0,
-			reserveTokens: resolveCodexContextEngineProjectionReserveTokens({ config: params.config }) ?? 2e4,
-			...contextSessionKey ? { sessionKey: contextSessionKey } : {},
-			...activeSessionId ? { sessionId: activeSessionId } : {},
-			...activeSessionFile ? { sessionFile: activeSessionFile } : {}
-		}));
-		if (precheck.route === "fits") return;
-		if (!await forceContextEngineCompactionForCodexOverflow(PREEMPTIVE_OVERFLOW_ERROR_TEXT)) throw new Error(PREEMPTIVE_OVERFLOW_ERROR_TEXT);
-		await rebuildPromptAfterContextEngineCompaction();
-		const afterCompactionPrecheck = buildCodexProviderBoundaryPrecheck();
-		if (!afterCompactionPrecheck || afterCompactionPrecheck.route === "fits") return;
-		embeddedAgentLog.warn("codex app-server provider-boundary precheck still overflowed after compaction", {
-			sessionId: activeSessionId,
-			sessionKey: contextSessionKey,
-			route: afterCompactionPrecheck.route,
-			estimatedPromptTokens: afterCompactionPrecheck.estimatedPromptTokens,
-			promptBudgetBeforeReserve: afterCompactionPrecheck.promptBudgetBeforeReserve,
-			overflowTokens: afterCompactionPrecheck.overflowTokens
-		});
-		throw new Error(PREEMPTIVE_OVERFLOW_ERROR_TEXT);
-	};
-	await maybeCompactContextEngineForProviderBoundaryPrecheck();
 	const systemPromptReport = buildCodexSystemPromptReport({
 		attempt: params,
 		sessionKey: contextSessionKey,
@@ -5916,7 +5892,9 @@ async function runCodexAppServerAttempt(params, options = {}) {
 			...turnId ? { turnId } : {}
 		});
 		embeddedAgentLog.debug("codex app-server raw notification received", correlation);
-		if (notification.method === "turn/completed" && correlation.matchesActiveTurn === false) embeddedAgentLog.warn("codex app-server turn/completed did not match active turn", correlation);
+		if (notification.method === "turn/completed" && correlation.matchesActiveTurn === false) if (correlation.matchesActiveThread) embeddedAgentLog.warn("codex app-server turn/completed did not match active turn", correlation);
+		else embeddedAgentLog.debug("codex app-server turn/completed ignored for other subscribed thread", correlation);
+		if (isCodexNotificationOutsideActiveRun(correlation)) return Promise.resolve();
 		if (!projector || !turnId) {
 			userInputBridge?.handleNotification(notification);
 			pendingNotifications.push(notification);
@@ -5990,6 +5968,7 @@ async function runCodexAppServerAttempt(params, options = {}) {
 						threadId: thread.threadId,
 						turnId,
 						nativeHookRelay,
+						autoApprove: shouldAutoApproveCodexAppServerApprovals(appServer),
 						signal: runAbortController.signal
 					});
 				}
@@ -6083,22 +6062,26 @@ async function runCodexAppServerAttempt(params, options = {}) {
 				projector?.recordDynamicToolResult({
 					callId: call.callId,
 					tool: call.tool,
+					asyncStarted: response.asyncStarted === true,
 					success: protocolResponse.success,
 					terminalType: response.diagnosticTerminalType ?? (protocolResponse.success ? "completed" : "error"),
 					sideEffectEvidence: response.sideEffectEvidence === true,
 					contentItems: protocolResponse.contentItems
 				});
-				if (shouldEmitDynamicToolProgress) emitCodexAppServerEvent(params, {
-					stream: "tool",
-					data: {
-						phase: "result",
-						name: call.tool,
-						toolCallId: call.callId,
-						...toolMeta ? { meta: toolMeta } : {},
-						isError: !protocolResponse.success,
-						result: sanitizeCodexToolResponse(protocolResponse)
-					}
-				});
+				if (shouldEmitDynamicToolProgress) {
+					const progressResponse = toCodexDynamicToolProgressResponse(response, protocolResponse);
+					emitCodexAppServerEvent(params, {
+						stream: "tool",
+						data: {
+							phase: "result",
+							name: call.tool,
+							toolCallId: call.callId,
+							...toolMeta ? { meta: toolMeta } : {},
+							isError: !protocolResponse.success,
+							result: sanitizeCodexToolResponse(progressResponse)
+						}
+					});
+				}
 				if (!terminalDiagnosticObserved && !hasPendingDynamicToolTerminalDiagnostic({
 					call,
 					runId: params.runId,
@@ -6161,27 +6144,99 @@ async function runCodexAppServerAttempt(params, options = {}) {
 		systemPrompt: buildRenderedCodexDeveloperInstructions(),
 		prompt: codexTurnPromptText,
 		historyMessages,
-		imagesCount: params.images?.length ?? 0
+		imagesCount: params.images?.length ?? 0,
+		tools
 	});
 	const buildTurnStartFailureMessages = () => [...historyMessages, buildCodexUserPromptMessage({
 		...params,
 		prompt: codexTurnPromptText
 	})];
+	const codexModelCallBaseFields = {
+		runId: params.runId,
+		callId: codexModelCallId,
+		...params.sessionKey ? { sessionKey: params.sessionKey } : {},
+		sessionId: params.sessionId,
+		provider: params.provider,
+		model: params.modelId,
+		api: params.model.api,
+		transport: appServer.start.transport,
+		...hookContextWindowFields,
+		trace: codexModelCallTrace
+	};
+	const codexDiagnosticToolDefinitions = codexModelContentCapture.toolDefinitions ? buildCodexDiagnosticToolDefinitions(tools) : void 0;
+	const codexModelContentPrivateData = (modelContent) => modelContent && Object.keys(modelContent).length > 0 ? { modelContent } : void 0;
+	const buildCodexModelCallDiagnosticContent = () => {
+		const modelContent = {
+			...codexModelContentCapture.inputMessages ? { inputMessages: buildTurnStartFailureMessages() } : {},
+			...codexModelContentCapture.systemPrompt ? { systemPrompt: buildRenderedCodexDeveloperInstructions() } : {},
+			...codexDiagnosticToolDefinitions ? { toolDefinitions: codexDiagnosticToolDefinitions } : {}
+		};
+		return Object.keys(modelContent).length > 0 ? modelContent : void 0;
+	};
+	const emitCodexModelCallStarted = () => {
+		codexModelCallStartedAt = Date.now();
+		codexModelCallStarted = true;
+		emitTrustedDiagnosticEventWithPrivateData({
+			type: "model.call.started",
+			...codexModelCallBaseFields
+		}, codexModelContentPrivateData(buildCodexModelCallDiagnosticContent()));
+	};
+	const emitCodexModelCallCompleted = (result) => {
+		if (!codexModelCallStarted || codexModelCallTerminalEmitted) return;
+		codexModelCallTerminalEmitted = true;
+		emitTrustedDiagnosticEventWithPrivateData({
+			type: "model.call.completed",
+			...codexModelCallBaseFields,
+			durationMs: Math.max(0, Date.now() - codexModelCallStartedAt),
+			...codexModelCallRequestPayloadBytes !== void 0 ? { requestPayloadBytes: codexModelCallRequestPayloadBytes } : {}
+		}, codexModelContentPrivateData({
+			...buildCodexModelCallDiagnosticContent(),
+			...codexModelContentCapture.outputMessages ? { outputMessages: result.lastAssistant ? [result.lastAssistant] : result.assistantTexts } : {}
+		}));
+	};
+	const emitCodexModelCallError = (error, fields = {}) => {
+		if (!codexModelCallStarted || codexModelCallTerminalEmitted) return;
+		codexModelCallTerminalEmitted = true;
+		emitTrustedDiagnosticEventWithPrivateData({
+			type: "model.call.error",
+			...codexModelCallBaseFields,
+			durationMs: Math.max(0, Date.now() - codexModelCallStartedAt),
+			errorCategory: fields.failureKind ?? "error",
+			...fields.failureKind ? { failureKind: fields.failureKind } : {},
+			...codexModelCallRequestPayloadBytes !== void 0 ? { requestPayloadBytes: codexModelCallRequestPayloadBytes } : {}
+		}, codexModelContentPrivateData({
+			...buildCodexModelCallDiagnosticContent(),
+			...codexModelContentCapture.outputMessages ? { outputMessages: [] } : {}
+		}));
+		embeddedAgentLog.debug("codex app-server model call diagnostic ended with error", { error: formatErrorMessage(error) });
+	};
+	const classifyCodexModelCallFailureKind = (error) => {
+		if (timedOut || turnCompletionIdleTimedOut) return "timeout";
+		const errorMessage = error ? formatErrorMessage(error).toLowerCase() : "";
+		if (errorMessage.includes("timed out") || errorMessage.includes("timeout")) return "timeout";
+		if (runAbortController.signal.aborted && !clientClosedAbort) return String(runAbortController.signal.reason ?? "").toLowerCase().includes("timeout") ? "timeout" : "aborted";
+		return errorMessage.includes("aborted") ? "aborted" : void 0;
+	};
 	let turn;
-	const startCodexTurn = async () => assertCodexTurnStartResponse(await client.request("turn/start", buildTurnStartParams(params, {
-		threadId: thread.threadId,
-		cwd: codexExecutionCwd,
-		appServer: pluginAppServer,
-		promptText: codexTurnPromptText,
-		sandboxPolicy: codexSandboxPolicy,
-		environmentSelection: codexEnvironmentSelection,
-		turnScopedDeveloperInstructions: workspaceBootstrapContext.turnScopedDeveloperInstructions,
-		heartbeatCollaborationInstructions: workspaceBootstrapContext.heartbeatCollaborationInstructions
-	}), {
-		timeoutMs: params.timeoutMs,
-		signal: runAbortController.signal
-	}));
+	const startCodexTurn = async () => {
+		const turnStartParams = buildTurnStartParams(params, {
+			threadId: thread.threadId,
+			cwd: codexExecutionCwd,
+			appServer: pluginAppServer,
+			promptText: codexTurnPromptText,
+			sandboxPolicy: codexSandboxPolicy,
+			environmentSelection: codexEnvironmentSelection,
+			turnScopedDeveloperInstructions: workspaceBootstrapContext.turnScopedDeveloperInstructions,
+			heartbeatCollaborationInstructions: workspaceBootstrapContext.heartbeatCollaborationInstructions
+		});
+		codexModelCallRequestPayloadBytes = utf8JsonByteLength(turnStartParams);
+		return assertCodexTurnStartResponse(await client.request("turn/start", turnStartParams, {
+			timeoutMs: params.timeoutMs,
+			signal: runAbortController.signal
+		}));
+	};
 	try {
+		emitCodexModelCallStarted();
 		runAgentHarnessLlmInputHook({
 			event: buildLlmInputEvent(),
 			ctx: hookContext
@@ -6207,10 +6262,8 @@ async function runCodexAppServerAttempt(params, options = {}) {
 			});
 			try {
 				const preRetrySessionFile = activeSessionFile;
-				const compactedForRetry = await forceContextEngineCompactionForCodexOverflow(turnStartError, { threadId: thread.threadId });
 				await clearCodexAppServerBinding(preRetrySessionFile);
 				if (activeSessionFile !== preRetrySessionFile) await clearCodexAppServerBinding(activeSessionFile);
-				if (compactedForRetry) await rebuildPromptAfterContextEngineCompaction();
 				thread = await restartContextEngineCodexThread();
 				emitCodexAppServerEvent(params, {
 					stream: "codex_app_server.lifecycle",
@@ -6270,6 +6323,8 @@ async function runCodexAppServerAttempt(params, options = {}) {
 				},
 				ctx: hookContext
 			});
+			const turnStartFailureKind = classifyCodexModelCallFailureKind(turnStartError);
+			emitCodexModelCallError(turnStartErrorMessage, turnStartFailureKind ? { failureKind: turnStartFailureKind } : {});
 			await runCodexAgentEndHook(params, {
 				event: {
 					messages: buildTurnStartFailureMessages(),
@@ -6303,12 +6358,12 @@ async function runCodexAppServerAttempt(params, options = {}) {
 					authProfileId: startupAuthProfileId,
 					rateLimits: usageLimitError.rateLimitsForProfile
 				});
-				return buildCodexTurnStartFailureResult({
+				return { ...buildCodexTurnStartFailureResult({
 					params,
 					message: usageLimitError.message,
 					messagesSnapshot: buildTurnStartFailureMessages(),
 					systemPromptReport
-				});
+				}) };
 			}
 			throw turnStartError;
 		}
@@ -6380,24 +6435,26 @@ async function runCodexAppServerAttempt(params, options = {}) {
 		queueMessage: async (text, options) => activeSteeringQueue.queue(text, options),
 		isStreaming: () => !completed,
 		isCompacting: () => projector?.isCompacting() ?? false,
+		sourceReplyDeliveryMode: params.sourceReplyDeliveryMode,
 		cancel: () => runAbortController.abort("cancelled"),
 		abort: () => runAbortController.abort("aborted")
 	};
 	setActiveEmbeddedRun(params.sessionId, handle, params.sessionKey);
+	mirrorPromptAtTurnStartBestEffort({
+		params,
+		agentId: sessionAgentId,
+		sessionKey: sandboxSessionKey,
+		threadId: thread.threadId,
+		turnId: activeTurnId
+	});
 	turnAttemptIdleWatchArmed = true;
 	turnTerminalIdleWatchArmed = true;
 	touchTurnCompletionActivity("turn:start", { attemptProgress: true });
 	const abortListener = () => {
-		const shouldRetireClient = timedOut;
 		interruptCodexTurnBestEffort(client, {
 			threadId: thread.threadId,
 			turnId: activeTurnId,
-			timeoutMs: shouldRetireClient ? CODEX_APP_SERVER_INTERRUPT_TIMEOUT_MS : void 0
-		});
-		if (shouldRetireClient) retireCodexAppServerClientAfterTimedOutTurn(client, {
-			threadId: thread.threadId,
-			turnId: activeTurnId,
-			reason: String(runAbortController.signal.reason ?? "timeout")
+			timeoutMs: timedOut ? CODEX_APP_SERVER_INTERRUPT_TIMEOUT_MS : void 0
 		});
 		resolveCompletion?.();
 	};
@@ -6432,6 +6489,10 @@ async function runCodexAppServerAttempt(params, options = {}) {
 			result,
 			turnCompletionIdleTimedOut
 		});
+		const modelCallFailureKind = classifyCodexModelCallFailureKind(finalPromptError) ?? (finalAborted ? "aborted" : void 0);
+		if (modelCallFailureKind) emitCodexModelCallError(finalPromptError ?? "codex app-server attempt interrupted", { failureKind: modelCallFailureKind });
+		else if (finalPromptError) emitCodexModelCallError(finalPromptError);
+		else emitCodexModelCallCompleted(result);
 		recordCodexTrajectoryCompletion(trajectoryRecorder, {
 			attempt: params,
 			result,
@@ -6542,6 +6603,7 @@ async function runCodexAppServerAttempt(params, options = {}) {
 			systemPromptReport
 		};
 	} finally {
+		emitCodexModelCallError("codex app-server run completed without model-call terminal event");
 		emitLifecycleTerminal({
 			phase: "error",
 			error: "codex app-server run completed without lifecycle terminal event"
@@ -6717,6 +6779,16 @@ function toCodexDynamicToolProtocolResponse(response) {
 		success: response.success
 	};
 }
+function toCodexDynamicToolProgressResponse(response, protocolResponse) {
+	if (response.asyncStarted !== true) return protocolResponse;
+	return {
+		...protocolResponse,
+		details: {
+			async: true,
+			status: "started"
+		}
+	};
+}
 function shouldReleaseTurnAfterTerminalDynamicTool(state) {
 	return !state.completed && !state.aborted && state.responseSuccess && !state.currentTurnHadNonTerminalDynamicToolResult && state.activeAppServerTurnRequests === 0 && state.activeTurnItemIdsCount === 0 && state.pendingOpenClawDynamicToolCompletionIdsCount === 0;
 }
@@ -6797,7 +6869,10 @@ function createCodexNativeHookRelay(params) {
 			turnStartTimeoutMs: params.turnStartTimeoutMs
 		}),
 		signal: params.signal,
-		command: { timeoutMs: params.options?.gatewayTimeoutMs }
+		command: {
+			nice: 10,
+			timeoutMs: params.options?.gatewayTimeoutMs
+		}
 	});
 }
 function resolveCodexNativeHookRelayEvents(params) {
@@ -6865,19 +6940,6 @@ async function unsubscribeCodexThreadBestEffort(client, params) {
 		});
 	}
 }
-function retireCodexAppServerClientAfterTimedOutTurn(client, params) {
-	const clearedSharedClient = clearSharedCodexAppServerClientIfCurrent(client);
-	if (!clearedSharedClient) {
-		const close = client.close;
-		if (typeof close === "function") close.call(client);
-	}
-	embeddedAgentLog.warn("codex app-server client retired after timed-out turn", {
-		threadId: params.threadId,
-		turnId: params.turnId,
-		reason: params.reason,
-		clearedSharedClient
-	});
-}
 function resolveOpenClawCodingToolsSessionKeys(params, sandboxSessionKey) {
 	return {
 		sessionKey: sandboxSessionKey,
@@ -6893,12 +6955,54 @@ function resolveCodexAppServerHookChannelId(params, sandboxSessionKey) {
 		messageTo: params.messageTo
 	}).channelId;
 }
+const CODEX_DYNAMIC_TOOL_BUILD_WARN_TOTAL_MS = 1e3;
+const CODEX_DYNAMIC_TOOL_BUILD_WARN_STAGE_MS = 500;
+function createCodexDynamicToolBuildStageTracker(options = {}) {
+	if (!options.enabled) return {
+		mark() {},
+		snapshot() {
+			return {
+				totalMs: 0,
+				stages: []
+			};
+		}
+	};
+	const startedAt = Date.now();
+	let previousAt = startedAt;
+	const stages = [];
+	const toMs = (value) => Math.max(0, Math.round(value));
+	return {
+		mark(name) {
+			const currentAt = Date.now();
+			stages.push({
+				name,
+				durationMs: toMs(currentAt - previousAt),
+				elapsedMs: toMs(currentAt - startedAt)
+			});
+			previousAt = currentAt;
+		},
+		snapshot() {
+			return {
+				totalMs: toMs(Date.now() - startedAt),
+				stages: stages.slice()
+			};
+		}
+	};
+}
+function shouldWarnCodexDynamicToolBuildStageSummary(summary) {
+	return summary.totalMs >= CODEX_DYNAMIC_TOOL_BUILD_WARN_TOTAL_MS || summary.stages.some((stage) => stage.durationMs >= CODEX_DYNAMIC_TOOL_BUILD_WARN_STAGE_MS);
+}
+function formatCodexDynamicToolBuildStageSummary(summary) {
+	return summary.stages.length > 0 ? summary.stages.map((stage) => `${stage.name}:${stage.durationMs}ms@${stage.elapsedMs}ms`).join(",") : "none";
+}
 async function buildDynamicTools(input) {
 	const { params } = input;
 	if (params.disableTools || !supportsModelTools(params.model)) return [];
+	const toolBuildStages = createCodexDynamicToolBuildStageTracker({ enabled: input.profilerEnabled });
 	const modelHasVision = params.model.input?.includes("image") ?? false;
 	const agentDir = params.agentDir ?? resolveAgentDir$1(params.config ?? {}, input.sessionAgentId);
 	const createOpenClawCodingTools = (await import("openclaw/plugin-sdk/agent-harness")).createOpenClawCodingTools;
+	toolBuildStages.mark("load-agent-harness-tools");
 	const sessionKeys = resolveOpenClawCodingToolsSessionKeys(params, input.sandboxSessionKey);
 	const allTools = createOpenClawCodingTools({
 		agentId: input.sessionAgentId,
@@ -6963,13 +7067,22 @@ async function buildDynamicTools(input) {
 					message
 				}
 			});
+		},
+		recordToolPrepStage: (name) => {
+			toolBuildStages.mark(name);
 		}
 	});
-	const filteredTools = filterCodexDynamicToolsForAllowlist(filterToolsForVisionInputs(addNodeShellDynamicToolsIfNeeded(addSandboxShellDynamicToolsIfAvailable(isCodexMemoryFlushRun(params) ? filterCodexMemoryFlushDynamicTools(allTools) : filterCodexDynamicTools(allTools, input.pluginConfig), allTools, input), allTools, input), {
+	toolBuildStages.mark("create-openclaw-coding-tools");
+	const codexFilteredTools = addNodeShellDynamicToolsIfNeeded(addSandboxShellDynamicToolsIfAvailable(isCodexMemoryFlushRun(params) ? filterCodexMemoryFlushDynamicTools(allTools) : filterCodexDynamicTools(allTools, input.pluginConfig), allTools, input), allTools, input);
+	toolBuildStages.mark("codex-filtering");
+	const visionFilteredTools = filterToolsForVisionInputs(codexFilteredTools, {
 		modelHasVision,
 		hasInboundImages: (params.images?.length ?? 0) > 0
-	}), includeForcedCodexDynamicToolAllow(params.toolsAllow, params));
-	return normalizeAgentRuntimeTools({
+	});
+	toolBuildStages.mark("vision-filtering");
+	const filteredTools = filterCodexDynamicToolsForAllowlist(visionFilteredTools, includeForcedCodexDynamicToolAllow(params.toolsAllow, params));
+	toolBuildStages.mark("allowlist-filter");
+	const normalizedTools = normalizeAgentRuntimeTools({
 		runtimePlan: input.ignoreRuntimePlan ? void 0 : params.runtimePlan,
 		tools: filteredTools,
 		provider: params.provider,
@@ -6980,6 +7093,27 @@ async function buildDynamicTools(input) {
 		modelApi: params.model.api,
 		model: params.model
 	});
+	toolBuildStages.mark("runtime-normalization");
+	const summary = toolBuildStages.snapshot();
+	if (shouldWarnCodexDynamicToolBuildStageSummary(summary)) {
+		const phase = input.forceHeartbeatTool ? "registered-tools" : "runtime-tools";
+		embeddedAgentLog.warn(`codex app-server dynamic tool build timings runId=${params.runId} sessionId=${params.sessionId} phase=${phase} totalMs=${summary.totalMs} stages=${formatCodexDynamicToolBuildStageSummary(summary)}`, {
+			runId: params.runId,
+			sessionId: params.sessionId,
+			phase,
+			totalMs: summary.totalMs,
+			stages: summary.stages,
+			allToolCount: allTools.length,
+			codexFilteredToolCount: codexFilteredTools.length,
+			visionFilteredToolCount: visionFilteredTools.length,
+			filteredToolCount: filteredTools.length,
+			normalizedToolCount: normalizedTools.length,
+			forceHeartbeatTool: input.forceHeartbeatTool === true,
+			ignoreRuntimePlan: input.ignoreRuntimePlan === true,
+			nativeToolSurfaceEnabled: input.nativeToolSurfaceEnabled === true
+		});
+	}
+	return normalizedTools;
 }
 function includeForcedCodexDynamicToolAllow(toolsAllow, params) {
 	if (toolsAllow === void 0 || hasWildcardCodexToolsAllow(toolsAllow)) return toolsAllow;
@@ -7149,11 +7283,33 @@ function shouldProjectMirroredHistoryForCodexStart(params) {
 	if (!params.historyMessages.some((message) => message.role === "user")) return false;
 	if (params.forceProject) return true;
 	if (!params.startupBinding?.threadId) return true;
+	if (hasUserVisibleHistoryAfterCodexBinding({
+		startupBinding: params.startupBinding,
+		historyMessages: params.historyMessages
+	})) return true;
 	return !areCodexDynamicToolFingerprintsCompatible({
 		previous: params.startupBinding.dynamicToolsFingerprint,
 		next: params.dynamicToolsFingerprint
 	});
 }
+function hasUserVisibleHistoryAfterCodexBinding(params) {
+	const bindingUpdatedAt = Date.parse(params.startupBinding.updatedAt);
+	if (!Number.isFinite(bindingUpdatedAt)) return false;
+	return params.historyMessages.some((message) => {
+		if (message.role !== "user" && message.role !== "assistant") return false;
+		if (isCodexAppServerMirroredTranscriptMessage(message)) return false;
+		const timestamp = typeof message.timestamp === "number" ? message.timestamp : typeof message.timestamp === "string" ? Date.parse(message.timestamp) : NaN;
+		return Number.isFinite(timestamp) && timestamp > bindingUpdatedAt;
+	});
+}
+function isCodexAppServerMirroredTranscriptMessage(message) {
+	const record = message;
+	const idempotencyKey = record.idempotencyKey;
+	if (typeof idempotencyKey === "string" && idempotencyKey.startsWith("codex-app-server:")) return true;
+	const meta = record["__openclaw"];
+	if (!meta || typeof meta !== "object" || Array.isArray(meta)) return false;
+	return typeof meta.mirrorIdentity === "string";
+}
 function readContextEngineThreadBootstrapProjection(projection) {
 	if (projection?.mode !== "thread_bootstrap") return;
 	const epoch = projection.epoch?.trim();
@@ -7471,6 +7627,11 @@ function readRawAssistantTextPreview(item) {
 function isTurnNotification(value, threadId, turnId) {
 	return isCodexNotificationForTurn(value, threadId, turnId);
 }
+function isCodexNotificationOutsideActiveRun(correlation) {
+	if (!Boolean(correlation.threadId || correlation.nestedTurnThreadId)) return false;
+	if (!correlation.matchesActiveThread) return true;
+	return Boolean(correlation.turnId || correlation.nestedTurnId) && correlation.matchesActiveTurn === false;
+}
 function isCurrentThreadTurnRequestParams(value, threadId, turnId) {
 	if (!isJsonObject(value)) return false;
 	return readString(value, "threadId") === threadId && readString(value, "turnId") === turnId;
@@ -7528,8 +7689,7 @@ function readString(record, key) {
 	return typeof value === "string" ? value : void 0;
 }
 function readBoolean(record, key) {
-	const value = record[key];
-	return typeof value === "boolean" ? value : void 0;
+	return asBoolean(record[key]);
 }
 async function readMirroredSessionHistoryMessages(sessionFile) {
 	const messages = await readCodexMirroredSessionHistoryMessages(sessionFile);
@@ -7596,7 +7756,8 @@ function buildCodexSystemPromptReport(params) {
 		systemPrompt: {
 			chars: params.developerInstructions.length,
 			projectContextChars: 0,
-			nonProjectContextChars: params.developerInstructions.length
+			nonProjectContextChars: params.developerInstructions.length,
+			hash: sha256Text(params.developerInstructions)
 		},
 		injectedWorkspaceFiles: buildCodexBootstrapInjectionStats({
 			bootstrapFiles: params.workspaceBootstrapContext.bootstrapFiles,
@@ -7605,6 +7766,7 @@ function buildCodexSystemPromptReport(params) {
 		}),
 		skills: {
 			promptChars: skillsPrompt.length,
+			hash: sha256Text(skillsPrompt),
 			entries: buildCodexSkillReportEntries(skillsPrompt)
 		},
 		tools: {
@@ -7621,17 +7783,30 @@ function buildCodexSkillReportEntries(skillsPrompt) {
 		blockChars: block.length
 	})).filter((entry) => entry.blockChars > 0);
 }
+function readCodexDiagnosticToolParameters(tool) {
+	return tool.inputSchema ?? tool.parameters;
+}
+function buildCodexDiagnosticToolDefinitions(tools) {
+	return tools.map((tool) => ({
+		name: tool.name,
+		description: tool.description,
+		parameters: readCodexDiagnosticToolParameters(tool)
+	}));
+}
 function buildCodexToolReportEntry(tool) {
 	const summary = tool.description.trim();
 	if (tool.deferLoading === true) return {
 		name: tool.name,
 		summaryChars: summary.length,
+		summaryHash: sha256Text(summary),
 		schemaChars: 0,
+		schemaHash: stableJsonHash(null),
 		propertiesCount: null
 	};
 	return {
 		name: tool.name,
 		summaryChars: summary.length,
+		summaryHash: sha256Text(summary),
 		...buildCodexToolSchemaStats(tool.inputSchema)
 	};
 }
@@ -7646,9 +7821,24 @@ function buildCodexToolSchemaStats(schema) {
 	const properties = isJsonObject(schema) && isJsonObject(schema.properties) ? schema.properties : null;
 	return {
 		schemaChars,
+		schemaHash: stableJsonHash(schema),
 		propertiesCount: properties ? Object.keys(properties).length : null
 	};
 }
+function sha256Text(value) {
+	return createHash("sha256").update(value).digest("hex");
+}
+function normalizeForStableHash(value) {
+	if (Array.isArray(value)) return value.map((entry) => normalizeForStableHash(entry));
+	if (value && typeof value === "object") {
+		const record = value;
+		return Object.fromEntries(Object.keys(record).toSorted((left, right) => left.localeCompare(right)).map((key) => [key, normalizeForStableHash(record[key])]));
+	}
+	return value;
+}
+function stableJsonHash(value) {
+	return sha256Text(JSON.stringify(normalizeForStableHash(value)) ?? "null");
+}
 function buildCodexBootstrapInjectionStats(params) {
 	const injectedIndex = indexCodexContextFileContent(params.injectedFiles);
 	const developerInstructionIndex = indexCodexContextFileContent(params.developerInstructionFiles ?? []);
@@ -7822,9 +8012,11 @@ function isMissingCodexBootstrapContextFile(file) {
 function remapCodexContextFilePath(params) {
 	const relativePath = path.relative(params.sourceWorkspaceDir, params.file.path);
 	if (!relativePath || relativePath === ".." || relativePath.startsWith(`..${path.sep}`) || path.isAbsolute(relativePath) || params.sourceWorkspaceDir === params.targetWorkspaceDir) return params.file;
+	const targetUsesPosixSeparators = params.targetWorkspaceDir.includes("/") && !params.targetWorkspaceDir.includes("\\");
+	const normalizedRelativePath = targetUsesPosixSeparators ? relativePath.replaceAll("\\", "/") : relativePath.replaceAll("/", "\\");
 	return {
 		...params.file,
-		path: path.join(params.targetWorkspaceDir, relativePath)
+		path: targetUsesPosixSeparators ? path.posix.join(params.targetWorkspaceDir, normalizedRelativePath) : path.win32.join(params.targetWorkspaceDir, normalizedRelativePath)
 	};
 }
 function compareCodexContextFiles(left, right) {
@@ -7861,6 +8053,21 @@ async function mirrorTranscriptBestEffort(params) {
 		embeddedAgentLog.warn("failed to mirror codex app-server transcript", { error });
 	}
 }
+async function mirrorPromptAtTurnStartBestEffort(params) {
+	if (params.params.suppressNextUserMessagePersistence) return;
+	try {
+		await mirrorCodexAppServerTranscript({
+			sessionFile: params.params.sessionFile,
+			agentId: params.agentId,
+			sessionKey: params.sessionKey,
+			messages: [attachCodexMirrorIdentity(buildCodexUserPromptMessage(params.params), `${params.turnId}:prompt`)],
+			idempotencyScope: `codex-app-server:${params.threadId}`,
+			config: params.params.config
+		});
+	} catch (error) {
+		embeddedAgentLog.warn("failed to mirror codex app-server prompt at turn start", { error });
+	}
+}
 function isNonEmptyString(value) {
 	return typeof value === "string" && value.length > 0;
 }
@@ -7907,6 +8114,7 @@ function handleApprovalRequest(params) {
 		threadId: params.threadId,
 		turnId: params.turnId,
 		nativeHookRelay: params.nativeHookRelay,
+		autoApprove: params.autoApprove,
 		signal: params.signal
 	});
 }