@openclaw/codex 2026.5.28-beta.2 → 2026.5.28-beta.4

package/dist/{client-TfDda-h3.js → client-DMXvboVu.js}

@@ -1,4 +1,4 @@
-import { l as resolveCodexAppServerRuntimeOptions } from "./config-BW7NPdAQ.js";
+import { l as resolveCodexAppServerRuntimeOptions } from "./config--tW89bHH.js";
 import { materializeWindowsSpawnProgram, resolveWindowsSpawnProgram } from "openclaw/plugin-sdk/windows-spawn";
 import { OPENCLAW_VERSION, embeddedAgentLog } from "openclaw/plugin-sdk/agent-harness-runtime";
 import { createInterface } from "node:readline";

package/dist/{client-factory-BPBvbguy.js → client-factory-qZvhyyXr.js}

@@ -1,11 +1,11 @@
 //#region extensions/codex/src/app-server/client-factory.ts
-const defaultCodexAppServerClientFactory = (startOptions, authProfileId, agentDir, config) => import("./shared-client-DICbgRn5.js").then((n) => n.s).then(({ getSharedCodexAppServerClient }) => getSharedCodexAppServerClient({
+const defaultCodexAppServerClientFactory = (startOptions, authProfileId, agentDir, config) => import("./shared-client-Duh1bHaP.js").then((n) => n.s).then(({ getSharedCodexAppServerClient }) => getSharedCodexAppServerClient({
 	startOptions,
 	authProfileId,
 	agentDir,
 	config
 }));
-const defaultLeasedCodexAppServerClientFactory = (startOptions, authProfileId, agentDir, config) => import("./shared-client-DICbgRn5.js").then((n) => n.s).then(({ getLeasedSharedCodexAppServerClient }) => getLeasedSharedCodexAppServerClient({
+const defaultLeasedCodexAppServerClientFactory = (startOptions, authProfileId, agentDir, config) => import("./shared-client-Duh1bHaP.js").then((n) => n.s).then(({ getLeasedSharedCodexAppServerClient }) => getLeasedSharedCodexAppServerClient({
 	startOptions,
 	authProfileId,
 	agentDir,

package/dist/{command-handlers-B8MXR7fh.js → command-handlers-C2t6-ChO.js}

@@ -1,16 +1,17 @@
-import { a as isCodexFastServiceTier, l as resolveCodexAppServerRuntimeOptions } from "./config-BW7NPdAQ.js";
-import { n as listCodexAppServerModels, t as listAllCodexAppServerModels } from "./models-Dnasi6LR.js";
-import { l as isJsonObject } from "./client-TfDda-h3.js";
-import { i as readCodexAppServerBinding, o as writeCodexAppServerBinding, t as clearCodexAppServerBinding } from "./session-binding-DuJisBZB.js";
-import { i as describeControlFailure, r as CODEX_CONTROL_METHODS, t as requestCodexAppServerJson } from "./request-Cj95iOk6.js";
-import { a as buildHelp, c as formatCodexStatus, d as formatModels, f as formatSkills, l as formatComputerUseStatus, m as readString$1, o as formatAccount, p as formatThreads, s as formatCodexDisplayText, u as formatList, v as summarizeCodexAccountUsage } from "./notification-correlation-BVB6XFQM.js";
-import { n as resolveCodexNativeExecutionBlock, r as resolveCodexNativeSandboxBlock } from "./sandbox-guard-CTnEWuor.js";
-import { _ as steerCodexConversationTurn, b as readCodexConversationBindingData, d as parseCodexFastModeArg, f as parseCodexPermissionsModeArg, g as setCodexConversationPermissions, h as setCodexConversationModel, m as setCodexConversationFastMode, o as formatCodexCliSessions, p as readCodexConversationActiveTurn, r as startCodexConversationThread, u as formatPermissionsMode, v as stopCodexConversationTurn, x as resolveCodexDefaultWorkspaceDir, y as createCodexCliNodeConversationBindingData } from "./conversation-binding-D8OO0S9R.js";
-import { n as installCodexComputerUse, r as readCodexComputerUseStatus } from "./computer-use-BRIifWhE.js";
+import { a as isCodexFastServiceTier, l as resolveCodexAppServerRuntimeOptions } from "./config--tW89bHH.js";
+import { n as listCodexAppServerModels, t as listAllCodexAppServerModels } from "./models-QT-XOhE7.js";
+import { l as isJsonObject } from "./client-DMXvboVu.js";
+import { i as readCodexAppServerBinding, o as writeCodexAppServerBinding, t as clearCodexAppServerBinding } from "./session-binding-ueMCn4om.js";
+import { i as describeControlFailure, r as CODEX_CONTROL_METHODS, t as requestCodexAppServerJson } from "./request-CF4f5hWY.js";
+import { a as buildHelp, c as formatCodexStatus, d as formatModels, f as formatSkills, l as formatComputerUseStatus, m as readString$1, o as formatAccount, p as formatThreads, s as formatCodexDisplayText, u as formatList, v as summarizeCodexAccountUsage } from "./notification-correlation-BDakP_d3.js";
+import { n as resolveCodexNativeExecutionBlock, r as resolveCodexNativeSandboxBlock } from "./sandbox-guard-mXE4_vE_.js";
+import { _ as steerCodexConversationTurn, b as readCodexConversationBindingData, d as parseCodexFastModeArg, f as parseCodexPermissionsModeArg, g as setCodexConversationPermissions, h as setCodexConversationModel, m as setCodexConversationFastMode, o as formatCodexCliSessions, p as readCodexConversationActiveTurn, r as startCodexConversationThread, u as formatPermissionsMode, v as stopCodexConversationTurn, x as resolveCodexDefaultWorkspaceDir, y as createCodexCliNodeConversationBindingData } from "./conversation-binding-CC9XMAwn.js";
+import { n as installCodexComputerUse, r as readCodexComputerUseStatus } from "./computer-use-Ba4vW9fO.js";
 import { n as rememberCodexRateLimits } from "./rate-limit-cache-N66I-Rd7.js";
 import crypto from "node:crypto";
 import { normalizeOptionalString, normalizeUniqueStringEntries } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { ensureAuthProfileStore, findNormalizedProviderValue, resolveAgentDir, resolveAuthProfileEligibility, resolveAuthProfileOrder, resolveDefaultAgentDir, resolveProfileUnusableUntilForDisplay, resolveSessionAgentIds } from "openclaw/plugin-sdk/agent-runtime";
+import { parseStrictPositiveInteger } from "openclaw/plugin-sdk/number-runtime";
 //#region extensions/codex/src/command-account.ts
 const OPENAI_PROVIDER_ID = "openai";
 const OPENAI_CODEX_PROVIDER_ID = "openai-codex";
@@ -621,6 +622,7 @@ async function bindConversation(deps, ctx, pluginConfig, args) {
 		sessionFile: ctx.sessionFile,
 		workspaceDir,
 		agentDir: scope.agentDir,
+		sessionKey: ctx.sessionKey,
 		threadId: parsed.threadId,
 		model: parsed.model,
 		modelProvider: parsed.provider
@@ -1442,9 +1444,8 @@ function parseCodexCliSessionsArgs(args) {
 			continue;
 		}
 		if (arg === "--limit") {
-			const value = readRequiredOptionValue(args, index);
-			const parsedLimit = value && /^\+?\d+$/.test(value.trim()) ? Number(value.trim()) : NaN;
-			if (!Number.isSafeInteger(parsedLimit) || parsedLimit <= 0) {
+			const parsedLimit = parseStrictPositiveInteger(readRequiredOptionValue(args, index));
+			if (parsedLimit === void 0) {
 				parsed.help = true;
 				continue;
 			}

package/dist/{compact-Dyz0rQLl.js → compact-Dlnt5G3v.js}

@@ -1,7 +1,7 @@
-import { t as defaultCodexAppServerClientFactory } from "./client-factory-BPBvbguy.js";
-import { l as resolveCodexAppServerRuntimeOptions } from "./config-BW7NPdAQ.js";
-import { i as readCodexAppServerBinding } from "./session-binding-DuJisBZB.js";
-import { n as resolveCodexNativeExecutionBlock } from "./sandbox-guard-CTnEWuor.js";
+import { t as defaultCodexAppServerClientFactory } from "./client-factory-qZvhyyXr.js";
+import { l as resolveCodexAppServerRuntimeOptions } from "./config--tW89bHH.js";
+import { i as readCodexAppServerBinding } from "./session-binding-ueMCn4om.js";
+import { n as resolveCodexNativeExecutionBlock } from "./sandbox-guard-mXE4_vE_.js";
 import { embeddedAgentLog } from "openclaw/plugin-sdk/agent-harness-runtime";
 //#region extensions/codex/src/app-server/compact.ts
 const warnedIgnoredCompactionOverrides = /* @__PURE__ */ new Set();

package/dist/{computer-use-BRIifWhE.js → computer-use-Ba4vW9fO.js}

@@ -1,5 +1,5 @@
-import { l as resolveCodexAppServerRuntimeOptions, u as resolveCodexComputerUseConfig } from "./config-BW7NPdAQ.js";
-import { i as describeControlFailure, t as requestCodexAppServerJson } from "./request-Cj95iOk6.js";
+import { l as resolveCodexAppServerRuntimeOptions, u as resolveCodexComputerUseConfig } from "./config--tW89bHH.js";
+import { i as describeControlFailure, t as requestCodexAppServerJson } from "./request-CF4f5hWY.js";
 import { existsSync } from "node:fs";
 //#region extensions/codex/src/app-server/computer-use.ts
 var CodexComputerUseSetupError = class extends Error {

package/dist/{config-BW7NPdAQ.js → config--tW89bHH.js}

@@ -1,6 +1,8 @@
 import { createHmac, randomBytes } from "node:crypto";
 import { readFileSync } from "node:fs";
 import { hostname } from "node:os";
+import { resolveExecApprovalsFromFile } from "openclaw/plugin-sdk/exec-approvals-runtime";
+import { normalizeAgentId } from "openclaw/plugin-sdk/routing";
 import { normalizeTrimmedStringList } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { detectWindowsSpawnCommandInlineArgs } from "openclaw/plugin-sdk/windows-spawn";
 import { z } from "zod";
@@ -147,17 +149,46 @@ function resolveCodexAppServerRuntimeOptions(params = {}) {
 	const clearEnv = normalizeStringList(config.clearEnv);
 	const authToken = readNonEmptyString(config.authToken);
 	const url = readNonEmptyString(config.url);
+	const execMode = resolveEffectiveOpenClawExecModeForCodexAppServer({
+		execMode: params.execMode,
+		execPolicy: params.execPolicy
+	});
+	assertCodexAppServerAllowedForOpenClawExecMode(execMode);
 	const explicitPolicyMode = resolvePolicyMode(config.mode) ?? resolvePolicyMode(env.OPENCLAW_CODEX_APP_SERVER_MODE);
-	const defaultPolicy = explicitPolicyMode ? void 0 : resolveDefaultCodexAppServerPolicy({
+	const configuredSandbox = resolveSandbox(config.sandbox) ?? resolveSandbox(env.OPENCLAW_CODEX_APP_SERVER_SANDBOX);
+	const explicitApprovalsReviewer = resolveApprovalsReviewer(config.approvalsReviewer);
+	const normalizedPolicyMode = resolveCodexPolicyModeForOpenClawExecMode(execMode);
+	const ignoreLegacyYoloPolicyMode = normalizedPolicyMode === "guardian" && explicitPolicyMode === "yolo";
+	const forceUserReviewer = execMode !== void 0 && execMode !== "auto" && execMode !== "full";
+	const forceGuardianReviewer = execMode === "auto";
+	const forceDangerFullAccessSandbox = params.execPolicy?.touched === true && params.execPolicy.security === "full" && params.execPolicy.ask === "always";
+	const forceRuntimePolicy = forceUserReviewer || forceGuardianReviewer || forceDangerFullAccessSandbox;
+	const defaultPolicy = explicitPolicyMode && !forceRuntimePolicy && !ignoreLegacyYoloPolicyMode ? void 0 : resolveDefaultCodexAppServerPolicy({
 		transport,
 		env,
+		forceGuardian: normalizedPolicyMode === "guardian",
+		forceUserReviewer,
+		execModeRequiringPromptingApprovals: execMode === "auto" || execMode === "ask" ? execMode : void 0,
 		requirementsToml: params.requirementsToml,
 		requirementsPath: params.requirementsPath,
 		readRequirementsFile: params.readRequirementsFile,
 		platform: params.platform,
 		hostName: params.hostName
 	});
-	const policyMode = explicitPolicyMode ?? defaultPolicy?.mode ?? "yolo";
+	const preserveExplicitAutoSandbox = forceGuardianReviewer && configuredSandbox === "read-only";
+	const forcedPolicy = forceRuntimePolicy ? {
+		approvalPolicy: defaultPolicy?.approvalPolicy ?? "on-request",
+		sandbox: preserveExplicitAutoSandbox ? void 0 : forceDangerFullAccessSandbox ? selectForcedDangerFullAccessSandbox({
+			configuredSandbox,
+			defaultPolicy,
+			openClawSandboxActive: Boolean(params.openClawSandboxActive)
+		}) : selectForcedPromptingSandbox({
+			configuredSandbox,
+			defaultSandbox: defaultPolicy?.sandbox
+		}),
+		approvalsReviewer: defaultPolicy?.approvalsReviewer ?? (forceUserReviewer ? "user" : "auto_review")
+	} : void 0;
+	const policyMode = ignoreLegacyYoloPolicyMode ? normalizedPolicyMode : explicitPolicyMode ?? normalizedPolicyMode ?? defaultPolicy?.mode ?? "yolo";
 	const serviceTier = normalizeCodexServiceTier(config.serviceTier);
 	if (transport === "websocket" && !url) throw new Error("plugins.entries.codex.config.appServer.url is required when appServer.transport is websocket");
 	const configApprovalPolicy = resolveApprovalPolicy(config.approvalPolicy);
@@ -183,10 +214,10 @@ function resolveCodexAppServerRuntimeOptions(params = {}) {
 		requestTimeoutMs: normalizePositiveNumber(config.requestTimeoutMs, 6e4),
 		turnCompletionIdleTimeoutMs: normalizePositiveNumber(config.turnCompletionIdleTimeoutMs, 6e4),
 		...config.postToolRawAssistantCompletionIdleTimeoutMs !== void 0 ? { postToolRawAssistantCompletionIdleTimeoutMs: normalizePositiveNumber(config.postToolRawAssistantCompletionIdleTimeoutMs, 6e4) } : {},
-		approvalPolicy,
+		approvalPolicy: forcedPolicy?.approvalPolicy ?? approvalPolicy,
 		approvalPolicySource,
-		sandbox: resolveSandbox(config.sandbox) ?? resolveSandbox(env.OPENCLAW_CODEX_APP_SERVER_SANDBOX) ?? defaultPolicy?.sandbox ?? (policyMode === "guardian" ? "workspace-write" : "danger-full-access"),
-		approvalsReviewer: resolveApprovalsReviewer(config.approvalsReviewer) ?? defaultPolicy?.approvalsReviewer ?? (policyMode === "guardian" ? "auto_review" : "user"),
+		sandbox: forcedPolicy?.sandbox ?? configuredSandbox ?? defaultPolicy?.sandbox ?? (policyMode === "guardian" ? "workspace-write" : "danger-full-access"),
+		approvalsReviewer: forcedPolicy?.approvalsReviewer ?? explicitApprovalsReviewer ?? defaultPolicy?.approvalsReviewer ?? (policyMode === "guardian" ? "auto_review" : "user"),
 		...serviceTier ? { serviceTier } : {}
 	};
 }
@@ -268,20 +299,39 @@ function resolvePolicyMode(value) {
 	return value === "guardian" || value === "yolo" ? value : void 0;
 }
 function resolveDefaultCodexAppServerPolicy(params) {
-	if (params.transport !== "stdio") return { mode: "yolo" };
+	if (params.transport !== "stdio") return {
+		mode: "yolo",
+		dangerFullAccessAllowed: true
+	};
 	const content = readCodexRequirementsToml(params);
-	if (content === void 0) return { mode: "yolo" };
+	if (content === void 0) {
+		if (!params.forceGuardian) return {
+			mode: "yolo",
+			dangerFullAccessAllowed: true
+		};
+		return {
+			mode: "guardian",
+			dangerFullAccessAllowed: true,
+			approvalPolicy: selectGuardianApprovalPolicy(void 0, params.execModeRequiringPromptingApprovals),
+			approvalsReviewer: params.forceUserReviewer ? selectUserApprovalsReviewer(void 0) : selectGuardianApprovalsReviewer(void 0, params.execModeRequiringPromptingApprovals === "auto" ? "auto" : void 0),
+			sandbox: selectGuardianSandbox(void 0)
+		};
+	}
 	const allowedSandboxModes = parseAllowedSandboxModesFromCodexRequirements(content, readNonEmptyString(params.hostName) ?? hostname());
 	const allowedApprovalPolicies = parseAllowedApprovalPoliciesFromCodexRequirements(content);
 	const allowedApprovalsReviewers = parseAllowedApprovalsReviewersFromCodexRequirements(content);
 	const yoloSandboxAllowed = allowedSandboxModes === void 0 || allowedSandboxModes.has("danger-full-access");
 	const yoloApprovalAllowed = allowedApprovalPolicies === void 0 || allowedApprovalPolicies.has("never");
 	const yoloReviewerAllowed = allowedApprovalsReviewers === void 0 || allowedApprovalsReviewers.has("user");
-	if (yoloSandboxAllowed && yoloApprovalAllowed && yoloReviewerAllowed) return { mode: "yolo" };
+	if (!params.forceGuardian && yoloSandboxAllowed && yoloApprovalAllowed && yoloReviewerAllowed) return {
+		mode: "yolo",
+		dangerFullAccessAllowed: true
+	};
 	return {
 		mode: "guardian",
-		approvalPolicy: selectGuardianApprovalPolicy(allowedApprovalPolicies),
-		approvalsReviewer: selectGuardianApprovalsReviewer(allowedApprovalsReviewers),
+		dangerFullAccessAllowed: yoloSandboxAllowed,
+		approvalPolicy: selectGuardianApprovalPolicy(allowedApprovalPolicies, params.execModeRequiringPromptingApprovals),
+		approvalsReviewer: params.forceUserReviewer ? selectUserApprovalsReviewer(allowedApprovalsReviewers) : selectGuardianApprovalsReviewer(allowedApprovalsReviewers, params.execModeRequiringPromptingApprovals === "auto" ? "auto" : void 0),
 		sandbox: selectGuardianSandbox(allowedSandboxModes)
 	};
 }
@@ -420,19 +470,37 @@ function normalizeRequirementsApprovalPolicy(value) {
 function normalizeRequirementsApprovalsReviewer(value) {
 	return resolveApprovalsReviewer(value.trim().toLowerCase());
 }
-function selectGuardianApprovalPolicy(allowedApprovalPolicies) {
+function selectGuardianApprovalPolicy(allowedApprovalPolicies, execModeRequiringPromptingApprovals) {
 	if (allowedApprovalPolicies === void 0 || allowedApprovalPolicies.has("on-request")) return "on-request";
+	if (execModeRequiringPromptingApprovals) throw new Error(`tools.exec.mode=${execModeRequiringPromptingApprovals} requires Codex app-server prompting approvals`);
 	if (allowedApprovalPolicies.has("on-failure")) return "on-failure";
 	if (allowedApprovalPolicies.has("untrusted")) return "untrusted";
 	if (allowedApprovalPolicies.has("never")) return "never";
 	return "on-request";
 }
-function selectGuardianApprovalsReviewer(allowedApprovalsReviewers) {
+function selectGuardianApprovalsReviewer(allowedApprovalsReviewers, execModeRequiringAutoReviewer) {
 	if (allowedApprovalsReviewers === void 0 || allowedApprovalsReviewers.has("auto_review")) return "auto_review";
 	if (allowedApprovalsReviewers.has("guardian_subagent")) return "guardian_subagent";
+	if (execModeRequiringAutoReviewer) throw new Error(`tools.exec.mode=${execModeRequiringAutoReviewer} requires Codex app-server auto approvals`);
 	if (allowedApprovalsReviewers.has("user")) return "user";
 	return "auto_review";
 }
+function selectUserApprovalsReviewer(allowedApprovalsReviewers) {
+	if (allowedApprovalsReviewers === void 0 || allowedApprovalsReviewers.has("user")) return "user";
+	throw new Error("tools.exec.mode=ask requires Codex app-server user approvals");
+}
+function selectForcedPromptingSandbox(params) {
+	if (params.configuredSandbox === "read-only" || params.defaultSandbox === "read-only") return "read-only";
+	return params.defaultSandbox ?? "workspace-write";
+}
+function selectForcedDangerFullAccessSandbox(params) {
+	if (params.configuredSandbox === "read-only") return "read-only";
+	if (params.defaultPolicy?.dangerFullAccessAllowed === false) {
+		if (params.openClawSandboxActive) return params.defaultPolicy.sandbox ?? "workspace-write";
+		throw new Error("legacy full exec security with ask requires Codex app-server danger-full-access");
+	}
+	return "danger-full-access";
+}
 function selectGuardianSandbox(allowedSandboxModes) {
 	if (allowedSandboxModes === void 0 || allowedSandboxModes.has("workspace-write")) return "workspace-write";
 	if (allowedSandboxModes.has("read-only")) return "read-only";
@@ -448,6 +516,151 @@ function resolveSandbox(value) {
 function resolveApprovalsReviewer(value) {
 	return value === "auto_review" || value === "guardian_subagent" || value === "user" ? value : void 0;
 }
+function resolveOpenClawExecPolicyFromConfig(params) {
+	const root = readRecord(params.config);
+	const globalExec = readRecord(readRecord(root?.tools)?.exec);
+	const globalPolicy = applyOpenClawExecPolicyLayer(createDefaultOpenClawExecPolicy(), globalExec);
+	const agentId = params.agentId?.trim();
+	if (!agentId) return globalPolicy;
+	const agents = readRecord(root?.agents);
+	const agentList = Array.isArray(agents?.list) ? agents.list : [];
+	const normalizedAgentId = normalizeAgentId(agentId);
+	return applyOpenClawExecPolicyLayer(globalPolicy, readRecord(readRecord(readRecord(agentList.find((entry) => {
+		const id = readRecord(entry)?.id;
+		return typeof id === "string" && normalizeAgentId(id) === normalizedAgentId;
+	}))?.tools)?.exec));
+}
+function resolveOpenClawExecPolicyForCodexAppServer(params) {
+	const overridePolicy = applyOpenClawExecPolicyLayer(resolveOpenClawExecPolicyFromConfig({
+		config: params.config,
+		agentId: params.agentId
+	}), params.execOverrides);
+	return applyOpenClawExecApprovalFloors(overridePolicy, resolveOpenClawExecApprovalFloorsForCodexAppServer({
+		approvals: params.approvals,
+		agentId: params.agentId,
+		policy: overridePolicy
+	}));
+}
+function resolveEffectiveOpenClawExecModeForCodexAppServer(params) {
+	if (params.execPolicy?.touched === true) return params.execPolicy.mode;
+	return params.execMode;
+}
+function resolveCodexPolicyModeForOpenClawExecMode(mode) {
+	if (!mode || mode === "full") return;
+	return "guardian";
+}
+function assertCodexAppServerAllowedForOpenClawExecMode(mode) {
+	if (mode === "deny" || mode === "allowlist") throw new Error(`Codex app-server local execution is not available when tools.exec.mode=${mode}`);
+}
+function createDefaultOpenClawExecPolicy() {
+	return {
+		security: "full",
+		ask: "off",
+		touched: false
+	};
+}
+function applyOpenClawExecPolicyLayer(base, exec) {
+	if (!exec) return base;
+	const mode = readExecMode(exec.mode);
+	if (mode !== void 0) return {
+		...resolveOpenClawExecPolicyForMode(mode),
+		touched: true
+	};
+	const security = readExecSecurity(exec.security);
+	const ask = readExecAsk(exec.ask);
+	if (security === void 0 && ask === void 0) return base;
+	const nextSecurity = security ?? base.security;
+	const nextAsk = ask ?? base.ask;
+	return {
+		mode: resolveOpenClawExecModeFromPolicy({
+			security: nextSecurity,
+			ask: nextAsk
+		}),
+		security: nextSecurity,
+		ask: nextAsk,
+		touched: true
+	};
+}
+function resolveOpenClawExecApprovalFloorsForCodexAppServer(params) {
+	if (!params.approvals) return;
+	return resolveExecApprovalsFromFile({
+		file: params.approvals,
+		agentId: params.agentId,
+		overrides: {
+			security: params.policy.security,
+			ask: params.policy.ask
+		}
+	}).agent;
+}
+function applyOpenClawExecApprovalFloors(base, approvalFloors) {
+	if (!approvalFloors) return base;
+	const nextSecurity = approvalFloors.security ? minOpenClawExecSecurity(base.security, approvalFloors.security) : base.security;
+	const nextAsk = approvalFloors.ask ? maxOpenClawExecAsk(base.ask, approvalFloors.ask) : base.ask;
+	if (nextSecurity === base.security && nextAsk === base.ask) return base;
+	return {
+		mode: resolveOpenClawExecModeFromPolicy({
+			security: nextSecurity,
+			ask: nextAsk
+		}),
+		security: nextSecurity,
+		ask: nextAsk,
+		touched: true
+	};
+}
+function resolveOpenClawExecPolicyForMode(mode) {
+	switch (mode) {
+		case "deny": return {
+			mode,
+			security: "deny",
+			ask: "off"
+		};
+		case "allowlist": return {
+			mode,
+			security: "allowlist",
+			ask: "off"
+		};
+		case "ask":
+		case "auto": return {
+			mode,
+			security: "allowlist",
+			ask: "on-miss"
+		};
+		case "full": return {
+			mode,
+			security: "full",
+			ask: "off"
+		};
+	}
+	return mode;
+}
+function resolveOpenClawExecModeFromPolicy(params) {
+	if (params.security === "deny") return "deny";
+	if (params.security === "allowlist" && params.ask === "off") return "allowlist";
+	if (params.security === "full" && params.ask !== "always") return "full";
+	return "ask";
+}
+function minOpenClawExecSecurity(left, right) {
+	const order = {
+		deny: 0,
+		allowlist: 1,
+		full: 2
+	};
+	return order[left] <= order[right] ? left : right;
+}
+function maxOpenClawExecAsk(left, right) {
+	const order = {
+		off: 0,
+		"on-miss": 1,
+		always: 2
+	};
+	return order[left] >= order[right] ? left : right;
+}
+function readExecMode(value) {
+	return value === "deny" || value === "allowlist" || value === "ask" || value === "auto" || value === "full" ? value : void 0;
+}
+function readRecord(value) {
+	return value && typeof value === "object" && !Array.isArray(value) ? value : void 0;
+}
 function normalizeCodexServiceTier(value) {
 	if (typeof value !== "string") return;
 	const trimmed = value.trim();
@@ -486,6 +699,12 @@ function readBooleanEnv(value) {
 		"off"
 	].includes(normalized)) return false;
 }
+function readExecSecurity(value) {
+	return value === "deny" || value === "allowlist" || value === "full" ? value : void 0;
+}
+function readExecAsk(value) {
+	return value === "off" || value === "on-miss" || value === "always" ? value : void 0;
+}
 function readNumberEnv(value) {
 	const trimmed = value?.trim();
 	if (!trimmed || !PLAIN_DECIMAL_NUMBER_RE.test(trimmed)) return;
@@ -537,4 +756,4 @@ function splitShellWords(value) {
 	return words;
 }
 //#endregion
-export { isCodexFastServiceTier as a, readCodexPluginConfig as c, resolveCodexPluginsPolicy as d, shouldAutoApproveCodexAppServerApprovals as f, isCodexAppServerApprovalPolicyAllowedByRequirements as i, resolveCodexAppServerRuntimeOptions as l, codexAppServerStartOptionsKey as n, isCodexSandboxExecServerEnabled as o, withMcpElicitationsApprovalPolicy as p, codexSandboxPolicyForTurn as r, normalizeCodexServiceTier as s, CODEX_PLUGINS_MARKETPLACE_NAME as t, resolveCodexComputerUseConfig as u };
+export { isCodexFastServiceTier as a, readCodexPluginConfig as c, resolveCodexPluginsPolicy as d, resolveOpenClawExecPolicyForCodexAppServer as f, isCodexAppServerApprovalPolicyAllowedByRequirements as i, resolveCodexAppServerRuntimeOptions as l, withMcpElicitationsApprovalPolicy as m, codexAppServerStartOptionsKey as n, isCodexSandboxExecServerEnabled as o, shouldAutoApproveCodexAppServerApprovals as p, codexSandboxPolicyForTurn as r, normalizeCodexServiceTier as s, CODEX_PLUGINS_MARKETPLACE_NAME as t, resolveCodexComputerUseConfig as u };

package/dist/{conversation-binding-D8OO0S9R.js → conversation-binding-CC9XMAwn.js}

@@ -1,18 +1,21 @@
-import { a as isCodexFastServiceTier, l as resolveCodexAppServerRuntimeOptions, r as codexSandboxPolicyForTurn } from "./config-BW7NPdAQ.js";
-import { l as isJsonObject } from "./client-TfDda-h3.js";
-import { t as CODEX_NATIVE_PERSONALITY_NONE } from "./thread-lifecycle-1u5ogKG_.js";
-import { i as readCodexAppServerBinding, n as isCodexAppServerNativeAuthProfile, o as writeCodexAppServerBinding, r as normalizeCodexAppServerBindingModelProvider, t as clearCodexAppServerBinding } from "./session-binding-DuJisBZB.js";
-import { r as CODEX_CONTROL_METHODS } from "./request-Cj95iOk6.js";
-import { i as readCodexNotificationTurnId, r as readCodexNotificationThreadId, s as formatCodexDisplayText } from "./notification-correlation-BVB6XFQM.js";
-import { a as releaseLeasedSharedCodexAppServerClient, f as resolveCodexAppServerAuthProfileIdForAgent, i as getLeasedSharedCodexAppServerClient } from "./shared-client-DICbgRn5.js";
-import { n as resolveCodexNativeExecutionBlock, r as resolveCodexNativeSandboxBlock } from "./sandbox-guard-CTnEWuor.js";
+import { a as isCodexFastServiceTier, f as resolveOpenClawExecPolicyForCodexAppServer, l as resolveCodexAppServerRuntimeOptions, r as codexSandboxPolicyForTurn } from "./config--tW89bHH.js";
+import { l as isJsonObject } from "./client-DMXvboVu.js";
+import { t as CODEX_NATIVE_PERSONALITY_NONE } from "./thread-lifecycle-Dv9Npl7a.js";
+import { i as readCodexAppServerBinding, n as isCodexAppServerNativeAuthProfile, o as writeCodexAppServerBinding, r as normalizeCodexAppServerBindingModelProvider, t as clearCodexAppServerBinding } from "./session-binding-ueMCn4om.js";
+import { r as CODEX_CONTROL_METHODS } from "./request-CF4f5hWY.js";
+import { i as readCodexNotificationTurnId, r as readCodexNotificationThreadId, s as formatCodexDisplayText } from "./notification-correlation-BDakP_d3.js";
+import { a as releaseLeasedSharedCodexAppServerClient, f as resolveCodexAppServerAuthProfileIdForAgent, i as getLeasedSharedCodexAppServerClient } from "./shared-client-Duh1bHaP.js";
+import { n as resolveCodexNativeExecutionBlock, r as resolveCodexNativeSandboxBlock } from "./sandbox-guard-mXE4_vE_.js";
 import os from "node:os";
+import { loadExecApprovals } from "openclaw/plugin-sdk/exec-approvals-runtime";
 import { asOptionalRecord, isRecord, normalizeSingleOrTrimmedStringList } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { materializeWindowsSpawnProgram, resolveWindowsSpawnProgram } from "openclaw/plugin-sdk/windows-spawn";
-import { formatErrorMessage } from "openclaw/plugin-sdk/agent-harness-runtime";
+import { formatErrorMessage, resolveSandboxContext } from "openclaw/plugin-sdk/agent-harness-runtime";
 import { spawn } from "node:child_process";
 import fs from "node:fs/promises";
 import path from "node:path";
+import { resolveSessionAgentIds as resolveSessionAgentIds$1 } from "openclaw/plugin-sdk/agent-runtime";
+import { loadSessionStore, resolveSessionStoreEntry, resolveStorePath } from "openclaw/plugin-sdk/session-store-runtime";
 import { fileURLToPath } from "node:url";
 import process from "node:process";
 import { resolvePreferredOpenClawTmpDir } from "openclaw/plugin-sdk/temp-path";
@@ -913,6 +916,32 @@ function formatNodeLabel(node) {
 //#endregion
 //#region extensions/codex/src/conversation-binding.ts
 const DEFAULT_BOUND_TURN_TIMEOUT_MS = 20 * 6e4;
+const NATIVE_CONVERSATION_INTERACTIVE_APPROVALS_UNAVAILABLE = "OpenClaw native Codex conversation binding cannot route interactive approvals yet; use the Codex harness or explicit /acp spawn codex for that workflow.";
+async function resolveConversationAppServerRuntime(params) {
+	const execPolicy = resolveConversationExecPolicy({
+		config: params.config,
+		agentId: params.agentId,
+		sessionKey: params.sessionKey
+	});
+	const sandboxForPolicy = execPolicy.touched && execPolicy.security === "full" && execPolicy.ask !== "off" ? await resolveSandboxContext({
+		config: params.config,
+		sessionKey: params.sessionKey,
+		workspaceDir: params.workspaceDir
+	}) : void 0;
+	const runtime = resolveCodexAppServerRuntimeOptions({
+		pluginConfig: params.pluginConfig,
+		execPolicy,
+		openClawSandboxActive: Boolean(sandboxForPolicy?.enabled)
+	});
+	assertNativeConversationApprovalPolicySupported({
+		execPolicy,
+		runtime
+	});
+	return {
+		execPolicy,
+		runtime
+	};
+}
 const CODEX_CONVERSATION_GLOBAL_STATE = Symbol.for("openclaw.codex.conversationBinding");
 function getGlobalState() {
 	const globalState = globalThis;
@@ -943,7 +972,8 @@ async function startCodexConversationThread(params) {
 		approvalPolicy: params.approvalPolicy,
 		sandbox: params.sandbox,
 		serviceTier: params.serviceTier,
-		config: params.config
+		config: params.config,
+		sessionKey: params.sessionKey
 	});
 	else await createThread({
 		pluginConfig: params.pluginConfig,
@@ -956,7 +986,8 @@ async function startCodexConversationThread(params) {
 		approvalPolicy: params.approvalPolicy,
 		sandbox: params.sandbox,
 		serviceTier: params.serviceTier,
-		config: params.config
+		config: params.config,
+		sessionKey: params.sessionKey
 	});
 	return createCodexConversationBindingData({
 		sessionFile: params.sessionFile,
@@ -1016,6 +1047,8 @@ async function handleCodexConversationInboundClaim(event, ctx, options = {}) {
 				data,
 				prompt,
 				event,
+				config: options.config,
+				sessionKey: event.sessionKey ?? ctx.sessionKey,
 				pluginConfig: options.pluginConfig,
 				timeoutMs: options.timeoutMs
 			}))).reply
@@ -1034,7 +1067,13 @@ async function handleCodexConversationBindingResolved(event) {
 	await clearCodexAppServerBinding(data.sessionFile);
 }
 async function attachExistingThread(params) {
-	const runtime = resolveCodexAppServerRuntimeOptions({ pluginConfig: params.pluginConfig });
+	const { execPolicy, runtime } = await resolveConversationAppServerRuntime({
+		pluginConfig: params.pluginConfig,
+		config: params.config,
+		agentId: params.agentId,
+		sessionKey: params.sessionKey,
+		workspaceDir: params.workspaceDir
+	});
 	const agentLookup = buildAgentLookup({
 		agentDir: params.agentDir,
 		config: params.config
@@ -1056,9 +1095,9 @@ async function attachExistingThread(params) {
 			...params.model ? { model: params.model } : {},
 			...modelProvider ? { modelProvider } : {},
 			personality: CODEX_NATIVE_PERSONALITY_NONE,
-			approvalPolicy: params.approvalPolicy ?? runtime.approvalPolicy,
+			approvalPolicy: execPolicy?.touched ? runtime.approvalPolicy : params.approvalPolicy ?? runtime.approvalPolicy,
 			approvalsReviewer: runtime.approvalsReviewer,
-			sandbox: params.sandbox ?? runtime.sandbox,
+			sandbox: execPolicy?.touched ? runtime.sandbox : params.sandbox ?? runtime.sandbox,
 			...params.serviceTier ?? runtime.serviceTier ? { serviceTier: params.serviceTier ?? runtime.serviceTier } : {},
 			persistExtendedHistory: true
 		}, { timeoutMs: runtime.requestTimeoutMs });
@@ -1074,8 +1113,8 @@ async function attachExistingThread(params) {
 				modelProvider: response.modelProvider ?? params.modelProvider,
 				...agentLookup
 			}),
-			approvalPolicy: params.approvalPolicy ?? runtimeApprovalPolicy,
-			sandbox: params.sandbox ?? runtime.sandbox,
+			approvalPolicy: execPolicy?.touched ? runtimeApprovalPolicy : params.approvalPolicy ?? runtimeApprovalPolicy,
+			sandbox: execPolicy?.touched ? runtime.sandbox : params.sandbox ?? runtime.sandbox,
 			serviceTier: params.serviceTier ?? runtime.serviceTier
 		}, { ...agentLookup });
 	} finally {
@@ -1083,7 +1122,13 @@ async function attachExistingThread(params) {
 	}
 }
 async function createThread(params) {
-	const runtime = resolveCodexAppServerRuntimeOptions({ pluginConfig: params.pluginConfig });
+	const { execPolicy, runtime } = await resolveConversationAppServerRuntime({
+		pluginConfig: params.pluginConfig,
+		config: params.config,
+		agentId: params.agentId,
+		sessionKey: params.sessionKey,
+		workspaceDir: params.workspaceDir
+	});
 	const agentLookup = buildAgentLookup({
 		agentDir: params.agentDir,
 		config: params.config
@@ -1105,9 +1150,9 @@ async function createThread(params) {
 			...params.model ? { model: params.model } : {},
 			...modelProvider ? { modelProvider } : {},
 			personality: CODEX_NATIVE_PERSONALITY_NONE,
-			approvalPolicy: params.approvalPolicy ?? runtime.approvalPolicy,
+			approvalPolicy: execPolicy?.touched ? runtime.approvalPolicy : params.approvalPolicy ?? runtime.approvalPolicy,
 			approvalsReviewer: runtime.approvalsReviewer,
-			sandbox: params.sandbox ?? runtime.sandbox,
+			sandbox: execPolicy?.touched ? runtime.sandbox : params.sandbox ?? runtime.sandbox,
 			...params.serviceTier ?? runtime.serviceTier ? { serviceTier: params.serviceTier ?? runtime.serviceTier } : {},
 			developerInstructions: "This Codex thread is bound to an OpenClaw conversation. Answer normally; OpenClaw will deliver your final response back to the conversation.",
 			experimentalRawEvents: true,
@@ -1124,8 +1169,8 @@ async function createThread(params) {
 				modelProvider: response.modelProvider ?? params.modelProvider,
 				...agentLookup
 			}),
-			approvalPolicy: params.approvalPolicy ?? runtimeApprovalPolicy,
-			sandbox: params.sandbox ?? runtime.sandbox,
+			approvalPolicy: execPolicy?.touched ? runtimeApprovalPolicy : params.approvalPolicy ?? runtimeApprovalPolicy,
+			sandbox: execPolicy?.touched ? runtime.sandbox : params.sandbox ?? runtime.sandbox,
 			serviceTier: params.serviceTier ?? runtime.serviceTier
 		}, { ...agentLookup });
 	} finally {
@@ -1133,11 +1178,24 @@ async function createThread(params) {
 	}
 }
 async function runBoundTurn(params) {
-	const runtime = resolveCodexAppServerRuntimeOptions({ pluginConfig: params.pluginConfig });
-	const agentLookup = buildAgentLookup({ agentDir: params.data.agentDir });
+	const agentLookup = buildAgentLookup({
+		agentDir: params.data.agentDir,
+		config: params.config
+	});
 	const binding = await readCodexAppServerBinding(params.data.sessionFile, agentLookup);
 	const threadId = binding?.threadId;
 	if (!threadId) throw new Error("bound Codex conversation has no thread binding");
+	const workspaceDir = binding.cwd || params.data.workspaceDir;
+	const { execPolicy, runtime } = await resolveConversationAppServerRuntime({
+		pluginConfig: params.pluginConfig,
+		config: params.config,
+		sessionKey: params.sessionKey,
+		workspaceDir
+	});
+	assertNativeConversationApprovalPolicySupported({
+		execPolicy,
+		runtime
+	});
 	const client = await getLeasedSharedCodexAppServerClient({
 		startOptions: runtime.start,
 		timeoutMs: runtime.requestTimeoutMs,
@@ -1174,10 +1232,10 @@ async function runBoundTurn(params) {
 				prompt: params.prompt,
 				event: params.event
 			}),
-			cwd: binding.cwd || params.data.workspaceDir,
-			approvalPolicy: binding.approvalPolicy ?? runtime.approvalPolicy,
+			cwd: workspaceDir,
+			approvalPolicy: execPolicy?.touched ? runtime.approvalPolicy : binding.approvalPolicy ?? runtime.approvalPolicy,
 			approvalsReviewer: runtime.approvalsReviewer,
-			sandboxPolicy: codexSandboxPolicyForTurn(binding.sandbox ?? runtime.sandbox, binding.cwd || params.data.workspaceDir),
+			sandboxPolicy: codexSandboxPolicyForTurn(execPolicy?.touched ? runtime.sandbox : binding.sandbox ?? runtime.sandbox, workspaceDir),
 			...binding.model ? { model: binding.model } : {},
 			personality: CODEX_NATIVE_PERSONALITY_NONE,
 			...binding.serviceTier ?? runtime.serviceTier ? { serviceTier: binding.serviceTier ?? runtime.serviceTier } : {}
@@ -1195,13 +1253,23 @@ async function runBoundTurn(params) {
 		releaseLeasedSharedCodexAppServerClient(client);
 	}
 }
+function assertNativeConversationApprovalPolicySupported(params) {
+	if (params.execPolicy?.touched === true && params.runtime.approvalPolicy !== "never") throw new Error(NATIVE_CONVERSATION_INTERACTIVE_APPROVALS_UNAVAILABLE);
+}
 async function runBoundTurnWithMissingThreadRecovery(params) {
 	try {
 		return await runBoundTurn(params);
 	} catch (error) {
 		if (!isCodexThreadNotFoundError(error)) throw error;
-		const agentLookup = buildAgentLookup({ agentDir: params.data.agentDir });
+		const agentLookup = buildAgentLookup({
+			agentDir: params.data.agentDir,
+			config: params.config
+		});
 		const binding = await readCodexAppServerBinding(params.data.sessionFile, agentLookup);
+		const useCurrentRuntimePolicy = resolveConversationExecPolicy({
+			config: params.config,
+			sessionKey: params.sessionKey
+		}).touched;
 		await startCodexConversationThread({
 			pluginConfig: params.pluginConfig,
 			sessionFile: params.data.sessionFile,
@@ -1210,13 +1278,44 @@ async function runBoundTurnWithMissingThreadRecovery(params) {
 			model: binding?.model,
 			modelProvider: binding?.modelProvider,
 			authProfileId: binding?.authProfileId,
-			approvalPolicy: binding?.approvalPolicy,
-			sandbox: binding?.sandbox,
-			serviceTier: binding?.serviceTier
+			approvalPolicy: useCurrentRuntimePolicy ? void 0 : binding?.approvalPolicy,
+			sandbox: useCurrentRuntimePolicy ? void 0 : binding?.sandbox,
+			serviceTier: binding?.serviceTier,
+			config: params.config,
+			sessionKey: params.sessionKey
 		});
 		return await runBoundTurn(params);
 	}
 }
+function resolveConversationExecPolicy(params) {
+	const agentId = params.agentId ?? (params.config ? resolveSessionAgentIds$1({
+		sessionKey: params.sessionKey,
+		config: params.config
+	}).sessionAgentId : void 0);
+	return resolveOpenClawExecPolicyForCodexAppServer({
+		config: params.config,
+		agentId,
+		execOverrides: readSessionExecOverrides({
+			config: params.config,
+			agentId,
+			sessionKey: params.sessionKey
+		}),
+		approvals: loadExecApprovals()
+	});
+}
+function readSessionExecOverrides(params) {
+	const sessionKey = params.sessionKey?.trim();
+	if (!params.config || !sessionKey) return;
+	const entry = resolveSessionStoreEntry({
+		store: loadSessionStore(resolveStorePath(params.config.session?.store, { agentId: params.agentId }), { skipCache: true }),
+		sessionKey
+	}).existing;
+	if (!entry?.execSecurity && !entry?.execAsk) return;
+	return {
+		security: entry.execSecurity,
+		ask: entry.execAsk
+	};
+}
 function isCodexThreadNotFoundError(error) {
 	const message = formatErrorMessage(error);
 	return /\bthread not found:/iu.test(message) || /\bbound Codex conversation has no thread binding\b/u.test(message);

package/dist/harness.js

@@ -32,31 +32,31 @@ function createCodexAppServerAgentHarness(options) {
 			};
 		},
 		runAttempt: async (params) => {
-			const { runCodexAppServerAttempt } = await import("./run-attempt-Jyxv6IjU.js");
+			const { runCodexAppServerAttempt } = await import("./run-attempt-C6EMmamz.js");
 			return runCodexAppServerAttempt(params, {
 				pluginConfig: options?.resolvePluginConfig?.() ?? options?.pluginConfig,
 				nativeHookRelay: { enabled: true }
 			});
 		},
 		runSideQuestion: async (params) => {
-			const { runCodexAppServerSideQuestion } = await import("./side-question-280VWjeH.js");
+			const { runCodexAppServerSideQuestion } = await import("./side-question-B-Cjb9wm.js");
 			return runCodexAppServerSideQuestion(params, {
 				pluginConfig: options?.resolvePluginConfig?.() ?? options?.pluginConfig,
 				nativeHookRelay: { enabled: true }
 			});
 		},
 		compact: async (params) => {
-			const { maybeCompactCodexAppServerSession } = await import("./compact-Dyz0rQLl.js");
+			const { maybeCompactCodexAppServerSession } = await import("./compact-Dlnt5G3v.js");
 			return maybeCompactCodexAppServerSession(params, { pluginConfig: options?.resolvePluginConfig?.() ?? options?.pluginConfig });
 		},
 		reset: async (params) => {
 			if (params.sessionFile) {
-				const { clearCodexAppServerBinding } = await import("./session-binding-DuJisBZB.js").then((n) => n.a);
+				const { clearCodexAppServerBinding } = await import("./session-binding-ueMCn4om.js").then((n) => n.a);
 				await clearCodexAppServerBinding(params.sessionFile);
 			}
 		},
 		dispose: async () => {
-			const { clearSharedCodexAppServerClientAndWait } = await import("./shared-client-DICbgRn5.js").then((n) => n.s);
+			const { clearSharedCodexAppServerClientAndWait } = await import("./shared-client-Duh1bHaP.js").then((n) => n.s);
 			await clearSharedCodexAppServerClientAndWait();
 		}
 	};

package/dist/index.js

@@ -1,12 +1,12 @@
 import { createCodexAppServerAgentHarness } from "./harness.js";
-import { c as readCodexPluginConfig, l as resolveCodexAppServerRuntimeOptions, t as CODEX_PLUGINS_MARKETPLACE_NAME } from "./config-BW7NPdAQ.js";
+import { c as readCodexPluginConfig, l as resolveCodexAppServerRuntimeOptions, t as CODEX_PLUGINS_MARKETPLACE_NAME } from "./config--tW89bHH.js";
 import { buildCodexProvider } from "./provider.js";
-import { v as ensureCodexPluginActivation, x as defaultCodexAppInventoryCache, y as pluginReadParams } from "./thread-lifecycle-1u5ogKG_.js";
+import { v as ensureCodexPluginActivation, x as defaultCodexAppInventoryCache, y as pluginReadParams } from "./thread-lifecycle-Dv9Npl7a.js";
 import { buildCodexMediaUnderstandingProvider } from "./media-understanding-provider.js";
-import { i as describeControlFailure, n as buildCodexPluginAppCacheKey, t as requestCodexAppServerJson } from "./request-Cj95iOk6.js";
-import { s as formatCodexDisplayText } from "./notification-correlation-BVB6XFQM.js";
-import { a as releaseLeasedSharedCodexAppServerClient, f as resolveCodexAppServerAuthProfileIdForAgent, i as getLeasedSharedCodexAppServerClient, n as clearSharedCodexAppServerClientIfCurrentAndWait, p as resolveCodexAppServerFallbackApiKeyCacheKey, u as resolveCodexAppServerAuthAccountCacheKey } from "./shared-client-DICbgRn5.js";
-import { a as createCodexCliSessionNodeInvokePolicies, c as resolveCodexCliSessionForBindingOnNode, i as createCodexCliSessionNodeHostCommands, l as resumeCodexCliSessionOnNode, n as handleCodexConversationInboundClaim, s as listCodexCliSessionsOnNode, t as handleCodexConversationBindingResolved } from "./conversation-binding-D8OO0S9R.js";
+import { i as describeControlFailure, n as buildCodexPluginAppCacheKey, t as requestCodexAppServerJson } from "./request-CF4f5hWY.js";
+import { s as formatCodexDisplayText } from "./notification-correlation-BDakP_d3.js";
+import { a as releaseLeasedSharedCodexAppServerClient, f as resolveCodexAppServerAuthProfileIdForAgent, i as getLeasedSharedCodexAppServerClient, n as clearSharedCodexAppServerClientIfCurrentAndWait, p as resolveCodexAppServerFallbackApiKeyCacheKey, u as resolveCodexAppServerAuthAccountCacheKey } from "./shared-client-Duh1bHaP.js";
+import { a as createCodexCliSessionNodeInvokePolicies, c as resolveCodexCliSessionForBindingOnNode, i as createCodexCliSessionNodeHostCommands, l as resumeCodexCliSessionOnNode, n as handleCodexConversationInboundClaim, s as listCodexCliSessionsOnNode, t as handleCodexConversationBindingResolved } from "./conversation-binding-CC9XMAwn.js";
 import { mutateConfigFile } from "openclaw/plugin-sdk/config-mutation";
 import { resolveLivePluginConfigObject } from "openclaw/plugin-sdk/plugin-config-runtime";
 import { definePluginEntry } from "openclaw/plugin-sdk/plugin-entry";
@@ -48,7 +48,7 @@ async function handleCodexCommand(ctx, options = {}) {
 	}
 }
 async function loadDefaultCodexSubcommandHandler() {
-	const { handleCodexSubcommand } = await import("./command-handlers-B8MXR7fh.js");
+	const { handleCodexSubcommand } = await import("./command-handlers-C2t6-ChO.js");
 	return handleCodexSubcommand;
 }
 //#endregion
@@ -1536,7 +1536,8 @@ var codex_default = definePluginEntry({
 	name: "Codex",
 	description: "Codex app-server harness and Codex-managed GPT model catalog.",
 	register(api) {
-		const resolveCurrentPluginConfig = () => resolveLivePluginConfigObject(api.runtime.config?.current ? () => api.runtime.config.current() : void 0, "codex", api.pluginConfig) ?? api.pluginConfig;
+		const resolveCurrentConfig = () => api.runtime.config?.current ? api.runtime.config.current() : void 0;
+		const resolveCurrentPluginConfig = () => resolveLivePluginConfigObject(resolveCurrentConfig, "codex", api.pluginConfig) ?? api.pluginConfig;
 		api.registerAgentHarness(createCodexAppServerAgentHarness({ resolvePluginConfig: resolveCurrentPluginConfig }));
 		api.registerProvider(buildCodexProvider({ pluginConfig: api.pluginConfig }));
 		api.registerMediaUnderstandingProvider(buildCodexMediaUnderstandingProvider({ pluginConfig: api.pluginConfig }));
@@ -1594,8 +1595,8 @@ var codex_default = definePluginEntry({
 			}
 		}));
 		api.on("inbound_claim", (event, ctx) => handleCodexConversationInboundClaim(event, ctx, {
-			config: api.runtime.config?.current?.(),
 			pluginConfig: resolveCurrentPluginConfig(),
+			config: resolveCurrentConfig(),
 			resumeCodexCliSessionOnNode: (params) => resumeCodexCliSessionOnNode({
 				runtime: api.runtime,
 				...params

package/dist/media-understanding-provider.js

@@ -1,10 +1,10 @@
 import { CODEX_PROVIDER_ID, FALLBACK_CODEX_MODELS } from "./provider-catalog.js";
-import "./client-factory-BPBvbguy.js";
-import { l as resolveCodexAppServerRuntimeOptions } from "./config-BW7NPdAQ.js";
+import "./client-factory-qZvhyyXr.js";
+import { l as resolveCodexAppServerRuntimeOptions } from "./config--tW89bHH.js";
 import { i as assertCodexTurnStartResponse, l as readCodexTurnCompletedNotification, o as readCodexErrorNotification, r as assertCodexThreadStartResponse } from "./protocol-validators-DtjYmUw_.js";
-import { i as readModelListResult } from "./models-Dnasi6LR.js";
-import { l as isJsonObject } from "./client-TfDda-h3.js";
-import { r as buildCodexRuntimeThreadConfig } from "./thread-lifecycle-1u5ogKG_.js";
+import { i as readModelListResult } from "./models-QT-XOhE7.js";
+import { l as isJsonObject } from "./client-DMXvboVu.js";
+import { r as buildCodexRuntimeThreadConfig } from "./thread-lifecycle-Dv9Npl7a.js";
 import { validateJsonSchemaValue } from "openclaw/plugin-sdk/json-schema-runtime";
 import "openclaw/plugin-sdk/media-understanding";
 //#region extensions/codex/media-understanding-provider.ts
@@ -65,7 +65,7 @@ async function runBoundedCodexVisionTurn(params) {
 	const appServer = resolveCodexAppServerRuntimeOptions({ pluginConfig: params.options.pluginConfig });
 	const timeoutMs = Math.max(100, params.timeoutMs);
 	const ownsClient = !params.options.clientFactory;
-	const client = params.options.clientFactory ? await params.options.clientFactory(appServer.start, params.profile) : await import("./shared-client-DICbgRn5.js").then((n) => n.s).then(({ createIsolatedCodexAppServerClient }) => createIsolatedCodexAppServerClient({
+	const client = params.options.clientFactory ? await params.options.clientFactory(appServer.start, params.profile) : await import("./shared-client-Duh1bHaP.js").then((n) => n.s).then(({ createIsolatedCodexAppServerClient }) => createIsolatedCodexAppServerClient({
 		startOptions: appServer.start,
 		timeoutMs,
 		authProfileId: params.profile

package/dist/{models-Dnasi6LR.js → models-QT-XOhE7.js}

@@ -40,7 +40,7 @@ async function listAllCodexAppServerModels(options = {}) {
 async function withCodexAppServerModelClient(options, run) {
 	const timeoutMs = options.timeoutMs ?? 2500;
 	const useSharedClient = options.sharedClient !== false;
-	const { createIsolatedCodexAppServerClient, getLeasedSharedCodexAppServerClient, releaseLeasedSharedCodexAppServerClient } = await import("./shared-client-DICbgRn5.js").then((n) => n.s);
+	const { createIsolatedCodexAppServerClient, getLeasedSharedCodexAppServerClient, releaseLeasedSharedCodexAppServerClient } = await import("./shared-client-Duh1bHaP.js").then((n) => n.s);
 	const client = useSharedClient ? await getLeasedSharedCodexAppServerClient({
 		startOptions: options.startOptions,
 		timeoutMs,

package/dist/{native-hook-relay-DYOYE3qb.js → native-hook-relay-B8qM8ZwR.js}

@@ -1,11 +1,11 @@
-import { l as isJsonObject } from "./client-TfDda-h3.js";
-import { S as invalidInlineImageText, w as sanitizeInlineImageDataUrl } from "./thread-lifecycle-1u5ogKG_.js";
-import { s as formatCodexDisplayText } from "./notification-correlation-BVB6XFQM.js";
+import { l as isJsonObject } from "./client-DMXvboVu.js";
+import { S as invalidInlineImageText, w as sanitizeInlineImageDataUrl } from "./thread-lifecycle-Dv9Npl7a.js";
+import { s as formatCodexDisplayText } from "./notification-correlation-BDakP_d3.js";
 import { createHash } from "node:crypto";
+import { normalizeAgentId } from "openclaw/plugin-sdk/routing";
 import { asOptionalRecord, isRecord, normalizeTrimmedStringList } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { HEARTBEAT_RESPONSE_TOOL_NAME, buildAgentHookContextChannelFields, callGatewayTool, createAgentToolResultMiddlewareRunner, createCodexAppServerToolResultExtensionRunner, embeddedAgentLog, extractToolResultMediaArtifact, filterToolResultMediaUrls, formatApprovalDisplayPath, hasNativeHookRelayInvocation, invokeNativeHookRelay, isMessagingTool, isMessagingToolSendAction, isToolWrappedWithBeforeToolCallHook, normalizeHeartbeatToolResponse, projectRuntimeToolInputSchema, registerNativeHookRelay, resolveNativeHookRelayDeferredToolApproval, runAgentHarnessAfterToolCallHook, runBeforeToolCallHook, setBeforeToolCallDiagnosticsEnabled, wrapToolWithBeforeToolCallHook } from "openclaw/plugin-sdk/agent-harness-runtime";
 import { emitTrustedDiagnosticEvent } from "openclaw/plugin-sdk/diagnostic-runtime";
-import { normalizeAgentId } from "openclaw/plugin-sdk/routing";
 //#region extensions/codex/src/app-server/plugin-approval-roundtrip.ts
 const DEFAULT_CODEX_APPROVAL_TIMEOUT_MS = 12e4;
 const MAX_PLUGIN_APPROVAL_TITLE_LENGTH = 80;

package/dist/{notification-correlation-BVB6XFQM.js → notification-correlation-BDakP_d3.js}

@@ -1,4 +1,4 @@
-import { l as isJsonObject } from "./client-TfDda-h3.js";
+import { l as isJsonObject } from "./client-DMXvboVu.js";
 import { asFiniteNumber } from "openclaw/plugin-sdk/string-coerce-runtime";
 //#region extensions/codex/src/app-server/rate-limits.ts
 const CODEX_LIMIT_ID = "codex";

package/dist/provider.js

@@ -1,5 +1,5 @@
 import { CODEX_APP_SERVER_AUTH_MARKER, CODEX_BASE_URL, CODEX_PROVIDER_ID, FALLBACK_CODEX_MODELS, buildCodexModelDefinition, buildCodexProviderConfig } from "./provider-catalog.js";
-import { c as readCodexPluginConfig, l as resolveCodexAppServerRuntimeOptions } from "./config-BW7NPdAQ.js";
+import { c as readCodexPluginConfig, l as resolveCodexAppServerRuntimeOptions } from "./config--tW89bHH.js";
 import { resolveCodexSystemPromptContribution } from "./prompt-overlay.js";
 import { resolvePluginConfigObject } from "openclaw/plugin-sdk/plugin-config-runtime";
 import { normalizeModelCompat } from "openclaw/plugin-sdk/provider-model-shared";
@@ -123,7 +123,7 @@ async function listModelsBestEffort(params) {
 	}
 }
 async function listCodexAppServerModelsLazy(options) {
-	const { listCodexAppServerModels } = await import("./models-Dnasi6LR.js").then((n) => n.r);
+	const { listCodexAppServerModels } = await import("./models-QT-XOhE7.js").then((n) => n.r);
 	return listCodexAppServerModels(options);
 }
 function normalizeTimeoutMs(value) {

package/dist/{request-Cj95iOk6.js → request-CF4f5hWY.js}

@@ -1,7 +1,7 @@
-import { n as CodexAppServerRpcError } from "./client-TfDda-h3.js";
-import { b as buildCodexAppInventoryCacheKey } from "./thread-lifecycle-1u5ogKG_.js";
-import { a as releaseLeasedSharedCodexAppServerClient, c as withTimeout, i as getLeasedSharedCodexAppServerClient, m as resolveCodexAppServerHomeDir, r as createIsolatedCodexAppServerClient } from "./shared-client-DICbgRn5.js";
-import { t as resolveCodexAppServerDirectSandboxBypassBlock } from "./sandbox-guard-CTnEWuor.js";
+import { n as CodexAppServerRpcError } from "./client-DMXvboVu.js";
+import { b as buildCodexAppInventoryCacheKey } from "./thread-lifecycle-Dv9Npl7a.js";
+import { a as releaseLeasedSharedCodexAppServerClient, c as withTimeout, i as getLeasedSharedCodexAppServerClient, m as resolveCodexAppServerHomeDir, r as createIsolatedCodexAppServerClient } from "./shared-client-Duh1bHaP.js";
+import { t as resolveCodexAppServerDirectSandboxBypassBlock } from "./sandbox-guard-mXE4_vE_.js";
 import { createHash } from "node:crypto";
 //#region extensions/codex/src/app-server/capabilities.ts
 const CODEX_CONTROL_METHODS = {

package/dist/{run-attempt-Jyxv6IjU.js → run-attempt-C6EMmamz.js}

@@ -1,18 +1,19 @@
-import { n as defaultLeasedCodexAppServerClientFactory } from "./client-factory-BPBvbguy.js";
-import { c as readCodexPluginConfig, d as resolveCodexPluginsPolicy, f as shouldAutoApproveCodexAppServerApprovals, i as isCodexAppServerApprovalPolicyAllowedByRequirements, l as resolveCodexAppServerRuntimeOptions, o as isCodexSandboxExecServerEnabled, p as withMcpElicitationsApprovalPolicy, u as resolveCodexComputerUseConfig } from "./config-BW7NPdAQ.js";
+import { n as defaultLeasedCodexAppServerClientFactory } from "./client-factory-qZvhyyXr.js";
+import { c as readCodexPluginConfig, d as resolveCodexPluginsPolicy, f as resolveOpenClawExecPolicyForCodexAppServer, i as isCodexAppServerApprovalPolicyAllowedByRequirements, l as resolveCodexAppServerRuntimeOptions, m as withMcpElicitationsApprovalPolicy, o as isCodexSandboxExecServerEnabled, p as shouldAutoApproveCodexAppServerApprovals, u as resolveCodexComputerUseConfig } from "./config--tW89bHH.js";
 import { a as readCodexDynamicToolCallParams, c as readCodexTurn, i as assertCodexTurnStartResponse } from "./protocol-validators-DtjYmUw_.js";
-import { a as isCodexAppServerConnectionClosedError, i as isCodexAppServerApprovalRequest, l as isJsonObject, r as compareCodexAppServerVersions, s as MIN_CODEX_SANDBOX_EXEC_SERVER_APP_SERVER_VERSION } from "./client-TfDda-h3.js";
-import { C as sanitizeCodexHistoryImagePayloads, D as resolveCodexContextEngineProjectionReserveTokens, E as resolveCodexContextEngineProjectionMaxChars, T as projectContextEngineAssemblyForCodex, _ as shouldBuildCodexPluginThreadConfig, a as buildDeveloperInstructions, c as codexDynamicToolsFingerprint, f as startOrResumeThread, g as mergeCodexThreadConfigs, h as buildCodexPluginThreadConfigInputFingerprint, i as buildContextEngineBinding, l as isContextEngineBindingCompatible, m as buildCodexPluginThreadConfig, n as areCodexDynamicToolFingerprintsCompatible, o as buildTurnCollaborationMode, p as isCodexAppServerProfilerEnabled, s as buildTurnStartParams, x as defaultCodexAppInventoryCache } from "./thread-lifecycle-1u5ogKG_.js";
-import { i as readCodexAppServerBinding, t as clearCodexAppServerBinding } from "./session-binding-DuJisBZB.js";
-import { n as buildCodexPluginAppCacheKey, r as CODEX_CONTROL_METHODS } from "./request-Cj95iOk6.js";
-import { _ as shouldRefreshCodexRateLimitsForUsageLimitMessage, g as resolveCodexUsageLimitResetAtMs, h as formatCodexUsageLimitErrorMessage, i as readCodexNotificationTurnId, n as isCodexNotificationForTurn, r as readCodexNotificationThreadId, s as formatCodexDisplayText, t as describeCodexNotificationCorrelation } from "./notification-correlation-BVB6XFQM.js";
-import { a as releaseLeasedSharedCodexAppServerClient, d as resolveCodexAppServerAuthProfileId, f as resolveCodexAppServerAuthProfileIdForAgent, l as refreshCodexAppServerAuthTokens, m as resolveCodexAppServerHomeDir, o as retireSharedCodexAppServerClientIfCurrent, p as resolveCodexAppServerFallbackApiKeyCacheKey, t as clearSharedCodexAppServerClientIfCurrent, u as resolveCodexAppServerAuthAccountCacheKey } from "./shared-client-DICbgRn5.js";
-import { i as resolveCodexNativeExecutionPolicy } from "./sandbox-guard-CTnEWuor.js";
-import { _ as normalizeCodexDynamicToolName$1, a as createCodexNativeHookRelay, c as scheduleCodexNativeHookRelayUnregister, d as emitDynamicToolErrorDiagnostic, f as emitDynamicToolStartedDiagnostic, g as isForcedPrivateQaCodexRuntime, h as filterCodexDynamicTools, i as buildCodexNativeHookRelayDisabledConfig, l as handleCodexAppServerElicitationRequest, m as filterToolsForVisionInputs, n as CODEX_NATIVE_HOOK_RELAY_TTL_GRACE_MS, o as resolveCodexNativeHookRelayEvents, p as emitDynamicToolTerminalDiagnostic, r as buildCodexNativeHookRelayConfig, s as resolveCodexNativeHookRelayTtlMs, u as createCodexDynamicToolBridge, v as resolveCodexDynamicToolsLoading, y as handleCodexAppServerApprovalRequest } from "./native-hook-relay-DYOYE3qb.js";
-import { t as ensureCodexComputerUse } from "./computer-use-BRIifWhE.js";
+import { a as isCodexAppServerConnectionClosedError, i as isCodexAppServerApprovalRequest, l as isJsonObject, r as compareCodexAppServerVersions, s as MIN_CODEX_SANDBOX_EXEC_SERVER_APP_SERVER_VERSION } from "./client-DMXvboVu.js";
+import { C as sanitizeCodexHistoryImagePayloads, D as resolveCodexContextEngineProjectionReserveTokens, E as resolveCodexContextEngineProjectionMaxChars, T as projectContextEngineAssemblyForCodex, _ as shouldBuildCodexPluginThreadConfig, a as buildDeveloperInstructions, c as codexDynamicToolsFingerprint, f as startOrResumeThread, g as mergeCodexThreadConfigs, h as buildCodexPluginThreadConfigInputFingerprint, i as buildContextEngineBinding, l as isContextEngineBindingCompatible, m as buildCodexPluginThreadConfig, n as areCodexDynamicToolFingerprintsCompatible, o as buildTurnCollaborationMode, p as isCodexAppServerProfilerEnabled, s as buildTurnStartParams, x as defaultCodexAppInventoryCache } from "./thread-lifecycle-Dv9Npl7a.js";
+import { i as readCodexAppServerBinding, t as clearCodexAppServerBinding } from "./session-binding-ueMCn4om.js";
+import { n as buildCodexPluginAppCacheKey, r as CODEX_CONTROL_METHODS } from "./request-CF4f5hWY.js";
+import { _ as shouldRefreshCodexRateLimitsForUsageLimitMessage, g as resolveCodexUsageLimitResetAtMs, h as formatCodexUsageLimitErrorMessage, i as readCodexNotificationTurnId, n as isCodexNotificationForTurn, r as readCodexNotificationThreadId, s as formatCodexDisplayText, t as describeCodexNotificationCorrelation } from "./notification-correlation-BDakP_d3.js";
+import { a as releaseLeasedSharedCodexAppServerClient, d as resolveCodexAppServerAuthProfileId, f as resolveCodexAppServerAuthProfileIdForAgent, l as refreshCodexAppServerAuthTokens, m as resolveCodexAppServerHomeDir, o as retireSharedCodexAppServerClientIfCurrent, p as resolveCodexAppServerFallbackApiKeyCacheKey, t as clearSharedCodexAppServerClientIfCurrent, u as resolveCodexAppServerAuthAccountCacheKey } from "./shared-client-Duh1bHaP.js";
+import { i as resolveCodexNativeExecutionPolicy } from "./sandbox-guard-mXE4_vE_.js";
+import { _ as normalizeCodexDynamicToolName$1, a as createCodexNativeHookRelay, c as scheduleCodexNativeHookRelayUnregister, d as emitDynamicToolErrorDiagnostic, f as emitDynamicToolStartedDiagnostic, g as isForcedPrivateQaCodexRuntime, h as filterCodexDynamicTools, i as buildCodexNativeHookRelayDisabledConfig, l as handleCodexAppServerElicitationRequest, m as filterToolsForVisionInputs, n as CODEX_NATIVE_HOOK_RELAY_TTL_GRACE_MS, o as resolveCodexNativeHookRelayEvents, p as emitDynamicToolTerminalDiagnostic, r as buildCodexNativeHookRelayConfig, s as resolveCodexNativeHookRelayTtlMs, u as createCodexDynamicToolBridge, v as resolveCodexDynamicToolsLoading, y as handleCodexAppServerApprovalRequest } from "./native-hook-relay-B8qM8ZwR.js";
+import { t as ensureCodexComputerUse } from "./computer-use-Ba4vW9fO.js";
 import { n as rememberCodexRateLimits, t as readRecentCodexRateLimits } from "./rate-limit-cache-N66I-Rd7.js";
 import { createHash, randomUUID } from "node:crypto";
 import fsSync from "node:fs";
+import { loadExecApprovals } from "openclaw/plugin-sdk/exec-approvals-runtime";
 import { asBoolean, asFiniteNumber, normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { CODEX_APP_SERVER_CONTEXT_ENGINE_HOST, TOOL_PROGRESS_OUTPUT_MAX_CHARS, acquireSessionWriteLock, appendSessionTranscriptMessage, assembleHarnessContextEngine, assertContextEngineHostSupport, awaitAgentHarnessAgentEndHook, bootstrapHarnessContextEngine, buildAgentHookContextChannelFields, buildBootstrapContextForFiles, buildEmbeddedAttemptToolRunContext, buildHarnessContextEngineRuntimeContext, buildHarnessContextEngineRuntimeContextFromUsage, classifyAgentHarnessTerminalOutcome, clearActiveEmbeddedRun, embeddedAgentLog, emitAgentEvent, emitSessionTranscriptUpdate, finalizeHarnessContextEngineTurn, formatErrorMessage, formatToolAggregate, formatToolProgressOutput, getAgentHarnessHookRunner, getBeforeToolCallPolicyDiagnosticState, inferToolMetaFromArgs, isActiveHarnessContextEngine, isSubagentSessionKey, loadCodexBundleMcpThreadConfig, normalizeAgentRuntimeTools, normalizeUsage, resolveAgentHarnessBeforePromptBuildResult, resolveAttemptSpawnWorkspaceDir, resolveBootstrapFilesForRun, resolveContextEngineOwnerPluginId, resolveModelAuthMode, resolveSandboxContext, resolveSessionAgentIds, resolveSessionWriteLockOptions, resolveUserPath, runAgentCleanupStep, runAgentHarnessAfterCompactionHook, runAgentHarnessAfterToolCallHook, runAgentHarnessAgentEndHook, runAgentHarnessBeforeCompactionHook, runAgentHarnessBeforeMessageWriteHook, runAgentHarnessLlmInputHook, runAgentHarnessLlmOutputHook, runHarnessContextEngineMaintenance, setActiveEmbeddedRun, supportsModelTools } from "openclaw/plugin-sdk/agent-harness-runtime";
 import { spawn } from "node:child_process";
@@ -32,7 +33,7 @@ import { createAgentHarnessTaskRuntime, deliverAgentHarnessTaskCompletion, isDur
 //#region extensions/codex/src/app-server/app-server-policy.ts
 function resolveCodexAppServerForOpenClawToolPolicy(params) {
 	if (!params.shouldPromote || !params.canUseUntrustedApprovalPolicy || params.appServer.approvalPolicy !== "never") return params.appServer;
-	const explicitMode = params.pluginConfig.appServer?.mode !== void 0 || isCodexAppServerPolicyMode(params.env.OPENCLAW_CODEX_APP_SERVER_MODE);
+	const explicitMode = params.execPolicy?.mode === "full" || params.pluginConfig.appServer?.mode !== void 0 || isCodexAppServerPolicyMode(params.env.OPENCLAW_CODEX_APP_SERVER_MODE);
 	const explicitApprovalPolicy = params.pluginConfig.appServer?.approvalPolicy !== void 0 || isCodexAppServerApprovalPolicy(params.env.OPENCLAW_CODEX_APP_SERVER_APPROVAL_POLICY) || params.appServer.approvalPolicySource === "requirements";
 	if (explicitMode || explicitApprovalPolicy) return params.appServer;
 	return {
@@ -1254,6 +1255,7 @@ async function buildDynamicTools(input) {
 		...buildEmbeddedAttemptToolRunContext(params),
 		exec: {
 			...params.execOverrides,
+			config: params.config,
 			elevated: params.bashElevated
 		},
 		sandbox: input.sandbox,
@@ -7110,7 +7112,11 @@ async function runCodexAppServerAttempt(params, options = {}) {
 	const attemptClientFactory = options.clientFactory ?? defaultLeasedCodexAppServerClientFactory;
 	const pluginConfig = readCodexPluginConfig(options.pluginConfig);
 	const computerUseConfig = resolveCodexComputerUseConfig({ pluginConfig });
-	const configuredAppServer = resolveCodexAppServerRuntimeOptions({ pluginConfig });
+	const { sessionAgentId } = resolveSessionAgentIds({
+		sessionKey: params.sessionKey,
+		config: params.config,
+		agentId: params.agentId
+	});
 	const beforeToolCallPolicy = getBeforeToolCallPolicyDiagnosticState();
 	preDynamicStartupStages.mark("config");
 	const resolvedWorkspace = resolveUserPath(params.workspaceDir);
@@ -7124,6 +7130,17 @@ async function runCodexAppServerAttempt(params, options = {}) {
 		workspaceDir: resolvedWorkspace
 	});
 	preDynamicStartupStages.mark("sandbox");
+	const execPolicy = resolveOpenClawExecPolicyForCodexAppServer({
+		execOverrides: params.execOverrides,
+		approvals: loadExecApprovals(),
+		config: params.config,
+		agentId: sessionAgentId
+	});
+	const configuredAppServer = resolveCodexAppServerRuntimeOptions({
+		pluginConfig,
+		execPolicy,
+		openClawSandboxActive: sandbox?.enabled === true
+	});
 	const effectiveWorkspace = sandbox?.enabled ? sandbox.workspaceAccess === "rw" ? resolvedWorkspace : sandbox.workspaceDir : resolvedWorkspace;
 	const requestedCwd = params.cwd ? resolveUserPath(params.cwd) : void 0;
 	if (sandbox?.enabled && requestedCwd && requestedCwd !== resolvedWorkspace) throw new Error("cwd override is not supported for sandboxed Codex app-server runs; omit cwd or use the agent workspace as cwd");
@@ -7135,6 +7152,7 @@ async function runCodexAppServerAttempt(params, options = {}) {
 		pluginConfig,
 		env: process.env,
 		shouldPromote: beforeToolCallPolicy.hasBeforeToolCallHook || beforeToolCallPolicy.trustedToolPolicies.length > 0,
+		execPolicy,
 		canUseUntrustedApprovalPolicy: configuredAppServer.start.transport !== "stdio" || isCodexAppServerApprovalPolicyAllowedByRequirements("untrusted")
 	});
 	if (configuredAppServer.approvalPolicy === "never" && appServer.approvalPolicy === "untrusted") embeddedAgentLog.info("codex app-server approval policy promoted for OpenClaw tool policy", {
@@ -7156,11 +7174,6 @@ async function runCodexAppServerAttempt(params, options = {}) {
 	};
 	if (params.abortSignal?.aborted) abortFromUpstream();
 	else params.abortSignal?.addEventListener("abort", abortFromUpstream, { once: true });
-	const { sessionAgentId } = resolveSessionAgentIds({
-		sessionKey: params.sessionKey,
-		config: params.config,
-		agentId: params.agentId
-	});
 	const agentDir = params.agentDir ?? resolveAgentDir$1(params.config ?? {}, sessionAgentId);
 	preDynamicStartupStages.mark("session-agent");
 	let startupBinding = await readCodexAppServerBinding(params.sessionFile);

package/dist/{session-binding-DuJisBZB.js → session-binding-ueMCn4om.js}

@@ -1,5 +1,5 @@
 import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
-import { s as normalizeCodexServiceTier } from "./config-BW7NPdAQ.js";
+import { s as normalizeCodexServiceTier } from "./config--tW89bHH.js";
 import { embeddedAgentLog } from "openclaw/plugin-sdk/agent-harness-runtime";
 import fs from "node:fs/promises";
 import { ensureAuthProfileStore, resolveDefaultAgentDir, resolveProviderIdForAuth } from "openclaw/plugin-sdk/agent-runtime";

package/dist/{shared-client-DICbgRn5.js → shared-client-Duh1bHaP.js}

@@ -1,6 +1,6 @@
 import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
-import { l as resolveCodexAppServerRuntimeOptions, n as codexAppServerStartOptionsKey } from "./config-BW7NPdAQ.js";
-import { c as resolveCodexAppServerSpawnEnv, o as MANAGED_CODEX_APP_SERVER_PACKAGE, t as CodexAppServerClient } from "./client-TfDda-h3.js";
+import { l as resolveCodexAppServerRuntimeOptions, n as codexAppServerStartOptionsKey } from "./config--tW89bHH.js";
+import { c as resolveCodexAppServerSpawnEnv, o as MANAGED_CODEX_APP_SERVER_PACKAGE, t as CodexAppServerClient } from "./client-DMXvboVu.js";
 import { createRequire } from "node:module";
 import { createHash } from "node:crypto";
 import fsSync, { constants, readFileSync } from "node:fs";
@@ -599,6 +599,27 @@ function readLegacySharedCodexAppServerClientState(value) {
 	if (value === null || typeof value !== "object") return;
 	return value;
 }
+async function resolveCodexAppServerClientStartContext(options) {
+	const agentDir = options?.agentDir ?? resolveDefaultAgentDir(options?.config ?? {});
+	const usesNativeAuth = options?.authProfileId === null;
+	const requestedAuthProfileId = options?.authProfileId === null ? void 0 : options?.authProfileId;
+	const authProfileId = usesNativeAuth ? void 0 : resolveCodexAppServerAuthProfileIdForAgent({
+		authProfileId: requestedAuthProfileId,
+		agentDir,
+		config: options?.config
+	});
+	return {
+		agentDir,
+		usesNativeAuth,
+		authProfileId,
+		startOptions: await bridgeCodexAppServerStartOptions({
+			startOptions: await resolveManagedCodexAppServerStartOptions(options?.startOptions ?? resolveCodexAppServerRuntimeOptions().start),
+			agentDir,
+			authProfileId: usesNativeAuth ? null : authProfileId,
+			config: options?.config
+		})
+	};
+}
 async function getSharedCodexAppServerClient(options) {
 	return (await acquireSharedCodexAppServerClient(options)).client;
 }
@@ -621,20 +642,7 @@ function releaseLeasedSharedCodexAppServerClient(client) {
 	return true;
 }
 async function acquireSharedCodexAppServerClient(options, leaseOptions) {
-	const agentDir = options?.agentDir ?? resolveDefaultAgentDir(options?.config ?? {});
-	const usesNativeAuth = options?.authProfileId === null;
-	const requestedAuthProfileId = options?.authProfileId === null ? void 0 : options?.authProfileId;
-	const authProfileId = usesNativeAuth ? void 0 : resolveCodexAppServerAuthProfileIdForAgent({
-		authProfileId: requestedAuthProfileId,
-		agentDir,
-		config: options?.config
-	});
-	const startOptions = await bridgeCodexAppServerStartOptions({
-		startOptions: await resolveManagedCodexAppServerStartOptions(options?.startOptions ?? resolveCodexAppServerRuntimeOptions().start),
-		agentDir,
-		authProfileId: usesNativeAuth ? null : authProfileId,
-		config: options?.config
-	});
+	const { agentDir, usesNativeAuth, authProfileId, startOptions } = await resolveCodexAppServerClientStartContext(options);
 	const fallbackApiKeyCacheKey = authProfileId ? void 0 : resolveCodexAppServerFallbackApiKeyCacheKey({ startOptions });
 	const key = codexAppServerStartOptionsKey(startOptions, {
 		authProfileId,
@@ -676,20 +684,7 @@ async function acquireSharedCodexAppServerClient(options, leaseOptions) {
 	}
 }
 async function createIsolatedCodexAppServerClient(options) {
-	const agentDir = options?.agentDir ?? resolveDefaultAgentDir(options?.config ?? {});
-	const usesNativeAuth = options?.authProfileId === null;
-	const requestedAuthProfileId = options?.authProfileId === null ? void 0 : options?.authProfileId;
-	const authProfileId = usesNativeAuth ? void 0 : resolveCodexAppServerAuthProfileIdForAgent({
-		authProfileId: requestedAuthProfileId,
-		agentDir,
-		config: options?.config
-	});
-	const startOptions = await bridgeCodexAppServerStartOptions({
-		startOptions: await resolveManagedCodexAppServerStartOptions(options?.startOptions ?? resolveCodexAppServerRuntimeOptions().start),
-		agentDir,
-		authProfileId: usesNativeAuth ? null : authProfileId,
-		config: options?.config
-	});
+	const { agentDir, usesNativeAuth, authProfileId, startOptions } = await resolveCodexAppServerClientStartContext(options);
 	const client = CodexAppServerClient.start(startOptions);
 	const initialize = client.initialize();
 	try {

package/dist/{side-question-280VWjeH.js → side-question-B-Cjb9wm.js}

@@ -1,12 +1,12 @@
-import { c as readCodexPluginConfig, f as shouldAutoApproveCodexAppServerApprovals, l as resolveCodexAppServerRuntimeOptions } from "./config-BW7NPdAQ.js";
+import { c as readCodexPluginConfig, l as resolveCodexAppServerRuntimeOptions, p as shouldAutoApproveCodexAppServerApprovals } from "./config--tW89bHH.js";
 import { a as readCodexDynamicToolCallParams, c as readCodexTurn, i as assertCodexTurnStartResponse, t as assertCodexThreadForkResponse } from "./protocol-validators-DtjYmUw_.js";
-import { i as isCodexAppServerApprovalRequest, l as isJsonObject } from "./client-TfDda-h3.js";
-import { d as resolveReasoningEffort, g as mergeCodexThreadConfigs, r as buildCodexRuntimeThreadConfig, t as CODEX_NATIVE_PERSONALITY_NONE, u as resolveCodexAppServerModelProvider } from "./thread-lifecycle-1u5ogKG_.js";
-import { i as readCodexAppServerBinding } from "./session-binding-DuJisBZB.js";
-import { h as formatCodexUsageLimitErrorMessage, i as readCodexNotificationTurnId, r as readCodexNotificationThreadId } from "./notification-correlation-BVB6XFQM.js";
-import { a as releaseLeasedSharedCodexAppServerClient, i as getLeasedSharedCodexAppServerClient, l as refreshCodexAppServerAuthTokens } from "./shared-client-DICbgRn5.js";
-import { n as resolveCodexNativeExecutionBlock } from "./sandbox-guard-CTnEWuor.js";
-import { d as emitDynamicToolErrorDiagnostic, f as emitDynamicToolStartedDiagnostic, h as filterCodexDynamicTools, i as buildCodexNativeHookRelayDisabledConfig, l as handleCodexAppServerElicitationRequest, m as filterToolsForVisionInputs, p as emitDynamicToolTerminalDiagnostic, r as buildCodexNativeHookRelayConfig, t as CODEX_NATIVE_HOOK_RELAY_EVENTS, u as createCodexDynamicToolBridge, v as resolveCodexDynamicToolsLoading, y as handleCodexAppServerApprovalRequest } from "./native-hook-relay-DYOYE3qb.js";
+import { i as isCodexAppServerApprovalRequest, l as isJsonObject } from "./client-DMXvboVu.js";
+import { d as resolveReasoningEffort, g as mergeCodexThreadConfigs, r as buildCodexRuntimeThreadConfig, t as CODEX_NATIVE_PERSONALITY_NONE, u as resolveCodexAppServerModelProvider } from "./thread-lifecycle-Dv9Npl7a.js";
+import { i as readCodexAppServerBinding } from "./session-binding-ueMCn4om.js";
+import { h as formatCodexUsageLimitErrorMessage, i as readCodexNotificationTurnId, r as readCodexNotificationThreadId } from "./notification-correlation-BDakP_d3.js";
+import { a as releaseLeasedSharedCodexAppServerClient, i as getLeasedSharedCodexAppServerClient, l as refreshCodexAppServerAuthTokens } from "./shared-client-Duh1bHaP.js";
+import { n as resolveCodexNativeExecutionBlock } from "./sandbox-guard-mXE4_vE_.js";
+import { d as emitDynamicToolErrorDiagnostic, f as emitDynamicToolStartedDiagnostic, h as filterCodexDynamicTools, i as buildCodexNativeHookRelayDisabledConfig, l as handleCodexAppServerElicitationRequest, m as filterToolsForVisionInputs, p as emitDynamicToolTerminalDiagnostic, r as buildCodexNativeHookRelayConfig, t as CODEX_NATIVE_HOOK_RELAY_EVENTS, u as createCodexDynamicToolBridge, v as resolveCodexDynamicToolsLoading, y as handleCodexAppServerApprovalRequest } from "./native-hook-relay-B8qM8ZwR.js";
 import { n as rememberCodexRateLimits, t as readRecentCodexRateLimits } from "./rate-limit-cache-N66I-Rd7.js";
 import { buildAgentHookContextChannelFields, embeddedAgentLog, formatErrorMessage, registerNativeHookRelay, resolveAgentDir, resolveAttemptSpawnWorkspaceDir, resolveModelAuthMode, resolveSandboxContext, resolveSessionAgentIds, supportsModelTools } from "openclaw/plugin-sdk/agent-harness-runtime";
 //#region extensions/codex/src/app-server/side-question.ts

package/dist/{thread-lifecycle-1u5ogKG_.js → thread-lifecycle-Dv9Npl7a.js}

@@ -1,9 +1,9 @@
-import { d as resolveCodexPluginsPolicy, r as codexSandboxPolicyForTurn, t as CODEX_PLUGINS_MARKETPLACE_NAME } from "./config-BW7NPdAQ.js";
+import { d as resolveCodexPluginsPolicy, r as codexSandboxPolicyForTurn, t as CODEX_PLUGINS_MARKETPLACE_NAME } from "./config--tW89bHH.js";
 import { n as assertCodexThreadResumeResponse, r as assertCodexThreadStartResponse } from "./protocol-validators-DtjYmUw_.js";
-import { a as isCodexAppServerConnectionClosedError, l as isJsonObject, n as CodexAppServerRpcError } from "./client-TfDda-h3.js";
+import { a as isCodexAppServerConnectionClosedError, l as isJsonObject, n as CodexAppServerRpcError } from "./client-DMXvboVu.js";
 import { CODEX_GPT5_HEARTBEAT_PROMPT_OVERLAY } from "./prompt-overlay.js";
 import { isModernCodexModel } from "./provider.js";
-import { i as readCodexAppServerBinding, n as isCodexAppServerNativeAuthProfile, o as writeCodexAppServerBinding, t as clearCodexAppServerBinding } from "./session-binding-DuJisBZB.js";
+import { i as readCodexAppServerBinding, n as isCodexAppServerNativeAuthProfile, o as writeCodexAppServerBinding, t as clearCodexAppServerBinding } from "./session-binding-ueMCn4om.js";
 import crypto from "node:crypto";
 import { isRecord } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { embeddedAgentLog, formatErrorMessage, isActiveHarnessContextEngine } from "openclaw/plugin-sdk/agent-harness-runtime";

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@openclaw/codex",
-  "version": "2026.5.28-beta.2",
+  "version": "2026.5.28-beta.4",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@openclaw/codex",
-      "version": "2026.5.28-beta.2",
+      "version": "2026.5.28-beta.4",
       "dependencies": {
         "@openai/codex": "0.134.0",
         "typebox": "1.1.38",

package/openclaw.plugin.json

@@ -133,8 +133,7 @@
         "properties": {
           "mode": {
             "type": "string",
-            "enum": ["yolo", "guardian"],
-            "default": "yolo"
+            "enum": ["yolo", "guardian"]
           },
           "transport": {
             "type": "string",
@@ -305,7 +304,7 @@
     },
     "appServer.mode": {
       "label": "Execution Mode",
-      "help": "Use yolo for unchained local execution or guardian for Codex guardian-reviewed approvals.",
+      "help": "Legacy Codex app-server preset. Prefer tools.exec.mode=auto for normalized Guardian-reviewed approvals.",
       "advanced": true
     },
     "appServer.transport": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openclaw/codex",
-  "version": "2026.5.28-beta.2",
+  "version": "2026.5.28-beta.4",
   "description": "OpenClaw Codex app-server harness and model provider plugin with a Codex-managed GPT catalog.",
   "repository": {
     "type": "git",
@@ -26,10 +26,10 @@
       "minHostVersion": ">=2026.5.1-beta.1"
     },
     "compat": {
-      "pluginApi": ">=2026.5.28-beta.2"
+      "pluginApi": ">=2026.5.28-beta.4"
     },
     "build": {
-      "openclawVersion": "2026.5.28-beta.2"
+      "openclawVersion": "2026.5.28-beta.4"
     },
     "release": {
       "publishToClawHub": true,
@@ -46,7 +46,7 @@
     "npm-shrinkwrap.json"
   ],
   "peerDependencies": {
-    "openclaw": ">=2026.5.28-beta.2"
+    "openclaw": ">=2026.5.28-beta.4"
   },
   "peerDependenciesMeta": {
     "openclaw": {

package/dist/{sandbox-guard-CTnEWuor.js → sandbox-guard-mXE4_vE_.js}

@@ -1,5 +1,5 @@
-import { resolveSandboxRuntimeStatus } from "openclaw/plugin-sdk/sandbox";
 import { getSessionEntry } from "openclaw/plugin-sdk/session-store-runtime";
+import { resolveSandboxRuntimeStatus } from "openclaw/plugin-sdk/sandbox";
 //#region extensions/codex/src/app-server/native-execution-policy.ts
 const DEFAULT_AGENT_ID = "main";
 const VALID_AGENT_ID_PATTERN = /^[a-z0-9][a-z0-9_-]{0,63}$/i;