@openclaw/codex 2026.6.11-beta.2 → 2026.6.33

package/dist/{run-attempt-CXxtFC9d.js → run-attempt-CDCK3aeX.js}

@@ -1,21 +1,21 @@
 import { n as isJsonObject, t as flattenCodexDynamicToolFunctions } from "./protocol-dh-ETiNd.js";
-import { A as resolveCodexContextEngineProjectionReserveTokens, D as fitCodexProjectedContextForTurnStart, E as resolveCodexDynamicToolsLoadingForRuntime, H as readCodexNotificationTurnId, M as buildCodexPluginThreadConfigInputFingerprint, N as mergeCodexThreadConfigs, O as projectContextEngineAssemblyForCodex, P as shouldBuildCodexPluginThreadConfig, R as defaultCodexAppInventoryCache, V as readCodexNotificationThreadId, _ as resolveCodexWebSearchPlan, a as buildDeveloperInstructions, b as sanitizeCodexHistoryImagePayloads, c as codexDynamicToolsFingerprint, f as resolveCodexAppServerThreadModelSelection, h as startOrResumeThread, i as buildContextEngineBinding, j as buildCodexPluginThreadConfig, k as resolveCodexContextEngineProjectionMaxChars, l as isContextEngineBindingCompatible, n as areCodexDynamicToolFingerprintsCompatible, o as buildTurnCollaborationMode, s as buildTurnStartParams, v as isCodexAppServerProfilerEnabled, z as describeCodexNotificationCorrelation } from "./thread-lifecycle-DtT3-ehU.js";
-import { C as readCodexNotificationItem, D as updateActiveTurnItemIds, E as shouldDisarmAssistantCompletionIdleWatch, S as isTurnNotification, T as readRawResponseToolCallId, _ as isRawToolOutputCompletionNotification, a as isCodexNotificationOutsideActiveRun, b as isRetryableErrorNotification, c as isCurrentThreadOptionalTurnRequestParams, d as isNativeResponseStreamDeltaNotification, f as isNativeToolProgressNotification, g as isRawReasoningCompletionNotification, h as isRawFunctionToolOutputCompletionNotification, i as isAssistantCompletionReleaseNotification, l as isCurrentThreadTurnRequestParams, m as isRawAssistantProgressNotification, n as describeNotificationActivity, o as isCodexTurnAbortMarkerNotification, p as isPendingOpenClawDynamicToolCompletionNotification, r as isAssistantCommentaryCompletionNotification, s as isCurrentApprovalTurnRequestParams, t as codexExecutionToolName, u as isFileChangePatchUpdatedNotification, v as isReasoningItemCompletionNotification, w as readNotificationItemId, x as isTerminalTurnStatus, y as isReasoningProgressNotification } from "./attempt-notifications-BYnndyFl.js";
-import { _ as withMcpElicitationsApprovalPolicy, a as isCodexAppServerApprovalPolicyAllowedByRequirements, d as resolveCodexAppServerRuntimeOptions, f as resolveCodexComputerUseConfig, g as shouldAutoApproveCodexAppServerApprovals, h as resolveOpenClawExecPolicyForCodexAppServer, m as resolveCodexPluginsPolicy, p as resolveCodexModelBackedReviewerPolicyContext, s as isCodexSandboxExecServerEnabled, u as readCodexPluginConfig } from "./config-CszD0vP3.js";
+import { A as resolveCodexContextEngineProjectionReserveTokens, D as fitCodexProjectedContextForTurnStart, E as resolveCodexDynamicToolsLoadingForRuntime, H as readCodexNotificationTurnId, M as buildCodexPluginThreadConfigInputFingerprint, N as mergeCodexThreadConfigs, O as projectContextEngineAssemblyForCodex, P as shouldBuildCodexPluginThreadConfig, R as defaultCodexAppInventoryCache, V as readCodexNotificationThreadId, _ as resolveCodexWebSearchPlan, a as buildDeveloperInstructions, b as sanitizeCodexHistoryImagePayloads, c as codexDynamicToolsFingerprint, f as resolveCodexAppServerThreadModelSelection, h as startOrResumeThread, i as buildContextEngineBinding, j as buildCodexPluginThreadConfig, k as resolveCodexContextEngineProjectionMaxChars, l as isContextEngineBindingCompatible, n as areCodexDynamicToolFingerprintsCompatible, o as buildTurnCollaborationMode, s as buildTurnStartParams, v as isCodexAppServerProfilerEnabled, z as describeCodexNotificationCorrelation } from "./thread-lifecycle-DXrm-WWA.js";
+import { C as readCodexNotificationItem, D as updateActiveTurnItemIds, E as shouldDisarmAssistantCompletionIdleWatch, S as isTurnNotification, T as readRawResponseToolCallId, _ as isRawToolOutputCompletionNotification, a as isCodexNotificationOutsideActiveRun, b as isRetryableErrorNotification, c as isCurrentThreadOptionalTurnRequestParams, d as isNativeResponseStreamDeltaNotification, f as isNativeToolProgressNotification, g as isRawReasoningCompletionNotification, h as isRawFunctionToolOutputCompletionNotification, i as isAssistantCompletionReleaseNotification, l as isCurrentThreadTurnRequestParams, m as isRawAssistantProgressNotification, n as describeNotificationActivity, o as isCodexTurnAbortMarkerNotification, p as isPendingOpenClawDynamicToolCompletionNotification, r as isAssistantCommentaryCompletionNotification, s as isCurrentApprovalTurnRequestParams, t as codexExecutionToolName, u as isFileChangePatchUpdatedNotification, v as isReasoningItemCompletionNotification, w as readNotificationItemId, x as isTerminalTurnStatus, y as isReasoningProgressNotification } from "./attempt-notifications-Dl3RWAT-.js";
+import { a as isCodexAppServerApprovalPolicyAllowedByRequirements, d as resolveCodexComputerUseConfig, f as resolveCodexModelBackedReviewerPolicyContext, g as withMcpElicitationsApprovalPolicy, h as shouldAutoApproveCodexAppServerApprovals, l as readCodexPluginConfig, m as resolveOpenClawExecPolicyForCodexAppServer, p as resolveCodexPluginsPolicy, s as isCodexSandboxExecServerEnabled, u as resolveCodexAppServerRuntimeOptions } from "./config-DfV7hMHu.js";
 import { a as readCodexDynamicToolCallParams, c as readCodexTurn, i as assertCodexTurnStartResponse } from "./protocol-validators-B19q5BIX.js";
-import { i as formatCodexUsageLimitErrorMessage, o as resolveCodexUsageLimitResetAtMs, s as shouldRefreshCodexRateLimitsForUsageLimitMessage } from "./provider-B-OHpbD3.js";
-import { a as isCodexAppServerConnectionClosedError, i as isCodexAppServerApprovalRequest, n as CodexAppServerRpcError, r as compareCodexAppServerVersions, s as MIN_CODEX_SANDBOX_EXEC_SERVER_APP_SERVER_VERSION } from "./client-CLrtWgrD.js";
-import { i as isCodexAppServerNativeAuthProfile, l as writeCodexAppServerBinding, n as clearCodexAppServerBinding, o as readCodexAppServerBinding, r as clearCodexAppServerBindingForThread } from "./session-binding-HOuPt-E0.js";
-import { n as buildCodexPluginAppCacheKey, r as CODEX_CONTROL_METHODS, t as buildCodexAppServerRuntimeFingerprint } from "./plugin-app-cache-key-C9ILt7bl.js";
-import { a as formatCodexDisplayText, n as resolveCodexAppServerForOpenClawToolPolicy, t as resolveCodexAppServerForModelProvider } from "./app-server-policy-BPTiVNsW.js";
-import { d as resolveCodexAppServerAuthAccountCacheKey, f as resolveCodexAppServerAuthProfileId, h as resolveCodexAppServerHomeDir, m as resolveCodexAppServerFallbackApiKeyCacheKey, n as clearSharedCodexAppServerClientIfCurrentAndUnclaimed, o as releaseLeasedSharedCodexAppServerClient, p as resolveCodexAppServerAuthProfileIdForAgent, s as retireSharedCodexAppServerClientIfCurrent, t as clearSharedCodexAppServerClientIfCurrent, u as refreshCodexAppServerAuthTokens } from "./shared-client-Dtx5i7Ez.js";
-import { t as defaultLeasedCodexAppServerClientFactory } from "./client-factory-Bm6HsGob.js";
-import { A as CODEX_POST_REASONING_REPLY_IDLE_TIMEOUT_MS, C as resolveCodexMessageToolProvider, D as shouldWarnCodexDynamicToolBuildStageSummary, E as shouldRequireCodexSandboxExecServerEnvironment, F as resolveCodexTurnTerminalIdleTimeoutMs, I as withCodexStartupTimeout, M as resolveCodexStartupTimeoutMs, N as resolveCodexTurnAssistantCompletionIdleTimeoutMs, P as resolveCodexTurnCompletionIdleTimeoutMs, S as resolveCodexExternalSandboxPolicyForOpenClawSandbox, T as shouldEnableCodexAppServerNativeToolSurface, _ as createCodexDynamicToolBuildStageTracker, a as buildCodexNativeHookRelayConfig, b as resolveCodexAppServerExecutionCwd, c as resolveCodexNativeHookRelayEvents, d as handleCodexAppServerElicitationRequest, f as createCodexDynamicToolBridge, g as buildDynamicTools, h as emitDynamicToolTerminalDiagnostic, i as CODEX_NATIVE_HOOK_RELAY_TTL_GRACE_MS, j as resolveCodexPostToolRawAssistantCompletionIdleTimeoutMs, k as handleCodexAppServerApprovalRequest, l as resolveCodexNativeHookRelayTtlMs, m as emitDynamicToolStartedDiagnostic, o as buildCodexNativeHookRelayDisabledConfig, p as emitDynamicToolErrorDiagnostic, s as createCodexNativeHookRelay, t as resolveCodexProviderWebSearchSupport, u as scheduleCodexNativeHookRelayUnregister, v as disableCodexPluginThreadConfig, w as resolveCodexSandboxEnvironmentSelection, x as resolveCodexAppServerHookChannelId, y as formatCodexDynamicToolBuildStageSummary } from "./provider-capabilities-D7hnTO76.js";
-import { t as ensureCodexComputerUse } from "./computer-use-ClrJwoFp.js";
+import { i as formatCodexUsageLimitErrorMessage, o as resolveCodexUsageLimitResetAtMs, s as shouldRefreshCodexRateLimitsForUsageLimitMessage } from "./provider-J2nTGL8Q.js";
+import { a as isCodexAppServerConnectionClosedError, i as isCodexAppServerApprovalRequest, n as CodexAppServerRpcError, r as compareCodexAppServerVersions, s as MIN_CODEX_SANDBOX_EXEC_SERVER_APP_SERVER_VERSION } from "./client-DsqoRGhJ.js";
+import { i as isCodexAppServerNativeAuthProfile, l as writeCodexAppServerBinding, n as clearCodexAppServerBinding, o as readCodexAppServerBinding, r as clearCodexAppServerBindingForThread } from "./session-binding-CP5b8iN1.js";
+import { n as buildCodexPluginAppCacheKey, r as CODEX_CONTROL_METHODS, t as buildCodexAppServerRuntimeFingerprint } from "./plugin-app-cache-key-BwzTPSGU.js";
+import { a as formatCodexDisplayText, n as resolveCodexAppServerForOpenClawToolPolicy, t as resolveCodexAppServerForModelProvider } from "./app-server-policy-BaB2492Z.js";
+import { d as resolveCodexAppServerAuthAccountCacheKey, f as resolveCodexAppServerAuthProfileId, h as resolveCodexAppServerHomeDir, m as resolveCodexAppServerFallbackApiKeyCacheKey, n as clearSharedCodexAppServerClientIfCurrentAndUnclaimed, o as releaseLeasedSharedCodexAppServerClient, p as resolveCodexAppServerAuthProfileIdForAgent, s as retireSharedCodexAppServerClientIfCurrent, t as clearSharedCodexAppServerClientIfCurrent, u as refreshCodexAppServerAuthTokens } from "./shared-client-Ll9fWpy9.js";
+import { t as defaultLeasedCodexAppServerClientFactory } from "./client-factory-E-67xUhS.js";
+import { A as resolveCodexAppServerExecutionCwd, B as CODEX_POST_REASONING_REPLY_IDLE_TIMEOUT_MS, C as emitDynamicToolErrorDiagnostic, D as createCodexDynamicToolBuildStageTracker, E as buildDynamicTools, F as shouldEnableCodexAppServerNativeToolSurface, G as resolveCodexTurnTerminalIdleTimeoutMs, H as resolveCodexStartupTimeoutMs, I as shouldRequireCodexSandboxExecServerEnvironment, K as withCodexStartupTimeout, L as shouldWarnCodexDynamicToolBuildStageSummary, M as resolveCodexExternalSandboxPolicyForOpenClawSandbox, N as resolveCodexMessageToolProvider, O as disableCodexPluginThreadConfig, P as resolveCodexSandboxEnvironmentSelection, S as toCodexDynamicToolProtocolResponse, T as emitDynamicToolTerminalDiagnostic, U as resolveCodexTurnAssistantCompletionIdleTimeoutMs, V as resolveCodexPostToolRawAssistantCompletionIdleTimeoutMs, W as resolveCodexTurnCompletionIdleTimeoutMs, _ as resolveDynamicToolCallTimeoutMs, a as buildCodexNativeHookRelayConfig, b as shouldReleaseTurnAfterTerminalDynamicTool, c as resolveCodexNativeHookRelayEvents, d as handleCodexAppServerElicitationRequest, f as createCodexDynamicToolBridge, g as isMatchingDynamicToolTerminalDiagnostic, h as isDynamicToolTerminalDiagnosticEvent, i as CODEX_NATIVE_HOOK_RELAY_TTL_GRACE_MS, j as resolveCodexAppServerHookChannelId, k as formatCodexDynamicToolBuildStageSummary, l as resolveCodexNativeHookRelayTtlMs, m as hasPendingDynamicToolTerminalDiagnostic, o as buildCodexNativeHookRelayDisabledConfig, p as handleDynamicToolCallWithTimeout, s as createCodexNativeHookRelay, t as resolveCodexProviderWebSearchSupport, u as scheduleCodexNativeHookRelayUnregister, v as resolveTerminalDynamicToolBatchAction, w as emitDynamicToolStartedDiagnostic, x as toCodexDynamicToolProgressResponse, y as shouldBlockTerminalReleaseForNonTerminalDynamicToolResult, z as handleCodexAppServerApprovalRequest } from "./provider-capabilities-B3pUz-8b.js";
+import { t as ensureCodexComputerUse } from "./computer-use-B_iZKrBI.js";
 import { n as rememberCodexRateLimits, t as readRecentCodexRateLimits } from "./rate-limit-cache-C7qmZ0Jh.js";
 import fs from "node:fs/promises";
 import path, { posix } from "node:path";
-import { asDateTimestampMs, parseStrictNonNegativeInteger, resolveTimerTimeoutMs } from "openclaw/plugin-sdk/number-runtime";
+import { asDateTimestampMs, resolveTimerTimeoutMs } from "openclaw/plugin-sdk/number-runtime";
 import { asFiniteNumber, normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { createHash, randomUUID } from "node:crypto";
 import fsSync from "node:fs";
@@ -27,7 +27,7 @@ import { spawn } from "node:child_process";
 import { once } from "node:events";
 import { WebSocketServer } from "ws";
 import { redactSensitiveFieldValue, redactToolPayloadText } from "openclaw/plugin-sdk/logging-core";
-import { createDiagnosticTraceContextFromActiveScope, emitTrustedDiagnosticEvent, emitTrustedDiagnosticEventWithPrivateData, freezeDiagnosticTraceContext, hasPendingInternalDiagnosticEvent, onInternalDiagnosticEvent, resolveDiagnosticModelContentCapturePolicy } from "openclaw/plugin-sdk/diagnostic-runtime";
+import { createDiagnosticTraceContextFromActiveScope, emitTrustedDiagnosticEvent, emitTrustedDiagnosticEventWithPrivateData, freezeDiagnosticTraceContext, onInternalDiagnosticEvent, resolveDiagnosticModelContentCapturePolicy } from "openclaw/plugin-sdk/diagnostic-runtime";
 import { appendRegularFile, pathExists } from "openclaw/plugin-sdk/security-runtime";
 import { MESSAGE_TOOL_DELIVERY_HINTS } from "openclaw/plugin-sdk/message-tool-delivery-hints";
 import { buildSessionContext, migrateSessionEntries, parseSessionEntries } from "openclaw/plugin-sdk/agent-sessions";
@@ -147,6 +147,9 @@ async function retireCodexAppServerClientAfterTimedOutTurn(client, params) {
 * Reads OpenClaw session history for Codex transcript mirroring and sanitizes
 * image payloads before replaying messages into the app-server projector.
 */
+function isMissingFileError(error) {
+	return Boolean(error && typeof error === "object" && "code" in error && error.code === "ENOENT");
+}
 /** Returns sanitized session-context messages for a Codex mirrored session file. */
 async function readCodexMirroredSessionHistoryMessages(target) {
 	try {
@@ -159,7 +162,8 @@ async function readCodexMirroredSessionHistoryMessages(target) {
 		return sanitizeCodexHistoryImagePayloads(buildSessionContext(entries.filter((entry) => {
 			return entry !== null && typeof entry === "object" && !Array.isArray(entry) && entry.type !== "session";
 		})).messages, "codex mirrored history");
-	} catch {
+	} catch (error) {
+		if (isMissingFileError(error)) return [];
 		return;
 	}
 }
@@ -1619,16 +1623,31 @@ async function runStreamingSandboxHttpRequest(execServer, socket, requestId, par
 		env: {},
 		usePty: false
 	});
-	const [command, ...args] = execSpec.argv;
-	if (!command) throw new Error("OpenClaw sandbox HTTP exec spec did not provide a command.");
-	const child = spawn(command, args, {
-		env: execSpec.env,
-		stdio: [
-			"pipe",
-			"pipe",
-			"pipe"
-		]
-	});
+	let child;
+	try {
+		const [command, ...args] = execSpec.argv;
+		if (!command) throw new Error("OpenClaw sandbox HTTP exec spec did not provide a command.");
+		child = spawn(command, args, {
+			env: execSpec.env,
+			stdio: [
+				"pipe",
+				"pipe",
+				"pipe"
+			]
+		});
+	} catch (error) {
+		try {
+			await backend.finalizeExec?.({
+				status: "failed",
+				exitCode: null,
+				timedOut: false,
+				token: execSpec.finalizeToken
+			});
+		} catch (finalizeError) {
+			embeddedAgentLog.warn("codex sandbox http/request finalize after start failure failed", { error: finalizeError });
+		}
+		throw error;
+	}
 	const abortOnSocketClose = () => child.kill("SIGTERM");
 	socket.once("close", abortOnSocketClose);
 	child.once("close", () => {
@@ -1651,6 +1670,7 @@ function readStreamingSandboxHttpResponse(params) {
 	return new Promise((resolve, reject) => {
 		let headerResolved = false;
 		let failed = false;
+		let childFailure = null;
 		let lastBodySeq = 0;
 		let stdoutBuffer = "";
 		let stderr = "";
@@ -1720,10 +1740,16 @@ function readStreamingSandboxHttpResponse(params) {
 		params.child.stderr.on("data", (chunk) => {
 			stderr = `${stderr}${chunk.toString("utf8")}`.slice(-4096);
 		});
-		params.child.once("error", (error) => fail(error.message, null));
+		params.child.once("error", (error) => {
+			childFailure ??= error.message;
+		});
 		params.child.once("close", (code) => {
 			const exitCode = code ?? 1;
 			if (failed) return;
+			if (childFailure) {
+				fail(childFailure, exitCode);
+				return;
+			}
 			if (exitCode === 0) {
 				finalize("completed", exitCode).catch((error) => {
 					embeddedAgentLog.warn("codex sandbox http/request finalize failed", { error });
@@ -2026,29 +2052,37 @@ async function runProcess(execServer, managed, params) {
 	});
 	managed.finalizeToken = execSpec.finalizeToken;
 	managed.finalizeExec = backend.finalizeExec;
-	if (managed.abortController.signal.aborted) {
-		managed.failure = "process start cancelled";
-		await finalizeProcess(managed);
-		throw new Error("process start cancelled");
-	}
-	const [command, ...args] = execSpec.argv;
-	if (!command) throw new Error("OpenClaw sandbox exec spec did not provide a command.");
-	const child = spawn(command, args, {
-		env: execSpec.env,
-		stdio: [
-			"pipe",
-			"pipe",
-			"pipe"
-		]
-	});
+	let child;
+	try {
+		if (managed.abortController.signal.aborted) throw new Error("process start cancelled");
+		const [command, ...args] = execSpec.argv;
+		if (!command) throw new Error("OpenClaw sandbox exec spec did not provide a command.");
+		child = spawn(command, args, {
+			env: execSpec.env,
+			stdio: [
+				"pipe",
+				"pipe",
+				"pipe"
+			]
+		});
+	} catch (error) {
+		managed.failure = error instanceof Error ? error.message : String(error);
+		await finalizeProcess(managed).catch((finalizeError) => {
+			embeddedAgentLog.warn("codex sandbox exec-server finalize after start failure failed", {
+				processId: managed.processId,
+				error: finalizeError instanceof Error ? finalizeError.message : String(finalizeError)
+			});
+		});
+		throw error;
+	}
 	managed.child = child;
 	const abortListener = () => child.kill("SIGTERM");
 	managed.abortController.signal.addEventListener("abort", abortListener, { once: true });
 	child.stdout.on("data", (chunk) => appendProcessChunk(managed, managed.tty ? "pty" : "stdout", chunk));
 	child.stderr.on("data", (chunk) => appendProcessChunk(managed, "stderr", chunk));
 	child.once("error", (error) => {
-		managed.failure = error.message;
-		emitProcessClosed(managed, null);
+		managed.failure ??= error.message;
+		notifyProcessWaiters(managed);
 	});
 	child.once("close", (code) => {
 		managed.abortController.signal.removeEventListener("abort", abortListener);
@@ -3171,263 +3205,6 @@ function createCodexAttemptTurnWatchController(params) {
 		clearAllTimers
 	};
 }
-/** Hard cap for per-call Codex dynamic tool timeout overrides. */
-const CODEX_DYNAMIC_TOOL_MAX_TIMEOUT_MS = 6e5;
-const CODEX_DYNAMIC_IMAGE_GENERATION_TOOL_TIMEOUT_MS = 12e4;
-/** Timeout for message-delivery dynamic tool calls. */
-const CODEX_DYNAMIC_MESSAGE_TOOL_TIMEOUT_MS = 12e4;
-const LOG_FIELD_MAX_LENGTH = 160;
-function normalizeLogField(value) {
-	if (typeof value !== "string") return;
-	const normalized = value.replaceAll(String.fromCharCode(27), " ").replaceAll("\r", " ").replaceAll("\n", " ").replaceAll("	", " ").trim();
-	if (!normalized) return;
-	return normalized.length > LOG_FIELD_MAX_LENGTH ? `${normalized.slice(0, LOG_FIELD_MAX_LENGTH - 3)}...` : normalized;
-}
-function readNumericTimeoutMs(value) {
-	if (typeof value === "number" && Number.isFinite(value)) return Math.max(0, Math.floor(value));
-	if (typeof value === "string") {
-		const parsed = parseStrictNonNegativeInteger(value);
-		if (parsed !== void 0) return Math.max(0, Math.floor(parsed));
-	}
-}
-function formatDynamicToolTimeoutDetails(params) {
-	const tool = normalizeLogField(params.call.tool) ?? "unknown";
-	const baseMeta = {
-		tool: params.call.tool,
-		toolCallId: params.call.callId,
-		threadId: params.call.threadId,
-		turnId: params.call.turnId,
-		timeoutMs: params.timeoutMs,
-		timeoutKind: "codex_dynamic_tool_rpc"
-	};
-	if (tool !== "process" || !isJsonObject(params.call.arguments)) return {
-		responseMessage: `OpenClaw dynamic tool call timed out after ${params.timeoutMs}ms while running tool ${tool}.`,
-		consoleMessage: `codex dynamic tool timeout: tool=${tool} toolTimeoutMs=${params.timeoutMs}; per-tool-call watchdog, not session idle`,
-		meta: baseMeta
-	};
-	const action = normalizeLogField(params.call.arguments.action);
-	const sessionId = normalizeLogField(params.call.arguments.sessionId);
-	const requestedTimeoutMs = readNumericTimeoutMs(params.call.arguments.timeout);
-	const actionPart = action ? ` action=${action}` : "";
-	const sessionPart = sessionId ? ` sessionId=${sessionId}` : "";
-	const requestedPart = requestedTimeoutMs === void 0 ? "" : ` requestedWaitMs=${requestedTimeoutMs}`;
-	const retryHint = action === "poll" ? "; repeated lines usually mean process-poll retry churn, not model progress" : "";
-	const responseTarget = action || sessionId ? ` while waiting for process${actionPart}${sessionPart}` : " while waiting for the process tool";
-	return {
-		responseMessage: `OpenClaw dynamic tool call timed out after ${params.timeoutMs}ms${responseTarget}. This is a tool RPC timeout, not a session idle timeout.`,
-		consoleMessage: `codex process tool timeout:${actionPart}${sessionPart} toolTimeoutMs=${params.timeoutMs}${requestedPart}; per-tool-call watchdog, not session idle${retryHint}`,
-		meta: {
-			...baseMeta,
-			processAction: action,
-			processSessionId: sessionId,
-			processRequestedTimeoutMs: requestedTimeoutMs
-		}
-	};
-}
-/**
-* Runs a dynamic tool call with run-abort and per-call timeout handling,
-* returning a Codex protocol response instead of throwing.
-*/
-async function handleDynamicToolCallWithTimeout(params) {
-	let didNotifyAgentToolResult = false;
-	const notifyAgentToolResult = (event) => {
-		if (didNotifyAgentToolResult) return;
-		didNotifyAgentToolResult = true;
-		try {
-			params.onAgentToolResult?.(event);
-		} catch (error) {
-			embeddedAgentLog.warn(`onAgentToolResult handler failed: tool=${params.call.tool} error=${String(error)}`);
-		}
-	};
-	const notifyFailedToolResult = (message) => {
-		notifyAgentToolResult({
-			toolName: params.call.tool,
-			result: {
-				content: [{
-					type: "text",
-					text: message
-				}],
-				details: {
-					status: "failed",
-					error: message
-				}
-			},
-			isError: true
-		});
-	};
-	if (params.signal.aborted) {
-		const message = "OpenClaw dynamic tool call aborted before execution.";
-		params.onFallbackSelected?.();
-		notifyFailedToolResult(message);
-		return failedDynamicToolResponse(message);
-	}
-	const controller = new AbortController();
-	let timeout;
-	let timedOut = false;
-	let resolveAbort;
-	const abortFromRun = () => {
-		const message = "OpenClaw dynamic tool call aborted.";
-		params.onFallbackSelected?.();
-		controller.abort(params.signal.reason ?? /* @__PURE__ */ new Error(message));
-		notifyFailedToolResult(message);
-		resolveAbort?.(failedDynamicToolResponse(message, { sideEffectEvidence: true }));
-	};
-	const abortPromise = new Promise((resolve) => {
-		resolveAbort = resolve;
-	});
-	const timeoutPromise = new Promise((resolve) => {
-		const timeoutMs = clampDynamicToolTimeoutMs(params.timeoutMs);
-		timeout = setTimeout(() => {
-			timedOut = true;
-			const timeoutDetails = formatDynamicToolTimeoutDetails({
-				call: params.call,
-				timeoutMs
-			});
-			params.onFallbackSelected?.();
-			controller.abort(new Error(timeoutDetails.responseMessage));
-			params.onTimeout?.();
-			embeddedAgentLog.warn("codex dynamic tool call timed out", {
-				...timeoutDetails.meta,
-				consoleMessage: timeoutDetails.consoleMessage
-			});
-			notifyFailedToolResult(timeoutDetails.responseMessage);
-			resolve(failedDynamicToolResponse(timeoutDetails.responseMessage, { sideEffectEvidence: true }));
-		}, timeoutMs);
-		timeout.unref?.();
-	});
-	try {
-		params.signal.addEventListener("abort", abortFromRun, { once: true });
-		if (params.signal.aborted) abortFromRun();
-		const response = await Promise.race([
-			params.toolBridge.handleToolCall(params.call, {
-				signal: controller.signal,
-				onAgentToolResult: notifyAgentToolResult,
-				toolCallOrdinal: params.toolCallOrdinal
-			}),
-			abortPromise,
-			timeoutPromise
-		]);
-		if (!response.success && !didNotifyAgentToolResult) notifyFailedToolResult(readDynamicToolResponseText(response));
-		return response;
-	} catch (error) {
-		const message = error instanceof Error ? error.message : String(error);
-		notifyFailedToolResult(message);
-		return failedDynamicToolResponse(message, { sideEffectEvidence: true });
-	} finally {
-		if (timeout) clearTimeout(timeout);
-		params.signal.removeEventListener("abort", abortFromRun);
-		resolveAbort = void 0;
-		if (!timedOut && !controller.signal.aborted) controller.abort(/* @__PURE__ */ new Error("OpenClaw dynamic tool call finished."));
-	}
-}
-function readDynamicToolResponseText(response) {
-	return response.contentItems.flatMap((item) => item.type === "inputText" && typeof item.text === "string" ? [item.text] : []).join("\n").trim() || "OpenClaw dynamic tool call failed.";
-}
-function failedDynamicToolResponse(message, options) {
-	const response = {
-		contentItems: [{
-			type: "inputText",
-			text: message
-		}],
-		success: false
-	};
-	Object.defineProperty(response, "diagnosticTerminalType", {
-		configurable: true,
-		enumerable: false,
-		value: "error"
-	});
-	if (options?.sideEffectEvidence === true) Object.defineProperty(response, "sideEffectEvidence", {
-		configurable: true,
-		enumerable: false,
-		value: true
-	});
-	return response;
-}
-/** Strips OpenClaw-only metadata before sending a dynamic tool response to Codex. */
-function toCodexDynamicToolProtocolResponse(response) {
-	return {
-		contentItems: response.contentItems,
-		success: response.success
-	};
-}
-/** Adds async-started progress details when a tool result continues out of band. */
-function toCodexDynamicToolProgressResponse(response, protocolResponse) {
-	if (response.asyncStarted !== true) return protocolResponse;
-	return {
-		...protocolResponse,
-		details: {
-			async: true,
-			status: "started"
-		}
-	};
-}
-/** Decides whether a terminal dynamic tool response can release the Codex turn. */
-function shouldReleaseTurnAfterTerminalDynamicTool(state) {
-	return !state.completed && !state.aborted && state.responseSuccess && !state.currentTurnHadNonTerminalDynamicToolResult && state.activeAppServerTurnRequests === 0 && state.activeTurnItemIdsCount === 0 && state.pendingOpenClawDynamicToolCompletionIdsCount === 0;
-}
-/** Returns true when a non-async result should block terminal-release shortcuts. */
-function shouldBlockTerminalReleaseForNonTerminalDynamicToolResult(response) {
-	return response.asyncStarted !== true;
-}
-/** Resolves whether terminal diagnostic state should release, wait, or stay idle. */
-function resolveTerminalDynamicToolBatchAction(state) {
-	if (state.activeAppServerTurnRequests > 0 || state.activeTurnItemIdsCount > 0 || state.pendingOpenClawDynamicToolCompletionIdsCount > 0) return "wait";
-	if (state.currentTurnHadNonTerminalDynamicToolResult) return "clear-nonterminal-batch";
-	if (state.hasPendingTerminalDynamicToolRelease) return "release-pending-terminal";
-	return "idle";
-}
-/** Returns true for diagnostic events that terminate a dynamic tool call. */
-function isDynamicToolTerminalDiagnosticEvent(event) {
-	return event.type === "tool.execution.completed" || event.type === "tool.execution.error" || event.type === "tool.execution.blocked";
-}
-/** Matches terminal diagnostics to a specific dynamic tool call id/name. */
-function isMatchingDynamicToolTerminalDiagnostic(params) {
-	if (params.event.toolCallId !== params.call.callId || params.event.toolName !== params.call.tool) return false;
-	if (params.runId !== void 0) return params.event.runId === params.runId;
-	if (params.sessionId !== void 0) return params.event.sessionId === params.sessionId;
-	if (params.sessionKey !== void 0) return params.event.sessionKey === params.sessionKey;
-	return params.event.runId === void 0 && params.event.sessionId === void 0 && params.event.sessionKey === void 0;
-}
-/** Checks pending diagnostics for a terminal event matching a tool call. */
-function hasPendingDynamicToolTerminalDiagnostic(params) {
-	return hasPendingInternalDiagnosticEvent((event) => {
-		if (!isDynamicToolTerminalDiagnosticEvent(event)) return false;
-		return isMatchingDynamicToolTerminalDiagnostic({
-			event,
-			call: params.call,
-			runId: params.runId,
-			sessionId: params.sessionId,
-			sessionKey: params.sessionKey
-		});
-	});
-}
-/** Resolves per-tool timeout, applying media/message defaults and hard caps. */
-function resolveDynamicToolCallTimeoutMs(params) {
-	return clampDynamicToolTimeoutMs(readDynamicToolCallTimeoutMs(params.call.arguments) ?? readConfiguredDynamicToolTimeoutMs(params.call.tool, params.config) ?? 9e4);
-}
-function readDynamicToolCallTimeoutMs(value) {
-	if (!isJsonObject(value)) return;
-	return readPositiveFiniteTimeoutMs(value.timeoutMs);
-}
-function readConfiguredDynamicToolTimeoutMs(toolName, config) {
-	if (toolName === "image_generate") {
-		const imageGenerationModel = config?.agents?.defaults?.imageGenerationModel;
-		if (!imageGenerationModel || typeof imageGenerationModel !== "object") return CODEX_DYNAMIC_IMAGE_GENERATION_TOOL_TIMEOUT_MS;
-		return readPositiveFiniteTimeoutMs(imageGenerationModel.timeoutMs) ?? CODEX_DYNAMIC_IMAGE_GENERATION_TOOL_TIMEOUT_MS;
-	}
-	if (toolName === "image") return readTimeoutSecondsAsMs(config?.tools?.media?.image?.timeoutSeconds) ?? 6e4;
-	if (toolName === "message") return CODEX_DYNAMIC_MESSAGE_TOOL_TIMEOUT_MS;
-}
-function readTimeoutSecondsAsMs(value) {
-	const seconds = readPositiveFiniteTimeoutMs(value);
-	return seconds === void 0 ? void 0 : seconds * 1e3;
-}
-function readPositiveFiniteTimeoutMs(value) {
-	return typeof value === "number" && Number.isFinite(value) && value > 0 ? Math.floor(value) : void 0;
-}
-function clampDynamicToolTimeoutMs(timeoutMs) {
-	return Math.max(1, Math.min(CODEX_DYNAMIC_TOOL_MAX_TIMEOUT_MS, Math.floor(timeoutMs)));
-}
 //#endregion
 //#region extensions/codex/src/app-server/local-runtime-attribution.ts
 const OPENAI_PROVIDER_ID = "openai";
@@ -8546,7 +8323,7 @@ async function runCodexAppServerAttempt(params, options = {}) {
 	const turnCompletionIdleTimeoutMs = resolveCodexTurnCompletionIdleTimeoutMs(options.turnCompletionIdleTimeoutMs ?? appServer.turnCompletionIdleTimeoutMs);
 	const turnAssistantCompletionIdleTimeoutMs = resolveCodexTurnAssistantCompletionIdleTimeoutMs(options.turnAssistantCompletionIdleTimeoutMs);
 	const postToolRawAssistantCompletionIdleTimeoutMs = resolveCodexPostToolRawAssistantCompletionIdleTimeoutMs(options.postToolRawAssistantCompletionIdleTimeoutMs ?? appServer.postToolRawAssistantCompletionIdleTimeoutMs, turnAssistantCompletionIdleTimeoutMs);
-	const turnTerminalIdleTimeoutMs = resolveCodexTurnTerminalIdleTimeoutMs(options.turnTerminalIdleTimeoutMs);
+	const turnTerminalIdleTimeoutMs = resolveCodexTurnTerminalIdleTimeoutMs(options.turnTerminalIdleTimeoutMs, params.runTimeoutOverrideMs);
 	const turnAttemptIdleTimeoutMs = Math.max(100, Math.floor(params.timeoutMs));
 	let nativeHookRelayLastRenewedAt = 0;
 	let activeAppServerTurnRequests = 0;
@@ -8955,9 +8732,6 @@ async function runCodexAppServerAttempt(params, options = {}) {
 						threadId: thread.threadId,
 						turnId,
 						nativeHookRelay,
-						execPolicy,
-						execReviewerAgentId: sessionAgentId,
-						internalExecAutoReview: appServer.approvalsReviewer === "user",
 						autoApprove: shouldAutoApproveCodexAppServerApprovals(appServer),
 						signal: runAbortController.signal
 					});
@@ -9506,11 +9280,13 @@ async function runCodexAppServerAttempt(params, options = {}) {
 		kind: "embedded",
 		queueMessage: async (text, optionsLocal) => activeSteeringQueue.queue(text, optionsLocal),
 		isStreaming: () => !completed && !runAbortController.signal.aborted,
+		isAbortable: () => !completed && !runAbortController.signal.aborted,
 		isCompacting: () => projectorRef.current?.isCompacting() ?? false,
 		sourceReplyDeliveryMode: params.sourceReplyDeliveryMode,
 		cancel: () => runAbortController.abort("cancelled"),
 		abort: () => runAbortController.abort("aborted")
 	};
+	params.replyOperation?.attachBackend(handle);
 	setActiveEmbeddedRun(params.sessionId, handle, params.sessionKey);
 	const notifyUserMessagePersisted = createCodexAppServerUserMessagePersistenceNotifier(params);
 	mirrorPromptAtTurnStartBestEffort({
@@ -9892,9 +9668,6 @@ function handleApprovalRequest(params) {
 		threadId: params.threadId,
 		turnId: params.turnId,
 		nativeHookRelay: params.nativeHookRelay,
-		execPolicy: params.execPolicy,
-		execReviewerAgentId: params.execReviewerAgentId,
-		internalExecAutoReview: params.internalExecAutoReview,
 		autoApprove: params.autoApprove,
 		signal: params.signal
 	});

package/dist/{session-binding-HOuPt-E0.js → session-binding-CP5b8iN1.js}

@@ -1,5 +1,5 @@
 import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
-import { l as normalizeCodexServiceTier } from "./config-CszD0vP3.js";
+import { c as normalizeCodexServiceTier } from "./config-DfV7hMHu.js";
 import fs from "node:fs/promises";
 import { ensureAuthProfileStore, resolveDefaultAgentDir, resolveProviderIdForAuth } from "openclaw/plugin-sdk/agent-runtime";
 import { embeddedAgentLog } from "openclaw/plugin-sdk/agent-harness-runtime";

package/dist/{shared-client-Dtx5i7Ez.js → shared-client-Ll9fWpy9.js}

@@ -1,6 +1,6 @@
 import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
-import { d as resolveCodexAppServerRuntimeOptions, r as codexAppServerStartOptionsKey } from "./config-CszD0vP3.js";
-import { c as resolveCodexAppServerSpawnEnv, o as MANAGED_CODEX_APP_SERVER_PACKAGE, t as CodexAppServerClient } from "./client-CLrtWgrD.js";
+import { r as codexAppServerStartOptionsKey, u as resolveCodexAppServerRuntimeOptions } from "./config-DfV7hMHu.js";
+import { c as resolveCodexAppServerSpawnEnv, o as MANAGED_CODEX_APP_SERVER_PACKAGE, t as CodexAppServerClient } from "./client-DsqoRGhJ.js";
 import { createRequire } from "node:module";
 import fs, { access } from "node:fs/promises";
 import path from "node:path";