@openclaw/codex 2026.6.5 → 2026.6.6-beta.1

package/dist/{run-attempt-BWdNnok4.js → run-attempt-DG9p9ReO.js}

@@ -1,59 +1,40 @@
-import { c as readCodexPluginConfig, d as resolveCodexPluginsPolicy, f as resolveOpenClawExecPolicyForCodexAppServer, i as isCodexAppServerApprovalPolicyAllowedByRequirements, l as resolveCodexAppServerRuntimeOptions, m as withMcpElicitationsApprovalPolicy, o as isCodexSandboxExecServerEnabled, p as shouldAutoApproveCodexAppServerApprovals, u as resolveCodexComputerUseConfig } from "./config-BT6SLiE6.js";
-import { a as readCodexDynamicToolCallParams, c as readCodexTurn, i as assertCodexTurnStartResponse } from "./protocol-validators-CIpP8IJ2.js";
-import { a as isCodexAppServerConnectionClosedError, i as isCodexAppServerApprovalRequest, l as isJsonObject, r as compareCodexAppServerVersions, s as MIN_CODEX_SANDBOX_EXEC_SERVER_APP_SERVER_VERSION } from "./client-kMCtlApt.js";
-import { A as projectContextEngineAssemblyForCodex, C as sanitizeCodexHistoryImagePayloads, D as normalizeCodexDynamicToolName$1, E as isForcedPrivateQaCodexRuntime, M as resolveCodexContextEngineProjectionReserveTokens, T as filterCodexDynamicTools, _ as shouldBuildCodexPluginThreadConfig, a as buildDeveloperInstructions, c as codexDynamicToolsFingerprint, f as startOrResumeThread, g as mergeCodexThreadConfigs, h as buildCodexPluginThreadConfigInputFingerprint, i as buildContextEngineBinding, j as resolveCodexContextEngineProjectionMaxChars, k as resolveCodexDynamicToolsLoadingForModel, l as isContextEngineBindingCompatible, m as buildCodexPluginThreadConfig, n as areCodexDynamicToolFingerprintsCompatible, o as buildTurnCollaborationMode, p as isCodexAppServerProfilerEnabled, s as buildTurnStartParams, x as defaultCodexAppInventoryCache } from "./thread-lifecycle-BJsazZ8j.js";
-import { a as readCodexAppServerBinding, n as clearCodexAppServerBindingForThread, s as writeCodexAppServerBinding, t as clearCodexAppServerBinding } from "./session-binding-BgTv_YGm.js";
-import { n as buildCodexPluginAppCacheKey, r as CODEX_CONTROL_METHODS } from "./request-D64BfplD.js";
-import { _ as shouldRefreshCodexRateLimitsForUsageLimitMessage, g as resolveCodexUsageLimitResetAtMs, h as formatCodexUsageLimitErrorMessage, i as readCodexNotificationTurnId, n as isCodexNotificationForTurn, r as readCodexNotificationThreadId, s as formatCodexDisplayText, t as describeCodexNotificationCorrelation } from "./notification-correlation-o8quHmTK.js";
-import { d as resolveCodexAppServerAuthAccountCacheKey, f as resolveCodexAppServerAuthProfileId, h as resolveCodexAppServerHomeDir, m as resolveCodexAppServerFallbackApiKeyCacheKey, n as clearSharedCodexAppServerClientIfCurrentAndUnclaimed, o as releaseLeasedSharedCodexAppServerClient, p as resolveCodexAppServerAuthProfileIdForAgent, s as retireSharedCodexAppServerClientIfCurrent, t as clearSharedCodexAppServerClientIfCurrent, u as refreshCodexAppServerAuthTokens } from "./shared-client-xytpSKD0.js";
+import { _ as withMcpElicitationsApprovalPolicy, a as isCodexAppServerApprovalPolicyAllowedByRequirements, d as resolveCodexAppServerRuntimeOptions, f as resolveCodexComputerUseConfig, g as shouldAutoApproveCodexAppServerApprovals, h as resolveOpenClawExecPolicyForCodexAppServer, m as resolveCodexPluginsPolicy, p as resolveCodexModelBackedReviewerPolicyContext, s as isCodexSandboxExecServerEnabled, u as readCodexPluginConfig } from "./config-DJXpBkGf.js";
+import { a as readCodexDynamicToolCallParams, c as readCodexTurn, i as assertCodexTurnStartResponse } from "./protocol-validators-B48C6S9O.js";
+import { t as isJsonObject } from "./protocol-oeJQu4rs.js";
+import { i as formatCodexUsageLimitErrorMessage, o as resolveCodexUsageLimitResetAtMs, s as shouldRefreshCodexRateLimitsForUsageLimitMessage } from "./provider-Cs6kWhDQ.js";
+import { a as isCodexAppServerConnectionClosedError, i as isCodexAppServerApprovalRequest, n as CodexAppServerRpcError, r as compareCodexAppServerVersions, s as MIN_CODEX_SANDBOX_EXEC_SERVER_APP_SERVER_VERSION } from "./client-DovmVtbr.js";
+import { C as defaultCodexAppInventoryCache, D as filterCodexDynamicTools, M as projectContextEngineAssemblyForCodex, N as resolveCodexContextEngineProjectionMaxChars, O as isForcedPrivateQaCodexRuntime, P as resolveCodexContextEngineProjectionReserveTokens, T as sanitizeCodexHistoryImagePayloads, _ as buildCodexPluginThreadConfigInputFingerprint, a as buildDeveloperInstructions, c as codexDynamicToolsFingerprint, g as buildCodexPluginThreadConfig, h as isCodexAppServerProfilerEnabled, i as buildContextEngineBinding, j as resolveCodexDynamicToolsLoadingForModel, k as normalizeCodexDynamicToolName$1, l as isContextEngineBindingCompatible, m as startOrResumeThread, n as areCodexDynamicToolFingerprintsCompatible, o as buildTurnCollaborationMode, s as buildTurnStartParams, v as mergeCodexThreadConfigs, y as shouldBuildCodexPluginThreadConfig } from "./thread-lifecycle-Cq1-IfZB.js";
+import { i as isCodexAppServerNativeAuthProfile, l as writeCodexAppServerBinding, n as clearCodexAppServerBinding, o as readCodexAppServerBinding, r as clearCodexAppServerBindingForThread } from "./session-binding-ElbcSq2o.js";
+import { n as CODEX_CONTROL_METHODS, t as buildCodexPluginAppCacheKey } from "./plugin-app-cache-key-NpzxEcSR.js";
+import { a as resolveCodexAppServerForModelProvider, i as readCodexNotificationTurnId, l as formatCodexDisplayText, n as isCodexNotificationForTurn, o as resolveCodexAppServerForOpenClawToolPolicy, r as readCodexNotificationThreadId, t as describeCodexNotificationCorrelation } from "./notification-correlation-D-MYfJwV.js";
+import { d as resolveCodexAppServerAuthAccountCacheKey, f as resolveCodexAppServerAuthProfileId, h as resolveCodexAppServerHomeDir, m as resolveCodexAppServerFallbackApiKeyCacheKey, n as clearSharedCodexAppServerClientIfCurrentAndUnclaimed, o as releaseLeasedSharedCodexAppServerClient, p as resolveCodexAppServerAuthProfileIdForAgent, s as retireSharedCodexAppServerClientIfCurrent, t as clearSharedCodexAppServerClientIfCurrent, u as refreshCodexAppServerAuthTokens } from "./shared-client-CflavQ_i.js";
 import { i as resolveCodexNativeExecutionPolicy } from "./sandbox-guard-C-Yv9uwY.js";
-import { t as defaultLeasedCodexAppServerClientFactory } from "./client-factory-Bt49r45B.js";
-import { S as withCodexStartupTimeout, _ as resolveCodexPostToolRawAssistantCompletionIdleTimeoutMs, a as createCodexNativeHookRelay, b as resolveCodexTurnCompletionIdleTimeoutMs, c as scheduleCodexNativeHookRelayUnregister, d as emitDynamicToolErrorDiagnostic, f as emitDynamicToolStartedDiagnostic, g as CODEX_POST_REASONING_REPLY_IDLE_TIMEOUT_MS, h as handleCodexAppServerApprovalRequest, i as buildCodexNativeHookRelayDisabledConfig, l as handleCodexAppServerElicitationRequest, m as filterToolsForVisionInputs, n as CODEX_NATIVE_HOOK_RELAY_TTL_GRACE_MS, o as resolveCodexNativeHookRelayEvents, p as emitDynamicToolTerminalDiagnostic, r as buildCodexNativeHookRelayConfig, s as resolveCodexNativeHookRelayTtlMs, u as createCodexDynamicToolBridge, v as resolveCodexStartupTimeoutMs, x as resolveCodexTurnTerminalIdleTimeoutMs, y as resolveCodexTurnAssistantCompletionIdleTimeoutMs } from "./native-hook-relay-DHwz_ICg.js";
-import { t as ensureCodexComputerUse } from "./computer-use-ClweWaMz.js";
+import { t as defaultLeasedCodexAppServerClientFactory } from "./client-factory-XajDuvQ1.js";
+import { S as withCodexStartupTimeout, _ as resolveCodexPostToolRawAssistantCompletionIdleTimeoutMs, a as createCodexNativeHookRelay, b as resolveCodexTurnCompletionIdleTimeoutMs, c as scheduleCodexNativeHookRelayUnregister, d as emitDynamicToolErrorDiagnostic, f as emitDynamicToolStartedDiagnostic, g as CODEX_POST_REASONING_REPLY_IDLE_TIMEOUT_MS, h as handleCodexAppServerApprovalRequest, i as buildCodexNativeHookRelayDisabledConfig, l as handleCodexAppServerElicitationRequest, m as filterToolsForVisionInputs, n as CODEX_NATIVE_HOOK_RELAY_TTL_GRACE_MS, o as resolveCodexNativeHookRelayEvents, p as emitDynamicToolTerminalDiagnostic, r as buildCodexNativeHookRelayConfig, s as resolveCodexNativeHookRelayTtlMs, u as createCodexDynamicToolBridge, v as resolveCodexStartupTimeoutMs, x as resolveCodexTurnTerminalIdleTimeoutMs, y as resolveCodexTurnAssistantCompletionIdleTimeoutMs } from "./native-hook-relay-CmUUO3Eu.js";
+import { t as ensureCodexComputerUse } from "./computer-use-D3pi5csE.js";
 import { n as rememberCodexRateLimits, t as readRecentCodexRateLimits } from "./rate-limit-cache-C7qmZ0Jh.js";
 import { asDateTimestampMs, parseStrictNonNegativeInteger, resolveTimerTimeoutMs } from "openclaw/plugin-sdk/number-runtime";
 import { createHash, randomUUID } from "node:crypto";
 import fsSync from "node:fs";
+import path, { posix } from "node:path";
+import { markAuthProfileBlockedUntil, resolveAgentDir, resolveAgentWorkspaceDir } from "openclaw/plugin-sdk/agent-runtime";
 import { loadExecApprovals } from "openclaw/plugin-sdk/exec-approvals-runtime";
 import { asBoolean, asFiniteNumber, normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
-import { CODEX_APP_SERVER_CONTEXT_ENGINE_HOST, TOOL_PROGRESS_OUTPUT_MAX_CHARS, acquireSessionWriteLock, appendSessionTranscriptMessage, assembleHarnessContextEngine, assertContextEngineHostSupport, awaitAgentHarnessAgentEndHook, bootstrapHarnessContextEngine, buildAgentHookContextChannelFields, buildBootstrapContextForFiles, buildEmbeddedAttemptToolRunContext, buildHarnessContextEngineRuntimeContext, buildHarnessContextEngineRuntimeContextFromUsage, classifyAgentHarnessTerminalOutcome, clearActiveEmbeddedRun, embeddedAgentLog, emitAgentEvent, emitSessionTranscriptUpdate, filterProviderNormalizableTools, finalizeHarnessContextEngineTurn, formatErrorMessage, formatToolAggregate, formatToolProgressOutput, getAgentHarnessHookRunner, getBeforeToolCallPolicyDiagnosticState, inferToolMetaFromArgs, isActiveHarnessContextEngine, isSubagentSessionKey, loadCodexBundleMcpThreadConfig, normalizeAgentRuntimeTools, normalizeUsage, resolveAgentHarnessBeforePromptBuildResult, resolveAttemptSpawnWorkspaceDir, resolveBootstrapFilesForRun, resolveContextEngineOwnerPluginId, resolveModelAuthMode, resolveSandboxContext, resolveSessionAgentIds, resolveSessionWriteLockOptions, resolveUserPath, runAgentCleanupStep, runAgentHarnessAfterCompactionHook, runAgentHarnessAfterToolCallHook, runAgentHarnessAgentEndHook, runAgentHarnessBeforeCompactionHook, runAgentHarnessBeforeMessageWriteHook, runAgentHarnessLlmInputHook, runAgentHarnessLlmOutputHook, runHarnessContextEngineMaintenance, setActiveEmbeddedRun, supportsModelTools } from "openclaw/plugin-sdk/agent-harness-runtime";
+import { CODEX_APP_SERVER_CONTEXT_ENGINE_HOST, TOOL_PROGRESS_OUTPUT_MAX_CHARS, acquireSessionWriteLock, appendSessionTranscriptMessage, assembleHarnessContextEngine, assertContextEngineHostSupport, awaitAgentHarnessAgentEndHook, bootstrapHarnessContextEngine, buildAgentHookContextChannelFields, buildBootstrapContextForFiles, buildEmbeddedAttemptToolRunContext, buildHarnessContextEngineRuntimeContext, buildHarnessContextEngineRuntimeContextFromUsage, classifyAgentHarnessTerminalOutcome, clearActiveEmbeddedRun, embeddedAgentLog, emitAgentEvent, emitSessionTranscriptUpdate, filterProviderNormalizableTools, finalizeHarnessContextEngineTurn, formatErrorMessage, formatToolAggregate, formatToolProgressOutput, getAgentHarnessHookRunner, getBeforeToolCallPolicyDiagnosticState, inferToolMetaFromArgs, isActiveHarnessContextEngine, isSubagentSessionKey, loadCodexBundleMcpThreadConfig, normalizeAgentRuntimeTools, normalizeUsage, resolveAgentHarnessBeforePromptBuildResult, resolveAttemptSpawnWorkspaceDir, resolveBootstrapFilesForRun, resolveContextEngineOwnerPluginId, resolveModelAuthMode, resolveSandboxContext, resolveSessionAgentIds as resolveSessionAgentIds$1, resolveSessionWriteLockOptions, resolveUserPath, runAgentCleanupStep, runAgentHarnessAfterCompactionHook, runAgentHarnessAfterToolCallHook, runAgentHarnessAgentEndHook, runAgentHarnessBeforeCompactionHook, runAgentHarnessBeforeMessageWriteHook, runAgentHarnessLlmInputHook, runAgentHarnessLlmOutputHook, runHarnessContextEngineMaintenance, setActiveEmbeddedRun, supportsModelTools } from "openclaw/plugin-sdk/agent-harness-runtime";
 import { spawn } from "node:child_process";
 import { once } from "node:events";
 import { WebSocketServer } from "ws";
 import { redactSensitiveFieldValue, redactToolPayloadText } from "openclaw/plugin-sdk/logging-core";
 import fs from "node:fs/promises";
-import path, { posix } from "node:path";
 import { createDiagnosticTraceContextFromActiveScope, emitTrustedDiagnosticEvent, emitTrustedDiagnosticEventWithPrivateData, freezeDiagnosticTraceContext, hasPendingInternalDiagnosticEvent, onInternalDiagnosticEvent, resolveDiagnosticModelContentCapturePolicy } from "openclaw/plugin-sdk/diagnostic-runtime";
-import { markAuthProfileBlockedUntil, resolveAgentDir as resolveAgentDir$1, resolveAgentWorkspaceDir } from "openclaw/plugin-sdk/agent-runtime";
 import { isToolAllowed } from "openclaw/plugin-sdk/sandbox";
 import { appendRegularFile, pathExists } from "openclaw/plugin-sdk/security-runtime";
 import { buildSessionContext, migrateSessionEntries, parseSessionEntries } from "openclaw/plugin-sdk/agent-sessions";
 import { isIP } from "node:net";
+import { SsrFBlockedError, isBlockedHostnameOrIp } from "openclaw/plugin-sdk/ssrf-runtime";
 import { generatedImageAssetFromBase64 } from "openclaw/plugin-sdk/image-generation";
 import { saveMediaBuffer } from "openclaw/plugin-sdk/media-store";
 import { createAgentHarnessTaskRuntime, deliverAgentHarnessTaskCompletion, isDurableAgentHarnessCompletionDelivery } from "openclaw/plugin-sdk/agent-harness-task-runtime";
-//#region extensions/codex/src/app-server/app-server-policy.ts
-/**
-* Promotes implicit `never` approval policy to `untrusted` only when runtime
-* requirements allow OpenClaw to handle tool approvals.
-*/
-function resolveCodexAppServerForOpenClawToolPolicy(params) {
-	if (!params.shouldPromote || !params.canUseUntrustedApprovalPolicy || params.appServer.approvalPolicy !== "never") return params.appServer;
-	const explicitMode = params.execPolicy?.mode === "full" || params.pluginConfig.appServer?.mode !== void 0 || isCodexAppServerPolicyMode(params.env.OPENCLAW_CODEX_APP_SERVER_MODE);
-	const explicitApprovalPolicy = params.pluginConfig.appServer?.approvalPolicy !== void 0 || isCodexAppServerApprovalPolicy(params.env.OPENCLAW_CODEX_APP_SERVER_APPROVAL_POLICY) || params.appServer.approvalPolicySource === "requirements";
-	if (explicitMode || explicitApprovalPolicy) return params.appServer;
-	return {
-		...params.appServer,
-		approvalPolicy: "untrusted"
-	};
-}
-function isCodexAppServerPolicyMode(value) {
-	return value === "guardian" || value === "yolo";
-}
-function isCodexAppServerApprovalPolicy(value) {
-	return value === "never" || value === "on-request" || value === "on-failure" || value === "untrusted";
-}
-//#endregion
 //#region extensions/codex/src/app-server/attempt-client-cleanup.ts
 /**
 * Best-effort cleanup helpers for timed-out or aborted Codex app-server turns.
@@ -1323,7 +1304,7 @@ async function buildDynamicTools(input) {
 	if (params.disableTools || !supportsModelTools(params.model)) return [];
 	const toolBuildStages = createCodexDynamicToolBuildStageTracker({ enabled: input.profilerEnabled });
 	const modelHasVision = params.model.input?.includes("image") ?? false;
-	const agentDir = params.agentDir ?? resolveAgentDir$1(params.config ?? {}, input.sessionAgentId);
+	const agentDir = params.agentDir ?? resolveAgentDir(params.config ?? {}, input.sessionAgentId);
 	const createOpenClawCodingTools = (await import("openclaw/plugin-sdk/agent-harness")).createOpenClawCodingTools;
 	toolBuildStages.mark("load-agent-harness-tools");
 	const sessionKeys = resolveOpenClawCodingToolsSessionKeys(params, input.sandboxSessionKey);
@@ -2122,9 +2103,11 @@ const SANDBOX_HTTP_STREAM_LINE_MAX_CHARS = 256 * 1024;
 async function httpRequest(execServer, socket, params) {
 	const record = requireObject(params, "http/request params");
 	const requestId = requireString(record.requestId, "requestId");
+	const url = requireString(record.url, "url");
+	assertSandboxHttpRequestTargetAllowed(url);
 	const request = {
 		method: requireString(record.method, "method"),
-		url: requireString(record.url, "url"),
+		url,
 		headers: readHttpHeaders(record.headers),
 		bodyBase64: typeof record.bodyBase64 === "string" ? record.bodyBase64 : void 0,
 		timeoutMs: typeof record.timeoutMs === "number" && record.timeoutMs > 0 ? Math.floor(record.timeoutMs) : void 0,
@@ -2136,6 +2119,16 @@ async function httpRequest(execServer, socket, params) {
 		streamResponse: false
 	});
 }
+function assertSandboxHttpRequestTargetAllowed(url) {
+	let parsed;
+	try {
+		parsed = new URL(url);
+	} catch {
+		throw new SsrFBlockedError("Invalid URL supplied to sandbox http/request");
+	}
+	if (parsed.protocol !== "http:" && parsed.protocol !== "https:") throw new SsrFBlockedError(`Blocked non-HTTP(S) protocol in sandbox http/request: ${parsed.protocol}`);
+	if (isBlockedHostnameOrIp(parsed.hostname)) throw new SsrFBlockedError(`Blocked hostname or private/internal IP in sandbox http/request: ${parsed.hostname}`);
+}
 async function runSandboxHttpRequest(execServer, params) {
 	const result = await requireBackend(execServer).runShellCommand({
 		script: SANDBOX_HTTP_REQUEST_SCRIPT,
@@ -2284,6 +2277,8 @@ trap 'rm -f "$tmp"' EXIT
 cat > "$tmp" <<'PY'
 import base64
 import json
+import ipaddress
+import socket
 import sys
 import urllib.error
 import urllib.parse
@@ -2295,6 +2290,127 @@ def emit(payload):
 def response_headers(response):
     return [{"name": name, "value": value} for name, value in response.headers.items()]
 
+BLOCKED_HOSTNAMES = {
+    "localhost",
+    "localhost.localdomain",
+    "metadata.google.internal",
+}
+CLOUD_METADATA_IP_ADDRESSES = {
+    "100.100.100.200",
+    "fd00:ec2::254",
+}
+BLOCKED_IPV4_NETWORKS = tuple(
+    ipaddress.ip_network(network)
+    for network in (
+        "100.64.0.0/10",
+        "198.18.0.0/15",
+    )
+)
+BLOCKED_IPV6_NETWORKS = tuple(
+    ipaddress.ip_network(network)
+    for network in (
+        "100::/64",
+        "2001:2::/48",
+        "2001:20::/28",
+        "2001:db8::/32",
+        "fec0::/10",
+    )
+)
+PINNED_ADDRESSES = {}
+
+def normalize_hostname(hostname):
+    return (hostname or "").strip("[]").rstrip(".").lower()
+
+def is_blocked_hostname(hostname):
+    normalized = normalize_hostname(hostname)
+    return (
+        normalized in BLOCKED_HOSTNAMES
+        or normalized.endswith(".localhost")
+        or normalized.endswith(".local")
+        or normalized.endswith(".internal")
+    )
+
+def is_blocked_ip(address):
+    try:
+        parsed = ipaddress.ip_address(address)
+    except ValueError:
+        return False
+    embedded_ipv4 = extract_embedded_ipv4(parsed)
+    if embedded_ipv4 is not None and is_blocked_ip(str(embedded_ipv4)):
+        return True
+    if str(parsed).lower() in CLOUD_METADATA_IP_ADDRESSES:
+        return True
+    if isinstance(parsed, ipaddress.IPv4Address):
+        if any(parsed in network for network in BLOCKED_IPV4_NETWORKS):
+            return True
+    else:
+        if any(parsed in network for network in BLOCKED_IPV6_NETWORKS):
+            return True
+    return (
+        parsed.is_loopback
+        or parsed.is_private
+        or parsed.is_link_local
+        or parsed.is_multicast
+        or parsed.is_reserved
+        or parsed.is_unspecified
+    )
+
+def ipv4_from_int(value):
+    return ipaddress.IPv4Address(value & 0xffffffff)
+
+def extract_embedded_ipv4(address):
+    if not isinstance(address, ipaddress.IPv6Address):
+        return None
+    if address.ipv4_mapped is not None:
+        return address.ipv4_mapped
+    value = int(address)
+    hextets = [(value >> shift) & 0xffff for shift in range(112, -1, -16)]
+    if hextets[:6] == [0, 0, 0, 0, 0, 0]:
+        return ipv4_from_int(value)
+    if hextets[:6] == [0x64, 0xff9b, 0, 0, 0, 0]:
+        return ipv4_from_int(value)
+    if hextets[:6] == [0x64, 0xff9b, 1, 0, 0, 0]:
+        return ipv4_from_int(value)
+    if hextets[0] == 0x2002:
+        return ipv4_from_int((hextets[1] << 16) | hextets[2])
+    if hextets[0] == 0x2001 and hextets[1] == 0:
+        return ipv4_from_int(((hextets[6] << 16) | hextets[7]) ^ 0xffffffff)
+    if (hextets[4] & 0xfcff) == 0 and hextets[5] == 0x5efe:
+        return ipv4_from_int((hextets[6] << 16) | hextets[7])
+    return None
+
+def assert_url_allowed(url):
+    parsed = urllib.parse.urlparse(url)
+    if parsed.scheme not in ("http", "https"):
+        raise ValueError("http/request only supports http and https URLs")
+    hostname = normalize_hostname(parsed.hostname)
+    if not hostname or is_blocked_hostname(hostname) or is_blocked_ip(hostname):
+        raise ValueError("Blocked hostname or private/internal/special-use IP address")
+    try:
+        results = socket.getaddrinfo(hostname, parsed.port, proto=socket.IPPROTO_TCP)
+    except socket.gaierror as error:
+        raise ValueError(f"Unable to resolve hostname: {hostname}") from error
+    addresses = {entry[4][0] for entry in results if entry[4]}
+    if not addresses or any(is_blocked_ip(address) for address in addresses):
+        raise ValueError("Blocked: resolves to private/internal/special-use IP address")
+    PINNED_ADDRESSES[hostname] = sorted(addresses)
+
+class GuardedRedirectHandler(urllib.request.HTTPRedirectHandler):
+    def redirect_request(self, req, fp, code, msg, headers, newurl):
+        assert_url_allowed(newurl)
+        return super().redirect_request(req, fp, code, msg, headers, newurl)
+
+def pinned_getaddrinfo(original_getaddrinfo):
+    def getaddrinfo(host, port, family=0, type=0, proto=0, flags=0):
+        pinned = PINNED_ADDRESSES.get(normalize_hostname(host))
+        if not pinned:
+            return original_getaddrinfo(host, port, family, type, proto, flags)
+        results = []
+        for address in pinned:
+            results.extend(original_getaddrinfo(address, port, family, type, proto, flags))
+        return results
+    return getaddrinfo
+
 def handle_response(input_data, response):
     headers = response_headers(response)
     status = int(getattr(response, "status", getattr(response, "code", 0)))
@@ -2324,9 +2440,7 @@ def handle_response(input_data, response):
 def main():
     input_data = json.load(sys.stdin)
     url = str(input_data.get("url", ""))
-    parsed = urllib.parse.urlparse(url)
-    if parsed.scheme not in ("http", "https"):
-        raise ValueError("http/request only supports http and https URLs")
+    assert_url_allowed(url)
     body_base64 = input_data.get("bodyBase64")
     data = base64.b64decode(body_base64) if isinstance(body_base64, str) else None
     request = urllib.request.Request(
@@ -2340,11 +2454,16 @@ def main():
     timeout = None
     if isinstance(timeout_ms, (int, float)) and timeout_ms > 0:
         timeout = timeout_ms / 1000
+    opener = urllib.request.build_opener(urllib.request.ProxyHandler({}), GuardedRedirectHandler)
+    original_getaddrinfo = socket.getaddrinfo
+    socket.getaddrinfo = pinned_getaddrinfo(original_getaddrinfo)
     try:
-        with urllib.request.urlopen(request, timeout=timeout) as response:
+        with opener.open(request, timeout=timeout) as response:
             handle_response(input_data, response)
     except urllib.error.HTTPError as response:
         handle_response(input_data, response)
+    finally:
+        socket.getaddrinfo = original_getaddrinfo
 
 if __name__ == "__main__":
     main()
@@ -7798,6 +7917,7 @@ function readRequestId(record) {
 //#region extensions/codex/src/app-server/run-attempt.ts
 const CODEX_NATIVE_HOOK_RELAY_RENEW_INTERVAL_MS = 6e4;
 const CODEX_APP_SERVER_PROJECTED_CHARS_PER_TOKEN = 4;
+const CODEX_APP_SERVER_ACTIVE_NATIVE_TURN_WAIT_TIMEOUT_MS = 3e4;
 const ensuredCodexWorkspaceDirs = /* @__PURE__ */ new Set();
 function estimateCodexAppServerProjectedTurnTokens(params) {
 	const inputChars = params.prompt.length + (params.developerInstructions?.length ?? 0);
@@ -7836,6 +7956,43 @@ function emitCodexAppServerEvent(params, event) {
 		embeddedAgentLog.debug("codex app-server agent event handler threw", { error });
 	}
 }
+function toTranscriptToolResult(response) {
+	const sanitized = sanitizeCodexToolResponse(response);
+	const contentItems = Array.isArray(sanitized.contentItems) ? sanitized.contentItems : [];
+	const result = {
+		...sanitized,
+		content: contentItems.map(toTranscriptToolResultContentItem)
+	};
+	delete result.contentItems;
+	delete result.success;
+	return result;
+}
+function toTranscriptToolResultContentItem(item) {
+	if (!item || typeof item !== "object") return {
+		type: "text",
+		text: ""
+	};
+	const record = item;
+	if (record.type === "inputText") return {
+		type: "text",
+		text: typeof record.text === "string" ? record.text : ""
+	};
+	if (record.type === "inputImage") return typeof record.imageUrl === "string" ? {
+		type: "image",
+		url: record.imageUrl
+	} : {
+		type: "text",
+		text: formatUnsupportedCodexDynamicToolOutput(record.type)
+	};
+	return {
+		type: "text",
+		text: formatUnsupportedCodexDynamicToolOutput(record.type)
+	};
+}
+function formatUnsupportedCodexDynamicToolOutput(type) {
+	const rawType = typeof type === "string" ? type.replace(/\s+/g, " ").trim() : "";
+	return `[Unsupported Codex dynamic tool output: ${rawType ? rawType.slice(0, 80) : "unknown"}${rawType.length > 80 ? "..." : ""}]`;
+}
 function shouldAwaitCodexAgentEndHook(params) {
 	return !params.messageChannel && !params.messageProvider;
 }
@@ -7856,7 +8013,7 @@ async function runCodexAppServerAttempt(params, options = {}) {
 	const attemptClientFactory = options.clientFactory ?? defaultLeasedCodexAppServerClientFactory;
 	const pluginConfig = readCodexPluginConfig(options.pluginConfig);
 	const computerUseConfig = resolveCodexComputerUseConfig({ pluginConfig });
-	const { sessionAgentId } = resolveSessionAgentIds({
+	const { sessionAgentId } = resolveSessionAgentIds$1({
 		sessionKey: params.sessionKey,
 		config: params.config,
 		agentId: params.agentId
@@ -7880,9 +8037,44 @@ async function runCodexAppServerAttempt(params, options = {}) {
 		config: params.config,
 		agentId: sessionAgentId
 	});
-	const configuredAppServer = resolveCodexAppServerRuntimeOptions({
+	const agentDir = params.agentDir ?? resolveAgentDir(params.config ?? {}, sessionAgentId);
+	preDynamicStartupStages.mark("session-agent");
+	const activeContextEngine = isActiveHarnessContextEngine(params.contextEngine) ? params.contextEngine : void 0;
+	const isInactiveThreadBootstrapBinding = (binding) => !activeContextEngine && binding?.contextEngine?.projection?.mode === "thread_bootstrap";
+	let startupBinding = await readCodexAppServerBinding(params.sessionFile);
+	preDynamicStartupStages.mark("read-binding");
+	const startupBindingAuthProfileId = startupBinding?.authProfileId;
+	const initialStartupBindingHadInactiveThreadBootstrap = isInactiveThreadBootstrapBinding(startupBinding);
+	const startupAuthProfileCandidate = params.runtimePlan?.auth.forwardedAuthProfileId ?? params.authProfileId ?? startupBinding?.authProfileId ?? startupBindingAuthProfileId;
+	const startupAuthProfileId = params.authProfileStore ? resolveCodexAppServerAuthProfileId({
+		authProfileId: startupAuthProfileCandidate,
+		store: params.authProfileStore,
+		config: params.config
+	}) : resolveCodexAppServerAuthProfileIdForAgent({
+		authProfileId: startupAuthProfileCandidate,
+		agentDir,
+		config: params.config
+	});
+	let reviewerPolicyContext = resolveCodexModelBackedReviewerPolicyContext({
+		provider: params.provider,
+		model: params.modelId,
+		bindingModelProvider: startupBinding?.modelProvider,
+		bindingModel: startupBinding?.model,
+		nativeAuthProfile: isCodexAppServerNativeAuthProfile({
+			authProfileId: startupAuthProfileId,
+			authProfileStore: params.authProfileStore,
+			agentDir,
+			config: params.config
+		})
+	});
+	preDynamicStartupStages.mark("auth-profile");
+	let configuredAppServer = resolveCodexAppServerRuntimeOptions({
 		pluginConfig,
 		execPolicy,
+		modelProvider: reviewerPolicyContext.modelProvider,
+		model: reviewerPolicyContext.model,
+		config: params.config,
+		agentDir,
 		openClawSandboxActive: sandbox?.enabled === true
 	});
 	const effectiveWorkspace = sandbox?.enabled ? sandbox.workspaceAccess === "rw" ? resolvedWorkspace : sandbox.workspaceDir : resolvedWorkspace;
@@ -7891,7 +8083,7 @@ async function runCodexAppServerAttempt(params, options = {}) {
 	const effectiveCwd = sandbox?.enabled ? effectiveWorkspace : requestedCwd ?? effectiveWorkspace;
 	await ensureCodexWorkspaceDirOnce(effectiveWorkspace);
 	preDynamicStartupStages.mark("effective-workspace");
-	const appServer = resolveCodexAppServerForOpenClawToolPolicy({
+	let policyAppServer = resolveCodexAppServerForOpenClawToolPolicy({
 		appServer: configuredAppServer,
 		pluginConfig,
 		env: process.env,
@@ -7899,6 +8091,14 @@ async function runCodexAppServerAttempt(params, options = {}) {
 		execPolicy,
 		canUseUntrustedApprovalPolicy: configuredAppServer.start.transport !== "stdio" || isCodexAppServerApprovalPolicyAllowedByRequirements("untrusted")
 	});
+	let appServer = resolveCodexAppServerForModelProvider({
+		appServer: policyAppServer,
+		provider: reviewerPolicyContext.modelProvider,
+		model: reviewerPolicyContext.model,
+		config: params.config,
+		env: process.env,
+		agentDir
+	});
 	if (configuredAppServer.approvalPolicy === "never" && appServer.approvalPolicy === "untrusted") embeddedAgentLog.info("codex app-server approval policy promoted for OpenClaw tool policy", {
 		from: "never",
 		to: "untrusted",
@@ -7907,7 +8107,7 @@ async function runCodexAppServerAttempt(params, options = {}) {
 	});
 	preDynamicStartupStages.mark("app-server-policy");
 	let pluginAppServer = appServer;
-	const nativeHookRelayEvents = resolveCodexNativeHookRelayEvents({
+	let nativeHookRelayEvents = resolveCodexNativeHookRelayEvents({
 		configuredEvents: options.nativeHookRelay?.events,
 		appServer
 	});
@@ -7918,14 +8118,6 @@ async function runCodexAppServerAttempt(params, options = {}) {
 	};
 	if (params.abortSignal?.aborted) abortFromUpstream();
 	else params.abortSignal?.addEventListener("abort", abortFromUpstream, { once: true });
-	const agentDir = params.agentDir ?? resolveAgentDir$1(params.config ?? {}, sessionAgentId);
-	preDynamicStartupStages.mark("session-agent");
-	const activeContextEngine = isActiveHarnessContextEngine(params.contextEngine) ? params.contextEngine : void 0;
-	const isInactiveThreadBootstrapBinding = (binding) => !activeContextEngine && binding?.contextEngine?.projection?.mode === "thread_bootstrap";
-	let startupBinding = await readCodexAppServerBinding(params.sessionFile);
-	preDynamicStartupStages.mark("read-binding");
-	const startupBindingAuthProfileId = startupBinding?.authProfileId;
-	const initialStartupBindingHadInactiveThreadBootstrap = isInactiveThreadBootstrapBinding(startupBinding);
 	startupBinding = await rotateOversizedCodexAppServerStartupBinding({
 		binding: startupBinding,
 		sessionFile: params.sessionFile,
@@ -7936,17 +8128,48 @@ async function runCodexAppServerAttempt(params, options = {}) {
 	});
 	const initialInactiveThreadBootstrapBindingForcedFreshStart = initialStartupBindingHadInactiveThreadBootstrap && !startupBinding?.threadId;
 	preDynamicStartupStages.mark("rotate-binding");
-	const startupAuthProfileCandidate = params.runtimePlan?.auth.forwardedAuthProfileId ?? params.authProfileId ?? startupBinding?.authProfileId ?? startupBindingAuthProfileId;
-	const startupAuthProfileId = params.authProfileStore ? resolveCodexAppServerAuthProfileId({
-		authProfileId: startupAuthProfileCandidate,
-		store: params.authProfileStore,
-		config: params.config
-	}) : resolveCodexAppServerAuthProfileIdForAgent({
-		authProfileId: startupAuthProfileCandidate,
+	reviewerPolicyContext = resolveCodexModelBackedReviewerPolicyContext({
+		provider: params.provider,
+		model: params.modelId,
+		bindingModelProvider: startupBinding?.modelProvider,
+		bindingModel: startupBinding?.model,
+		nativeAuthProfile: isCodexAppServerNativeAuthProfile({
+			authProfileId: startupAuthProfileId,
+			authProfileStore: params.authProfileStore,
+			agentDir,
+			config: params.config
+		})
+	});
+	configuredAppServer = resolveCodexAppServerRuntimeOptions({
+		pluginConfig,
+		execPolicy,
+		modelProvider: reviewerPolicyContext.modelProvider,
+		model: reviewerPolicyContext.model,
+		config: params.config,
 		agentDir,
-		config: params.config
+		openClawSandboxActive: sandbox?.enabled === true
+	});
+	policyAppServer = resolveCodexAppServerForOpenClawToolPolicy({
+		appServer: configuredAppServer,
+		pluginConfig,
+		env: process.env,
+		shouldPromote: beforeToolCallPolicy.hasBeforeToolCallHook || beforeToolCallPolicy.trustedToolPolicies.length > 0,
+		execPolicy,
+		canUseUntrustedApprovalPolicy: configuredAppServer.start.transport !== "stdio" || isCodexAppServerApprovalPolicyAllowedByRequirements("untrusted")
+	});
+	appServer = resolveCodexAppServerForModelProvider({
+		appServer: policyAppServer,
+		provider: reviewerPolicyContext.modelProvider,
+		model: reviewerPolicyContext.model,
+		config: params.config,
+		env: process.env,
+		agentDir
+	});
+	pluginAppServer = appServer;
+	nativeHookRelayEvents = resolveCodexNativeHookRelayEvents({
+		configuredEvents: options.nativeHookRelay?.events,
+		appServer
 	});
-	preDynamicStartupStages.mark("auth-profile");
 	const runtimeParams = {
 		...params,
 		sessionKey: contextSessionKey,
@@ -8709,6 +8932,32 @@ async function runCodexAppServerAttempt(params, options = {}) {
 			}
 		}
 	};
+	let activeNativeTurnCompletionWaiter;
+	const waitForActiveNativeTurnCompletion = async (turnIds) => {
+		const turnIdSet = turnIds?.length ? new Set(turnIds) : void 0;
+		const matchesCompletion = (notification) => isCodexThreadTurnCompletedNotification(notification, thread.threadId, turnIdSet);
+		if (pendingNotifications.some((notification) => matchesCompletion(notification))) return true;
+		return await new Promise((resolve) => {
+			let settled = false;
+			const timeoutRef = {};
+			const finish = (completedNativeTurn) => {
+				if (settled) return;
+				settled = true;
+				if (timeoutRef.current) clearTimeout(timeoutRef.current);
+				runAbortController.signal.removeEventListener("abort", abortListener);
+				if (activeNativeTurnCompletionWaiter?.resolve === finishComplete) activeNativeTurnCompletionWaiter = void 0;
+				resolve(completedNativeTurn);
+			};
+			const finishComplete = () => finish(true);
+			const abortListener = () => finish(false);
+			timeoutRef.current = setTimeout(() => finish(false), Math.min(appServer.requestTimeoutMs, CODEX_APP_SERVER_ACTIVE_NATIVE_TURN_WAIT_TIMEOUT_MS));
+			activeNativeTurnCompletionWaiter = {
+				matches: matchesCompletion,
+				resolve: finishComplete
+			};
+			runAbortController.signal.addEventListener("abort", abortListener, { once: true });
+		});
+	};
 	const enqueueNotification = (notification) => {
 		const projector = projectorRef.current;
 		const turnId = turnIdRef.current;
@@ -8720,6 +8969,9 @@ async function runCodexAppServerAttempt(params, options = {}) {
 		embeddedAgentLog.trace("codex app-server raw notification received", correlation);
 		if (notification.method === "turn/completed" && correlation.matchesActiveTurn === false) if (correlation.matchesActiveThread) embeddedAgentLog.warn("codex app-server turn/completed did not match active turn", correlation);
 		else embeddedAgentLog.debug("codex app-server turn/completed ignored for other subscribed thread", correlation);
+		if (notification.method === "turn/completed" && correlation.matchesActiveThread) {
+			if (activeNativeTurnCompletionWaiter?.matches(notification)) activeNativeTurnCompletionWaiter.resolve();
+		}
 		if (isCodexNotificationOutsideActiveRun(correlation)) return Promise.resolve();
 		if (!projector || !turnId) {
 			userInputBridge?.handleNotification(notification);
@@ -8804,6 +9056,9 @@ async function runCodexAppServerAttempt(params, options = {}) {
 						threadId: thread.threadId,
 						turnId,
 						nativeHookRelay,
+						execPolicy,
+						execReviewerAgentId: sessionAgentId,
+						internalExecAutoReview: appServer.approvalsReviewer === "user",
 						autoApprove: shouldAutoApproveCodexAppServerApprovals(appServer),
 						signal: runAbortController.signal
 					});
@@ -8914,7 +9169,7 @@ async function runCodexAppServerAttempt(params, options = {}) {
 							toolCallId: call.callId,
 							...toolMeta ? { meta: toolMeta } : {},
 							isError: !protocolResponse.success,
-							result: sanitizeCodexToolResponse(progressResponse)
+							result: toTranscriptToolResult(progressResponse)
 						}
 					});
 				}
@@ -9028,6 +9283,8 @@ async function runCodexAppServerAttempt(params, options = {}) {
 			promptText: codexTurnPromptText,
 			sandboxPolicy: codexSandboxPolicy,
 			environmentSelection: codexEnvironmentSelection,
+			model: thread.model,
+			modelProvider: thread.modelProvider,
 			turnScopedDeveloperInstructions: workspaceBootstrapContext.turnScopedDeveloperInstructions,
 			skillsCollaborationInstructions,
 			memoryCollaborationInstructions: workspaceBootstrapContext.memoryCollaborationInstructions,
@@ -9041,6 +9298,25 @@ async function runCodexAppServerAttempt(params, options = {}) {
 		throwIfTurnStartAcceptedAfterAbort();
 		return startedTurn;
 	};
+	const activeNativeTurnIds = thread.lifecycle.action === "resumed" ? thread.lifecycle.activeTurnIds ?? [] : [];
+	if (activeNativeTurnIds.length > 0) {
+		embeddedAgentLog.info("codex app-server resumed thread has active native turn; waiting before turn/start", {
+			threadId: thread.threadId,
+			activeTurnIds: activeNativeTurnIds
+		});
+		emitCodexAppServerEvent(params, {
+			stream: "codex_app_server.lifecycle",
+			data: {
+				phase: "turn_start_waiting_for_native_turn",
+				threadId: thread.threadId,
+				activeTurnIds: activeNativeTurnIds
+			}
+		});
+		if (!await waitForActiveNativeTurnCompletion(activeNativeTurnIds) && !runAbortController.signal.aborted) embeddedAgentLog.warn("codex app-server active native turn did not complete before turn/start wait timed out", {
+			threadId: thread.threadId,
+			activeTurnIds: activeNativeTurnIds
+		});
+	}
 	try {
 		codexModelCallDiagnostics.emitStarted();
 		runAgentHarnessLlmInputHook({
@@ -9058,7 +9334,24 @@ async function runCodexAppServerAttempt(params, options = {}) {
 		turn = await startCodexTurn();
 	} catch (error) {
 		let turnStartError = error;
-		if (shouldUseFreshCodexThreadAfterContextEngineOverflow({
+		if (isCodexActiveCompactTurnError(turnStartError)) {
+			embeddedAgentLog.info("codex app-server turn/start blocked by active compact turn; waiting to retry", { threadId: thread.threadId });
+			if (await waitForActiveNativeTurnCompletion() && !runAbortController.signal.aborted) {
+				emitCodexAppServerEvent(params, {
+					stream: "codex_app_server.lifecycle",
+					data: {
+						phase: "turn_start_retry_after_compact",
+						threadId: thread.threadId
+					}
+				});
+				try {
+					turn = await startCodexTurn();
+				} catch (retryError) {
+					turnStartError = retryError;
+				}
+			}
+		}
+		if (turn === void 0 && shouldUseFreshCodexThreadAfterContextEngineOverflow({
 			error: turnStartError,
 			contextEngineActive: Boolean(activeContextEngine),
 			thread
@@ -9598,6 +9891,19 @@ function isCodexContextWindowError(error) {
 	const message = formatErrorMessage(error);
 	return /ran out of room in the model'?s context window/iu.test(message) || /context window/iu.test(message) || /context length/iu.test(message) || /maximum context/iu.test(message) || /too many tokens/iu.test(message);
 }
+function isCodexActiveCompactTurnError(error) {
+	if (!(error instanceof CodexAppServerRpcError)) return false;
+	const data = isJsonObject(error.data) ? error.data : void 0;
+	const codexErrorInfo = isJsonObject(data?.codexErrorInfo) ? data.codexErrorInfo : void 0;
+	return (isJsonObject(codexErrorInfo?.activeTurnNotSteerable) ? codexErrorInfo.activeTurnNotSteerable : void 0)?.turnKind === "compact";
+}
+function isCodexThreadTurnCompletedNotification(notification, threadId, turnIds) {
+	if (notification.method !== "turn/completed") return false;
+	const correlation = describeCodexNotificationCorrelation(notification, { threadId });
+	if (!correlation.matchesActiveThread) return false;
+	const turnId = correlation.turnId ?? correlation.nestedTurnId;
+	return !turnIds || turnId !== void 0 && turnIds.has(turnId);
+}
 function joinPresentSections(...sections) {
 	return sections.filter((section) => Boolean(section?.trim())).join("\n\n");
 }
@@ -9648,6 +9954,9 @@ function handleApprovalRequest(params) {
 		threadId: params.threadId,
 		turnId: params.turnId,
 		nativeHookRelay: params.nativeHookRelay,
+		execPolicy: params.execPolicy,
+		execReviewerAgentId: params.execReviewerAgentId,
+		internalExecAutoReview: params.internalExecAutoReview,
 		autoApprove: params.autoApprove,
 		signal: params.signal
 	});