@openclaw/codex 2026.6.5 → 2026.6.6-beta.1

package/dist/{session-binding-BgTv_YGm.js → session-binding-ElbcSq2o.js}

@@ -1,28 +1,67 @@
 import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
-import { s as normalizeCodexServiceTier } from "./config-BT6SLiE6.js";
+import { l as normalizeCodexServiceTier } from "./config-DJXpBkGf.js";
+import { ensureAuthProfileStore, resolveDefaultAgentDir, resolveProviderIdForAuth } from "openclaw/plugin-sdk/agent-runtime";
 import { embeddedAgentLog } from "openclaw/plugin-sdk/agent-harness-runtime";
 import fs from "node:fs/promises";
-import { ensureAuthProfileStore, resolveDefaultAgentDir, resolveProviderIdForAuth } from "openclaw/plugin-sdk/agent-runtime";
+import { AsyncLocalStorage } from "node:async_hooks";
+import { withFileLock } from "openclaw/plugin-sdk/file-lock";
 //#region extensions/codex/src/app-server/session-binding.ts
 /**
 * Persists and normalizes the Codex app-server thread binding associated with
 * an OpenClaw session file.
 */
 var session_binding_exports = /* @__PURE__ */ __exportAll({
+	CODEX_APP_SERVER_BINDING_GUARDED_REQUEST_TIMEOUT_MS: () => CODEX_APP_SERVER_BINDING_GUARDED_REQUEST_TIMEOUT_MS,
 	clearCodexAppServerBinding: () => clearCodexAppServerBinding,
 	clearCodexAppServerBindingForThread: () => clearCodexAppServerBindingForThread,
 	isCodexAppServerNativeAuthProfile: () => isCodexAppServerNativeAuthProfile,
 	normalizeCodexAppServerBindingModelProvider: () => normalizeCodexAppServerBindingModelProvider,
 	readCodexAppServerBinding: () => readCodexAppServerBinding,
 	resolveCodexAppServerBindingPath: () => resolveCodexAppServerBindingPath,
+	withCodexAppServerBindingLock: () => withCodexAppServerBindingLock,
 	writeCodexAppServerBinding: () => writeCodexAppServerBinding
 });
 const CODEX_APP_SERVER_NATIVE_AUTH_PROVIDER = "openai";
 const PUBLIC_OPENAI_MODEL_PROVIDER = "openai";
+const CODEX_APP_SERVER_BINDING_GUARDED_REQUEST_TIMEOUT_MS = 6e4;
+const CODEX_APP_SERVER_BINDING_LOCK_RETRY_INTERVAL_MS = 1e3;
+const CODEX_APP_SERVER_BINDING_LOCK_OPTIONS = {
+	retries: {
+		retries: Math.ceil(75e3 / CODEX_APP_SERVER_BINDING_LOCK_RETRY_INTERVAL_MS),
+		factor: 1,
+		minTimeout: CODEX_APP_SERVER_BINDING_LOCK_RETRY_INTERVAL_MS,
+		maxTimeout: CODEX_APP_SERVER_BINDING_LOCK_RETRY_INTERVAL_MS
+	},
+	stale: CODEX_APP_SERVER_BINDING_GUARDED_REQUEST_TIMEOUT_MS * 2
+};
+const bindingMutationQueues = /* @__PURE__ */ new Map();
+const bindingMutationContext = new AsyncLocalStorage();
 /** Returns the JSON sidecar path for the Codex app-server binding beside a session file. */
 function resolveCodexAppServerBindingPath(sessionFile) {
 	return `${sessionFile}.codex-app-server.json`;
 }
+/** Serializes mutation of the Codex app-server binding sidecar for a session file. */
+async function withCodexAppServerBindingLock(sessionFile, run) {
+	const bindingPath = resolveCodexAppServerBindingPath(sessionFile);
+	const ownedBindings = bindingMutationContext.getStore();
+	if (ownedBindings?.has(bindingPath)) return await withFileLock(bindingPath, CODEX_APP_SERVER_BINDING_LOCK_OPTIONS, run);
+	const previous = bindingMutationQueues.get(bindingPath) ?? Promise.resolve();
+	let releaseCurrent;
+	const current = new Promise((resolve) => {
+		releaseCurrent = resolve;
+	});
+	const queued = previous.then(() => current, () => current);
+	bindingMutationQueues.set(bindingPath, queued);
+	await previous.catch(() => void 0);
+	const nestedOwnedBindings = new Set(ownedBindings);
+	nestedOwnedBindings.add(bindingPath);
+	try {
+		return await bindingMutationContext.run(nestedOwnedBindings, () => withFileLock(bindingPath, CODEX_APP_SERVER_BINDING_LOCK_OPTIONS, run));
+	} finally {
+		releaseCurrent();
+		if (bindingMutationQueues.get(bindingPath) === queued) bindingMutationQueues.delete(bindingPath);
+	}
+}
 /** Reads and normalizes a Codex app-server binding sidecar, returning undefined on stale data. */
 async function readCodexAppServerBinding(sessionFile, lookup = {}) {
 	const path = resolveCodexAppServerBindingPath(sessionFile);
@@ -79,36 +118,38 @@ async function readCodexAppServerBinding(sessionFile, lookup = {}) {
 }
 /** Writes the Codex app-server binding sidecar with normalized provider/auth metadata. */
 async function writeCodexAppServerBinding(sessionFile, binding, lookup = {}) {
-	const now = (/* @__PURE__ */ new Date()).toISOString();
-	const payload = {
-		schemaVersion: 1,
-		sessionFile,
-		threadId: binding.threadId,
-		cwd: binding.cwd,
-		authProfileId: binding.authProfileId,
-		model: binding.model,
-		modelProvider: normalizeCodexAppServerBindingModelProvider({
-			...lookup,
+	await withCodexAppServerBindingLock(sessionFile, async () => {
+		const now = (/* @__PURE__ */ new Date()).toISOString();
+		const payload = {
+			schemaVersion: 1,
+			sessionFile,
+			threadId: binding.threadId,
+			cwd: binding.cwd,
 			authProfileId: binding.authProfileId,
-			modelProvider: binding.modelProvider
-		}),
-		approvalPolicy: binding.approvalPolicy,
-		sandbox: binding.sandbox,
-		serviceTier: binding.serviceTier,
-		dynamicToolsFingerprint: binding.dynamicToolsFingerprint,
-		dynamicToolsContainDeferred: binding.dynamicToolsContainDeferred,
-		userMcpServersFingerprint: binding.userMcpServersFingerprint,
-		mcpServersFingerprint: binding.mcpServersFingerprint,
-		nativeHookRelayGeneration: binding.nativeHookRelayGeneration,
-		pluginAppsFingerprint: binding.pluginAppsFingerprint,
-		pluginAppsInputFingerprint: binding.pluginAppsInputFingerprint,
-		pluginAppPolicyContext: binding.pluginAppPolicyContext,
-		contextEngine: binding.contextEngine,
-		environmentSelectionFingerprint: binding.environmentSelectionFingerprint,
-		createdAt: binding.createdAt ?? now,
-		updatedAt: now
-	};
-	await fs.writeFile(resolveCodexAppServerBindingPath(sessionFile), `${JSON.stringify(payload, null, 2)}\n`);
+			model: binding.model,
+			modelProvider: normalizeCodexAppServerBindingModelProvider({
+				...lookup,
+				authProfileId: binding.authProfileId,
+				modelProvider: binding.modelProvider
+			}),
+			approvalPolicy: binding.approvalPolicy,
+			sandbox: binding.sandbox,
+			serviceTier: binding.serviceTier,
+			dynamicToolsFingerprint: binding.dynamicToolsFingerprint,
+			dynamicToolsContainDeferred: binding.dynamicToolsContainDeferred,
+			userMcpServersFingerprint: binding.userMcpServersFingerprint,
+			mcpServersFingerprint: binding.mcpServersFingerprint,
+			nativeHookRelayGeneration: binding.nativeHookRelayGeneration,
+			pluginAppsFingerprint: binding.pluginAppsFingerprint,
+			pluginAppsInputFingerprint: binding.pluginAppsInputFingerprint,
+			pluginAppPolicyContext: binding.pluginAppPolicyContext,
+			contextEngine: binding.contextEngine,
+			environmentSelectionFingerprint: binding.environmentSelectionFingerprint,
+			createdAt: binding.createdAt ?? now,
+			updatedAt: now
+		};
+		await fs.writeFile(resolveCodexAppServerBindingPath(sessionFile), `${JSON.stringify(payload, null, 2)}\n`);
+	});
 }
 function readContextEngineBinding(value) {
 	if (!value || typeof value !== "object" || Array.isArray(value)) return;
@@ -166,29 +207,51 @@ function readPluginAppPolicyContext(value) {
 }
 /** Removes the Codex app-server binding sidecar if present. */
 async function clearCodexAppServerBinding(sessionFile, _lookup = {}) {
+	if (!await codexAppServerBindingSidecarExists(sessionFile)) return;
+	await withCodexAppServerBindingLock(sessionFile, async () => {
+		await unlinkCodexAppServerBinding(sessionFile);
+	});
+}
+async function codexAppServerBindingSidecarExists(sessionFile) {
 	try {
-		await fs.unlink(resolveCodexAppServerBindingPath(sessionFile));
+		await fs.access(resolveCodexAppServerBindingPath(sessionFile));
+		return true;
 	} catch (error) {
-		if (!isNotFound(error)) embeddedAgentLog.warn("failed to clear codex app-server binding", {
+		if (!isNotFound(error)) embeddedAgentLog.warn("failed to inspect codex app-server binding", {
 			sessionFile,
 			error
 		});
+		return false;
 	}
 }
-/** Clears a binding only when it still points at the expected Codex thread id. */
-async function clearCodexAppServerBindingForThread(sessionFile, threadId, lookup = {}) {
-	const binding = await readCodexAppServerBinding(sessionFile, lookup);
-	if (!binding) return false;
-	if (binding.threadId !== threadId) {
-		embeddedAgentLog.debug("codex app-server binding points at a different thread; preserving", {
+async function unlinkCodexAppServerBinding(sessionFile) {
+	try {
+		await fs.unlink(resolveCodexAppServerBindingPath(sessionFile));
+		return true;
+	} catch (error) {
+		if (!isNotFound(error)) embeddedAgentLog.warn("failed to clear codex app-server binding", {
 			sessionFile,
-			threadId,
-			boundThreadId: binding.threadId
+			error
 		});
 		return false;
 	}
-	await clearCodexAppServerBinding(sessionFile);
-	return true;
+}
+/** Clears a binding only when it still points at the expected Codex thread id. */
+async function clearCodexAppServerBindingForThread(sessionFile, threadId, lookup = {}) {
+	if (!await readCodexAppServerBinding(sessionFile, lookup)) return false;
+	return await withCodexAppServerBindingLock(sessionFile, async () => {
+		const binding = await readCodexAppServerBinding(sessionFile, lookup);
+		if (!binding) return false;
+		if (binding.threadId !== threadId) {
+			embeddedAgentLog.debug("codex app-server binding points at a different thread; preserving", {
+				sessionFile,
+				threadId,
+				boundThreadId: binding.threadId
+			});
+			return false;
+		}
+		return await unlinkCodexAppServerBinding(sessionFile);
+	});
 }
 function isNotFound(error) {
 	return Boolean(error && typeof error === "object" && "code" in error && error.code === "ENOENT");
@@ -253,4 +316,4 @@ function readServiceTier(value) {
 	return normalizeCodexServiceTier(value);
 }
 //#endregion
-export { readCodexAppServerBinding as a, normalizeCodexAppServerBindingModelProvider as i, clearCodexAppServerBindingForThread as n, session_binding_exports as o, isCodexAppServerNativeAuthProfile as r, writeCodexAppServerBinding as s, clearCodexAppServerBinding as t };
+export { normalizeCodexAppServerBindingModelProvider as a, withCodexAppServerBindingLock as c, isCodexAppServerNativeAuthProfile as i, writeCodexAppServerBinding as l, clearCodexAppServerBinding as n, readCodexAppServerBinding as o, clearCodexAppServerBindingForThread as r, session_binding_exports as s, CODEX_APP_SERVER_BINDING_GUARDED_REQUEST_TIMEOUT_MS as t };

package/dist/{shared-client-xytpSKD0.js → shared-client-CflavQ_i.js}

@@ -1,13 +1,13 @@
 import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
-import { l as resolveCodexAppServerRuntimeOptions, n as codexAppServerStartOptionsKey } from "./config-BT6SLiE6.js";
-import { c as resolveCodexAppServerSpawnEnv, o as MANAGED_CODEX_APP_SERVER_PACKAGE, t as CodexAppServerClient } from "./client-kMCtlApt.js";
+import { d as resolveCodexAppServerRuntimeOptions, r as codexAppServerStartOptionsKey } from "./config-DJXpBkGf.js";
+import { c as resolveCodexAppServerSpawnEnv, o as MANAGED_CODEX_APP_SERVER_PACKAGE, t as CodexAppServerClient } from "./client-DovmVtbr.js";
 import { createRequire } from "node:module";
 import { createHash } from "node:crypto";
 import fsSync, { constants, readFileSync } from "node:fs";
 import os from "node:os";
-import fs, { access } from "node:fs/promises";
 import path from "node:path";
 import { ensureAuthProfileStore, ensureAuthProfileStoreWithoutExternalProfiles, loadAuthProfileStoreForSecretsRuntime, refreshOAuthCredentialForRuntime, resolveApiKeyForProfile, resolveAuthProfileOrder, resolveDefaultAgentDir, resolvePersistedAuthProfileOwnerAgentDir, resolveProviderIdForAuth } from "openclaw/plugin-sdk/agent-runtime";
+import fs, { access } from "node:fs/promises";
 import { fileURLToPath } from "node:url";
 import { withTimeout } from "openclaw/plugin-sdk/security-runtime";
 //#region extensions/codex/src/app-server/auth-bridge.ts

package/dist/{side-question-BnvBQPqW.js → side-question-Ctu2VXAG.js}

@@ -1,13 +1,16 @@
-import { c as readCodexPluginConfig, l as resolveCodexAppServerRuntimeOptions, p as shouldAutoApproveCodexAppServerApprovals } from "./config-BT6SLiE6.js";
-import { a as readCodexDynamicToolCallParams, c as readCodexTurn, i as assertCodexTurnStartResponse, t as assertCodexThreadForkResponse } from "./protocol-validators-CIpP8IJ2.js";
-import { i as isCodexAppServerApprovalRequest, l as isJsonObject } from "./client-kMCtlApt.js";
-import { O as resolveCodexDynamicToolsLoading, T as filterCodexDynamicTools, d as resolveReasoningEffort, g as mergeCodexThreadConfigs, r as buildCodexRuntimeThreadConfig, t as CODEX_NATIVE_PERSONALITY_NONE, u as resolveCodexAppServerModelProvider } from "./thread-lifecycle-BJsazZ8j.js";
-import { a as readCodexAppServerBinding } from "./session-binding-BgTv_YGm.js";
-import { h as formatCodexUsageLimitErrorMessage, i as readCodexNotificationTurnId, r as readCodexNotificationThreadId } from "./notification-correlation-o8quHmTK.js";
-import { a as getLeasedSharedCodexAppServerClient, o as releaseLeasedSharedCodexAppServerClient, u as refreshCodexAppServerAuthTokens } from "./shared-client-xytpSKD0.js";
+import { d as resolveCodexAppServerRuntimeOptions, g as shouldAutoApproveCodexAppServerApprovals, h as resolveOpenClawExecPolicyForCodexAppServer, n as canUseCodexModelBackedApprovalsReviewerForModel, p as resolveCodexModelBackedReviewerPolicyContext, u as readCodexPluginConfig } from "./config-DJXpBkGf.js";
+import { a as readCodexDynamicToolCallParams, c as readCodexTurn, i as assertCodexTurnStartResponse, t as assertCodexThreadForkResponse } from "./protocol-validators-B48C6S9O.js";
+import { t as isJsonObject } from "./protocol-oeJQu4rs.js";
+import { i as formatCodexUsageLimitErrorMessage } from "./provider-Cs6kWhDQ.js";
+import { i as isCodexAppServerApprovalRequest } from "./client-DovmVtbr.js";
+import { A as resolveCodexDynamicToolsLoading, D as filterCodexDynamicTools, d as resolveCodexAppServerRequestModelSelection, f as resolveCodexBindingModelProviderFallback, p as resolveReasoningEffort, r as buildCodexRuntimeThreadConfig, t as CODEX_NATIVE_PERSONALITY_NONE, u as resolveCodexAppServerModelProvider, v as mergeCodexThreadConfigs } from "./thread-lifecycle-Cq1-IfZB.js";
+import { i as isCodexAppServerNativeAuthProfile, o as readCodexAppServerBinding } from "./session-binding-ElbcSq2o.js";
+import { a as resolveCodexAppServerForModelProvider, i as readCodexNotificationTurnId, r as readCodexNotificationThreadId } from "./notification-correlation-D-MYfJwV.js";
+import { a as getLeasedSharedCodexAppServerClient, o as releaseLeasedSharedCodexAppServerClient, u as refreshCodexAppServerAuthTokens } from "./shared-client-CflavQ_i.js";
 import { n as resolveCodexNativeExecutionBlock } from "./sandbox-guard-C-Yv9uwY.js";
-import { d as emitDynamicToolErrorDiagnostic, f as emitDynamicToolStartedDiagnostic, h as handleCodexAppServerApprovalRequest, i as buildCodexNativeHookRelayDisabledConfig, l as handleCodexAppServerElicitationRequest, m as filterToolsForVisionInputs, p as emitDynamicToolTerminalDiagnostic, r as buildCodexNativeHookRelayConfig, t as CODEX_NATIVE_HOOK_RELAY_EVENTS, u as createCodexDynamicToolBridge } from "./native-hook-relay-DHwz_ICg.js";
+import { d as emitDynamicToolErrorDiagnostic, f as emitDynamicToolStartedDiagnostic, h as handleCodexAppServerApprovalRequest, i as buildCodexNativeHookRelayDisabledConfig, l as handleCodexAppServerElicitationRequest, m as filterToolsForVisionInputs, p as emitDynamicToolTerminalDiagnostic, r as buildCodexNativeHookRelayConfig, t as CODEX_NATIVE_HOOK_RELAY_EVENTS, u as createCodexDynamicToolBridge } from "./native-hook-relay-CmUUO3Eu.js";
 import { n as rememberCodexRateLimits, t as readRecentCodexRateLimits } from "./rate-limit-cache-C7qmZ0Jh.js";
+import { loadExecApprovals } from "openclaw/plugin-sdk/exec-approvals-runtime";
 import { buildAgentHookContextChannelFields, embeddedAgentLog, formatErrorMessage, registerNativeHookRelay, resolveAgentDir, resolveAttemptSpawnWorkspaceDir, resolveModelAuthMode, resolveSandboxContext, resolveSessionAgentIds, supportsModelTools } from "openclaw/plugin-sdk/agent-harness-runtime";
 //#region extensions/codex/src/app-server/side-question.ts
 const CODEX_SIDE_DYNAMIC_TOOL_TIMEOUT_MS = 9e4;
@@ -57,8 +60,54 @@ async function runCodexAppServerSideQuestion(params, options = {}) {
 	});
 	if (nativeExecutionBlock) throw new Error(nativeExecutionBlock);
 	const pluginConfig = readCodexPluginConfig(options.pluginConfig);
-	const appServer = resolveCodexAppServerRuntimeOptions({ pluginConfig });
+	const { sessionAgentId } = resolveSessionAgentIds({
+		sessionKey: params.sessionKey,
+		config: params.cfg,
+		agentId: params.agentId
+	});
+	const execPolicy = resolveOpenClawExecPolicyForCodexAppServer({
+		approvals: loadExecApprovals(),
+		config: params.cfg,
+		agentId: sessionAgentId
+	});
 	const authProfileId = params.authProfileId ?? binding.authProfileId;
+	const modelProvider = resolveCodexAppServerModelProvider({
+		provider: params.provider,
+		authProfileId,
+		agentDir: params.agentDir,
+		config: params.cfg
+	}) ?? resolveCodexBindingModelProviderFallback({
+		provider: params.provider,
+		currentModel: params.model,
+		bindingModel: binding.model,
+		bindingModelProvider: binding.modelProvider
+	});
+	const modelSelection = resolveCodexAppServerRequestModelSelection({
+		model: params.model,
+		modelProvider,
+		authProfileId,
+		agentDir: params.agentDir,
+		config: params.cfg
+	});
+	const reviewerPolicyContext = resolveCodexModelBackedReviewerPolicyContext({
+		provider: params.provider,
+		model: params.model,
+		bindingModelProvider: binding.modelProvider,
+		bindingModel: binding.model,
+		nativeAuthProfile: isCodexAppServerNativeAuthProfile({
+			authProfileId,
+			agentDir: params.agentDir,
+			config: params.cfg
+		})
+	});
+	const appServer = resolveCodexAppServerRuntimeOptions({
+		pluginConfig,
+		execPolicy,
+		modelProvider: reviewerPolicyContext.modelProvider,
+		model: reviewerPolicyContext.model,
+		config: params.cfg,
+		agentDir: params.agentDir
+	});
 	const client = await getLeasedSharedCodexAppServerClient({
 		startOptions: appServer.start,
 		timeoutMs: appServer.requestTimeoutMs,
@@ -82,13 +131,23 @@ async function runCodexAppServerSideQuestion(params, options = {}) {
 			cwd,
 			authProfileId
 		});
-		const approvalPolicy = binding.approvalPolicy ?? appServer.approvalPolicy;
-		const sandbox = binding.sandbox ?? appServer.sandbox;
-		const { sessionAgentId } = resolveSessionAgentIds({
-			sessionKey: params.sessionKey,
+		const modelScopedAppServer = resolveCodexAppServerForModelProvider({
+			appServer,
+			provider: reviewerPolicyContext.modelProvider,
+			model: reviewerPolicyContext.model,
+			config: params.cfg,
+			env: process.env,
+			agentDir: params.agentDir
+		});
+		const useModelScopedPolicy = !canUseCodexModelBackedApprovalsReviewerForModel({
+			modelProvider: reviewerPolicyContext.modelProvider,
+			model: reviewerPolicyContext.model,
 			config: params.cfg,
-			agentId: params.agentId
+			env: process.env,
+			agentDir: params.agentDir
 		});
+		const approvalPolicy = useModelScopedPolicy ? modelScopedAppServer.approvalPolicy : binding.approvalPolicy ?? modelScopedAppServer.approvalPolicy;
+		const sandbox = useModelScopedPolicy ? modelScopedAppServer.sandbox : binding.sandbox ?? modelScopedAppServer.sandbox;
 		const toolBridge = await createCodexSideToolBridge({
 			params,
 			cwd,
@@ -119,6 +178,9 @@ async function runCodexAppServerSideQuestion(params, options = {}) {
 				threadId: childThreadId,
 				turnId,
 				nativeHookRelay,
+				execPolicy,
+				execReviewerAgentId: sessionAgentId,
+				internalExecAutoReview: modelScopedAppServer.approvalsReviewer === "user",
 				autoApprove: shouldAutoApproveCodexAppServerApprovals({
 					approvalPolicy,
 					sandbox
@@ -195,20 +257,14 @@ async function runCodexAppServerSideQuestion(params, options = {}) {
 		}) : options.nativeHookRelay?.enabled === false ? buildCodexNativeHookRelayDisabledConfig() : void 0;
 		const runtimeThreadConfig = buildCodexRuntimeThreadConfig(void 0, { nativeCodeModeOnlyEnabled: appServer.codeModeOnly });
 		const threadConfig = mergeCodexThreadConfigs(nativeHookRelayConfig, runtimeThreadConfig) ?? runtimeThreadConfig;
-		const modelProvider = resolveCodexAppServerModelProvider({
-			provider: params.provider,
-			authProfileId,
-			agentDir: params.agentDir,
-			config: params.cfg
-		});
 		childThreadId = assertCodexThreadForkResponse(await forkCodexSideThread(client, {
 			threadId: binding.threadId,
-			model: params.model,
-			...modelProvider ? { modelProvider } : {},
+			model: modelSelection.model,
+			...modelSelection.modelProvider ? { modelProvider: modelSelection.modelProvider } : {},
 			personality: CODEX_NATIVE_PERSONALITY_NONE,
 			cwd,
 			approvalPolicy,
-			approvalsReviewer: appServer.approvalsReviewer,
+			approvalsReviewer: modelScopedAppServer.approvalsReviewer,
 			sandbox,
 			...serviceTier ? { serviceTier } : {},
 			config: threadConfig,
@@ -226,7 +282,7 @@ async function runCodexAppServerSideQuestion(params, options = {}) {
 			timeoutMs: appServer.requestTimeoutMs,
 			signal: params.opts?.abortSignal
 		});
-		const effort = resolveReasoningEffort(params.resolvedThinkLevel ?? "off", params.model);
+		const effort = resolveReasoningEffort(params.resolvedThinkLevel ?? "off", modelSelection.model);
 		turnId = assertCodexTurnStartResponse(await client.request("turn/start", {
 			threadId: childThreadId,
 			input: [{
@@ -235,14 +291,14 @@ async function runCodexAppServerSideQuestion(params, options = {}) {
 				text_elements: []
 			}],
 			cwd,
-			model: params.model,
+			model: modelSelection.model,
 			personality: CODEX_NATIVE_PERSONALITY_NONE,
 			...serviceTier ? { serviceTier } : {},
 			effort,
 			collaborationMode: {
 				mode: "default",
 				settings: {
-					model: params.model,
+					model: modelSelection.model,
 					reasoning_effort: effort,
 					developer_instructions: null
 				}