@openclaw/codex 2026.6.8-beta.2 → 2026.6.9-beta.1

package/dist/{native-hook-relay-C3i3FYtc.js → provider-capabilities-BOvTfMhF.js}

@@ -1,13 +1,17 @@
-import { c as isTrustedCodexModelBackedOpenAIProvider } from "./config-DJXpBkGf.js";
-import { t as isJsonObject } from "./protocol-oeJQu4rs.js";
-import { E as sanitizeInlineImageDataUrl, w as invalidInlineImageText } from "./thread-lifecycle-cban34w3.js";
-import { l as formatCodexDisplayText } from "./notification-correlation-BGoG0N90.js";
+import { n as isJsonObject } from "./protocol-dh-ETiNd.js";
+import { C as isForcedPrivateQaCodexRuntime, S as filterCodexDynamicTools, _ as resolveCodexWebSearchPlan, w as normalizeCodexDynamicToolName, x as sanitizeInlineImageDataUrl, y as invalidInlineImageText } from "./thread-lifecycle-CbJqqnEw.js";
+import { c as isTrustedCodexModelBackedOpenAIProvider, u as readCodexPluginConfig } from "./config-BksX0T33.js";
+import { a as formatCodexDisplayText } from "./app-server-policy-KpyUye2D.js";
+import { o as releaseLeasedSharedCodexAppServerClient } from "./shared-client-Bg5d7VV9.js";
+import { i as resolveCodexNativeExecutionPolicy } from "./sandbox-guard-3tnjhjFb.js";
 import { addTimerTimeoutGraceMs, finiteSecondsToTimerSafeMilliseconds, resolveTimerTimeoutMs } from "openclaw/plugin-sdk/number-runtime";
+import { asOptionalRecord, isRecord, normalizeTrimmedStringList } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { createHash } from "node:crypto";
+import { resolveAgentDir } from "openclaw/plugin-sdk/agent-runtime";
 import { normalizeAgentId } from "openclaw/plugin-sdk/routing";
-import { asOptionalRecord, isRecord, normalizeTrimmedStringList } from "openclaw/plugin-sdk/string-coerce-runtime";
-import { HEARTBEAT_RESPONSE_TOOL_NAME, buildAgentHookContextChannelFields, callGatewayTool, createAgentToolResultMiddlewareRunner, createCodexAppServerToolResultExtensionRunner, embeddedAgentLog, extractToolResultMediaArtifact, filterToolResultMediaUrls, formatApprovalDisplayPath, hasNativeHookRelayInvocation, invokeNativeHookRelay, isMessagingTool, isMessagingToolSendAction, isToolResultError, isToolWrappedWithBeforeToolCallHook, normalizeHeartbeatToolResponse, projectRuntimeToolInputSchema, registerNativeHookRelay, resolveNativeHookRelayDeferredToolApproval, runAgentHarnessAfterToolCallHook, runBeforeToolCallHook, sanitizeToolResult, setBeforeToolCallDiagnosticsEnabled, wrapToolWithBeforeToolCallHook } from "openclaw/plugin-sdk/agent-harness-runtime";
+import { HEARTBEAT_RESPONSE_TOOL_NAME, buildAgentHookContextChannelFields, buildEmbeddedAttemptToolRunContext, callGatewayTool, consumeAdjustedParamsForToolCall, consumePreExecutionBlockedToolCall, createAgentToolResultMiddlewareRunner, createCodexAppServerToolResultExtensionRunner, embeddedAgentLog, extractMessagingToolSend, extractMessagingToolSendResult, extractToolResultMediaArtifact, filterProviderNormalizableTools, filterToolResultMediaUrls, finalizeToolTerminalPresentation, formatApprovalDisplayPath, getChannelAgentToolMeta, getPluginToolMeta, hasNativeHookRelayInvocation, invokeNativeHookRelay, isMessagingTool, isMessagingToolSendAction, isReplaySafeToolCall, isSubagentSessionKey, isToolResultError, isToolWrappedWithBeforeToolCallHook, normalizeAgentRuntimeTools, normalizeHeartbeatToolResponse, projectRuntimeToolInputSchema, registerNativeHookRelay, resolveAttemptSpawnWorkspaceDir, resolveModelAuthMode, resolveNativeHookRelayDeferredToolApproval, runAgentHarnessAfterToolCallHook, runBeforeToolCallHook, sanitizeToolResult, setBeforeToolCallDiagnosticsEnabled, supportsModelTools, wrapToolWithBeforeToolCallHook } from "openclaw/plugin-sdk/agent-harness-runtime";
 import { emitTrustedDiagnosticEvent } from "openclaw/plugin-sdk/diagnostic-runtime";
+import { isToolAllowed } from "openclaw/plugin-sdk/sandbox";
 import { buildExecAutoReviewInputForShellCommand, reviewExecRequestWithConfiguredModel } from "openclaw/plugin-sdk/agent-harness-exec-review-runtime";
 /** Default idle timeout while waiting for app-server turn completion. */
 const CODEX_TURN_COMPLETION_IDLE_TIMEOUT_MS = 6e4;
@@ -112,7 +116,8 @@ async function requestPluginApproval(params) {
 		turnSourceAccountId: params.paramsForRun.agentAccountId,
 		turnSourceThreadId: params.paramsForRun.currentThreadTs,
 		timeoutMs,
-		twoPhase: true
+		twoPhase: true,
+		...params.allowedDecisions ? { allowedDecisions: params.allowedDecisions } : {}
 	}, { expectFinal: false });
 }
 /** Detects the gateway's explicit null-decision marker for unavailable approvals. */
@@ -1068,6 +1073,535 @@ function filterToolsForVisionInputs(tools, params) {
 	return tools.filter((tool) => tool.name !== "image");
 }
 //#endregion
+//#region extensions/codex/src/app-server/dynamic-tool-build.ts
+/**
+* Builds the Codex app-server dynamic tool list for one turn, including
+* OpenClaw-owned tools, Codex native-tool fallback rules, sandbox shell shims,
+* and provider allowlist normalization.
+*/
+const CODEX_NATIVE_SANDBOX_TOOL_REQUIREMENTS = [
+	"exec",
+	"process",
+	"read",
+	"write",
+	"edit",
+	"apply_patch"
+];
+const CODEX_MEMORY_FLUSH_DYNAMIC_TOOL_ALLOW = new Set(["read", "write"]);
+const CODEX_NODE_EXEC_DYNAMIC_TOOL_NAME = "node_exec";
+const CODEX_NODE_PROCESS_DYNAMIC_TOOL_NAME = "node_process";
+const CODEX_NODE_EXEC_HIDDEN_PARAMETER_NAMES = new Set([
+	"host",
+	"security",
+	"ask",
+	"node"
+]);
+/** Splits sandbox and run session keys so tool calls can bind to both scopes when needed. */
+function resolveOpenClawCodingToolsSessionKeys(params, sandboxSessionKey) {
+	return {
+		sessionKey: sandboxSessionKey,
+		runSessionKey: params.sessionKey && params.sessionKey !== sandboxSessionKey ? params.sessionKey : void 0
+	};
+}
+/** Returns the canonical channel used for Codex message routing and receipts. */
+function resolveCodexMessageToolProvider(params) {
+	return params.messageChannel ?? params.messageProvider;
+}
+/** Resolves the channel id that hook events should target for this Codex app-server turn. */
+function resolveCodexAppServerHookChannelId(params, sandboxSessionKey) {
+	return buildAgentHookContextChannelFields({
+		sessionKey: sandboxSessionKey,
+		messageChannel: params.messageChannel,
+		messageProvider: params.messageProvider,
+		currentChannelId: params.currentChannelId,
+		messageTo: params.messageTo
+	}).channelId;
+}
+const CODEX_DYNAMIC_TOOL_BUILD_WARN_TOTAL_MS = 1e3;
+const CODEX_DYNAMIC_TOOL_BUILD_WARN_STAGE_MS = 500;
+/** Creates cheap optional timing instrumentation for the dynamic-tool hot path. */
+function createCodexDynamicToolBuildStageTracker(options = {}) {
+	if (!options.enabled) return {
+		mark() {},
+		snapshot() {
+			return {
+				totalMs: 0,
+				stages: []
+			};
+		}
+	};
+	const startedAt = Date.now();
+	let previousAt = startedAt;
+	const stages = [];
+	const toMs = (value) => Math.max(0, Math.round(value));
+	return {
+		mark(name) {
+			const currentAt = Date.now();
+			stages.push({
+				name,
+				durationMs: toMs(currentAt - previousAt),
+				elapsedMs: toMs(currentAt - startedAt)
+			});
+			previousAt = currentAt;
+		},
+		snapshot() {
+			return {
+				totalMs: toMs(Date.now() - startedAt),
+				stages: stages.slice()
+			};
+		}
+	};
+}
+/** Returns true when dynamic-tool construction is slow enough to warrant a warning log. */
+function shouldWarnCodexDynamicToolBuildStageSummary(summary) {
+	return summary.totalMs >= CODEX_DYNAMIC_TOOL_BUILD_WARN_TOTAL_MS || summary.stages.some((stage) => stage.durationMs >= CODEX_DYNAMIC_TOOL_BUILD_WARN_STAGE_MS);
+}
+/** Formats per-stage timings into the compact form used by Codex app-server logs. */
+function formatCodexDynamicToolBuildStageSummary(summary) {
+	return summary.stages.length > 0 ? summary.stages.map((stage) => `${stage.name}:${stage.durationMs}ms@${stage.elapsedMs}ms`).join(",") : "none";
+}
+/** Builds, filters, and normalizes Codex-compatible runtime tools for a single turn. */
+async function buildDynamicTools(input) {
+	const { params } = input;
+	const messagePolicyParams = input.ignoreDisableMessageTool ? {
+		...params,
+		disableMessageTool: false
+	} : params;
+	if (params.disableTools) {
+		input.onWebSearchPolicyResolved?.(false);
+		return [];
+	}
+	if (!supportsModelTools(params.model)) {
+		input.onPersistentWebSearchPolicyResolved?.(false);
+		input.onWebSearchPolicyResolved?.(false);
+		return [];
+	}
+	const toolBuildStages = createCodexDynamicToolBuildStageTracker({ enabled: input.profilerEnabled });
+	const modelHasVision = params.model.input?.includes("image") ?? false;
+	const agentDir = params.agentDir ?? resolveAgentDir(params.config ?? {}, input.sessionAgentId);
+	const agentHarness = await import("openclaw/plugin-sdk/agent-harness");
+	const createOpenClawCodingTools = agentHarness.createOpenClawCodingTools;
+	toolBuildStages.mark("load-agent-harness-tools");
+	const sessionKeys = resolveOpenClawCodingToolsSessionKeys(params, input.sandboxSessionKey);
+	const nativeExecutionPolicy = resolveCodexNativeExecutionPolicyForDynamicTools(input);
+	const allTools = createOpenClawCodingTools({
+		agentId: input.sessionAgentId,
+		...buildEmbeddedAttemptToolRunContext(params),
+		exec: {
+			...params.execOverrides,
+			...resolveNodeExecToolOverrides(nativeExecutionPolicy),
+			config: params.config,
+			elevated: params.bashElevated
+		},
+		sandbox: input.sandbox,
+		messageProvider: resolveCodexMessageToolProvider(params),
+		toolPolicyMessageProvider: params.messageProvider ?? params.messageChannel,
+		agentAccountId: params.agentAccountId,
+		messageTo: params.messageTo,
+		messageThreadId: params.messageThreadId,
+		groupId: params.groupId,
+		groupChannel: params.groupChannel,
+		groupSpace: params.groupSpace,
+		spawnedBy: params.spawnedBy,
+		senderId: params.senderId,
+		senderName: params.senderName,
+		senderUsername: params.senderUsername,
+		senderE164: params.senderE164,
+		allowGatewaySubagentBinding: params.allowGatewaySubagentBinding || isForcedPrivateQaCodexRuntime(),
+		...sessionKeys,
+		sessionId: params.sessionId,
+		runId: params.runId,
+		agentDir,
+		cwd: input.effectiveCwd ?? input.effectiveWorkspace,
+		workspaceDir: input.effectiveWorkspace,
+		spawnWorkspaceDir: input.effectiveCwd && input.effectiveCwd !== input.effectiveWorkspace ? input.resolvedWorkspace : resolveAttemptSpawnWorkspaceDir({
+			sandbox: input.sandbox,
+			resolvedWorkspace: input.resolvedWorkspace
+		}),
+		config: params.config,
+		authProfileStore: params.toolAuthProfileStore ?? params.authProfileStore,
+		abortSignal: input.runAbortController.signal,
+		emitBeforeToolCallDiagnostics: false,
+		modelProvider: params.model.provider,
+		modelId: params.modelId,
+		modelCompat: params.model.compat && typeof params.model.compat === "object" ? params.model.compat : void 0,
+		modelApi: params.model.api,
+		modelContextWindowTokens: params.model.contextWindow,
+		modelAuthMode: resolveModelAuthMode(params.model.provider, params.config, params.toolAuthProfileStore ?? params.authProfileStore, { workspaceDir: input.effectiveWorkspace }),
+		suppressManagedWebSearch: false,
+		currentChannelId: params.currentChannelId,
+		currentMessagingTarget: params.currentMessagingTarget,
+		hookChannelId: resolveCodexAppServerHookChannelId(params, input.sandboxSessionKey),
+		currentThreadTs: params.currentThreadTs,
+		currentMessageId: params.currentMessageId,
+		replyToMode: params.replyToMode,
+		hasRepliedRef: params.hasRepliedRef,
+		modelHasVision,
+		requireExplicitMessageTarget: params.requireExplicitMessageTarget ?? isSubagentSessionKey(params.sessionKey),
+		sourceReplyDeliveryMode: params.sourceReplyDeliveryMode,
+		disableMessageTool: input.ignoreDisableMessageTool ? false : params.disableMessageTool,
+		forceMessageTool: shouldForceMessageTool(messagePolicyParams),
+		enableHeartbeatTool: params.trigger === "heartbeat" || input.forceHeartbeatTool === true,
+		forceHeartbeatTool: params.trigger === "heartbeat" || input.forceHeartbeatTool === true,
+		onYield: (message) => {
+			input.onYieldDetected();
+			input.onCodexAppServerEvent?.({
+				stream: "codex_app_server.tool",
+				data: {
+					name: "sessions_yield",
+					message
+				}
+			});
+		},
+		recordToolPrepStage: (name) => {
+			toolBuildStages.mark(name);
+		},
+		onToolOutcome: params.onToolOutcome,
+		allocateToolOutcomeOrdinal: params.allocateToolOutcomeOrdinal
+	});
+	toolBuildStages.mark("create-openclaw-coding-tools");
+	const preNormalizationDiagnostics = [];
+	const readableAllToolProjection = filterProviderNormalizableTools(allTools);
+	preNormalizationDiagnostics.push(...readableAllToolProjection.diagnostics);
+	const webSearchPlan = resolveCodexWebSearchPlan({
+		config: params.config,
+		disableTools: params.disableTools,
+		nativeToolSurfaceEnabled: input.nativeToolSurfaceEnabled,
+		nativeProviderWebSearchSupport: input.nativeProviderWebSearchSupport
+	});
+	const readableAllTools = [...readableAllToolProjection.tools];
+	const codexFilteredTools = addNodeShellDynamicToolsIfNeeded(addSandboxShellDynamicToolsIfAvailable(isCodexMemoryFlushRun(params) ? filterCodexMemoryFlushDynamicTools(readableAllTools) : filterCodexDynamicTools(readableAllTools, input.pluginConfig), readableAllTools, input), readableAllTools, input, nativeExecutionPolicy);
+	toolBuildStages.mark("codex-filtering");
+	const visionFilteredTools = filterToolsForVisionInputs(codexFilteredTools, {
+		modelHasVision,
+		hasInboundImages: (params.images?.length ?? 0) > 0
+	});
+	toolBuildStages.mark("vision-filtering");
+	const webSearchPresent = visionFilteredTools.some((tool) => tool.name === "web_search");
+	const webSearchPolicy = agentHarness.resolveWebSearchToolPolicy({
+		config: params.config,
+		modelProvider: params.model.provider,
+		modelId: params.modelId,
+		agentId: input.sessionAgentId,
+		sessionKey: input.sandboxSessionKey,
+		sandboxToolPolicy: input.sandbox?.tools,
+		messageProvider: resolveCodexMessageToolProvider(params),
+		agentAccountId: params.agentAccountId,
+		groupId: params.groupId,
+		groupChannel: params.groupChannel,
+		groupSpace: params.groupSpace,
+		spawnedBy: params.spawnedBy,
+		senderId: params.senderId,
+		senderName: params.senderName,
+		senderUsername: params.senderUsername,
+		senderE164: params.senderE164
+	});
+	const transientWebSearchRestriction = !webSearchPolicy.allowed && webSearchPolicy.persistentAllowed || isCodexMemoryFlushRun(params);
+	const persistentCodexWebSearchSurface = params.config?.tools?.web?.search?.enabled !== false && !(input.pluginConfig.codexDynamicToolsExclude ?? []).some((name) => normalizeCodexDynamicToolName(name) === "web_search");
+	input.onPersistentWebSearchPolicyResolved?.(webSearchPresent || persistentCodexWebSearchSurface && transientWebSearchRestriction && webSearchPolicy.persistentAllowed);
+	const filteredTools = filterCodexDynamicToolsForAllowlist(visionFilteredTools, includeForcedCodexDynamicToolAllow(params.toolsAllow, messagePolicyParams));
+	toolBuildStages.mark("allowlist-filter");
+	const normalizedTools = normalizeAgentRuntimeTools({
+		runtimePlan: input.ignoreRuntimePlan ? void 0 : params.runtimePlan,
+		tools: filteredTools,
+		provider: params.provider,
+		config: params.config,
+		workspaceDir: input.effectiveWorkspace,
+		env: process.env,
+		modelId: params.modelId,
+		modelApi: params.model.api,
+		model: params.model,
+		onPreNormalizationSchemaDiagnostics: (diagnostics) => preNormalizationDiagnostics.push(...diagnostics)
+	});
+	toolBuildStages.mark("runtime-normalization");
+	input.onWebSearchPolicyResolved?.(normalizedTools.some((tool) => tool.name === "web_search"));
+	const exposedTools = webSearchPlan.suppressManagedWebSearch ? normalizedTools.filter((tool) => tool.name !== "web_search") : normalizedTools;
+	if (preNormalizationDiagnostics.length > 0) embeddedAgentLog.warn(`codex app-server quarantined ${preNormalizationDiagnostics.length} unsupported runtime tool schema${preNormalizationDiagnostics.length === 1 ? "" : "s"} before dynamic tool registration`, {
+		runId: params.runId,
+		sessionId: params.sessionId,
+		diagnostics: preNormalizationDiagnostics.map((diagnostic) => ({
+			index: diagnostic.toolIndex,
+			tool: diagnostic.toolName,
+			violations: diagnostic.violations.slice(0, 12),
+			violationCount: diagnostic.violations.length
+		}))
+	});
+	const summary = toolBuildStages.snapshot();
+	if (shouldWarnCodexDynamicToolBuildStageSummary(summary)) {
+		const phase = input.forceHeartbeatTool ? "registered-tools" : "runtime-tools";
+		embeddedAgentLog.warn(`codex app-server dynamic tool build timings runId=${params.runId} sessionId=${params.sessionId} phase=${phase} totalMs=${summary.totalMs} stages=${formatCodexDynamicToolBuildStageSummary(summary)}`, {
+			runId: params.runId,
+			sessionId: params.sessionId,
+			phase,
+			totalMs: summary.totalMs,
+			stages: summary.stages,
+			allToolCount: readableAllTools.length,
+			codexFilteredToolCount: codexFilteredTools.length,
+			visionFilteredToolCount: visionFilteredTools.length,
+			filteredToolCount: filteredTools.length,
+			normalizedToolCount: exposedTools.length,
+			forceHeartbeatTool: input.forceHeartbeatTool === true,
+			ignoreRuntimePlan: input.ignoreRuntimePlan === true,
+			nativeToolSurfaceEnabled: input.nativeToolSurfaceEnabled === true
+		});
+	}
+	return exposedTools;
+}
+/** Preserves delivery-critical tools when a narrow allowlist would otherwise hide them. */
+function includeForcedCodexDynamicToolAllow(toolsAllow, params) {
+	if (toolsAllow === void 0 || hasWildcardCodexToolsAllow(toolsAllow)) return toolsAllow;
+	const forcedToolNames = shouldForceMessageTool(params) ? ["message"] : [];
+	if (forcedToolNames.length === 0) return toolsAllow;
+	if (toolsAllow.length === 0) return forcedToolNames;
+	const normalized = new Set(toolsAllow.map((name) => normalizeCodexDynamicToolName(name)));
+	const missingToolNames = forcedToolNames.filter((toolName) => !normalized.has(normalizeCodexDynamicToolName(toolName)));
+	return missingToolNames.length === 0 ? toolsAllow : [...toolsAllow, ...missingToolNames];
+}
+/** Decides whether Codex native code mode can own shell/file tools for this turn. */
+function shouldEnableCodexAppServerNativeToolSurface(params, sandbox, options = {}) {
+	if (isCodexMemoryFlushRun(params)) return false;
+	const toolsAllow = includeForcedCodexDynamicToolAllow(params.toolsAllow, params);
+	if (toolsAllow === void 0) return canCodexAppServerNativeToolSurfaceHonorSandbox(sandbox, options);
+	return hasWildcardCodexToolsAllow(toolsAllow) && canCodexAppServerNativeToolSurfaceHonorSandbox(sandbox, options);
+}
+/** Returns true when OpenClaw policy requires the Node-owned exec/process tools instead. */
+function isCodexNativeExecutionBlockedByNodeExecHost(params, options = {}) {
+	return !resolveCodexNativeExecutionPolicy({
+		config: params.config,
+		sessionKey: resolveCodexRuntimePolicySessionKey(params, options.runtimeSessionKey),
+		sessionId: params.sessionId,
+		agentId: options.agentId,
+		execOverrides: params.execOverrides,
+		sandboxAvailable: options.sandbox?.enabled,
+		readRuntimeSessionEntry: true
+	}).nativeToolSurfaceAllowed;
+}
+function resolveCodexRuntimePolicySessionKey(params, runtimeSessionKey) {
+	return runtimeSessionKey?.trim() || params.sandboxSessionKey?.trim() || params.sessionKey?.trim() || params.sessionId;
+}
+function canCodexAppServerNativeToolSurfaceHonorSandbox(sandbox, options = {}) {
+	if (!sandbox?.enabled) return true;
+	if (options.sandboxExecServerEnabled === true && sandbox.backend && canSandboxToolPolicyExposeCodexNativeToolSurface(sandbox)) return true;
+	return false;
+}
+function canSandboxToolPolicyExposeCodexNativeToolSurface(sandbox) {
+	return CODEX_NATIVE_SANDBOX_TOOL_REQUIREMENTS.every((toolName) => isToolAllowed(sandbox.tools, toolName));
+}
+function isCodexMemoryFlushRun(params) {
+	return params?.trigger === "memory" && Boolean(params.memoryFlushWritePath?.trim());
+}
+function filterCodexMemoryFlushDynamicTools(tools) {
+	return tools.filter((tool) => CODEX_MEMORY_FLUSH_DYNAMIC_TOOL_ALLOW.has(normalizeCodexDynamicToolName(tool.name)));
+}
+/** Requires a Codex sandbox environment only when native tools must run inside OpenClaw sandboxing. */
+function shouldRequireCodexSandboxExecServerEnvironment(params) {
+	return Boolean(params.sandbox?.enabled && params.nativeToolSurfaceEnabled && params.sandboxExecServerEnabled);
+}
+/** Selects the sandbox exec-server environment passed through the Codex app-server protocol. */
+function resolveCodexSandboxEnvironmentSelection(environment, nativeToolSurfaceEnabled) {
+	return environment && nativeToolSurfaceEnabled ? [environment] : void 0;
+}
+/** Chooses the cwd visible to Codex native execution after sandbox exec-server setup. */
+function resolveCodexAppServerExecutionCwd(params) {
+	return mapCodexAppServerRemoteWorkspacePath({
+		value: params.environment && params.nativeToolSurfaceEnabled ? params.environment.cwd : params.effectiveCwd,
+		localWorkspaceRoot: params.localWorkspaceRoot,
+		remoteWorkspaceRoot: params.remoteWorkspaceRoot
+	});
+}
+/** Projects a local OpenClaw workspace cwd into the remote Codex app-server workspace root. */
+function mapCodexAppServerRemoteWorkspacePath(params) {
+	if (!params.remoteWorkspaceRoot) return params.value;
+	const localRoot = normalizeRemoteWorkspaceMatchPath(params.localWorkspaceRoot);
+	const remoteRoot = normalizeRemoteWorkspaceMatchPath(params.remoteWorkspaceRoot);
+	const normalizedValue = normalizeRemoteWorkspaceMatchPath(params.value);
+	if (!localRoot || !remoteRoot) throw new Error("Codex remoteWorkspaceRoot requires non-empty workspace roots.");
+	if (normalizedValue === localRoot) return remoteRoot;
+	const prefix = `${localRoot}/`;
+	if (!normalizedValue.startsWith(prefix)) throw new Error(`Codex remoteWorkspaceRoot is configured but cwd ${params.value} is outside OpenClaw workspace root ${params.localWorkspaceRoot}; refusing to send a gateway-local cwd to the remote Codex app-server.`);
+	return joinRemoteWorkspacePath(remoteRoot, normalizedValue.slice(prefix.length));
+}
+function normalizeRemoteWorkspaceMatchPath(value) {
+	return trimTrailingPathSeparator(value.replace(/\\/gu, "/"));
+}
+function trimTrailingPathSeparator(value) {
+	return value.length > 1 ? value.replace(/[\\/]+$/u, "") : value;
+}
+function joinRemoteWorkspacePath(remoteRoot, suffix) {
+	return remoteRoot === "/" ? `/${suffix}` : `${remoteRoot}/${suffix}`;
+}
+/** Converts OpenClaw sandbox networking into Codex's external-sandbox policy shape. */
+function resolveCodexExternalSandboxPolicyForOpenClawSandbox(sandbox) {
+	return {
+		type: "externalSandbox",
+		networkAccess: codexNetworkAccessForOpenClawSandbox(sandbox) ? "enabled" : "restricted"
+	};
+}
+function codexNetworkAccessForOpenClawSandbox(sandbox) {
+	if (sandbox?.backendId !== "docker") return true;
+	const network = sandbox?.docker?.network?.trim().toLowerCase();
+	return Boolean(network && network !== "none");
+}
+/** Returns a Codex config copy with app-server Codex plugin loading disabled for thread tools. */
+function disableCodexPluginThreadConfig(pluginConfig) {
+	const config = readCodexPluginConfig(pluginConfig);
+	return {
+		...config,
+		codexPlugins: {
+			...config.codexPlugins,
+			enabled: false
+		}
+	};
+}
+/** Adds sandbox_exec/process aliases when native Code Mode cannot directly honor the sandbox. */
+function addSandboxShellDynamicToolsIfAvailable(filteredTools, allTools, input) {
+	if (!shouldExposeSandboxExecDynamicTool(input) || isSandboxShellDynamicToolExcluded(input.pluginConfig)) return filteredTools;
+	const execTool = allTools.find((tool) => normalizeCodexDynamicToolName(tool.name) === "exec");
+	const processTool = allTools.find((tool) => normalizeCodexDynamicToolName(tool.name) === "process");
+	if (!execTool || !processTool) return filteredTools;
+	const sandboxExecTool = {
+		...execTool,
+		name: "sandbox_exec",
+		description: "Run a shell command through OpenClaw's configured sandbox backend for this session. Use when OpenClaw sandboxing is active or when a command must execute in the sandbox backend, such as an SSH-backed sandbox or Docker container-path bind layout. Use Codex's native shell only when no OpenClaw sandbox is active and native Code Mode is available.",
+		execute: async (toolCallId, args, signal, onUpdate) => {
+			const result = await execTool.execute(toolCallId, args, signal, onUpdate);
+			return {
+				...result,
+				content: result.content.map((item) => item.type === "text" ? Object.assign({}, item, { text: item.text.replace("Use process (list/poll/log/write/send-keys/submit/paste/kill/clear/remove) for follow-up.", "Use sandbox_process (list/poll/log/write/send-keys/submit/paste/kill/clear/remove) for follow-up.") }) : item)
+			};
+		}
+	};
+	const sandboxProcessTool = {
+		...processTool,
+		name: "sandbox_process",
+		description: "Manage sandbox_exec sessions that were started through OpenClaw's configured sandbox backend for this session: list, poll, log, write, send-keys, submit, paste, kill, clear, or remove. Use only for sandbox_exec follow-up; use Codex's native shell session handling only when no OpenClaw sandbox is active and native Code Mode is available."
+	};
+	return [
+		...filteredTools,
+		sandboxExecTool,
+		sandboxProcessTool
+	];
+}
+function shouldExposeSandboxExecDynamicTool(input) {
+	if (isCodexMemoryFlushRun(input.params)) return false;
+	if (isCodexNativeExecutionBlockedByNodeExecHost(input.params, {
+		agentId: input.sessionAgentId,
+		runtimeSessionKey: input.sandboxSessionKey,
+		sandbox: input.sandbox
+	})) return false;
+	const backendId = input.sandbox?.enabled ? input.sandbox.backendId.trim().toLowerCase() : "";
+	return Boolean(backendId && input.nativeToolSurfaceEnabled === false);
+}
+function isCodexDynamicToolExcluded(config, names) {
+	const normalizedNames = new Set(names.map((name) => normalizeCodexDynamicToolName(name)));
+	return (config.codexDynamicToolsExclude ?? []).some((name) => {
+		const normalized = normalizeCodexDynamicToolName(name);
+		return normalizedNames.has(normalized);
+	});
+}
+function isSandboxShellDynamicToolExcluded(config) {
+	return isCodexDynamicToolExcluded(config, [
+		"exec",
+		"sandbox_exec",
+		"process",
+		"sandbox_process"
+	]);
+}
+function addNodeShellDynamicToolsIfNeeded(filteredTools, allTools, input, nodePolicy) {
+	if (isCodexMemoryFlushRun(input.params)) return filteredTools;
+	if (nodePolicy.effectiveExecHost !== "node") return filteredTools;
+	const execTool = allTools.find((tool) => normalizeCodexDynamicToolName(tool.name) === "exec");
+	const processTool = allTools.find((tool) => normalizeCodexDynamicToolName(tool.name) === "process");
+	if (!execTool || !processTool) return filteredTools;
+	const toolsToAppend = [];
+	if (!isCodexDynamicToolExcluded(input.pluginConfig, ["exec", CODEX_NODE_EXEC_DYNAMIC_TOOL_NAME]) && !filteredTools.some((tool) => normalizeCodexDynamicToolName(tool.name) === CODEX_NODE_EXEC_DYNAMIC_TOOL_NAME)) toolsToAppend.push(createNodeExecDynamicTool(execTool, nodePolicy.node));
+	if (!isCodexDynamicToolExcluded(input.pluginConfig, ["process", CODEX_NODE_PROCESS_DYNAMIC_TOOL_NAME]) && !filteredTools.some((tool) => normalizeCodexDynamicToolName(tool.name) === CODEX_NODE_PROCESS_DYNAMIC_TOOL_NAME)) toolsToAppend.push(createNodeProcessDynamicTool(processTool));
+	return toolsToAppend.length > 0 ? [...filteredTools, ...toolsToAppend] : filteredTools;
+}
+function createNodeExecDynamicTool(execTool, configuredNode) {
+	return {
+		...execTool,
+		name: CODEX_NODE_EXEC_DYNAMIC_TOOL_NAME,
+		description: "Run a shell command on the OpenClaw configured remote node for this session. This tool always uses OpenClaw host=node internally and follows the existing node exec approval and allowlist policy. Use node_process for follow-up on backgrounded node_exec sessions. Use Codex's native shell for local app-server work.",
+		parameters: hideNodeExecDynamicToolParameters(execTool.parameters),
+		execute: async (toolCallId, args, signal, onUpdate) => {
+			const result = await execTool.execute(toolCallId, pinNodeExecDynamicToolArgs(args, configuredNode), signal, onUpdate);
+			return {
+				...result,
+				content: result.content.map((item) => item.type === "text" ? Object.assign({}, item, { text: item.text.replace("Use process (list/poll/log/write/send-keys/submit/paste/kill/clear/remove) for follow-up.", "Use node_process (list/poll/log/write/send-keys/submit/paste/kill/clear/remove) for follow-up.") }) : item)
+			};
+		}
+	};
+}
+function createNodeProcessDynamicTool(processTool) {
+	return {
+		...processTool,
+		name: CODEX_NODE_PROCESS_DYNAMIC_TOOL_NAME,
+		description: "Manage node_exec sessions that were started on the OpenClaw configured remote node for this session: list, poll, log, write, send-keys, submit, paste, kill, clear, or remove. Use only for node_exec follow-up; use Codex's native shell session handling for local app-server work."
+	};
+}
+function pinNodeExecDynamicToolArgs(args, configuredNode) {
+	const { host: _host, security: _security, ask: _ask, node: _node, ...rest } = args && typeof args === "object" && !Array.isArray(args) ? args : {};
+	const node = configuredNode?.trim();
+	return {
+		...rest,
+		host: "node",
+		...node ? { node } : {}
+	};
+}
+function hideNodeExecDynamicToolParameters(parameters) {
+	if (!parameters || typeof parameters !== "object" || Array.isArray(parameters)) return parameters;
+	const schema = parameters;
+	const rawProperties = schema.properties;
+	if (!rawProperties || typeof rawProperties !== "object" || Array.isArray(rawProperties)) return parameters;
+	const nextProperties = Object.fromEntries(Object.entries(rawProperties).filter(([name]) => !CODEX_NODE_EXEC_HIDDEN_PARAMETER_NAMES.has(normalizeCodexDynamicToolName(name))));
+	const rawRequired = schema.required;
+	const nextRequired = Array.isArray(rawRequired) ? rawRequired.filter((name) => typeof name !== "string" || !CODEX_NODE_EXEC_HIDDEN_PARAMETER_NAMES.has(normalizeCodexDynamicToolName(name))) : rawRequired;
+	return {
+		...schema,
+		properties: nextProperties,
+		...Array.isArray(rawRequired) ? { required: nextRequired } : {}
+	};
+}
+function resolveCodexNativeExecutionPolicyForDynamicTools(input) {
+	return resolveCodexNativeExecutionPolicy({
+		config: input.params.config,
+		sessionKey: resolveCodexRuntimePolicySessionKey(input.params, input.sandboxSessionKey),
+		sessionId: input.params.sessionId,
+		agentId: input.sessionAgentId,
+		execOverrides: input.params.execOverrides,
+		sandboxAvailable: input.sandbox?.enabled,
+		readRuntimeSessionEntry: true
+	});
+}
+function resolveNodeExecToolOverrides(policy) {
+	if (policy.effectiveExecHost !== "node") return;
+	const node = policy.node?.trim();
+	return {
+		host: "node",
+		...node ? { node } : {}
+	};
+}
+/** Applies a normalized tool allowlist while preserving shell aliases for exec/process. */
+function filterCodexDynamicToolsForAllowlist(tools, toolsAllow) {
+	if (!toolsAllow) return tools;
+	if (toolsAllow.length === 0) return [];
+	if (hasWildcardCodexToolsAllow(toolsAllow)) return tools;
+	const allowSet = new Set(toolsAllow.map((name) => normalizeCodexDynamicToolName(name)).filter(Boolean));
+	return tools.filter((tool) => {
+		const normalized = normalizeCodexDynamicToolName(tool.name);
+		return allowSet.has(normalized) || normalized === "sandbox_exec" && allowSet.has("exec") || normalized === "sandbox_process" && (allowSet.has("exec") || allowSet.has("process")) || normalized === CODEX_NODE_EXEC_DYNAMIC_TOOL_NAME && allowSet.has("exec") || normalized === CODEX_NODE_PROCESS_DYNAMIC_TOOL_NAME && (allowSet.has("exec") || allowSet.has("process"));
+	});
+}
+/** Detects the wildcard allowlist marker after Codex tool-name normalization. */
+function hasWildcardCodexToolsAllow(toolsAllow) {
+	return toolsAllow.some((name) => normalizeCodexDynamicToolName(name) === "*");
+}
+/** Forces message delivery through the message tool when the source channel requires it. */
+function shouldForceMessageTool(params) {
+	return params.disableMessageTool !== true && params.sourceReplyDeliveryMode === "message_tool_only";
+}
+//#endregion
 //#region extensions/codex/src/app-server/dynamic-tool-diagnostics.ts
 /**
 * Trusted diagnostics emitted around Codex dynamic tool execution lifecycle.
@@ -1128,6 +1662,15 @@ function emitDynamicToolTerminalDiagnostic(params) {
 }
 //#endregion
 //#region extensions/codex/src/app-server/dynamic-tools.ts
+function applyCurrentMessageProvider(toolName, args, currentProvider) {
+	const hasProvider = typeof args.provider === "string" && args.provider.trim().length > 0 ? true : typeof args.channel === "string" && args.channel.trim().length > 0;
+	const provider = currentProvider?.trim();
+	if (toolName !== "message" || hasProvider || !provider) return args;
+	return {
+		...args,
+		provider
+	};
+}
 /** Namespace attached to OpenClaw-owned dynamic tools exposed to Codex. */
 const CODEX_OPENCLAW_DYNAMIC_TOOL_NAMESPACE = "openclaw";
 const ALWAYS_DIRECT_DYNAMIC_TOOL_NAMES = new Set(["sessions_yield"]);
@@ -1168,24 +1711,38 @@ function createCodexDynamicToolBridge(params) {
 		runtime: "codex",
 		...toolResultHookContext
 	});
+	const isReplaySafeToolInstance = (tool) => {
+		const pluginMeta = getPluginToolMeta(tool);
+		if (pluginMeta) return pluginMeta.replaySafe === true;
+		return getChannelAgentToolMeta(tool) === void 0;
+	};
 	const legacyExtensionRunner = createCodexAppServerToolResultExtensionRunner(toolResultHookContext);
 	const directToolNames = new Set([...ALWAYS_DIRECT_DYNAMIC_TOOL_NAMES, ...params.directToolNames ?? []]);
 	return {
-		availableSpecs: availableTools.map((entry) => createCodexDynamicToolSpec({
-			entry,
+		availableSpecs: createCodexDynamicToolSpecs({
+			entries: availableTools,
 			loading: params.loading ?? "searchable",
 			directToolNames
-		})),
-		specs: registeredSpecTools.map((entry) => createCodexDynamicToolSpec({
-			entry,
+		}),
+		specs: createCodexDynamicToolSpecs({
+			entries: registeredSpecTools,
 			loading: params.loading ?? "searchable",
 			directToolNames
-		})),
+		}),
 		telemetry,
 		handleToolCall: async (call, options) => {
 			const toolEntry = toolMap.get(call.tool);
 			if (!toolEntry) {
 				const message = registeredToolNames.has(call.tool) ? `OpenClaw tool is not available for this turn: ${call.tool}` : `Unknown OpenClaw tool: ${call.tool}`;
+				finalizeToolTerminalPresentation({
+					toolCallId: call.callId,
+					runId: toolResultHookContext.runId,
+					result: failedToolResult(message),
+					isError: true,
+					observer: params.hookContext?.onToolOutcome,
+					toolName: call.tool,
+					toolCallOrdinal: options?.toolCallOrdinal
+				});
 				notifyAgentToolResult(options?.onAgentToolResult, call.tool, failedToolResult(message), true);
 				if (registeredToolNames.has(call.tool)) return {
 					contentItems: [{
@@ -1207,17 +1764,33 @@ function createCodexDynamicToolBridge(params) {
 			const startedAt = Date.now();
 			const signal = composeAbortSignals(params.signal, options?.signal);
 			let didStartExecution = false;
+			let executionPrevented = false;
+			let executedArgs = structuredClone(args);
 			try {
 				const preparedArgs = tool.prepareArguments ? tool.prepareArguments(args) : args;
+				const telemetryArgs = isRecord(preparedArgs) ? preparedArgs : args;
+				executedArgs = structuredClone(telemetryArgs);
+				const messagingContext = {
+					config: params.hookContext?.config,
+					currentChannelId: params.hookContext?.currentChannelId,
+					currentMessagingTarget: params.hookContext?.currentMessagingTarget,
+					currentThreadId: params.hookContext?.currentThreadId,
+					replyToMode: params.hookContext?.replyToMode,
+					hasRepliedRef: params.hookContext?.hasRepliedRef ? { value: params.hookContext.hasRepliedRef.value } : void 0
+				};
 				didStartExecution = true;
 				const rawResult = await tool.execute(call.callId, preparedArgs, signal);
+				const adjustedExecutedArgs = consumeAdjustedParamsForToolCall(call.callId, toolResultHookContext.runId);
+				if (isRecord(adjustedExecutedArgs)) executedArgs = structuredClone(adjustedExecutedArgs);
+				executionPrevented = consumePreExecutionBlockedToolCall(call.callId, toolResultHookContext.runId);
+				const telemetryRawResult = sanitizeToolResult(rawResult);
 				const rawIsError = isCodexToolResultError(rawResult);
 				const middlewareResult = await middlewareRunner.applyToolResultMiddleware({
 					threadId: call.threadId,
 					turnId: call.turnId,
 					toolCallId: call.callId,
 					toolName,
-					args,
+					args: structuredClone(executedArgs),
 					isError: rawIsError,
 					result: rawResult
 				});
@@ -1226,19 +1799,11 @@ function createCodexDynamicToolBridge(params) {
 					turnId: call.turnId,
 					toolCallId: call.callId,
 					toolName,
-					args,
+					args: structuredClone(executedArgs),
 					result: middlewareResult
 				});
 				const resultIsError = rawIsError || isCodexToolResultError(result);
 				notifyAgentToolResult(options?.onAgentToolResult, toolName, result, resultIsError);
-				collectToolTelemetry({
-					toolName,
-					args,
-					result,
-					mediaTrustResult: rawResult,
-					telemetry,
-					isError: resultIsError
-				});
 				runAgentHarnessAfterToolCallHook({
 					toolName,
 					toolCallId: call.callId,
@@ -1247,24 +1812,59 @@ function createCodexDynamicToolBridge(params) {
 					sessionId: toolResultHookContext.sessionId,
 					sessionKey: toolResultHookContext.sessionKey,
 					channelId: toolResultHookContext.channelId,
-					startArgs: args,
+					startArgs: executedArgs,
 					result,
 					startedAt
 				});
+				finalizeToolTerminalPresentation({
+					toolCallId: call.callId,
+					runId: toolResultHookContext.runId,
+					result,
+					isError: resultIsError,
+					observer: params.hookContext?.onToolOutcome,
+					toolName,
+					toolCallOrdinal: options?.toolCallOrdinal
+				});
+				const messagingTelemetryArgs = applyCurrentMessageProvider(toolName, executedArgs, params.hookContext?.currentChannelProvider);
+				const messagingTarget = isMessagingTool(toolName) && isMessagingToolSendAction(toolName, executedArgs) ? extractMessagingToolSend(toolName, messagingTelemetryArgs, messagingContext) : void 0;
+				const confirmedMessagingTarget = !rawIsError && messagingTarget ? extractMessagingToolSendResult(messagingTarget, telemetryRawResult) : messagingTarget;
+				collectToolTelemetry({
+					toolName,
+					args: executedArgs,
+					result,
+					mediaTrustResult: telemetryRawResult,
+					telemetry,
+					isError: resultIsError,
+					messagingTarget: confirmedMessagingTarget
+				});
 				const terminalType = inferToolResultDiagnosticTerminalType(result, resultIsError);
 				const response = withDiagnosticTerminalType({
 					contentItems: convertToolContents(result.content, toolResultMaxChars),
 					success: !resultIsError
 				}, terminalType);
 				withDynamicToolTermination(response, rawResult.terminate === true || result.terminate === true || isToolResultYield(rawResult) || isToolResultYield(result));
-				withDynamicToolAsyncStarted(response, isAsyncStartedToolResult(rawResult) || isAsyncStartedToolResult(result));
-				return withSideEffectEvidence(response, terminalType !== "blocked");
+				const asyncStarted = isAsyncStartedToolResult(rawResult) || isAsyncStartedToolResult(result);
+				withDynamicToolAsyncStarted(response, asyncStarted);
+				return withSideEffectEvidence(response, !(executionPrevented || !asyncStarted && isReplaySafeToolInstance(toolEntry.tool) && isReplaySafeToolCall(toolName, executedArgs)));
 			} catch (error) {
 				const errorMessage = error instanceof Error ? error.message : String(error);
-				notifyAgentToolResult(options?.onAgentToolResult, toolName, failedToolResult(errorMessage), true);
+				const adjustedExecutedArgs = consumeAdjustedParamsForToolCall(call.callId, toolResultHookContext.runId);
+				if (isRecord(adjustedExecutedArgs)) executedArgs = structuredClone(adjustedExecutedArgs);
+				executionPrevented = executionPrevented || consumePreExecutionBlockedToolCall(call.callId, toolResultHookContext.runId);
+				const failedResult = failedToolResult(errorMessage);
+				finalizeToolTerminalPresentation({
+					toolCallId: call.callId,
+					runId: toolResultHookContext.runId,
+					result: failedResult,
+					isError: true,
+					observer: params.hookContext?.onToolOutcome,
+					toolName,
+					toolCallOrdinal: options?.toolCallOrdinal
+				});
+				notifyAgentToolResult(options?.onAgentToolResult, toolName, failedResult, true);
 				collectToolTelemetry({
 					toolName,
-					args,
+					args: executedArgs,
 					result: void 0,
 					telemetry,
 					isError: true
@@ -1277,17 +1877,18 @@ function createCodexDynamicToolBridge(params) {
 					sessionId: toolResultHookContext.sessionId,
 					sessionKey: toolResultHookContext.sessionKey,
 					channelId: toolResultHookContext.channelId,
-					startArgs: args,
+					startArgs: executedArgs,
 					error: errorMessage,
 					startedAt
 				});
+				const replaySafe = !didStartExecution || executionPrevented || isReplaySafeToolInstance(toolEntry.tool) && isReplaySafeToolCall(toolName, executedArgs);
 				return withSideEffectEvidence(withDiagnosticTerminalType({
 					contentItems: [{
 						type: "inputText",
 						text: errorMessage
 					}],
 					success: false
-				}, "error"), didStartExecution);
+				}, "error"), didStartExecution && !replaySafe);
 			}
 		}
 	};
@@ -1339,18 +1940,35 @@ function wrapProjectedCodexDynamicTools(tools, hookContext) {
 		quarantinedTools
 	};
 }
-function createCodexDynamicToolSpec(params) {
-	const base = {
+function createCodexDynamicToolSpecs(params) {
+	const specs = [];
+	const namespaceTools = [];
+	for (const entry of params.entries) {
+		const functionSpec = createCodexDynamicToolFunctionSpec({ entry });
+		if (params.loading === "direct" || params.directToolNames.has(entry.name)) {
+			specs.push(functionSpec);
+			continue;
+		}
+		namespaceTools.push({
+			...functionSpec,
+			deferLoading: true
+		});
+	}
+	if (namespaceTools.length > 0) specs.push({
+		type: "namespace",
+		name: CODEX_OPENCLAW_DYNAMIC_TOOL_NAMESPACE,
+		description: "",
+		tools: namespaceTools
+	});
+	return specs;
+}
+function createCodexDynamicToolFunctionSpec(params) {
+	return {
+		type: "function",
 		name: params.entry.name,
 		description: params.entry.description,
 		inputSchema: params.entry.inputSchema
 	};
-	if (params.loading === "direct" || params.directToolNames.has(params.entry.name)) return base;
-	return {
-		...base,
-		namespace: CODEX_OPENCLAW_DYNAMIC_TOOL_NAMESPACE,
-		deferLoading: true
-	};
 }
 function projectCodexDynamicTools(tools) {
 	const projectedTools = [];
@@ -1553,19 +2171,21 @@ function collectToolTelemetry(params) {
 	const mediaUrls = collectMediaUrls(params.args);
 	params.telemetry.messagingToolSentMediaUrls.push(...mediaUrls);
 	params.telemetry.messagingToolSentTargets.push({
-		tool: params.toolName,
-		provider: readFirstString$1(params.args, ["provider", "channel"]) ?? params.toolName,
-		accountId: readFirstString$1(params.args, ["accountId", "account_id"]),
-		to: readFirstString$1(params.args, [
-			"to",
-			"target",
-			"recipient"
-		]),
-		threadId: readFirstString$1(params.args, [
-			"threadId",
-			"thread_id",
-			"messageThreadId"
-		]),
+		...params.messagingTarget ?? {
+			tool: params.toolName,
+			provider: readFirstString$1(params.args, ["provider", "channel"]) ?? params.toolName,
+			accountId: readFirstString$1(params.args, ["accountId", "account_id"]),
+			to: readFirstString$1(params.args, [
+				"to",
+				"target",
+				"recipient"
+			]),
+			threadId: readFirstString$1(params.args, [
+				"threadId",
+				"thread_id",
+				"messageThreadId"
+			])
+		},
 		...text ? { text } : {},
 		...mediaUrls.length > 0 ? { mediaUrls } : {}
 	});
@@ -1845,17 +2465,22 @@ async function handleCodexAppServerElicitationRequest(params) {
 			logPluginElicitationDecline("missing_active_turn", requestParams);
 			return declineElicitationResponse();
 		}
-		return buildPluginPolicyElicitationResponse(pluginResolution.entry, requestParams);
+		return await buildPluginPolicyElicitationResponse({
+			entry: pluginResolution.entry,
+			requestParams,
+			paramsForRun: params.paramsForRun,
+			signal: params.signal
+		});
 	}
 	const approvalPrompt = readComputerUseApprovalElicitation(requestParams, params.computerUseMcpServerName) ?? readBridgeableApprovalElicitation(requestParams);
 	if (!approvalPrompt) return;
-	const outcome = await requestPluginApprovalOutcome({
+	return buildElicitationResponse(approvalPrompt, await requestPluginApprovalOutcome({
 		paramsForRun: params.paramsForRun,
 		title: approvalPrompt.title,
 		description: approvalPrompt.description,
+		allowedDecisions: approvalPrompt.allowedDecisions,
 		signal: params.signal
-	});
-	return buildElicitationResponse(approvalPrompt.requestedSchema, approvalPrompt.meta, outcome);
+	}));
 }
 function matchesCurrentThread(requestParams, threadId) {
 	if (!requestParams) return false;
@@ -1953,21 +2578,77 @@ function hasDisplayNameOnlyPluginMatch(meta, entries) {
 function normalizePluginIdentityText(value) {
 	return value.toLowerCase().replace(/[^a-z0-9]+/g, "");
 }
-function buildPluginPolicyElicitationResponse(entry, requestParams) {
-	if (!entry.allowDestructiveActions) {
-		logPluginElicitationDecline("destructive_actions_disabled", requestParams);
+async function buildPluginPolicyElicitationResponse(params) {
+	const mode = resolvePluginDestructiveApprovalMode(params.entry);
+	if (mode === "deny") {
+		logPluginElicitationDecline("destructive_actions_disabled", params.requestParams);
 		return declineElicitationResponse();
 	}
-	if (readString(requestParams, "mode") !== "form" || !isJsonObject(requestParams.requestedSchema)) {
-		logPluginElicitationDecline("unsupported_schema", requestParams);
+	const approvalPrompt = readPluginApprovalElicitation(params.entry, params.requestParams);
+	if (!approvalPrompt) {
+		logPluginElicitationDecline("unsupported_schema", params.requestParams);
 		return declineElicitationResponse();
 	}
-	const meta = isJsonObject(requestParams["_meta"]) ? requestParams["_meta"] : {};
-	const response = buildElicitationResponse(requestParams.requestedSchema, meta, "approved-once");
-	if (isJsonObject(response) && response.action === "accept") return response;
-	logPluginElicitationDecline("unmappable_schema", requestParams);
+	const response = buildElicitationResponse(approvalPrompt, "approved-once");
+	if (isJsonObject(response) && response.action === "accept") {
+		if (mode === "allow") return response;
+		return buildElicitationResponse(approvalPrompt, await requestPluginApprovalOutcome({
+			paramsForRun: params.paramsForRun,
+			title: approvalPrompt.title,
+			description: approvalPrompt.description,
+			allowedDecisions: approvalPrompt.allowedDecisions,
+			signal: params.signal
+		}));
+	}
+	logPluginElicitationDecline("unmappable_schema", params.requestParams);
 	return declineElicitationResponse();
 }
+function resolvePluginDestructiveApprovalMode(entry) {
+	return entry.destructiveApprovalMode ?? (entry.allowDestructiveActions ? "allow" : "deny");
+}
+function readPluginApprovalElicitation(entry, requestParams) {
+	if (readString(requestParams, "mode") !== "form" || !isJsonObject(requestParams.requestedSchema)) return;
+	const requestedSchema = requestParams.requestedSchema;
+	if (readString(requestedSchema, "type") !== "object" || !isJsonObject(requestedSchema.properties)) return;
+	const meta = isJsonObject(requestParams["_meta"]) ? requestParams["_meta"] : {};
+	const title = sanitizeDisplayText(readString(requestParams, "message") ?? "") || "Codex plugin approval";
+	const descriptionMeta = { ...meta };
+	if (!readString(descriptionMeta, MCP_TOOL_APPROVAL_CONNECTOR_NAME_KEY)) descriptionMeta[MCP_TOOL_APPROVAL_CONNECTOR_NAME_KEY] = entry.pluginName;
+	return {
+		title,
+		description: buildApprovalDescription({
+			title,
+			meta: descriptionMeta,
+			requestedSchema,
+			serverName: sanitizeOptionalDisplayText(readString(requestParams, "serverName"))
+		}),
+		requestedSchema,
+		meta,
+		persistHintsMode: "explicit",
+		allowedDecisions: buildApprovalAllowedDecisions(requestedSchema, meta)
+	};
+}
+function buildApprovalAllowedDecisions(requestedSchema, meta) {
+	return canMapPersistentApproval(requestedSchema, meta) ? [
+		"allow-once",
+		"allow-always",
+		"deny"
+	] : ["allow-once", "deny"];
+}
+function canMapPersistentApproval(requestedSchema, meta) {
+	const persistHints = readPersistHints(meta, "explicit");
+	if (persistHints.length > 0) return persistHints.includes("always");
+	const properties = isJsonObject(requestedSchema.properties) ? requestedSchema.properties : {};
+	return Object.entries(properties).some(([name, value]) => {
+		const schema = isJsonObject(value) ? value : void 0;
+		if (!schema) return false;
+		return isPersistField({
+			name,
+			schema,
+			required: false
+		}) && chooseAlwaysPersistOptionValue(readEnumOptions(schema)) !== void 0;
+	});
+}
 function declineElicitationResponse() {
 	return {
 		action: "decline",
@@ -2115,7 +2796,8 @@ async function requestPluginApprovalOutcome(params) {
 			title: params.title,
 			description: params.description,
 			severity: "warning",
-			toolName: "codex_mcp_tool_approval"
+			toolName: "codex_mcp_tool_approval",
+			allowedDecisions: params.allowedDecisions
 		});
 		const approvalId = requestResult?.id;
 		if (!approvalId) return "unavailable";
@@ -2127,7 +2809,8 @@ async function requestPluginApprovalOutcome(params) {
 		return params.signal?.aborted ? "cancelled" : "denied";
 	}
 }
-function buildElicitationResponse(requestedSchema, meta, outcome) {
+function buildElicitationResponse(approvalPrompt, outcome) {
+	const { requestedSchema, meta } = approvalPrompt;
 	if (outcome === "cancelled") return {
 		action: "cancel",
 		content: null,
@@ -2138,12 +2821,12 @@ function buildElicitationResponse(requestedSchema, meta, outcome) {
 		content: null,
 		_meta: null
 	};
-	const content = buildAcceptedContent(requestedSchema, meta, outcome);
+	const content = buildAcceptedContent(approvalPrompt, outcome);
 	if (!content) {
 		if (hasNoSchemaProperties(requestedSchema)) return {
 			action: "accept",
 			content: null,
-			_meta: buildAcceptedMeta(meta, outcome)
+			_meta: buildAcceptedMeta(meta, outcome, approvalPrompt.persistHintsMode ?? "legacy")
 		};
 		embeddedAgentLog.warn("codex MCP approval elicitation approved without a mappable response", {
 			approvalKind: meta[MCP_TOOL_APPROVAL_KIND_KEY],
@@ -2159,10 +2842,11 @@ function buildElicitationResponse(requestedSchema, meta, outcome) {
 	return {
 		action: "accept",
 		content,
-		_meta: buildAcceptedMeta(meta, outcome)
+		_meta: buildAcceptedMeta(meta, outcome, approvalPrompt.persistHintsMode ?? "legacy")
 	};
 }
-function buildAcceptedContent(requestedSchema, meta, outcome) {
+function buildAcceptedContent(approvalPrompt, outcome) {
+	const { requestedSchema, meta } = approvalPrompt;
 	const properties = isJsonObject(requestedSchema.properties) ? requestedSchema.properties : void 0;
 	if (!properties) return;
 	const required = Array.isArray(requestedSchema.required) ? new Set(requestedSchema.required.filter((entry) => typeof entry === "string")) : /* @__PURE__ */ new Set();
@@ -2176,7 +2860,7 @@ function buildAcceptedContent(requestedSchema, meta, outcome) {
 			schema,
 			required: required.has(name)
 		};
-		const next = readApprovalFieldValue(property, outcome) ?? readPersistFieldValue(property, meta, outcome) ?? readFallbackFieldValue(property, outcome);
+		const next = readApprovalFieldValue(property, outcome) ?? readPersistFieldValue(property, meta, outcome, approvalPrompt.persistHintsMode ?? "legacy") ?? readFallbackFieldValue(property, outcome);
 		if (next === void 0) {
 			if (isApprovalField(property)) sawApprovalField = true;
 			if (property.required) return;
@@ -2197,13 +2881,14 @@ function readApprovalFieldValue(property, outcome) {
 	if (outcome === "approved-session") return sessionChoice?.value ?? acceptChoice?.value;
 	return acceptChoice?.value ?? sessionChoice?.value;
 }
-function readPersistFieldValue(property, meta, outcome) {
+function readPersistFieldValue(property, meta, outcome, persistHintsMode) {
 	if (!isPersistField(property) || outcome !== "approved-session") return;
-	const persistHints = readPersistHints(meta);
+	const persistHints = readPersistHints(meta, persistHintsMode);
 	const options = readEnumOptions(property.schema);
 	if (options.length === 0) return;
 	const preferred = choosePersistHint(persistHints);
 	if (preferred) return options.find((option) => option.value === preferred || option.label === preferred)?.value;
+	if (persistHintsMode === "explicit") return chooseAlwaysPersistOptionValue(options);
 }
 function readDefaultValue(schema) {
 	return schema.default;
@@ -2227,21 +2912,27 @@ function propertyText(property) {
 		readString(property.schema, "description")
 	].filter(Boolean).join(" ");
 }
-function readPersistHints(meta) {
+function readPersistHints(meta, mode = "legacy") {
 	const raw = meta.persist;
 	if (typeof raw === "string") return [raw];
 	if (Array.isArray(raw)) return raw.filter((entry) => typeof entry === "string");
-	return ["session", "always"];
+	return mode === "legacy" ? ["session", "always"] : [];
 }
-function buildAcceptedMeta(meta, outcome) {
+function buildAcceptedMeta(meta, outcome, persistHintsMode) {
 	if (outcome !== "approved-session") return null;
-	const persist = choosePersistHint(readPersistHints(meta));
+	const persist = choosePersistHint(readPersistHints(meta, persistHintsMode));
 	return persist ? { persist } : null;
 }
 function choosePersistHint(persistHints) {
 	if (persistHints.includes("always")) return "always";
 	if (persistHints.includes("session")) return "session";
 }
+function chooseAlwaysPersistOptionValue(options) {
+	return options.find((option) => optionMatchesPersist(option, "always"))?.value;
+}
+function optionMatchesPersist(option, persist) {
+	return option.value.toLowerCase() === persist || option.label.toLowerCase() === persist;
+}
 function hasNoSchemaProperties(requestedSchema) {
 	const properties = isJsonObject(requestedSchema.properties) ? requestedSchema.properties : {};
 	return Object.keys(properties).length === 0;
@@ -2472,4 +3163,38 @@ function sortJsonValue(value) {
 	return sorted;
 }
 //#endregion
-export { withCodexStartupTimeout as S, resolveCodexPostToolRawAssistantCompletionIdleTimeoutMs as _, createCodexNativeHookRelay as a, resolveCodexTurnCompletionIdleTimeoutMs as b, scheduleCodexNativeHookRelayUnregister as c, emitDynamicToolErrorDiagnostic as d, emitDynamicToolStartedDiagnostic as f, CODEX_POST_REASONING_REPLY_IDLE_TIMEOUT_MS as g, handleCodexAppServerApprovalRequest as h, buildCodexNativeHookRelayDisabledConfig as i, handleCodexAppServerElicitationRequest as l, filterToolsForVisionInputs as m, CODEX_NATIVE_HOOK_RELAY_TTL_GRACE_MS as n, resolveCodexNativeHookRelayEvents as o, emitDynamicToolTerminalDiagnostic as p, buildCodexNativeHookRelayConfig as r, resolveCodexNativeHookRelayTtlMs as s, CODEX_NATIVE_HOOK_RELAY_EVENTS as t, createCodexDynamicToolBridge as u, resolveCodexStartupTimeoutMs as v, resolveCodexTurnTerminalIdleTimeoutMs as x, resolveCodexTurnAssistantCompletionIdleTimeoutMs as y };
+//#region extensions/codex/src/app-server/provider-capabilities.ts
+async function readConfiguredProviderWebSearchSupport(params) {
+	return (await params.client.request("modelProvider/capabilities/read", {}, {
+		timeoutMs: params.timeoutMs,
+		signal: params.signal
+	})).webSearch ? "supported" : "unsupported";
+}
+async function resolveCodexProviderWebSearchSupportForClient(params) {
+	const modelProviderOverride = params.modelProviderOverride?.trim().toLowerCase();
+	if (modelProviderOverride === "openai") return "supported";
+	if (modelProviderOverride) return "unsupported";
+	try {
+		return await readConfiguredProviderWebSearchSupport(params);
+	} catch {
+		return "unknown";
+	}
+}
+async function resolveCodexProviderWebSearchSupport(params) {
+	let client;
+	try {
+		client = await params.clientFactory(params.appServer.start, params.authProfileId, params.agentDir, params.config, { timeoutMs: params.appServer.requestTimeoutMs });
+		return await resolveCodexProviderWebSearchSupportForClient({
+			client,
+			timeoutMs: params.appServer.requestTimeoutMs,
+			modelProviderOverride: params.modelProviderOverride,
+			signal: params.signal
+		});
+	} catch {
+		return "unknown";
+	} finally {
+		if (client) releaseLeasedSharedCodexAppServerClient(client);
+	}
+}
+//#endregion
+export { CODEX_POST_REASONING_REPLY_IDLE_TIMEOUT_MS as A, resolveCodexMessageToolProvider as C, shouldWarnCodexDynamicToolBuildStageSummary as D, shouldRequireCodexSandboxExecServerEnvironment as E, resolveCodexTurnTerminalIdleTimeoutMs as F, withCodexStartupTimeout as I, resolveCodexStartupTimeoutMs as M, resolveCodexTurnAssistantCompletionIdleTimeoutMs as N, filterToolsForVisionInputs as O, resolveCodexTurnCompletionIdleTimeoutMs as P, resolveCodexExternalSandboxPolicyForOpenClawSandbox as S, shouldEnableCodexAppServerNativeToolSurface as T, createCodexDynamicToolBuildStageTracker as _, buildCodexNativeHookRelayConfig as a, resolveCodexAppServerExecutionCwd as b, resolveCodexNativeHookRelayEvents as c, handleCodexAppServerElicitationRequest as d, createCodexDynamicToolBridge as f, buildDynamicTools as g, emitDynamicToolTerminalDiagnostic as h, CODEX_NATIVE_HOOK_RELAY_TTL_GRACE_MS as i, resolveCodexPostToolRawAssistantCompletionIdleTimeoutMs as j, handleCodexAppServerApprovalRequest as k, resolveCodexNativeHookRelayTtlMs as l, emitDynamicToolStartedDiagnostic as m, resolveCodexProviderWebSearchSupportForClient as n, buildCodexNativeHookRelayDisabledConfig as o, emitDynamicToolErrorDiagnostic as p, CODEX_NATIVE_HOOK_RELAY_EVENTS as r, createCodexNativeHookRelay as s, resolveCodexProviderWebSearchSupport as t, scheduleCodexNativeHookRelayUnregister as u, disableCodexPluginThreadConfig as v, resolveCodexSandboxEnvironmentSelection as w, resolveCodexAppServerHookChannelId as x, formatCodexDynamicToolBuildStageSummary as y };