@openclaw/codex 2026.7.1-beta.6 → 2026.7.2-beta.1

package/dist/{thread-lifecycle-qWE88Dn2.js → thread-lifecycle-BgLXzjvV.js}

@@ -1,239 +1,22 @@
-import { n as flattenCodexDynamicToolFunctions, r as isJsonObject } from "./protocol-2POPqAY4.js";
-import { h as resolveCodexPluginsPolicy, i as codexSandboxPolicyForTurn, t as CODEX_PLUGINS_MARKETPLACE_NAME } from "./config-CYEDnLJ2.js";
-import { n as assertCodexThreadResumeResponse, r as assertCodexThreadStartResponse } from "./protocol-validators-dZQ-UTOa.js";
+import { i as isJsonObject, r as flattenCodexDynamicToolFunctions } from "./protocol-BMifTfdW.js";
+import { _ as resolveCodexPluginsPolicy, n as CODEX_PLUGINS_WORKSPACE_MARKETPLACE_NAME, o as codexSandboxPolicyForTurn, t as CODEX_PLUGINS_MARKETPLACE_NAME } from "./config-c48K5HP9.js";
+import { n as assertCodexThreadResumeResponse, r as assertCodexThreadStartResponse, t as assertCodexThreadForkResponse } from "./protocol-validators-dZQ-UTOa.js";
+import { a as serializeCodexAppInventoryError, i as defaultCodexAppInventoryCache, t as buildCodexAppServerConnectionFingerprint } from "./plugin-app-cache-key-BKNjHMEs.js";
+import { O as CodexAppServerRpcError, P as isCodexAppServerPrewriteRequestCancellationError, d as retireSharedCodexAppServerClientIfCurrent, j as isCodexAppServerConnectionClosedError, k as getCodexAppServerClientInstanceId, n as clearSharedCodexAppServerClientIfCurrentAndUnclaimed, o as isCodexAppServerStartSelectionChangedError, t as clearSharedCodexAppServerClientIfCurrent } from "./shared-client-D4mFI9al.js";
+import { a as isCodexAppServerNativeAuthProfile, c as sessionBindingIdentity, i as hashCodexAppServerBindingFingerprint, n as assertCodexBindingMayBeReplaced, o as normalizeCodexAppServerBindingModelProvider, s as reclaimCurrentCodexSessionGeneration } from "./session-binding-BMfX1OX-.js";
 import { CODEX_GPT5_HEARTBEAT_PROMPT_OVERLAY } from "./prompt-overlay.js";
-import { a as readCodexSupportedReasoningEfforts, i as isModernCodexModel, o as resolveCodexFallbackReasoningEfforts, r as isMaxReasoningCodexModel, s as resolveCodexSupportedReasoningEffort } from "./provider-zjPfx5Fs.js";
-import { f as isCodexAppServerConnectionClosedError, n as clearSharedCodexAppServerClientIfCurrentAndUnclaimed, s as retireSharedCodexAppServerClientIfCurrent, t as clearSharedCodexAppServerClientIfCurrent, u as CodexAppServerRpcError } from "./shared-client-4ICy3U6d.js";
-import { a as normalizeCodexAppServerBindingModelProvider, i as isCodexAppServerNativeAuthProfile, o as reclaimCurrentCodexSessionGeneration, r as hashCodexAppServerBindingFingerprint, s as sessionBindingIdentity } from "./session-binding-C1ZXdP-x.js";
-import "node:fs/promises";
-import "node:path";
-import { isFutureDateTimestampMs, resolveDateTimestampMs, resolveExpiresAtMsFromDurationMs } from "openclaw/plugin-sdk/number-runtime";
-import { truncateUtf16Safe } from "openclaw/plugin-sdk/text-utility-runtime";
+import { isMaxReasoningCodexModel, isModernCodexModel, readCodexSupportedReasoningEfforts, resolveCodexFallbackReasoningEfforts, resolveCodexSupportedReasoningEffort } from "./provider.js";
+import { a as projectBoundedCodexThreadHistory } from "./transcript-mirror-DhLwFIL4.js";
+import { sliceUtf16Safe, truncateUtf16Safe } from "openclaw/plugin-sdk/text-utility-runtime";
+import * as crypto$1 from "node:crypto";
 import crypto from "node:crypto";
 import { isRecord } from "openclaw/plugin-sdk/string-coerce-runtime";
-import { SKILL_WORKSHOP_TOOL_NAME, buildSkillWorkshopPromptSection, embeddedAgentLog, formatErrorMessage, isActiveHarnessContextEngine } from "openclaw/plugin-sdk/agent-harness-runtime";
-import { buildCodexUserMcpServersThreadConfigPatch } from "openclaw/plugin-sdk/codex-mcp-projection";
+import { SKILL_WORKSHOP_TOOL_NAME, buildSkillWorkshopPromptSection, embeddedAgentLog, formatErrorMessage, isActiveHarnessContextEngine, isHostScopedAgentToolActive } from "openclaw/plugin-sdk/agent-harness-runtime";
+import { buildCodexUserMcpServersThreadConfigPatchForRuntime } from "openclaw/plugin-sdk/codex-mcp-projection";
 import { listRegisteredPluginAgentPromptGuidance } from "openclaw/plugin-sdk/plugin-runtime";
 import { redactSensitiveFieldValue, redactToolPayloadText } from "openclaw/plugin-sdk/logging-core";
 import { INLINE_IMAGE_DATA_URL_PREFIX, sanitizeInlineImageDataUrl } from "openclaw/plugin-sdk/inline-image-data-url-runtime";
 import { isDiagnosticFlagEnabled } from "openclaw/plugin-sdk/diagnostic-runtime";
-const CODEX_TARGETED_APP_INVENTORY_LIMIT = 1e3;
-const MAX_SERIALIZED_ERROR_MESSAGE_LENGTH = 500;
-/** In-memory app inventory cache with coalesced refreshes per key. */
-var CodexAppInventoryCache = class {
-	constructor(options = {}) {
-		this.entries = /* @__PURE__ */ new Map();
-		this.inFlight = /* @__PURE__ */ new Map();
-		this.refreshTokens = /* @__PURE__ */ new Map();
-		this.diagnostics = /* @__PURE__ */ new Map();
-		this.revision = 0;
-		this.ttlMs = options.ttlMs ?? 36e5;
-	}
-	/** Reads a snapshot and schedules refresh when missing, stale, or forced. */
-	read(params) {
-		const nowMs = resolveDateTimestampMs(params.nowMs);
-		const entry = this.entries.get(params.key);
-		if (!entry) {
-			const refreshScheduled = params.suppressRefresh ? false : this.scheduleRefresh(params);
-			return {
-				state: "missing",
-				key: params.key,
-				revision: this.revision,
-				refreshScheduled,
-				...this.diagnostics.get(params.key) ? { diagnostic: this.diagnostics.get(params.key) } : {}
-			};
-		}
-		const state = entry.invalidated || !isFutureDateTimestampMs(entry.expiresAtMs, { nowMs }) ? "stale" : "fresh";
-		const refreshScheduled = state === "fresh" && !params.forceRefetch ? false : this.scheduleRefresh(params);
-		return {
-			state,
-			key: params.key,
-			revision: entry.revision,
-			snapshot: stripEntryState(entry),
-			refreshScheduled,
-			...entry.lastError ? { diagnostic: entry.lastError } : {}
-		};
-	}
-	/** Forces or joins an immediate refresh for a cache key. */
-	refreshNow(params) {
-		return this.refresh(params);
-	}
-	/** Marks a key stale and records the reason as a diagnostic. */
-	invalidate(key, reason, nowMs = Date.now()) {
-		this.revision += 1;
-		const diagnostic = {
-			message: reason,
-			atMs: nowMs
-		};
-		const entry = this.entries.get(key);
-		if (entry) {
-			entry.invalidated = true;
-			entry.lastError = diagnostic;
-			entry.revision = this.revision;
-		} else this.diagnostics.set(key, diagnostic);
-		return this.revision;
-	}
-	/** Clears all cached snapshots, diagnostics, in-flight requests, and revision state. */
-	clear() {
-		this.entries.clear();
-		this.inFlight.clear();
-		this.refreshTokens.clear();
-		this.diagnostics.clear();
-		this.revision = 0;
-	}
-	/** Returns the monotonically increasing cache revision. */
-	getRevision() {
-		return this.revision;
-	}
-	scheduleRefresh(params) {
-		if (this.inFlight.has(params.key) && !params.forceRefetch) return true;
-		const promise = this.refresh(params);
-		this.inFlight.set(params.key, promise);
-		promise.catch(() => void 0);
-		return true;
-	}
-	async refresh(params) {
-		const existing = this.inFlight.get(params.key);
-		if (existing && !params.forceRefetch) return existing;
-		const refreshToken = (this.refreshTokens.get(params.key) ?? 0) + 1;
-		this.refreshTokens.set(params.key, refreshToken);
-		const promise = this.refreshUncoalesced(params, refreshToken);
-		this.inFlight.set(params.key, promise);
-		try {
-			return await promise;
-		} finally {
-			if (this.inFlight.get(params.key) === promise) this.inFlight.delete(params.key);
-		}
-	}
-	async refreshUncoalesced(params, refreshToken) {
-		const nowMs = resolveDateTimestampMs(params.nowMs);
-		try {
-			const apps = await listAllApps(params.request, params.forceRefetch ?? false, params.targetAppIds);
-			this.revision += 1;
-			const expiresAtMs = resolveExpiresAtMsFromDurationMs(this.ttlMs, { nowMs }) ?? 0;
-			const snapshot = {
-				key: params.key,
-				apps,
-				fetchedAtMs: nowMs,
-				expiresAtMs,
-				revision: this.revision
-			};
-			if (this.refreshTokens.get(params.key) === refreshToken) {
-				this.entries.set(params.key, {
-					...snapshot,
-					invalidated: false
-				});
-				this.diagnostics.delete(params.key);
-			}
-			return snapshot;
-		} catch (error) {
-			const diagnostic = {
-				message: sanitizeErrorMessage(error instanceof Error ? error.message : String(error)),
-				atMs: nowMs
-			};
-			this.diagnostics.set(params.key, diagnostic);
-			const entry = this.entries.get(params.key);
-			if (entry) entry.lastError = diagnostic;
-			embeddedAgentLog.warn("codex app inventory refresh failed", {
-				forceRefetch: params.forceRefetch === true,
-				keyFingerprint: fingerprintInventoryCacheKey(params.key),
-				error: serializeCodexAppInventoryError(error)
-			});
-			throw error;
-		}
-	}
-};
-/** Serializes a refresh failure without leaking large or sensitive error data. */
-function serializeCodexAppInventoryError(error) {
-	const record = isRecord(error) ? error : void 0;
-	const data = record && "data" in record ? redactErrorData(record.data) : void 0;
-	return {
-		name: error instanceof Error ? error.name : typeof record?.name === "string" ? record.name : void 0,
-		message: sanitizeErrorMessage(error instanceof Error ? error.message : String(error)),
-		...typeof record?.code === "number" ? { code: record.code } : {},
-		...data !== void 0 ? { data } : {}
-	};
-}
-/** Shared app inventory cache used by Codex app-server runtime paths. */
-const defaultCodexAppInventoryCache = new CodexAppInventoryCache();
-/** Builds a stable cache key from build versions and runtime identity fields. */
-function buildCodexAppInventoryCacheKey(input, openClawVersion, codexPluginVersion) {
-	return JSON.stringify({
-		openClawVersion,
-		codexPluginVersion,
-		codexHome: input.codexHome ?? null,
-		endpoint: input.endpoint ?? null,
-		runtimeIdentity: normalizeRuntimeIdentityForCacheKey(input.runtimeIdentity),
-		authProfileId: input.authProfileId ?? null,
-		accountId: input.accountId ?? null,
-		envApiKeyFingerprint: input.envApiKeyFingerprint ?? null,
-		appServerVersion: input.appServerVersion ?? null
-	});
-}
-function normalizeRuntimeIdentityForCacheKey(value) {
-	if (!value) return null;
-	const entries = Object.entries(value).flatMap(([key, rawValue]) => {
-		const normalized = rawValue?.trim();
-		return normalized ? [[key, normalized]] : [];
-	}).toSorted(([left], [right]) => left.localeCompare(right));
-	return entries.length > 0 ? Object.fromEntries(entries) : null;
-}
-async function listAllApps(request, forceRefetch, targetAppIds = []) {
-	const apps = [];
-	const targetIds = new Set(targetAppIds.filter(Boolean));
-	const remainingTargetIds = new Set(targetIds);
-	const seenCursors = /* @__PURE__ */ new Set();
-	let cursor;
-	do {
-		const response = await request("app/list", {
-			cursor,
-			limit: targetIds.size > 0 ? CODEX_TARGETED_APP_INVENTORY_LIMIT : 100,
-			forceRefetch
-		});
-		apps.push(...response.data);
-		for (const app of response.data) remainingTargetIds.delete(app.id);
-		if (targetIds.size > 0 && remainingTargetIds.size === 0) break;
-		cursor = response.nextCursor;
-		if (cursor && seenCursors.has(cursor)) throw new Error(`app/list returned repeated cursor ${cursor}`);
-		if (cursor) seenCursors.add(cursor);
-	} while (cursor);
-	return apps;
-}
-function stripEntryState(entry) {
-	const { invalidated: _invalidated, ...snapshot } = entry;
-	return snapshot;
-}
-function fingerprintInventoryCacheKey(key) {
-	let hash = 0;
-	for (let index = 0; index < key.length; index += 1) hash = hash * 31 + key.charCodeAt(index) >>> 0;
-	return hash.toString(16).padStart(8, "0");
-}
-function redactErrorData(value, depth = 0) {
-	if (value === void 0) return;
-	if (value === null || typeof value === "boolean" || typeof value === "number") return value;
-	if (depth > 6) return "[truncated]";
-	if (Array.isArray(value)) return value.map((entry) => redactErrorData(entry, depth + 1) ?? null);
-	if (isRecord(value)) {
-		const redacted = {};
-		for (const [key, entry] of Object.entries(value)) redacted[key] = isSensitiveErrorDataKey(key) ? "<redacted>" : redactErrorData(entry, depth + 1) ?? null;
-		return redacted;
-	}
-	if (typeof value === "string" && value.length > 500) return `${truncateUtf16Safe(value, 500)}...`;
-	if (typeof value === "string") return value;
-	if (typeof value === "bigint") return value.toString();
-	if (typeof value === "symbol") return value.description ? `Symbol(${value.description})` : "Symbol()";
-	if (typeof value === "function") return value.name ? `[function ${value.name}]` : "[function]";
-	return "[unserializable]";
-}
-function sanitizeErrorMessage(message) {
-	const htmlStart = message.search(/<html[\s>]/i);
-	const redacted = (htmlStart >= 0 ? `${message.slice(0, htmlStart).trimEnd()} [HTML response body omitted]` : message).replace(/([?&][^=\s"'<>]*(?:api[_-]?key|authorization|cookie|credential|password|secret|token|tk)[^=\s"'<>]*=)[^&\s"'<>]+/gi, "$1<redacted>");
-	return redacted.length > MAX_SERIALIZED_ERROR_MESSAGE_LENGTH ? `${redacted.slice(0, MAX_SERIALIZED_ERROR_MESSAGE_LENGTH)}...` : redacted;
-}
-function isSensitiveErrorDataKey(key) {
-	return /api[_-]?key|authorization|cookie|credential|password|secret|token/i.test(key);
-}
-//#endregion
 //#region extensions/codex/src/app-server/plugin-inventory.ts
 /**
 * Reads Codex plugin marketplace state and app inventory to decide which
@@ -252,19 +35,21 @@ async function readCodexPluginInventory(params) {
 		}]
 	};
 	const appInventory = readCachedAppInventory(params);
-	const listed = await params.request("plugin/list", { cwds: [] });
-	const marketplaceEntry = listed.marketplaces.find(isOpenAiCuratedMarketplace);
-	if (!marketplaceEntry) return {
-		policy,
-		records: [],
-		diagnostics: policy.pluginPolicies.filter((pluginPolicy) => pluginPolicy.enabled).map((pluginPolicy) => ({
-			code: "marketplace_missing",
-			plugin: pluginPolicy,
-			message: `Codex marketplace ${CODEX_PLUGINS_MARKETPLACE_NAME} was not found.`
-		})),
-		...appInventory ? { appInventory } : {}
-	};
-	let marketplace = marketplaceRef(marketplaceEntry);
+	const curatedListed = await params.request("plugin/list", { cwds: [] });
+	const shouldListWorkspacePlugins = policy.pluginPolicies.some((pluginPolicy) => pluginPolicy.enabled && pluginPolicy.marketplaceName === "workspace-directory");
+	let workspaceListResult;
+	if (shouldListWorkspacePlugins) try {
+		workspaceListResult = {
+			kind: "listed",
+			response: await params.request("plugin/list", {
+				cwds: [],
+				marketplaceKinds: [CODEX_PLUGINS_WORKSPACE_MARKETPLACE_NAME]
+			})
+		};
+	} catch (error) {
+		if (!(error instanceof CodexAppServerRpcError)) throw error;
+		workspaceListResult = { kind: "rejected" };
+	}
 	const diagnostics = [];
 	const records = [];
 	if (appInventory?.state === "missing") diagnostics.push({
@@ -277,19 +62,27 @@ async function readCodexPluginInventory(params) {
 	});
 	for (const pluginPolicy of policy.pluginPolicies) {
 		if (!pluginPolicy.enabled) continue;
-		const resolvedPlugin = findOpenAiCuratedMarketplacePlugin(listed, pluginPolicy.pluginName);
+		const listed = pluginPolicy.marketplaceName === "workspace-directory" ? workspaceListResult?.kind === "listed" ? workspaceListResult.response : void 0 : curatedListed;
+		const hasMarketplace = pluginPolicy.marketplaceName === "workspace-directory" ? listed?.marketplaces.some((entry) => entry.name === CODEX_PLUGINS_WORKSPACE_MARKETPLACE_NAME) === true : listed?.marketplaces.some(isOpenAiCuratedMarketplace) === true;
+		if (!listed || !hasMarketplace) {
+			diagnostics.push({
+				code: "marketplace_missing",
+				plugin: pluginPolicy,
+				message: `Codex marketplace ${pluginPolicy.marketplaceName} was not found.`
+			});
+			continue;
+		}
+		const resolvedPlugin = pluginPolicy.marketplaceName === "workspace-directory" ? findWorkspaceMarketplacePlugin(listed, pluginPolicy.pluginName) : findOpenAiCuratedMarketplacePlugin(listed, pluginPolicy.pluginName);
 		if (!resolvedPlugin) {
 			diagnostics.push({
 				code: "plugin_missing",
 				plugin: pluginPolicy,
-				message: `${pluginPolicy.pluginName} was not found in ${CODEX_PLUGINS_MARKETPLACE_NAME}.`
+				message: `${pluginPolicy.pluginName} was not found in ${pluginPolicy.marketplaceName}.`
 			});
 			continue;
 		}
 		const { summary } = resolvedPlugin;
-		const pluginMarketplace = marketplaceRef(resolvedPlugin.marketplace);
-		if (records.length === 0) marketplace = pluginMarketplace;
-		const detail = await readPluginDetail(params, pluginMarketplace, pluginPolicy, summary, diagnostics);
+		const detail = await readPluginDetail(params, marketplaceRef(resolvedPlugin.marketplace, pluginPolicy.marketplaceName), pluginPolicy, summary, diagnostics);
 		const ownedAppIds = detail?.apps.map((app) => app.id).filter(Boolean).toSorted() ?? [];
 		const appOwnership = resolveAppOwnership({
 			detail,
@@ -324,7 +117,6 @@ async function readCodexPluginInventory(params) {
 	}
 	return {
 		policy,
-		marketplace,
 		records,
 		diagnostics,
 		...appInventory ? { appInventory } : {}
@@ -334,7 +126,7 @@ async function readCodexPluginInventory(params) {
 function findOpenAiCuratedPluginSummary(listed, pluginName) {
 	const resolved = findOpenAiCuratedMarketplacePlugin(listed, pluginName);
 	return resolved ? {
-		marketplace: marketplaceRef(resolved.marketplace),
+		marketplace: marketplaceRef(resolved.marketplace, CODEX_PLUGINS_MARKETPLACE_NAME),
 		summary: resolved.summary
 	} : void 0;
 }
@@ -358,6 +150,14 @@ function readCachedAppInventory(params) {
 }
 async function readPluginDetail(params, marketplace, pluginPolicy, summary, diagnostics) {
 	if (params.readPluginDetails === false) return;
+	if (marketplace.name === "workspace-directory" && marketplace.remoteMarketplaceName && !summary.remotePluginId) {
+		diagnostics.push({
+			code: "plugin_detail_unavailable",
+			plugin: pluginPolicy,
+			message: `${pluginPolicy.pluginName} detail unavailable: Codex did not return a remote plugin id.`
+		});
+		return;
+	}
 	try {
 		return (await params.request("plugin/read", pluginReadParams(marketplace, marketplace.remoteMarketplaceName && summary.remotePluginId ? summary.remotePluginId : pluginPolicy.pluginName))).plugin;
 	} catch (error) {
@@ -416,15 +216,23 @@ function findOpenAiCuratedMarketplacePlugin(listed, pluginName) {
 		};
 	}
 }
+function findWorkspaceMarketplacePlugin(listed, pluginName) {
+	const marketplace = listed.marketplaces.find((entry) => entry.name === CODEX_PLUGINS_WORKSPACE_MARKETPLACE_NAME);
+	const summary = marketplace?.plugins.find((plugin) => plugin.id === pluginName);
+	return marketplace && summary ? {
+		marketplace,
+		summary
+	} : void 0;
+}
 function pluginNameFromPluginId(pluginId, marketplaceName) {
 	const trimmed = pluginId.trim();
 	if (!trimmed) return;
 	const marketplaceSuffix = `@${marketplaceName}`;
 	return (trimmed.endsWith(marketplaceSuffix) ? trimmed.slice(0, -marketplaceSuffix.length) : trimmed).split("/").at(-1)?.trim() || void 0;
 }
-function marketplaceRef(marketplace) {
+function marketplaceRef(marketplace, name) {
 	return {
-		name: CODEX_PLUGINS_MARKETPLACE_NAME,
+		name,
 		...marketplace.path ? { path: marketplace.path } : {},
 		...!marketplace.path ? { remoteMarketplaceName: marketplace.name } : {}
 	};
@@ -434,9 +242,9 @@ function isOpenAiCuratedMarketplace(marketplace) {
 }
 //#endregion
 //#region extensions/codex/src/app-server/plugin-activation.ts
-/** Installs/enables a configured Codex plugin and refreshes plugin/app state. */
+/** Activates a curated plugin or rejects a workspace plugin that is not already active. */
 async function ensureCodexPluginActivation(params) {
-	if (params.identity.marketplaceName !== "openai-curated") return activationFailure(params.identity, "marketplace_missing", { message: "Only openai-curated plugins can be activated." });
+	if (params.identity.marketplaceName === "workspace-directory") return activationFailure(params.identity, "disabled", { message: "workspace-directory plugins must be installed and enabled outside OpenClaw before use." });
 	const listed = await params.request("plugin/list", { cwds: [] });
 	const resolved = findOpenAiCuratedPluginSummary(listed, params.identity.pluginName);
 	if (!resolved) {
@@ -1033,17 +841,19 @@ async function unsubscribeCodexThreadBestEffort(client, params) {
 * potentially wedged app-server connection.
 */
 async function retireCodexAppServerClientAfterTimedOutTurn(client, params) {
-	const retiredSharedClient = retireSharedCodexAppServerClientIfCurrent(client);
+	const retiredSharedClient = retireSharedCodexAppServerClientIfCurrent(client, { failActiveLeases: params.suspectPhysicalClient });
 	const detachedSharedClient = Boolean(retiredSharedClient);
-	interruptCodexTurnBestEffort(client, {
-		threadId: params.threadId,
-		turnId: params.turnId,
-		timeoutMs: CODEX_APP_SERVER_INTERRUPT_TIMEOUT_MS
-	});
-	await unsubscribeCodexThreadBestEffort(client, {
-		threadId: params.threadId,
-		timeoutMs: CODEX_APP_SERVER_UNSUBSCRIBE_TIMEOUT_MS
-	});
+	if (!(params.suspectPhysicalClient && (retiredSharedClient?.closed ?? false))) {
+		interruptCodexTurnBestEffort(client, {
+			threadId: params.threadId,
+			turnId: params.turnId,
+			timeoutMs: CODEX_APP_SERVER_INTERRUPT_TIMEOUT_MS
+		});
+		await unsubscribeCodexThreadBestEffort(client, {
+			threadId: params.threadId,
+			timeoutMs: CODEX_APP_SERVER_UNSUBSCRIBE_TIMEOUT_MS
+		});
+	}
 	let closedClient = retiredSharedClient?.closed ?? false;
 	if (!detachedSharedClient) {
 		const close = client.close;
@@ -1128,7 +938,7 @@ function resolveCodexContextEngineProjectionReserveTokens(params) {
 	const compaction = asRecord(asRecord(asRecord(params.config)?.agents)?.defaults)?.compaction;
 	const configuredReserveTokens = toNonNegativeInt(asRecord(compaction)?.reserveTokens);
 	const configuredReserveTokensFloor = toNonNegativeInt(asRecord(compaction)?.reserveTokensFloor);
-	if (configuredReserveTokens !== void 0) return Math.max(configuredReserveTokens, configuredReserveTokensFloor ?? 2e4);
+	if (configuredReserveTokens !== void 0) return Math.max(configuredReserveTokens, configuredReserveTokensFloor ?? DEFAULT_CODEX_PROJECTION_RESERVE_TOKENS);
 	if (configuredReserveTokensFloor !== void 0) return configuredReserveTokensFloor;
 }
 /** Fits projected context prompts under Codex app-server turn/start text limits. */
@@ -1311,7 +1121,9 @@ function resolveTextPartMaxChars(maxRenderedContextChars) {
 	return Math.min(MAX_TEXT_PART_CHARS, Math.max(DEFAULT_TEXT_PART_CHARS, Math.floor(maxRenderedContextChars / 4)));
 }
 function truncateText(text, maxChars) {
-	return text.length > maxChars ? `${text.slice(0, maxChars)}\n[truncated ${text.length - maxChars} chars]` : text;
+	if (text.length <= maxChars) return text;
+	const truncated = truncateUtf16Safe(text, maxChars);
+	return `${truncated}\n[truncated ${text.length - truncated.length} chars]`;
 }
 function truncateOlderContext(text, maxChars) {
 	if (text.length <= maxChars) return text;
@@ -1322,15 +1134,7 @@ function truncateOlderContext(text, maxChars) {
 	marker = buildMarker(text.length - tailChars);
 	if (marker.length >= maxChars) return marker.slice(0, maxChars);
 	tailChars = maxChars - marker.length;
-	return `${marker}${sliceTailFromCodePointBoundary(text, tailChars).trimStart()}`;
-}
-function sliceTailFromCodePointBoundary(text, tailChars) {
-	let start = text.length - tailChars;
-	if (start > 0 && start < text.length) {
-		const code = text.charCodeAt(start);
-		if (code >= 56320 && code <= 57343) start += 1;
-	}
-	return text.slice(start);
+	return `${marker}${sliceUtf16Safe(text, -tailChars).trimStart()}`;
 }
 //#endregion
 //#region extensions/codex/src/app-server/dynamic-tool-profile.ts
@@ -1357,6 +1161,10 @@ function normalizeCodexDynamicToolName(name) {
 	const normalized = name.trim().toLowerCase();
 	return DYNAMIC_TOOL_NAME_ALIASES[normalized] ?? normalized;
 }
+/** True only for the host-scoped OpenClaw run's exact tool contract. */
+function isSystemAgentOnlyCodexDynamicToolAllowlist(toolsAllow) {
+	return toolsAllow?.length === 1 && normalizeCodexDynamicToolName(toolsAllow[0] ?? "") === "openclaw";
+}
 /** Returns true for private QA runs that force the Codex runtime profile. */
 function isForcedPrivateQaCodexRuntime(env = process.env) {
 	return env.OPENCLAW_BUILD_PRIVATE_QA === "1" && env.OPENCLAW_QA_FORCE_RUNTIME?.trim().toLowerCase() === "codex";
@@ -1481,6 +1289,7 @@ async function resumeCodexAppServerThread(params) {
 		}));
 		assertCodexThreadResumeSubscription(threadId, response.thread.id);
 	} catch (error) {
+		if (isCodexAppServerStartSelectionChangedError(error) || isCodexAppServerPrewriteRequestCancellationError(error)) throw error;
 		if (error instanceof CodexAppServerRpcError) throw error;
 		try {
 			await params.abandonClient();
@@ -1573,7 +1382,21 @@ var CodexThreadBindingConflictError = class extends Error {
 		this.name = "CodexThreadBindingConflictError";
 	}
 };
+var CodexRingZeroAttestationError = class extends Error {
+	constructor(cause) {
+		super("Codex ring-zero MCP attestation failed", { cause });
+		this.name = "CodexRingZeroAttestationError";
+	}
+};
+var CodexThreadBindingConflictAfterCleanupError = class extends CodexThreadBindingConflictError {};
+var CodexAdoptedThreadActiveError = class extends Error {
+	constructor() {
+		super("Codex session became active in another runner; wait for it to finish before continuing");
+		this.name = "CodexAdoptedThreadActiveError";
+	}
+};
 const CODEX_NATIVE_PERSONALITY_NONE = "none";
+const CODEX_RING_ZERO_BASE_INSTRUCTIONS = "";
 const CODEX_CODE_MODE_THREAD_CONFIG = {
 	"features.code_mode": true,
 	"features.code_mode_only": false,
@@ -1585,6 +1408,64 @@ const CODEX_CODE_MODE_DISABLED_THREAD_CONFIG = {
 };
 const CODEX_LIGHTWEIGHT_CONTEXT_THREAD_CONFIG = { project_doc_max_bytes: 0 };
 const CODEX_TOOL_SEARCH_UNSUPPORTED_THREAD_CONFIG = { "features.multi_agent": false };
+const CODEX_RING_ZERO_THREAD_CONFIG = {
+	"features.apps": false,
+	"features.current_time_reminder": false,
+	"features.deferred_executor": false,
+	"features.enable_fanout": false,
+	"features.goals": false,
+	"features.hooks": false,
+	"features.image_generation": false,
+	"features.memories": false,
+	"features.multi_agent": false,
+	"features.multi_agent_v2": false,
+	"features.plugins": false,
+	"features.standalone_web_search": false,
+	"features.token_budget": false,
+	"orchestrator.mcp.enabled": false,
+	"orchestrator.skills.enabled": false,
+	"tools.experimental_request_user_input.enabled": false,
+	hooks: {
+		PreToolUse: [],
+		PermissionRequest: [],
+		PostToolUse: [],
+		PreCompact: [],
+		PostCompact: [],
+		SessionStart: [],
+		UserPromptSubmit: [],
+		SubagentStart: [],
+		SubagentStop: [],
+		Stop: []
+	},
+	project_doc_max_bytes: 0,
+	notify: [],
+	web_search: "disabled"
+};
+const CODEX_RING_ZERO_RESTRICTED_FEATURES = /* @__PURE__ */ new Set([
+	"apps",
+	"code_mode",
+	"code_mode_only",
+	"current_time_reminder",
+	"deferred_executor",
+	"enable_fanout",
+	"goals",
+	"hooks",
+	"image_generation",
+	"memories",
+	"multi_agent",
+	"multi_agent_v2",
+	"plugins",
+	"standalone_web_search",
+	"token_budget"
+]);
+const CODEX_RING_ZERO_OVERRIDABLE_LAYER_TYPES = /* @__PURE__ */ new Set([
+	"mdm",
+	"system",
+	"enterpriseManaged",
+	"user",
+	"project",
+	"sessionFlags"
+]);
 const CODEX_THREAD_LIFECYCLE_TIMING_WARN_TOTAL_MS = 1e3;
 const CODEX_THREAD_LIFECYCLE_TIMING_WARN_STAGE_MS = 500;
 function shouldWarnCodexThreadLifecycleTimingSummary(summary, options = {}) {
@@ -1696,10 +1577,29 @@ async function startOrResumeThread(params) {
 		})).threadConfig);
 		const networkProxyConfigFingerprint = params.appServer.networkProxy?.configFingerprint;
 		const contextEngineBinding = lifecycleTiming.measureSync("context-engine-binding", () => buildContextEngineBinding(params.params, params.contextEngineProjection));
-		const userMcpServersConfigPatch = params.userMcpServersEnabled === false ? void 0 : buildCodexUserMcpServersThreadConfigPatch(params.params.config, { agentId: params.agentId ?? params.params.agentId });
+		const userMcpServersConfigPatch = params.userMcpServersEnabled === false ? void 0 : await buildCodexUserMcpServersThreadConfigPatchForRuntime(params.params.config, {
+			agentId: params.agentId ?? params.params.agentId,
+			agentDir: params.params.agentDir,
+			allowLiteralOAuthProjection: params.appServer.connectionClass !== "remote",
+			onServerUnavailable: (serverName, error) => embeddedAgentLog.warn("skipping unavailable MCP OAuth server", {
+				serverName,
+				error: formatErrorMessage(error)
+			})
+		});
 		const legacyUserMcpServersFingerprint = legacyFingerprintUserMcpServersConfigPatch(userMcpServersConfigPatch);
 		const userMcpServersFingerprint = fingerprintUserMcpServersConfigPatch(userMcpServersConfigPatch);
 		const environmentSelectionFingerprint = fingerprintEnvironmentSelection(params.environmentSelection);
+		const hostSystemAgentActive = params.hostSystemAgentActive ?? isHostScopedAgentToolActive("openclaw");
+		const ringZeroActive = hostSystemAgentActive && isSystemAgentOnlyCodexDynamicToolAllowlist(params.params.toolsAllow);
+		if (ringZeroActive && params.nativeCodeModeEnabled !== false) throw new Error("Codex ring-zero requires native code mode to be disabled");
+		const ringZeroInheritedMcpServerNames = ringZeroActive ? await lifecycleTiming.measure("ring-zero-mcp-config-read", () => readCodexInheritedMcpServerNames(params.client, params.cwd, params.signal)) : [];
+		if (ringZeroActive) await lifecycleTiming.measure("ring-zero-config-requirements-read", () => assertCodexRingZeroHasNoManagedHooks(params.client, params.signal));
+		const ringZeroConfigFingerprint = ringZeroActive ? fingerprintJsonObject({
+			version: 1,
+			baseInstructions: CODEX_RING_ZERO_BASE_INSTRUCTIONS,
+			config: buildCodexRingZeroThreadConfigPatch(params.params, true, ringZeroInheritedMcpServerNames)
+		}) : void 0;
+		const ringZeroClientInstanceId = ringZeroActive ? getCodexAppServerClientInstanceId(params.client) : void 0;
 		let binding = await lifecycleTiming.measure("read-binding", () => params.bindingStore.read(bindingIdentity));
 		const normalizeBindingModelProvider = (authProfileId, modelProvider) => normalizeCodexAppServerBindingModelProvider({
 			authProfileId,
@@ -1708,6 +1608,14 @@ async function startOrResumeThread(params) {
 			agentDir: params.params.agentDir,
 			config: params.params.config
 		});
+		const throwIfAborted = () => {
+			if (!params.signal?.aborted) return;
+			const reason = params.signal.reason;
+			if (reason instanceof Error) throw reason;
+			const error = new Error(typeof reason === "string" && reason.length > 0 ? reason : "codex app-server thread lifecycle aborted");
+			error.name = "AbortError";
+			throw error;
+		};
 		if (!binding && bindingIdentity.kind === "session" && bindingIdentity.sessionKey) {
 			if (!await lifecycleTiming.measure("reclaim-binding-generation", () => reclaimCurrentCodexSessionGeneration({
 				bindingStore: params.bindingStore,
@@ -1715,18 +1623,74 @@ async function startOrResumeThread(params) {
 				config: params.params.config
 			}))) throw new Error(`Codex session generation is no longer current: ${bindingIdentity.sessionId}`);
 		}
+		if (binding?.pendingSupervisionBranch) {
+			const pendingBinding = binding;
+			const pluginThreadConfig = params.pluginThreadConfig?.enabled ? await lifecycleTiming.measure("plugin-config-build", () => params.pluginThreadConfig?.build()) : void 0;
+			const finalConfigPatch = params.buildFinalConfigPatch?.({ action: "start" }) ?? {
+				configPatch: params.finalConfigPatch,
+				nativeHookRelayGeneration: params.nativeHookRelayGeneration
+			};
+			const config = lifecycleTiming.measureSync("merge-thread-config", () => mergeCodexThreadConfigs(params.config, userMcpServersConfigPatch, pluginThreadConfig?.configPatch, finalConfigPatch.configPatch));
+			return await materializePendingSupervisionBranch({
+				client: params.client,
+				abandonClient: params.abandonClient ?? (() => closeCodexStartupClientBestEffort(params.client)),
+				bindingStore: params.bindingStore,
+				bindingIdentity,
+				binding: pendingBinding,
+				attempt: params.params,
+				cwd: params.cwd,
+				dynamicTools: params.dynamicTools,
+				appServer: params.appServer,
+				developerInstructions: params.developerInstructions,
+				config,
+				nativeCodeModeEnabled: params.nativeCodeModeEnabled,
+				nativeProviderWebSearchSupport: params.nativeProviderWebSearchSupport,
+				nativeCodeModeOnlyEnabled: params.nativeCodeModeOnlyEnabled,
+				webSearchAllowed: params.webSearchAllowed,
+				environmentSelection: params.environmentSelection,
+				signal: params.signal,
+				throwIfAborted,
+				lifecycleTiming,
+				normalizeBindingModelProvider,
+				bindingPatch: {
+					cwd: params.cwd,
+					authProfileId: void 0,
+					preserveNativeModel: true,
+					dynamicToolsFingerprint,
+					dynamicToolsContainDeferred,
+					webSearchThreadConfigFingerprint,
+					userMcpServersFingerprint,
+					mcpServersFingerprint: params.mcpServersFingerprintEvaluated === true ? params.mcpServersFingerprint : pendingBinding.mcpServersFingerprint,
+					networkProxyProfileName: params.appServer.networkProxy?.profileName,
+					networkProxyConfigFingerprint,
+					nativeHookRelayGeneration: finalConfigPatch.nativeHookRelayGeneration,
+					appServerRuntimeFingerprint: buildCodexAppServerConnectionFingerprint(params.appServer, params.params.agentDir),
+					pluginAppsFingerprint: pluginThreadConfig?.fingerprint,
+					pluginAppsInputFingerprint: pluginThreadConfig?.inputFingerprint,
+					pluginAppPolicyContext: pluginThreadConfig?.policyContext,
+					contextEngine: contextEngineBinding,
+					environmentSelectionFingerprint,
+					conversationSourceTransferComplete: true
+				}
+			});
+		}
 		const clearCurrentBinding = async (operation) => {
 			const current = binding;
 			if (!current?.threadId) return;
+			assertCodexBindingMayBeReplaced(current, operation);
 			if (!await params.bindingStore.mutate(bindingIdentity, {
 				kind: "clear",
 				threadId: current.threadId
 			})) throw new CodexThreadBindingConflictError(current.threadId, operation);
 			binding = void 0;
 		};
+		if (binding?.threadId && (binding.ringZeroConfigFingerprint !== ringZeroConfigFingerprint || binding.ringZeroClientInstanceId !== ringZeroClientInstanceId) && (ringZeroActive || binding.ringZeroConfigFingerprint !== void 0)) {
+			embeddedAgentLog.debug("codex app-server ring-zero restriction changed; rotating thread", { threadId: binding.threadId });
+			await clearCurrentBinding("rotating a ring-zero thread binding");
+		}
 		if (binding?.threadId && shouldRotateCodexAppServerBindingForRuntime({
 			connectionClass: params.appServer.connectionClass,
-			current: params.appServerRuntimeFingerprint,
+			current: binding.connectionScope === "supervision" ? buildCodexAppServerConnectionFingerprint(params.appServer, params.params.agentDir) : params.appServerRuntimeFingerprint,
 			binding: binding.appServerRuntimeFingerprint
 		})) {
 			embeddedAgentLog.debug("codex app-server runtime identity changed; starting a new thread", {
@@ -1758,17 +1722,9 @@ async function startOrResumeThread(params) {
 			config: params.params.config
 		});
 		const startModelProvider = startModelSelection.modelProvider;
-		let preserveExistingBinding = params.nativeProviderWebSearchSupport === "unknown" && !binding?.threadId;
+		let preserveExistingBinding = !ringZeroActive && params.nativeProviderWebSearchSupport === "unknown" && !binding?.threadId;
 		let rotatedContextEngineBinding = false;
 		let prebuiltPluginThreadConfig;
-		const throwIfAborted = () => {
-			if (!params.signal?.aborted) return;
-			const reason = params.signal.reason;
-			if (reason instanceof Error) throw reason;
-			const error = new Error(typeof reason === "string" && reason.length > 0 ? reason : "codex app-server thread lifecycle aborted");
-			error.name = "AbortError";
-			throw error;
-		};
 		const webSearchBindingChanged = binding?.threadId && binding.webSearchThreadConfigFingerprint !== webSearchThreadConfigFingerprint;
 		const persistentWebSearchRestriction = params.webSearchAllowed === false && params.persistentWebSearchAllowed === false;
 		const transientNativeToolRestriction = params.nativeCodeModeEnabled === false && !persistentWebSearchRestriction;
@@ -1776,7 +1732,8 @@ async function startOrResumeThread(params) {
 		const explicitTransientWebSearchRestriction = params.webSearchAllowed === false && params.persistentWebSearchAllowed !== false && transientWebSearchRestriction;
 		const unknownProviderWebSearchSupport = params.nativeProviderWebSearchSupport === "unknown";
 		if (binding?.threadId && params.mcpServersFingerprintEvaluated === true && binding.mcpServersFingerprint !== params.mcpServersFingerprint) {
-			if (transientNativeToolRestriction || webSearchBindingChanged && (explicitTransientWebSearchRestriction || unknownProviderWebSearchSupport)) {
+			assertCodexBindingMayBeReplaced(binding, "changing MCP configuration");
+			if (!ringZeroActive && (transientNativeToolRestriction || webSearchBindingChanged && (explicitTransientWebSearchRestriction || unknownProviderWebSearchSupport))) {
 				embeddedAgentLog.debug("codex app-server MCP config changed during transient restricted turn; starting transient thread", { threadId: binding.threadId });
 				preserveExistingBinding = true;
 			} else {
@@ -1787,7 +1744,8 @@ async function startOrResumeThread(params) {
 		}
 		const deferLegacyWebSearchRotationToTransientNativeSurface = params.nativeCodeModeEnabled === false && binding?.webSearchThreadConfigFingerprint === void 0 && !persistentWebSearchRestriction;
 		if (binding?.threadId && webSearchBindingChanged && !deferLegacyWebSearchRotationToTransientNativeSurface) {
-			if (transientWebSearchRestriction) {
+			assertCodexBindingMayBeReplaced(binding, "changing web-search configuration");
+			if (!ringZeroActive && transientWebSearchRestriction) {
 				embeddedAgentLog.debug("codex app-server web search restricted for turn; starting transient thread", { threadId: binding.threadId });
 				preserveExistingBinding = true;
 			} else {
@@ -1796,7 +1754,8 @@ async function startOrResumeThread(params) {
 			}
 			binding = void 0;
 		}
-		if (binding?.threadId && transientNativeToolRestriction) {
+		if (binding?.threadId && transientNativeToolRestriction && !ringZeroActive) {
+			assertCodexBindingMayBeReplaced(binding, "starting a native-tool-restricted turn");
 			embeddedAgentLog.debug("codex app-server native tool surface disabled for turn; starting transient thread", { threadId: binding.threadId });
 			preserveExistingBinding = true;
 			binding = void 0;
@@ -1872,6 +1831,7 @@ async function startOrResumeThread(params) {
 			}
 		}
 		if (binding?.threadId) if (binding.dynamicToolsFingerprint && !areDynamicToolFingerprintsCompatible(binding.dynamicToolsFingerprint, dynamicToolsFingerprint, legacyDynamicToolsFingerprint)) {
+			assertCodexBindingMayBeReplaced(binding, "changing the dynamic tool catalog");
 			preserveExistingBinding = shouldStartTransientNoToolThread({
 				previous: binding.dynamicToolsFingerprint,
 				nextHasDynamicTools: params.dynamicTools.length > 0
@@ -1885,7 +1845,7 @@ async function startOrResumeThread(params) {
 			const resumeBinding = binding;
 			let resumeReservation;
 			try {
-				const authProfileId = params.params.authProfileId ?? resumeBinding.authProfileId;
+				const authProfileId = resumeBinding.connectionScope === "supervision" ? void 0 : params.params.authProfileId ?? resumeBinding.authProfileId;
 				const finalConfigPatch = params.buildFinalConfigPatch?.({
 					action: "resume",
 					binding: resumeBinding
@@ -1900,6 +1860,7 @@ async function startOrResumeThread(params) {
 					authProfileId,
 					model: startModelSelection.model,
 					modelProvider: startModelProvider,
+					preserveNativeModel: resumeBinding.preserveNativeModel === true,
 					appServer: params.appServer,
 					dynamicTools: params.dynamicTools,
 					developerInstructions: params.developerInstructions,
@@ -1907,10 +1868,20 @@ async function startOrResumeThread(params) {
 					nativeCodeModeEnabled: params.nativeCodeModeEnabled,
 					nativeProviderWebSearchSupport: params.nativeProviderWebSearchSupport,
 					nativeCodeModeOnlyEnabled: params.nativeCodeModeOnlyEnabled,
-					webSearchAllowed: params.webSearchAllowed
+					webSearchAllowed: params.webSearchAllowed,
+					hostSystemAgentActive,
+					ringZeroInheritedMcpServerNames
 				}));
 				const requestModelProvider = typeof resumeParams.modelProvider === "string" && resumeParams.modelProvider.trim() ? resumeParams.modelProvider : void 0;
 				throwIfAborted();
+				if (resumeBinding.preserveNativeModel === true) {
+					const current = await lifecycleTiming.measure("thread-read-adoption-status", () => params.client.request("thread/read", {
+						threadId: resumeBinding.threadId,
+						includeTurns: false
+					}, { signal: params.signal }));
+					throwIfAborted();
+					if (current.thread.status?.type === "active") throw new CodexAdoptedThreadActiveError();
+				}
 				resumeReservation = params.reserveResumeThread?.(resumeBinding.threadId);
 				const response = await lifecycleTiming.measure("thread-resume-request", () => resumeCodexAppServerThread({
 					client: params.client,
@@ -1918,6 +1889,12 @@ async function startOrResumeThread(params) {
 					request: resumeParams,
 					signal: params.signal
 				}));
+				if (ringZeroActive) try {
+					await lifecycleTiming.measure("ring-zero-mcp-attestation", () => attestCodexRingZeroThreadHasNoMcpServers(params.client, response.thread.id, params.signal));
+				} catch (error) {
+					await (params.abandonClient ?? (() => closeCodexStartupClientBestEffort(params.client)))();
+					throw new CodexRingZeroAttestationError(error);
+				}
 				throwIfAborted();
 				const boundAuthProfileId = authProfileId;
 				const nextMcpServersFingerprint = params.mcpServersFingerprintEvaluated === true ? params.mcpServersFingerprint : resumeBinding.mcpServersFingerprint;
@@ -1925,16 +1902,19 @@ async function startOrResumeThread(params) {
 					cwd: params.cwd,
 					authProfileId: boundAuthProfileId,
 					model: response.model ?? resumeParams.model ?? params.params.modelId,
+					preserveNativeModel: resumeBinding.preserveNativeModel === true ? true : void 0,
 					modelProvider: normalizeBindingModelProvider(boundAuthProfileId, response.modelProvider ?? requestModelProvider ?? startModelProvider),
 					dynamicToolsFingerprint,
 					dynamicToolsContainDeferred,
 					webSearchThreadConfigFingerprint,
 					userMcpServersFingerprint,
 					mcpServersFingerprint: nextMcpServersFingerprint,
+					ringZeroConfigFingerprint,
+					ringZeroClientInstanceId,
 					networkProxyProfileName: params.appServer.networkProxy?.profileName,
 					networkProxyConfigFingerprint,
 					nativeHookRelayGeneration: finalConfigPatch.nativeHookRelayGeneration ?? resumeBinding.nativeHookRelayGeneration,
-					appServerRuntimeFingerprint: params.appServerRuntimeFingerprint,
+					appServerRuntimeFingerprint: resumeBinding.connectionScope === "supervision" ? buildCodexAppServerConnectionFingerprint(params.appServer, params.params.agentDir) : params.appServerRuntimeFingerprint,
 					pluginAppsFingerprint: resumeBinding.pluginAppsFingerprint,
 					pluginAppsInputFingerprint: resumeBinding.pluginAppsInputFingerprint,
 					pluginAppPolicyContext: resumeBinding.pluginAppPolicyContext,
@@ -1975,6 +1955,12 @@ async function startOrResumeThread(params) {
 				};
 			} catch (error) {
 				resumeReservation?.release();
+				if (isCodexAppServerStartSelectionChangedError(error)) throw error;
+				if (error instanceof CodexRingZeroAttestationError) {
+					await clearCurrentBinding("retiring a failed ring-zero thread attestation");
+					throw error;
+				}
+				if (error instanceof CodexAdoptedThreadActiveError) throw error;
 				if (isCodexAppServerUnsafeSubscriptionError(error)) throw error;
 				const resumeRejected = error instanceof CodexAppServerRpcError;
 				if (!await unsubscribeCodexThreadBestEffort(params.client, {
@@ -2004,7 +1990,9 @@ async function startOrResumeThread(params) {
 			webSearchAllowed: params.webSearchAllowed,
 			environmentSelection: params.environmentSelection,
 			model: startModelSelection.model,
-			modelProvider: startModelProvider
+			modelProvider: startModelProvider,
+			hostSystemAgentActive,
+			ringZeroInheritedMcpServerNames
 		}));
 		const requestModelProvider = typeof startParams.modelProvider === "string" && startParams.modelProvider.trim() ? startParams.modelProvider : void 0;
 		const response = assertCodexThreadStartResponse(await lifecycleTiming.measure("thread-start-request", async () => {
@@ -2015,6 +2003,12 @@ async function startOrResumeThread(params) {
 				throw error;
 			}
 		}));
+		if (ringZeroActive) try {
+			await lifecycleTiming.measure("ring-zero-mcp-attestation", () => attestCodexRingZeroThreadHasNoMcpServers(params.client, response.thread.id, params.signal));
+		} catch (error) {
+			await (params.abandonClient ?? (() => closeCodexStartupClientBestEffort(params.client)))();
+			throw error;
+		}
 		throwIfAborted();
 		const modelProvider = resolveCodexAppServerModelProvider({
 			provider: params.params.provider,
@@ -2039,6 +2033,8 @@ async function startOrResumeThread(params) {
 					webSearchThreadConfigFingerprint,
 					userMcpServersFingerprint,
 					mcpServersFingerprint: nextMcpServersFingerprint,
+					ringZeroConfigFingerprint,
+					ringZeroClientInstanceId,
 					networkProxyProfileName: params.appServer.networkProxy?.profileName,
 					networkProxyConfigFingerprint,
 					nativeHookRelayGeneration: finalConfigPatch.nativeHookRelayGeneration,
@@ -2078,6 +2074,8 @@ async function startOrResumeThread(params) {
 			dynamicToolsContainDeferred,
 			userMcpServersFingerprint,
 			mcpServersFingerprint: nextMcpServersFingerprint,
+			ringZeroConfigFingerprint,
+			ringZeroClientInstanceId,
 			networkProxyProfileName: params.appServer.networkProxy?.profileName,
 			networkProxyConfigFingerprint,
 			nativeHookRelayGeneration: finalConfigPatch.nativeHookRelayGeneration,
@@ -2094,6 +2092,325 @@ async function startOrResumeThread(params) {
 		};
 	});
 }
+async function materializePendingSupervisionBranch(params) {
+	let pending = params.binding.pendingSupervisionBranch;
+	const connectionFingerprint = buildCodexAppServerConnectionFingerprint(params.appServer, params.attempt.agentDir);
+	if (!pending.connectionFingerprint || pending.connectionFingerprint !== connectionFingerprint) throw new Error("Codex supervision source connection changed before branch materialization");
+	pending = await recoverPendingSupervisionArtifacts(params, pending);
+	params.throwIfAborted();
+	const sourceResponse = await params.lifecycleTiming.measure("supervision-source-read", () => params.client.request("thread/read", {
+		threadId: pending.sourceThreadId,
+		includeTurns: true
+	}, { signal: params.signal }));
+	params.throwIfAborted();
+	const sourceThread = sourceResponse.thread;
+	if (sourceThread.id !== pending.sourceThreadId) throw new Error(`Codex supervision source read returned ${sourceThread.id} for ${pending.sourceThreadId}`);
+	assertPendingSupervisionSnapshotUnchanged(sourceThread, pending);
+	const history = projectBoundedCodexThreadHistory({
+		thread: sourceThread,
+		throughTurnId: pending.lastTurnId ?? null,
+		importedAt: Date.now(),
+		modelProvider: sourceThread.modelProvider
+	});
+	let bindingCommitted = false;
+	let provisionalCleanupSafe = true;
+	try {
+		const probeParams = buildPendingSupervisionProbeForkParams(params, pending);
+		const rawProbeResponse = await params.lifecycleTiming.measure("supervision-model-probe-fork", async () => {
+			try {
+				return await params.client.request("thread/fork", probeParams, { signal: params.signal });
+			} catch (error) {
+				if (!(error instanceof CodexAppServerRpcError)) throw new CodexAppServerUnsafeSubscriptionError("Codex model probe fork may have materialized without a response", { cause: error });
+				throw error;
+			}
+		});
+		const probeThreadId = requireDistinctSupervisionThreadId({
+			threadId: readSupervisionResponseThreadId(rawProbeResponse),
+			sourceThreadId: pending.sourceThreadId,
+			role: "model probe"
+		});
+		pending = await trackPendingSupervisionArtifacts(params, pending, [probeThreadId]);
+		params.throwIfAborted();
+		const probeResponse = assertCodexThreadForkResponse(rawProbeResponse);
+		const nativeModel = requireNonBlankSupervisionValue(probeResponse.model, "native model");
+		const nativeModelProvider = requireNativeSupervisionModelProvider({
+			responseModelProvider: probeResponse.modelProvider,
+			responseThreadModelProvider: probeResponse.thread.modelProvider
+		});
+		const startParams = buildThreadStartParams({
+			...params.attempt,
+			modelId: nativeModel
+		}, {
+			cwd: params.cwd,
+			dynamicTools: params.dynamicTools,
+			appServer: params.appServer,
+			developerInstructions: params.developerInstructions,
+			config: params.config,
+			nativeCodeModeEnabled: params.nativeCodeModeEnabled,
+			nativeProviderWebSearchSupport: params.nativeProviderWebSearchSupport,
+			nativeCodeModeOnlyEnabled: params.nativeCodeModeOnlyEnabled,
+			webSearchAllowed: params.webSearchAllowed,
+			environmentSelection: params.environmentSelection,
+			model: nativeModel,
+			modelProvider: nativeModelProvider
+		});
+		assertExactSupervisionModelSelection(startParams, {
+			model: nativeModel,
+			modelProvider: nativeModelProvider,
+			operation: "thread/start request"
+		});
+		const rawStartResponse = await params.lifecycleTiming.measure("supervision-thread-start", async () => {
+			try {
+				return await params.client.request("thread/start", startParams, { signal: params.signal });
+			} catch (error) {
+				if (error instanceof CodexAppServerRpcError) throw new CodexThreadStartRequestError(error);
+				throw new CodexAppServerUnsafeSubscriptionError("Canonical Codex branch may have started without a response", { cause: error });
+			}
+		});
+		const finalThreadId = requireDistinctSupervisionThreadId({
+			threadId: readSupervisionResponseThreadId(rawStartResponse),
+			sourceThreadId: pending.sourceThreadId,
+			otherThreadId: probeThreadId,
+			role: "canonical branch"
+		});
+		pending = await trackPendingSupervisionArtifacts(params, pending, [probeThreadId, finalThreadId]);
+		params.throwIfAborted();
+		assertExactSupervisionModelSelection(assertCodexThreadStartResponse(rawStartResponse), {
+			model: nativeModel,
+			modelProvider: nativeModelProvider,
+			operation: "thread/start response"
+		});
+		if (history.responseItems.length > 0) {
+			await params.lifecycleTiming.measure("supervision-history-inject", () => params.client.request("thread/inject_items", {
+				threadId: finalThreadId,
+				items: history.responseItems
+			}, { signal: params.signal }));
+			params.throwIfAborted();
+		}
+		if (!await archiveSupervisionArtifact(params.client, probeThreadId)) throw new Error(`Failed to archive temporary Codex model probe: ${probeThreadId}`);
+		pending = await trackPendingSupervisionArtifacts(params, pending, [finalThreadId]);
+		const historyCoveredThrough = (/* @__PURE__ */ new Date()).toISOString();
+		const bindingModelProvider = params.normalizeBindingModelProvider(params.attempt.authProfileId, nativeModelProvider);
+		let committed = false;
+		try {
+			committed = await params.bindingStore.mutate(params.bindingIdentity, {
+				kind: "commit-pending-supervision-branch",
+				expected: pending,
+				threadId: finalThreadId,
+				patch: {
+					...params.bindingPatch,
+					model: nativeModel,
+					modelProvider: bindingModelProvider,
+					historyCoveredThrough
+				}
+			});
+		} catch (error) {
+			let current;
+			try {
+				current = await params.bindingStore.read(params.bindingIdentity);
+			} catch (readError) {
+				provisionalCleanupSafe = false;
+				throw new CodexAppServerUnsafeSubscriptionError(`Canonical Codex branch binding could not be verified: ${finalThreadId}`, { cause: new AggregateError([error, readError]) });
+			}
+			if (matchesMaterializedSupervisionBranch(current, {
+				sourceThreadId: pending.sourceThreadId,
+				connectionFingerprint,
+				threadId: finalThreadId,
+				model: nativeModel,
+				modelProvider: bindingModelProvider,
+				historyCoveredThrough
+			})) committed = true;
+			else {
+				if (!matchesPendingSupervisionState(current, pending)) {
+					provisionalCleanupSafe = false;
+					throw new CodexAppServerUnsafeSubscriptionError(`Canonical Codex branch binding changed while commit was uncertain: ${finalThreadId}`, { cause: error });
+				}
+				throw error;
+			}
+		}
+		if (!committed) throw new CodexThreadBindingConflictError(pending.sourceThreadId, "committing a supervised Codex branch");
+		bindingCommitted = true;
+		params.lifecycleTiming.mark("thread-ready");
+		params.lifecycleTiming.logSummary({
+			runId: params.attempt.runId,
+			sessionId: params.attempt.sessionId,
+			sessionKey: params.attempt.sessionKey,
+			threadId: finalThreadId,
+			action: "forked"
+		});
+		return {
+			...params.binding,
+			...params.bindingPatch,
+			threadId: finalThreadId,
+			pendingSupervisionBranch: void 0,
+			model: nativeModel,
+			modelProvider: bindingModelProvider,
+			historyCoveredThrough,
+			lifecycle: { action: "forked" }
+		};
+	} catch (error) {
+		if (bindingCommitted) throw error;
+		if (error instanceof CodexThreadBindingConflictAfterCleanupError) throw error;
+		if (!provisionalCleanupSafe) {
+			await params.abandonClient();
+			throw error;
+		}
+		const cleanup = await cleanPendingSupervisionArtifacts(params.client, pending);
+		let cleanupStateError;
+		if (cleanup.remaining.length !== (pending.cleanupThreadIds?.length ?? 0)) {
+			const nextPending = withPendingSupervisionCleanup(pending, cleanup.remaining);
+			try {
+				if (await params.bindingStore.mutate(params.bindingIdentity, {
+					kind: "patch-pending-supervision-branch",
+					expected: pending,
+					pending: nextPending
+				})) pending = nextPending;
+			} catch (stateError) {
+				cleanupStateError = stateError;
+			}
+		}
+		const unsafeCleanup = cleanup.remaining.length > 0 || isCodexAppServerUnsafeSubscriptionError(error);
+		if (unsafeCleanup) await params.abandonClient();
+		if (cleanupStateError) {
+			const cause = new AggregateError([error, cleanupStateError]);
+			if (unsafeCleanup) throw new CodexAppServerUnsafeSubscriptionError("Codex supervised branch cleanup state could not be recorded", { cause });
+			throw new AggregateError([error, cleanupStateError], "Codex supervised branch cleanup state could not be recorded", { cause: error });
+		}
+		if (cleanup.remaining.length > 0) throw new CodexAppServerUnsafeSubscriptionError(`Codex supervised branch cleanup remains pending: ${cleanup.remaining.join(", ")}`, { cause: error });
+		throw error;
+	}
+}
+function buildPendingSupervisionProbeForkParams(params, pending) {
+	const runtimeConfig = buildCodexRuntimeThreadConfigForRun(params.attempt, params.config, {
+		nativeCodeModeEnabled: params.nativeCodeModeEnabled,
+		nativeProviderWebSearchSupport: params.nativeProviderWebSearchSupport,
+		nativeCodeModeOnlyEnabled: params.nativeCodeModeOnlyEnabled,
+		webSearchAllowed: params.webSearchAllowed,
+		appServer: params.appServer
+	});
+	return {
+		threadId: pending.sourceThreadId,
+		...pending.lastTurnId ? { lastTurnId: pending.lastTurnId } : {},
+		cwd: params.cwd,
+		approvalPolicy: params.appServer.approvalPolicy,
+		approvalsReviewer: resolveCodexThreadApprovalsReviewer(params.appServer, runtimeConfig),
+		...codexThreadSandboxOrPermissions(params.appServer),
+		...params.appServer.serviceTier !== void 0 ? { serviceTier: params.appServer.serviceTier } : {},
+		config: runtimeConfig,
+		developerInstructions: params.developerInstructions ?? buildDeveloperInstructions(params.attempt, { dynamicTools: params.dynamicTools }),
+		ephemeral: false,
+		threadSource: "appServer",
+		excludeTurns: true
+	};
+}
+function assertPendingSupervisionSnapshotUnchanged(thread, pending) {
+	if (pending.lastTurnId) return;
+	if (thread.status?.type === "active" || (thread.turns?.length ?? 0) > 0) throw new Error("Codex source changed after Continue; reopen the source session before sending a message");
+}
+function requireNonBlankSupervisionValue(value, label) {
+	if (typeof value !== "string" || !value.trim()) throw new Error(`Codex supervision ${label} is missing`);
+	return value.trim();
+}
+function requireNativeSupervisionModelProvider(params) {
+	const responseProvider = requireNonBlankSupervisionValue(params.responseModelProvider, "native model provider");
+	const threadProvider = params.responseThreadModelProvider?.trim();
+	if (threadProvider && threadProvider !== responseProvider) throw new Error(`Codex supervision model provider mismatch: ${responseProvider} != ${threadProvider}`);
+	return responseProvider;
+}
+function assertExactSupervisionModelSelection(value, expected) {
+	if (value.model !== expected.model || value.modelProvider !== expected.modelProvider) throw new Error(`Codex supervision ${expected.operation} changed native model selection: ${value.modelProvider ?? "unknown"}/${value.model ?? "unknown"}`);
+}
+function matchesPendingSupervisionState(binding, expected) {
+	const pending = binding?.pendingSupervisionBranch;
+	const cleanupThreadIds = pending?.cleanupThreadIds ?? [];
+	const expectedCleanupThreadIds = expected.cleanupThreadIds ?? [];
+	return binding?.threadId === expected.sourceThreadId && binding.connectionScope === "supervision" && binding.supervisionSourceThreadId === expected.sourceThreadId && pending?.sourceThreadId === expected.sourceThreadId && pending.connectionFingerprint === expected.connectionFingerprint && pending.lastTurnId === expected.lastTurnId && cleanupThreadIds.length === expectedCleanupThreadIds.length && cleanupThreadIds.every((threadId, index) => threadId === expectedCleanupThreadIds[index]);
+}
+function matchesMaterializedSupervisionBranch(binding, expected) {
+	return binding?.threadId === expected.threadId && binding.connectionScope === "supervision" && binding.supervisionSourceThreadId === expected.sourceThreadId && binding.appServerRuntimeFingerprint === expected.connectionFingerprint && binding.pendingSupervisionBranch === void 0 && binding.model === expected.model && binding.modelProvider === expected.modelProvider && binding.historyCoveredThrough === expected.historyCoveredThrough;
+}
+function requireDistinctSupervisionThreadId(params) {
+	let threadId;
+	try {
+		threadId = requireNonBlankSupervisionValue(params.threadId, `${params.role} thread id`);
+	} catch (error) {
+		throw new CodexAppServerUnsafeSubscriptionError(`Codex supervision ${params.role} may have materialized without a safe thread id`, { cause: error });
+	}
+	if (threadId === params.sourceThreadId || threadId === params.otherThreadId) throw new CodexAppServerUnsafeSubscriptionError(`Codex supervision ${params.role} reused an existing thread: ${threadId}`);
+	return threadId;
+}
+function readSupervisionResponseThreadId(value) {
+	if (!value || typeof value !== "object" || Array.isArray(value)) return;
+	const thread = value.thread;
+	if (!thread || typeof thread !== "object" || Array.isArray(thread)) return;
+	return thread.id;
+}
+async function recoverPendingSupervisionArtifacts(params, pending) {
+	if (!pending.cleanupThreadIds?.length) return pending;
+	const cleanup = await cleanPendingSupervisionArtifacts(params.client, pending);
+	const next = withPendingSupervisionCleanup(pending, cleanup.remaining);
+	if (cleanup.remaining.length > 0) {
+		if (cleanup.remaining.length !== pending.cleanupThreadIds.length) {
+			if (!await params.bindingStore.mutate(params.bindingIdentity, {
+				kind: "patch-pending-supervision-branch",
+				expected: pending,
+				pending: next
+			})) throw new CodexThreadBindingConflictError(pending.sourceThreadId, "recording supervised Codex cleanup recovery");
+		}
+		throw new Error(`Codex supervised branch cleanup must finish before retry: ${cleanup.remaining.join(", ")}`);
+	}
+	if (!await params.bindingStore.mutate(params.bindingIdentity, {
+		kind: "patch-pending-supervision-branch",
+		expected: pending,
+		pending: next
+	})) throw new CodexThreadBindingConflictError(pending.sourceThreadId, "recovering a supervised Codex branch");
+	return next;
+}
+async function trackPendingSupervisionArtifacts(params, pending, cleanupThreadIds) {
+	const next = withPendingSupervisionCleanup(pending, cleanupThreadIds);
+	if (!await params.bindingStore.mutate(params.bindingIdentity, {
+		kind: "patch-pending-supervision-branch",
+		expected: pending,
+		pending: next
+	})) {
+		const cleanupFailed = [];
+		for (const threadId of cleanupThreadIds) if (!await archiveSupervisionArtifact(params.client, threadId)) cleanupFailed.push(threadId);
+		if (cleanupFailed.length > 0) throw new CodexAppServerUnsafeSubscriptionError(`Codex supervised branch CAS cleanup failed: ${cleanupFailed.join(", ")}`);
+		throw new CodexThreadBindingConflictAfterCleanupError(pending.sourceThreadId, "tracking supervised Codex branch cleanup");
+	}
+	return next;
+}
+function withPendingSupervisionCleanup(pending, cleanupThreadIds) {
+	return {
+		sourceThreadId: pending.sourceThreadId,
+		...pending.connectionFingerprint ? { connectionFingerprint: pending.connectionFingerprint } : {},
+		...pending.lastTurnId ? { lastTurnId: pending.lastTurnId } : {},
+		...cleanupThreadIds.length > 0 ? { cleanupThreadIds } : {}
+	};
+}
+async function cleanPendingSupervisionArtifacts(client, pending) {
+	const remaining = [];
+	for (const threadId of pending.cleanupThreadIds ?? []) if (!await archiveSupervisionArtifact(client, threadId)) remaining.push(threadId);
+	return { remaining };
+}
+async function archiveSupervisionArtifact(client, threadId) {
+	try {
+		await client.request("thread/archive", { threadId }, { timeoutMs: CODEX_APP_SERVER_UNSUBSCRIBE_TIMEOUT_MS });
+		return true;
+	} catch (error) {
+		const message = formatErrorMessage(error).toLowerCase();
+		if (message.includes("no rollout found for thread id") || message.includes("thread not found") || message.includes("already archived")) return true;
+		await unsubscribeCodexThreadBestEffort(client, {
+			threadId,
+			timeoutMs: CODEX_APP_SERVER_UNSUBSCRIBE_TIMEOUT_MS
+		});
+		embeddedAgentLog.warn("failed to archive temporary Codex supervision thread", {
+			threadId,
+			error
+		});
+		return false;
+	}
+}
 function shouldRotateCodexAppServerBindingForRuntime(params) {
 	if (!params.current) return false;
 	if (params.binding === params.current) return false;
@@ -2191,6 +2508,7 @@ function shouldRecheckRecoverablePluginBinding(params) {
 	return Object.keys(policyContext.apps).length === 0 || expectedPluginConfigKeys.length > 0;
 }
 function buildThreadStartParams(params, options) {
+	const ringZeroActive = (options.hostSystemAgentActive ?? isHostScopedAgentToolActive("openclaw")) && isSystemAgentOnlyCodexDynamicToolAllowlist(params.toolsAllow);
 	const resolvedModelProvider = resolveCodexAppServerModelProvider({
 		provider: params.provider,
 		authProfileId: params.authProfileId,
@@ -2216,12 +2534,16 @@ function buildThreadStartParams(params, options) {
 		...options.appServer.serviceTier !== void 0 ? { serviceTier: options.appServer.serviceTier } : {},
 		personality: CODEX_NATIVE_PERSONALITY_NONE,
 		serviceName: "OpenClaw",
+		...ringZeroActive ? { baseInstructions: CODEX_RING_ZERO_BASE_INSTRUCTIONS } : {},
 		config: buildCodexRuntimeThreadConfigForRun(params, options.config, {
 			nativeCodeModeEnabled: options.nativeCodeModeEnabled,
 			nativeProviderWebSearchSupport: options.nativeProviderWebSearchSupport,
 			nativeCodeModeOnlyEnabled: options.nativeCodeModeOnlyEnabled,
+			directOnlyToolNamespaces: resolveDirectOnlyToolNamespaces(options.dynamicTools),
 			webSearchAllowed: options.webSearchAllowed,
-			appServer: options.appServer
+			appServer: options.appServer,
+			hostSystemAgentActive: options.hostSystemAgentActive,
+			ringZeroInheritedMcpServerNames: options.ringZeroInheritedMcpServerNames
 		}),
 		...resolveCodexThreadEnvironmentSelection(options),
 		developerInstructions: options.developerInstructions ?? buildDeveloperInstructions(params, { dynamicTools: options.dynamicTools }),
@@ -2230,16 +2552,15 @@ function buildThreadStartParams(params, options) {
 	};
 }
 function buildThreadResumeParams(params, options) {
-	const resolvedModelProvider = resolveCodexAppServerModelProvider({
-		provider: params.provider,
-		authProfileId: options.authProfileId ?? params.authProfileId,
-		authProfileStore: params.authProfileStore,
-		agentDir: params.agentDir,
-		config: params.config
-	});
-	const modelSelection = resolveCodexAppServerRequestModelSelection({
+	const modelSelection = options.preserveNativeModel ? void 0 : resolveCodexAppServerRequestModelSelection({
 		model: options.model ?? params.modelId,
-		modelProvider: options.modelProvider ?? resolvedModelProvider,
+		modelProvider: options.modelProvider ?? resolveCodexAppServerModelProvider({
+			provider: params.provider,
+			authProfileId: options.authProfileId ?? params.authProfileId,
+			authProfileStore: params.authProfileStore,
+			agentDir: params.agentDir,
+			config: params.config
+		}),
 		authProfileId: options.authProfileId ?? params.authProfileId,
 		authProfileStore: params.authProfileStore,
 		agentDir: params.agentDir,
@@ -2247,8 +2568,10 @@ function buildThreadResumeParams(params, options) {
 	});
 	return {
 		threadId: options.threadId,
-		model: modelSelection.model,
-		...modelSelection.modelProvider ? { modelProvider: modelSelection.modelProvider } : {},
+		...modelSelection ? {
+			model: modelSelection.model,
+			...modelSelection.modelProvider ? { modelProvider: modelSelection.modelProvider } : {}
+		} : {},
 		approvalPolicy: options.appServer.approvalPolicy,
 		approvalsReviewer: resolveCodexThreadApprovalsReviewer(options.appServer, options.config),
 		...codexThreadSandboxOrPermissions(options.appServer),
@@ -2258,8 +2581,11 @@ function buildThreadResumeParams(params, options) {
 			nativeCodeModeEnabled: options.nativeCodeModeEnabled,
 			nativeProviderWebSearchSupport: options.nativeProviderWebSearchSupport,
 			nativeCodeModeOnlyEnabled: options.nativeCodeModeOnlyEnabled,
+			directOnlyToolNamespaces: resolveDirectOnlyToolNamespaces(options.dynamicTools),
 			webSearchAllowed: options.webSearchAllowed,
-			appServer: options.appServer
+			appServer: options.appServer,
+			hostSystemAgentActive: options.hostSystemAgentActive,
+			ringZeroInheritedMcpServerNames: options.ringZeroInheritedMcpServerNames
 		}),
 		developerInstructions: options.developerInstructions ?? buildDeveloperInstructions(params, { dynamicTools: options.dynamicTools })
 	};
@@ -2332,13 +2658,29 @@ function buildCodexRuntimeThreadConfig(config, options = {}) {
 		delete disabledConfig["features.apply_patch_streaming_events"];
 		return disabledConfig;
 	}
-	if (options.nativeCodeModeOnlyEnabled === true) return mergeCodexThreadConfigs(codeModeConfig, config, { "features.code_mode_only": true }) ?? {
+	if (options.nativeCodeModeOnlyEnabled === true) return ensureDirectOnlyToolNamespaces(mergeCodexThreadConfigs(codeModeConfig, config, { "features.code_mode_only": true }) ?? {
 		...codeModeConfig,
 		"features.code_mode_only": true
+	}, options.directOnlyToolNamespaces);
+	return ensureDirectOnlyToolNamespaces(mergeCodexThreadConfigs(codeModeConfig, config) ?? { ...codeModeConfig }, options.directOnlyToolNamespaces);
+}
+function ensureDirectOnlyToolNamespaces(config, requiredNamespaces) {
+	if (!requiredNamespaces?.length) return config;
+	const configured = config["code_mode.direct_only_tool_namespaces"];
+	const namespaces = Array.isArray(configured) ? configured.filter((entry) => typeof entry === "string" && entry.length > 0) : [];
+	return {
+		...config,
+		"code_mode.direct_only_tool_namespaces": [.../* @__PURE__ */ new Set([...namespaces, ...requiredNamespaces])]
 	};
-	return mergeCodexThreadConfigs(codeModeConfig, config) ?? { ...codeModeConfig };
+}
+function resolveDirectOnlyToolNamespaces(dynamicTools) {
+	return (dynamicTools ?? []).filter((tool) => tool.type === "namespace" && tool.name === "openclaw_direct").map((tool) => tool.name);
 }
 function buildCodexRuntimeThreadConfigForRun(params, config, options = {}) {
+	const ringZeroActive = (options.hostSystemAgentActive ?? isHostScopedAgentToolActive("openclaw")) && isSystemAgentOnlyCodexDynamicToolAllowlist(params.toolsAllow);
+	const configMcpServers = config?.mcp_servers;
+	if (ringZeroActive && configMcpServers !== void 0 && !isJsonObject(configMcpServers)) throw new Error("Codex ring-zero received invalid thread mcp_servers config");
+	const ringZeroMcpServerNames = [...options.ringZeroInheritedMcpServerNames ?? [], ...isJsonObject(configMcpServers) ? Object.keys(configMcpServers) : []];
 	const webSearchConfig = resolveCodexWebSearchPlan({
 		config: params.config,
 		disableTools: params.disableTools,
@@ -2347,15 +2689,85 @@ function buildCodexRuntimeThreadConfigForRun(params, config, options = {}) {
 		webSearchAllowed: options.webSearchAllowed
 	}).threadConfig;
 	const baseConfig = buildCodexRuntimeThreadConfig(mergeCodexThreadConfigs(config, webSearchConfig), options);
-	const runtimeConfig = mergeCodexThreadConfigs(baseConfig, options.appServer?.networkProxy?.configPatch, shouldDisableCodexToolSearchForModel(params.modelId) ? CODEX_TOOL_SEARCH_UNSUPPORTED_THREAD_CONFIG : void 0) ?? baseConfig;
+	const runtimeConfig = mergeCodexThreadConfigs(baseConfig, options.appServer?.networkProxy?.configPatch, shouldDisableCodexToolSearchForModel(params.modelId) ? CODEX_TOOL_SEARCH_UNSUPPORTED_THREAD_CONFIG : void 0, buildCodexRingZeroThreadConfigPatch(params, options.hostSystemAgentActive, ringZeroMcpServerNames)) ?? baseConfig;
 	if (params.bootstrapContextMode !== "lightweight") return runtimeConfig;
 	return mergeCodexThreadConfigs(runtimeConfig, CODEX_LIGHTWEIGHT_CONTEXT_THREAD_CONFIG) ?? {
 		...runtimeConfig,
 		...CODEX_LIGHTWEIGHT_CONTEXT_THREAD_CONFIG
 	};
 }
+function buildCodexRingZeroThreadConfigPatch(params, hostSystemAgentActive = isHostScopedAgentToolActive("openclaw"), inheritedMcpServerNames = []) {
+	if (!hostSystemAgentActive || !isSystemAgentOnlyCodexDynamicToolAllowlist(params.toolsAllow)) return;
+	const mcpServers = Object.fromEntries([...new Set(inheritedMcpServerNames)].toSorted().map((name) => [name, { enabled: false }]));
+	return {
+		...CODEX_RING_ZERO_THREAD_CONFIG,
+		...Object.keys(mcpServers).length > 0 ? { mcp_servers: mcpServers } : {}
+	};
+}
+async function readCodexInheritedMcpServerNames(client, cwd, signal) {
+	const response = await client.request("config/read", {
+		cwd,
+		includeLayers: true
+	}, { signal });
+	if (!isJsonObject(response) || !isJsonObject(response.config)) throw new Error("Codex config/read returned an invalid effective config");
+	if (!Array.isArray(response.layers)) throw new Error("Codex config/read omitted effective config layers");
+	for (const layer of response.layers) {
+		if (!isJsonObject(layer) || !isJsonObject(layer.name) || typeof layer.name.type !== "string") throw new Error("Codex config/read returned invalid effective config layers");
+		if (layer.name.type === "legacyManagedConfigTomlFromFile" || layer.name.type === "legacyManagedConfigTomlFromMdm") throw new Error(`Codex ring-zero cannot override config layer ${layer.name.type}`);
+		if (!CODEX_RING_ZERO_OVERRIDABLE_LAYER_TYPES.has(layer.name.type)) throw new Error(`Codex ring-zero does not recognize config layer ${layer.name.type}`);
+	}
+	const configuredServers = response.config.mcp_servers;
+	if (configuredServers === void 0) return [];
+	if (!isJsonObject(configuredServers)) throw new Error("Codex config/read returned invalid mcp_servers");
+	return Object.keys(configuredServers).toSorted();
+}
+async function assertCodexRingZeroHasNoManagedHooks(client, signal) {
+	const response = await client.request("configRequirements/read", void 0, { signal });
+	if (!isJsonObject(response) || !Object.hasOwn(response, "requirements")) throw new Error("Codex configRequirements/read returned an invalid response");
+	if (response.requirements === null) return;
+	if (!isJsonObject(response.requirements)) throw new Error("Codex configRequirements/read returned invalid requirements");
+	for (const key of [
+		"hooks",
+		"managedHooks",
+		"managed_hooks"
+	]) {
+		const hooks = response.requirements[key];
+		if (hooks === void 0 || hooks === null) continue;
+		if (!isJsonObject(hooks)) throw new Error("Codex configRequirements/read returned invalid managed hooks");
+		if (hasNonEmptyJsonValue(hooks)) throw new Error("Codex ring-zero cannot override managed hooks");
+	}
+	for (const key of ["featureRequirements", "feature_requirements"]) {
+		const requirements = response.requirements[key];
+		if (requirements === void 0 || requirements === null) continue;
+		if (!isJsonObject(requirements)) throw new Error("Codex configRequirements/read returned invalid feature requirements");
+		for (const [feature, enabled] of Object.entries(requirements)) {
+			if (typeof enabled !== "boolean") throw new Error("Codex configRequirements/read returned invalid feature requirements");
+			if (enabled && CODEX_RING_ZERO_RESTRICTED_FEATURES.has(feature)) throw new Error(`Codex ring-zero cannot override required feature ${feature}`);
+		}
+	}
+}
+async function attestCodexRingZeroThreadHasNoMcpServers(client, threadId, signal) {
+	const response = await client.request("mcpServerStatus/list", {
+		threadId,
+		limit: 1,
+		detail: "toolsAndAuthOnly"
+	}, { signal });
+	if (!isJsonObject(response) || !Array.isArray(response.data)) throw new Error("Codex mcpServerStatus/list returned an invalid ring-zero attestation");
+	if (response.data.length > 0) {
+		const first = response.data[0];
+		const serverName = isJsonObject(first) && typeof first.name === "string" ? first.name : "unknown";
+		throw new Error(`Codex ring-zero MCP attestation found server ${serverName}`);
+	}
+	if (response.nextCursor !== void 0 && response.nextCursor !== null) throw new Error("Codex mcpServerStatus/list returned an invalid empty-page cursor");
+}
+function hasNonEmptyJsonValue(value) {
+	if (value === null || value === false || value === "") return false;
+	if (Array.isArray(value)) return value.length > 0;
+	if (typeof value === "object") return Object.values(value).some(hasNonEmptyJsonValue);
+	return true;
+}
 function buildTurnStartParams(params, options) {
-	const modelSelection = resolveCodexAppServerRequestModelSelection({
+	const modelSelection = options.preserveNativeTurnSettings ? void 0 : resolveCodexAppServerRequestModelSelection({
 		model: options.model ?? params.modelId,
 		modelProvider: options.modelProvider,
 		authProfileId: params.authProfileId,
@@ -2371,18 +2783,20 @@ function buildTurnStartParams(params, options) {
 		approvalPolicy: options.appServer.approvalPolicy,
 		approvalsReviewer: options.appServer.approvalsReviewer,
 		...useThreadPermissionProfile ? {} : { sandboxPolicy: options.sandboxPolicy ?? codexSandboxPolicyForTurn(options.appServer.sandbox, options.cwd) },
-		model: modelSelection.model,
-		personality: CODEX_NATIVE_PERSONALITY_NONE,
+		...modelSelection ? {
+			model: modelSelection.model,
+			personality: CODEX_NATIVE_PERSONALITY_NONE
+		} : {},
 		...options.appServer.serviceTier !== void 0 ? { serviceTier: options.appServer.serviceTier } : {},
-		effort: resolveReasoningEffort(params.thinkLevel, modelSelection.model, readCodexSupportedReasoningEfforts(params.model?.compat)),
+		...modelSelection ? { effort: resolveReasoningEffort(params.thinkLevel, modelSelection.model, readCodexSupportedReasoningEfforts(params.model?.compat)) } : {},
 		...options.environmentSelection ? { environments: options.environmentSelection } : {},
-		collaborationMode: buildTurnCollaborationMode(params, {
+		...modelSelection ? { collaborationMode: buildTurnCollaborationMode(params, {
 			model: modelSelection.model,
 			turnScopedDeveloperInstructions: options.turnScopedDeveloperInstructions,
 			skillsCollaborationInstructions: options.skillsCollaborationInstructions,
 			memoryCollaborationInstructions: options.memoryCollaborationInstructions,
 			heartbeatCollaborationInstructions: options.heartbeatCollaborationInstructions
-		})
+		}) } : {}
 	};
 }
 function resolveCodexThreadApprovalsReviewer(appServer, config) {
@@ -2467,7 +2881,23 @@ function legacyFingerprintUserMcpServersConfigPatch(configPatch) {
 	return configPatch ? JSON.stringify(stabilizeJsonValue(configPatch)) : void 0;
 }
 function fingerprintUserMcpServersConfigPatch(configPatch) {
-	return configPatch ? hashCodexAppServerBindingFingerprint(JSON.stringify(stabilizeJsonValue(configPatch))) : void 0;
+	return configPatch ? hashCodexAppServerBindingFingerprint(JSON.stringify(stabilizeJsonValue(redactUserMcpServersFingerprintSecrets(configPatch)))) : void 0;
+}
+function redactUserMcpServersFingerprintSecrets(value) {
+	if (Array.isArray(value)) return value.map(redactUserMcpServersFingerprintSecrets);
+	if (!value || typeof value !== "object") return value;
+	const next = {};
+	for (const [key, entry] of Object.entries(value)) {
+		if (key === "http_headers" && entry && typeof entry === "object" && !Array.isArray(entry)) {
+			next[key] = Object.fromEntries(Object.entries(entry).map(([header, headerValue]) => [header, header.toLowerCase() === "authorization" ? fingerprintUserMcpServersAuthorizationHeader(headerValue) : headerValue]));
+			continue;
+		}
+		next[key] = redactUserMcpServersFingerprintSecrets(entry);
+	}
+	return next;
+}
+function fingerprintUserMcpServersAuthorizationHeader(value) {
+	return typeof value === "string" && value.length > 0 ? `<redacted:sha256:${crypto$1.createHash("sha256").update(value).digest("hex")}>` : "<redacted>";
 }
 function fingerprintJsonObject(value) {
 	return JSON.stringify(stabilizeJsonValue(value));
@@ -2541,7 +2971,7 @@ function buildSkillWorkshopInstruction(dynamicTools) {
 }
 function buildVisibleReplyInstruction(params, dynamicTools) {
 	const messageToolAvailable = dynamicTools ? flattenCodexDynamicToolFunctions(dynamicTools).some((tool) => tool.name.trim() === "message") : params.disableMessageTool !== true;
-	if (params.sourceReplyDeliveryMode === "message_tool_only" && messageToolAvailable) return "Visible source replies are not automatically delivered for this run. Use `message(action=send)` for user-visible source-channel output. Do not repeat that visible content in your final answer.";
+	if (params.sourceReplyDeliveryMode === "message_tool_only" && messageToolAvailable) return "Visible source replies are not automatically delivered for this run. Use `message(action=send)` for user-visible source-channel output. For progress, set `final=false`. When the message is the completed reply to the current source conversation, set `final=true`; OpenClaw stops after confirming delivery. Do not repeat that visible content in your final answer.";
 	if (messageToolAvailable) return "For the current source conversation, reply normally in your final assistant message; OpenClaw will deliver it through the active source conversation. Use `message` only for explicit out-of-band sends, media/file sends, or sends to a different target.";
 	return "For the current source conversation, reply normally in your final assistant message; OpenClaw will deliver it through the active source conversation.";
 }
@@ -2587,4 +3017,4 @@ function resolveReasoningEffort(thinkLevel, modelId, supportedReasoningEfforts)
 	return null;
 }
 //#endregion
-export { resolveCodexContextEngineProjectionMaxChars as A, buildCodexPluginThreadConfig as B, filterCodexDynamicTools as C, resolveCodexDynamicToolsLoadingForRuntime as D, resolveCodexDynamicToolsLoading as E, closeCodexStartupClientBestEffort as F, pluginReadParams as G, mergeCodexThreadConfigs as H, interruptCodexTurnBestEffort as I, buildCodexAppInventoryCacheKey as K, retireCodexAppServerClientAfterTimedOutTurn as L, CODEX_APP_SERVER_INTERRUPT_TIMEOUT_MS as M, CODEX_APP_SERVER_UNSUBSCRIBE_TIMEOUT_MS as N, fitCodexProjectedContextForTurnStart as O, CodexAppServerUnsafeSubscriptionError as P, unsubscribeCodexThreadBestEffort as R, sanitizeInlineImageDataUrl$1 as S, normalizeCodexDynamicToolName as T, shouldBuildCodexPluginThreadConfig as U, buildCodexPluginThreadConfigInputFingerprint as V, ensureCodexPluginActivation as W, buildCodexNativeWebSearchThreadConfig as _, buildDeveloperInstructions as a, invalidInlineImageText as b, codexDynamicToolsFingerprint as c, resolveCodexAppServerModelProvider as d, resolveCodexAppServerRequestModelSelection as f, startOrResumeThread as g, resolveReasoningEffort as h, buildContextEngineBinding as i, resolveCodexContextEngineProjectionReserveTokens as j, projectContextEngineAssemblyForCodex as k, codexLegacyDynamicToolsFingerprint as l, resolveCodexBindingModelProviderFallback as m, areCodexDynamicToolFingerprintsCompatible as n, buildTurnCollaborationMode as o, resolveCodexAppServerThreadModelSelection as p, defaultCodexAppInventoryCache as q, buildCodexRuntimeThreadConfig as r, buildTurnStartParams as s, CODEX_NATIVE_PERSONALITY_NONE as t, isContextEngineBindingCompatible as u, resolveCodexWebSearchPlan as v, isForcedPrivateQaCodexRuntime as w, sanitizeCodexHistoryImagePayloads as x, isCodexAppServerProfilerEnabled as y, buildCodexPluginAppsConfigPatchFromPolicyContext as z };
+export { fitCodexProjectedContextForTurnStart as A, unsubscribeCodexThreadBestEffort as B, sanitizeInlineImageDataUrl$1 as C, normalizeCodexDynamicToolName as D, isSystemAgentOnlyCodexDynamicToolAllowlist as E, CODEX_APP_SERVER_UNSUBSCRIBE_TIMEOUT_MS as F, shouldBuildCodexPluginThreadConfig as G, buildCodexPluginThreadConfig as H, CodexAppServerUnsafeSubscriptionError as I, ensureCodexPluginActivation as K, closeCodexStartupClientBestEffort as L, resolveCodexContextEngineProjectionMaxChars as M, resolveCodexContextEngineProjectionReserveTokens as N, resolveCodexDynamicToolsLoading as O, CODEX_APP_SERVER_INTERRUPT_TIMEOUT_MS as P, interruptCodexTurnBestEffort as R, sanitizeCodexHistoryImagePayloads as S, isForcedPrivateQaCodexRuntime as T, buildCodexPluginThreadConfigInputFingerprint as U, buildCodexPluginAppsConfigPatchFromPolicyContext as V, mergeCodexThreadConfigs as W, buildCodexNativeWebSearchThreadConfig as _, buildDeveloperInstructions as a, isCodexAppServerProfilerEnabled as b, codexDynamicToolsFingerprint as c, resolveCodexAppServerModelProvider as d, resolveCodexAppServerRequestModelSelection as f, startOrResumeThread as g, resolveReasoningEffort as h, buildContextEngineBinding as i, projectContextEngineAssemblyForCodex as j, resolveCodexDynamicToolsLoadingForRuntime as k, codexLegacyDynamicToolsFingerprint as l, resolveCodexBindingModelProviderFallback as m, areCodexDynamicToolFingerprintsCompatible as n, buildTurnCollaborationMode as o, resolveCodexAppServerThreadModelSelection as p, pluginReadParams as q, buildCodexRuntimeThreadConfig as r, buildTurnStartParams as s, CODEX_NATIVE_PERSONALITY_NONE as t, isContextEngineBindingCompatible as u, resolveCodexWebSearchPlan as v, filterCodexDynamicTools as w, invalidInlineImageText as x, resumeCodexAppServerThread as y, retireCodexAppServerClientAfterTimedOutTurn as z };