@openclaw/codex 2026.7.2-beta.1 → 2026.7.2-beta.2

package/dist/{thread-lifecycle-BgLXzjvV.js → thread-lifecycle-CN_pPtPh.js}

@@ -1,22 +1,18 @@
-import { i as isJsonObject, r as flattenCodexDynamicToolFunctions } from "./protocol-BMifTfdW.js";
-import { _ as resolveCodexPluginsPolicy, n as CODEX_PLUGINS_WORKSPACE_MARKETPLACE_NAME, o as codexSandboxPolicyForTurn, t as CODEX_PLUGINS_MARKETPLACE_NAME } from "./config-c48K5HP9.js";
-import { n as assertCodexThreadResumeResponse, r as assertCodexThreadStartResponse, t as assertCodexThreadForkResponse } from "./protocol-validators-dZQ-UTOa.js";
-import { a as serializeCodexAppInventoryError, i as defaultCodexAppInventoryCache, t as buildCodexAppServerConnectionFingerprint } from "./plugin-app-cache-key-BKNjHMEs.js";
-import { O as CodexAppServerRpcError, P as isCodexAppServerPrewriteRequestCancellationError, d as retireSharedCodexAppServerClientIfCurrent, j as isCodexAppServerConnectionClosedError, k as getCodexAppServerClientInstanceId, n as clearSharedCodexAppServerClientIfCurrentAndUnclaimed, o as isCodexAppServerStartSelectionChangedError, t as clearSharedCodexAppServerClientIfCurrent } from "./shared-client-D4mFI9al.js";
-import { a as isCodexAppServerNativeAuthProfile, c as sessionBindingIdentity, i as hashCodexAppServerBindingFingerprint, n as assertCodexBindingMayBeReplaced, o as normalizeCodexAppServerBindingModelProvider, s as reclaimCurrentCodexSessionGeneration } from "./session-binding-BMfX1OX-.js";
-import { CODEX_GPT5_HEARTBEAT_PROMPT_OVERLAY } from "./prompt-overlay.js";
-import { isMaxReasoningCodexModel, isModernCodexModel, readCodexSupportedReasoningEfforts, resolveCodexFallbackReasoningEfforts, resolveCodexSupportedReasoningEffort } from "./provider.js";
-import { a as projectBoundedCodexThreadHistory } from "./transcript-mirror-DhLwFIL4.js";
+import { G as isCodexAppServerPrewriteRequestCancellationError, H as isCodexAppServerConnectionClosedError, R as CodexAppServerRpcError, X as flattenCodexDynamicToolFunctions, Z as isJsonObject, d as retireSharedCodexAppServerClientIfCurrent, n as clearSharedCodexAppServerClientIfCurrentAndUnclaimed, o as isCodexAppServerStartSelectionChangedError, t as clearSharedCodexAppServerClientIfCurrent, z as getCodexAppServerClientInstanceId } from "./shared-client-JiAnW6pc.js";
+import { T as resolveCodexPluginsPolicy, a as isCodexAppServerNativeAuthProfile, c as sessionBindingIdentity, d as CODEX_PLUGINS_WORKSPACE_MARKETPLACE_NAME, h as codexSandboxPolicyForTurn, i as hashCodexAppServerBindingFingerprint, n as assertCodexBindingMayBeReplaced, o as normalizeCodexAppServerBindingModelProvider, s as reclaimCurrentCodexSessionGeneration, u as CODEX_PLUGINS_MARKETPLACE_NAME } from "./session-binding-h1mmCGnl.js";
+import { a as projectBoundedCodexThreadHistory, d as assertCodexThreadStartResponse, l as assertCodexThreadForkResponse, u as assertCodexThreadResumeResponse } from "./transcript-mirror-D9rTxx2P.js";
+import { a as serializeCodexAppInventoryError, i as defaultCodexAppInventoryCache, t as buildCodexAppServerConnectionFingerprint } from "./plugin-app-cache-key-Ceb-lm2c.js";
 import { sliceUtf16Safe, truncateUtf16Safe } from "openclaw/plugin-sdk/text-utility-runtime";
 import * as crypto$1 from "node:crypto";
 import crypto from "node:crypto";
 import { isRecord } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { SKILL_WORKSHOP_TOOL_NAME, buildSkillWorkshopPromptSection, embeddedAgentLog, formatErrorMessage, isActiveHarnessContextEngine, isHostScopedAgentToolActive } from "openclaw/plugin-sdk/agent-harness-runtime";
+import { redactSensitiveFieldValue, redactToolPayloadText } from "openclaw/plugin-sdk/logging-core";
 import { buildCodexUserMcpServersThreadConfigPatchForRuntime } from "openclaw/plugin-sdk/codex-mcp-projection";
+import { isDiagnosticFlagEnabled } from "openclaw/plugin-sdk/diagnostic-runtime";
 import { listRegisteredPluginAgentPromptGuidance } from "openclaw/plugin-sdk/plugin-runtime";
-import { redactSensitiveFieldValue, redactToolPayloadText } from "openclaw/plugin-sdk/logging-core";
+import { GPT5_HEARTBEAT_PROMPT_OVERLAY } from "openclaw/plugin-sdk/provider-model-shared";
 import { INLINE_IMAGE_DATA_URL_PREFIX, sanitizeInlineImageDataUrl } from "openclaw/plugin-sdk/inline-image-data-url-runtime";
-import { isDiagnosticFlagEnabled } from "openclaw/plugin-sdk/diagnostic-runtime";
 //#region extensions/codex/src/app-server/plugin-inventory.ts
 /**
 * Reads Codex plugin marketplace state and app inventory to decide which
@@ -35,13 +31,13 @@ async function readCodexPluginInventory(params) {
 		}]
 	};
 	const appInventory = readCachedAppInventory(params);
-	const curatedListed = await params.request("plugin/list", { cwds: [] });
+	const curatedListed = await listCodexPluginMetadata(params, "curated-global", {});
 	const shouldListWorkspacePlugins = policy.pluginPolicies.some((pluginPolicy) => pluginPolicy.enabled && pluginPolicy.marketplaceName === "workspace-directory");
 	let workspaceListResult;
 	if (shouldListWorkspacePlugins) try {
 		workspaceListResult = {
 			kind: "listed",
-			response: await params.request("plugin/list", {
+			response: await listCodexPluginMetadata(params, "workspace-directory", {
 				cwds: [],
 				marketplaceKinds: [CODEX_PLUGINS_WORKSPACE_MARKETPLACE_NAME]
 			})
@@ -138,6 +134,31 @@ function pluginReadParams(marketplace, pluginName) {
 		pluginName
 	};
 }
+/** Returns configured plugin keys whose current metadata may still recover. */
+function resolveRecoverableCodexPluginConfigKeys(params) {
+	return params.policy.pluginPolicies.filter((pluginPolicy) => pluginPolicy.enabled && !isSettledMissingPluginPolicy({
+		pluginPolicy,
+		metadataCache: params.metadataCache,
+		appCacheKey: params.appCacheKey
+	})).map((pluginPolicy) => pluginPolicy.configKey).toSorted();
+}
+async function listCodexPluginMetadata(params, queryKind, requestParams) {
+	if (!params.metadataCache || !params.appCacheKey || queryKind === "workspace-directory") return await params.request("plugin/list", requestParams);
+	return (await params.metadataCache.load({
+		appCacheKey: params.appCacheKey,
+		queryKind,
+		requestParams,
+		request: async (method, listedParams) => await params.request(method, listedParams),
+		cacheable: (response) => (response.marketplaces ?? []).some((marketplace) => isOpenAiCuratedMarketplace(marketplace))
+	})).response;
+}
+function isSettledMissingPluginPolicy(params) {
+	const queryKind = params.pluginPolicy.marketplaceName === "workspace-directory" ? "workspace-directory" : "curated-global";
+	const listed = params.metadataCache.read(params.appCacheKey, queryKind)?.response;
+	if (!listed) return false;
+	if (queryKind === "workspace-directory") return !findWorkspaceMarketplacePlugin(listed, params.pluginPolicy.pluginName);
+	return !findOpenAiCuratedMarketplacePlugin(listed, params.pluginPolicy.pluginName);
+}
 function readCachedAppInventory(params) {
 	if (!params.appCache || !params.appCacheKey) return;
 	const request = async (method, requestParams) => await params.request(method, requestParams);
@@ -237,6 +258,7 @@ function marketplaceRef(marketplace, name) {
 		...!marketplace.path ? { remoteMarketplaceName: marketplace.name } : {}
 	};
 }
+/** True for either supported OpenAI curated marketplace wire name. */
 function isOpenAiCuratedMarketplace(marketplace) {
 	return marketplace.name === "openai-curated" || marketplace.name === CODEX_PLUGINS_REMOTE_MARKETPLACE_NAME;
 }
@@ -245,10 +267,10 @@ function isOpenAiCuratedMarketplace(marketplace) {
 /** Activates a curated plugin or rejects a workspace plugin that is not already active. */
 async function ensureCodexPluginActivation(params) {
 	if (params.identity.marketplaceName === "workspace-directory") return activationFailure(params.identity, "disabled", { message: "workspace-directory plugins must be installed and enabled outside OpenClaw before use." });
-	const listed = await params.request("plugin/list", { cwds: [] });
+	const listed = await listCuratedCodexPluginMetadata(params);
 	const resolved = findOpenAiCuratedPluginSummary(listed, params.identity.pluginName);
 	if (!resolved) {
-		if (!listed.marketplaces.some((marketplace) => marketplace.name === "openai-curated")) return activationFailure(params.identity, "marketplace_missing", { message: `Codex marketplace ${CODEX_PLUGINS_MARKETPLACE_NAME} was not found.` });
+		if (!listed.marketplaces.some(isOpenAiCuratedMarketplace)) return activationFailure(params.identity, "marketplace_missing", { message: `Codex marketplace ${CODEX_PLUGINS_MARKETPLACE_NAME} was not found.` });
 		return activationFailure(params.identity, "plugin_missing", { message: `${params.identity.pluginName} was not found in ${CODEX_PLUGINS_MARKETPLACE_NAME}.` });
 	}
 	if (resolved.summary.installed && resolved.summary.enabled && !params.installEvenIfActive) return {
@@ -260,6 +282,7 @@ async function ensureCodexPluginActivation(params) {
 		diagnostics: []
 	};
 	const installResponse = await params.request("plugin/install", pluginReadParams(resolved.marketplace, resolved.marketplace.remoteMarketplaceName && resolved.summary.remotePluginId ? resolved.summary.remotePluginId : params.identity.pluginName));
+	if (params.metadataCache && params.appCacheKey) params.metadataCache.invalidate(params.appCacheKey);
 	const refreshDiagnostics = [];
 	let refreshFailed = false;
 	try {
@@ -267,6 +290,7 @@ async function ensureCodexPluginActivation(params) {
 			request: params.request,
 			appCache: params.appCache,
 			appCacheKey: params.appCacheKey,
+			metadataCache: params.metadataCache,
 			targetAppIds: params.targetAppIds
 		});
 		refreshDiagnostics.push(...refreshResult.diagnostics);
@@ -288,7 +312,7 @@ async function ensureCodexPluginActivation(params) {
 /** Forces Codex plugin, skill, hook, MCP, and app inventory refreshes after activation. */
 async function refreshCodexPluginRuntimeState(params) {
 	const diagnostics = [];
-	await params.request("plugin/list", { cwds: [] });
+	await listCuratedCodexPluginMetadata(params);
 	await params.request("skills/list", {
 		cwds: [],
 		forceReload: true
@@ -315,6 +339,17 @@ async function refreshCodexPluginRuntimeState(params) {
 	}
 	return { diagnostics };
 }
+async function listCuratedCodexPluginMetadata(params) {
+	const requestParams = {};
+	if (!params.metadataCache || !params.appCacheKey) return await params.request("plugin/list", requestParams);
+	return (await params.metadataCache.load({
+		appCacheKey: params.appCacheKey,
+		queryKind: "curated-global",
+		requestParams,
+		request: async (method, listedParams) => await params.request(method, listedParams),
+		cacheable: (response) => (response.marketplaces ?? []).some((marketplace) => isOpenAiCuratedMarketplace(marketplace))
+	})).response;
+}
 function activationFailure(identity, reason, diagnostic, extraDiagnostics = []) {
 	return {
 		identity,
@@ -345,6 +380,20 @@ function buildCodexPluginThreadConfigInputFingerprint(params) {
 		appCacheKey: params.appCacheKey ?? null
 	});
 }
+/** Builds the deny-all app patch used when plugin discovery exceeds its turn budget. */
+function buildCodexPluginThreadConfigTimeoutFallback(params) {
+	return {
+		...emptyPluginThreadConfig({
+			enabled: true,
+			inputFingerprint: buildCodexPluginThreadConfigInputFingerprint(params),
+			configPatch: buildDisabledAppsConfigPatch()
+		}),
+		diagnostics: [{
+			code: "plugin_config_timeout",
+			message: params.message
+		}]
+	};
+}
 /** Builds the Codex apps config patch and policy context for a native thread. */
 async function buildCodexPluginThreadConfig(params) {
 	const appCache = params.appCache ?? defaultCodexAppInventoryCache;
@@ -364,6 +413,7 @@ async function buildCodexPluginThreadConfig(params) {
 		request: params.request,
 		appCache,
 		appCacheKey: params.appCacheKey,
+		metadataCache: params.metadataCache,
 		nowMs: params.nowMs,
 		suppressAppInventoryRefresh: true
 	}) : emptyCodexPluginInventory(policy);
@@ -380,6 +430,7 @@ async function buildCodexPluginThreadConfig(params) {
 			request: params.request,
 			appCache,
 			appCacheKey: params.appCacheKey,
+			metadataCache: params.metadataCache,
 			nowMs: params.nowMs
 		});
 		inputFingerprint = buildCodexPluginThreadConfigInputFingerprint({
@@ -396,6 +447,7 @@ async function buildCodexPluginThreadConfig(params) {
 			request: params.request,
 			appCache,
 			appCacheKey: params.appCacheKey,
+			metadataCache: params.metadataCache,
 			targetAppIds: record.ownedAppIds
 		});
 		activationResults.push(activation);
@@ -419,6 +471,7 @@ async function buildCodexPluginThreadConfig(params) {
 			request: params.request,
 			appCache,
 			appCacheKey: params.appCacheKey,
+			metadataCache: params.metadataCache,
 			nowMs: params.nowMs
 		});
 		inputFingerprint = buildCodexPluginThreadConfigInputFingerprint({
@@ -438,6 +491,7 @@ async function buildCodexPluginThreadConfig(params) {
 			request: params.request,
 			appCache,
 			appCacheKey: params.appCacheKey,
+			metadataCache: params.metadataCache,
 			nowMs: params.nowMs
 		});
 		inputFingerprint = buildCodexPluginThreadConfigInputFingerprint({
@@ -755,129 +809,6 @@ function stableStringify(value) {
 	return JSON.stringify(value);
 }
 //#endregion
-//#region extensions/codex/src/app-server/attempt-client-cleanup.ts
-/**
-* Best-effort cleanup helpers for Codex app-server startup attempts and turns.
-*/
-/** Timeout for best-effort app-server turn interruption during cleanup. */
-const CODEX_APP_SERVER_INTERRUPT_TIMEOUT_MS = 5e3;
-/** Timeout for best-effort thread unsubscribe during cleanup. */
-const CODEX_APP_SERVER_UNSUBSCRIBE_TIMEOUT_MS = 5e3;
-/** Raised when a thread subscription may be live on a client OpenClaw no longer controls. */
-var CodexAppServerUnsafeSubscriptionError = class extends Error {
-	constructor(message, options) {
-		super(message, options);
-		this.name = "CodexAppServerUnsafeSubscriptionError";
-	}
-};
-function isCodexAppServerUnsafeSubscriptionError(error) {
-	return error instanceof CodexAppServerUnsafeSubscriptionError;
-}
-/** Asserts Codex resumed the exact thread this attempt subscribed to. */
-function assertCodexThreadResumeSubscription(requestedThreadId, returnedThreadId) {
-	if (returnedThreadId !== requestedThreadId) throw new CodexAppServerUnsafeSubscriptionError(`Codex thread/resume returned ${returnedThreadId} for ${requestedThreadId}`);
-}
-async function closeClientAndWaitIfAvailable(client) {
-	const closeable = client;
-	if (typeof closeable.closeAndWait === "function") {
-		await closeable.closeAndWait();
-		return;
-	}
-	closeable.close?.();
-}
-async function closeCodexStartupClientBestEffort(client) {
-	if (!client) return;
-	const unclaimedSharedClient = clearSharedCodexAppServerClientIfCurrentAndUnclaimed(client);
-	if (unclaimedSharedClient.closed) {
-		await closeClientAndWaitIfAvailable(client);
-		return;
-	}
-	if (unclaimedSharedClient.found) {
-		if (retireSharedCodexAppServerClientIfCurrent(client)?.closed) await closeClientAndWaitIfAvailable(client);
-		return;
-	}
-	const retiredSharedClient = retireSharedCodexAppServerClientIfCurrent(client);
-	if (retiredSharedClient) {
-		if (retiredSharedClient.closed) await closeClientAndWaitIfAvailable(client);
-		return;
-	}
-	if (clearSharedCodexAppServerClientIfCurrent(client)) {
-		await closeClientAndWaitIfAvailable(client);
-		return;
-	}
-	await closeClientAndWaitIfAvailable(client);
-}
-/** Sends a turn interrupt without blocking abort cleanup on app-server errors. */
-function interruptCodexTurnBestEffort(client, params) {
-	const requestOptions = params.timeoutMs && Number.isFinite(params.timeoutMs) && params.timeoutMs > 0 ? { timeoutMs: params.timeoutMs } : void 0;
-	const requestParams = {
-		threadId: params.threadId,
-		turnId: params.turnId
-	};
-	try {
-		const interrupt = requestOptions ? client.request("turn/interrupt", requestParams, requestOptions) : client.request("turn/interrupt", requestParams);
-		Promise.resolve(interrupt).catch((error) => {
-			embeddedAgentLog.debug("codex app-server turn interrupt failed during abort", { error });
-		});
-	} catch (error) {
-		embeddedAgentLog.debug("codex app-server turn interrupt failed during abort", { error });
-	}
-}
-/** Unsubscribes from a thread while swallowing cleanup-only failures. */
-async function unsubscribeCodexThreadBestEffort(client, params) {
-	try {
-		await client.request("thread/unsubscribe", { threadId: params.threadId }, { timeoutMs: params.timeoutMs });
-		return true;
-	} catch (error) {
-		embeddedAgentLog.debug("codex app-server thread unsubscribe cleanup failed", {
-			threadId: params.threadId,
-			error
-		});
-		return false;
-	}
-}
-/**
-* Retires the shared client after a timed-out turn so later runs do not reuse a
-* potentially wedged app-server connection.
-*/
-async function retireCodexAppServerClientAfterTimedOutTurn(client, params) {
-	const retiredSharedClient = retireSharedCodexAppServerClientIfCurrent(client, { failActiveLeases: params.suspectPhysicalClient });
-	const detachedSharedClient = Boolean(retiredSharedClient);
-	if (!(params.suspectPhysicalClient && (retiredSharedClient?.closed ?? false))) {
-		interruptCodexTurnBestEffort(client, {
-			threadId: params.threadId,
-			turnId: params.turnId,
-			timeoutMs: CODEX_APP_SERVER_INTERRUPT_TIMEOUT_MS
-		});
-		await unsubscribeCodexThreadBestEffort(client, {
-			threadId: params.threadId,
-			timeoutMs: CODEX_APP_SERVER_UNSUBSCRIBE_TIMEOUT_MS
-		});
-	}
-	let closedClient = retiredSharedClient?.closed ?? false;
-	if (!detachedSharedClient) {
-		const close = client.close;
-		if (typeof close === "function") try {
-			close.call(client);
-			closedClient = true;
-		} catch (error) {
-			embeddedAgentLog.debug("codex app-server client close failed during timeout cleanup", {
-				threadId: params.threadId,
-				turnId: params.turnId,
-				error
-			});
-		}
-	}
-	embeddedAgentLog.warn("codex app-server client retired after timed-out turn", {
-		threadId: params.threadId,
-		turnId: params.turnId,
-		reason: params.reason,
-		detachedSharedClient,
-		closedClient,
-		activeSharedClientLeases: retiredSharedClient?.activeLeases ?? 0
-	});
-}
-//#endregion
 //#region extensions/codex/src/app-server/context-engine-projection.ts
 const CONTEXT_HEADER = "OpenClaw assembled context for this turn:";
 const CONTEXT_OPEN = "<conversation_context>";
@@ -1137,961 +1068,1332 @@ function truncateOlderContext(text, maxChars) {
 	return `${marker}${sliceUtf16Safe(text, -tailChars).trimStart()}`;
 }
 //#endregion
-//#region extensions/codex/src/app-server/dynamic-tool-profile.ts
-/** Tool names owned by Codex app-server and normally excluded from OpenClaw dynamic tools. */
-const CODEX_APP_SERVER_OWNED_DYNAMIC_TOOL_EXCLUDES = [
-	"read",
-	"write",
-	"edit",
-	"apply_patch",
-	"exec",
-	"process",
-	"update_plan",
-	"tool_call",
-	"tool_describe",
-	"tool_search",
-	"tool_search_code"
-];
-const DYNAMIC_TOOL_NAME_ALIASES = {
-	bash: "exec",
-	"apply-patch": "apply_patch"
-};
-/** Normalizes OpenClaw/Codex tool names before filtering and allowlist checks. */
-function normalizeCodexDynamicToolName(name) {
-	const normalized = name.trim().toLowerCase();
-	return DYNAMIC_TOOL_NAME_ALIASES[normalized] ?? normalized;
+//#region extensions/codex/src/app-server/thread-context-engine.ts
+function buildContextEngineBinding(params, projection) {
+	const contextEngine = isActiveHarnessContextEngine(params.contextEngine) ? params.contextEngine : void 0;
+	const engineId = contextEngine?.info?.id?.trim();
+	if (!contextEngine || !engineId) return;
+	return {
+		schemaVersion: 1,
+		engineId,
+		policyFingerprint: JSON.stringify({
+			schemaVersion: 1,
+			engineId,
+			engineVersion: contextEngine.info.version,
+			ownsCompaction: contextEngine.info.ownsCompaction === true,
+			turnMaintenanceMode: contextEngine.info.turnMaintenanceMode,
+			citationsMode: resolveContextEngineCitationsMode(params.config),
+			contextTokenBudget: params.contextTokenBudget,
+			projectionMaxChars: resolveCodexContextEngineProjectionMaxChars({
+				contextTokenBudget: params.contextTokenBudget,
+				reserveTokens: resolveCodexContextEngineProjectionReserveTokens({ config: params.config })
+			})
+		}),
+		projection: projection ? buildContextEngineProjectionBinding(projection) : void 0
+	};
 }
-/** True only for the host-scoped OpenClaw run's exact tool contract. */
-function isSystemAgentOnlyCodexDynamicToolAllowlist(toolsAllow) {
-	return toolsAllow?.length === 1 && normalizeCodexDynamicToolName(toolsAllow[0] ?? "") === "openclaw";
+function buildContextEngineProjectionBinding(projection) {
+	return {
+		schemaVersion: 1,
+		mode: "thread_bootstrap",
+		epoch: projection.epoch,
+		fingerprint: projection.fingerprint
+	};
 }
-/** Returns true for private QA runs that force the Codex runtime profile. */
-function isForcedPrivateQaCodexRuntime(env = process.env) {
-	return env.OPENCLAW_BUILD_PRIVATE_QA === "1" && env.OPENCLAW_QA_FORCE_RUNTIME?.trim().toLowerCase() === "codex";
+function isContextEngineBindingCompatible(previous, next) {
+	return previous?.schemaVersion === next.schemaVersion && previous.engineId === next.engineId && previous.policyFingerprint === next.policyFingerprint && areContextEngineProjectionBindingsCompatible(previous.projection, next.projection);
 }
-/** Resolves whether dynamic tools load directly or through Codex tool search. */
-function resolveCodexDynamicToolsLoading(config, env = process.env) {
-	return isForcedPrivateQaCodexRuntime(env) ? "direct" : config.codexDynamicToolsLoading ?? "searchable";
+function areContextEngineProjectionBindingsCompatible(previous, next) {
+	if (!next) return previous === void 0;
+	return previous?.schemaVersion === next.schemaVersion && previous.mode === next.mode && previous.epoch === next.epoch && previous.fingerprint === next.fingerprint;
 }
-function normalizeCodexModelId(modelId) {
-	const normalized = modelId?.trim().toLowerCase();
-	if (!normalized) return "";
-	return normalized.includes("/") ? normalized.split("/").at(-1) : normalized;
+function resolveContextEngineCitationsMode(config) {
+	const rootConfig = isUnknownRecord(config) ? config : void 0;
+	const citations = (isUnknownRecord(rootConfig?.memory) ? rootConfig.memory : void 0)?.citations;
+	return isJsonConfigValue(citations) ? citations : void 0;
 }
-/** Returns true when model behavior requires direct dynamic-tool registration. */
-function shouldUseDirectCodexDynamicToolsForModel(modelId) {
-	return shouldDisableCodexToolSearchForModel(modelId);
+function isUnknownRecord(value) {
+	return Boolean(value && typeof value === "object" && !Array.isArray(value));
 }
-/** Returns true for models whose tool-search path is unsupported or inefficient. */
-function shouldDisableCodexToolSearchForModel(modelId) {
-	return normalizeCodexModelId(modelId) === "gpt-5.4-nano";
+function isJsonConfigValue(value) {
+	if (value === null || typeof value === "string" || typeof value === "boolean") return true;
+	if (typeof value === "number") return Number.isFinite(value);
+	if (Array.isArray(value)) return value.every(isJsonConfigValue);
+	return isUnknownRecord(value) && Object.values(value).every(isJsonConfigValue);
 }
-/** Resolves dynamic-tool loading after applying model-specific restrictions. */
-function resolveCodexDynamicToolsLoadingForModel(config, modelId, env = process.env) {
-	const loading = resolveCodexDynamicToolsLoading(config, env);
-	return loading === "searchable" && shouldUseDirectCodexDynamicToolsForModel(modelId) ? "direct" : loading;
+//#endregion
+//#region extensions/codex/src/app-server/thread-fingerprints.ts
+function codexDynamicToolsFingerprint(dynamicTools) {
+	return fingerprintDynamicTools(dynamicTools);
 }
-/** Resolves dynamic-tool loading for the app-server connection that will execute the turn. */
-function resolveCodexDynamicToolsLoadingForRuntime(config, modelId, options = {}, env = process.env) {
-	const loading = resolveCodexDynamicToolsLoadingForModel(config, modelId, env);
-	return loading === "searchable" && options.connectionClass === "remote" ? "direct" : loading;
+function codexLegacyDynamicToolsFingerprint(dynamicTools) {
+	return legacyFingerprintDynamicTools(dynamicTools);
 }
-/** Filters OpenClaw tools that Codex owns natively or config explicitly excludes. */
-function filterCodexDynamicTools(tools, config, env = process.env) {
-	const excludes = /* @__PURE__ */ new Set();
-	if (!isForcedPrivateQaCodexRuntime(env)) for (const name of CODEX_APP_SERVER_OWNED_DYNAMIC_TOOL_EXCLUDES) excludes.add(name);
-	for (const name of config.codexDynamicToolsExclude ?? []) {
-		const trimmed = normalizeCodexDynamicToolName(name);
-		if (trimmed) excludes.add(trimmed);
-	}
-	return excludes.size === 0 ? tools : tools.filter((tool) => !excludes.has(normalizeCodexDynamicToolName(tool.name)));
+function areCodexDynamicToolFingerprintsCompatible(params) {
+	return areDynamicToolFingerprintsCompatible(params.previous, params.next, params.nextLegacy);
 }
-//#endregion
-//#region extensions/codex/src/app-server/image-payload-sanitizer.ts
-/**
-* Sanitizes inline image payloads mirrored through Codex history so invalid
-* base64 data becomes readable text instead of poisoning replayed transcripts.
-*/
-const IMAGE_OMITTED_TEXT = "omitted image payload: invalid inline image data";
-/** Validates and normalizes an inline image data URL for Codex history payloads. */
-function sanitizeInlineImageDataUrl$1(imageUrl) {
-	return sanitizeInlineImageDataUrl(imageUrl);
+function fingerprintDynamicTools(dynamicTools) {
+	return hashCodexAppServerBindingFingerprint(legacyFingerprintDynamicTools(dynamicTools));
 }
-/** Builds the replacement text inserted when an inline image payload is invalid. */
-function invalidInlineImageText(label) {
-	return `[${label}] ${IMAGE_OMITTED_TEXT}`;
+function legacyFingerprintDynamicTools(dynamicTools) {
+	return JSON.stringify(dynamicTools.map(fingerprintDynamicToolSpec).toSorted(compareJsonFingerprint));
 }
-function sanitizeImageContentRecord(record, label) {
-	if (record.type === "image" && typeof record.data === "string") {
-		const mimeType = typeof record.mimeType === "string" ? record.mimeType : "image/png";
-		const imageUrl = sanitizeInlineImageDataUrl$1(`data:${mimeType};base64,${record.data}`);
-		if (!imageUrl) return {
-			type: "text",
-			text: invalidInlineImageText(label)
-		};
-		const commaIndex = imageUrl.indexOf(",");
-		const mime = imageUrl.slice(INLINE_IMAGE_DATA_URL_PREFIX.length, commaIndex).split(";")[0] ?? mimeType;
-		return {
-			...record,
-			mimeType: mime,
-			data: imageUrl.slice(commaIndex + 1)
-		};
-	}
-	if (record.type === "inputImage" && typeof record.imageUrl === "string") {
-		const imageUrl = sanitizeInlineImageDataUrl$1(record.imageUrl);
-		return imageUrl ? {
-			...record,
-			imageUrl
-		} : {
-			type: "inputText",
-			text: invalidInlineImageText(label)
-		};
-	}
-	if (record.type === "input_image" && typeof record.image_url === "string") {
-		const imageUrl = sanitizeInlineImageDataUrl$1(record.image_url);
-		return imageUrl ? {
-			...record,
-			image_url: imageUrl
-		} : {
-			type: "input_text",
-			text: invalidInlineImageText(label)
-		};
-	}
+function legacyFingerprintUserMcpServersConfigPatch(configPatch) {
+	return configPatch ? JSON.stringify(stabilizeJsonValue(configPatch)) : void 0;
 }
-/** Recursively sanitizes all Codex history image shapes while preserving unknown structure. */
-function sanitizeCodexHistoryImagePayloads(value, label) {
-	if (Array.isArray(value)) return value.map((entry) => sanitizeCodexHistoryImagePayloads(entry, label));
-	if (!isRecord(value)) return value;
-	const imageRecord = sanitizeImageContentRecord(value, label);
-	if (imageRecord) return imageRecord;
+function fingerprintUserMcpServersConfigPatch(configPatch) {
+	return configPatch ? hashCodexAppServerBindingFingerprint(JSON.stringify(stabilizeJsonValue(redactUserMcpServersFingerprintSecrets(configPatch)))) : void 0;
+}
+function redactUserMcpServersFingerprintSecrets(value) {
+	if (Array.isArray(value)) return value.map(redactUserMcpServersFingerprintSecrets);
+	if (!value || typeof value !== "object") return value;
 	const next = {};
-	for (const [key, child] of Object.entries(value)) next[key] = sanitizeCodexHistoryImagePayloads(child, label);
+	for (const [key, entry] of Object.entries(value)) {
+		if (key === "http_headers" && entry && typeof entry === "object" && !Array.isArray(entry)) {
+			next[key] = Object.fromEntries(Object.entries(entry).map(([header, headerValue]) => [header, header.toLowerCase() === "authorization" ? fingerprintUserMcpServersAuthorizationHeader(headerValue) : headerValue]));
+			continue;
+		}
+		next[key] = redactUserMcpServersFingerprintSecrets(entry);
+	}
 	return next;
 }
-//#endregion
-//#region extensions/codex/src/app-server/profiler-flag.ts
-const PROFILER_FLAGS = ["profiler", "codex.profiler"];
-/** Checks the generic and Codex-specific profiler diagnostic flags. */
-function isCodexAppServerProfilerEnabled(config, env = process.env) {
-	return PROFILER_FLAGS.some((flag) => isDiagnosticFlagEnabled(flag, config, env));
+function fingerprintUserMcpServersAuthorizationHeader(value) {
+	return typeof value === "string" && value.length > 0 ? `<redacted:sha256:${crypto$1.createHash("sha256").update(value).digest("hex")}>` : "<redacted>";
 }
-//#endregion
-//#region extensions/codex/src/app-server/thread-resume.ts
-/** Owns Codex thread/resume subscription safety. */
-/** Resumes one thread and retires the physical client when acceptance is indeterminate. */
-async function resumeCodexAppServerThread(params) {
-	const threadId = params.request.threadId;
-	let response;
-	try {
-		response = assertCodexThreadResumeResponse(await params.client.request("thread/resume", params.request, {
-			...params.timeoutMs !== void 0 ? { timeoutMs: params.timeoutMs } : {},
-			...params.signal ? { signal: params.signal } : {}
-		}));
-		assertCodexThreadResumeSubscription(threadId, response.thread.id);
-	} catch (error) {
-		if (isCodexAppServerStartSelectionChangedError(error) || isCodexAppServerPrewriteRequestCancellationError(error)) throw error;
-		if (error instanceof CodexAppServerRpcError) throw error;
-		try {
-			await params.abandonClient();
-		} catch (abandonError) {
-			throw new CodexAppServerUnsafeSubscriptionError(`Codex thread/resume client could not be retired for ${threadId}`, { cause: abandonError });
-		}
-		if (error instanceof CodexAppServerUnsafeSubscriptionError) throw error;
-		throw new CodexAppServerUnsafeSubscriptionError(error instanceof Error ? error.message : `Codex thread/resume outcome is indeterminate for ${threadId}`, { cause: error });
+function fingerprintJsonObject(value) {
+	return JSON.stringify(stabilizeJsonValue(value));
+}
+function fingerprintEnvironmentSelection(environments) {
+	return environments ? JSON.stringify(environments.map(stabilizeJsonValue)) : void 0;
+}
+function fingerprintDynamicToolSpec(tool) {
+	return stabilizeDynamicToolFingerprintValue(tool);
+}
+function stabilizeDynamicToolFingerprintValue(value) {
+	if (Array.isArray(value)) return value.map(stabilizeDynamicToolFingerprintValue);
+	if (!isJsonObject(value)) return value;
+	const stable = {};
+	for (const [key, child] of Object.entries(value).toSorted(([left], [right]) => left.localeCompare(right))) {
+		if (key === "description") continue;
+		stable[key] = stabilizeDynamicToolFingerprintValue(child);
 	}
-	return response;
+	return stable;
 }
-//#endregion
-//#region extensions/codex/src/app-server/web-search.ts
-const CODEX_NATIVE_WEB_SEARCH_DISABLED_CONFIG = {
-	"features.standalone_web_search": false,
-	web_search: "disabled"
-};
-function normalizeOptionalString$1(value) {
-	return typeof value === "string" ? value.trim() || void 0 : void 0;
+function stabilizeJsonValue(value) {
+	if (Array.isArray(value)) return value.map(stabilizeJsonValue);
+	if (!isJsonObject(value)) return value;
+	const stable = {};
+	for (const [key, child] of Object.entries(value).toSorted(([left], [right]) => left.localeCompare(right))) stable[key] = stabilizeJsonValue(child);
+	return stable;
 }
-function normalizeUniqueStrings(value) {
-	if (!Array.isArray(value)) return;
-	const normalized = [...new Set(value.map(normalizeOptionalString$1).filter((entry) => Boolean(entry)))];
-	return normalized.length > 0 ? normalized : void 0;
+function readActiveCodexTurnIds(thread) {
+	return (thread.turns ?? []).filter((turn) => turn.status === "inProgress").map((turn) => typeof turn.id === "string" ? turn.id : "").filter((turnId) => turnId.trim().length > 0);
 }
-function hasManagedSearchProvider(config) {
-	return normalizeOptionalString$1(config?.tools?.web?.search?.provider) !== void 0;
+const LEGACY_EMPTY_DYNAMIC_TOOLS_FINGERPRINT = legacyFingerprintDynamicTools([]);
+const EMPTY_DYNAMIC_TOOLS_FINGERPRINT = hashCodexAppServerBindingFingerprint(LEGACY_EMPTY_DYNAMIC_TOOLS_FINGERPRINT);
+function areDynamicToolFingerprintsCompatible(previous, next, nextLegacy) {
+	return !previous || previous === next || previous === nextLegacy;
 }
-function hasNativeDomainRestrictions(config) {
-	return normalizeUniqueStrings(config?.tools?.web?.search?.openaiCodex?.allowedDomains) !== void 0;
+function areUserMcpServersFingerprintsCompatible(params) {
+	return params.previous === params.next || params.previous === params.nextLegacy || params.nextLegacy !== void 0 && params.previous === hashCodexAppServerBindingFingerprint(params.nextLegacy);
 }
-function buildCodexNativeWebSearchThreadConfig(config) {
-	const nativeConfig = config?.tools?.web?.search?.openaiCodex;
-	const threadConfig = {
-		"features.standalone_web_search": false,
-		web_search: nativeConfig?.mode === "live" ? "live" : "cached"
-	};
-	const allowedDomains = normalizeUniqueStrings(nativeConfig?.allowedDomains);
-	if (allowedDomains) threadConfig["tools.web_search.allowed_domains"] = allowedDomains;
-	if (nativeConfig?.contextSize) threadConfig["tools.web_search.context_size"] = nativeConfig.contextSize;
-	const location = nativeConfig?.userLocation;
-	const country = normalizeOptionalString$1(location?.country);
-	const region = normalizeOptionalString$1(location?.region);
-	const city = normalizeOptionalString$1(location?.city);
-	const timezone = normalizeOptionalString$1(location?.timezone);
-	if (country) threadConfig["tools.web_search.location.country"] = country;
-	if (region) threadConfig["tools.web_search.location.region"] = region;
-	if (city) threadConfig["tools.web_search.location.city"] = city;
-	if (timezone) threadConfig["tools.web_search.location.timezone"] = timezone;
-	return threadConfig;
+function shouldStartTransientNoToolThread(params) {
+	return Boolean(params.previous && !isEmptyDynamicToolsFingerprint(params.previous) && !params.nextHasDynamicTools);
 }
-function resolveCodexWebSearchPlan(params) {
-	if (params.disableTools === true || params.webSearchAllowed === false || params.config?.tools?.web?.search?.enabled === false) return {
-		kind: "disabled",
-		suppressManagedWebSearch: true,
-		threadConfig: CODEX_NATIVE_WEB_SEARCH_DISABLED_CONFIG
-	};
-	const nativeConfig = params.config?.tools?.web?.search?.openaiCodex;
-	const managedSearchExplicit = hasManagedSearchProvider(params.config) || nativeConfig?.enabled === false;
-	const nativeProviderSupportsSearch = params.nativeProviderWebSearchSupport === void 0 || params.nativeProviderWebSearchSupport === "supported";
-	if (!(params.nativeToolSurfaceEnabled !== false && nativeProviderSupportsSearch && nativeConfig?.enabled !== false && !hasManagedSearchProvider(params.config))) {
-		if (!managedSearchExplicit && hasNativeDomainRestrictions(params.config)) return {
-			kind: "disabled",
-			suppressManagedWebSearch: true,
-			threadConfig: CODEX_NATIVE_WEB_SEARCH_DISABLED_CONFIG
-		};
-		return {
-			kind: "managed",
-			suppressManagedWebSearch: false,
-			threadConfig: CODEX_NATIVE_WEB_SEARCH_DISABLED_CONFIG
-		};
-	}
-	return {
-		kind: "native-hosted",
-		suppressManagedWebSearch: true,
-		threadConfig: buildCodexNativeWebSearchThreadConfig(params.config)
-	};
+function isEmptyDynamicToolsFingerprint(fingerprint) {
+	return fingerprint === EMPTY_DYNAMIC_TOOLS_FINGERPRINT || fingerprint === LEGACY_EMPTY_DYNAMIC_TOOLS_FINGERPRINT;
+}
+function compareJsonFingerprint(left, right) {
+	return JSON.stringify(left).localeCompare(JSON.stringify(right));
 }
 //#endregion
-//#region extensions/codex/src/app-server/thread-lifecycle.ts
-var CodexThreadStartRequestError = class extends Error {
-	constructor(cause) {
-		super(formatErrorMessage(cause), { cause });
-		this.name = "CodexThreadStartRequestError";
+//#region extensions/codex/src/app-server/attempt-client-cleanup.ts
+/**
+* Best-effort cleanup helpers for Codex app-server startup attempts and turns.
+*/
+/** Timeout for best-effort app-server turn interruption during cleanup. */
+const CODEX_APP_SERVER_INTERRUPT_TIMEOUT_MS = 5e3;
+/** Timeout for best-effort thread unsubscribe during cleanup. */
+const CODEX_APP_SERVER_UNSUBSCRIBE_TIMEOUT_MS = 5e3;
+/** Raised when a thread subscription may be live on a client OpenClaw no longer controls. */
+var CodexAppServerUnsafeSubscriptionError = class extends Error {
+	constructor(message, options) {
+		super(message, options);
+		this.name = "CodexAppServerUnsafeSubscriptionError";
 	}
 };
-var CodexThreadBindingConflictError = class extends Error {
-	constructor(threadId, operation) {
-		super(`Codex thread binding changed while ${operation}: ${threadId}`);
-		this.name = "CodexThreadBindingConflictError";
+function isCodexAppServerUnsafeSubscriptionError(error) {
+	return error instanceof CodexAppServerUnsafeSubscriptionError;
+}
+/** Asserts Codex resumed the exact thread this attempt subscribed to. */
+function assertCodexThreadResumeSubscription(requestedThreadId, returnedThreadId) {
+	if (returnedThreadId !== requestedThreadId) throw new CodexAppServerUnsafeSubscriptionError(`Codex thread/resume returned ${returnedThreadId} for ${requestedThreadId}`);
+}
+async function closeClientAndWaitIfAvailable(client) {
+	const closeable = client;
+	if (typeof closeable.closeAndWait === "function") {
+		await closeable.closeAndWait();
+		return;
 	}
-};
-var CodexRingZeroAttestationError = class extends Error {
-	constructor(cause) {
-		super("Codex ring-zero MCP attestation failed", { cause });
-		this.name = "CodexRingZeroAttestationError";
+	closeable.close?.();
+}
+async function closeCodexStartupClientBestEffort(client) {
+	if (!client) return;
+	const unclaimedSharedClient = clearSharedCodexAppServerClientIfCurrentAndUnclaimed(client);
+	if (unclaimedSharedClient.closed) {
+		await closeClientAndWaitIfAvailable(client);
+		return;
 	}
-};
-var CodexThreadBindingConflictAfterCleanupError = class extends CodexThreadBindingConflictError {};
-var CodexAdoptedThreadActiveError = class extends Error {
-	constructor() {
-		super("Codex session became active in another runner; wait for it to finish before continuing");
-		this.name = "CodexAdoptedThreadActiveError";
+	if (unclaimedSharedClient.found) {
+		if (retireSharedCodexAppServerClientIfCurrent(client)?.closed) await closeClientAndWaitIfAvailable(client);
+		return;
 	}
-};
-const CODEX_NATIVE_PERSONALITY_NONE = "none";
-const CODEX_RING_ZERO_BASE_INSTRUCTIONS = "";
-const CODEX_CODE_MODE_THREAD_CONFIG = {
-	"features.code_mode": true,
-	"features.code_mode_only": false,
-	"features.apply_patch_streaming_events": true
-};
-const CODEX_CODE_MODE_DISABLED_THREAD_CONFIG = {
-	"features.code_mode": false,
-	"features.code_mode_only": false
-};
-const CODEX_LIGHTWEIGHT_CONTEXT_THREAD_CONFIG = { project_doc_max_bytes: 0 };
-const CODEX_TOOL_SEARCH_UNSUPPORTED_THREAD_CONFIG = { "features.multi_agent": false };
-const CODEX_RING_ZERO_THREAD_CONFIG = {
-	"features.apps": false,
-	"features.current_time_reminder": false,
-	"features.deferred_executor": false,
-	"features.enable_fanout": false,
-	"features.goals": false,
-	"features.hooks": false,
-	"features.image_generation": false,
-	"features.memories": false,
-	"features.multi_agent": false,
-	"features.multi_agent_v2": false,
-	"features.plugins": false,
-	"features.standalone_web_search": false,
-	"features.token_budget": false,
-	"orchestrator.mcp.enabled": false,
-	"orchestrator.skills.enabled": false,
-	"tools.experimental_request_user_input.enabled": false,
-	hooks: {
-		PreToolUse: [],
-		PermissionRequest: [],
-		PostToolUse: [],
-		PreCompact: [],
-		PostCompact: [],
-		SessionStart: [],
-		UserPromptSubmit: [],
-		SubagentStart: [],
-		SubagentStop: [],
-		Stop: []
-	},
-	project_doc_max_bytes: 0,
-	notify: [],
-	web_search: "disabled"
-};
-const CODEX_RING_ZERO_RESTRICTED_FEATURES = /* @__PURE__ */ new Set([
-	"apps",
-	"code_mode",
-	"code_mode_only",
-	"current_time_reminder",
-	"deferred_executor",
-	"enable_fanout",
-	"goals",
-	"hooks",
-	"image_generation",
-	"memories",
-	"multi_agent",
-	"multi_agent_v2",
-	"plugins",
-	"standalone_web_search",
-	"token_budget"
-]);
-const CODEX_RING_ZERO_OVERRIDABLE_LAYER_TYPES = /* @__PURE__ */ new Set([
-	"mdm",
-	"system",
-	"enterpriseManaged",
-	"user",
-	"project",
-	"sessionFlags"
-]);
-const CODEX_THREAD_LIFECYCLE_TIMING_WARN_TOTAL_MS = 1e3;
-const CODEX_THREAD_LIFECYCLE_TIMING_WARN_STAGE_MS = 500;
-function shouldWarnCodexThreadLifecycleTimingSummary(summary, options = {}) {
-	const totalThresholdMs = options.totalThresholdMs ?? CODEX_THREAD_LIFECYCLE_TIMING_WARN_TOTAL_MS;
-	const stageThresholdMs = options.stageThresholdMs ?? CODEX_THREAD_LIFECYCLE_TIMING_WARN_STAGE_MS;
-	return summary.totalMs >= totalThresholdMs || summary.spans.some((span) => span.durationMs >= stageThresholdMs);
-}
-function formatCodexThreadLifecycleTimingSummary(params) {
-	const spans = params.summary.spans.length > 0 ? params.summary.spans.map((span) => `${span.name}:${span.durationMs}ms@${span.elapsedMs}ms`).join(",") : "none";
-	return `[trace:codex-app-server] thread lifecycle: runId=${params.runId} sessionId=${params.sessionId} sessionKey=${params.sessionKey ?? "unknown"} action=${params.action} totalMs=${params.summary.totalMs} stages=${spans}`;
+	const retiredSharedClient = retireSharedCodexAppServerClientIfCurrent(client);
+	if (retiredSharedClient) {
+		if (retiredSharedClient.closed) await closeClientAndWaitIfAvailable(client);
+		return;
+	}
+	if (clearSharedCodexAppServerClientIfCurrent(client)) {
+		await closeClientAndWaitIfAvailable(client);
+		return;
+	}
+	await closeClientAndWaitIfAvailable(client);
 }
-function createCodexThreadLifecycleTimingTracker(options = {}) {
-	const log = options.log ?? embeddedAgentLog;
-	if (!options.enabled && log.isEnabled?.("trace") !== true) return {
-		async measure(_name, run) {
-			return await run();
-		},
-		measureSync(_name, run) {
-			return run();
-		},
-		mark() {},
-		logSummary() {}
+/** Sends a turn interrupt without blocking abort cleanup on app-server errors. */
+function interruptCodexTurnBestEffort(client, params) {
+	const requestOptions = params.timeoutMs && Number.isFinite(params.timeoutMs) && params.timeoutMs > 0 ? { timeoutMs: params.timeoutMs } : void 0;
+	const requestParams = {
+		threadId: params.threadId,
+		turnId: params.turnId
 	};
-	const now = options.now ?? Date.now;
-	const startedAt = now();
-	let didLog = false;
-	const spans = [];
-	const toMs = (value) => Math.max(0, Math.round(value));
-	const record = (name, spanStartedAt) => {
-		const currentAt = now();
-		spans.push({
-			name,
-			durationMs: toMs(currentAt - spanStartedAt),
-			elapsedMs: toMs(currentAt - startedAt)
+	try {
+		const interrupt = requestOptions ? client.request("turn/interrupt", requestParams, requestOptions) : client.request("turn/interrupt", requestParams);
+		Promise.resolve(interrupt).catch((error) => {
+			embeddedAgentLog.debug("codex app-server turn interrupt failed during abort", { error });
 		});
-	};
-	const snapshot = () => ({
-		totalMs: toMs(now() - startedAt),
-		spans: spans.slice()
-	});
-	return {
-		async measure(name, run) {
-			const spanStartedAt = now();
-			try {
-				return await run();
-			} finally {
-				record(name, spanStartedAt);
-			}
-		},
-		measureSync(name, run) {
-			const spanStartedAt = now();
-			try {
-				return run();
-			} finally {
-				record(name, spanStartedAt);
-			}
-		},
-		mark(name) {
-			record(name, now());
-		},
-		logSummary(params) {
-			if (didLog) return;
-			const summary = snapshot();
-			const shouldWarn = shouldWarnCodexThreadLifecycleTimingSummary(summary, options);
-			if (!shouldWarn && !log.isEnabled?.("trace")) return;
-			didLog = true;
-			const message = formatCodexThreadLifecycleTimingSummary({
-				runId: params.runId,
-				sessionId: params.sessionId,
-				sessionKey: params.sessionKey,
-				action: params.action,
-				summary
-			});
-			const meta = {
-				runId: params.runId,
-				sessionId: params.sessionId,
-				sessionKey: params.sessionKey,
-				action: params.action,
-				threadId: params.threadId,
-				totalMs: summary.totalMs,
-				spans: summary.spans
-			};
-			if (shouldWarn) log.warn(message, meta);
-			else log.trace(message, meta);
-		}
-	};
+	} catch (error) {
+		embeddedAgentLog.debug("codex app-server turn interrupt failed during abort", { error });
+	}
 }
-async function startOrResumeThread(params) {
-	const bindingIdentity = sessionBindingIdentity({
-		sessionId: params.params.sessionId,
-		sessionKey: params.params.sessionKey,
-		agentId: params.agentId ?? params.params.agentId,
-		config: params.params.config
-	});
-	return await params.bindingStore.withLease(bindingIdentity, async () => {
-		const lifecycleTiming = createCodexThreadLifecycleTimingTracker({
-			...params.timing,
-			enabled: params.timing?.enabled ?? isCodexAppServerProfilerEnabled(params.params.config)
+/** Unsubscribes from a thread while swallowing cleanup-only failures. */
+async function unsubscribeCodexThreadBestEffort(client, params) {
+	try {
+		await client.request("thread/unsubscribe", { threadId: params.threadId }, { timeoutMs: params.timeoutMs });
+		return true;
+	} catch (error) {
+		embeddedAgentLog.debug("codex app-server thread unsubscribe cleanup failed", {
+			threadId: params.threadId,
+			error
 		});
-		const legacyDynamicToolsFingerprint = lifecycleTiming.measureSync("legacy-dynamic-tools-fingerprint", () => legacyFingerprintDynamicTools(params.dynamicTools));
-		const dynamicToolsFingerprint = lifecycleTiming.measureSync("dynamic-tools-fingerprint", () => hashCodexAppServerBindingFingerprint(legacyDynamicToolsFingerprint));
-		const dynamicToolsContainDeferred = flattenCodexDynamicToolFunctions(params.dynamicTools).some((tool) => tool.deferLoading === true);
-		const webSearchThreadConfigFingerprint = fingerprintJsonObject(lifecycleTiming.measureSync("web-search-plan", () => resolveCodexWebSearchPlan({
-			config: params.params.config,
-			disableTools: params.params.disableTools,
-			nativeToolSurfaceEnabled: params.nativeCodeModeEnabled,
-			nativeProviderWebSearchSupport: params.nativeProviderWebSearchSupport,
-			webSearchAllowed: params.webSearchAllowed
-		})).threadConfig);
-		const networkProxyConfigFingerprint = params.appServer.networkProxy?.configFingerprint;
-		const contextEngineBinding = lifecycleTiming.measureSync("context-engine-binding", () => buildContextEngineBinding(params.params, params.contextEngineProjection));
-		const userMcpServersConfigPatch = params.userMcpServersEnabled === false ? void 0 : await buildCodexUserMcpServersThreadConfigPatchForRuntime(params.params.config, {
-			agentId: params.agentId ?? params.params.agentId,
-			agentDir: params.params.agentDir,
-			allowLiteralOAuthProjection: params.appServer.connectionClass !== "remote",
-			onServerUnavailable: (serverName, error) => embeddedAgentLog.warn("skipping unavailable MCP OAuth server", {
-				serverName,
-				error: formatErrorMessage(error)
-			})
+		return false;
+	}
+}
+/**
+* Retires the shared client after a timed-out turn so later runs do not reuse a
+* potentially wedged app-server connection.
+*/
+async function retireCodexAppServerClientAfterTimedOutTurn(client, params) {
+	const retiredSharedClient = retireSharedCodexAppServerClientIfCurrent(client, { failActiveLeases: params.suspectPhysicalClient });
+	const detachedSharedClient = Boolean(retiredSharedClient);
+	if (!(params.suspectPhysicalClient && (retiredSharedClient?.closed ?? false))) {
+		interruptCodexTurnBestEffort(client, {
+			threadId: params.threadId,
+			turnId: params.turnId,
+			timeoutMs: CODEX_APP_SERVER_INTERRUPT_TIMEOUT_MS
 		});
-		const legacyUserMcpServersFingerprint = legacyFingerprintUserMcpServersConfigPatch(userMcpServersConfigPatch);
-		const userMcpServersFingerprint = fingerprintUserMcpServersConfigPatch(userMcpServersConfigPatch);
-		const environmentSelectionFingerprint = fingerprintEnvironmentSelection(params.environmentSelection);
-		const hostSystemAgentActive = params.hostSystemAgentActive ?? isHostScopedAgentToolActive("openclaw");
-		const ringZeroActive = hostSystemAgentActive && isSystemAgentOnlyCodexDynamicToolAllowlist(params.params.toolsAllow);
-		if (ringZeroActive && params.nativeCodeModeEnabled !== false) throw new Error("Codex ring-zero requires native code mode to be disabled");
-		const ringZeroInheritedMcpServerNames = ringZeroActive ? await lifecycleTiming.measure("ring-zero-mcp-config-read", () => readCodexInheritedMcpServerNames(params.client, params.cwd, params.signal)) : [];
-		if (ringZeroActive) await lifecycleTiming.measure("ring-zero-config-requirements-read", () => assertCodexRingZeroHasNoManagedHooks(params.client, params.signal));
-		const ringZeroConfigFingerprint = ringZeroActive ? fingerprintJsonObject({
-			version: 1,
-			baseInstructions: CODEX_RING_ZERO_BASE_INSTRUCTIONS,
-			config: buildCodexRingZeroThreadConfigPatch(params.params, true, ringZeroInheritedMcpServerNames)
-		}) : void 0;
-		const ringZeroClientInstanceId = ringZeroActive ? getCodexAppServerClientInstanceId(params.client) : void 0;
-		let binding = await lifecycleTiming.measure("read-binding", () => params.bindingStore.read(bindingIdentity));
-		const normalizeBindingModelProvider = (authProfileId, modelProvider) => normalizeCodexAppServerBindingModelProvider({
-			authProfileId,
-			modelProvider,
-			authProfileStore: params.params.authProfileStore,
-			agentDir: params.params.agentDir,
-			config: params.params.config
+		await unsubscribeCodexThreadBestEffort(client, {
+			threadId: params.threadId,
+			timeoutMs: CODEX_APP_SERVER_UNSUBSCRIBE_TIMEOUT_MS
 		});
-		const throwIfAborted = () => {
-			if (!params.signal?.aborted) return;
-			const reason = params.signal.reason;
-			if (reason instanceof Error) throw reason;
-			const error = new Error(typeof reason === "string" && reason.length > 0 ? reason : "codex app-server thread lifecycle aborted");
-			error.name = "AbortError";
-			throw error;
-		};
-		if (!binding && bindingIdentity.kind === "session" && bindingIdentity.sessionKey) {
-			if (!await lifecycleTiming.measure("reclaim-binding-generation", () => reclaimCurrentCodexSessionGeneration({
-				bindingStore: params.bindingStore,
-				identity: bindingIdentity,
-				config: params.params.config
-			}))) throw new Error(`Codex session generation is no longer current: ${bindingIdentity.sessionId}`);
-		}
-		if (binding?.pendingSupervisionBranch) {
-			const pendingBinding = binding;
-			const pluginThreadConfig = params.pluginThreadConfig?.enabled ? await lifecycleTiming.measure("plugin-config-build", () => params.pluginThreadConfig?.build()) : void 0;
-			const finalConfigPatch = params.buildFinalConfigPatch?.({ action: "start" }) ?? {
-				configPatch: params.finalConfigPatch,
-				nativeHookRelayGeneration: params.nativeHookRelayGeneration
-			};
-			const config = lifecycleTiming.measureSync("merge-thread-config", () => mergeCodexThreadConfigs(params.config, userMcpServersConfigPatch, pluginThreadConfig?.configPatch, finalConfigPatch.configPatch));
-			return await materializePendingSupervisionBranch({
-				client: params.client,
-				abandonClient: params.abandonClient ?? (() => closeCodexStartupClientBestEffort(params.client)),
-				bindingStore: params.bindingStore,
-				bindingIdentity,
-				binding: pendingBinding,
-				attempt: params.params,
-				cwd: params.cwd,
-				dynamicTools: params.dynamicTools,
-				appServer: params.appServer,
-				developerInstructions: params.developerInstructions,
-				config,
-				nativeCodeModeEnabled: params.nativeCodeModeEnabled,
-				nativeProviderWebSearchSupport: params.nativeProviderWebSearchSupport,
-				nativeCodeModeOnlyEnabled: params.nativeCodeModeOnlyEnabled,
-				webSearchAllowed: params.webSearchAllowed,
-				environmentSelection: params.environmentSelection,
-				signal: params.signal,
-				throwIfAborted,
-				lifecycleTiming,
-				normalizeBindingModelProvider,
-				bindingPatch: {
-					cwd: params.cwd,
-					authProfileId: void 0,
-					preserveNativeModel: true,
-					dynamicToolsFingerprint,
-					dynamicToolsContainDeferred,
-					webSearchThreadConfigFingerprint,
-					userMcpServersFingerprint,
-					mcpServersFingerprint: params.mcpServersFingerprintEvaluated === true ? params.mcpServersFingerprint : pendingBinding.mcpServersFingerprint,
-					networkProxyProfileName: params.appServer.networkProxy?.profileName,
-					networkProxyConfigFingerprint,
-					nativeHookRelayGeneration: finalConfigPatch.nativeHookRelayGeneration,
-					appServerRuntimeFingerprint: buildCodexAppServerConnectionFingerprint(params.appServer, params.params.agentDir),
-					pluginAppsFingerprint: pluginThreadConfig?.fingerprint,
-					pluginAppsInputFingerprint: pluginThreadConfig?.inputFingerprint,
-					pluginAppPolicyContext: pluginThreadConfig?.policyContext,
-					contextEngine: contextEngineBinding,
-					environmentSelectionFingerprint,
-					conversationSourceTransferComplete: true
-				}
-			});
-		}
-		const clearCurrentBinding = async (operation) => {
-			const current = binding;
-			if (!current?.threadId) return;
-			assertCodexBindingMayBeReplaced(current, operation);
-			if (!await params.bindingStore.mutate(bindingIdentity, {
-				kind: "clear",
-				threadId: current.threadId
-			})) throw new CodexThreadBindingConflictError(current.threadId, operation);
-			binding = void 0;
-		};
-		if (binding?.threadId && (binding.ringZeroConfigFingerprint !== ringZeroConfigFingerprint || binding.ringZeroClientInstanceId !== ringZeroClientInstanceId) && (ringZeroActive || binding.ringZeroConfigFingerprint !== void 0)) {
-			embeddedAgentLog.debug("codex app-server ring-zero restriction changed; rotating thread", { threadId: binding.threadId });
-			await clearCurrentBinding("rotating a ring-zero thread binding");
-		}
-		if (binding?.threadId && shouldRotateCodexAppServerBindingForRuntime({
-			connectionClass: params.appServer.connectionClass,
-			current: binding.connectionScope === "supervision" ? buildCodexAppServerConnectionFingerprint(params.appServer, params.params.agentDir) : params.appServerRuntimeFingerprint,
-			binding: binding.appServerRuntimeFingerprint
-		})) {
-			embeddedAgentLog.debug("codex app-server runtime identity changed; starting a new thread", {
-				threadId: binding.threadId,
-				connectionClass: params.appServer.connectionClass
-			});
-			await clearCurrentBinding("rotating a stale thread binding");
-			binding = void 0;
-		}
-		if (binding?.threadId && shouldRotateCodexGpt56MultiAgentBinding({
-			bindingModel: binding.model,
-			requestedModel: params.params.modelId
-		})) {
-			embeddedAgentLog.debug("codex app-server GPT-5.6 multi-agent version changed; starting a new thread", {
-				threadId: binding.threadId,
-				bindingModel: binding.model,
-				requestedModel: params.params.modelId
-			});
-			await clearCurrentBinding("rotating a GPT-5.6 multi-agent thread binding");
-			binding = void 0;
-		}
-		const startModelSelection = resolveCodexAppServerThreadModelSelection({
-			provider: params.params.provider,
-			model: params.params.modelId,
-			binding,
-			authProfileId: params.params.authProfileId,
-			authProfileStore: params.params.authProfileStore,
-			agentDir: params.params.agentDir,
-			config: params.params.config
-		});
-		const startModelProvider = startModelSelection.modelProvider;
-		let preserveExistingBinding = !ringZeroActive && params.nativeProviderWebSearchSupport === "unknown" && !binding?.threadId;
-		let rotatedContextEngineBinding = false;
-		let prebuiltPluginThreadConfig;
-		const webSearchBindingChanged = binding?.threadId && binding.webSearchThreadConfigFingerprint !== webSearchThreadConfigFingerprint;
-		const persistentWebSearchRestriction = params.webSearchAllowed === false && params.persistentWebSearchAllowed === false;
-		const transientNativeToolRestriction = params.nativeCodeModeEnabled === false && !persistentWebSearchRestriction;
-		const transientWebSearchRestriction = isTransientWebSearchRestriction(params);
-		const explicitTransientWebSearchRestriction = params.webSearchAllowed === false && params.persistentWebSearchAllowed !== false && transientWebSearchRestriction;
-		const unknownProviderWebSearchSupport = params.nativeProviderWebSearchSupport === "unknown";
-		if (binding?.threadId && params.mcpServersFingerprintEvaluated === true && binding.mcpServersFingerprint !== params.mcpServersFingerprint) {
-			assertCodexBindingMayBeReplaced(binding, "changing MCP configuration");
-			if (!ringZeroActive && (transientNativeToolRestriction || webSearchBindingChanged && (explicitTransientWebSearchRestriction || unknownProviderWebSearchSupport))) {
-				embeddedAgentLog.debug("codex app-server MCP config changed during transient restricted turn; starting transient thread", { threadId: binding.threadId });
-				preserveExistingBinding = true;
-			} else {
-				embeddedAgentLog.debug("codex app-server MCP config changed; starting a new thread", { threadId: binding.threadId });
-				await clearCurrentBinding("rotating a stale thread binding");
-			}
-			binding = void 0;
-		}
-		const deferLegacyWebSearchRotationToTransientNativeSurface = params.nativeCodeModeEnabled === false && binding?.webSearchThreadConfigFingerprint === void 0 && !persistentWebSearchRestriction;
-		if (binding?.threadId && webSearchBindingChanged && !deferLegacyWebSearchRotationToTransientNativeSurface) {
-			assertCodexBindingMayBeReplaced(binding, "changing web-search configuration");
-			if (!ringZeroActive && transientWebSearchRestriction) {
-				embeddedAgentLog.debug("codex app-server web search restricted for turn; starting transient thread", { threadId: binding.threadId });
-				preserveExistingBinding = true;
-			} else {
-				embeddedAgentLog.debug("codex app-server web search config changed; starting a new thread", { threadId: binding.threadId });
-				await clearCurrentBinding("rotating a stale thread binding");
-			}
-			binding = void 0;
-		}
-		if (binding?.threadId && transientNativeToolRestriction && !ringZeroActive) {
-			assertCodexBindingMayBeReplaced(binding, "starting a native-tool-restricted turn");
-			embeddedAgentLog.debug("codex app-server native tool surface disabled for turn; starting transient thread", { threadId: binding.threadId });
-			preserveExistingBinding = true;
-			binding = void 0;
-		}
-		if (binding?.threadId && (binding.contextEngine || contextEngineBinding)) {
-			if (!contextEngineBinding || !isContextEngineBindingCompatible(binding.contextEngine, contextEngineBinding)) {
-				embeddedAgentLog.debug("codex app-server context-engine binding changed; starting a new thread", {
-					threadId: binding.threadId,
-					engineId: contextEngineBinding?.engineId,
-					previousEngineId: binding.contextEngine?.engineId,
-					epoch: contextEngineBinding?.projection?.epoch,
-					previousEpoch: binding.contextEngine?.projection?.epoch,
-					fingerprint: contextEngineBinding?.projection?.fingerprint,
-					previousFingerprint: binding.contextEngine?.projection?.fingerprint,
-					policyFingerprint: contextEngineBinding?.policyFingerprint,
-					previousPolicyFingerprint: binding.contextEngine?.policyFingerprint
-				});
-				await clearCurrentBinding("rotating a stale thread binding");
-				binding = void 0;
-				rotatedContextEngineBinding = true;
-			}
-		}
-		if (binding?.threadId && !areUserMcpServersFingerprintsCompatible({
-			previous: binding.userMcpServersFingerprint,
-			next: userMcpServersFingerprint,
-			nextLegacy: legacyUserMcpServersFingerprint
-		})) {
-			embeddedAgentLog.debug("codex app-server user MCP config changed; starting a new thread", { threadId: binding.threadId });
-			await clearCurrentBinding("rotating a stale thread binding");
-			binding = void 0;
-		}
-		if (binding?.threadId && binding.environmentSelectionFingerprint !== environmentSelectionFingerprint) {
-			embeddedAgentLog.debug("codex app-server environment selection changed; starting a new thread", { threadId: binding.threadId });
-			await clearCurrentBinding("rotating a stale thread binding");
-			binding = void 0;
-		}
-		if (binding?.threadId && (binding.networkProxyConfigFingerprint !== networkProxyConfigFingerprint || binding.networkProxyProfileName !== params.appServer.networkProxy?.profileName)) {
-			embeddedAgentLog.debug("codex app-server network proxy config changed; starting a new thread", { threadId: binding.threadId });
-			await clearCurrentBinding("rotating a stale thread binding");
-			binding = void 0;
-		}
-		if (binding?.threadId) {
-			let pluginBindingStale = isCodexPluginThreadBindingStale({
-				codexPluginsEnabled: params.pluginThreadConfig?.enabled ?? false,
-				bindingFingerprint: binding.pluginAppsFingerprint,
-				bindingInputFingerprint: binding.pluginAppsInputFingerprint,
-				currentInputFingerprint: params.pluginThreadConfig?.inputFingerprint,
-				hasBindingPolicyContext: Boolean(binding.pluginAppPolicyContext)
+	}
+	let closedClient = retiredSharedClient?.closed ?? false;
+	if (!detachedSharedClient) {
+		const close = client.close;
+		if (typeof close === "function") try {
+			close.call(client);
+			closedClient = true;
+		} catch (error) {
+			embeddedAgentLog.debug("codex app-server client close failed during timeout cleanup", {
+				threadId: params.threadId,
+				turnId: params.turnId,
+				error
 			});
-			if (!pluginBindingStale && shouldRecheckRecoverablePluginBinding({
-				binding,
-				pluginThreadConfig: params.pluginThreadConfig
-			})) try {
-				prebuiltPluginThreadConfig = await lifecycleTiming.measure("plugin-config-recovery", () => params.pluginThreadConfig?.build());
-				pluginBindingStale = prebuiltPluginThreadConfig?.fingerprint !== binding.pluginAppsFingerprint;
-			} catch (error) {
-				embeddedAgentLog.warn("codex app-server plugin app config recovery check failed", {
-					error,
-					threadId: binding.threadId
-				});
-			}
-			if (pluginBindingStale) {
-				embeddedAgentLog.debug("codex app-server plugin app config changed; starting a new thread", { threadId: binding.threadId });
-				await clearCurrentBinding("rotating a stale thread binding");
-				binding = void 0;
-			}
 		}
-		if (binding?.threadId) {
-			if (binding.dynamicToolsFingerprint && params.dynamicTools.length > 0 && binding.dynamicToolsContainDeferred !== dynamicToolsContainDeferred && (binding.dynamicToolsContainDeferred !== void 0 || !dynamicToolsContainDeferred)) {
-				embeddedAgentLog.debug("codex app-server dynamic tool loading changed; starting a new thread", { threadId: binding.threadId });
-				await clearCurrentBinding("rotating a stale thread binding");
-				binding = void 0;
-			}
+	}
+	embeddedAgentLog.warn("codex app-server client retired after timed-out turn", {
+		threadId: params.threadId,
+		turnId: params.turnId,
+		reason: params.reason,
+		detachedSharedClient,
+		closedClient,
+		activeSharedClientLeases: retiredSharedClient?.activeLeases ?? 0
+	});
+}
+//#endregion
+//#region extensions/codex/src/app-server/dynamic-tool-profile.ts
+/** Tool names owned by Codex app-server and normally excluded from OpenClaw dynamic tools. */
+const CODEX_APP_SERVER_OWNED_DYNAMIC_TOOL_EXCLUDES = [
+	"read",
+	"write",
+	"edit",
+	"apply_patch",
+	"exec",
+	"process",
+	"update_plan",
+	"tool_call",
+	"tool_describe",
+	"tool_search",
+	"tool_search_code"
+];
+const CODEX_APP_SERVER_OWNED_SHELL_TOOL_EXCLUDES = /* @__PURE__ */ new Set(["exec", "process"]);
+const DYNAMIC_TOOL_NAME_ALIASES = {
+	bash: "exec",
+	"apply-patch": "apply_patch"
+};
+/** Normalizes OpenClaw/Codex tool names before filtering and allowlist checks. */
+function normalizeCodexDynamicToolName(name) {
+	const normalized = name.trim().toLowerCase();
+	return DYNAMIC_TOOL_NAME_ALIASES[normalized] ?? normalized;
+}
+/** True only for the host-scoped OpenClaw run's exact tool contract. */
+function isSystemAgentOnlyCodexDynamicToolAllowlist(toolsAllow) {
+	return toolsAllow?.length === 1 && normalizeCodexDynamicToolName(toolsAllow[0] ?? "") === "openclaw";
+}
+/** Returns true for private QA runs that force the Codex runtime profile. */
+function isForcedPrivateQaCodexRuntime(env = process.env) {
+	return env.OPENCLAW_BUILD_PRIVATE_QA === "1" && env.OPENCLAW_QA_FORCE_RUNTIME?.trim().toLowerCase() === "codex";
+}
+/** Resolves whether dynamic tools load directly or through Codex tool search. */
+function resolveCodexDynamicToolsLoading(config, env = process.env) {
+	return isForcedPrivateQaCodexRuntime(env) ? "direct" : config.codexDynamicToolsLoading ?? "searchable";
+}
+function normalizeCodexModelId(modelId) {
+	const normalized = modelId?.trim().toLowerCase();
+	if (!normalized) return "";
+	return normalized.includes("/") ? normalized.split("/").at(-1) : normalized;
+}
+/** Returns true when model behavior requires direct dynamic-tool registration. */
+function shouldUseDirectCodexDynamicToolsForModel(modelId) {
+	return shouldDisableCodexToolSearchForModel(modelId);
+}
+/** Returns true for models whose tool-search path is unsupported or inefficient. */
+function shouldDisableCodexToolSearchForModel(modelId) {
+	return normalizeCodexModelId(modelId) === "gpt-5.4-nano";
+}
+/** Resolves dynamic-tool loading after applying model-specific restrictions. */
+function resolveCodexDynamicToolsLoadingForModel(config, modelId, env = process.env) {
+	const loading = resolveCodexDynamicToolsLoading(config, env);
+	return loading === "searchable" && shouldUseDirectCodexDynamicToolsForModel(modelId) ? "direct" : loading;
+}
+/** Resolves dynamic-tool loading for the app-server connection that will execute the turn. */
+function resolveCodexDynamicToolsLoadingForRuntime(config, modelId, options = {}, env = process.env) {
+	const loading = resolveCodexDynamicToolsLoadingForModel(config, modelId, env);
+	return loading === "searchable" && options.connectionClass === "remote" ? "direct" : loading;
+}
+/** Filters OpenClaw tools that Codex owns natively or config explicitly excludes. */
+function filterCodexDynamicTools(tools, config, env = process.env) {
+	return filterCodexDynamicToolsWithOptions(tools, config, env, { preserveOpenClawShell: false });
+}
+/** Keeps exec/process only when Codex cannot advertise an environment-backed native shell. */
+function filterCodexDynamicToolsWithOpenClawShell(tools, config, env = process.env) {
+	return filterCodexDynamicToolsWithOptions(tools, config, env, { preserveOpenClawShell: true });
+}
+function filterCodexDynamicToolsWithOptions(tools, config, env, options) {
+	const excludes = /* @__PURE__ */ new Set();
+	if (!isForcedPrivateQaCodexRuntime(env)) for (const name of CODEX_APP_SERVER_OWNED_DYNAMIC_TOOL_EXCLUDES) {
+		if (options.preserveOpenClawShell && CODEX_APP_SERVER_OWNED_SHELL_TOOL_EXCLUDES.has(name)) continue;
+		excludes.add(name);
+	}
+	for (const name of config.codexDynamicToolsExclude ?? []) {
+		const trimmed = normalizeCodexDynamicToolName(name);
+		if (trimmed) excludes.add(trimmed);
+	}
+	return excludes.size === 0 ? tools : tools.filter((tool) => !excludes.has(normalizeCodexDynamicToolName(tool.name)));
+}
+//#endregion
+//#region extensions/codex/src/app-server/profiler-flag.ts
+const PROFILER_FLAGS = ["profiler", "codex.profiler"];
+/** Checks the generic and Codex-specific profiler diagnostic flags. */
+function isCodexAppServerProfilerEnabled(config, env = process.env) {
+	return PROFILER_FLAGS.some((flag) => isDiagnosticFlagEnabled(flag, config, env));
+}
+//#endregion
+//#region extensions/codex/src/app-server/thread-binding-policy.ts
+function shouldRotateCodexAppServerBindingForRuntime(params) {
+	if (!params.current) return false;
+	if (params.binding === params.current) return false;
+	return params.connectionClass === "remote" || Boolean(params.binding);
+}
+function resolveCodexGpt56MultiAgentVersion(modelRef) {
+	let modelId = modelRef?.trim().toLowerCase();
+	if (!modelId) return;
+	const slashIndex = modelId.indexOf("/");
+	if (slashIndex > 0) {
+		const provider = modelId.slice(0, slashIndex);
+		if (provider !== "openai" && provider !== "codex") return;
+		modelId = modelId.slice(slashIndex + 1);
+	}
+	if (modelId === "gpt-5.6-sol" || modelId === "gpt-5.6-terra") return "v2";
+	return modelId === "gpt-5.6-luna" ? "v1" : void 0;
+}
+function shouldRotateCodexGpt56MultiAgentBinding(params) {
+	const bindingVersion = resolveCodexGpt56MultiAgentVersion(params.bindingModel);
+	const requestedVersion = resolveCodexGpt56MultiAgentVersion(params.requestedModel);
+	return Boolean(bindingVersion && requestedVersion && bindingVersion !== requestedVersion);
+}
+function isTransientWebSearchRestriction(params) {
+	if (params.nativeProviderWebSearchSupport === "unknown") return true;
+	if (params.params.config?.tools?.web?.search?.enabled === false) return false;
+	if (params.params.disableTools === true) return true;
+	const persistentWebSearchRestriction = params.webSearchAllowed === false && params.persistentWebSearchAllowed === false;
+	if (params.nativeCodeModeEnabled === false && !persistentWebSearchRestriction) return true;
+	if (params.webSearchAllowed !== false) return false;
+	if (params.persistentWebSearchAllowed !== void 0) return params.persistentWebSearchAllowed;
+	if (params.params.toolsAllow === void 0) return false;
+	return !params.params.toolsAllow.some((name) => {
+		const normalized = normalizeCodexDynamicToolName(name);
+		return normalized === "*" || normalized === "web_search";
+	});
+}
+function shouldRecheckRecoverablePluginBinding(params) {
+	if (!params.pluginThreadConfig?.enabled) return false;
+	if (!params.binding.pluginAppsFingerprint || !params.binding.pluginAppsInputFingerprint || params.binding.pluginAppsInputFingerprint !== params.pluginThreadConfig.inputFingerprint) return false;
+	const policyContext = params.binding.pluginAppPolicyContext;
+	if (!policyContext) return false;
+	const enabledPluginConfigKeys = params.pluginThreadConfig.enabledPluginConfigKeys ?? [];
+	const recoverablePluginConfigKeys = params.pluginThreadConfig.recoverablePluginConfigKeys ?? enabledPluginConfigKeys;
+	const recoverablePluginConfigKeySet = new Set(recoverablePluginConfigKeys);
+	const bindingContainsSettledPlugin = enabledPluginConfigKeys.filter((configKey) => !recoverablePluginConfigKeySet.has(configKey)).some((configKey) => (policyContext.pluginAppIds[configKey]?.length ?? 0) > 0 || Object.values(policyContext.apps).some((app) => app.source !== "account" && app.configKey === configKey));
+	const accountAppRecoveryEnabled = params.pluginThreadConfig.accountAppRecoveryEnabled ?? enabledPluginConfigKeys.length === 0;
+	return bindingContainsSettledPlugin || accountAppRecoveryEnabled && Object.keys(policyContext.apps).length === 0 || recoverablePluginConfigKeys.length > 0;
+}
+//#endregion
+//#region extensions/codex/src/app-server/thread-lifecycle-errors.ts
+var CodexThreadStartRequestError = class extends Error {
+	constructor(cause) {
+		super(formatErrorMessage(cause), { cause });
+		this.name = "CodexThreadStartRequestError";
+	}
+};
+var CodexThreadBindingConflictError = class extends Error {
+	constructor(threadId, operation) {
+		super(`Codex thread binding changed while ${operation}: ${threadId}`);
+		this.name = "CodexThreadBindingConflictError";
+	}
+};
+var CodexRingZeroAttestationError = class extends Error {
+	constructor(cause) {
+		super("Codex ring-zero MCP attestation failed", { cause });
+		this.name = "CodexRingZeroAttestationError";
+	}
+};
+var CodexThreadBindingConflictAfterCleanupError = class extends CodexThreadBindingConflictError {};
+var CodexAdoptedThreadActiveError = class extends Error {
+	constructor() {
+		super("Codex session became active in another runner; wait for it to finish before continuing");
+		this.name = "CodexAdoptedThreadActiveError";
+	}
+};
+//#endregion
+//#region extensions/codex/src/app-server/reasoning-effort.ts
+const CODEX_REASONING_EFFORTS = [
+	"minimal",
+	"low",
+	"medium",
+	"high",
+	"xhigh",
+	"max",
+	"ultra"
+];
+const GPT_56_MAX_REASONING_EFFORTS = [
+	"low",
+	"medium",
+	"high",
+	"xhigh",
+	"max"
+];
+const GPT_56_ULTRA_REASONING_EFFORTS = [...GPT_56_MAX_REASONING_EFFORTS, "ultra"];
+const GPT_5_PRO_REASONING_EFFORTS = [
+	"medium",
+	"high",
+	"xhigh"
+];
+const GPT_56_ULTRA_MODEL_IDS = /* @__PURE__ */ new Set(["gpt-5.6-sol", "gpt-5.6-terra"]);
+const GPT_56_MAX_MODEL_IDS = /* @__PURE__ */ new Set([...GPT_56_ULTRA_MODEL_IDS, "gpt-5.6-luna"]);
+const MODERN_CODEX_MODEL_IDS = /* @__PURE__ */ new Set([
+	...GPT_56_MAX_MODEL_IDS,
+	"gpt-5.5",
+	"gpt-5.5-pro",
+	"gpt-5.4",
+	"gpt-5.4-pro",
+	"gpt-5.4-mini",
+	"gpt-5.3-codex-spark"
+]);
+function normalizeCodexReasoningEfforts(efforts) {
+	if (!efforts) return [];
+	const supported = new Set(efforts.map((effort) => effort.trim().toLowerCase()));
+	return CODEX_REASONING_EFFORTS.filter((effort) => supported.has(effort));
+}
+/** Read reasoning metadata after the Codex app-server route has been selected. */
+function readCodexSupportedReasoningEfforts(compat) {
+	if (!compat || typeof compat !== "object" || Array.isArray(compat)) return;
+	const efforts = compat.supportedReasoningEfforts;
+	if (!Array.isArray(efforts)) return;
+	return efforts.filter((effort) => typeof effort === "string");
+}
+function resolveSupportedReasoningEffort(params) {
+	const supported = normalizeCodexReasoningEfforts(params.supportedReasoningEfforts);
+	if (supported.includes(params.requested)) return params.requested;
+	const fallbackEfforts = params.requested === "ultra" ? supported : supported.filter((effort) => effort !== "ultra");
+	const requestedRank = CODEX_REASONING_EFFORTS.indexOf(params.requested);
+	return fallbackEfforts.find((effort) => CODEX_REASONING_EFFORTS.indexOf(effort) >= requestedRank) ?? fallbackEfforts.at(-1);
+}
+function resolveFallbackReasoningEfforts(modelId) {
+	const normalized = modelId.trim().toLowerCase();
+	if (GPT_56_ULTRA_MODEL_IDS.has(normalized)) return GPT_56_ULTRA_REASONING_EFFORTS;
+	if (normalized === "gpt-5.6-luna") return GPT_56_MAX_REASONING_EFFORTS;
+	if (normalized === "gpt-5.5-pro" || normalized === "gpt-5.4-pro") return GPT_5_PRO_REASONING_EFFORTS;
+}
+/** Resolve a turn effort from app-server metadata, with exact-name offline fallbacks. */
+function resolveCodexAppServerReasoningEffort(params) {
+	if (params.thinkLevel === "off" || params.thinkLevel === "adaptive") return null;
+	const supportedReasoningEfforts = params.supportedReasoningEfforts ?? resolveFallbackReasoningEfforts(params.modelId);
+	if (supportedReasoningEfforts) return resolveSupportedReasoningEffort({
+		requested: params.thinkLevel,
+		supportedReasoningEfforts
+	}) ?? null;
+	const normalizedModelId = params.modelId.trim().toLowerCase();
+	if (params.thinkLevel === "minimal") return MODERN_CODEX_MODEL_IDS.has(normalizedModelId) ? "low" : "minimal";
+	if (params.thinkLevel === "low" || params.thinkLevel === "medium" || params.thinkLevel === "high" || params.thinkLevel === "xhigh") return params.thinkLevel;
+	return params.thinkLevel === "max" && GPT_56_MAX_MODEL_IDS.has(normalizedModelId) ? "max" : null;
+}
+//#endregion
+//#region extensions/codex/src/app-server/thread-model-selection.ts
+const CODEX_NATIVE_PERSONALITY_NONE = "none";
+function resolveCodexBindingModelProviderFallback(params) {
+	const provider = params.provider?.trim().toLowerCase();
+	if (provider && provider !== "codex") return;
+	const currentModel = params.currentModel?.trim();
+	const bindingModel = params.bindingModel?.trim();
+	if (currentModel && bindingModel && currentModel === bindingModel && params.bindingModelProvider) return params.bindingModelProvider;
+	return hasProviderQualifiedModelRef(currentModel) ? void 0 : params.bindingModelProvider;
+}
+function resolveCodexAppServerThreadModelSelection(params) {
+	const authProfileId = params.authProfileId ?? params.binding?.authProfileId;
+	const explicitModelProvider = resolveCodexAppServerModelProvider({
+		provider: params.provider,
+		authProfileId,
+		authProfileStore: params.authProfileStore,
+		agentDir: params.agentDir,
+		config: params.config
+	});
+	const bindingModelProvider = params.binding?.threadId ? resolveCodexBindingModelProviderFallback({
+		provider: params.provider,
+		currentModel: params.model,
+		bindingModel: params.binding.model,
+		bindingModelProvider: params.binding.modelProvider
+	}) : void 0;
+	return resolveCodexAppServerRequestModelSelection({
+		model: params.model,
+		modelProvider: explicitModelProvider ?? bindingModelProvider,
+		authProfileId,
+		authProfileStore: params.authProfileStore,
+		agentDir: params.agentDir,
+		config: params.config
+	});
+}
+function resolveCodexAppServerRequestModelSelection(params) {
+	const model = params.model.trim();
+	const modelProvider = params.modelProvider?.trim();
+	if (modelProvider) return {
+		model,
+		modelProvider
+	};
+	const slashIndex = model.indexOf("/");
+	if (slashIndex <= 0 || slashIndex >= model.length - 1) return { model };
+	const inferredModelProvider = resolveCodexAppServerModelProvider({
+		provider: model.slice(0, slashIndex),
+		authProfileId: params.authProfileId,
+		authProfileStore: params.authProfileStore,
+		agentDir: params.agentDir,
+		config: params.config
+	});
+	return {
+		model: model.slice(slashIndex + 1).trim(),
+		...inferredModelProvider ? { modelProvider: inferredModelProvider } : {}
+	};
+}
+function hasProviderQualifiedModelRef(model) {
+	const trimmed = model?.trim();
+	const slashIndex = trimmed?.indexOf("/") ?? -1;
+	return slashIndex > 0 && slashIndex < (trimmed?.length ?? 0) - 1;
+}
+function resolveCodexAppServerModelProvider(params) {
+	const normalized = params.provider.trim();
+	const normalizedLower = normalized.toLowerCase();
+	if (!normalized || normalizedLower === "codex") return;
+	if (isCodexAppServerNativeAuthProfile(params) && normalizedLower === "openai") return;
+	return normalizedLower === "openai" ? "openai" : normalized;
+}
+function resolveReasoningEffort(thinkLevel, modelId, supportedReasoningEfforts) {
+	return resolveCodexAppServerReasoningEffort({
+		thinkLevel,
+		modelId,
+		supportedReasoningEfforts
+	});
+}
+//#endregion
+//#region extensions/codex/src/app-server/thread-prompt.ts
+function buildDeveloperInstructions(params, options = {}) {
+	const nativeCommandGuidance = listRegisteredPluginAgentPromptGuidance({
+		surface: "codex_app_server",
+		includeLegacyGlobalGuidance: false
+	}).join("\n");
+	return [
+		"You are a personal agent running inside OpenClaw. OpenClaw has dynamic tools for OpenClaw-owned messaging, cron, sessions, media, gateway, and nodes.",
+		buildDeferredDynamicToolManifest(options.dynamicTools),
+		buildSkillWorkshopInstruction(options.dynamicTools),
+		"Use Codex native `spawn_agent` for Codex subagents. `spawn_agent` and the other native collaboration tools may be deferred: when `spawn_agent` is not directly listed, load it with `tool_search` before spawning. Use OpenClaw `sessions_spawn` only for OpenClaw or ACP delegation, never as a substitute for `spawn_agent`.",
+		buildVisibleReplyInstruction(params, options.dynamicTools),
+		nativeCommandGuidance,
+		params.extraSystemPrompt
+	].filter((section) => typeof section === "string" && section.trim()).join("\n\n");
+}
+function buildDeferredDynamicToolManifest(dynamicTools) {
+	const deferredToolNames = [...new Set(flattenCodexDynamicToolFunctions(dynamicTools).filter((tool) => tool.deferLoading === true).map((tool) => tool.name.trim()).filter(Boolean))].toSorted((left, right) => left.localeCompare(right));
+	if (deferredToolNames.length === 0) return;
+	return `Deferred searchable OpenClaw dynamic tools available: ${deferredToolNames.join(", ")}. Use \`tool_search\` to load exact callable specs before use.`;
+}
+function buildSkillWorkshopInstruction(dynamicTools) {
+	if (!flattenCodexDynamicToolFunctions(dynamicTools).some((tool) => tool.name.trim() === SKILL_WORKSHOP_TOOL_NAME)) return;
+	return buildSkillWorkshopPromptSection().join("\n");
+}
+function buildVisibleReplyInstruction(params, dynamicTools) {
+	const messageToolAvailable = dynamicTools ? flattenCodexDynamicToolFunctions(dynamicTools).some((tool) => tool.name.trim() === "message") : params.disableMessageTool !== true;
+	if (params.sourceReplyDeliveryMode === "message_tool_only" && messageToolAvailable) return "Visible source replies are not automatically delivered for this run. Use `message(action=send)` for user-visible source-channel output. For progress, set `final=false`. When the message is the completed reply to the current source conversation, set `final=true`; OpenClaw stops after confirming delivery. If `final` is omitted, OpenClaw continues and resolves the latest omitted source reply only when the turn ends successfully. Do not repeat visible message content in your final answer.";
+	if (messageToolAvailable) return "For the current source conversation, reply normally in your final assistant message; OpenClaw will deliver it through the active source conversation. Use `message` only for explicit out-of-band sends, media/file sends, or sends to a different target.";
+	return "For the current source conversation, reply normally in your final assistant message; OpenClaw will deliver it through the active source conversation.";
+}
+//#endregion
+//#region extensions/codex/src/app-server/web-search.ts
+const CODEX_NATIVE_WEB_SEARCH_DISABLED_CONFIG = {
+	"features.standalone_web_search": false,
+	web_search: "disabled"
+};
+function normalizeOptionalString$1(value) {
+	return typeof value === "string" ? value.trim() || void 0 : void 0;
+}
+function normalizeUniqueStrings(value) {
+	if (!Array.isArray(value)) return;
+	const normalized = [...new Set(value.map(normalizeOptionalString$1).filter((entry) => Boolean(entry)))];
+	return normalized.length > 0 ? normalized : void 0;
+}
+function hasManagedSearchProvider(config) {
+	return normalizeOptionalString$1(config?.tools?.web?.search?.provider) !== void 0;
+}
+function hasNativeDomainRestrictions(config) {
+	return normalizeUniqueStrings(config?.tools?.web?.search?.openaiCodex?.allowedDomains) !== void 0;
+}
+function buildCodexNativeWebSearchThreadConfig(config) {
+	const nativeConfig = config?.tools?.web?.search?.openaiCodex;
+	const threadConfig = {
+		"features.standalone_web_search": false,
+		web_search: nativeConfig?.mode === "live" ? "live" : "cached"
+	};
+	const allowedDomains = normalizeUniqueStrings(nativeConfig?.allowedDomains);
+	if (allowedDomains) threadConfig["tools.web_search.allowed_domains"] = allowedDomains;
+	if (nativeConfig?.contextSize) threadConfig["tools.web_search.context_size"] = nativeConfig.contextSize;
+	const location = nativeConfig?.userLocation;
+	const country = normalizeOptionalString$1(location?.country);
+	const region = normalizeOptionalString$1(location?.region);
+	const city = normalizeOptionalString$1(location?.city);
+	const timezone = normalizeOptionalString$1(location?.timezone);
+	if (country) threadConfig["tools.web_search.location.country"] = country;
+	if (region) threadConfig["tools.web_search.location.region"] = region;
+	if (city) threadConfig["tools.web_search.location.city"] = city;
+	if (timezone) threadConfig["tools.web_search.location.timezone"] = timezone;
+	return threadConfig;
+}
+function resolveCodexWebSearchPlan(params) {
+	if (params.disableTools === true || params.webSearchAllowed === false || params.config?.tools?.web?.search?.enabled === false) return {
+		kind: "disabled",
+		suppressManagedWebSearch: true,
+		threadConfig: CODEX_NATIVE_WEB_SEARCH_DISABLED_CONFIG
+	};
+	const nativeConfig = params.config?.tools?.web?.search?.openaiCodex;
+	const managedSearchExplicit = hasManagedSearchProvider(params.config) || nativeConfig?.enabled === false;
+	const nativeProviderSupportsSearch = params.nativeProviderWebSearchSupport === void 0 || params.nativeProviderWebSearchSupport === "supported";
+	if (!(params.nativeToolSurfaceEnabled !== false && nativeProviderSupportsSearch && nativeConfig?.enabled !== false && !hasManagedSearchProvider(params.config))) {
+		if (!managedSearchExplicit && hasNativeDomainRestrictions(params.config)) return {
+			kind: "disabled",
+			suppressManagedWebSearch: true,
+			threadConfig: CODEX_NATIVE_WEB_SEARCH_DISABLED_CONFIG
+		};
+		return {
+			kind: "managed",
+			suppressManagedWebSearch: false,
+			threadConfig: CODEX_NATIVE_WEB_SEARCH_DISABLED_CONFIG
+		};
+	}
+	return {
+		kind: "native-hosted",
+		suppressManagedWebSearch: true,
+		threadConfig: buildCodexNativeWebSearchThreadConfig(params.config)
+	};
+}
+const CODEX_CODE_MODE_THREAD_CONFIG = {
+	"features.code_mode": true,
+	"features.code_mode_only": false,
+	"features.apply_patch_streaming_events": true
+};
+const CODEX_CODE_MODE_DISABLED_THREAD_CONFIG = {
+	"features.code_mode": false,
+	"features.code_mode_only": false
+};
+const CODEX_LIGHTWEIGHT_CONTEXT_THREAD_CONFIG = { project_doc_max_bytes: 0 };
+const CODEX_TOOL_SEARCH_UNSUPPORTED_THREAD_CONFIG = { "features.multi_agent": false };
+const CODEX_RING_ZERO_THREAD_CONFIG = {
+	"features.apps": false,
+	"features.current_time_reminder": false,
+	"features.deferred_executor": false,
+	"features.enable_fanout": false,
+	"features.goals": false,
+	"features.hooks": false,
+	"features.image_generation": false,
+	"features.memories": false,
+	"features.multi_agent": false,
+	"features.multi_agent_v2": false,
+	"features.plugins": false,
+	"features.standalone_web_search": false,
+	"features.token_budget": false,
+	"orchestrator.mcp.enabled": false,
+	"orchestrator.skills.enabled": false,
+	"tools.experimental_request_user_input.enabled": false,
+	hooks: {
+		PreToolUse: [],
+		PermissionRequest: [],
+		PostToolUse: [],
+		PreCompact: [],
+		PostCompact: [],
+		SessionStart: [],
+		UserPromptSubmit: [],
+		SubagentStart: [],
+		SubagentStop: [],
+		Stop: []
+	},
+	project_doc_max_bytes: 0,
+	notify: [],
+	web_search: "disabled"
+};
+const CODEX_RING_ZERO_RESTRICTED_FEATURES = /* @__PURE__ */ new Set([
+	"apps",
+	"code_mode",
+	"code_mode_only",
+	"current_time_reminder",
+	"deferred_executor",
+	"enable_fanout",
+	"goals",
+	"hooks",
+	"image_generation",
+	"memories",
+	"multi_agent",
+	"multi_agent_v2",
+	"plugins",
+	"standalone_web_search",
+	"token_budget"
+]);
+const CODEX_RING_ZERO_OVERRIDABLE_LAYER_TYPES = /* @__PURE__ */ new Set([
+	"mdm",
+	"system",
+	"enterpriseManaged",
+	"user",
+	"project",
+	"sessionFlags"
+]);
+function buildThreadStartParams(params, options) {
+	const ringZeroActive = (options.hostSystemAgentActive ?? isHostScopedAgentToolActive("openclaw")) && isSystemAgentOnlyCodexDynamicToolAllowlist(params.toolsAllow);
+	const resolvedModelProvider = resolveCodexAppServerModelProvider({
+		provider: params.provider,
+		authProfileId: params.authProfileId,
+		authProfileStore: params.authProfileStore,
+		agentDir: params.agentDir,
+		config: params.config
+	});
+	const modelSelection = resolveCodexAppServerRequestModelSelection({
+		model: options.model ?? params.modelId,
+		modelProvider: options.modelProvider ?? resolvedModelProvider,
+		authProfileId: params.authProfileId,
+		authProfileStore: params.authProfileStore,
+		agentDir: params.agentDir,
+		config: params.config
+	});
+	return {
+		model: modelSelection.model,
+		...modelSelection.modelProvider ? { modelProvider: modelSelection.modelProvider } : {},
+		cwd: options.cwd,
+		approvalPolicy: options.appServer.approvalPolicy,
+		approvalsReviewer: resolveCodexThreadApprovalsReviewer(options.appServer, options.config),
+		...codexThreadSandboxOrPermissions(options.appServer),
+		...options.appServer.serviceTier !== void 0 ? { serviceTier: options.appServer.serviceTier } : {},
+		personality: CODEX_NATIVE_PERSONALITY_NONE,
+		serviceName: "OpenClaw",
+		...ringZeroActive ? { baseInstructions: "" } : {},
+		config: buildCodexRuntimeThreadConfigForRun(params, options.config, {
+			nativeCodeModeEnabled: options.nativeCodeModeEnabled,
+			nativeProviderWebSearchSupport: options.nativeProviderWebSearchSupport,
+			nativeCodeModeOnlyEnabled: options.nativeCodeModeOnlyEnabled,
+			directOnlyToolNamespaces: resolveDirectOnlyToolNamespaces(options.dynamicTools),
+			webSearchAllowed: options.webSearchAllowed,
+			appServer: options.appServer,
+			hostSystemAgentActive: options.hostSystemAgentActive,
+			ringZeroInheritedMcpServerNames: options.ringZeroInheritedMcpServerNames
+		}),
+		...resolveCodexThreadEnvironmentSelection(options),
+		developerInstructions: options.developerInstructions ?? buildDeveloperInstructions(params, { dynamicTools: options.dynamicTools }),
+		dynamicTools: [...options.dynamicTools],
+		experimentalRawEvents: true
+	};
+}
+function buildThreadResumeParams(params, options) {
+	const modelSelection = options.preserveNativeModel ? void 0 : resolveCodexAppServerRequestModelSelection({
+		model: options.model ?? params.modelId,
+		modelProvider: options.modelProvider ?? resolveCodexAppServerModelProvider({
+			provider: params.provider,
+			authProfileId: options.authProfileId ?? params.authProfileId,
+			authProfileStore: params.authProfileStore,
+			agentDir: params.agentDir,
+			config: params.config
+		}),
+		authProfileId: options.authProfileId ?? params.authProfileId,
+		authProfileStore: params.authProfileStore,
+		agentDir: params.agentDir,
+		config: params.config
+	});
+	return {
+		threadId: options.threadId,
+		...modelSelection ? {
+			model: modelSelection.model,
+			...modelSelection.modelProvider ? { modelProvider: modelSelection.modelProvider } : {}
+		} : {},
+		approvalPolicy: options.appServer.approvalPolicy,
+		approvalsReviewer: resolveCodexThreadApprovalsReviewer(options.appServer, options.config),
+		...codexThreadSandboxOrPermissions(options.appServer),
+		...options.appServer.serviceTier !== void 0 ? { serviceTier: options.appServer.serviceTier } : {},
+		personality: CODEX_NATIVE_PERSONALITY_NONE,
+		config: buildCodexRuntimeThreadConfigForRun(params, options.config, {
+			nativeCodeModeEnabled: options.nativeCodeModeEnabled,
+			nativeProviderWebSearchSupport: options.nativeProviderWebSearchSupport,
+			nativeCodeModeOnlyEnabled: options.nativeCodeModeOnlyEnabled,
+			directOnlyToolNamespaces: resolveDirectOnlyToolNamespaces(options.dynamicTools),
+			webSearchAllowed: options.webSearchAllowed,
+			appServer: options.appServer,
+			hostSystemAgentActive: options.hostSystemAgentActive,
+			ringZeroInheritedMcpServerNames: options.ringZeroInheritedMcpServerNames
+		}),
+		developerInstructions: options.developerInstructions ?? buildDeveloperInstructions(params, { dynamicTools: options.dynamicTools })
+	};
+}
+function buildCodexRuntimeThreadConfig(config, options = {}) {
+	const codeModeConfig = {
+		...CODEX_CODE_MODE_THREAD_CONFIG,
+		"features.code_mode_only": options.nativeCodeModeOnlyEnabled === true
+	};
+	if (options.nativeCodeModeEnabled === false) {
+		const disabledConfig = mergeCodexThreadConfigs(config, CODEX_CODE_MODE_DISABLED_THREAD_CONFIG) ?? { ...CODEX_CODE_MODE_DISABLED_THREAD_CONFIG };
+		delete disabledConfig["features.apply_patch_streaming_events"];
+		return disabledConfig;
+	}
+	if (options.nativeCodeModeOnlyEnabled === true) return ensureDirectOnlyToolNamespaces(mergeCodexThreadConfigs(codeModeConfig, config, { "features.code_mode_only": true }) ?? {
+		...codeModeConfig,
+		"features.code_mode_only": true
+	}, options.directOnlyToolNamespaces);
+	return ensureDirectOnlyToolNamespaces(mergeCodexThreadConfigs(codeModeConfig, config) ?? { ...codeModeConfig }, options.directOnlyToolNamespaces);
+}
+function ensureDirectOnlyToolNamespaces(config, requiredNamespaces) {
+	if (!requiredNamespaces?.length) return config;
+	const configured = config["code_mode.direct_only_tool_namespaces"];
+	const namespaces = Array.isArray(configured) ? configured.filter((entry) => typeof entry === "string" && entry.length > 0) : [];
+	return {
+		...config,
+		"code_mode.direct_only_tool_namespaces": [.../* @__PURE__ */ new Set([...namespaces, ...requiredNamespaces])]
+	};
+}
+function resolveDirectOnlyToolNamespaces(dynamicTools) {
+	return (dynamicTools ?? []).filter((tool) => tool.type === "namespace" && tool.name === "openclaw_direct").map((tool) => tool.name);
+}
+function buildCodexRuntimeThreadConfigForRun(params, config, options = {}) {
+	const ringZeroActive = (options.hostSystemAgentActive ?? isHostScopedAgentToolActive("openclaw")) && isSystemAgentOnlyCodexDynamicToolAllowlist(params.toolsAllow);
+	const configMcpServers = config?.mcp_servers;
+	if (ringZeroActive && configMcpServers !== void 0 && !isJsonObject(configMcpServers)) throw new Error("Codex ring-zero received invalid thread mcp_servers config");
+	const ringZeroMcpServerNames = [...options.ringZeroInheritedMcpServerNames ?? [], ...isJsonObject(configMcpServers) ? Object.keys(configMcpServers) : []];
+	const webSearchConfig = resolveCodexWebSearchPlan({
+		config: params.config,
+		disableTools: params.disableTools,
+		nativeToolSurfaceEnabled: options.nativeCodeModeEnabled,
+		nativeProviderWebSearchSupport: options.nativeProviderWebSearchSupport,
+		webSearchAllowed: options.webSearchAllowed
+	}).threadConfig;
+	const baseConfig = buildCodexRuntimeThreadConfig(mergeCodexThreadConfigs(config, webSearchConfig), options);
+	const runtimeConfig = mergeCodexThreadConfigs(baseConfig, options.appServer?.networkProxy?.configPatch, shouldDisableCodexToolSearchForModel(params.modelId) ? CODEX_TOOL_SEARCH_UNSUPPORTED_THREAD_CONFIG : void 0, buildCodexRingZeroThreadConfigPatch(params, options.hostSystemAgentActive, ringZeroMcpServerNames)) ?? baseConfig;
+	if (params.bootstrapContextMode !== "lightweight") return runtimeConfig;
+	return mergeCodexThreadConfigs(runtimeConfig, CODEX_LIGHTWEIGHT_CONTEXT_THREAD_CONFIG) ?? {
+		...runtimeConfig,
+		...CODEX_LIGHTWEIGHT_CONTEXT_THREAD_CONFIG
+	};
+}
+function buildCodexRingZeroThreadConfigPatch(params, hostSystemAgentActive = isHostScopedAgentToolActive("openclaw"), inheritedMcpServerNames = []) {
+	if (!hostSystemAgentActive || !isSystemAgentOnlyCodexDynamicToolAllowlist(params.toolsAllow)) return;
+	const mcpServers = Object.fromEntries([...new Set(inheritedMcpServerNames)].toSorted().map((name) => [name, { enabled: false }]));
+	return {
+		...CODEX_RING_ZERO_THREAD_CONFIG,
+		...Object.keys(mcpServers).length > 0 ? { mcp_servers: mcpServers } : {}
+	};
+}
+async function readCodexInheritedMcpServerNames(client, cwd, signal) {
+	const response = await client.request("config/read", {
+		cwd,
+		includeLayers: true
+	}, { signal });
+	if (!isJsonObject(response) || !isJsonObject(response.config)) throw new Error("Codex config/read returned an invalid effective config");
+	if (!Array.isArray(response.layers)) throw new Error("Codex config/read omitted effective config layers");
+	for (const layer of response.layers) {
+		if (!isJsonObject(layer) || !isJsonObject(layer.name) || typeof layer.name.type !== "string") throw new Error("Codex config/read returned invalid effective config layers");
+		if (layer.name.type === "legacyManagedConfigTomlFromFile" || layer.name.type === "legacyManagedConfigTomlFromMdm") throw new Error(`Codex ring-zero cannot override config layer ${layer.name.type}`);
+		if (!CODEX_RING_ZERO_OVERRIDABLE_LAYER_TYPES.has(layer.name.type)) throw new Error(`Codex ring-zero does not recognize config layer ${layer.name.type}`);
+	}
+	const configuredServers = response.config.mcp_servers;
+	if (configuredServers === void 0) return [];
+	if (!isJsonObject(configuredServers)) throw new Error("Codex config/read returned invalid mcp_servers");
+	return Object.keys(configuredServers).toSorted();
+}
+async function assertCodexRingZeroHasNoManagedHooks(client, signal) {
+	const response = await client.request("configRequirements/read", void 0, { signal });
+	if (!isJsonObject(response) || !Object.hasOwn(response, "requirements")) throw new Error("Codex configRequirements/read returned an invalid response");
+	if (response.requirements === null) return;
+	if (!isJsonObject(response.requirements)) throw new Error("Codex configRequirements/read returned invalid requirements");
+	for (const key of [
+		"hooks",
+		"managedHooks",
+		"managed_hooks"
+	]) {
+		const hooks = response.requirements[key];
+		if (hooks === void 0 || hooks === null) continue;
+		if (!isJsonObject(hooks)) throw new Error("Codex configRequirements/read returned invalid managed hooks");
+		if (hasNonEmptyJsonValue(hooks)) throw new Error("Codex ring-zero cannot override managed hooks");
+	}
+	for (const key of ["featureRequirements", "feature_requirements"]) {
+		const requirements = response.requirements[key];
+		if (requirements === void 0 || requirements === null) continue;
+		if (!isJsonObject(requirements)) throw new Error("Codex configRequirements/read returned invalid feature requirements");
+		for (const [feature, enabled] of Object.entries(requirements)) {
+			if (typeof enabled !== "boolean") throw new Error("Codex configRequirements/read returned invalid feature requirements");
+			if (enabled && CODEX_RING_ZERO_RESTRICTED_FEATURES.has(feature)) throw new Error(`Codex ring-zero cannot override required feature ${feature}`);
 		}
-		if (binding?.threadId) if (binding.dynamicToolsFingerprint && !areDynamicToolFingerprintsCompatible(binding.dynamicToolsFingerprint, dynamicToolsFingerprint, legacyDynamicToolsFingerprint)) {
-			assertCodexBindingMayBeReplaced(binding, "changing the dynamic tool catalog");
-			preserveExistingBinding = shouldStartTransientNoToolThread({
-				previous: binding.dynamicToolsFingerprint,
-				nextHasDynamicTools: params.dynamicTools.length > 0
-			});
-			if (preserveExistingBinding) embeddedAgentLog.debug("codex app-server dynamic tools unavailable for turn; starting transient thread", { threadId: binding.threadId });
-			else {
-				embeddedAgentLog.debug("codex app-server dynamic tool catalog changed; starting a new thread", { threadId: binding.threadId });
-				await clearCurrentBinding("rotating a stale thread binding");
-			}
-		} else {
-			const resumeBinding = binding;
-			let resumeReservation;
-			try {
-				const authProfileId = resumeBinding.connectionScope === "supervision" ? void 0 : params.params.authProfileId ?? resumeBinding.authProfileId;
-				const finalConfigPatch = params.buildFinalConfigPatch?.({
-					action: "resume",
-					binding: resumeBinding
-				}) ?? {
-					configPatch: params.finalConfigPatch,
-					nativeHookRelayGeneration: params.nativeHookRelayGeneration
-				};
-				const pluginAppsConfigPatch = params.pluginThreadConfig?.enabled && resumeBinding.pluginAppPolicyContext ? buildCodexPluginAppsConfigPatchFromPolicyContext(resumeBinding.pluginAppPolicyContext) : void 0;
-				const resumeConfig = mergeCodexThreadConfigs(params.config, userMcpServersConfigPatch, pluginAppsConfigPatch, finalConfigPatch.configPatch);
-				const resumeParams = lifecycleTiming.measureSync("thread-resume-params", () => buildThreadResumeParams(params.params, {
-					threadId: resumeBinding.threadId,
-					authProfileId,
-					model: startModelSelection.model,
-					modelProvider: startModelProvider,
-					preserveNativeModel: resumeBinding.preserveNativeModel === true,
-					appServer: params.appServer,
-					dynamicTools: params.dynamicTools,
-					developerInstructions: params.developerInstructions,
-					config: resumeConfig,
-					nativeCodeModeEnabled: params.nativeCodeModeEnabled,
-					nativeProviderWebSearchSupport: params.nativeProviderWebSearchSupport,
-					nativeCodeModeOnlyEnabled: params.nativeCodeModeOnlyEnabled,
-					webSearchAllowed: params.webSearchAllowed,
-					hostSystemAgentActive,
-					ringZeroInheritedMcpServerNames
-				}));
-				const requestModelProvider = typeof resumeParams.modelProvider === "string" && resumeParams.modelProvider.trim() ? resumeParams.modelProvider : void 0;
-				throwIfAborted();
-				if (resumeBinding.preserveNativeModel === true) {
-					const current = await lifecycleTiming.measure("thread-read-adoption-status", () => params.client.request("thread/read", {
-						threadId: resumeBinding.threadId,
-						includeTurns: false
-					}, { signal: params.signal }));
-					throwIfAborted();
-					if (current.thread.status?.type === "active") throw new CodexAdoptedThreadActiveError();
-				}
-				resumeReservation = params.reserveResumeThread?.(resumeBinding.threadId);
-				const response = await lifecycleTiming.measure("thread-resume-request", () => resumeCodexAppServerThread({
-					client: params.client,
-					abandonClient: params.abandonClient ?? (() => closeCodexStartupClientBestEffort(params.client)),
-					request: resumeParams,
-					signal: params.signal
-				}));
-				if (ringZeroActive) try {
-					await lifecycleTiming.measure("ring-zero-mcp-attestation", () => attestCodexRingZeroThreadHasNoMcpServers(params.client, response.thread.id, params.signal));
-				} catch (error) {
-					await (params.abandonClient ?? (() => closeCodexStartupClientBestEffort(params.client)))();
-					throw new CodexRingZeroAttestationError(error);
-				}
-				throwIfAborted();
-				const boundAuthProfileId = authProfileId;
-				const nextMcpServersFingerprint = params.mcpServersFingerprintEvaluated === true ? params.mcpServersFingerprint : resumeBinding.mcpServersFingerprint;
-				const resumePatch = {
-					cwd: params.cwd,
-					authProfileId: boundAuthProfileId,
-					model: response.model ?? resumeParams.model ?? params.params.modelId,
-					preserveNativeModel: resumeBinding.preserveNativeModel === true ? true : void 0,
-					modelProvider: normalizeBindingModelProvider(boundAuthProfileId, response.modelProvider ?? requestModelProvider ?? startModelProvider),
-					dynamicToolsFingerprint,
-					dynamicToolsContainDeferred,
-					webSearchThreadConfigFingerprint,
-					userMcpServersFingerprint,
-					mcpServersFingerprint: nextMcpServersFingerprint,
-					ringZeroConfigFingerprint,
-					ringZeroClientInstanceId,
-					networkProxyProfileName: params.appServer.networkProxy?.profileName,
-					networkProxyConfigFingerprint,
-					nativeHookRelayGeneration: finalConfigPatch.nativeHookRelayGeneration ?? resumeBinding.nativeHookRelayGeneration,
-					appServerRuntimeFingerprint: resumeBinding.connectionScope === "supervision" ? buildCodexAppServerConnectionFingerprint(params.appServer, params.params.agentDir) : params.appServerRuntimeFingerprint,
-					pluginAppsFingerprint: resumeBinding.pluginAppsFingerprint,
-					pluginAppsInputFingerprint: resumeBinding.pluginAppsInputFingerprint,
-					pluginAppPolicyContext: resumeBinding.pluginAppPolicyContext,
-					contextEngine: contextEngineBinding,
-					environmentSelectionFingerprint
-				};
-				if (!await lifecycleTiming.measure("thread-resume-write-binding", () => params.bindingStore.mutate(bindingIdentity, {
-					kind: "patch",
-					threadId: resumeBinding.threadId,
-					patch: resumePatch
-				}))) throw new CodexThreadBindingConflictError(resumeBinding.threadId, "committing a resumed thread");
-				if (contextEngineBinding) embeddedAgentLog.info("codex app-server wrote context-engine thread binding", {
-					sessionId: params.params.sessionId,
-					sessionKey: params.params.sessionKey,
-					threadId: response.thread.id,
-					engineId: contextEngineBinding.engineId,
-					epoch: contextEngineBinding.projection?.epoch,
-					fingerprint: contextEngineBinding.projection?.fingerprint,
-					action: "resumed"
-				});
-				lifecycleTiming.mark("thread-ready");
-				lifecycleTiming.logSummary({
-					runId: params.params.runId,
-					sessionId: params.params.sessionId,
-					sessionKey: params.params.sessionKey,
-					threadId: response.thread.id,
-					action: "resumed"
-				});
-				const activeTurnIds = readActiveCodexTurnIds(response.thread);
-				return {
-					...resumeBinding,
-					threadId: response.thread.id,
-					...resumePatch,
-					lifecycle: {
-						action: "resumed",
-						...activeTurnIds.length ? { activeTurnIds } : {}
-					}
-				};
-			} catch (error) {
-				resumeReservation?.release();
-				if (isCodexAppServerStartSelectionChangedError(error)) throw error;
-				if (error instanceof CodexRingZeroAttestationError) {
-					await clearCurrentBinding("retiring a failed ring-zero thread attestation");
-					throw error;
-				}
-				if (error instanceof CodexAdoptedThreadActiveError) throw error;
-				if (isCodexAppServerUnsafeSubscriptionError(error)) throw error;
-				const resumeRejected = error instanceof CodexAppServerRpcError;
-				if (!await unsubscribeCodexThreadBestEffort(params.client, {
-					threadId: resumeBinding.threadId,
-					timeoutMs: 5e3
-				}) && !resumeRejected && !isCodexAppServerConnectionClosedError(error) && !params.signal?.aborted) throw new CodexAppServerUnsafeSubscriptionError("Codex thread/resume subscription cleanup failed", { cause: error });
-				if (isCodexAppServerConnectionClosedError(error) || params.signal?.aborted) throw error;
-				embeddedAgentLog.warn("codex app-server thread resume failed; starting a new thread", { error });
-				await clearCurrentBinding("rotating a stale thread binding");
-			}
+	}
+}
+async function attestCodexRingZeroThreadHasNoMcpServers(client, threadId, signal) {
+	const response = await client.request("mcpServerStatus/list", {
+		threadId,
+		limit: 1,
+		detail: "toolsAndAuthOnly"
+	}, { signal });
+	if (!isJsonObject(response) || !Array.isArray(response.data)) throw new Error("Codex mcpServerStatus/list returned an invalid ring-zero attestation");
+	if (response.data.length > 0) {
+		const first = response.data[0];
+		const serverName = isJsonObject(first) && typeof first.name === "string" ? first.name : "unknown";
+		throw new Error(`Codex ring-zero MCP attestation found server ${serverName}`);
+	}
+	if (response.nextCursor !== void 0 && response.nextCursor !== null) throw new Error("Codex mcpServerStatus/list returned an invalid empty-page cursor");
+}
+function hasNonEmptyJsonValue(value) {
+	if (value === null || value === false || value === "") return false;
+	if (Array.isArray(value)) return value.length > 0;
+	if (typeof value === "object") return Object.values(value).some(hasNonEmptyJsonValue);
+	return true;
+}
+function resolveCodexThreadApprovalsReviewer(appServer, config) {
+	return config?.approvals_reviewer === "user" ? "user" : appServer.approvalsReviewer;
+}
+function codexThreadSandboxOrPermissions(appServer) {
+	if (appServer.networkProxy) return {};
+	return { sandbox: appServer.sandbox };
+}
+function resolveCodexThreadEnvironmentSelection(options) {
+	if (options.nativeCodeModeEnabled === false) return { environments: [] };
+	if (options.environmentSelection) return { environments: options.environmentSelection };
+	return {};
+}
+//#endregion
+//#region extensions/codex/src/app-server/thread-resume.ts
+/** Owns Codex thread/resume subscription safety. */
+/** Resumes one thread and retires the physical client when acceptance is indeterminate. */
+async function resumeCodexAppServerThread(params) {
+	const threadId = params.request.threadId;
+	let response;
+	try {
+		response = assertCodexThreadResumeResponse(await params.client.request("thread/resume", params.request, {
+			...params.timeoutMs !== void 0 ? { timeoutMs: params.timeoutMs } : {},
+			...params.signal ? { signal: params.signal } : {}
+		}));
+		assertCodexThreadResumeSubscription(threadId, response.thread.id);
+	} catch (error) {
+		if (isCodexAppServerStartSelectionChangedError(error) || isCodexAppServerPrewriteRequestCancellationError(error)) throw error;
+		if (error instanceof CodexAppServerRpcError) throw error;
+		try {
+			await params.abandonClient();
+		} catch (abandonError) {
+			throw new CodexAppServerUnsafeSubscriptionError(`Codex thread/resume client could not be retired for ${threadId}`, { cause: abandonError });
 		}
-		const pluginThreadConfig = params.pluginThreadConfig?.enabled ? prebuiltPluginThreadConfig ?? await lifecycleTiming.measure("plugin-config-build", () => params.pluginThreadConfig?.build()) : void 0;
-		const finalConfigPatch = params.buildFinalConfigPatch?.({ action: "start" }) ?? {
+		if (error instanceof CodexAppServerUnsafeSubscriptionError) throw error;
+		throw new CodexAppServerUnsafeSubscriptionError(error instanceof Error ? error.message : `Codex thread/resume outcome is indeterminate for ${threadId}`, { cause: error });
+	}
+	return response;
+}
+//#endregion
+//#region extensions/codex/src/app-server/thread-lifecycle-io.ts
+async function resumeExistingCodexThread(params, context) {
+	const { binding: resumeBinding, bindingIdentity, startModelSelection, startModelProvider, userMcpServersConfigPatch, dynamicToolsFingerprint, dynamicToolsContainDeferred, webSearchThreadConfigFingerprint, userMcpServersFingerprint, ringZeroConfigFingerprint, ringZeroClientInstanceId, networkProxyConfigFingerprint, contextEngineBinding, environmentSelectionFingerprint, hostSystemAgentActive, ringZeroActive, ringZeroInheritedMcpServerNames, lifecycleTiming, normalizeBindingModelProvider, throwIfAborted, clearCurrentBinding } = context;
+	let resumeReservation;
+	try {
+		const authProfileId = resumeBinding.connectionScope === "supervision" ? void 0 : params.params.authProfileId ?? resumeBinding.authProfileId;
+		const finalConfigPatch = params.buildFinalConfigPatch?.({
+			action: "resume",
+			binding: resumeBinding
+		}) ?? {
 			configPatch: params.finalConfigPatch,
 			nativeHookRelayGeneration: params.nativeHookRelayGeneration
 		};
-		const config = lifecycleTiming.measureSync("merge-thread-config", () => mergeCodexThreadConfigs(params.config, userMcpServersConfigPatch, pluginThreadConfig?.configPatch, finalConfigPatch.configPatch));
-		const startParams = lifecycleTiming.measureSync("thread-start-params", () => buildThreadStartParams(params.params, {
-			cwd: params.cwd,
-			dynamicTools: params.dynamicTools,
+		const pluginAppsConfigPatch = params.pluginThreadConfig?.enabled && resumeBinding.pluginAppPolicyContext ? buildCodexPluginAppsConfigPatchFromPolicyContext(resumeBinding.pluginAppPolicyContext) : void 0;
+		const resumeConfig = mergeCodexThreadConfigs(params.config, userMcpServersConfigPatch, pluginAppsConfigPatch, finalConfigPatch.configPatch);
+		const resumeParams = lifecycleTiming.measureSync("thread-resume-params", () => buildThreadResumeParams(params.params, {
+			threadId: resumeBinding.threadId,
+			authProfileId,
+			model: startModelSelection.model,
+			modelProvider: startModelProvider,
+			preserveNativeModel: resumeBinding.preserveNativeModel === true,
 			appServer: params.appServer,
+			dynamicTools: params.dynamicTools,
 			developerInstructions: params.developerInstructions,
-			config,
+			config: resumeConfig,
 			nativeCodeModeEnabled: params.nativeCodeModeEnabled,
 			nativeProviderWebSearchSupport: params.nativeProviderWebSearchSupport,
 			nativeCodeModeOnlyEnabled: params.nativeCodeModeOnlyEnabled,
 			webSearchAllowed: params.webSearchAllowed,
-			environmentSelection: params.environmentSelection,
-			model: startModelSelection.model,
-			modelProvider: startModelProvider,
 			hostSystemAgentActive,
 			ringZeroInheritedMcpServerNames
 		}));
-		const requestModelProvider = typeof startParams.modelProvider === "string" && startParams.modelProvider.trim() ? startParams.modelProvider : void 0;
-		const response = assertCodexThreadStartResponse(await lifecycleTiming.measure("thread-start-request", async () => {
-			try {
-				return await params.client.request("thread/start", startParams, { signal: params.signal });
-			} catch (error) {
-				if (error instanceof CodexAppServerRpcError) throw new CodexThreadStartRequestError(error);
-				throw error;
-			}
+		const requestModelProvider = typeof resumeParams.modelProvider === "string" && resumeParams.modelProvider.trim() ? resumeParams.modelProvider : void 0;
+		throwIfAborted();
+		if (resumeBinding.preserveNativeModel === true) {
+			const current = await lifecycleTiming.measure("thread-read-adoption-status", () => params.client.request("thread/read", {
+				threadId: resumeBinding.threadId,
+				includeTurns: false
+			}, { signal: params.signal }));
+			throwIfAborted();
+			if (current.thread.status?.type === "active") throw new CodexAdoptedThreadActiveError();
+		}
+		resumeReservation = params.reserveResumeThread?.(resumeBinding.threadId);
+		const response = await lifecycleTiming.measure("thread-resume-request", () => resumeCodexAppServerThread({
+			client: params.client,
+			abandonClient: params.abandonClient ?? (() => closeCodexStartupClientBestEffort(params.client)),
+			request: resumeParams,
+			signal: params.signal
 		}));
 		if (ringZeroActive) try {
 			await lifecycleTiming.measure("ring-zero-mcp-attestation", () => attestCodexRingZeroThreadHasNoMcpServers(params.client, response.thread.id, params.signal));
 		} catch (error) {
 			await (params.abandonClient ?? (() => closeCodexStartupClientBestEffort(params.client)))();
-			throw error;
+			throw new CodexRingZeroAttestationError(error);
 		}
 		throwIfAborted();
-		const modelProvider = resolveCodexAppServerModelProvider({
-			provider: params.params.provider,
-			authProfileId: params.params.authProfileId,
-			authProfileStore: params.params.authProfileStore,
-			agentDir: params.params.agentDir,
-			config: params.params.config
+		const boundAuthProfileId = authProfileId;
+		const nextMcpServersFingerprint = params.mcpServersFingerprintEvaluated === true ? params.mcpServersFingerprint : resumeBinding.mcpServersFingerprint;
+		const resumePatch = {
+			cwd: params.cwd,
+			authProfileId: boundAuthProfileId,
+			model: response.model ?? resumeParams.model ?? params.params.modelId,
+			preserveNativeModel: resumeBinding.preserveNativeModel === true ? true : void 0,
+			modelProvider: normalizeBindingModelProvider(boundAuthProfileId, response.modelProvider ?? requestModelProvider ?? startModelProvider),
+			dynamicToolsFingerprint,
+			dynamicToolsContainDeferred,
+			webSearchThreadConfigFingerprint,
+			userMcpServersFingerprint,
+			mcpServersFingerprint: nextMcpServersFingerprint,
+			ringZeroConfigFingerprint,
+			ringZeroClientInstanceId,
+			networkProxyProfileName: params.appServer.networkProxy?.profileName,
+			networkProxyConfigFingerprint,
+			nativeHookRelayGeneration: finalConfigPatch.nativeHookRelayGeneration ?? resumeBinding.nativeHookRelayGeneration,
+			appServerRuntimeFingerprint: resumeBinding.connectionScope === "supervision" ? buildCodexAppServerConnectionFingerprint(params.appServer, params.params.agentDir) : params.appServerRuntimeFingerprint,
+			pluginAppsFingerprint: resumeBinding.pluginAppsFingerprint,
+			pluginAppsInputFingerprint: resumeBinding.pluginAppsInputFingerprint,
+			pluginAppPolicyContext: resumeBinding.pluginAppPolicyContext,
+			contextEngine: contextEngineBinding,
+			environmentSelectionFingerprint
+		};
+		if (!await lifecycleTiming.measure("thread-resume-write-binding", () => params.bindingStore.mutate(bindingIdentity, {
+			kind: "patch",
+			threadId: resumeBinding.threadId,
+			patch: resumePatch
+		}))) throw new CodexThreadBindingConflictError(resumeBinding.threadId, "committing a resumed thread");
+		if (contextEngineBinding) embeddedAgentLog.info("codex app-server wrote context-engine thread binding", {
+			sessionId: params.params.sessionId,
+			sessionKey: params.params.sessionKey,
+			threadId: response.thread.id,
+			engineId: contextEngineBinding.engineId,
+			epoch: contextEngineBinding.projection?.epoch,
+			fingerprint: contextEngineBinding.projection?.fingerprint,
+			action: "resumed"
 		});
-		const nextMcpServersFingerprint = params.mcpServersFingerprintEvaluated === true ? params.mcpServersFingerprint : void 0;
-		if (!preserveExistingBinding) {
-			if (!await lifecycleTiming.measure("thread-start-write-binding", () => params.bindingStore.mutate(bindingIdentity, {
-				kind: "set",
-				if: { kind: "absent" },
-				binding: {
-					threadId: response.thread.id,
-					cwd: params.cwd,
-					authProfileId: params.params.authProfileId,
-					model: response.model ?? startParams.model ?? params.params.modelId,
-					modelProvider: normalizeBindingModelProvider(params.params.authProfileId, response.modelProvider ?? requestModelProvider ?? startModelProvider ?? modelProvider),
-					dynamicToolsFingerprint,
-					dynamicToolsContainDeferred,
-					webSearchThreadConfigFingerprint,
-					userMcpServersFingerprint,
-					mcpServersFingerprint: nextMcpServersFingerprint,
-					ringZeroConfigFingerprint,
-					ringZeroClientInstanceId,
-					networkProxyProfileName: params.appServer.networkProxy?.profileName,
-					networkProxyConfigFingerprint,
-					nativeHookRelayGeneration: finalConfigPatch.nativeHookRelayGeneration,
-					appServerRuntimeFingerprint: params.appServerRuntimeFingerprint,
-					pluginAppsFingerprint: pluginThreadConfig?.fingerprint,
-					pluginAppsInputFingerprint: pluginThreadConfig?.inputFingerprint,
-					pluginAppPolicyContext: pluginThreadConfig?.policyContext,
-					contextEngine: contextEngineBinding,
-					environmentSelectionFingerprint
-				}
-			}))) throw new CodexThreadBindingConflictError(response.thread.id, "committing a fresh thread");
-			if (contextEngineBinding) embeddedAgentLog.info("codex app-server wrote context-engine thread binding", {
-				sessionId: params.params.sessionId,
-				sessionKey: params.params.sessionKey,
-				threadId: response.thread.id,
-				engineId: contextEngineBinding.engineId,
-				epoch: contextEngineBinding.projection?.epoch,
-				fingerprint: contextEngineBinding.projection?.fingerprint,
-				action: rotatedContextEngineBinding ? "rotated" : "started"
-			});
-		}
 		lifecycleTiming.mark("thread-ready");
 		lifecycleTiming.logSummary({
 			runId: params.params.runId,
 			sessionId: params.params.sessionId,
 			sessionKey: params.params.sessionKey,
 			threadId: response.thread.id,
+			action: "resumed"
+		});
+		const activeTurnIds = readActiveCodexTurnIds(response.thread);
+		return {
+			...resumeBinding,
+			threadId: response.thread.id,
+			...resumePatch,
+			lifecycle: {
+				action: "resumed",
+				...activeTurnIds.length ? { activeTurnIds } : {}
+			}
+		};
+	} catch (error) {
+		resumeReservation?.release();
+		if (isCodexAppServerStartSelectionChangedError(error)) throw error;
+		if (error instanceof CodexRingZeroAttestationError) {
+			await clearCurrentBinding("retiring a failed ring-zero thread attestation");
+			throw error;
+		}
+		if (error instanceof CodexAdoptedThreadActiveError) throw error;
+		if (isCodexAppServerUnsafeSubscriptionError(error)) throw error;
+		const resumeRejected = error instanceof CodexAppServerRpcError;
+		if (!await unsubscribeCodexThreadBestEffort(params.client, {
+			threadId: resumeBinding.threadId,
+			timeoutMs: 5e3
+		}) && !resumeRejected && !isCodexAppServerConnectionClosedError(error) && !params.signal?.aborted) throw new CodexAppServerUnsafeSubscriptionError("Codex thread/resume subscription cleanup failed", { cause: error });
+		if (isCodexAppServerConnectionClosedError(error) || params.signal?.aborted) throw error;
+		embeddedAgentLog.warn("codex app-server thread resume failed; starting a new thread", { error });
+		await clearCurrentBinding("rotating a stale thread binding");
+	}
+}
+async function startFreshCodexThread(params, context) {
+	const { bindingIdentity, startModelSelection, startModelProvider, userMcpServersConfigPatch, dynamicToolsFingerprint, dynamicToolsContainDeferred, webSearchThreadConfigFingerprint, userMcpServersFingerprint, ringZeroConfigFingerprint, ringZeroClientInstanceId, networkProxyConfigFingerprint, contextEngineBinding, environmentSelectionFingerprint, hostSystemAgentActive, ringZeroActive, ringZeroInheritedMcpServerNames, lifecycleTiming, normalizeBindingModelProvider, throwIfAborted, prebuiltPluginThreadConfig, preserveExistingBinding, rotatedContextEngineBinding } = context;
+	const pluginThreadConfig = params.pluginThreadConfig?.enabled ? prebuiltPluginThreadConfig ?? await lifecycleTiming.measure("plugin-config-build", () => params.pluginThreadConfig?.build()) : void 0;
+	const finalConfigPatch = params.buildFinalConfigPatch?.({ action: "start" }) ?? {
+		configPatch: params.finalConfigPatch,
+		nativeHookRelayGeneration: params.nativeHookRelayGeneration
+	};
+	const config = lifecycleTiming.measureSync("merge-thread-config", () => mergeCodexThreadConfigs(params.config, userMcpServersConfigPatch, pluginThreadConfig?.configPatch, finalConfigPatch.configPatch));
+	const startParams = lifecycleTiming.measureSync("thread-start-params", () => buildThreadStartParams(params.params, {
+		cwd: params.cwd,
+		dynamicTools: params.dynamicTools,
+		appServer: params.appServer,
+		developerInstructions: params.developerInstructions,
+		config,
+		nativeCodeModeEnabled: params.nativeCodeModeEnabled,
+		nativeProviderWebSearchSupport: params.nativeProviderWebSearchSupport,
+		nativeCodeModeOnlyEnabled: params.nativeCodeModeOnlyEnabled,
+		webSearchAllowed: params.webSearchAllowed,
+		environmentSelection: params.environmentSelection,
+		model: startModelSelection.model,
+		modelProvider: startModelProvider,
+		hostSystemAgentActive,
+		ringZeroInheritedMcpServerNames
+	}));
+	const requestModelProvider = typeof startParams.modelProvider === "string" && startParams.modelProvider.trim() ? startParams.modelProvider : void 0;
+	const response = assertCodexThreadStartResponse(await lifecycleTiming.measure("thread-start-request", async () => {
+		try {
+			return await params.client.request("thread/start", startParams, { signal: params.signal });
+		} catch (error) {
+			if (error instanceof CodexAppServerRpcError) throw new CodexThreadStartRequestError(error);
+			throw error;
+		}
+	}));
+	if (ringZeroActive) try {
+		await lifecycleTiming.measure("ring-zero-mcp-attestation", () => attestCodexRingZeroThreadHasNoMcpServers(params.client, response.thread.id, params.signal));
+	} catch (error) {
+		await (params.abandonClient ?? (() => closeCodexStartupClientBestEffort(params.client)))();
+		throw error;
+	}
+	throwIfAborted();
+	const modelProvider = resolveCodexAppServerModelProvider({
+		provider: params.params.provider,
+		authProfileId: params.params.authProfileId,
+		authProfileStore: params.params.authProfileStore,
+		agentDir: params.params.agentDir,
+		config: params.params.config
+	});
+	const nextMcpServersFingerprint = params.mcpServersFingerprintEvaluated === true ? params.mcpServersFingerprint : void 0;
+	if (!preserveExistingBinding) {
+		if (!await lifecycleTiming.measure("thread-start-write-binding", () => params.bindingStore.mutate(bindingIdentity, {
+			kind: "set",
+			if: { kind: "absent" },
+			binding: {
+				threadId: response.thread.id,
+				cwd: params.cwd,
+				authProfileId: params.params.authProfileId,
+				model: response.model ?? startParams.model ?? params.params.modelId,
+				modelProvider: normalizeBindingModelProvider(params.params.authProfileId, response.modelProvider ?? requestModelProvider ?? startModelProvider ?? modelProvider),
+				dynamicToolsFingerprint,
+				dynamicToolsContainDeferred,
+				webSearchThreadConfigFingerprint,
+				userMcpServersFingerprint,
+				mcpServersFingerprint: nextMcpServersFingerprint,
+				ringZeroConfigFingerprint,
+				ringZeroClientInstanceId,
+				networkProxyProfileName: params.appServer.networkProxy?.profileName,
+				networkProxyConfigFingerprint,
+				nativeHookRelayGeneration: finalConfigPatch.nativeHookRelayGeneration,
+				appServerRuntimeFingerprint: params.appServerRuntimeFingerprint,
+				pluginAppsFingerprint: pluginThreadConfig?.fingerprint,
+				pluginAppsInputFingerprint: pluginThreadConfig?.inputFingerprint,
+				pluginAppPolicyContext: pluginThreadConfig?.policyContext,
+				contextEngine: contextEngineBinding,
+				environmentSelectionFingerprint
+			}
+		}))) throw new CodexThreadBindingConflictError(response.thread.id, "committing a fresh thread");
+		if (contextEngineBinding) embeddedAgentLog.info("codex app-server wrote context-engine thread binding", {
+			sessionId: params.params.sessionId,
+			sessionKey: params.params.sessionKey,
+			threadId: response.thread.id,
+			engineId: contextEngineBinding.engineId,
+			epoch: contextEngineBinding.projection?.epoch,
+			fingerprint: contextEngineBinding.projection?.fingerprint,
 			action: rotatedContextEngineBinding ? "rotated" : "started"
 		});
-		return {
-			threadId: response.thread.id,
-			cwd: params.cwd,
-			authProfileId: params.params.authProfileId,
-			model: response.model ?? startParams.model ?? params.params.modelId,
-			modelProvider: response.modelProvider ?? requestModelProvider ?? startModelProvider ?? modelProvider,
-			dynamicToolsFingerprint,
-			dynamicToolsContainDeferred,
-			userMcpServersFingerprint,
-			mcpServersFingerprint: nextMcpServersFingerprint,
-			ringZeroConfigFingerprint,
-			ringZeroClientInstanceId,
-			networkProxyProfileName: params.appServer.networkProxy?.profileName,
-			networkProxyConfigFingerprint,
-			nativeHookRelayGeneration: finalConfigPatch.nativeHookRelayGeneration,
-			appServerRuntimeFingerprint: params.appServerRuntimeFingerprint,
-			pluginAppsFingerprint: pluginThreadConfig?.fingerprint,
-			pluginAppsInputFingerprint: pluginThreadConfig?.inputFingerprint,
-			pluginAppPolicyContext: pluginThreadConfig?.policyContext,
-			contextEngine: contextEngineBinding,
-			environmentSelectionFingerprint,
-			lifecycle: {
-				action: "started",
-				...rotatedContextEngineBinding ? { rotatedContextEngineBinding } : {}
-			}
-		};
+	}
+	lifecycleTiming.mark("thread-ready");
+	lifecycleTiming.logSummary({
+		runId: params.params.runId,
+		sessionId: params.params.sessionId,
+		sessionKey: params.params.sessionKey,
+		threadId: response.thread.id,
+		action: rotatedContextEngineBinding ? "rotated" : "started"
+	});
+	return {
+		threadId: response.thread.id,
+		cwd: params.cwd,
+		authProfileId: params.params.authProfileId,
+		model: response.model ?? startParams.model ?? params.params.modelId,
+		modelProvider: response.modelProvider ?? requestModelProvider ?? startModelProvider ?? modelProvider,
+		dynamicToolsFingerprint,
+		dynamicToolsContainDeferred,
+		userMcpServersFingerprint,
+		mcpServersFingerprint: nextMcpServersFingerprint,
+		ringZeroConfigFingerprint,
+		ringZeroClientInstanceId,
+		networkProxyProfileName: params.appServer.networkProxy?.profileName,
+		networkProxyConfigFingerprint,
+		nativeHookRelayGeneration: finalConfigPatch.nativeHookRelayGeneration,
+		appServerRuntimeFingerprint: params.appServerRuntimeFingerprint,
+		pluginAppsFingerprint: pluginThreadConfig?.fingerprint,
+		pluginAppsInputFingerprint: pluginThreadConfig?.inputFingerprint,
+		pluginAppPolicyContext: pluginThreadConfig?.policyContext,
+		contextEngine: contextEngineBinding,
+		environmentSelectionFingerprint,
+		lifecycle: {
+			action: "started",
+			...rotatedContextEngineBinding ? { rotatedContextEngineBinding } : {}
+		}
+	};
+}
+//#endregion
+//#region extensions/codex/src/app-server/thread-lifecycle-timing.ts
+const CODEX_THREAD_LIFECYCLE_TIMING_WARN_TOTAL_MS = 1e3;
+const CODEX_THREAD_LIFECYCLE_TIMING_WARN_STAGE_MS = 500;
+function shouldWarnCodexThreadLifecycleTimingSummary(summary, options = {}) {
+	const totalThresholdMs = options.totalThresholdMs ?? CODEX_THREAD_LIFECYCLE_TIMING_WARN_TOTAL_MS;
+	const stageThresholdMs = options.stageThresholdMs ?? CODEX_THREAD_LIFECYCLE_TIMING_WARN_STAGE_MS;
+	return summary.totalMs >= totalThresholdMs || summary.spans.some((span) => span.durationMs >= stageThresholdMs);
+}
+function formatCodexThreadLifecycleTimingSummary(params) {
+	const spans = params.summary.spans.length > 0 ? params.summary.spans.map((span) => `${span.name}:${span.durationMs}ms@${span.elapsedMs}ms`).join(",") : "none";
+	return `[trace:codex-app-server] thread lifecycle: runId=${params.runId} sessionId=${params.sessionId} sessionKey=${params.sessionKey ?? "unknown"} action=${params.action} totalMs=${params.summary.totalMs} stages=${spans}`;
+}
+function createCodexThreadLifecycleTimingTracker(options = {}) {
+	const log = options.log ?? embeddedAgentLog;
+	if (!options.enabled && log.isEnabled?.("trace") !== true) return {
+		async measure(_name, run) {
+			return await run();
+		},
+		measureSync(_name, run) {
+			return run();
+		},
+		mark() {},
+		logSummary() {}
+	};
+	const now = options.now ?? Date.now;
+	const startedAt = now();
+	let didLog = false;
+	const spans = [];
+	const toMs = (value) => Math.max(0, Math.round(value));
+	const record = (name, spanStartedAt) => {
+		const currentAt = now();
+		spans.push({
+			name,
+			durationMs: toMs(currentAt - spanStartedAt),
+			elapsedMs: toMs(currentAt - startedAt)
+		});
+	};
+	const snapshot = () => ({
+		totalMs: toMs(now() - startedAt),
+		spans: spans.slice()
 	});
+	return {
+		async measure(name, run) {
+			const spanStartedAt = now();
+			try {
+				return await run();
+			} finally {
+				record(name, spanStartedAt);
+			}
+		},
+		measureSync(name, run) {
+			const spanStartedAt = now();
+			try {
+				return run();
+			} finally {
+				record(name, spanStartedAt);
+			}
+		},
+		mark(name) {
+			record(name, now());
+		},
+		logSummary(params) {
+			if (didLog) return;
+			const summary = snapshot();
+			const shouldWarn = shouldWarnCodexThreadLifecycleTimingSummary(summary, options);
+			if (!shouldWarn && !log.isEnabled?.("trace")) return;
+			didLog = true;
+			const message = formatCodexThreadLifecycleTimingSummary({
+				runId: params.runId,
+				sessionId: params.sessionId,
+				sessionKey: params.sessionKey,
+				action: params.action,
+				summary
+			});
+			const meta = {
+				runId: params.runId,
+				sessionId: params.sessionId,
+				sessionKey: params.sessionKey,
+				action: params.action,
+				threadId: params.threadId,
+				totalMs: summary.totalMs,
+				spans: summary.spans
+			};
+			if (shouldWarn) log.warn(message, meta);
+			else log.trace(message, meta);
+		}
+	};
 }
+//#endregion
+//#region extensions/codex/src/app-server/thread-supervision.ts
 async function materializePendingSupervisionBranch(params) {
 	let pending = params.binding.pendingSupervisionBranch;
 	const connectionFingerprint = buildCodexAppServerConnectionFingerprint(params.appServer, params.attempt.agentDir);
@@ -2364,408 +2666,480 @@ async function recoverPendingSupervisionArtifacts(params, pending) {
 		expected: pending,
 		pending: next
 	})) throw new CodexThreadBindingConflictError(pending.sourceThreadId, "recovering a supervised Codex branch");
-	return next;
-}
-async function trackPendingSupervisionArtifacts(params, pending, cleanupThreadIds) {
-	const next = withPendingSupervisionCleanup(pending, cleanupThreadIds);
-	if (!await params.bindingStore.mutate(params.bindingIdentity, {
-		kind: "patch-pending-supervision-branch",
-		expected: pending,
-		pending: next
-	})) {
-		const cleanupFailed = [];
-		for (const threadId of cleanupThreadIds) if (!await archiveSupervisionArtifact(params.client, threadId)) cleanupFailed.push(threadId);
-		if (cleanupFailed.length > 0) throw new CodexAppServerUnsafeSubscriptionError(`Codex supervised branch CAS cleanup failed: ${cleanupFailed.join(", ")}`);
-		throw new CodexThreadBindingConflictAfterCleanupError(pending.sourceThreadId, "tracking supervised Codex branch cleanup");
-	}
-	return next;
-}
-function withPendingSupervisionCleanup(pending, cleanupThreadIds) {
-	return {
-		sourceThreadId: pending.sourceThreadId,
-		...pending.connectionFingerprint ? { connectionFingerprint: pending.connectionFingerprint } : {},
-		...pending.lastTurnId ? { lastTurnId: pending.lastTurnId } : {},
-		...cleanupThreadIds.length > 0 ? { cleanupThreadIds } : {}
-	};
-}
-async function cleanPendingSupervisionArtifacts(client, pending) {
-	const remaining = [];
-	for (const threadId of pending.cleanupThreadIds ?? []) if (!await archiveSupervisionArtifact(client, threadId)) remaining.push(threadId);
-	return { remaining };
-}
-async function archiveSupervisionArtifact(client, threadId) {
-	try {
-		await client.request("thread/archive", { threadId }, { timeoutMs: CODEX_APP_SERVER_UNSUBSCRIBE_TIMEOUT_MS });
-		return true;
-	} catch (error) {
-		const message = formatErrorMessage(error).toLowerCase();
-		if (message.includes("no rollout found for thread id") || message.includes("thread not found") || message.includes("already archived")) return true;
-		await unsubscribeCodexThreadBestEffort(client, {
-			threadId,
-			timeoutMs: CODEX_APP_SERVER_UNSUBSCRIBE_TIMEOUT_MS
-		});
-		embeddedAgentLog.warn("failed to archive temporary Codex supervision thread", {
-			threadId,
-			error
-		});
-		return false;
-	}
-}
-function shouldRotateCodexAppServerBindingForRuntime(params) {
-	if (!params.current) return false;
-	if (params.binding === params.current) return false;
-	return params.connectionClass === "remote" || Boolean(params.binding);
-}
-function resolveCodexGpt56MultiAgentVersion(modelRef) {
-	let modelId = modelRef?.trim().toLowerCase();
-	if (!modelId) return;
-	const slashIndex = modelId.indexOf("/");
-	if (slashIndex > 0) {
-		const provider = modelId.slice(0, slashIndex);
-		if (provider !== "openai" && provider !== "codex") return;
-		modelId = modelId.slice(slashIndex + 1);
-	}
-	if (modelId === "gpt-5.6-sol" || modelId === "gpt-5.6-terra") return "v2";
-	return modelId === "gpt-5.6-luna" ? "v1" : void 0;
-}
-function shouldRotateCodexGpt56MultiAgentBinding(params) {
-	const bindingVersion = resolveCodexGpt56MultiAgentVersion(params.bindingModel);
-	const requestedVersion = resolveCodexGpt56MultiAgentVersion(params.requestedModel);
-	return Boolean(bindingVersion && requestedVersion && bindingVersion !== requestedVersion);
-}
-function isTransientWebSearchRestriction(params) {
-	if (params.nativeProviderWebSearchSupport === "unknown") return true;
-	if (params.params.config?.tools?.web?.search?.enabled === false) return false;
-	if (params.params.disableTools === true) return true;
-	const persistentWebSearchRestriction = params.webSearchAllowed === false && params.persistentWebSearchAllowed === false;
-	if (params.nativeCodeModeEnabled === false && !persistentWebSearchRestriction) return true;
-	if (params.webSearchAllowed !== false) return false;
-	if (params.persistentWebSearchAllowed !== void 0) return params.persistentWebSearchAllowed;
-	if (params.params.toolsAllow === void 0) return false;
-	return !params.params.toolsAllow.some((name) => {
-		const normalized = normalizeCodexDynamicToolName(name);
-		return normalized === "*" || normalized === "web_search";
-	});
-}
-function buildContextEngineBinding(params, projection) {
-	const contextEngine = isActiveHarnessContextEngine(params.contextEngine) ? params.contextEngine : void 0;
-	const engineId = contextEngine?.info?.id?.trim();
-	if (!contextEngine || !engineId) return;
-	return {
-		schemaVersion: 1,
-		engineId,
-		policyFingerprint: JSON.stringify({
-			schemaVersion: 1,
-			engineId,
-			engineVersion: contextEngine.info.version,
-			ownsCompaction: contextEngine.info.ownsCompaction === true,
-			turnMaintenanceMode: contextEngine.info.turnMaintenanceMode,
-			citationsMode: resolveContextEngineCitationsMode(params.config),
-			contextTokenBudget: params.contextTokenBudget,
-			projectionMaxChars: resolveCodexContextEngineProjectionMaxChars({
-				contextTokenBudget: params.contextTokenBudget,
-				reserveTokens: resolveCodexContextEngineProjectionReserveTokens({ config: params.config })
-			})
-		}),
-		projection: projection ? buildContextEngineProjectionBinding(projection) : void 0
-	};
-}
-function buildContextEngineProjectionBinding(projection) {
-	return {
-		schemaVersion: 1,
-		mode: "thread_bootstrap",
-		epoch: projection.epoch,
-		fingerprint: projection.fingerprint
-	};
-}
-function isContextEngineBindingCompatible(previous, next) {
-	return previous?.schemaVersion === next.schemaVersion && previous.engineId === next.engineId && previous.policyFingerprint === next.policyFingerprint && areContextEngineProjectionBindingsCompatible(previous.projection, next.projection);
-}
-function areContextEngineProjectionBindingsCompatible(previous, next) {
-	if (!next) return previous === void 0;
-	return previous?.schemaVersion === next.schemaVersion && previous.mode === next.mode && previous.epoch === next.epoch && previous.fingerprint === next.fingerprint;
-}
-function resolveContextEngineCitationsMode(config) {
-	const rootConfig = isUnknownRecord(config) ? config : void 0;
-	const citations = (isUnknownRecord(rootConfig?.memory) ? rootConfig.memory : void 0)?.citations;
-	return isJsonConfigValue(citations) ? citations : void 0;
-}
-function isUnknownRecord(value) {
-	return Boolean(value && typeof value === "object" && !Array.isArray(value));
-}
-function isJsonConfigValue(value) {
-	if (value === null || typeof value === "string" || typeof value === "boolean") return true;
-	if (typeof value === "number") return Number.isFinite(value);
-	if (Array.isArray(value)) return value.every(isJsonConfigValue);
-	return isUnknownRecord(value) && Object.values(value).every(isJsonConfigValue);
-}
-function shouldRecheckRecoverablePluginBinding(params) {
-	if (!params.pluginThreadConfig?.enabled) return false;
-	if (!params.binding.pluginAppsFingerprint || !params.binding.pluginAppsInputFingerprint || params.binding.pluginAppsInputFingerprint !== params.pluginThreadConfig.inputFingerprint) return false;
-	const policyContext = params.binding.pluginAppPolicyContext;
-	if (!policyContext) return false;
-	const expectedPluginConfigKeys = params.pluginThreadConfig.enabledPluginConfigKeys ?? [];
-	return Object.keys(policyContext.apps).length === 0 || expectedPluginConfigKeys.length > 0;
-}
-function buildThreadStartParams(params, options) {
-	const ringZeroActive = (options.hostSystemAgentActive ?? isHostScopedAgentToolActive("openclaw")) && isSystemAgentOnlyCodexDynamicToolAllowlist(params.toolsAllow);
-	const resolvedModelProvider = resolveCodexAppServerModelProvider({
-		provider: params.provider,
-		authProfileId: params.authProfileId,
-		authProfileStore: params.authProfileStore,
-		agentDir: params.agentDir,
-		config: params.config
-	});
-	const modelSelection = resolveCodexAppServerRequestModelSelection({
-		model: options.model ?? params.modelId,
-		modelProvider: options.modelProvider ?? resolvedModelProvider,
-		authProfileId: params.authProfileId,
-		authProfileStore: params.authProfileStore,
-		agentDir: params.agentDir,
-		config: params.config
-	});
-	return {
-		model: modelSelection.model,
-		...modelSelection.modelProvider ? { modelProvider: modelSelection.modelProvider } : {},
-		cwd: options.cwd,
-		approvalPolicy: options.appServer.approvalPolicy,
-		approvalsReviewer: resolveCodexThreadApprovalsReviewer(options.appServer, options.config),
-		...codexThreadSandboxOrPermissions(options.appServer),
-		...options.appServer.serviceTier !== void 0 ? { serviceTier: options.appServer.serviceTier } : {},
-		personality: CODEX_NATIVE_PERSONALITY_NONE,
-		serviceName: "OpenClaw",
-		...ringZeroActive ? { baseInstructions: CODEX_RING_ZERO_BASE_INSTRUCTIONS } : {},
-		config: buildCodexRuntimeThreadConfigForRun(params, options.config, {
-			nativeCodeModeEnabled: options.nativeCodeModeEnabled,
-			nativeProviderWebSearchSupport: options.nativeProviderWebSearchSupport,
-			nativeCodeModeOnlyEnabled: options.nativeCodeModeOnlyEnabled,
-			directOnlyToolNamespaces: resolveDirectOnlyToolNamespaces(options.dynamicTools),
-			webSearchAllowed: options.webSearchAllowed,
-			appServer: options.appServer,
-			hostSystemAgentActive: options.hostSystemAgentActive,
-			ringZeroInheritedMcpServerNames: options.ringZeroInheritedMcpServerNames
-		}),
-		...resolveCodexThreadEnvironmentSelection(options),
-		developerInstructions: options.developerInstructions ?? buildDeveloperInstructions(params, { dynamicTools: options.dynamicTools }),
-		dynamicTools: [...options.dynamicTools],
-		experimentalRawEvents: true
-	};
+	return next;
 }
-function buildThreadResumeParams(params, options) {
-	const modelSelection = options.preserveNativeModel ? void 0 : resolveCodexAppServerRequestModelSelection({
-		model: options.model ?? params.modelId,
-		modelProvider: options.modelProvider ?? resolveCodexAppServerModelProvider({
-			provider: params.provider,
-			authProfileId: options.authProfileId ?? params.authProfileId,
-			authProfileStore: params.authProfileStore,
-			agentDir: params.agentDir,
-			config: params.config
-		}),
-		authProfileId: options.authProfileId ?? params.authProfileId,
-		authProfileStore: params.authProfileStore,
-		agentDir: params.agentDir,
-		config: params.config
-	});
+async function trackPendingSupervisionArtifacts(params, pending, cleanupThreadIds) {
+	const next = withPendingSupervisionCleanup(pending, cleanupThreadIds);
+	if (!await params.bindingStore.mutate(params.bindingIdentity, {
+		kind: "patch-pending-supervision-branch",
+		expected: pending,
+		pending: next
+	})) {
+		const cleanupFailed = [];
+		for (const threadId of cleanupThreadIds) if (!await archiveSupervisionArtifact(params.client, threadId)) cleanupFailed.push(threadId);
+		if (cleanupFailed.length > 0) throw new CodexAppServerUnsafeSubscriptionError(`Codex supervised branch CAS cleanup failed: ${cleanupFailed.join(", ")}`);
+		throw new CodexThreadBindingConflictAfterCleanupError(pending.sourceThreadId, "tracking supervised Codex branch cleanup");
+	}
+	return next;
+}
+function withPendingSupervisionCleanup(pending, cleanupThreadIds) {
 	return {
-		threadId: options.threadId,
-		...modelSelection ? {
-			model: modelSelection.model,
-			...modelSelection.modelProvider ? { modelProvider: modelSelection.modelProvider } : {}
-		} : {},
-		approvalPolicy: options.appServer.approvalPolicy,
-		approvalsReviewer: resolveCodexThreadApprovalsReviewer(options.appServer, options.config),
-		...codexThreadSandboxOrPermissions(options.appServer),
-		...options.appServer.serviceTier !== void 0 ? { serviceTier: options.appServer.serviceTier } : {},
-		personality: CODEX_NATIVE_PERSONALITY_NONE,
-		config: buildCodexRuntimeThreadConfigForRun(params, options.config, {
-			nativeCodeModeEnabled: options.nativeCodeModeEnabled,
-			nativeProviderWebSearchSupport: options.nativeProviderWebSearchSupport,
-			nativeCodeModeOnlyEnabled: options.nativeCodeModeOnlyEnabled,
-			directOnlyToolNamespaces: resolveDirectOnlyToolNamespaces(options.dynamicTools),
-			webSearchAllowed: options.webSearchAllowed,
-			appServer: options.appServer,
-			hostSystemAgentActive: options.hostSystemAgentActive,
-			ringZeroInheritedMcpServerNames: options.ringZeroInheritedMcpServerNames
-		}),
-		developerInstructions: options.developerInstructions ?? buildDeveloperInstructions(params, { dynamicTools: options.dynamicTools })
+		sourceThreadId: pending.sourceThreadId,
+		...pending.connectionFingerprint ? { connectionFingerprint: pending.connectionFingerprint } : {},
+		...pending.lastTurnId ? { lastTurnId: pending.lastTurnId } : {},
+		...cleanupThreadIds.length > 0 ? { cleanupThreadIds } : {}
 	};
 }
-function resolveCodexBindingModelProviderFallback(params) {
-	const provider = params.provider?.trim().toLowerCase();
-	if (provider && provider !== "codex") return;
-	const currentModel = params.currentModel?.trim();
-	const bindingModel = params.bindingModel?.trim();
-	if (currentModel && bindingModel && currentModel === bindingModel && params.bindingModelProvider) return params.bindingModelProvider;
-	return hasProviderQualifiedModelRef(currentModel) ? void 0 : params.bindingModelProvider;
+async function cleanPendingSupervisionArtifacts(client, pending) {
+	const remaining = [];
+	for (const threadId of pending.cleanupThreadIds ?? []) if (!await archiveSupervisionArtifact(client, threadId)) remaining.push(threadId);
+	return { remaining };
 }
-function resolveCodexAppServerThreadModelSelection(params) {
-	const authProfileId = params.authProfileId ?? params.binding?.authProfileId;
-	const explicitModelProvider = resolveCodexAppServerModelProvider({
-		provider: params.provider,
-		authProfileId,
-		authProfileStore: params.authProfileStore,
-		agentDir: params.agentDir,
-		config: params.config
-	});
-	const bindingModelProvider = params.binding?.threadId ? resolveCodexBindingModelProviderFallback({
-		provider: params.provider,
-		currentModel: params.model,
-		bindingModel: params.binding.model,
-		bindingModelProvider: params.binding.modelProvider
-	}) : void 0;
-	return resolveCodexAppServerRequestModelSelection({
-		model: params.model,
-		modelProvider: explicitModelProvider ?? bindingModelProvider,
-		authProfileId,
-		authProfileStore: params.authProfileStore,
-		agentDir: params.agentDir,
-		config: params.config
-	});
+async function archiveSupervisionArtifact(client, threadId) {
+	try {
+		await client.request("thread/archive", { threadId }, { timeoutMs: CODEX_APP_SERVER_UNSUBSCRIBE_TIMEOUT_MS });
+		return true;
+	} catch (error) {
+		const message = formatErrorMessage(error).toLowerCase();
+		if (message.includes("no rollout found for thread id") || message.includes("thread not found") || message.includes("already archived")) return true;
+		await unsubscribeCodexThreadBestEffort(client, {
+			threadId,
+			timeoutMs: CODEX_APP_SERVER_UNSUBSCRIBE_TIMEOUT_MS
+		});
+		embeddedAgentLog.warn("failed to archive temporary Codex supervision thread", {
+			threadId,
+			error
+		});
+		return false;
+	}
 }
-function resolveCodexAppServerRequestModelSelection(params) {
-	const model = params.model.trim();
-	const modelProvider = params.modelProvider?.trim();
-	if (modelProvider) return {
-		model,
-		modelProvider
-	};
-	const slashIndex = model.indexOf("/");
-	if (slashIndex <= 0 || slashIndex >= model.length - 1) return { model };
-	const inferredModelProvider = resolveCodexAppServerModelProvider({
-		provider: model.slice(0, slashIndex),
-		authProfileId: params.authProfileId,
-		authProfileStore: params.authProfileStore,
-		agentDir: params.agentDir,
-		config: params.config
+//#endregion
+//#region extensions/codex/src/app-server/thread-lifecycle-run.ts
+async function startOrResumeThread(params) {
+	const bindingIdentity = sessionBindingIdentity({
+		sessionId: params.params.sessionId,
+		sessionKey: params.params.sessionKey,
+		agentId: params.agentId ?? params.params.agentId,
+		config: params.params.config
+	});
+	return await params.bindingStore.withLease(bindingIdentity, async () => {
+		const lifecycleTiming = createCodexThreadLifecycleTimingTracker({
+			...params.timing,
+			enabled: params.timing?.enabled ?? isCodexAppServerProfilerEnabled(params.params.config)
+		});
+		const legacyDynamicToolsFingerprint = lifecycleTiming.measureSync("legacy-dynamic-tools-fingerprint", () => codexLegacyDynamicToolsFingerprint(params.dynamicTools));
+		const dynamicToolsFingerprint = lifecycleTiming.measureSync("dynamic-tools-fingerprint", () => hashCodexAppServerBindingFingerprint(legacyDynamicToolsFingerprint));
+		const dynamicToolsContainDeferred = flattenCodexDynamicToolFunctions(params.dynamicTools).some((tool) => tool.deferLoading === true);
+		const webSearchThreadConfigFingerprint = fingerprintJsonObject(lifecycleTiming.measureSync("web-search-plan", () => resolveCodexWebSearchPlan({
+			config: params.params.config,
+			disableTools: params.params.disableTools,
+			nativeToolSurfaceEnabled: params.nativeCodeModeEnabled,
+			nativeProviderWebSearchSupport: params.nativeProviderWebSearchSupport,
+			webSearchAllowed: params.webSearchAllowed
+		})).threadConfig);
+		const networkProxyConfigFingerprint = params.appServer.networkProxy?.configFingerprint;
+		const contextEngineBinding = lifecycleTiming.measureSync("context-engine-binding", () => buildContextEngineBinding(params.params, params.contextEngineProjection));
+		const userMcpServersConfigPatch = params.userMcpServersEnabled === false ? void 0 : await buildCodexUserMcpServersThreadConfigPatchForRuntime(params.params.config, {
+			agentId: params.agentId ?? params.params.agentId,
+			agentDir: params.params.agentDir,
+			allowLiteralOAuthProjection: params.appServer.connectionClass !== "remote",
+			onServerUnavailable: (serverName, error) => embeddedAgentLog.warn("skipping unavailable MCP OAuth server", {
+				serverName,
+				error: formatErrorMessage(error)
+			})
+		});
+		const legacyUserMcpServersFingerprint = legacyFingerprintUserMcpServersConfigPatch(userMcpServersConfigPatch);
+		const userMcpServersFingerprint = fingerprintUserMcpServersConfigPatch(userMcpServersConfigPatch);
+		const environmentSelectionFingerprint = fingerprintEnvironmentSelection(params.environmentSelection);
+		const hostSystemAgentActive = params.hostSystemAgentActive ?? isHostScopedAgentToolActive("openclaw");
+		const ringZeroActive = hostSystemAgentActive && isSystemAgentOnlyCodexDynamicToolAllowlist(params.params.toolsAllow);
+		if (ringZeroActive && params.nativeCodeModeEnabled !== false) throw new Error("Codex ring-zero requires native code mode to be disabled");
+		const ringZeroInheritedMcpServerNames = ringZeroActive ? await lifecycleTiming.measure("ring-zero-mcp-config-read", () => readCodexInheritedMcpServerNames(params.client, params.cwd, params.signal)) : [];
+		if (ringZeroActive) await lifecycleTiming.measure("ring-zero-config-requirements-read", () => assertCodexRingZeroHasNoManagedHooks(params.client, params.signal));
+		const ringZeroConfigFingerprint = ringZeroActive ? fingerprintJsonObject({
+			version: 1,
+			baseInstructions: "",
+			config: buildCodexRingZeroThreadConfigPatch(params.params, true, ringZeroInheritedMcpServerNames)
+		}) : void 0;
+		const ringZeroClientInstanceId = ringZeroActive ? getCodexAppServerClientInstanceId(params.client) : void 0;
+		let binding = await lifecycleTiming.measure("read-binding", () => params.bindingStore.read(bindingIdentity));
+		const normalizeBindingModelProvider = (authProfileId, modelProvider) => normalizeCodexAppServerBindingModelProvider({
+			authProfileId,
+			modelProvider,
+			authProfileStore: params.params.authProfileStore,
+			agentDir: params.params.agentDir,
+			config: params.params.config
+		});
+		const throwIfAborted = () => {
+			if (!params.signal?.aborted) return;
+			const reason = params.signal.reason;
+			if (reason instanceof Error) throw reason;
+			const error = new Error(typeof reason === "string" && reason.length > 0 ? reason : "codex app-server thread lifecycle aborted");
+			error.name = "AbortError";
+			throw error;
+		};
+		if (!binding && bindingIdentity.kind === "session" && bindingIdentity.sessionKey) {
+			if (!await lifecycleTiming.measure("reclaim-binding-generation", () => reclaimCurrentCodexSessionGeneration({
+				bindingStore: params.bindingStore,
+				identity: bindingIdentity,
+				config: params.params.config
+			}))) throw new Error(`Codex session generation is no longer current: ${bindingIdentity.sessionId}`);
+		}
+		if (binding?.pendingSupervisionBranch) {
+			const pendingBinding = binding;
+			const pluginThreadConfig = params.pluginThreadConfig?.enabled ? await lifecycleTiming.measure("plugin-config-build", () => params.pluginThreadConfig?.build()) : void 0;
+			const finalConfigPatch = params.buildFinalConfigPatch?.({ action: "start" }) ?? {
+				configPatch: params.finalConfigPatch,
+				nativeHookRelayGeneration: params.nativeHookRelayGeneration
+			};
+			const config = lifecycleTiming.measureSync("merge-thread-config", () => mergeCodexThreadConfigs(params.config, userMcpServersConfigPatch, pluginThreadConfig?.configPatch, finalConfigPatch.configPatch));
+			return await materializePendingSupervisionBranch({
+				client: params.client,
+				abandonClient: params.abandonClient ?? (() => closeCodexStartupClientBestEffort(params.client)),
+				bindingStore: params.bindingStore,
+				bindingIdentity,
+				binding: pendingBinding,
+				attempt: params.params,
+				cwd: params.cwd,
+				dynamicTools: params.dynamicTools,
+				appServer: params.appServer,
+				developerInstructions: params.developerInstructions,
+				config,
+				nativeCodeModeEnabled: params.nativeCodeModeEnabled,
+				nativeProviderWebSearchSupport: params.nativeProviderWebSearchSupport,
+				nativeCodeModeOnlyEnabled: params.nativeCodeModeOnlyEnabled,
+				webSearchAllowed: params.webSearchAllowed,
+				environmentSelection: params.environmentSelection,
+				signal: params.signal,
+				throwIfAborted,
+				lifecycleTiming,
+				normalizeBindingModelProvider,
+				bindingPatch: {
+					cwd: params.cwd,
+					authProfileId: void 0,
+					preserveNativeModel: true,
+					dynamicToolsFingerprint,
+					dynamicToolsContainDeferred,
+					webSearchThreadConfigFingerprint,
+					userMcpServersFingerprint,
+					mcpServersFingerprint: params.mcpServersFingerprintEvaluated === true ? params.mcpServersFingerprint : pendingBinding.mcpServersFingerprint,
+					networkProxyProfileName: params.appServer.networkProxy?.profileName,
+					networkProxyConfigFingerprint,
+					nativeHookRelayGeneration: finalConfigPatch.nativeHookRelayGeneration,
+					appServerRuntimeFingerprint: buildCodexAppServerConnectionFingerprint(params.appServer, params.params.agentDir),
+					pluginAppsFingerprint: pluginThreadConfig?.fingerprint,
+					pluginAppsInputFingerprint: pluginThreadConfig?.inputFingerprint,
+					pluginAppPolicyContext: pluginThreadConfig?.policyContext,
+					contextEngine: contextEngineBinding,
+					environmentSelectionFingerprint,
+					conversationSourceTransferComplete: true
+				}
+			});
+		}
+		const clearCurrentBinding = async (operation) => {
+			const current = binding;
+			if (!current?.threadId) return;
+			assertCodexBindingMayBeReplaced(current, operation);
+			if (!await params.bindingStore.mutate(bindingIdentity, {
+				kind: "clear",
+				threadId: current.threadId
+			})) throw new CodexThreadBindingConflictError(current.threadId, operation);
+			binding = void 0;
+		};
+		if (binding?.threadId && (binding.ringZeroConfigFingerprint !== ringZeroConfigFingerprint || binding.ringZeroClientInstanceId !== ringZeroClientInstanceId) && (ringZeroActive || binding.ringZeroConfigFingerprint !== void 0)) {
+			embeddedAgentLog.debug("codex app-server ring-zero restriction changed; rotating thread", { threadId: binding.threadId });
+			await clearCurrentBinding("rotating a ring-zero thread binding");
+		}
+		if (binding?.threadId && shouldRotateCodexAppServerBindingForRuntime({
+			connectionClass: params.appServer.connectionClass,
+			current: binding.connectionScope === "supervision" ? buildCodexAppServerConnectionFingerprint(params.appServer, params.params.agentDir) : params.appServerRuntimeFingerprint,
+			binding: binding.appServerRuntimeFingerprint
+		})) {
+			embeddedAgentLog.debug("codex app-server runtime identity changed; starting a new thread", {
+				threadId: binding.threadId,
+				connectionClass: params.appServer.connectionClass
+			});
+			await clearCurrentBinding("rotating a stale thread binding");
+			binding = void 0;
+		}
+		if (binding?.threadId && shouldRotateCodexGpt56MultiAgentBinding({
+			bindingModel: binding.model,
+			requestedModel: params.params.modelId
+		})) {
+			embeddedAgentLog.debug("codex app-server GPT-5.6 multi-agent version changed; starting a new thread", {
+				threadId: binding.threadId,
+				bindingModel: binding.model,
+				requestedModel: params.params.modelId
+			});
+			await clearCurrentBinding("rotating a GPT-5.6 multi-agent thread binding");
+			binding = void 0;
+		}
+		const startModelSelection = resolveCodexAppServerThreadModelSelection({
+			provider: params.params.provider,
+			model: params.params.modelId,
+			binding,
+			authProfileId: params.params.authProfileId,
+			authProfileStore: params.params.authProfileStore,
+			agentDir: params.params.agentDir,
+			config: params.params.config
+		});
+		const startModelProvider = startModelSelection.modelProvider;
+		let preserveExistingBinding = !ringZeroActive && params.nativeProviderWebSearchSupport === "unknown" && !binding?.threadId;
+		let rotatedContextEngineBinding = false;
+		let prebuiltPluginThreadConfig;
+		const webSearchBindingChanged = binding?.threadId && binding.webSearchThreadConfigFingerprint !== webSearchThreadConfigFingerprint;
+		const persistentWebSearchRestriction = params.webSearchAllowed === false && params.persistentWebSearchAllowed === false;
+		const transientNativeToolRestriction = params.nativeCodeModeEnabled === false && !persistentWebSearchRestriction;
+		const transientWebSearchRestriction = isTransientWebSearchRestriction(params);
+		const explicitTransientWebSearchRestriction = params.webSearchAllowed === false && params.persistentWebSearchAllowed !== false && transientWebSearchRestriction;
+		const unknownProviderWebSearchSupport = params.nativeProviderWebSearchSupport === "unknown";
+		if (binding?.threadId && params.mcpServersFingerprintEvaluated === true && binding.mcpServersFingerprint !== params.mcpServersFingerprint) {
+			assertCodexBindingMayBeReplaced(binding, "changing MCP configuration");
+			if (!ringZeroActive && (transientNativeToolRestriction || webSearchBindingChanged && (explicitTransientWebSearchRestriction || unknownProviderWebSearchSupport))) {
+				embeddedAgentLog.debug("codex app-server MCP config changed during transient restricted turn; starting transient thread", { threadId: binding.threadId });
+				preserveExistingBinding = true;
+			} else {
+				embeddedAgentLog.debug("codex app-server MCP config changed; starting a new thread", { threadId: binding.threadId });
+				await clearCurrentBinding("rotating a stale thread binding");
+			}
+			binding = void 0;
+		}
+		const deferLegacyWebSearchRotationToTransientNativeSurface = params.nativeCodeModeEnabled === false && binding?.webSearchThreadConfigFingerprint === void 0 && !persistentWebSearchRestriction;
+		if (binding?.threadId && webSearchBindingChanged && !deferLegacyWebSearchRotationToTransientNativeSurface) {
+			assertCodexBindingMayBeReplaced(binding, "changing web-search configuration");
+			if (!ringZeroActive && transientWebSearchRestriction) {
+				embeddedAgentLog.debug("codex app-server web search restricted for turn; starting transient thread", { threadId: binding.threadId });
+				preserveExistingBinding = true;
+			} else {
+				embeddedAgentLog.debug("codex app-server web search config changed; starting a new thread", { threadId: binding.threadId });
+				await clearCurrentBinding("rotating a stale thread binding");
+			}
+			binding = void 0;
+		}
+		if (binding?.threadId && transientNativeToolRestriction && !ringZeroActive) {
+			assertCodexBindingMayBeReplaced(binding, "starting a native-tool-restricted turn");
+			embeddedAgentLog.debug("codex app-server native tool surface disabled for turn; starting transient thread", { threadId: binding.threadId });
+			preserveExistingBinding = true;
+			binding = void 0;
+		}
+		if (binding?.threadId && (binding.contextEngine || contextEngineBinding)) {
+			if (!contextEngineBinding || !isContextEngineBindingCompatible(binding.contextEngine, contextEngineBinding)) {
+				embeddedAgentLog.debug("codex app-server context-engine binding changed; starting a new thread", {
+					threadId: binding.threadId,
+					engineId: contextEngineBinding?.engineId,
+					previousEngineId: binding.contextEngine?.engineId,
+					epoch: contextEngineBinding?.projection?.epoch,
+					previousEpoch: binding.contextEngine?.projection?.epoch,
+					fingerprint: contextEngineBinding?.projection?.fingerprint,
+					previousFingerprint: binding.contextEngine?.projection?.fingerprint,
+					policyFingerprint: contextEngineBinding?.policyFingerprint,
+					previousPolicyFingerprint: binding.contextEngine?.policyFingerprint
+				});
+				await clearCurrentBinding("rotating a stale thread binding");
+				binding = void 0;
+				rotatedContextEngineBinding = true;
+			}
+		}
+		if (binding?.threadId && !areUserMcpServersFingerprintsCompatible({
+			previous: binding.userMcpServersFingerprint,
+			next: userMcpServersFingerprint,
+			nextLegacy: legacyUserMcpServersFingerprint
+		})) {
+			embeddedAgentLog.debug("codex app-server user MCP config changed; starting a new thread", { threadId: binding.threadId });
+			await clearCurrentBinding("rotating a stale thread binding");
+			binding = void 0;
+		}
+		if (binding?.threadId && binding.environmentSelectionFingerprint !== environmentSelectionFingerprint) {
+			embeddedAgentLog.debug("codex app-server environment selection changed; starting a new thread", { threadId: binding.threadId });
+			await clearCurrentBinding("rotating a stale thread binding");
+			binding = void 0;
+		}
+		if (binding?.threadId && (binding.networkProxyConfigFingerprint !== networkProxyConfigFingerprint || binding.networkProxyProfileName !== params.appServer.networkProxy?.profileName)) {
+			embeddedAgentLog.debug("codex app-server network proxy config changed; starting a new thread", { threadId: binding.threadId });
+			await clearCurrentBinding("rotating a stale thread binding");
+			binding = void 0;
+		}
+		if (binding?.threadId) {
+			let pluginBindingStale = isCodexPluginThreadBindingStale({
+				codexPluginsEnabled: params.pluginThreadConfig?.enabled ?? false,
+				bindingFingerprint: binding.pluginAppsFingerprint,
+				bindingInputFingerprint: binding.pluginAppsInputFingerprint,
+				currentInputFingerprint: params.pluginThreadConfig?.inputFingerprint,
+				hasBindingPolicyContext: Boolean(binding.pluginAppPolicyContext)
+			});
+			if (!pluginBindingStale && shouldRecheckRecoverablePluginBinding({
+				binding,
+				pluginThreadConfig: params.pluginThreadConfig
+			})) try {
+				prebuiltPluginThreadConfig = await lifecycleTiming.measure("plugin-config-recovery", () => params.pluginThreadConfig?.build());
+				pluginBindingStale = prebuiltPluginThreadConfig?.fingerprint !== binding.pluginAppsFingerprint;
+			} catch (error) {
+				embeddedAgentLog.warn("codex app-server plugin app config recovery check failed", {
+					error,
+					threadId: binding.threadId
+				});
+			}
+			if (pluginBindingStale) {
+				embeddedAgentLog.debug("codex app-server plugin app config changed; starting a new thread", { threadId: binding.threadId });
+				await clearCurrentBinding("rotating a stale thread binding");
+				binding = void 0;
+			}
+		}
+		if (binding?.threadId) {
+			if (binding.dynamicToolsFingerprint && params.dynamicTools.length > 0 && binding.dynamicToolsContainDeferred !== dynamicToolsContainDeferred && (binding.dynamicToolsContainDeferred !== void 0 || !dynamicToolsContainDeferred)) {
+				embeddedAgentLog.debug("codex app-server dynamic tool loading changed; starting a new thread", { threadId: binding.threadId });
+				await clearCurrentBinding("rotating a stale thread binding");
+				binding = void 0;
+			}
+		}
+		if (binding?.threadId) if (binding.dynamicToolsFingerprint && !areDynamicToolFingerprintsCompatible(binding.dynamicToolsFingerprint, dynamicToolsFingerprint, legacyDynamicToolsFingerprint)) {
+			assertCodexBindingMayBeReplaced(binding, "changing the dynamic tool catalog");
+			preserveExistingBinding = shouldStartTransientNoToolThread({
+				previous: binding.dynamicToolsFingerprint,
+				nextHasDynamicTools: params.dynamicTools.length > 0
+			});
+			if (preserveExistingBinding) embeddedAgentLog.debug("codex app-server dynamic tools unavailable for turn; starting transient thread", { threadId: binding.threadId });
+			else {
+				embeddedAgentLog.debug("codex app-server dynamic tool catalog changed; starting a new thread", { threadId: binding.threadId });
+				await clearCurrentBinding("rotating a stale thread binding");
+			}
+		} else {
+			const resumed = await resumeExistingCodexThread(params, {
+				binding,
+				bindingIdentity,
+				startModelSelection,
+				startModelProvider,
+				userMcpServersConfigPatch,
+				dynamicToolsFingerprint,
+				dynamicToolsContainDeferred,
+				webSearchThreadConfigFingerprint,
+				userMcpServersFingerprint,
+				ringZeroConfigFingerprint,
+				ringZeroClientInstanceId,
+				networkProxyConfigFingerprint,
+				contextEngineBinding,
+				environmentSelectionFingerprint,
+				hostSystemAgentActive,
+				ringZeroActive,
+				ringZeroInheritedMcpServerNames,
+				lifecycleTiming,
+				normalizeBindingModelProvider,
+				throwIfAborted,
+				clearCurrentBinding
+			});
+			if (resumed) return resumed;
+		}
+		return await startFreshCodexThread(params, {
+			bindingIdentity,
+			startModelSelection,
+			startModelProvider,
+			userMcpServersConfigPatch,
+			dynamicToolsFingerprint,
+			dynamicToolsContainDeferred,
+			webSearchThreadConfigFingerprint,
+			userMcpServersFingerprint,
+			ringZeroConfigFingerprint,
+			ringZeroClientInstanceId,
+			networkProxyConfigFingerprint,
+			contextEngineBinding,
+			environmentSelectionFingerprint,
+			hostSystemAgentActive,
+			ringZeroActive,
+			ringZeroInheritedMcpServerNames,
+			lifecycleTiming,
+			normalizeBindingModelProvider,
+			throwIfAborted,
+			prebuiltPluginThreadConfig,
+			preserveExistingBinding,
+			rotatedContextEngineBinding
+		});
 	});
-	return {
-		model: model.slice(slashIndex + 1).trim(),
-		...inferredModelProvider ? { modelProvider: inferredModelProvider } : {}
-	};
-}
-function hasProviderQualifiedModelRef(model) {
-	const trimmed = model?.trim();
-	const slashIndex = trimmed?.indexOf("/") ?? -1;
-	return slashIndex > 0 && slashIndex < (trimmed?.length ?? 0) - 1;
-}
-function buildCodexRuntimeThreadConfig(config, options = {}) {
-	const codeModeConfig = {
-		...CODEX_CODE_MODE_THREAD_CONFIG,
-		"features.code_mode_only": options.nativeCodeModeOnlyEnabled === true
-	};
-	if (options.nativeCodeModeEnabled === false) {
-		const disabledConfig = mergeCodexThreadConfigs(config, CODEX_CODE_MODE_DISABLED_THREAD_CONFIG) ?? { ...CODEX_CODE_MODE_DISABLED_THREAD_CONFIG };
-		delete disabledConfig["features.apply_patch_streaming_events"];
-		return disabledConfig;
-	}
-	if (options.nativeCodeModeOnlyEnabled === true) return ensureDirectOnlyToolNamespaces(mergeCodexThreadConfigs(codeModeConfig, config, { "features.code_mode_only": true }) ?? {
-		...codeModeConfig,
-		"features.code_mode_only": true
-	}, options.directOnlyToolNamespaces);
-	return ensureDirectOnlyToolNamespaces(mergeCodexThreadConfigs(codeModeConfig, config) ?? { ...codeModeConfig }, options.directOnlyToolNamespaces);
-}
-function ensureDirectOnlyToolNamespaces(config, requiredNamespaces) {
-	if (!requiredNamespaces?.length) return config;
-	const configured = config["code_mode.direct_only_tool_namespaces"];
-	const namespaces = Array.isArray(configured) ? configured.filter((entry) => typeof entry === "string" && entry.length > 0) : [];
-	return {
-		...config,
-		"code_mode.direct_only_tool_namespaces": [.../* @__PURE__ */ new Set([...namespaces, ...requiredNamespaces])]
-	};
-}
-function resolveDirectOnlyToolNamespaces(dynamicTools) {
-	return (dynamicTools ?? []).filter((tool) => tool.type === "namespace" && tool.name === "openclaw_direct").map((tool) => tool.name);
-}
-function buildCodexRuntimeThreadConfigForRun(params, config, options = {}) {
-	const ringZeroActive = (options.hostSystemAgentActive ?? isHostScopedAgentToolActive("openclaw")) && isSystemAgentOnlyCodexDynamicToolAllowlist(params.toolsAllow);
-	const configMcpServers = config?.mcp_servers;
-	if (ringZeroActive && configMcpServers !== void 0 && !isJsonObject(configMcpServers)) throw new Error("Codex ring-zero received invalid thread mcp_servers config");
-	const ringZeroMcpServerNames = [...options.ringZeroInheritedMcpServerNames ?? [], ...isJsonObject(configMcpServers) ? Object.keys(configMcpServers) : []];
-	const webSearchConfig = resolveCodexWebSearchPlan({
-		config: params.config,
-		disableTools: params.disableTools,
-		nativeToolSurfaceEnabled: options.nativeCodeModeEnabled,
-		nativeProviderWebSearchSupport: options.nativeProviderWebSearchSupport,
-		webSearchAllowed: options.webSearchAllowed
-	}).threadConfig;
-	const baseConfig = buildCodexRuntimeThreadConfig(mergeCodexThreadConfigs(config, webSearchConfig), options);
-	const runtimeConfig = mergeCodexThreadConfigs(baseConfig, options.appServer?.networkProxy?.configPatch, shouldDisableCodexToolSearchForModel(params.modelId) ? CODEX_TOOL_SEARCH_UNSUPPORTED_THREAD_CONFIG : void 0, buildCodexRingZeroThreadConfigPatch(params, options.hostSystemAgentActive, ringZeroMcpServerNames)) ?? baseConfig;
-	if (params.bootstrapContextMode !== "lightweight") return runtimeConfig;
-	return mergeCodexThreadConfigs(runtimeConfig, CODEX_LIGHTWEIGHT_CONTEXT_THREAD_CONFIG) ?? {
-		...runtimeConfig,
-		...CODEX_LIGHTWEIGHT_CONTEXT_THREAD_CONFIG
-	};
-}
-function buildCodexRingZeroThreadConfigPatch(params, hostSystemAgentActive = isHostScopedAgentToolActive("openclaw"), inheritedMcpServerNames = []) {
-	if (!hostSystemAgentActive || !isSystemAgentOnlyCodexDynamicToolAllowlist(params.toolsAllow)) return;
-	const mcpServers = Object.fromEntries([...new Set(inheritedMcpServerNames)].toSorted().map((name) => [name, { enabled: false }]));
-	return {
-		...CODEX_RING_ZERO_THREAD_CONFIG,
-		...Object.keys(mcpServers).length > 0 ? { mcp_servers: mcpServers } : {}
-	};
 }
-async function readCodexInheritedMcpServerNames(client, cwd, signal) {
-	const response = await client.request("config/read", {
-		cwd,
-		includeLayers: true
-	}, { signal });
-	if (!isJsonObject(response) || !isJsonObject(response.config)) throw new Error("Codex config/read returned an invalid effective config");
-	if (!Array.isArray(response.layers)) throw new Error("Codex config/read omitted effective config layers");
-	for (const layer of response.layers) {
-		if (!isJsonObject(layer) || !isJsonObject(layer.name) || typeof layer.name.type !== "string") throw new Error("Codex config/read returned invalid effective config layers");
-		if (layer.name.type === "legacyManagedConfigTomlFromFile" || layer.name.type === "legacyManagedConfigTomlFromMdm") throw new Error(`Codex ring-zero cannot override config layer ${layer.name.type}`);
-		if (!CODEX_RING_ZERO_OVERRIDABLE_LAYER_TYPES.has(layer.name.type)) throw new Error(`Codex ring-zero does not recognize config layer ${layer.name.type}`);
-	}
-	const configuredServers = response.config.mcp_servers;
-	if (configuredServers === void 0) return [];
-	if (!isJsonObject(configuredServers)) throw new Error("Codex config/read returned invalid mcp_servers");
-	return Object.keys(configuredServers).toSorted();
+//#endregion
+//#region extensions/codex/src/app-server/image-payload-sanitizer.ts
+/**
+* Sanitizes inline image payloads mirrored through Codex history so invalid
+* base64 data becomes readable text instead of poisoning replayed transcripts.
+*/
+const IMAGE_OMITTED_TEXT = "omitted image payload: invalid inline image data";
+/** Validates and normalizes an inline image data URL for Codex history payloads. */
+function sanitizeInlineImageDataUrl$1(imageUrl) {
+	return sanitizeInlineImageDataUrl(imageUrl);
 }
-async function assertCodexRingZeroHasNoManagedHooks(client, signal) {
-	const response = await client.request("configRequirements/read", void 0, { signal });
-	if (!isJsonObject(response) || !Object.hasOwn(response, "requirements")) throw new Error("Codex configRequirements/read returned an invalid response");
-	if (response.requirements === null) return;
-	if (!isJsonObject(response.requirements)) throw new Error("Codex configRequirements/read returned invalid requirements");
-	for (const key of [
-		"hooks",
-		"managedHooks",
-		"managed_hooks"
-	]) {
-		const hooks = response.requirements[key];
-		if (hooks === void 0 || hooks === null) continue;
-		if (!isJsonObject(hooks)) throw new Error("Codex configRequirements/read returned invalid managed hooks");
-		if (hasNonEmptyJsonValue(hooks)) throw new Error("Codex ring-zero cannot override managed hooks");
+/** Builds the replacement text inserted when an inline image payload is invalid. */
+function invalidInlineImageText(label) {
+	return `[${label}] ${IMAGE_OMITTED_TEXT}`;
+}
+function sanitizeImageContentRecord(record, label) {
+	if (record.type === "image" && typeof record.data === "string") {
+		const mimeType = typeof record.mimeType === "string" ? record.mimeType : "image/png";
+		const imageUrl = sanitizeInlineImageDataUrl$1(`data:${mimeType};base64,${record.data}`);
+		if (!imageUrl) return {
+			type: "text",
+			text: invalidInlineImageText(label)
+		};
+		const commaIndex = imageUrl.indexOf(",");
+		const mime = imageUrl.slice(INLINE_IMAGE_DATA_URL_PREFIX.length, commaIndex).split(";")[0] ?? mimeType;
+		return {
+			...record,
+			mimeType: mime,
+			data: imageUrl.slice(commaIndex + 1)
+		};
 	}
-	for (const key of ["featureRequirements", "feature_requirements"]) {
-		const requirements = response.requirements[key];
-		if (requirements === void 0 || requirements === null) continue;
-		if (!isJsonObject(requirements)) throw new Error("Codex configRequirements/read returned invalid feature requirements");
-		for (const [feature, enabled] of Object.entries(requirements)) {
-			if (typeof enabled !== "boolean") throw new Error("Codex configRequirements/read returned invalid feature requirements");
-			if (enabled && CODEX_RING_ZERO_RESTRICTED_FEATURES.has(feature)) throw new Error(`Codex ring-zero cannot override required feature ${feature}`);
-		}
+	if (record.type === "inputImage" && typeof record.imageUrl === "string") {
+		const imageUrl = sanitizeInlineImageDataUrl$1(record.imageUrl);
+		return imageUrl ? {
+			...record,
+			imageUrl
+		} : {
+			type: "inputText",
+			text: invalidInlineImageText(label)
+		};
 	}
-}
-async function attestCodexRingZeroThreadHasNoMcpServers(client, threadId, signal) {
-	const response = await client.request("mcpServerStatus/list", {
-		threadId,
-		limit: 1,
-		detail: "toolsAndAuthOnly"
-	}, { signal });
-	if (!isJsonObject(response) || !Array.isArray(response.data)) throw new Error("Codex mcpServerStatus/list returned an invalid ring-zero attestation");
-	if (response.data.length > 0) {
-		const first = response.data[0];
-		const serverName = isJsonObject(first) && typeof first.name === "string" ? first.name : "unknown";
-		throw new Error(`Codex ring-zero MCP attestation found server ${serverName}`);
+	if (record.type === "input_image" && typeof record.image_url === "string") {
+		const imageUrl = sanitizeInlineImageDataUrl$1(record.image_url);
+		return imageUrl ? {
+			...record,
+			image_url: imageUrl
+		} : {
+			type: "input_text",
+			text: invalidInlineImageText(label)
+		};
 	}
-	if (response.nextCursor !== void 0 && response.nextCursor !== null) throw new Error("Codex mcpServerStatus/list returned an invalid empty-page cursor");
 }
-function hasNonEmptyJsonValue(value) {
-	if (value === null || value === false || value === "") return false;
-	if (Array.isArray(value)) return value.length > 0;
-	if (typeof value === "object") return Object.values(value).some(hasNonEmptyJsonValue);
-	return true;
+/** Recursively sanitizes all Codex history image shapes while preserving unknown structure. */
+function sanitizeCodexHistoryImagePayloads(value, label) {
+	if (Array.isArray(value)) return value.map((entry) => sanitizeCodexHistoryImagePayloads(entry, label));
+	if (!isRecord(value)) return value;
+	const imageRecord = sanitizeImageContentRecord(value, label);
+	if (imageRecord) return imageRecord;
+	const next = {};
+	for (const [key, child] of Object.entries(value)) next[key] = sanitizeCodexHistoryImagePayloads(child, label);
+	return next;
+}
+//#endregion
+//#region extensions/codex/src/app-server/user-input.ts
+/** Builds ordered Codex user input for both new turns and same-turn steering. */
+function buildCodexUserInput(text, images) {
+	const imageInputs = (images ?? []).map((image) => {
+		const imageUrl = sanitizeInlineImageDataUrl$1(`data:${image.mimeType};base64,${image.data}`);
+		return imageUrl ? {
+			type: "image",
+			url: imageUrl
+		} : {
+			type: "text",
+			text: invalidInlineImageText("codex user input"),
+			text_elements: []
+		};
+	});
+	return [...text === void 0 ? [] : [{
+		type: "text",
+		text,
+		text_elements: []
+	}], ...imageInputs];
 }
+//#endregion
+//#region extensions/codex/src/app-server/turn-params.ts
 function buildTurnStartParams(params, options) {
 	const modelSelection = options.preserveNativeTurnSettings ? void 0 : resolveCodexAppServerRequestModelSelection({
 		model: options.model ?? params.modelId,
@@ -2778,7 +3152,7 @@ function buildTurnStartParams(params, options) {
 	const useThreadPermissionProfile = options.appServer.networkProxy && !options.sandboxPolicy;
 	return {
 		threadId: options.threadId,
-		input: buildUserInput(params, options.promptText),
+		input: buildCodexUserInput(options.promptText ?? params.prompt, params.images),
 		cwd: options.cwd,
 		approvalPolicy: options.appServer.approvalPolicy,
 		approvalsReviewer: options.appServer.approvalsReviewer,
@@ -2799,18 +3173,6 @@ function buildTurnStartParams(params, options) {
 		}) } : {}
 	};
 }
-function resolveCodexThreadApprovalsReviewer(appServer, config) {
-	return config?.approvals_reviewer === "user" ? "user" : appServer.approvalsReviewer;
-}
-function codexThreadSandboxOrPermissions(appServer) {
-	if (appServer.networkProxy) return {};
-	return { sandbox: appServer.sandbox };
-}
-function resolveCodexThreadEnvironmentSelection(options) {
-	if (options.nativeCodeModeEnabled === false) return { environments: [] };
-	if (options.environmentSelection) return { environments: options.environmentSelection };
-	return {};
-}
 function buildTurnCollaborationMode(params, options = {}) {
 	const model = options.model ?? params.modelId;
 	return {
@@ -2856,165 +3218,11 @@ function buildHeartbeatCollaborationInstructions() {
 	return [
 		"This is an OpenClaw heartbeat turn. Apply these instructions only to this heartbeat wake; ordinary chat turns should stay in Codex Default mode.",
 		"When you are ready to end the heartbeat, prefer the structured `heartbeat_respond` tool so OpenClaw can record the wake outcome and notification decision. If `heartbeat_respond` is not already available and `tool_search` is available, search for `heartbeat_respond`, load it, then call it. Use `notify=false` when nothing should visibly interrupt the user.",
-		CODEX_GPT5_HEARTBEAT_PROMPT_OVERLAY
+		GPT5_HEARTBEAT_PROMPT_OVERLAY
 	].join("\n\n");
 }
 function joinPresentSections(...sections) {
 	return sections.filter((section) => Boolean(section?.trim())).join("\n\n");
 }
-function codexDynamicToolsFingerprint(dynamicTools) {
-	return fingerprintDynamicTools(dynamicTools);
-}
-function codexLegacyDynamicToolsFingerprint(dynamicTools) {
-	return legacyFingerprintDynamicTools(dynamicTools);
-}
-function areCodexDynamicToolFingerprintsCompatible(params) {
-	return areDynamicToolFingerprintsCompatible(params.previous, params.next, params.nextLegacy);
-}
-function fingerprintDynamicTools(dynamicTools) {
-	return hashCodexAppServerBindingFingerprint(legacyFingerprintDynamicTools(dynamicTools));
-}
-function legacyFingerprintDynamicTools(dynamicTools) {
-	return JSON.stringify(dynamicTools.map(fingerprintDynamicToolSpec).toSorted(compareJsonFingerprint));
-}
-function legacyFingerprintUserMcpServersConfigPatch(configPatch) {
-	return configPatch ? JSON.stringify(stabilizeJsonValue(configPatch)) : void 0;
-}
-function fingerprintUserMcpServersConfigPatch(configPatch) {
-	return configPatch ? hashCodexAppServerBindingFingerprint(JSON.stringify(stabilizeJsonValue(redactUserMcpServersFingerprintSecrets(configPatch)))) : void 0;
-}
-function redactUserMcpServersFingerprintSecrets(value) {
-	if (Array.isArray(value)) return value.map(redactUserMcpServersFingerprintSecrets);
-	if (!value || typeof value !== "object") return value;
-	const next = {};
-	for (const [key, entry] of Object.entries(value)) {
-		if (key === "http_headers" && entry && typeof entry === "object" && !Array.isArray(entry)) {
-			next[key] = Object.fromEntries(Object.entries(entry).map(([header, headerValue]) => [header, header.toLowerCase() === "authorization" ? fingerprintUserMcpServersAuthorizationHeader(headerValue) : headerValue]));
-			continue;
-		}
-		next[key] = redactUserMcpServersFingerprintSecrets(entry);
-	}
-	return next;
-}
-function fingerprintUserMcpServersAuthorizationHeader(value) {
-	return typeof value === "string" && value.length > 0 ? `<redacted:sha256:${crypto$1.createHash("sha256").update(value).digest("hex")}>` : "<redacted>";
-}
-function fingerprintJsonObject(value) {
-	return JSON.stringify(stabilizeJsonValue(value));
-}
-function fingerprintEnvironmentSelection(environments) {
-	return environments ? JSON.stringify(environments.map(stabilizeJsonValue)) : void 0;
-}
-function fingerprintDynamicToolSpec(tool) {
-	return stabilizeDynamicToolFingerprintValue(tool);
-}
-function stabilizeDynamicToolFingerprintValue(value) {
-	if (Array.isArray(value)) return value.map(stabilizeDynamicToolFingerprintValue);
-	if (!isJsonObject(value)) return value;
-	const stable = {};
-	for (const [key, child] of Object.entries(value).toSorted(([left], [right]) => left.localeCompare(right))) {
-		if (key === "description") continue;
-		stable[key] = stabilizeDynamicToolFingerprintValue(child);
-	}
-	return stable;
-}
-function stabilizeJsonValue(value) {
-	if (Array.isArray(value)) return value.map(stabilizeJsonValue);
-	if (!isJsonObject(value)) return value;
-	const stable = {};
-	for (const [key, child] of Object.entries(value).toSorted(([left], [right]) => left.localeCompare(right))) stable[key] = stabilizeJsonValue(child);
-	return stable;
-}
-function readActiveCodexTurnIds(thread) {
-	return (thread.turns ?? []).filter((turn) => turn.status === "inProgress").map((turn) => typeof turn.id === "string" ? turn.id : "").filter((turnId) => turnId.trim().length > 0);
-}
-const LEGACY_EMPTY_DYNAMIC_TOOLS_FINGERPRINT = legacyFingerprintDynamicTools([]);
-const EMPTY_DYNAMIC_TOOLS_FINGERPRINT = hashCodexAppServerBindingFingerprint(LEGACY_EMPTY_DYNAMIC_TOOLS_FINGERPRINT);
-function areDynamicToolFingerprintsCompatible(previous, next, nextLegacy) {
-	return !previous || previous === next || previous === nextLegacy;
-}
-function areUserMcpServersFingerprintsCompatible(params) {
-	return params.previous === params.next || params.previous === params.nextLegacy || params.nextLegacy !== void 0 && params.previous === hashCodexAppServerBindingFingerprint(params.nextLegacy);
-}
-function shouldStartTransientNoToolThread(params) {
-	return Boolean(params.previous && !isEmptyDynamicToolsFingerprint(params.previous) && !params.nextHasDynamicTools);
-}
-function isEmptyDynamicToolsFingerprint(fingerprint) {
-	return fingerprint === EMPTY_DYNAMIC_TOOLS_FINGERPRINT || fingerprint === LEGACY_EMPTY_DYNAMIC_TOOLS_FINGERPRINT;
-}
-function compareJsonFingerprint(left, right) {
-	return JSON.stringify(left).localeCompare(JSON.stringify(right));
-}
-function buildDeveloperInstructions(params, options = {}) {
-	const nativeCommandGuidance = listRegisteredPluginAgentPromptGuidance({
-		surface: "codex_app_server",
-		includeLegacyGlobalGuidance: false
-	}).join("\n");
-	return [
-		"You are a personal agent running inside OpenClaw. OpenClaw has dynamic tools for OpenClaw-owned messaging, cron, sessions, media, gateway, and nodes.",
-		buildDeferredDynamicToolManifest(options.dynamicTools),
-		buildSkillWorkshopInstruction(options.dynamicTools),
-		"Use Codex native `spawn_agent` for Codex subagents. `spawn_agent` and the other native collaboration tools may be deferred: when `spawn_agent` is not directly listed, load it with `tool_search` before spawning. Use OpenClaw `sessions_spawn` only for OpenClaw or ACP delegation, never as a substitute for `spawn_agent`.",
-		buildVisibleReplyInstruction(params, options.dynamicTools),
-		nativeCommandGuidance,
-		params.extraSystemPrompt
-	].filter((section) => typeof section === "string" && section.trim()).join("\n\n");
-}
-function buildDeferredDynamicToolManifest(dynamicTools) {
-	const deferredToolNames = [...new Set(flattenCodexDynamicToolFunctions(dynamicTools).filter((tool) => tool.deferLoading === true).map((tool) => tool.name.trim()).filter(Boolean))].toSorted((left, right) => left.localeCompare(right));
-	if (deferredToolNames.length === 0) return;
-	return `Deferred searchable OpenClaw dynamic tools available: ${deferredToolNames.join(", ")}. Use \`tool_search\` to load exact callable specs before use.`;
-}
-function buildSkillWorkshopInstruction(dynamicTools) {
-	if (!flattenCodexDynamicToolFunctions(dynamicTools).some((tool) => tool.name.trim() === SKILL_WORKSHOP_TOOL_NAME)) return;
-	return buildSkillWorkshopPromptSection().join("\n");
-}
-function buildVisibleReplyInstruction(params, dynamicTools) {
-	const messageToolAvailable = dynamicTools ? flattenCodexDynamicToolFunctions(dynamicTools).some((tool) => tool.name.trim() === "message") : params.disableMessageTool !== true;
-	if (params.sourceReplyDeliveryMode === "message_tool_only" && messageToolAvailable) return "Visible source replies are not automatically delivered for this run. Use `message(action=send)` for user-visible source-channel output. For progress, set `final=false`. When the message is the completed reply to the current source conversation, set `final=true`; OpenClaw stops after confirming delivery. Do not repeat that visible content in your final answer.";
-	if (messageToolAvailable) return "For the current source conversation, reply normally in your final assistant message; OpenClaw will deliver it through the active source conversation. Use `message` only for explicit out-of-band sends, media/file sends, or sends to a different target.";
-	return "For the current source conversation, reply normally in your final assistant message; OpenClaw will deliver it through the active source conversation.";
-}
-function buildUserInput(params, promptText = params.prompt) {
-	const imageInputs = (params.images ?? []).map((image) => {
-		const imageUrl = sanitizeInlineImageDataUrl$1(`data:${image.mimeType};base64,${image.data}`);
-		return imageUrl ? {
-			type: "image",
-			url: imageUrl
-		} : {
-			type: "text",
-			text: invalidInlineImageText("codex user input"),
-			text_elements: []
-		};
-	});
-	return [{
-		type: "text",
-		text: promptText,
-		text_elements: []
-	}, ...imageInputs];
-}
-function resolveCodexAppServerModelProvider(params) {
-	const normalized = params.provider.trim();
-	const normalizedLower = normalized.toLowerCase();
-	if (!normalized || normalizedLower === "codex") return;
-	if (isCodexAppServerNativeAuthProfile(params) && normalizedLower === "openai") return;
-	return normalizedLower === "openai" ? "openai" : normalized;
-}
-function resolveReasoningEffort(thinkLevel, modelId, supportedReasoningEfforts) {
-	if (thinkLevel === "off" || thinkLevel === "adaptive") return null;
-	if (supportedReasoningEfforts) return resolveCodexSupportedReasoningEffort({
-		requested: thinkLevel,
-		supportedReasoningEfforts
-	}) ?? null;
-	const fallbackReasoningEfforts = resolveCodexFallbackReasoningEfforts(modelId);
-	if (fallbackReasoningEfforts) return resolveCodexSupportedReasoningEffort({
-		requested: thinkLevel,
-		supportedReasoningEfforts: fallbackReasoningEfforts
-	}) ?? null;
-	if (thinkLevel === "minimal") return isModernCodexModel(modelId) ? "low" : "minimal";
-	if (thinkLevel === "low" || thinkLevel === "medium" || thinkLevel === "high" || thinkLevel === "xhigh") return thinkLevel;
-	if (thinkLevel === "max" && isMaxReasoningCodexModel(modelId)) return "max";
-	return null;
-}
 //#endregion
-export { fitCodexProjectedContextForTurnStart as A, unsubscribeCodexThreadBestEffort as B, sanitizeInlineImageDataUrl$1 as C, normalizeCodexDynamicToolName as D, isSystemAgentOnlyCodexDynamicToolAllowlist as E, CODEX_APP_SERVER_UNSUBSCRIBE_TIMEOUT_MS as F, shouldBuildCodexPluginThreadConfig as G, buildCodexPluginThreadConfig as H, CodexAppServerUnsafeSubscriptionError as I, ensureCodexPluginActivation as K, closeCodexStartupClientBestEffort as L, resolveCodexContextEngineProjectionMaxChars as M, resolveCodexContextEngineProjectionReserveTokens as N, resolveCodexDynamicToolsLoading as O, CODEX_APP_SERVER_INTERRUPT_TIMEOUT_MS as P, interruptCodexTurnBestEffort as R, sanitizeCodexHistoryImagePayloads as S, isForcedPrivateQaCodexRuntime as T, buildCodexPluginThreadConfigInputFingerprint as U, buildCodexPluginAppsConfigPatchFromPolicyContext as V, mergeCodexThreadConfigs as W, buildCodexNativeWebSearchThreadConfig as _, buildDeveloperInstructions as a, isCodexAppServerProfilerEnabled as b, codexDynamicToolsFingerprint as c, resolveCodexAppServerModelProvider as d, resolveCodexAppServerRequestModelSelection as f, startOrResumeThread as g, resolveReasoningEffort as h, buildContextEngineBinding as i, projectContextEngineAssemblyForCodex as j, resolveCodexDynamicToolsLoadingForRuntime as k, codexLegacyDynamicToolsFingerprint as l, resolveCodexBindingModelProviderFallback as m, areCodexDynamicToolFingerprintsCompatible as n, buildTurnCollaborationMode as o, resolveCodexAppServerThreadModelSelection as p, pluginReadParams as q, buildCodexRuntimeThreadConfig as r, buildTurnStartParams as s, CODEX_NATIVE_PERSONALITY_NONE as t, isContextEngineBindingCompatible as u, resolveCodexWebSearchPlan as v, filterCodexDynamicTools as w, invalidInlineImageText as x, resumeCodexAppServerThread as y, retireCodexAppServerClientAfterTimedOutTurn as z };
+export { CodexAppServerUnsafeSubscriptionError as A, fitCodexProjectedContextForTurnStart as B, isForcedPrivateQaCodexRuntime as C, resolveCodexDynamicToolsLoadingForRuntime as D, resolveCodexDynamicToolsLoading as E, areCodexDynamicToolFingerprintsCompatible as F, buildCodexPluginThreadConfig as G, resolveCodexContextEngineProjectionMaxChars as H, codexDynamicToolsFingerprint as I, mergeCodexThreadConfigs as J, buildCodexPluginThreadConfigInputFingerprint as K, codexLegacyDynamicToolsFingerprint as L, interruptCodexTurnBestEffort as M, retireCodexAppServerClientAfterTimedOutTurn as N, CODEX_APP_SERVER_INTERRUPT_TIMEOUT_MS as O, unsubscribeCodexThreadBestEffort as P, resolveRecoverableCodexPluginConfigKeys as Q, buildContextEngineBinding as R, filterCodexDynamicToolsWithOpenClawShell as S, normalizeCodexDynamicToolName as T, resolveCodexContextEngineProjectionReserveTokens as U, projectContextEngineAssemblyForCodex as V, buildCodexPluginAppsConfigPatchFromPolicyContext as W, ensureCodexPluginActivation as X, shouldBuildCodexPluginThreadConfig as Y, pluginReadParams as Z, resolveCodexBindingModelProviderFallback as _, sanitizeCodexHistoryImagePayloads as a, isCodexAppServerProfilerEnabled as b, resumeCodexAppServerThread as c, resolveCodexWebSearchPlan as d, buildDeveloperInstructions as f, resolveCodexAppServerThreadModelSelection as g, resolveCodexAppServerRequestModelSelection as h, invalidInlineImageText as i, closeCodexStartupClientBestEffort as j, CODEX_APP_SERVER_UNSUBSCRIBE_TIMEOUT_MS as k, buildCodexRuntimeThreadConfig as l, resolveCodexAppServerModelProvider as m, buildTurnStartParams as n, sanitizeInlineImageDataUrl$1 as o, CODEX_NATIVE_PERSONALITY_NONE as p, buildCodexPluginThreadConfigTimeoutFallback as q, buildCodexUserInput as r, startOrResumeThread as s, buildTurnCollaborationMode as t, buildCodexNativeWebSearchThreadConfig as u, resolveReasoningEffort as v, isSystemAgentOnlyCodexDynamicToolAllowlist as w, filterCodexDynamicTools as x, readCodexSupportedReasoningEfforts as y, isContextEngineBindingCompatible as z };