@openclaw/codex 2026.7.2-beta.1 → 2026.7.2-beta.3

package/dist/{run-attempt-VPVJoYDP.js → run-attempt-BIoO8ISr.js}

@@ -1,212 +1,328 @@
-import { i as isJsonObject, r as flattenCodexDynamicToolFunctions } from "./protocol-BMifTfdW.js";
-import { S as updateActiveTurnItemIds, _ as readCodexNotificationItem, a as isCodexTurnAbortMarkerNotification, b as shouldDisarmAssistantCompletionIdleWatch, c as isPendingOpenClawDynamicToolCompletionNotification, d as isRawReasoningCompletionNotification, f as isRawToolOutputCompletionNotification, g as isTerminalTurnStatus, h as isRetryableErrorNotification, i as isAssistantCompletionReleaseNotification, l as isRawAssistantProgressNotification, m as isReasoningProgressNotification, n as describeNotificationActivity, o as isFileChangePatchUpdatedNotification, p as isReasoningItemCompletionNotification, r as isAssistantCommentaryCompletionNotification, s as isNativeToolProgressNotification, t as codexExecutionToolName, u as isRawFunctionToolOutputCompletionNotification, v as readNotificationItemId, x as updateActiveCompletionBlockerItemIds, y as readRawResponseToolCallId } from "./attempt-notifications-DEv9h7iC.js";
-import { _ as resolveCodexPluginsPolicy, b as shouldAutoApproveCodexAppServerApprovals, d as readCodexPluginConfig, g as resolveCodexModelBackedReviewerPolicyContext, h as resolveCodexComputerUseConfig, l as isCodexSandboxExecServerEnabled, s as isCodexAppServerApprovalPolicyAllowedByRequirements, x as withMcpElicitationsApprovalPolicy, y as resolveOpenClawExecPolicyForCodexAppServer } from "./config-c48K5HP9.js";
-import { a as readCodexDynamicToolCallParams, i as assertCodexTurnStartResponse } from "./protocol-validators-dZQ-UTOa.js";
-import { i as defaultCodexAppInventoryCache, n as buildCodexAppServerRuntimeFingerprint, r as buildCodexPluginAppCacheKey } from "./plugin-app-cache-key-BKNjHMEs.js";
-import { A as isCodexAppServerApprovalRequest, C as resolveCodexAppServerFallbackApiKeyCacheKey, D as resolveCodexAppServerHomeDir, O as CodexAppServerRpcError, S as resolveCodexAppServerAuthProfileIdForAgent, T as resolveCodexAppServerPreparedAuthHandoff, _ as readCodexRateLimitsRevision, a as getLeasedSharedCodexAppServerClient, b as resolveCodexAppServerAuthAccountCacheKey, c as releaseLeasedSharedCodexAppServerClient, d as retireSharedCodexAppServerClientIfCurrent, g as ensureCodexAppServerClientRuntime, j as isCodexAppServerConnectionClosedError, n as clearSharedCodexAppServerClientIfCurrentAndUnclaimed, o as isCodexAppServerStartSelectionChangedError, t as clearSharedCodexAppServerClientIfCurrent, u as retainSharedCodexAppServerClientIfCurrent, v as readRecentCodexRateLimits, w as resolveCodexAppServerPreparedApiKeyCacheKey, x as resolveCodexAppServerAuthProfileId, y as rememberCodexRateLimitsRead } from "./shared-client-D4mFI9al.js";
-import { A as fitCodexProjectedContextForTurnStart, B as unsubscribeCodexThreadBestEffort, E as isSystemAgentOnlyCodexDynamicToolAllowlist, F as CODEX_APP_SERVER_UNSUBSCRIBE_TIMEOUT_MS, G as shouldBuildCodexPluginThreadConfig, H as buildCodexPluginThreadConfig, I as CodexAppServerUnsafeSubscriptionError, L as closeCodexStartupClientBestEffort, M as resolveCodexContextEngineProjectionMaxChars, N as resolveCodexContextEngineProjectionReserveTokens, P as CODEX_APP_SERVER_INTERRUPT_TIMEOUT_MS, R as interruptCodexTurnBestEffort, U as buildCodexPluginThreadConfigInputFingerprint, W as mergeCodexThreadConfigs, a as buildDeveloperInstructions, b as isCodexAppServerProfilerEnabled, c as codexDynamicToolsFingerprint, g as startOrResumeThread, i as buildContextEngineBinding, j as projectContextEngineAssemblyForCodex, k as resolveCodexDynamicToolsLoadingForRuntime, l as codexLegacyDynamicToolsFingerprint, n as areCodexDynamicToolFingerprintsCompatible, o as buildTurnCollaborationMode, p as resolveCodexAppServerThreadModelSelection, s as buildTurnStartParams, u as isContextEngineBindingCompatible, v as resolveCodexWebSearchPlan, w as filterCodexDynamicTools, z as retireCodexAppServerClientAfterTimedOutTurn } from "./thread-lifecycle-BgLXzjvV.js";
-import { c as sessionBindingIdentity, s as reclaimCurrentCodexSessionGeneration } from "./session-binding-BMfX1OX-.js";
-import { a as shouldRefreshCodexRateLimitsForUsageLimitMessage, i as resolveCodexUsageLimitResetAtMs, n as formatCodexUsageLimitErrorMessage } from "./rate-limits-Dhp04Rqo.js";
-import { i as mirrorPromptAtTurnStartBestEffort, n as createCodexAppServerUserMessagePersistenceNotifier, o as buildCodexUserPromptMessage, t as codexTranscriptMirrorRuntime } from "./transcript-mirror-DhLwFIL4.js";
-import { t as CODEX_CONTROL_METHODS } from "./capabilities-42Dfn2TV.js";
-import { r as formatCodexDisplayText } from "./command-formatters-D6ZlGNmb.js";
-import { n as resolveCodexAppServerForOpenClawToolPolicy, t as resolveCodexAppServerForModelProvider } from "./app-server-policy-DVcxdse_.js";
-import { a as resolveCodexBindingAppServerConnection, n as readCodexNotificationThreadId, r as readCodexNotificationTurnId, t as isCodexNotificationForTurn } from "./notification-correlation-DfaCm0mx.js";
+import { A as isCodexAppServerStartupError, B as isCodexAppServerApprovalRequest, C as resolveCodexAppServerFallbackApiKeyCacheKey, D as resolveCodexAppServerHomeDir, F as resolveCodexTurnCompletionIdleTimeoutMs, H as isCodexAppServerConnectionClosedError, I as resolveCodexTurnTerminalIdleTimeoutMs, K as isCodexAppServerRequestTimeoutError, L as withCodexStartupTimeout, M as resolveCodexPostToolRawAssistantCompletionIdleTimeoutMs, N as resolveCodexStartupTimeoutMs, O as CODEX_POST_REASONING_REPLY_IDLE_TIMEOUT_MS, P as resolveCodexTurnAssistantCompletionIdleTimeoutMs, R as CodexAppServerRpcError, S as resolveCodexAppServerAuthProfileIdForAgent, T as resolveCodexAppServerPreparedAuthHandoff, V as isCodexAppServerBrokenPipeError, X as flattenCodexDynamicToolFunctions, Z as isJsonObject, _ as readCodexRateLimitsRevision, a as getLeasedSharedCodexAppServerClient, b as resolveCodexAppServerAuthAccountCacheKey, c as releaseLeasedSharedCodexAppServerClient, d as retireSharedCodexAppServerClientIfCurrent, g as ensureCodexAppServerClientRuntime, k as CodexAppServerStartupError, n as clearSharedCodexAppServerClientIfCurrentAndUnclaimed, o as isCodexAppServerStartSelectionChangedError, t as clearSharedCodexAppServerClientIfCurrent, u as retainSharedCodexAppServerClientIfCurrent, v as readRecentCodexRateLimits, w as resolveCodexAppServerPreparedApiKeyCacheKey, x as resolveCodexAppServerAuthProfileId } from "./shared-client-CSXLtCLE.js";
+import { S as updateActiveTurnItemIds, _ as readCodexNotificationItem, a as isCodexTurnAbortMarkerNotification, b as shouldDisarmAssistantCompletionIdleWatch, c as isPendingOpenClawDynamicToolCompletionNotification, d as isRawReasoningCompletionNotification, f as isRawToolOutputCompletionNotification, g as isTerminalTurnStatus, h as isRetryableErrorNotification, i as isAssistantCompletionReleaseNotification, l as isRawAssistantProgressNotification, m as isReasoningProgressNotification, n as describeNotificationActivity, o as isFileChangePatchUpdatedNotification, p as isReasoningItemCompletionNotification, r as isAssistantCommentaryCompletionNotification, s as isNativeToolProgressNotification, t as codexExecutionToolName, u as isRawFunctionToolOutputCompletionNotification, v as readNotificationItemId, x as updateActiveCompletionBlockerItemIds, y as readRawResponseToolCallId } from "./attempt-notifications-Ecjyzufe.js";
+import { C as resolveCodexComputerUseConfig, D as resolveOpenClawExecPolicyForCodexAppServer, O as shouldAutoApproveCodexAppServerApprovals, T as resolveCodexPluginsPolicy, c as sessionBindingIdentity, g as isCodexAppServerApprovalPolicyAllowedByRequirements, k as withMcpElicitationsApprovalPolicy, s as reclaimCurrentCodexSessionGeneration, v as isCodexSandboxExecServerEnabled, w as resolveCodexModelBackedReviewerPolicyContext, y as readCodexPluginConfig } from "./session-binding-Bmt20HfB.js";
+import { _ as readCodexTurnCompletedNotification, f as assertCodexTurnStartResponse, i as mirrorPromptAtTurnStartBestEffort, n as createCodexAppServerUserMessagePersistenceNotifier, o as buildCodexUserPromptMessage, p as readCodexDynamicToolCallParams, t as codexTranscriptMirrorRuntime } from "./transcript-mirror-D9rTxx2P.js";
+import { i as defaultCodexAppInventoryCache, n as buildCodexAppServerRuntimeFingerprint, r as buildCodexPluginAppCacheKey } from "./plugin-app-cache-key-DJbhLYSK.js";
+import { A as CodexAppServerUnsafeSubscriptionError, B as fitCodexProjectedContextForTurnStart, D as resolveCodexDynamicToolsLoadingForRuntime, F as areCodexDynamicToolFingerprintsCompatible, G as buildCodexPluginThreadConfig, H as resolveCodexContextEngineProjectionMaxChars, I as codexDynamicToolsFingerprint, J as mergeCodexThreadConfigs, K as buildCodexPluginThreadConfigInputFingerprint, L as codexLegacyDynamicToolsFingerprint, M as interruptCodexTurnBestEffort, N as retireCodexAppServerClientAfterTimedOutTurn, O as CODEX_APP_SERVER_INTERRUPT_TIMEOUT_MS, P as unsubscribeCodexThreadBestEffort, Q as resolveRecoverableCodexPluginConfigKeys, R as buildContextEngineBinding, U as resolveCodexContextEngineProjectionReserveTokens, V as projectContextEngineAssemblyForCodex, Y as shouldBuildCodexPluginThreadConfig, b as isCodexAppServerProfilerEnabled, d as resolveCodexWebSearchPlan, f as buildDeveloperInstructions, g as resolveCodexAppServerThreadModelSelection, j as closeCodexStartupClientBestEffort, k as CODEX_APP_SERVER_UNSUBSCRIBE_TIMEOUT_MS, n as buildTurnStartParams, q as buildCodexPluginThreadConfigTimeoutFallback, r as buildCodexUserInput, s as startOrResumeThread, t as buildTurnCollaborationMode, w as isSystemAgentOnlyCodexDynamicToolAllowlist, x as filterCodexDynamicTools, z as isContextEngineBindingCompatible } from "./thread-lifecycle-CQ_9mAa1.js";
+import { r as formatCodexDisplayText } from "./command-formatters-NCTL7A2q.js";
+import { n as resolveCodexAppServerForOpenClawToolPolicy, t as resolveCodexAppServerForModelProvider } from "./app-server-policy-DUMF2Xyr.js";
+import { a as resolveCodexBindingAppServerConnection, n as readCodexNotificationThreadId, r as readCodexNotificationTurnId, t as isCodexNotificationForTurn } from "./notification-correlation-C8DVQ_Bq.js";
 import { n as prepareCodexAppServerAuthBinding } from "./auth-binding-C1czuHPA.js";
-import { $ as inferCodexDynamicToolMeta, B as handleDynamicToolCallWithTimeout, C as resolveCodexMessageToolProvider, D as shouldWarnCodexDynamicToolBuildStageSummary, E as shouldRequireCodexSandboxExecServerEnvironment, F as createCodexNativeHookRelay, G as resolveTerminalDynamicToolBatchAction, H as isDynamicToolTerminalDiagnosticEvent, I as emitCodexNativePreToolUseFailureDiagnostic, J as toCodexDynamicToolProgressResponse, K as shouldBlockTerminalReleaseForNonTerminalDynamicToolResult, L as resolveCodexNativeHookRelayEvents, M as CODEX_NATIVE_HOOK_RELAY_TTL_GRACE_MS, N as buildCodexNativeHookRelayConfig, P as buildCodexNativeHookRelayDisabledConfig, Q as shouldEmitTranscriptToolProgress, R as resolveCodexNativeHookRelayTtlMs, S as resolveCodexExternalSandboxPolicyForOpenClawSandbox, T as shouldEnableCodexAppServerNativeToolSurface, U as isMatchingDynamicToolTerminalDiagnostic, V as hasPendingDynamicToolTerminalDiagnostic, W as resolveDynamicToolCallTimeoutMs, X as resolveCodexToolAbortTerminalReason, Y as toCodexDynamicToolProtocolResponse, Z as readCodexMirroredSessionHistoryMessages, _ as createCodexDynamicToolBuildStageTracker, a as emitDynamicToolStartedDiagnostic, b as resolveCodexAppServerExecutionCwd, d as resolveCodexStartupTimeoutMs, et as resolveCodexToolProgressDetailMode, f as resolveCodexTurnAssistantCompletionIdleTimeoutMs, g as buildDynamicTools, h as withCodexStartupTimeout, i as emitDynamicToolErrorDiagnostic, k as CodexAppServerEventProjector, l as CODEX_POST_REASONING_REPLY_IDLE_TIMEOUT_MS, m as resolveCodexTurnTerminalIdleTimeoutMs, n as handleCodexAppServerApprovalRequest, nt as sanitizeCodexToolResponse, o as emitDynamicToolTerminalDiagnostic, p as resolveCodexTurnCompletionIdleTimeoutMs, q as shouldReleaseTurnAfterTerminalDynamicTool, r as handleCodexAppServerElicitationRequest, rt as resolveCodexLocalRuntimeAttribution, s as resolveCodexProviderWebSearchSupport, t as createCodexDynamicToolBridge, tt as sanitizeCodexToolArguments, u as resolveCodexPostToolRawAssistantCompletionIdleTimeoutMs, v as disableCodexPluginThreadConfig, w as resolveCodexSandboxEnvironmentSelection, x as resolveCodexAppServerHookChannelId, y as formatCodexDynamicToolBuildStageSummary, z as scheduleCodexNativeHookRelayUnregister } from "./dynamic-tools-BMLoaTeG.js";
-import { a as runCodexComputerUseLiveTest, r as killStaleComputerUseMcpChildren, t as ensureCodexComputerUse } from "./computer-use-DVzr8OP1.js";
+import { $ as resolveCodexToolProgressDetailMode, B as hasPendingDynamicToolTerminalDiagnostic, C as CodexAppServerEventProjector, D as markCodexAuthProfileBlockedFromRateLimits, E as isCodexUsageLimitPromptError, F as emitCodexNativePreToolUseFailureDiagnostic, G as shouldBlockTerminalReleaseForNonTerminalDynamicToolResult, H as isMatchingDynamicToolTerminalDiagnostic, I as resolveCodexNativeHookRelayEvents, J as toCodexDynamicToolProtocolResponse, K as shouldReleaseTurnAfterTerminalDynamicTool, L as resolveCodexNativeHookRelayTtlMs, M as buildCodexNativeHookRelayConfig, N as buildCodexNativeHookRelayDisabledConfig, O as refreshCodexUsageLimitPromptError, P as createCodexNativeHookRelay, Q as inferCodexDynamicToolMeta, R as scheduleCodexNativeHookRelayUnregister, T as formatCodexTurnStartUsageLimitError, U as resolveDynamicToolCallTimeoutMs, V as isDynamicToolTerminalDiagnosticEvent, W as resolveTerminalDynamicToolBatchAction, X as readCodexMirroredSessionHistoryMessages, Y as resolveCodexToolAbortTerminalReason, Z as shouldEmitTranscriptToolProgress, _ as resolveCodexMessageToolProvider, a as emitDynamicToolStartedDiagnostic, b as shouldRequireCodexSandboxExecServerEnvironment, d as createCodexDynamicToolBuildStageTracker, et as sanitizeCodexToolArguments, f as disableCodexPluginThreadConfig, g as resolveCodexExternalSandboxPolicyForOpenClawSandbox, h as resolveCodexAppServerHookChannelId, i as emitDynamicToolErrorDiagnostic, j as CODEX_NATIVE_HOOK_RELAY_TTL_GRACE_MS, l as settleCodexSourceReplyFinality, m as resolveCodexAppServerExecutionCwd, n as handleCodexAppServerApprovalRequest, nt as redactCodexEventKind, o as emitDynamicToolTerminalDiagnostic, p as formatCodexDynamicToolBuildStageSummary, q as toCodexDynamicToolProgressResponse, r as handleCodexAppServerElicitationRequest, rt as resolveCodexLocalRuntimeAttribution, s as resolveCodexProviderWebSearchSupport, t as createCodexDynamicToolBridge, tt as sanitizeCodexToolResponse, u as buildDynamicTools, v as resolveCodexSandboxEnvironmentSelection, w as createCodexUsageLimitPromptError, x as shouldWarnCodexDynamicToolBuildStageSummary, y as shouldEnableCodexAppServerNativeToolSurface, z as handleDynamicToolCallWithTimeout } from "./dynamic-tools-D_vSVmv9.js";
+import { a as runCodexComputerUseLiveTest, r as killStaleComputerUseMcpChildren, t as ensureCodexComputerUse } from "./computer-use-C7x4ZaqR.js";
 import fs from "node:fs/promises";
 import path, { posix } from "node:path";
 import { resolveTimerTimeoutMs } from "openclaw/plugin-sdk/number-runtime";
-import { truncateUtf16Safe } from "openclaw/plugin-sdk/text-utility-runtime";
+import { sliceUtf16Safe, truncateUtf16Safe } from "openclaw/plugin-sdk/text-utility-runtime";
 import { createHash, randomUUID } from "node:crypto";
-import { markAuthProfileBlockedUntil, resolveAgentDir, resolveAgentWorkspaceDir } from "openclaw/plugin-sdk/agent-runtime";
+import { resolveAgentDir, resolveAgentWorkspaceDir } from "openclaw/plugin-sdk/agent-runtime";
 import { loadExecApprovals } from "openclaw/plugin-sdk/exec-approvals-runtime";
 import { asFiniteNumber, normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
-import { CODEX_APP_SERVER_CONTEXT_ENGINE_HOST, FAST_MODE_AUTO_PROGRESS_KIND, assembleHarnessContextEngine, assertContextEngineHostSupport, awaitAgentEndSideEffects, bootstrapHarnessContextEngine, buildAgentHarnessUserInputAnswers, buildBootstrapContextForFiles, buildHarnessContextEngineRuntimeContext, buildHarnessContextEngineRuntimeContextFromUsage, clearActiveEmbeddedRun, deliverAgentHarnessUserInputPrompt, embeddedAgentLog, emitAgentEvent, emptyAgentHarnessUserInputAnswers, finalizeHarnessContextEngineTurn, formatErrorMessage, formatFastModeAutoProgressText, getAgentHarnessHookRunner, getBeforeToolCallPolicyDiagnosticState, isActiveHarnessContextEngine, isHostScopedAgentToolActive, loadCodexBundleMcpThreadConfig, materializeRequesterScopedMcpToolsForHarnessRun, resolveAgentDir as resolveAgentDir$1, resolveAgentHarnessBeforePromptBuildResult, resolveAgentRunAbortLifecycleFields, resolveBootstrapFilesForRun, resolveContextEngineOwnerPluginId, resolveFastModeForElapsed, resolveSandboxContext, resolveSessionAgentIds as resolveSessionAgentIds$1, resolveUserPath, runAgentCleanupStep, runAgentEndSideEffects, runAgentHarnessLlmInputHook, runAgentHarnessLlmOutputHook, runHarnessContextEngineMaintenance, setActiveEmbeddedRun, supportsModelTools } from "openclaw/plugin-sdk/agent-harness-runtime";
+import { CODEX_APP_SERVER_CONTEXT_ENGINE_HOST, FAST_MODE_AUTO_PROGRESS_KIND, assembleHarnessContextEngine, assertContextEngineHostSupport, awaitAgentEndSideEffects, bootstrapHarnessContextEngine, buildAgentHarnessUserInputAnswers, buildBootstrapContextForFiles, buildHarnessContextEngineRuntimeContext, buildHarnessContextEngineRuntimeContextFromUsage, callGatewayTool, cancelPendingAgentQuestionForSession, claimPendingAgentQuestionAnswer, clearActiveEmbeddedRun, deliverAgentHarnessUserInputPrompt, embeddedAgentLog, emitAgentEvent, emptyAgentHarnessUserInputAnswers, finalizeHarnessContextEngineTurn, formatErrorMessage, formatFastModeAutoProgressText, getAgentHarnessHookRunner, getBeforeToolCallPolicyDiagnosticState, isActiveHarnessContextEngine, isHostScopedAgentToolActive, loadCodexBundleMcpThreadConfig, materializeRequesterScopedMcpToolsForHarnessRun, resolveAgentDir as resolveAgentDir$1, resolveAgentHarnessBeforePromptBuildResult, resolveAgentRunAbortLifecycleFields, resolveBootstrapFilesForRun, resolveContextEngineOwnerPluginId, resolveFastModeForElapsed, resolveSandboxContext, resolveSessionAgentIds as resolveSessionAgentIds$1, resolveUserPath, runAgentCleanupStep, runAgentEndSideEffects, runAgentHarnessGatewayQuestion, runAgentHarnessLlmInputHook, runAgentHarnessLlmOutputHook, runHarnessContextEngineMaintenance, setActiveEmbeddedRun, supportsModelTools } from "openclaw/plugin-sdk/agent-harness-runtime";
 import { spawn } from "node:child_process";
 import { once } from "node:events";
 import { isIP } from "node:net";
 import { WebSocketServer } from "ws";
 import { parseSqliteSessionFileMarker } from "openclaw/plugin-sdk/session-store-runtime";
-import { buildMemorySystemPromptAddition } from "openclaw/plugin-sdk/core";
+import { fileURLToPath } from "node:url";
 import { createDiagnosticTraceContextFromActiveScope, emitTrustedDiagnosticEvent, emitTrustedDiagnosticEventWithPrivateData, freezeDiagnosticTraceContext, onInternalDiagnosticEvent, resolveDiagnosticModelContentCapturePolicy } from "openclaw/plugin-sdk/diagnostic-runtime";
+import { prepareMemorySystemPromptAddition } from "openclaw/plugin-sdk/core";
 import { MESSAGE_TOOL_DELIVERY_HINTS } from "openclaw/plugin-sdk/message-tool-delivery-hints";
 import { createAgentHarnessTaskRuntime, deliverAgentHarnessTaskCompletion, isDurableAgentHarnessCompletionDelivery } from "openclaw/plugin-sdk/agent-harness-task-runtime";
 import { SsrFBlockedError, isBlockedHostnameOrIp } from "openclaw/plugin-sdk/ssrf-runtime";
 //#region extensions/codex/src/app-server/attempt-steering.ts
 /**
-* Debounced steering queue for forwarding user text to an active Codex
+* Debounced steering queue for forwarding user messages to an active Codex
 * app-server turn.
 */
 const CODEX_STEER_ALL_DEBOUNCE_MS = 500;
 /**
-* Creates a queue that batches steer text while still serializing app-server
-* `turn/steer` requests.
+* Creates a queue that batches steer messages while still serializing
+* app-server `turn/steer` requests.
 */
 function createCodexSteeringQueue(params) {
-	let batchedTexts = [];
+	let batchedMessages = [];
+	const dispatchedBatches = /* @__PURE__ */ new Map();
+	const pendingMessages = /* @__PURE__ */ new Set();
 	let batchTimer;
+	let batchSequence = 0;
 	let sendChain = Promise.resolve();
+	let closedError;
 	const clearBatchTimer = () => {
 		if (batchTimer) {
 			clearTimeout(batchTimer);
 			batchTimer = void 0;
 		}
 	};
-	const sendTexts = async (texts) => {
-		if (texts.length === 0) return;
-		if (params.signal.aborted) throw new Error("codex app-server steering queue aborted");
-		await params.client.request("turn/steer", {
-			threadId: params.threadId,
-			expectedTurnId: params.turnId,
-			input: texts.map(toCodexTextInput)
-		});
+	const resolveItem = (item) => {
+		if (item.settled) return;
+		item.settled = true;
+		pendingMessages.delete(item);
+		item.resolve();
+	};
+	const rejectItem = (item, error) => {
+		if (item.settled) return;
+		item.settled = true;
+		pendingMessages.delete(item);
+		item.reject(error);
+	};
+	const closeQueue = (error) => {
+		if (closedError) return;
+		closedError = error;
+		params.signal.removeEventListener("abort", abortQueue);
+		clearBatchTimer();
+		batchedMessages = [];
+		dispatchedBatches.clear();
+		for (const item of pendingMessages) rejectItem(item, error);
+	};
+	const abortQueue = () => {
+		closeQueue(/* @__PURE__ */ new Error("codex app-server steering queue aborted"));
+	};
+	const cancelQueue = () => {
+		closeQueue(/* @__PURE__ */ new Error("codex app-server steering queue cancelled"));
+	};
+	const sendBatch = async (items) => {
+		const liveItems = items.filter((item) => !item.settled);
+		if (liveItems.length === 0) return;
+		const unavailableError = closedError ?? (params.signal.aborted ? /* @__PURE__ */ new Error("codex app-server steering queue aborted") : void 0);
+		if (unavailableError) {
+			for (const item of liveItems) rejectItem(item, unavailableError);
+			throw unavailableError;
+		}
+		const clientUserMessageId = `openclaw:${params.turnId}:steer:${++batchSequence}`;
+		const batch = { items: liveItems };
+		dispatchedBatches.set(clientUserMessageId, batch);
+		try {
+			await params.client.request("turn/steer", {
+				threadId: params.threadId,
+				expectedTurnId: params.turnId,
+				input: liveItems.flatMap((item) => buildCodexUserInput(item.text, item.images)),
+				clientUserMessageId
+			});
+		} catch (error) {
+			dispatchedBatches.delete(clientUserMessageId);
+			for (const item of liveItems) rejectItem(item, error);
+			throw error;
+		}
 	};
-	const enqueueSend = (texts) => {
-		const send = sendChain.then(() => sendTexts(texts));
-		sendChain = send.catch((error) => {
+	const enqueueSend = (items) => {
+		const send = sendChain.then(() => sendBatch(items));
+		sendChain = send;
+		send.catch((error) => {
+			for (const item of items) rejectItem(item, error);
 			embeddedAgentLog.debug("codex app-server queued steer failed", { error });
 		});
 		return send;
 	};
 	const flushBatch = () => {
 		clearBatchTimer();
-		const items = batchedTexts;
-		batchedTexts = [];
-		const send = enqueueSend(items.map((item) => item.text));
-		send.then(() => {
-			for (const item of items) item.resolve();
-		}, (error) => {
-			for (const item of items) item.reject(error);
-		});
+		const items = batchedMessages;
+		batchedMessages = [];
+		if (items.length === 0) return sendChain;
+		const send = enqueueSend(items);
+		send.catch(() => void 0);
 		return send;
 	};
+	const createPendingMessage = (text, images) => {
+		let resolveDelivery;
+		let rejectDelivery;
+		const delivery = new Promise((resolve, reject) => {
+			resolveDelivery = resolve;
+			rejectDelivery = reject;
+		});
+		const item = {
+			text,
+			images,
+			resolve: resolveDelivery,
+			reject: rejectDelivery,
+			settled: false
+		};
+		pendingMessages.add(item);
+		return {
+			item,
+			delivery
+		};
+	};
+	params.signal.addEventListener("abort", abortQueue, { once: true });
+	if (params.signal.aborted) abortQueue();
 	return {
 		async queue(text, options) {
-			if (params.answerPendingUserInput(text)) return;
-			return await new Promise((resolve, reject) => {
-				batchedTexts.push({
-					text,
-					resolve,
-					reject
-				});
-				clearBatchTimer();
-				const debounceMs = normalizeCodexSteerDebounceMs(options?.debounceMs);
-				if (debounceMs === 0) {
-					flushBatch().catch(() => void 0);
+			const pendingUserInput = params.claimPendingUserInput();
+			if (pendingUserInput) {
+				if (!options?.images?.length) {
+					pendingUserInput.answer(text);
 					return;
 				}
-				batchTimer = setTimeout(() => {
-					batchTimer = void 0;
-					flushBatch().catch(() => void 0);
-				}, debounceMs);
-			});
+				flushBatch().catch(() => void 0);
+				const { item, delivery } = createPendingMessage(text, options.images);
+				await Promise.all([enqueueSend([item]).finally(() => pendingUserInput.cancel()), delivery]);
+				return;
+			}
+			if (closedError) throw closedError;
+			if (params.signal.aborted) throw new Error("codex app-server steering queue aborted");
+			const { item, delivery } = createPendingMessage(text, options?.images);
+			batchedMessages.push(item);
+			clearBatchTimer();
+			const debounceMs = normalizeCodexSteerDebounceMs(options?.debounceMs);
+			if (debounceMs === 0) flushBatch();
+			else batchTimer = setTimeout(() => {
+				batchTimer = void 0;
+				flushBatch();
+			}, debounceMs);
+			return await delivery;
 		},
 		async flushPending() {
+			if (closedError) return;
 			await flushBatch().catch(() => void 0);
 		},
-		cancel() {
-			clearBatchTimer();
-			const items = batchedTexts;
-			batchedTexts = [];
-			for (const item of items) item.reject(/* @__PURE__ */ new Error("codex app-server steering queue cancelled"));
-		}
+		confirmConsumed(clientUserMessageId) {
+			const batch = dispatchedBatches.get(clientUserMessageId);
+			if (!batch) return false;
+			dispatchedBatches.delete(clientUserMessageId);
+			for (const item of batch.items) resolveItem(item);
+			return true;
+		},
+		cancel: cancelQueue
 	};
 }
 /** Normalizes steer debounce milliseconds, preserving explicit zero. */
 function normalizeCodexSteerDebounceMs(value) {
 	return typeof value === "number" && Number.isFinite(value) && value >= 0 ? Math.floor(value) : CODEX_STEER_ALL_DEBOUNCE_MS;
 }
-/** Converts plain text into the Codex app-server user-input shape. */
-function toCodexTextInput(text) {
-	return {
-		type: "text",
-		text,
-		text_elements: []
-	};
-}
 //#endregion
 //#region extensions/codex/src/app-server/user-input-bridge.ts
-/**
-* Bridges Codex item/tool user-input requests to OpenClaw messaging prompts and
-* turns replies into app-server answer payloads.
-*/
+/** Bridges Codex request_user_input calls to gateway questions and secret text prompts. */
+const DEFAULT_USER_INPUT_TIMEOUT_MS = 15 * 6e4;
 /** Creates a per-turn bridge for pending Codex user-input requests. */
 function createCodexUserInputBridge(params) {
-	let pending;
-	const resolvePending = (value) => {
-		const current = pending;
+	let sensitiveInput;
+	let pendingGateway;
+	const gatewayCall = params.gatewayCall ?? callGatewayTool;
+	const resolveSecret = (value) => {
+		const current = sensitiveInput;
 		if (!current) return;
-		pending = void 0;
+		sensitiveInput = void 0;
 		current.cleanup();
 		current.resolve(value);
 	};
+	const resolveSecretIfCurrent = (current, value) => {
+		if (sensitiveInput !== current) return false;
+		resolveSecret(value);
+		return true;
+	};
+	const cancelGateway = () => {
+		pendingGateway?.abort.abort(/* @__PURE__ */ new Error("Codex user input request cancelled"));
+	};
 	return {
 		async handleRequest(request) {
 			const requestParams = readUserInputParams(request.params);
 			if (!requestParams) return;
 			if (requestParams.threadId !== params.threadId || requestParams.turnId !== params.turnId) return;
 			if (requestParams.questions.length === 0) return emptyUserInputResponse();
-			resolvePending(emptyUserInputResponse());
-			return new Promise((resolve) => {
-				const abortListener = () => resolvePending(emptyUserInputResponse());
+			resolveSecret(emptyUserInputResponse());
+			cancelGateway();
+			if (requestParams.questions.some((question) => question.isSecret)) return new Promise((resolve) => {
+				const abortListener = () => resolveSecret(emptyUserInputResponse());
 				const cleanup = () => params.signal?.removeEventListener("abort", abortListener);
-				pending = {
+				sensitiveInput = {
 					requestId: request.id,
 					threadId: requestParams.threadId,
-					turnId: requestParams.turnId,
-					itemId: requestParams.itemId,
 					questions: requestParams.questions,
+					claimed: false,
 					resolve,
 					cleanup
 				};
 				params.signal?.addEventListener("abort", abortListener, { once: true });
 				if (params.signal?.aborted) {
-					resolvePending(emptyUserInputResponse());
+					resolveSecret(emptyUserInputResponse());
 					return;
 				}
-				deliverUserInputPrompt(params.paramsForRun, requestParams.questions).catch((error) => {
-					embeddedAgentLog.warn("failed to deliver codex user input prompt", { error });
+				deliverAgentHarnessUserInputPrompt(params.paramsForRun, requestParams.questions, {
+					formatText: formatCodexDisplayText,
+					intro: "Codex needs input:"
+				}).catch((error) => {
+					embeddedAgentLog.warn("failed to deliver secret codex user input prompt", { error });
 				});
 			});
+			const abort = new AbortController();
+			const abortFromRun = () => abort.abort(params.signal?.reason);
+			params.signal?.addEventListener("abort", abortFromRun, { once: true });
+			if (params.signal?.aborted) abortFromRun();
+			pendingGateway = {
+				requestId: request.id,
+				threadId: requestParams.threadId,
+				abort
+			};
+			try {
+				const result = await runAgentHarnessGatewayQuestion({
+					questions: requestParams.questions,
+					sessionKey: params.paramsForRun.sessionKey ?? params.paramsForRun.sessionId,
+					agentId: params.paramsForRun.agentId,
+					timeoutMs: requestParams.autoResolutionMs ?? params.paramsForRun.timeoutMs ?? DEFAULT_USER_INPUT_TIMEOUT_MS,
+					gatewayCall,
+					delivery: params.paramsForRun,
+					promptOptions: {
+						formatText: formatCodexDisplayText,
+						intro: "Codex needs input:"
+					},
+					signal: abort.signal
+				});
+				return result.status === "answered" ? result.answers : emptyUserInputResponse();
+			} catch (error) {
+				embeddedAgentLog.warn("failed to bridge codex user input through gateway", { error });
+				return emptyUserInputResponse();
+			} finally {
+				params.signal?.removeEventListener("abort", abortFromRun);
+				if (pendingGateway?.abort === abort) pendingGateway = void 0;
+			}
 		},
-		handleQueuedMessage(text) {
-			const current = pending;
-			if (!current) return false;
-			resolvePending(buildUserInputResponse(current.questions, text));
-			return true;
+		claimPendingRequest() {
+			const current = sensitiveInput;
+			if (!current || current.claimed) return;
+			current.claimed = true;
+			return {
+				answer: (text) => resolveSecretIfCurrent(current, buildUserInputResponse(current.questions, text)),
+				cancel: () => resolveSecretIfCurrent(current, emptyUserInputResponse())
+			};
 		},
 		handleNotification(notification) {
-			if (notification.method !== "serverRequest/resolved" || !pending) return;
+			if (notification.method !== "serverRequest/resolved") return;
 			const notificationParams = isJsonObject(notification.params) ? notification.params : void 0;
 			const requestId = notificationParams ? readRequestId(notificationParams) : void 0;
-			if (notificationParams && readString$4(notificationParams, "threadId") === pending.threadId && requestId !== void 0 && String(requestId) === String(pending.requestId)) resolvePending(emptyUserInputResponse());
+			if (!notificationParams || requestId === void 0) return;
+			if (sensitiveInput && readString$3(notificationParams, "threadId") === sensitiveInput.threadId && String(requestId) === String(sensitiveInput.requestId)) resolveSecret(emptyUserInputResponse());
+			if (pendingGateway && readString$3(notificationParams, "threadId") === pendingGateway.threadId && String(requestId) === String(pendingGateway.requestId)) pendingGateway.abort.abort(/* @__PURE__ */ new Error("Codex server request resolved"));
 		},
 		cancelPending() {
-			resolvePending(emptyUserInputResponse());
+			resolveSecret(emptyUserInputResponse());
+			cancelGateway();
 		}
 	};
 }
 function readUserInputParams(value) {
 	if (!isJsonObject(value)) return;
-	const threadId = readString$4(value, "threadId");
-	const turnId = readString$4(value, "turnId");
-	const itemId = readString$4(value, "itemId");
+	const threadId = readString$3(value, "threadId");
+	const turnId = readString$3(value, "turnId");
+	const itemId = readString$3(value, "itemId");
 	const questionsRaw = value.questions;
 	if (!threadId || !turnId || !itemId || !Array.isArray(questionsRaw)) return;
 	return {
 		threadId,
 		turnId,
 		itemId,
-		questions: questionsRaw.map(readQuestion).filter((question) => Boolean(question))
+		questions: questionsRaw.map((rawQuestion) => {
+			const question = readQuestion(rawQuestion);
+			if (question && isJsonObject(rawQuestion) && rawQuestion.multiSelect === true) question.multiSelect = true;
+			return question;
+		}).filter((question) => Boolean(question)),
+		autoResolutionMs: typeof value.autoResolutionMs === "number" && value.autoResolutionMs > 0 ? value.autoResolutionMs : void 0
 	};
 }
 function readQuestion(value) {
 	if (!isJsonObject(value)) return;
-	const id = readString$4(value, "id");
-	const header = readString$4(value, "header");
-	const question = readString$4(value, "question");
+	const id = readString$3(value, "id");
+	const header = readString$3(value, "header");
+	const question = readString$3(value, "question");
 	if (!id || !header || !question) return;
 	return {
 		id,
@@ -224,26 +340,20 @@ function readOptions(value) {
 }
 function readOption(value) {
 	if (!isJsonObject(value)) return;
-	const label = readString$4(value, "label");
-	const description = readString$4(value, "description") ?? "";
+	const label = readString$3(value, "label");
+	const description = readString$3(value, "description") ?? "";
 	return label ? {
 		label,
 		description
 	} : void 0;
 }
-async function deliverUserInputPrompt(params, questions) {
-	await deliverAgentHarnessUserInputPrompt(params, questions, {
-		formatText: formatCodexDisplayText,
-		intro: "Codex needs input:"
-	});
-}
 function buildUserInputResponse(questions, inputText) {
 	return buildAgentHarnessUserInputAnswers(questions, inputText);
 }
 function emptyUserInputResponse() {
 	return emptyAgentHarnessUserInputAnswers();
 }
-function readString$4(record, key) {
+function readString$3(record, key) {
 	const value = record[key];
 	return typeof value === "string" ? value : void 0;
 }
@@ -336,18 +446,35 @@ async function activateCodexAttemptTurn(resources, turnRuntime, lifecycle, notif
 		client: resourceState.client,
 		threadId: resourceState.thread.threadId,
 		turnId: activeTurnId,
-		answerPendingUserInput: (text) => userInputBridgeRef.current?.handleQueuedMessage(text) ?? false,
+		claimPendingUserInput: () => userInputBridgeRef.current?.claimPendingRequest(),
 		signal: runAbortController.signal
 	});
 	steeringQueueRef.current = activeSteeringQueue;
 	const handle = {
 		kind: "embedded",
 		runId: params.runId,
-		queueMessage: async (text, optionsLocal) => activeSteeringQueue.queue(text, optionsLocal),
+		queueMessage: async (text, optionsLocal) => {
+			const isInboundUserMessage = optionsLocal?.isInboundUserMessage === true;
+			if (isInboundUserMessage && !optionsLocal?.images?.length) {
+				if (await claimPendingAgentQuestionAnswer({
+					sessionKey: params.sessionKey ?? params.sessionId,
+					text
+				})) return;
+			} else if (isInboundUserMessage) try {
+				await cancelPendingAgentQuestionForSession({
+					sessionKey: params.sessionKey ?? params.sessionId,
+					resolvedBy: "image-reply"
+				});
+			} catch (error) {
+				embeddedAgentLog.warn("failed to cancel codex gateway question before image steering", { error });
+			}
+			await activeSteeringQueue.queue(text, optionsLocal);
+		},
 		isStreaming: () => !state.completed && !runAbortController.signal.aborted,
 		isStopped: () => state.completed || state.timedOut || runAbortController.signal.aborted,
 		isAbortable: () => !terminalState.terminalOutcomeFrozen || terminalState.sharedAbortAllowedAfterTerminalOutcome,
 		isCompacting: () => projectorRef.current?.isCompacting() ?? false,
+		supportsQueueMessageImages: true,
 		sourceReplyDeliveryMode: params.sourceReplyDeliveryMode,
 		cancel: () => abortExplicitly("cancelled"),
 		abort: () => abortExplicitly("aborted")
@@ -1058,6 +1185,7 @@ async function prepareCodexAttemptConnection({ params, options }) {
 		isInactiveThreadBootstrapBinding,
 		usesSupervisionConnection,
 		startupAuthProfileId,
+		startupAuthRequirement: preparedAuthRoute?.authRequirement,
 		startupPreparedAuth,
 		startupClientAuthProfileId,
 		effectiveWorkspace,
@@ -1215,13 +1343,14 @@ async function buildCodexWorkspaceBootstrapContext(params) {
 			promptContext: renderCodexWorkspaceBootstrapPromptContext(promptContextFiles),
 			developerInstructions: renderCodexWorkspaceThreadDeveloperInstructions(developerInstructionFiles),
 			turnScopedDeveloperInstructions: renderCodexWorkspaceCollaborationDeveloperInstructions(turnScopedDeveloperInstructionFiles),
-			memoryCollaborationInstructions: shouldInjectCodexOpenClawPromptContext(params.params) ? renderCodexWorkspaceMemoryCollaborationInstructions({
+			memoryCollaborationInstructions: shouldInjectCodexOpenClawPromptContext(params.params) ? await renderCodexWorkspaceMemoryCollaborationInstructions({
 				files: memoryReferenceFiles,
 				toolNames: params.memoryToolNames,
 				memoryToolRouted: memoryToolsAvailable,
 				citationsMode: params.params.config?.memory?.citations,
 				agentId: params.params.agentId ?? params.sessionAgentId,
-				agentSessionKey: params.sessionKey
+				agentSessionKey: params.sessionKey,
+				sandboxed: params.sandboxed
 			}) : void 0,
 			heartbeatCollaborationInstructions: renderCodexWorkspaceHeartbeatReference(heartbeatReferenceFiles)
 		};
@@ -1576,24 +1705,26 @@ function renderCodexWorkspaceMemoryReference(params) {
 	for (const file of params.files) lines.push(`- ${file.path}`);
 	return lines.join("\n").trim();
 }
-function renderCodexWorkspaceMemoryCollaborationInstructions(params) {
-	const sections = [params.memoryToolRouted ? renderCodexMemoryRecallInstructions({
+async function renderCodexWorkspaceMemoryCollaborationInstructions(params) {
+	const sections = [params.memoryToolRouted ? await renderCodexMemoryRecallInstructions({
 		toolNames: params.toolNames,
 		citationsMode: params.citationsMode,
 		agentId: params.agentId,
-		agentSessionKey: params.agentSessionKey
+		agentSessionKey: params.agentSessionKey,
+		sandboxed: params.sandboxed
 	}) : void 0, renderCodexWorkspaceMemoryReference({
 		files: params.files,
 		toolNames: params.toolNames
 	})].filter(isNonEmptyString$1);
 	return sections.length > 0 ? sections.join("\n\n") : void 0;
 }
-function renderCodexMemoryRecallInstructions(params) {
-	const memoryPrompt = buildMemorySystemPromptAddition({
+async function renderCodexMemoryRecallInstructions(params) {
+	const memoryPrompt = await prepareMemorySystemPromptAddition({
 		availableTools: new Set(params.toolNames),
 		citationsMode: params.citationsMode,
 		agentId: params.agentId,
-		agentSessionKey: params.agentSessionKey
+		agentSessionKey: params.agentSessionKey,
+		sandboxed: params.sandboxed
 	});
 	if (!memoryPrompt) return;
 	return [memoryPrompt, renderCodexMemoryToolSearchBridge(params.toolNames)].filter(isNonEmptyString$1).join("\n").trim();
@@ -1790,7 +1921,7 @@ function buildCodexAppServerTimeoutDiagnostics(params) {
 //#region extensions/codex/src/app-server/run-attempt-context.ts
 async function prepareCodexAttemptContext(runtime, attemptTools) {
 	const { connection, runtimeParams, activeSessionId, activeSessionFile, buildActiveRunAttemptParams, effectiveContextWindowInfo, effectiveContextTokenBudget, effectiveRuntimeProviderId, effectiveRuntimeModelId, hookChannelId } = runtime;
-	const { params, sessionAgentId, contextSessionKey, activeContextEngine, initialStartupBindingHadInactiveThreadBootstrap, sandboxSessionKey, effectiveWorkspace, effectiveCwd, agentDir, usesSupervisionConnection, resolvedWorkspace, initialInactiveThreadBootstrapBindingForcedFreshStart } = connection;
+	const { params, sessionAgentId, contextSessionKey, activeContextEngine, initialStartupBindingHadInactiveThreadBootstrap, sandboxSessionKey, effectiveWorkspace, effectiveCwd, agentDir, usesSupervisionConnection, resolvedWorkspace, initialInactiveThreadBootstrapBindingForcedFreshStart, sandbox } = connection;
 	const { toolBridge } = attemptTools;
 	const activeTranscriptTarget = {
 		agentId: sessionAgentId,
@@ -1854,7 +1985,8 @@ async function prepareCodexAttemptContext(runtime, attemptTools) {
 		effectiveWorkspace,
 		sessionKey: contextSessionKey,
 		sessionAgentId,
-		memoryToolNames: getCodexWorkspaceMemoryToolNames(toolBridge.availableSpecs)
+		memoryToolNames: getCodexWorkspaceMemoryToolNames(toolBridge.availableSpecs),
+		sandboxed: sandbox?.enabled === true
 	});
 	const baseDeveloperInstructions = joinPresentSections(buildDeveloperInstructions(runtimeParams, { dynamicTools: toolBridge.availableSpecs }), workspaceBootstrapContext.developerInstructions);
 	return {
@@ -2070,7 +2202,7 @@ function buildCodexTurnStartFailureResult(params) {
 		idleTimedOut: false,
 		timedOutDuringCompaction: false,
 		timedOutDuringToolExecution: false,
-		promptError: params.message,
+		promptError: params.promptError ?? params.message,
 		promptErrorSource: "prompt",
 		sessionIdUsed: params.params.sessionId,
 		messagesSnapshot: params.messagesSnapshot,
@@ -2284,139 +2416,6 @@ function normalizeCodexTrajectoryError(value) {
 	}
 }
 //#endregion
-//#region extensions/codex/src/app-server/usage-limit-error.ts
-/**
-* Enriches Codex usage-limit failures with current rate-limit information and
-* marks blocked auth profiles when Codex exposes a reset time.
-*/
-const CODEX_USAGE_LIMIT_RATE_LIMIT_REFRESH_TIMEOUT_MS = 5e3;
-/** Marks a Codex auth profile blocked until the reset time advertised by rate limits. */
-async function markCodexAuthProfileBlockedFromRateLimits(params) {
-	const authProfileId = params.authProfileId?.trim();
-	if (!authProfileId || !params.params.authProfileStore) return;
-	const blockedUntil = resolveCodexUsageLimitResetAtMs(params.rateLimits);
-	if (!blockedUntil) return;
-	try {
-		await markAuthProfileBlockedUntil({
-			store: params.params.authProfileStore,
-			profileId: authProfileId,
-			blockedUntil,
-			source: "codex_rate_limits",
-			agentDir: params.params.agentDir,
-			runId: params.params.runId,
-			modelId: params.params.modelId
-		});
-	} catch (error) {
-		embeddedAgentLog.debug("failed to mark Codex auth profile blocked from app-server limits", {
-			authProfileId,
-			error: formatErrorMessage(error)
-		});
-	}
-}
-/** Formats a turn-start usage-limit error, refreshing rate limits when needed. */
-async function formatCodexTurnStartUsageLimitError(params) {
-	return refreshCodexUsageLimitError({
-		client: params.client,
-		source: readCodexTurnStartUsageLimitErrorSource(params.client, params.error, params.errorNotification, params.rateLimitsRevisionBeforeTurnStart),
-		timeoutMs: params.timeoutMs,
-		signal: params.signal
-	});
-}
-/** Refreshes a generic prompt usage-limit message into a reset-aware message. */
-async function refreshCodexUsageLimitPromptError(params) {
-	if (!shouldRefreshCodexRateLimitsForUsageLimitMessage(params.message)) return;
-	return (await refreshCodexUsageLimitError({
-		client: params.client,
-		source: {
-			message: params.message,
-			codexErrorInfo: "usageLimitExceeded",
-			rateLimits: readRecentCodexRateLimits(params.client)
-		},
-		timeoutMs: params.timeoutMs,
-		signal: params.signal
-	}))?.message;
-}
-async function refreshCodexUsageLimitError(params) {
-	const initialMessage = formatCodexUsageLimitErrorMessage(params.source);
-	if (!shouldRefreshCodexRateLimitsForUsageLimitMessage(initialMessage)) return initialMessage ? {
-		message: initialMessage,
-		...params.source.rateLimitsTrustedForProfile ? { rateLimitsForProfile: params.source.rateLimits } : {}
-	} : void 0;
-	const rateLimits = await readCodexRateLimitsFromAppServerForUsageLimitError({
-		client: params.client,
-		timeoutMs: params.timeoutMs,
-		signal: params.signal
-	});
-	if (!rateLimits) return initialMessage ? {
-		message: initialMessage,
-		...params.source.rateLimitsTrustedForProfile ? { rateLimitsForProfile: params.source.rateLimits } : {}
-	} : void 0;
-	const message = formatCodexUsageLimitErrorMessage({
-		message: params.source.message,
-		codexErrorInfo: params.source.codexErrorInfo,
-		rateLimits
-	}) ?? initialMessage;
-	return message ? {
-		message,
-		rateLimitsForProfile: rateLimits
-	} : void 0;
-}
-async function readCodexRateLimitsFromAppServerForUsageLimitError(params) {
-	if (params.signal?.aborted) return;
-	try {
-		const rateLimits = await params.client.request(CODEX_CONTROL_METHODS.rateLimits, void 0, {
-			timeoutMs: resolveCodexUsageLimitRateLimitRefreshTimeoutMs(params.timeoutMs),
-			signal: params.signal
-		});
-		rememberCodexRateLimitsRead(params.client, rateLimits);
-		return rateLimits;
-	} catch (error) {
-		embeddedAgentLog.debug("codex app-server rate-limit refresh failed after usage-limit error", { error: formatErrorMessage(error) });
-		return;
-	}
-}
-function resolveCodexUsageLimitRateLimitRefreshTimeoutMs(timeoutMs) {
-	if (timeoutMs === void 0 || !Number.isFinite(timeoutMs) || timeoutMs <= 0) return CODEX_USAGE_LIMIT_RATE_LIMIT_REFRESH_TIMEOUT_MS;
-	return Math.max(100, Math.min(timeoutMs, CODEX_USAGE_LIMIT_RATE_LIMIT_REFRESH_TIMEOUT_MS));
-}
-function readCodexTurnStartUsageLimitErrorSource(client, error, errorNotification, rateLimitsRevisionBeforeTurnStart) {
-	const notificationError = readCodexErrorNotification(errorNotification);
-	const errorPayload = readCodexErrorPayload(error);
-	const rateLimits = errorPayload.rateLimits ?? readRecentCodexRateLimits(client);
-	const cacheUpdatedDuringTurnStart = rateLimitsRevisionBeforeTurnStart !== void 0 && readCodexRateLimitsRevision(client) > rateLimitsRevisionBeforeTurnStart;
-	return {
-		message: notificationError?.message ?? errorPayload.message ?? formatErrorMessage(error),
-		codexErrorInfo: notificationError?.codexErrorInfo ?? errorPayload.codexErrorInfo,
-		rateLimits,
-		rateLimitsTrustedForProfile: errorPayload.rateLimits !== void 0 || cacheUpdatedDuringTurnStart
-	};
-}
-function readCodexErrorNotification(notification) {
-	if (notification?.method !== "error" || !isJsonObject(notification.params)) return;
-	const error = notification.params.error;
-	return isJsonObject(error) ? {
-		message: readString$3(error, "message"),
-		codexErrorInfo: error.codexErrorInfo
-	} : void 0;
-}
-function readCodexErrorPayload(error) {
-	const message = error instanceof Error ? error.message : void 0;
-	if (!error || typeof error !== "object" || !("data" in error)) return { message };
-	const data = error.data;
-	if (!isJsonObject(data)) return { message };
-	const nestedError = isJsonObject(data.error) ? data.error : data;
-	const rateLimits = nestedError.rateLimits ?? data.rateLimits;
-	return {
-		message: readString$3(nestedError, "message") ?? message,
-		codexErrorInfo: nestedError.codexErrorInfo,
-		rateLimits
-	};
-}
-function readString$3(record, key) {
-	const value = record[key];
-	return typeof value === "string" ? value : void 0;
-}
-//#endregion
 //#region extensions/codex/src/app-server/run-attempt-finalize.ts
 async function finalizeCodexAttempt(resources, turnRuntime, lifecycle, notifications, requestRuntime, activeTurn) {
 	const { prompt, state: resourceState, trajectoryRecorder, markTrajectoryEndRecorded } = resources;
@@ -2425,7 +2424,7 @@ async function finalizeCodexAttempt(resources, turnRuntime, lifecycle, notificat
 	const { hookContextWindowFields, hookRunner, promptState } = context;
 	const { connection, preparedAuthBinding, activeSessionId, activeSessionFile } = runtime;
 	const { buildActiveRunAttemptParams, effectiveContextTokenBudget, effectiveRuntimeProviderId, effectiveRuntimeModelId } = runtime;
-	const { params, terminalState, runAbortController, activeContextEngine, bindingStore, bindingIdentity, appServer, usesSupervisionConnection, sessionAgentId, contextSessionKey, effectiveCwd, effectiveWorkspace, agentDir, attemptStartedAt } = connection;
+	const { params, terminalState, runAbortController, activeContextEngine, bindingStore, bindingIdentity, appServer, usesSupervisionConnection, sessionAgentId, contextSessionKey, effectiveCwd, effectiveWorkspace, agentDir, attemptStartedAt, startupAuthProfileId } = connection;
 	const { toolBridge, toolState } = attemptTools;
 	const { state, completion, pendingOpenClawDynamicToolCompletionIds, activeTurnItemIds, activeCompletionBlockerItemIds, activeFinalizationHookRunIds, turnWatches } = turnRuntime;
 	const { emitLifecycleTerminal, buildLifecycleTerminalMeta } = lifecycle;
@@ -2459,7 +2458,7 @@ async function finalizeCodexAttempt(resources, turnRuntime, lifecycle, notificat
 	const isFinalAborted = () => result.aborted || terminalState.explicitCancellationObserved || runAbortController.signal.aborted && !state.clientClosedAbort && !recoveredTurnWatchTimeout;
 	const clientClosedPromptErrorForFinal = state.clientClosedPromptError && hasRecoverableCompletedAssistant ? void 0 : state.clientClosedPromptError;
 	let finalPromptError = clientClosedPromptErrorForFinal ?? (effectiveTurnCompletionIdleTimedOut ? state.turnCompletionIdleTimeoutMessage : effectiveTimedOut ? "codex app-server attempt timed out" : result.promptError);
-	const finalPromptErrorMessage = typeof finalPromptError === "string" ? finalPromptError : finalPromptError ? formatErrorMessage(finalPromptError) : void 0;
+	const finalPromptErrorMessage = typeof finalPromptError === "string" ? finalPromptError : finalPromptError instanceof Error ? finalPromptError.message : finalPromptError ? formatErrorMessage(finalPromptError) : void 0;
 	if (isInvalidCodexImagePayloadError(finalPromptErrorMessage)) await clearCodexBindingAfterInvalidImagePayload(bindingStore, bindingIdentity, {
 		phase: "turn_completed",
 		threadId: resourceState.thread.threadId,
@@ -2487,7 +2486,18 @@ async function finalizeCodexAttempt(resources, turnRuntime, lifecycle, notificat
 		timeoutMs: appServer.requestTimeoutMs,
 		signal: runAbortController.signal
 	});
-	if (refreshedUsageLimitPromptError) finalPromptError = refreshedUsageLimitPromptError;
+	if (refreshedUsageLimitPromptError) {
+		await markCodexAuthProfileBlockedFromRateLimits({
+			params,
+			authProfileId: startupAuthProfileId,
+			rateLimits: refreshedUsageLimitPromptError.rateLimitsForProfile
+		});
+		finalPromptError = createCodexUsageLimitPromptError(refreshedUsageLimitPromptError.message);
+	} else if (isCodexUsageLimitPromptError(finalPromptError) && state.rateLimitsRevisionBeforeLastTurnStart !== void 0 && readCodexRateLimitsRevision(resourceState.client) > state.rateLimitsRevisionBeforeLastTurnStart) await markCodexAuthProfileBlockedFromRateLimits({
+		params,
+		authProfileId: startupAuthProfileId,
+		rateLimits: readRecentCodexRateLimits(resourceState.client)
+	});
 	const finalPromptErrorSource = effectiveTimedOut || clientClosedPromptErrorForFinal ? "prompt" : result.promptErrorSource;
 	const codexAppServerFailureKind = clientClosedPromptErrorForFinal ? "client_closed_before_turn_completed" : effectiveTurnCompletionIdleTimedOut ? "turn_completion_idle_timeout" : void 0;
 	const replayBlockedReason = codexAppServerFailureKind ? resolveCodexAppServerReplayBlockedReason(result) : void 0;
@@ -2515,7 +2525,9 @@ async function finalizeCodexAttempt(resources, turnRuntime, lifecycle, notificat
 	const finalAborted = isFinalAborted();
 	const completedTurnStatus = activeProjector.getCompletedTurnStatus();
 	const completedWithoutTerminalNotification = state.completed && !state.terminalTurnNotificationQueued && !state.timedOut && clientClosedPromptErrorForFinal === void 0;
-	const attemptSucceeded = !finalAborted && !effectiveTimedOut && (finalPromptError === null || finalPromptError === void 0) && result.agentHarnessResultClassification === void 0 && (completedTurnStatus === "completed" || recoveredTurnWatchTimeout || completedWithoutTerminalNotification);
+	const turnSucceeded = !finalAborted && !effectiveTimedOut && (finalPromptError === null || finalPromptError === void 0) && (completedTurnStatus === "completed" || recoveredTurnWatchTimeout || completedWithoutTerminalNotification);
+	if (settleCodexSourceReplyFinality(toolBridge.telemetry, turnSucceeded)) result.agentHarnessResultClassification = void 0;
+	const attemptSucceeded = turnSucceeded && result.agentHarnessResultClassification === void 0;
 	terminalState.sharedAbortAllowedAfterTerminalOutcome = shouldKeepCodexSharedAbortOpen({
 		trigger: params.trigger,
 		result,
@@ -2662,7 +2674,8 @@ async function finalizeCodexAttempt(resources, turnRuntime, lifecycle, notificat
 		phase: "end",
 		...buildLifecycleTerminalMeta({
 			aborted: finalAborted,
-			timedOut: effectiveTimedOut
+			timedOut: effectiveTimedOut,
+			yielded: toolState.yieldDetected
 		})
 	});
 	return {
@@ -2708,7 +2721,7 @@ function reportCodexExecutionNotification(params) {
 /** Returns true when a notification ends the current app-server turn. */
 function isTerminalCodexTurnNotificationForTurn(params) {
 	if (!isCodexNotificationForTurn(params.notification.params, params.threadId, params.turnId)) return false;
-	return params.notification.method === "turn/completed" || isCodexTurnAbortMarkerNotification(params.notification, { currentPromptTexts: params.currentPromptTexts });
+	return params.notification.method === "turn/completed";
 }
 /**
 * Applies one notification to active item tracking, idle watches, and terminal
@@ -2778,13 +2791,33 @@ function applyCodexTurnNotificationState(params) {
 		isTurnTerminal: isTerminalCodexTurnNotificationForTurn({
 			notification,
 			threadId: params.threadId,
-			turnId: params.turnId,
-			currentPromptTexts: params.currentPromptTexts
+			turnId: params.turnId
 		}),
 		turnCrossedToolHandoff
 	};
 }
 //#endregion
+//#region extensions/codex/src/app-server/run-attempt-lifecycle-terminal.ts
+function buildCodexLifecycleTerminalMeta(input) {
+	if (input.timedOut || input.abortStopReason === "timeout") return {
+		aborted: true,
+		status: "timed_out",
+		stopReason: "timeout",
+		timeoutPhase: "provider",
+		providerStarted: true
+	};
+	if (input.yielded && !input.aborted) return {
+		yielded: true,
+		livenessState: "paused",
+		stopReason: "end_turn"
+	};
+	return input.aborted ? {
+		aborted: true,
+		status: "cancelled",
+		stopReason: "stop"
+	} : void 0;
+}
+//#endregion
 //#region extensions/codex/src/app-server/run-attempt-lifecycle-controller.ts
 function createCodexAttemptLifecycleController(resources, turnRuntime) {
 	const { prompt, state: resourceState, trajectoryRecorder } = resources;
@@ -2816,6 +2849,7 @@ function createCodexAttemptLifecycleController(resources, turnRuntime) {
 			tool: value.call.tool,
 			durationMs: value.durationMs
 		});
+		turnRuntime.steeringQueueRef.current?.cancel();
 		interruptCodexTurnBestEffort(resourceState.client, {
 			threadId: value.call.threadId,
 			turnId: value.call.turnId,
@@ -2832,6 +2866,7 @@ function createCodexAttemptLifecycleController(resources, turnRuntime) {
 		state.terminalDynamicToolReleaseCheckScheduled = true;
 		setImmediate(() => {
 			state.terminalDynamicToolReleaseCheckScheduled = false;
+			if (state.pendingTerminalDynamicToolRelease?.response.success === true && !state.currentTurnHadNonTerminalDynamicToolResult && state.activeAppServerTurnRequests === 0 && pendingOpenClawDynamicToolCompletionIds.size === 0) turnRuntime.steeringQueueRef.current?.cancel();
 			const action = resolveTerminalDynamicToolBatchAction({
 				activeAppServerTurnRequests: state.activeAppServerTurnRequests,
 				activeTurnItemIdsCount: activeTurnItemIds.size,
@@ -2868,25 +2903,17 @@ function createCodexAttemptLifecycleController(resources, turnRuntime) {
 				startedAt: attemptStartedAt,
 				endedAt: Date.now(),
 				...data,
-				...params.deferTerminalLifecycle ?? params.deferTerminalLifecycleEnd ? { phase: "finishing" } : {}
+				...params.deferTerminalLifecycle ? { phase: "finishing" } : {}
 			}
 		});
 		state.lifecycleTerminalEmitted = true;
 	};
 	const buildLifecycleTerminalMeta = (input) => {
 		const abortFields = input.aborted ? resolveAgentRunAbortLifecycleFields(runAbortController.signal) : void 0;
-		if (input.timedOut || abortFields?.stopReason === "timeout") return {
-			aborted: true,
-			status: "timed_out",
-			stopReason: "timeout",
-			timeoutPhase: "provider",
-			providerStarted: true
-		};
-		return input.aborted ? {
-			aborted: true,
-			status: "cancelled",
-			stopReason: "stop"
-		} : void 0;
+		return buildCodexLifecycleTerminalMeta({
+			...input,
+			abortStopReason: abortFields?.stopReason
+		});
 	};
 	const executionPhaseKeys = /* @__PURE__ */ new Set();
 	const emitExecutionPhaseOnce = (key, info) => {
@@ -2999,7 +3026,8 @@ var ClientTurnRouter = class {
 			gate: "open",
 			pending: [],
 			notificationTail: Promise.resolve(),
-			nativeTurnCompleted: false
+			nativeTurnCompleted: false,
+			ignoredTurnNotificationKeys: /* @__PURE__ */ new Set()
 		};
 		this.routes.set(threadId, route);
 		if (options.onNotification || options.onRequest) this.activateNow(route, options);
@@ -3082,6 +3110,7 @@ var ClientTurnRouter = class {
 		this.assertRoute(route);
 		if (route.gate !== "open") throw new Error(`codex app-server thread route cannot arm from ${route.gate}`);
 		route.gate = "armed";
+		route.ignoredTurnNotificationKeys.clear();
 		route.nativeTurnCompleted = false;
 		route.binding = deferred();
 	}
@@ -3131,7 +3160,10 @@ var ClientTurnRouter = class {
 		}
 		const handler = route.handlers.onNotification;
 		if (!handler) return;
-		if (route.gate === "bound" && scope.turnId && scope.turnId !== route.turnId) return;
+		if (route.gate === "bound" && scope.turnId && scope.turnId !== route.turnId) {
+			this.warnDroppedStaleTurnNotification(route, notification, routeScope);
+			return;
+		}
 		if (route.gate === "armed") {
 			this.bufferNotification(route, notification, routeScope, receivedAtMs);
 			return;
@@ -3174,11 +3206,31 @@ var ClientTurnRouter = class {
 	flushNotifications(route) {
 		const handler = route.handlers?.onNotification;
 		if (!handler) return;
-		for (const pending of route.pending.splice(0)) if (!pending.scope.turnId || route.gate !== "bound" || pending.scope.turnId === route.turnId) {
+		for (const pending of route.pending.splice(0)) {
+			if (route.gate === "bound" && pending.scope.turnId && pending.scope.turnId !== route.turnId) {
+				this.warnDroppedStaleTurnNotification(route, pending.notification, pending.scope);
+				continue;
+			}
 			route.handlers?.onNotificationReceived?.(pending.notification, pending.scope, pending.receivedAtMs);
 			this.enqueueNotification(route, handler, pending.notification, pending.scope);
 		}
 	}
+	warnDroppedStaleTurnNotification(route, notification, scope) {
+		if (notification.method === "turn/completed" || !scope.turnId || !route.turnId) return;
+		const eventKind = redactCodexEventKind(notification.method);
+		const key = JSON.stringify([notification.method, scope.turnId]);
+		if (route.ignoredTurnNotificationKeys.has(key)) return;
+		route.ignoredTurnNotificationKeys.add(key);
+		embeddedAgentLog.warn("codex app-server notification ignored for inactive turn", {
+			eventKind,
+			activeThreadId: route.threadId,
+			activeTurnId: route.turnId,
+			threadId: scope.threadId,
+			turnId: scope.turnId,
+			matchesActiveThread: true,
+			matchesActiveTurn: false
+		});
+	}
 	bufferNotification(route, notification, scope, receivedAtMs) {
 		if (route.pending.length < DEFAULT_PREBIND_NOTIFICATION_LIMIT) {
 			route.pending.push({
@@ -3307,8 +3359,7 @@ function createCodexAttemptNotificationController(resources, turnRuntime, lifecy
 	const isTerminalTurnNotificationForTurn = (notification, notificationTurnId) => isTerminalCodexTurnNotificationForTurn({
 		notification,
 		threadId: resourceState.thread.threadId,
-		turnId: notificationTurnId,
-		currentPromptTexts: [turnState.codexTurnPromptText]
+		turnId: notificationTurnId
 	});
 	const handleNotification = async (notification) => {
 		const projector = projectorRef.current;
@@ -3335,6 +3386,11 @@ function createCodexAttemptNotificationController(resources, turnRuntime, lifecy
 			onReportExecutionNotification: reportExecutionNotification
 		});
 		state.turnCrossedToolHandoff = notificationState.turnCrossedToolHandoff;
+		if (notificationState.isCurrentTurnNotification && notification.method === "item/completed") {
+			const item = readCodexNotificationItem(notification.params);
+			if (item?.type === "userMessage" && typeof item.clientId === "string") steeringQueue?.confirmConsumed(item.clientId);
+		}
+		if (notificationState.isTurnAbortMarker) state.sawCodexInterruptMarker = true;
 		const hookNotification = readCodexFinalizationHookNotification(notification, resourceState.thread.threadId, turnId);
 		if (hookNotification?.phase === "started") {
 			if (activeFinalizationHookRunIds.size === 0) finalizationHookBatchStatuses.clear();
@@ -3378,7 +3434,7 @@ function createCodexAttemptNotificationController(resources, turnRuntime, lifecy
 				});
 			}
 			if (notificationState.isTurnTerminal) {
-				if (notificationState.isTurnAbortMarker) projector.markAborted();
+				if ((readCodexTurnCompletedNotification(notification.params)?.turn)?.status === "interrupted" && state.sawCodexInterruptMarker) projector.markAborted();
 				if (!state.timedOut && !runAbortController.signal.aborted) await steeringQueue?.flushPending();
 				state.completed = true;
 				turnWatches.clearCompletionIdleTimer();
@@ -3436,7 +3492,7 @@ function createCodexAttemptNotificationController(resources, turnRuntime, lifecy
 async function prepareCodexAttemptPrompt(context) {
 	const { runtime, attemptTools, historyState, hookContext, workspaceBootstrapContext, baseDeveloperInstructions, openClawPromptContext, skillsCollaborationInstructions, promptState, codexContextProjectionMaxChars } = context;
 	const { connection, buildActiveRunAttemptParams, effectiveContextTokenBudget, effectiveRuntimeModelId, effectiveRuntimeProviderId } = runtime;
-	const { params, activeContextEngine, usesSupervisionConnection, mutable, isInactiveThreadBootstrapBinding, bindingStore, bindingIdentity, agentDir, appServer, contextSessionKey, effectiveWorkspace } = connection;
+	const { params, activeContextEngine, usesSupervisionConnection, mutable, isInactiveThreadBootstrapBinding, bindingStore, bindingIdentity, agentDir, appServer, contextSessionKey, effectiveWorkspace, sandbox } = connection;
 	const { toolBridge } = attemptTools;
 	const applyFreshThreadContinuityProjection = () => {
 		const projection = projectContextEngineAssemblyForCodex({
@@ -3459,6 +3515,7 @@ async function prepareCodexAttemptPrompt(context) {
 			tokenBudget: effectiveContextTokenBudget,
 			availableTools: new Set(flattenCodexDynamicToolFunctions(toolBridge.availableSpecs).map((tool) => tool.name).filter(isNonEmptyString)),
 			citationsMode: params.config?.memory?.citations,
+			sandboxed: sandbox?.enabled === true,
 			modelId: effectiveRuntimeModelId,
 			contextEngineHostSupport: CODEX_APP_SERVER_CONTEXT_ENGINE_HOST,
 			providerId: effectiveRuntimeProviderId,
@@ -3520,7 +3577,7 @@ async function prepareCodexAttemptPrompt(context) {
 	const buildPromptFromCurrentInputs = () => resolveAgentHarnessBeforePromptBuildResult({
 		prompt: prependCurrentInboundContext(promptState.promptText, params.currentInboundContext),
 		developerInstructions: promptState.developerInstructions,
-		messages: codexModelInputHistoryMessages,
+		messages: structuredClone(historyState.messages),
 		ctx: hookContext,
 		bootstrapContextRunKind: params.bootstrapContextRunKind,
 		..."beforeAgentStartResult" in params ? { beforeAgentStartResult: params.beforeAgentStartResult } : {}
@@ -5265,6 +5322,30 @@ function sendError(socket, id, code, message) {
 	}));
 }
 //#endregion
+//#region extensions/codex/src/app-server/sandbox-exec-server/path-uri.ts
+/** Converts Codex PathUri protocol values into sandbox-backend path strings. */
+const WINDOWS_DRIVE_PATH_RE = /^\/[A-Za-z]:(?:\/|$)/u;
+/** Resolves one Codex exec-server PathUri into a POSIX sandbox path. */
+function resolveExecServerPath(rawPath, label) {
+	let pathUrl;
+	try {
+		pathUrl = new URL(rawPath);
+	} catch (error) {
+		throw new Error(`${label} must be a valid file URI: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
+	}
+	if (pathUrl.protocol !== "file:") throw new Error(`${label} URI must use the file scheme, received ${pathUrl.protocol.slice(0, -1)}.`);
+	if (pathUrl.search || pathUrl.hash) throw new Error(`${label} file URI must not include a query or fragment.`);
+	let resolved;
+	try {
+		resolved = fileURLToPath(pathUrl, { windows: false });
+	} catch (error) {
+		throw new Error(`${label} file URI is not valid for the sandbox: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
+	}
+	if (WINDOWS_DRIVE_PATH_RE.test(resolved)) throw new Error(`${label} Windows file URI is not supported by the sandbox.`);
+	if (resolved.includes("\0")) throw new Error(`${label} file URI must not contain a null byte.`);
+	return resolved;
+}
+//#endregion
 //#region extensions/codex/src/app-server/sandbox-exec-server/fs-policy.ts
 /**
 * Resolves Codex filesystem sandbox policy payloads into OpenClaw path/glob
@@ -5304,7 +5385,7 @@ function resolveFsSandboxPolicy(execServer, record) {
 }
 function readFsSandboxCwd(execServer, sandbox) {
 	if (sandbox.cwd === void 0 || sandbox.cwd === null) return normalizeSandboxAbsolutePath(execServer.sandbox.containerWorkdir, "sandbox cwd");
-	return normalizeSandboxAbsolutePath(requireString(sandbox.cwd, "sandbox cwd"), "sandbox cwd");
+	return normalizeSandboxAbsolutePath(resolveExecServerPath(requireString(sandbox.cwd, "sandbox cwd"), "sandbox cwd"), "sandbox cwd");
 }
 function resolveFsSandboxEntry(entry, cwd) {
 	const access = readFsAccessMode(entry.access);
@@ -5312,7 +5393,7 @@ function resolveFsSandboxEntry(entry, cwd) {
 	const pathType = requireString(pathSpec.type, "fs sandbox entry path type");
 	if (pathType === "path") return {
 		kind: "path",
-		path: normalizeSandboxAbsolutePath(requireString(pathSpec.path, "fs sandbox path"), "fs sandbox path"),
+		path: normalizeSandboxAbsolutePath(resolveExecServerPath(requireString(pathSpec.path, "fs sandbox path"), "fs sandbox path"), "fs sandbox path"),
 		access
 	};
 	if (pathType === "special") {
@@ -5506,7 +5587,7 @@ const CODEX_SANDBOX_EXEC_SERVER_MAX_READ_FILE_BYTES = 512 * 1024 * 1024;
 /** Reads a sandbox file as base64 after read-policy and size checks. */
 async function readFile(execServer, params) {
 	const record = requireObject(params, "fs/readFile params");
-	const filePath = requireString(record.path, "path");
+	const filePath = resolveExecServerPath(requireString(record.path, "path"), "read path");
 	assertFsSandboxAccess(execServer, record, [{
 		path: filePath,
 		access: "read"
@@ -5520,7 +5601,7 @@ async function readFile(execServer, params) {
 /** Writes base64 data to an existing sandbox directory after write-policy checks. */
 async function writeFile(execServer, params) {
 	const record = requireObject(params, "fs/writeFile params");
-	const filePath = requireString(record.path, "path");
+	const filePath = resolveExecServerPath(requireString(record.path, "path"), "write path");
 	assertFsSandboxAccess(execServer, record, [{
 		path: filePath,
 		access: "write"
@@ -5536,7 +5617,7 @@ async function writeFile(execServer, params) {
 /** Creates a sandbox directory, respecting recursive and parent-directory semantics. */
 async function createDirectory(execServer, params) {
 	const record = requireObject(params, "fs/createDirectory params");
-	const filePath = requireString(record.path, "path");
+	const filePath = resolveExecServerPath(requireString(record.path, "path"), "create-directory path");
 	assertFsSandboxAccess(execServer, record, [{
 		path: filePath,
 		access: "write"
@@ -5551,7 +5632,7 @@ async function createDirectory(execServer, params) {
 /** Returns normalized metadata for a sandbox path. */
 async function getMetadata(execServer, params) {
 	const record = requireObject(params, "fs/getMetadata params");
-	const filePath = requireString(record.path, "path");
+	const filePath = resolveExecServerPath(requireString(record.path, "path"), "metadata path");
 	assertFsSandboxAccess(execServer, record, [{
 		path: filePath,
 		access: "read"
@@ -5563,7 +5644,7 @@ async function getMetadata(execServer, params) {
 /** Lists sandbox directory entries visible under the resolved filesystem policy. */
 async function readDirectory(execServer, params) {
 	const record = requireObject(params, "fs/readDirectory params");
-	return { entries: await listDirectoryEntries(execServer, requireString(record.path, "path"), resolveFsSandboxPolicy(execServer, record)) };
+	return { entries: await listDirectoryEntries(execServer, resolveExecServerPath(requireString(record.path, "path"), "read-directory path"), resolveFsSandboxPolicy(execServer, record)) };
 }
 async function listDirectoryEntries(execServer, filePath, fsSandboxPolicy) {
 	assertResolvedFsSandboxAccess(fsSandboxPolicy, [{
@@ -5595,7 +5676,7 @@ async function listDirectoryEntries(execServer, filePath, fsSandboxPolicy) {
 /** Removes a sandbox path after rejecting writes outside policy or under read-only descendants. */
 async function removePath(execServer, params) {
 	const record = requireObject(params, "fs/remove params");
-	const filePath = requireString(record.path, "path");
+	const filePath = resolveExecServerPath(requireString(record.path, "path"), "remove path");
 	const fsSandboxPolicy = resolveFsSandboxPolicy(execServer, record);
 	assertResolvedFsSandboxAccess(fsSandboxPolicy, [{
 		path: filePath,
@@ -5611,8 +5692,8 @@ async function removePath(execServer, params) {
 /** Copies sandbox files or recursive directories while enforcing source and destination policy. */
 async function copyPath(execServer, params) {
 	const record = requireObject(params, "fs/copy params");
-	const sourcePath = requireString(record.sourcePath ?? record.source, "sourcePath");
-	const destinationPath = requireString(record.destinationPath ?? record.destination, "destinationPath");
+	const sourcePath = resolveExecServerPath(requireString(record.sourcePath ?? record.source, "sourcePath"), "copy source path");
+	const destinationPath = resolveExecServerPath(requireString(record.destinationPath ?? record.destination, "destinationPath"), "copy destination path");
 	const fsSandboxPolicy = resolveFsSandboxPolicy(execServer, record);
 	assertResolvedFsSandboxAccess(fsSandboxPolicy, [{
 		path: sourcePath,
@@ -5812,8 +5893,9 @@ function readStreamingSandboxHttpResponse(params) {
 			}
 			reject(new Error(message));
 		};
+		params.child.stdout.setEncoding("utf8");
 		params.child.stdout.on("data", (chunk) => {
-			stdoutBuffer += chunk.toString("utf8");
+			stdoutBuffer += chunk;
 			let newline = stdoutBuffer.indexOf("\n");
 			while (newline >= 0) {
 				const line = stdoutBuffer.slice(0, newline).trim();
@@ -5849,8 +5931,9 @@ function readStreamingSandboxHttpResponse(params) {
 				fail(`sandbox http/request produced an unterminated stdout line longer than ${SANDBOX_HTTP_STREAM_LINE_MAX_CHARS} characters`, null);
 			}
 		});
+		params.child.stderr.setEncoding("utf8");
 		params.child.stderr.on("data", (chunk) => {
-			stderr = `${stderr}${chunk.toString("utf8")}`.slice(-4096);
+			stderr = sliceUtf16Safe(`${stderr}${chunk}`, -4096);
 		});
 		params.child.once("error", (error) => {
 			childFailure ??= error.message;
@@ -6101,7 +6184,7 @@ async function startProcess(execServer, processes, socket, params) {
 	const processId = requireString(record.processId, "processId");
 	if (processes.has(processId)) throw new Error(`process already exists: ${processId}`);
 	const argv = requireStringArray(record.argv, "argv");
-	const cwd = requireString(record.cwd, "cwd");
+	const cwd = resolveExecServerPath(requireString(record.cwd, "cwd"), "process cwd");
 	rejectUnsupportedArg0(record.arg0);
 	const env = readProcessEnv(record);
 	const managed = {
@@ -6591,7 +6674,7 @@ function prepareCodexAttemptResources(prompt) {
 	const { context, turnState, buildRenderedCodexDeveloperInstructions } = prompt;
 	const { runtime, attemptTools } = context;
 	const { connection, hookChannelId } = runtime;
-	const { params, effectiveCwd, sessionAgentId, sandboxSessionKey, runAbortController, sandbox, options, nativeHookRelayEvents } = connection;
+	const { appServer, params, effectiveCwd, sessionAgentId, sandboxSessionKey, runAbortController, sandbox, options, nativeHookRelayEvents } = connection;
 	const { toolBridge } = attemptTools;
 	const hostTrajectoryRecorder = params.trajectoryRecorder;
 	const trajectoryRecorder = createCodexTrajectoryRecorder({
@@ -6657,16 +6740,17 @@ function prepareCodexAttemptResources(prompt) {
 	const retireSharedCodexClientForOneShotCleanup = async () => {
 		if (params.cleanupBundleMcpOnRunEnd !== true || state.sharedCodexClientRetiredForOneShotCleanup) return;
 		state.sharedCodexClientRetiredForOneShotCleanup = true;
-		const retired = retireSharedCodexAppServerClientIfCurrent(state.client);
-		embeddedAgentLog.info("codex app-server one-shot cleanup retired shared client", {
+		const retired = clearSharedCodexAppServerClientIfCurrentAndUnclaimed(state.client);
+		embeddedAgentLog.info("codex app-server one-shot cleanup checked shared client retirement", {
 			runId: params.runId,
 			sessionId: params.sessionId,
 			sessionKey: params.sessionKey,
-			activeLeases: retired?.activeLeases ?? null,
-			closed: retired?.closed ?? false,
-			matchedSharedClient: Boolean(retired)
+			activeLeases: retired.activeLeases,
+			pendingAcquires: retired.pendingAcquires,
+			closed: retired.closed,
+			matchedSharedClient: retired.found
 		});
-		if (retired?.closed) await state.client.closeAndWait({
+		if (retired.closed) await state.client.closeAndWait({
 			exitTimeoutMs: 2e3,
 			forceKillDelayMs: 250
 		});
@@ -6724,6 +6808,7 @@ function prepareCodexAttemptResources(prompt) {
 			attemptTimeoutMs: params.timeoutMs,
 			startupTimeoutMs,
 			turnStartTimeoutMs: params.timeoutMs,
+			loopDetectionPreToolUseRelay: appServer.loopDetectionPreToolUseRelay,
 			signal: runAbortController.signal,
 			onPreToolUseFailure: (failure) => {
 				const projector = projectorRef.current;
@@ -6736,7 +6821,8 @@ function prepareCodexAttemptResources(prompt) {
 			configPatch: state.nativeHookRelay ? buildCodexNativeHookRelayConfig({
 				relay: state.nativeHookRelay,
 				events: nativeHookRelayEvents,
-				hookTimeoutSec: options.nativeHookRelay?.hookTimeoutSec
+				hookTimeoutSec: options.nativeHookRelay?.hookTimeoutSec,
+				loopDetectionPreToolUseRelay: appServer.loopDetectionPreToolUseRelay
 			}) : options.nativeHookRelay?.enabled === false ? buildCodexNativeHookRelayDisabledConfig() : void 0,
 			nativeHookRelayGeneration: state.nativeHookRelay?.generation
 		};
@@ -6955,6 +7041,21 @@ async function prepareCodexAttemptRuntime(connection) {
 	};
 }
 //#endregion
+//#region extensions/codex/src/app-server/dynamic-tool-result-projection.ts
+/** Project one OpenClaw dynamic-tool response with its executed mutation identity. */
+function recordCodexDynamicToolResult(projector, call, response, protocolResponse) {
+	projector?.recordDynamicToolResult({
+		callId: call.callId,
+		tool: call.tool,
+		asyncStarted: response.asyncStarted === true,
+		terminalResolution: response.terminalResolution,
+		success: protocolResponse.success,
+		terminalType: response.diagnosticTerminalType ?? (protocolResponse.success ? "completed" : "error"),
+		sideEffectEvidence: response.sideEffectEvidence === true || response.terminalResolution?.sideEffectEvidence === true,
+		contentItems: protocolResponse.contentItems
+	});
+}
+//#endregion
 //#region extensions/codex/src/app-server/run-attempt-tools.ts
 function toTranscriptToolResult(response) {
 	const sanitized = sanitizeCodexToolResponse(response);
@@ -7180,8 +7281,10 @@ function createCodexAttemptServerRequestController(resources, turnRuntime, lifec
 					toolBridge,
 					signal: runAbortController.signal,
 					timeoutMs: dynamicToolTimeoutMs,
+					toolMeta,
 					toolCallOrdinal,
 					onAgentToolResult: params.onAgentToolResult,
+					observeToolTerminal: params.observeToolTerminal,
 					onFallbackSelected: () => {
 						if (toolCallOrdinal !== void 0) suppressedDynamicToolOutcomeOrdinals.add(toolCallOrdinal);
 					},
@@ -7217,15 +7320,7 @@ function createCodexAttemptServerRequestController(resources, turnRuntime, lifec
 					success: protocolResponse.success,
 					contentItems: protocolResponse.contentItems
 				});
-				projector?.recordDynamicToolResult({
-					callId: call.callId,
-					tool: call.tool,
-					asyncStarted: response.asyncStarted === true,
-					success: protocolResponse.success,
-					terminalType: response.diagnosticTerminalType ?? (protocolResponse.success ? "completed" : "error"),
-					sideEffectEvidence: response.sideEffectEvidence === true,
-					contentItems: protocolResponse.contentItems
-				});
+				recordCodexDynamicToolResult(projector, call, response, protocolResponse);
 				if (shouldEmitDynamicToolProgress) {
 					const progressResponse = toCodexDynamicToolProgressResponse(response, protocolResponse);
 					emitCodexAppServerEvent(params, {
@@ -7255,7 +7350,7 @@ function createCodexAttemptServerRequestController(resources, turnRuntime, lifec
 					durationMs: toolDurationMs
 				});
 				pendingOpenClawDynamicToolCompletionIds.delete(call.callId);
-				if (response.terminate === true) scheduleTurnReleaseAfterTerminalDynamicTool({
+				if (response.terminate === true && response.success) scheduleTurnReleaseAfterTerminalDynamicTool({
 					call,
 					response,
 					durationMs: toolDurationMs
@@ -7397,11 +7492,200 @@ function clearComputerUseHealthMonitor(client, monitor) {
 	getComputerUseHealthMonitorState().monitors.delete(client);
 }
 //#endregion
+//#region extensions/codex/src/app-server/plugin-metadata-cache.ts
+const CODEX_PLUGIN_METADATA_CACHE_TTL_MS = 3600 * 1e3;
+/** Process-local plugin metadata cache with coalesced loads per query. */
+var CodexPluginMetadataCache = class {
+	constructor(nowMs = Date.now) {
+		this.nowMs = nowMs;
+		this.entries = /* @__PURE__ */ new Map();
+		this.inFlight = /* @__PURE__ */ new Map();
+		this.generations = /* @__PURE__ */ new Map();
+		this.clearGeneration = 0;
+	}
+	/** Returns a fresh cached snapshot without issuing a request. */
+	read(appCacheKey, queryKind) {
+		const entryKey = buildMetadataCacheEntryKey(appCacheKey, queryKind);
+		const entry = this.entries.get(entryKey);
+		if (!entry) return;
+		if (entry.expiresAtMs <= this.nowMs()) {
+			this.entries.delete(entryKey);
+			return;
+		}
+		return entry.snapshot;
+	}
+	/** Returns a fresh cached snapshot or coalesces one plugin/list request. */
+	async load(params) {
+		const entryKey = buildMetadataCacheEntryKey(params.appCacheKey, params.queryKind);
+		const cached = this.read(params.appCacheKey, params.queryKind);
+		if (cached) return cached;
+		const pending = this.inFlight.get(entryKey);
+		if (pending) try {
+			return await pending.promise;
+		} catch {
+			if (this.inFlight.get(entryKey) === pending) this.inFlight.delete(entryKey);
+			return await this.load(params);
+		}
+		const generation = this.generations.get(params.appCacheKey) ?? 0;
+		const clearGeneration = this.clearGeneration;
+		const promise = (async () => {
+			const response = await params.request("plugin/list", params.requestParams);
+			const snapshot = {
+				appCacheKey: params.appCacheKey,
+				queryKind: params.queryKind,
+				response
+			};
+			if (generation === (this.generations.get(params.appCacheKey) ?? 0) && clearGeneration === this.clearGeneration && !hasMarketplaceLoadErrors(response) && (params.cacheable?.(response) ?? true)) this.entries.set(entryKey, {
+				snapshot,
+				expiresAtMs: this.nowMs() + CODEX_PLUGIN_METADATA_CACHE_TTL_MS
+			});
+			return snapshot;
+		})();
+		this.inFlight.set(entryKey, {
+			appCacheKey: params.appCacheKey,
+			promise
+		});
+		try {
+			return await promise;
+		} finally {
+			if (this.inFlight.get(entryKey)?.promise === promise) this.inFlight.delete(entryKey);
+		}
+	}
+	/** Invalidates all plugin metadata queries for one app-server runtime. */
+	invalidate(appCacheKey) {
+		this.generations.set(appCacheKey, (this.generations.get(appCacheKey) ?? 0) + 1);
+		for (const [entryKey, entry] of this.entries) if (entry.snapshot.appCacheKey === appCacheKey) this.entries.delete(entryKey);
+		for (const [entryKey, pending] of this.inFlight) if (pending.appCacheKey === appCacheKey) this.inFlight.delete(entryKey);
+	}
+	/** Clears snapshots and prevents late in-flight loads from repopulating them. */
+	clear() {
+		this.clearGeneration += 1;
+		this.generations.clear();
+		this.entries.clear();
+		this.inFlight.clear();
+	}
+};
+/** Shared plugin metadata cache used by Codex app-server runtime paths. */
+const defaultCodexPluginMetadataCache = new CodexPluginMetadataCache();
+function hasMarketplaceLoadErrors(response) {
+	return (response.marketplaceLoadErrors?.length ?? 0) > 0;
+}
+function buildMetadataCacheEntryKey(appCacheKey, queryKind) {
+	return JSON.stringify([appCacheKey, queryKind]);
+}
+//#endregion
+//#region extensions/codex/src/app-server/plugin-thread-config-deadline.ts
+/** Enforces one bounded startup budget across Codex plugin config discovery. */
+const CODEX_PLUGIN_THREAD_CONFIG_MAX_TIMEOUT_MS = 5e3;
+const CODEX_PLUGIN_THREAD_CONFIG_TIMEOUT_DIVISOR = 4;
+const CODEX_PLUGIN_THREAD_CONFIG_MIN_TIMEOUT_MS = 100;
+var CodexPluginThreadConfigDeadlineError = class extends Error {
+	constructor() {
+		super("Codex plugin thread config deadline elapsed");
+		this.name = "CodexPluginThreadConfigDeadlineError";
+	}
+};
+/** Resolves the plugin policy state reused throughout app-server startup. */
+function resolveCodexPluginThreadConfigStartupPolicy(params) {
+	const pluginThreadConfigRequired = !params.nativeToolSurfaceEnabled || shouldBuildCodexPluginThreadConfig(params.pluginConfig);
+	const pluginThreadConfigPluginConfig = params.nativeToolSurfaceEnabled ? params.pluginConfig : disableCodexPluginThreadConfig(params.pluginConfig);
+	const resolvedPluginPolicy = pluginThreadConfigRequired ? resolveCodexPluginsPolicy(pluginThreadConfigPluginConfig) : void 0;
+	return {
+		pluginThreadConfigRequired,
+		pluginThreadConfigPluginConfig,
+		resolvedPluginPolicy,
+		enabledPluginConfigKeys: resolvedPluginPolicy ? resolvedPluginPolicy.pluginPolicies.filter((plugin) => plugin.enabled).map((plugin) => plugin.configKey).toSorted() : void 0
+	};
+}
+/** Builds plugin config without allowing sequential RPC timeouts to consume the turn. */
+async function buildCodexPluginThreadConfigWithinDeadline(params) {
+	const { requestTimeoutMs, signal, request, ...buildParams } = params;
+	const timeoutMs = resolveCodexPluginThreadConfigTimeoutMs(requestTimeoutMs);
+	const deadlineMs = Date.now() + timeoutMs;
+	try {
+		return await waitForCodexPluginThreadConfigBuild({
+			signal,
+			timeoutMs,
+			build: () => buildCodexPluginThreadConfig({
+				...buildParams,
+				request: (method, requestParams) => {
+					const remainingTimeoutMs = deadlineMs - Date.now();
+					if (remainingTimeoutMs <= 0) throw new CodexPluginThreadConfigDeadlineError();
+					return request(method, requestParams, {
+						timeoutMs: remainingTimeoutMs,
+						signal
+					});
+				}
+			})
+		});
+	} catch (error) {
+		if (signal.aborted || !isCodexPluginThreadConfigTimeoutError(error)) throw error;
+		return buildCodexPluginThreadConfigTimeoutFallback({
+			pluginConfig: buildParams.pluginConfig,
+			appCacheKey: buildParams.appCacheKey,
+			message: `Codex plugin discovery exceeded its ${timeoutMs} ms startup budget; plugin apps were disabled for this turn.`
+		});
+	}
+}
+function waitForCodexPluginThreadConfigBuild(params) {
+	if (params.signal.aborted) return Promise.reject(resolveAbortReason(params.signal));
+	return new Promise((resolve, reject) => {
+		let settled = false;
+		const finish = () => {
+			if (settled) return false;
+			settled = true;
+			clearTimeout(timer);
+			params.signal.removeEventListener("abort", onAbort);
+			return true;
+		};
+		const resolveOnce = (config) => {
+			if (finish()) resolve(config);
+		};
+		const rejectOnce = (error) => {
+			if (finish()) reject(error instanceof Error ? error : new Error(String(error)));
+		};
+		const onAbort = () => rejectOnce(resolveAbortReason(params.signal));
+		const timer = setTimeout(() => rejectOnce(new CodexPluginThreadConfigDeadlineError()), params.timeoutMs);
+		params.signal.addEventListener("abort", onAbort, { once: true });
+		params.build().then(resolveOnce, rejectOnce);
+	});
+}
+function resolveAbortReason(signal) {
+	return signal.reason instanceof Error ? signal.reason : /* @__PURE__ */ new Error("Codex plugin thread config aborted");
+}
+/** Creates the recovery metadata and bounded builder used by thread startup. */
+function createCodexPluginThreadConfigStartupProvider(params) {
+	const { client, policy, inputFingerprint, enabledPluginConfigKeys, appCache, metadataCache: configuredMetadataCache, ...buildParams } = params;
+	const metadataCache = configuredMetadataCache ?? defaultCodexPluginMetadataCache;
+	return {
+		enabled: true,
+		inputFingerprint,
+		enabledPluginConfigKeys,
+		accountAppRecoveryEnabled: policy?.allowAllPlugins,
+		recoverablePluginConfigKeys: policy ? resolveRecoverableCodexPluginConfigKeys({
+			policy,
+			metadataCache,
+			appCacheKey: params.appCacheKey
+		}) : void 0,
+		build: () => buildCodexPluginThreadConfigWithinDeadline({
+			...buildParams,
+			appCache: appCache ?? defaultCodexAppInventoryCache,
+			metadataCache,
+			request: (method, requestParams, options) => client.request(method, requestParams, options)
+		})
+	};
+}
+function resolveCodexPluginThreadConfigTimeoutMs(requestTimeoutMs) {
+	return Math.min(CODEX_PLUGIN_THREAD_CONFIG_MAX_TIMEOUT_MS, Math.max(CODEX_PLUGIN_THREAD_CONFIG_MIN_TIMEOUT_MS, Math.floor((Number.isFinite(requestTimeoutMs) && requestTimeoutMs > 0 ? requestTimeoutMs : CODEX_PLUGIN_THREAD_CONFIG_MAX_TIMEOUT_MS * CODEX_PLUGIN_THREAD_CONFIG_TIMEOUT_DIVISOR) / CODEX_PLUGIN_THREAD_CONFIG_TIMEOUT_DIVISOR)));
+}
+function isCodexPluginThreadConfigTimeoutError(error) {
+	return error instanceof CodexPluginThreadConfigDeadlineError || error instanceof Error && "code" in error && error.code === "CODEX_APP_SERVER_LOCAL_REQUEST_CANCELLED" && error.message.endsWith(" timed out");
+}
+//#endregion
 //#region extensions/codex/src/app-server/attempt-startup.ts
 /**
 * Startup orchestration for Codex app-server attempts, including shared-client
-* leasing, plugin thread config, sandbox execution environment, and thread
-* lifecycle binding.
+* leasing, plugin thread config, sandbox environment, and thread lifecycle binding.
 */
 const CODEX_APP_SERVER_STARTUP_CONNECTION_CLOSE_MAX_ATTEMPTS = 3;
 const CODEX_APP_SERVER_CONTEXT_RESTART_SELECTION_CHANGED = "CODEX_APP_SERVER_CONTEXT_RESTART_SELECTION_CHANGED";
@@ -7440,13 +7724,12 @@ async function startCodexAttemptThread(params) {
 			},
 			operation: async () => {
 				const threadConfig = mergeCodexThreadConfigs(params.bundleMcpThreadConfig?.configPatch);
-				const pluginThreadConfigRequired = !params.nativeToolSurfaceEnabled || shouldBuildCodexPluginThreadConfig(params.pluginConfig);
-				const pluginThreadConfigPluginConfig = params.nativeToolSurfaceEnabled ? params.pluginConfig : disableCodexPluginThreadConfig(params.pluginConfig);
-				const resolvedPluginPolicy = pluginThreadConfigRequired ? resolveCodexPluginsPolicy(pluginThreadConfigPluginConfig) : void 0;
+				const { pluginThreadConfigRequired, pluginThreadConfigPluginConfig, resolvedPluginPolicy, enabledPluginConfigKeys } = resolveCodexPluginThreadConfigStartupPolicy({
+					pluginConfig: params.pluginConfig,
+					nativeToolSurfaceEnabled: params.nativeToolSurfaceEnabled
+				});
 				const computerUseMcpElicitationDelegationRequired = params.computerUseConfig.enabled;
-				const mcpElicitationDelegationRequired = resolvedPluginPolicy?.enabled === true || computerUseMcpElicitationDelegationRequired;
-				const enabledPluginConfigKeys = resolvedPluginPolicy ? resolvedPluginPolicy.pluginPolicies.filter((plugin) => plugin.enabled).map((plugin) => plugin.configKey).toSorted() : void 0;
-				pluginAppServer = mcpElicitationDelegationRequired ? {
+				pluginAppServer = resolvedPluginPolicy?.enabled === true || computerUseMcpElicitationDelegationRequired ? {
 					...params.appServer,
 					approvalPolicy: withMcpElicitationsApprovalPolicy(params.appServer.approvalPolicy)
 				} : params.appServer;
@@ -7461,6 +7744,7 @@ async function startCodexAttemptThread(params) {
 						startupClient = await params.attemptClientFactory({
 							startOptions: params.appServer.start,
 							...params.startupPreparedAuth ? { preparedAuth: params.startupPreparedAuth } : { authProfileId: params.startupAuthProfileId },
+							authRequirement: params.startupAuthRequirement,
 							authProfileStore: attemptParams.authProfileStore,
 							authBindingFingerprint: params.startupAuthBindingFingerprint,
 							...params.runtimeArtifactRequest ? {
@@ -7486,8 +7770,8 @@ async function startCodexAttemptThread(params) {
 						releaseSharedClientLease = startupClientLease;
 						attemptedClient = activeStartupClient;
 						startupClientForAbandonedRequestCleanup = activeStartupClient;
-						if (startupAbandoned) throw new Error("codex app-server startup timed out");
-						if (startupAbandonController.signal.aborted) throw new Error("codex app-server startup aborted");
+						if (startupAbandoned) throw new CodexAppServerStartupError("timed_out");
+						if (startupAbandonController.signal.aborted) throw new CodexAppServerStartupError("aborted");
 						let runtimeArtifact;
 						if (params.runtimeArtifactRequest) {
 							const { readCodexAppServerClientRuntimeArtifact, validateCodexAppServerRuntimeArtifact } = await import("./runtime-artifact-C2ITXdhM.js");
@@ -7568,7 +7852,7 @@ async function startCodexAttemptThread(params) {
 							startupSandboxEnvironmentAcquired = Boolean(startupSandboxEnvironment);
 							if (startupAbandonController.signal.aborted) {
 								await releaseStartupSandboxEnvironment();
-								throw new Error("codex app-server startup aborted");
+								throw new CodexAppServerStartupError("aborted");
 							}
 							if (params.sandbox?.enabled && params.nativeToolSurfaceEnabled && params.sandboxExecServerEnabled && !startupSandboxEnvironment) throw new Error("Codex app-server did not register an OpenClaw sandbox exec-server environment.");
 						} catch (error) {
@@ -7631,21 +7915,17 @@ async function startCodexAttemptThread(params) {
 							appServerRuntimeFingerprint,
 							contextEngineProjection: params.contextEngineProjection,
 							signal,
-							pluginThreadConfig: pluginThreadConfigRequired ? {
-								enabled: true,
+							pluginThreadConfig: pluginThreadConfigRequired ? createCodexPluginThreadConfigStartupProvider({
 								inputFingerprint: pluginThreadConfigInputFingerprint,
 								enabledPluginConfigKeys,
-								build: () => buildCodexPluginThreadConfig({
-									pluginConfig: pluginThreadConfigPluginConfig,
-									request: (method, requestParams) => activeStartupClient.request(method, requestParams, {
-										timeoutMs: params.appServer.requestTimeoutMs,
-										signal
-									}),
-									configCwd: startupExecutionCwd,
-									appCache: defaultCodexAppInventoryCache,
-									appCacheKey: pluginAppCacheKey
-								})
-							} : void 0
+								policy: resolvedPluginPolicy,
+								requestTimeoutMs: params.appServer.requestTimeoutMs,
+								signal,
+								pluginConfig: pluginThreadConfigPluginConfig,
+								client: activeStartupClient,
+								configCwd: startupExecutionCwd,
+								appCacheKey: pluginAppCacheKey
+							}) : void 0
 						});
 						try {
 							const startupThread = await startOrResumeThread(buildThreadLifecycleParams(startupAbandonController.signal, reserveStartupThread));
@@ -7658,7 +7938,7 @@ async function startCodexAttemptThread(params) {
 								})) throw new CodexAppServerUnsafeSubscriptionError("Codex startup subscription cleanup failed", { cause: error });
 								throw error;
 							}
-							if (startupAbandonController.signal.aborted) throw new Error("codex app-server startup aborted");
+							if (startupAbandonController.signal.aborted) throw new CodexAppServerStartupError("aborted");
 							const startupRoute = startupReservation;
 							if (!startupRoute) throw new Error("codex app-server startup did not reserve its thread route");
 							startupSandboxEnvironmentAcquired = false;
@@ -7773,14 +8053,14 @@ async function startCodexAttemptThread(params) {
 	}
 }
 function shouldClearSharedClientAfterStartupAbandon(error) {
-	return error instanceof Error && (error.message === "codex app-server startup timed out" || error.message === "codex app-server startup aborted");
+	return isCodexAppServerStartupError(error);
 }
 function shouldClearSharedClientAfterStartupRace(error) {
-	return error instanceof Error && (shouldClearSharedClientAfterStartupAbandon(error) || error.message.endsWith(" timed out"));
+	return shouldClearSharedClientAfterStartupAbandon(error) || isCodexAppServerRequestTimeoutError(error);
 }
 function shouldClearSharedClientAfterStartupFailure(params) {
 	if (!(params.error instanceof Error)) return !params.spawnedBy;
-	if (params.error.message.includes("write EPIPE")) return true;
+	if (isCodexAppServerBrokenPipeError(params.error)) return true;
 	return !params.spawnedBy;
 }
 //#endregion
@@ -7791,7 +8071,7 @@ async function startCodexAttemptRuntime(resources) {
 	const { runtime, attemptTools, promptState } = context;
 	const { connection, runtimeParams, preparedAuthBinding, buildActiveRunAttemptParams, startupAuthAccountCacheKey, startupEnvApiKeyCacheKey, bundleMcpThreadConfig, nativeToolSurfaceEnabled, nativeProviderWebSearchSupport, sandboxExecServerEnabled } = runtime;
 	const { toolBridge, toolState } = attemptTools;
-	const { params, attemptClientFactory, bindingStore, appServer, pluginConfig, computerUseConfig, startupClientAuthProfileId, runtimeArtifactRequest, startupPreparedAuth, agentDir, sessionAgentId, effectiveWorkspace, effectiveCwd, sandbox, runAbortController, usesSupervisionConnection, resolveReviewerPolicyContext, resolveRuntimeOptionsForCurrentBinding, startupAuthProfileId, abortFromUpstream } = connection;
+	const { params, attemptClientFactory, bindingStore, appServer, pluginConfig, computerUseConfig, startupClientAuthProfileId, runtimeArtifactRequest, startupPreparedAuth, agentDir, sessionAgentId, effectiveWorkspace, effectiveCwd, sandbox, runAbortController, usesSupervisionConnection, resolveReviewerPolicyContext, resolveRuntimeOptionsForCurrentBinding, startupAuthProfileId, startupAuthRequirement, abortFromUpstream } = connection;
 	let pluginAppServer = withCodexAppServerFastModeServiceTier(appServer, runtimeParams);
 	try {
 		emitCodexAppServerEvent(params, {
@@ -7805,6 +8085,7 @@ async function startCodexAttemptRuntime(resources) {
 			pluginConfig,
 			computerUseConfig,
 			startupAuthProfileId: startupClientAuthProfileId,
+			startupAuthRequirement,
 			startupAuthBindingFingerprint: preparedAuthBinding?.fingerprint,
 			...runtimeArtifactRequest ? { runtimeArtifactRequest } : {},
 			startupPreparedAuth,
@@ -7873,7 +8154,9 @@ async function startCodexAttemptRuntime(resources) {
 			stream: "codex_app_server.lifecycle",
 			data: {
 				phase: "thread_ready",
-				threadId: state.thread.threadId
+				threadId: state.thread.threadId,
+				action: state.thread.lifecycle.action,
+				clientId: state.client.getInstanceId()
 			}
 		});
 	} catch (error) {
@@ -8097,6 +8380,7 @@ async function prepareCodexAttemptTurnRequest(resources, turnRuntime, ensureCurr
 			model: usesSupervisionConnection ? resourceState.thread.model ?? effectiveRuntimeModelId : params.modelId,
 			api: usesSupervisionConnection ? runtimeParams.model.api : params.model.api,
 			transport: appServer.start.transport,
+			observationUnit: "turn",
 			...hookContextWindowFields,
 			trace: codexModelCallTrace
 		},
@@ -8385,6 +8669,7 @@ async function startCodexAttemptTurn(resources, turnRuntime, notifications, requ
 				return { result: buildCodexTurnStartFailureResult({
 					params,
 					message: usageLimitError.message,
+					promptError: createCodexUsageLimitPromptError(usageLimitError.message),
 					messagesSnapshot,
 					systemPromptReport
 				}) };
@@ -8771,6 +9056,7 @@ function createCodexAttemptTurnState(resources) {
 		rateLimitsRevisionBeforeLastTurnStart: void 0,
 		completed: false,
 		terminalTurnNotificationQueued: false,
+		sawCodexInterruptMarker: false,
 		timedOut: false,
 		turnCompletionIdleTimedOut: false,
 		turnWatchTimeoutKind: void 0,
@@ -8798,7 +9084,7 @@ function createCodexAttemptTurnState(resources) {
 		state.resolveCompletion = resolve;
 	});
 	const turnCompletionIdleTimeoutMs = resolveCodexTurnCompletionIdleTimeoutMs(options.turnCompletionIdleTimeoutMs ?? appServer.turnCompletionIdleTimeoutMs);
-	const turnAssistantCompletionIdleTimeoutMs = resolveCodexTurnAssistantCompletionIdleTimeoutMs(options.turnAssistantCompletionIdleTimeoutMs);
+	const turnAssistantCompletionIdleTimeoutMs = resolveCodexTurnAssistantCompletionIdleTimeoutMs(options.turnAssistantCompletionIdleTimeoutMs ?? appServer.turnAssistantCompletionIdleTimeoutMs);
 	const postToolRawAssistantCompletionIdleTimeoutMs = resolveCodexPostToolRawAssistantCompletionIdleTimeoutMs(options.postToolRawAssistantCompletionIdleTimeoutMs ?? appServer.postToolRawAssistantCompletionIdleTimeoutMs, turnAssistantCompletionIdleTimeoutMs);
 	const turnTerminalIdleTimeoutMs = resolveCodexTurnTerminalIdleTimeoutMs(options.turnTerminalIdleTimeoutMs, params.runTimeoutOverrideMs);
 	const turnAttemptIdleTimeoutMs = Math.max(100, Math.floor(params.timeoutMs));