@openclaw/codex 2026.7.2-beta.4 → 2026.7.2-beta.5

package/dist/{session-binding-ZSMX1omP.js → session-binding-DlVQ-Pxs.js}

@@ -2,704 +2,526 @@ import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
 import { n as CODEX_APP_SERVER_BINDING_NAMESPACE, t as CODEX_APP_SERVER_BINDING_MAX_ENTRIES } from "./session-binding-meta-B7aEMU7g.js";
 import path from "node:path";
 import { resolvePositiveTimerTimeoutMs } from "openclaw/plugin-sdk/number-runtime";
+import { AgentHarnessSessionSupersededError, embeddedAgentLog } from "openclaw/plugin-sdk/agent-harness-runtime";
 import { createHash, createHmac, randomBytes, randomUUID } from "node:crypto";
+import { ensureAuthProfileStore, resolveDefaultAgentDir, resolveProviderIdForAuth, resolveSessionAgentIds as resolveSessionAgentIds$1 } from "openclaw/plugin-sdk/agent-runtime";
 import { readFileSync } from "node:fs";
 import { homedir, hostname } from "node:os";
-import { ensureAuthProfileStore, resolveDefaultAgentDir, resolveProviderIdForAuth, resolveSessionAgentIds } from "openclaw/plugin-sdk/agent-runtime";
 import { resolveExecApprovalsFromFile } from "openclaw/plugin-sdk/exec-approvals-runtime";
 import { normalizeAgentId } from "openclaw/plugin-sdk/routing";
 import { buildSecretInputSchema, normalizeResolvedSecretInputString } from "openclaw/plugin-sdk/secret-input";
 import { normalizeTrimmedStringList } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { detectWindowsSpawnCommandInlineArgs } from "openclaw/plugin-sdk/windows-spawn";
-import { parse } from "smol-toml";
 import { z } from "zod";
-import { AgentHarnessSessionSupersededError, embeddedAgentLog } from "openclaw/plugin-sdk/agent-harness-runtime";
+import { parse } from "smol-toml";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { getSessionEntry, resolveStorePath } from "openclaw/plugin-sdk/session-store-runtime";
-//#region extensions/codex/src/app-server/session-discovery-config.ts
-const codexSessionCatalogConfigSchema = z.object({ enabled: z.boolean().optional() }).strict();
-const codexDiscoveryConfigSchema = z.object({
-	enabled: z.boolean().optional(),
-	timeoutMs: z.number().positive().optional()
-}).strict();
+//#region extensions/codex/src/app-server/config-contracts.ts
+const CODEX_PLUGINS_MARKETPLACE_NAME = "openai-curated";
+const CODEX_PLUGINS_WORKSPACE_MARKETPLACE_NAME = "workspace-directory";
 //#endregion
-//#region extensions/codex/src/app-server/config.ts
+//#region extensions/codex/src/app-server/config-utils.ts
 const START_OPTIONS_KEY_SECRET_SYMBOL = Symbol.for("openclaw.codexAppServerStartOptionsKeySecret");
 const START_OPTIONS_KEY_SECRET = getStartOptionsKeySecret();
-const UNIX_CODEX_REQUIREMENTS_PATH = "/etc/codex/requirements.toml";
-const WINDOWS_CODEX_REQUIREMENTS_SUFFIX = "\\OpenAI\\Codex\\requirements.toml";
-const CODEX_APP_SERVER_HOME_DIRNAME = "codex-home";
-const CODEX_CONFIG_TOML_FILENAME = "config.toml";
 const PLAIN_DECIMAL_NUMBER_RE = /^[+-]?(?:(?:\d+\.?\d*)|(?:\.\d+))$/;
-const CODEX_PLUGINS_MARKETPLACE_NAME = "openai-curated";
-const CODEX_PLUGINS_WORKSPACE_MARKETPLACE_NAME = "workspace-directory";
-function shouldAutoApproveCodexAppServerApprovals(appServer) {
-	return appServer.networkProxy === void 0 && appServer.approvalPolicy === "never" && appServer.sandbox === "danger-full-access";
+function readRecord(value) {
+	return value && typeof value === "object" && !Array.isArray(value) ? value : void 0;
 }
-const DEFAULT_CODEX_COMPUTER_USE_PLUGIN_NAME = "computer-use";
-const DEFAULT_CODEX_COMPUTER_USE_MCP_SERVER_NAME = "computer-use";
-const DEFAULT_CODEX_COMPUTER_USE_MARKETPLACE_DISCOVERY_TIMEOUT_MS = 6e4;
-const DEFAULT_CODEX_COMPUTER_USE_LIVE_TEST_TIMEOUT_MS = 6e4;
-const DEFAULT_CODEX_COMPUTER_USE_TOOL_CALL_TIMEOUT_MS = 6e4;
-const DEFAULT_CODEX_COMPUTER_USE_HEALTH_CHECK_INTERVAL_MINUTES = 60;
-const DEFAULT_CODEX_APP_SERVER_NETWORK_PROXY_PROFILE_PREFIX = "openclaw-network";
-const codexAppServerTransportSchema = z.enum([
-	"stdio",
-	"websocket",
-	"unix"
-]);
-const codexAppServerHomeScopeSchema = z.enum(["agent", "user"]);
-const SecretInputSchema = buildSecretInputSchema();
-const codexAppServerPolicyModeSchema = z.enum(["yolo", "guardian"]);
-const codexAppServerApprovalPolicySchema = z.preprocess((value) => value === "on-failure" ? "on-request" : value, z.enum([
-	"never",
-	"on-request",
-	"untrusted"
-]));
-const codexAppServerSandboxSchema = z.enum([
-	"read-only",
-	"workspace-write",
-	"danger-full-access"
-]);
-const codexAppServerApprovalsReviewerSchema = z.enum([
-	"user",
-	"auto_review",
-	"guardian_subagent"
-]);
-const codexDynamicToolsLoadingSchema = z.enum(["searchable", "direct"]);
-const codexComputerUseHealthIntervalSchema = z.union([
-	z.literal(30),
-	z.literal(60),
-	z.literal(120),
-	z.literal(240)
-]);
-const codexComputerUsePluginCacheModeSchema = z.enum(["shared", "independent"]);
-const codexPluginDestructivePolicySchema = z.union([
-	z.boolean(),
-	z.literal("auto"),
-	z.literal("ask")
-]);
-const codexAppServerServiceTierSchema = z.preprocess((value) => value === null ? null : normalizeCodexServiceTier(value), z.string().trim().min(1).nullable().optional()).optional();
-const codexAppServerExperimentalSchema = z.object({ sandboxExecServer: z.boolean().optional() }).strict();
-const codexAppServerRemoteWorkspaceRootSchema = z.string().trim().min(1);
-const codexAppServerNetworkProxyDomainPermissionSchema = z.enum(["allow", "deny"]);
-const codexAppServerNetworkProxyUnixSocketPermissionSchema = z.enum(["allow", "none"]);
-const codexAppServerNetworkProxySchema = z.object({
-	enabled: z.boolean().optional(),
-	profileName: z.string().trim().min(1).optional(),
-	baseProfile: z.enum(["read-only", "workspace"]).optional(),
-	mode: z.enum(["limited", "full"]).optional(),
-	domains: z.record(z.string(), codexAppServerNetworkProxyDomainPermissionSchema).optional(),
-	unixSockets: z.record(z.string(), codexAppServerNetworkProxyUnixSocketPermissionSchema).optional(),
-	proxyUrl: z.string().trim().min(1).optional(),
-	socksUrl: z.string().trim().min(1).optional(),
-	enableSocks5: z.boolean().optional(),
-	enableSocks5Udp: z.boolean().optional(),
-	allowUpstreamProxy: z.boolean().optional(),
-	allowLocalBinding: z.boolean().optional(),
-	dangerouslyAllowNonLoopbackProxy: z.boolean().optional(),
-	dangerouslyAllowAllUnixSockets: z.boolean().optional()
-}).strict();
-const codexPluginEntryConfigSchema = z.object({
-	enabled: z.boolean().optional(),
-	marketplaceName: z.enum([CODEX_PLUGINS_MARKETPLACE_NAME, CODEX_PLUGINS_WORKSPACE_MARKETPLACE_NAME]).optional(),
-	pluginName: z.string().trim().min(1).optional(),
-	allow_destructive_actions: codexPluginDestructivePolicySchema.optional()
-}).strict();
-const codexPluginsConfigSchema = z.object({
-	enabled: z.boolean().optional(),
-	allow_all_plugins: z.boolean().optional(),
-	allow_destructive_actions: codexPluginDestructivePolicySchema.optional(),
-	plugins: z.record(z.string(), codexPluginEntryConfigSchema).optional()
-}).strict();
-const codexSupervisionEndpointSchema = z.union([z.object({
-	id: z.string().optional(),
-	label: z.string().optional(),
-	transport: z.literal("stdio-proxy").optional(),
-	command: z.string().optional(),
-	args: z.array(z.string()).optional(),
-	cwd: z.string().optional()
-}).strict(), z.object({
-	id: z.string().optional(),
-	label: z.string().optional(),
-	transport: z.literal("websocket"),
-	url: z.string(),
-	authTokenEnv: z.string().optional()
-}).strict()]);
-const codexSupervisionConfigSchema = z.object({
-	enabled: z.boolean().optional(),
-	endpoints: z.array(codexSupervisionEndpointSchema).optional(),
-	allowRawTranscripts: z.boolean().optional(),
-	allowWriteControls: z.boolean().optional()
-}).strict();
-const codexPluginConfigSchema = z.object({
-	codexDynamicToolsLoading: codexDynamicToolsLoadingSchema.optional(),
-	codexDynamicToolsExclude: z.array(z.string()).optional(),
-	sessionCatalog: codexSessionCatalogConfigSchema.optional(),
-	discovery: codexDiscoveryConfigSchema.optional(),
-	computerUse: z.object({
-		enabled: z.boolean().optional(),
-		autoInstall: z.boolean().optional(),
-		marketplaceDiscoveryTimeoutMs: z.number().positive().optional(),
-		liveTestTimeoutMs: z.number().positive().optional(),
-		toolCallTimeoutMs: z.number().positive().optional(),
-		healthCheckEnabled: z.boolean().optional(),
-		healthCheckIntervalMinutes: codexComputerUseHealthIntervalSchema.optional(),
-		pluginCacheMode: codexComputerUsePluginCacheModeSchema.optional(),
-		strictReadiness: z.boolean().optional(),
-		autoRepair: z.boolean().optional(),
-		marketplaceSource: z.string().optional(),
-		marketplacePath: z.string().optional(),
-		marketplaceName: z.string().optional(),
-		pluginName: z.string().optional(),
-		mcpServerName: z.string().optional()
-	}).strict().optional(),
-	codexPlugins: z.unknown().optional(),
-	supervision: codexSupervisionConfigSchema.optional(),
-	appServer: z.object({
-		mode: codexAppServerPolicyModeSchema.optional(),
-		transport: codexAppServerTransportSchema.optional(),
-		homeScope: codexAppServerHomeScopeSchema.optional(),
-		command: z.string().optional(),
-		args: z.union([z.array(z.string()), z.string()]).optional(),
-		url: z.string().optional(),
-		authToken: SecretInputSchema.optional(),
-		headers: z.record(z.string(), SecretInputSchema).optional(),
-		clearEnv: z.array(z.string()).optional(),
-		remoteWorkspaceRoot: codexAppServerRemoteWorkspaceRootSchema.optional(),
-		codeModeOnly: z.boolean().optional(),
-		loopDetectionPreToolUseRelay: z.boolean().optional(),
-		requestTimeoutMs: z.number().positive().optional(),
-		turnCompletionIdleTimeoutMs: z.number().positive().optional(),
-		turnAssistantCompletionIdleTimeoutMs: z.number().positive().optional(),
-		postToolRawAssistantCompletionIdleTimeoutMs: z.number().positive().optional(),
-		approvalPolicy: codexAppServerApprovalPolicySchema.optional(),
-		sandbox: codexAppServerSandboxSchema.optional(),
-		approvalsReviewer: codexAppServerApprovalsReviewerSchema.optional(),
-		serviceTier: codexAppServerServiceTierSchema,
-		networkProxy: codexAppServerNetworkProxySchema.optional(),
-		defaultWorkspaceDir: z.string().optional(),
-		experimental: codexAppServerExperimentalSchema.optional()
-	}).strict().optional()
-}).strict();
-function readCodexPluginConfig(value) {
-	const parsed = codexPluginConfigSchema.safeParse(value);
-	if (!parsed.success) return {};
-	const { codexPlugins: rawCodexPlugins, ...config } = parsed.data;
-	const plugins = codexPluginsConfigSchema.safeParse(rawCodexPlugins);
-	if (!plugins.success) return config;
-	return {
-		...config,
-		...plugins.data ? { codexPlugins: plugins.data } : {}
-	};
+function normalizeCodexServiceTier(value) {
+	if (typeof value !== "string") return;
+	const trimmed = value.trim();
+	if (!trimmed) return;
+	const normalized = trimmed.toLowerCase();
+	if (normalized === "fast" || normalized === "priority") return "priority";
+	if (normalized === "flex") return "flex";
+	return trimmed;
 }
-function isCodexSandboxExecServerEnabled(pluginConfig) {
-	return readCodexPluginConfig(pluginConfig).appServer?.experimental?.sandboxExecServer === true;
+function isCodexFastServiceTier(value) {
+	return normalizeCodexServiceTier(value) === "priority";
 }
-function assertCodexAppServerCommandHasNoInlineArgs(params) {
-	const inlineArgs = detectWindowsSpawnCommandInlineArgs(params.command);
-	if (!inlineArgs) return;
-	const sourceLabel = params.source === "env" ? "OPENCLAW_CODEX_APP_SERVER_BIN" : "plugins.entries.codex.config.appServer.command";
-	const argsLabel = params.source === "env" ? "OPENCLAW_CODEX_APP_SERVER_ARGS" : "plugins.entries.codex.config.appServer.args";
-	throw new Error(`${sourceLabel} must be only the Codex app-server executable path; "${inlineArgs.executable}" was configured with inline arguments "${inlineArgs.arguments}". Move those arguments to ${argsLabel}, or remove the override to use the managed Codex startup path.`);
+function normalizePositiveNumber(value, fallback) {
+	return resolvePositiveTimerTimeoutMs(value, fallback);
 }
-function resolveCodexPluginsPolicy(pluginConfig) {
-	const config = readCodexPluginConfig(pluginConfig).codexPlugins;
-	const configured = config !== void 0;
-	const enabled = config?.enabled === true;
-	const destructivePolicy = resolveCodexPluginDestructivePolicy(config?.allow_destructive_actions ?? true);
-	const pluginPolicies = Object.entries(config?.plugins ?? {}).flatMap(([configKey, entry]) => {
-		if (!isCodexPluginMarketplaceName(entry.marketplaceName) || !entry.pluginName) return [];
-		const entryDestructivePolicy = resolveCodexPluginDestructivePolicy(entry.allow_destructive_actions ?? config?.allow_destructive_actions ?? true);
-		return [{
-			configKey,
-			marketplaceName: entry.marketplaceName,
-			pluginName: entry.pluginName,
-			enabled: enabled && entry.enabled !== false,
-			allowDestructiveActions: entryDestructivePolicy.allowDestructiveActions,
-			destructiveApprovalMode: entryDestructivePolicy.destructiveApprovalMode
-		}];
-	}).toSorted((left, right) => left.configKey.localeCompare(right.configKey));
-	return {
-		configured,
-		enabled,
-		allowAllPlugins: enabled && config?.allow_all_plugins === true,
-		allowDestructiveActions: destructivePolicy.allowDestructiveActions,
-		destructiveApprovalMode: destructivePolicy.destructiveApprovalMode,
-		pluginPolicies
-	};
+function normalizeHeaders(value) {
+	if (!value || typeof value !== "object" || Array.isArray(value)) return {};
+	return Object.fromEntries(Object.entries(value).map(([key, child]) => [key.trim(), normalizeCodexAppServerSecretInput({
+		value: child,
+		path: `plugins.entries.codex.config.appServer.headers.${key}`
+	})]).filter((entry) => Boolean(entry[0] && entry[1])));
 }
-function isCodexPluginMarketplaceName(value) {
-	return value === "openai-curated" || value === "workspace-directory";
+function normalizeCodexAppServerSecretInput(params) {
+	return normalizeResolvedSecretInputString(params);
 }
-function resolveCodexPluginDestructivePolicy(policy) {
-	if (policy === "auto" || policy === "ask") return {
-		allowDestructiveActions: true,
-		destructiveApprovalMode: policy
-	};
-	return {
-		allowDestructiveActions: policy,
-		destructiveApprovalMode: policy ? "allow" : "deny"
-	};
+function normalizeStringList(value) {
+	return normalizeTrimmedStringList(value);
 }
-function resolveCodexAppServerRuntimeOptions(params = {}) {
-	const env = params.env ?? process.env;
-	const config = readCodexPluginConfig(params.pluginConfig).appServer ?? {};
-	const transport = resolveTransport(config.transport);
-	const homeScope = config.homeScope ?? "agent";
-	const configCommand = readNonEmptyString(config.command);
-	const envCommand = readNonEmptyString(env.OPENCLAW_CODEX_APP_SERVER_BIN);
-	const command = configCommand ?? envCommand ?? "codex";
-	const commandSource = configCommand ? "config" : envCommand ? "env" : "managed";
-	if (commandSource === "config" || commandSource === "env") assertCodexAppServerCommandHasNoInlineArgs({
-		command,
-		source: commandSource
-	});
-	const args = resolveArgs(config.args, env.OPENCLAW_CODEX_APP_SERVER_ARGS);
-	const headers = normalizeHeaders(config.headers);
-	const clearEnv = normalizeStringList(config.clearEnv);
-	const authToken = normalizeCodexAppServerSecretInput({
-		value: config.authToken,
-		path: "plugins.entries.codex.config.appServer.authToken"
-	});
-	const url = readNonEmptyString(config.url) ?? (transport === "unix" ? "unix://" : void 0);
-	const connectionClass = inferCodexAppServerConnectionClass({
-		transport,
-		url
-	});
-	const remoteAppsSubstrate = "preconfigured";
-	const remoteWorkspaceRoot = normalizeRemoteWorkspaceRoot(config.remoteWorkspaceRoot);
-	const execMode = resolveEffectiveOpenClawExecModeForCodexAppServer({
-		execMode: params.execMode,
-		execPolicy: params.execPolicy
-	});
-	assertCodexAppServerAllowedForOpenClawExecMode(execMode);
-	const explicitPolicyMode = resolvePolicyMode(config.mode) ?? resolvePolicyMode(env.OPENCLAW_CODEX_APP_SERVER_MODE);
-	const configuredSandbox = resolveSandbox(config.sandbox) ?? resolveSandbox(env.OPENCLAW_CODEX_APP_SERVER_SANDBOX);
-	const explicitApprovalsReviewer = resolveApprovalsReviewer(config.approvalsReviewer);
-	const normalizedPolicyMode = resolveCodexPolicyModeForOpenClawExecMode(execMode);
-	const ignoreLegacyYoloPolicyMode = normalizedPolicyMode === "guardian" && explicitPolicyMode === "yolo";
-	const canUseModelBackedReviewer = canUseCodexModelBackedApprovalsReviewerForModel({
-		modelProvider: params.modelProvider,
-		model: params.model,
-		config: params.config,
-		env,
-		agentDir: params.agentDir,
-		codexConfigToml: params.codexConfigToml,
-		homeScope
-	});
-	const forceUserReviewer = !canUseModelBackedReviewer && (explicitApprovalsReviewer === "auto_review" || explicitApprovalsReviewer === "guardian_subagent" || explicitPolicyMode === "guardian" && explicitApprovalsReviewer !== "user") || execMode !== void 0 && execMode !== "full" && (execMode !== "auto" || !canUseModelBackedReviewer);
-	const forceGuardianReviewer = execMode === "auto" && canUseModelBackedReviewer;
-	const execModeRequiringPromptingApprovals = execMode === "auto" || execMode === "ask" ? execMode : forceUserReviewer ? "ask" : void 0;
-	const forceDangerFullAccessSandbox = params.execPolicy?.touched === true && params.execPolicy.security === "full" && params.execPolicy.ask === "always";
-	const forceRuntimePolicy = forceUserReviewer || forceGuardianReviewer || forceDangerFullAccessSandbox;
-	const defaultPolicy = explicitPolicyMode && !forceRuntimePolicy && !ignoreLegacyYoloPolicyMode ? void 0 : resolveDefaultCodexAppServerPolicy({
-		transport,
-		env,
-		forceGuardian: normalizedPolicyMode === "guardian",
-		forceUserReviewer: forceUserReviewer || !canUseModelBackedReviewer,
-		execModeRequiringPromptingApprovals,
-		requirementsToml: params.requirementsToml,
-		requirementsPath: params.requirementsPath,
-		readRequirementsFile: params.readRequirementsFile,
-		platform: params.platform,
-		hostName: params.hostName,
-		execModeRequiringUserReviewer: forceUserReviewer ? execMode : void 0
-	});
-	const preserveExplicitAutoSandbox = forceGuardianReviewer && configuredSandbox === "read-only";
-	const forcedPolicy = forceRuntimePolicy ? {
-		approvalPolicy: defaultPolicy?.approvalPolicy ?? "on-request",
-		sandbox: preserveExplicitAutoSandbox ? void 0 : forceDangerFullAccessSandbox ? selectForcedDangerFullAccessSandbox({
-			configuredSandbox,
-			defaultPolicy,
-			openClawSandboxActive: Boolean(params.openClawSandboxActive)
-		}) : selectForcedPromptingSandbox({
-			configuredSandbox,
-			defaultSandbox: defaultPolicy?.sandbox
-		}),
-		approvalsReviewer: defaultPolicy?.approvalsReviewer ?? (forceUserReviewer ? "user" : "auto_review")
-	} : void 0;
-	const policyMode = ignoreLegacyYoloPolicyMode ? normalizedPolicyMode : explicitPolicyMode ?? normalizedPolicyMode ?? defaultPolicy?.mode ?? "yolo";
-	const serviceTier = normalizeCodexServiceTier(config.serviceTier);
-	const resolvedSandbox = forcedPolicy?.sandbox ?? configuredSandbox ?? defaultPolicy?.sandbox ?? (policyMode === "guardian" ? "workspace-write" : "danger-full-access");
-	if (transport === "websocket" && !url) throw new Error("plugins.entries.codex.config.appServer.url is required when appServer.transport is websocket");
-	if (transport === "websocket" && homeScope === "user") throw new Error("plugins.entries.codex.config.appServer.homeScope=user requires appServer.transport=stdio or unix");
-	if (transport === "unix" && homeScope !== "user") throw new Error("plugins.entries.codex.config.appServer.transport=unix requires appServer.homeScope=user");
-	if (transport === "unix" && !url?.startsWith("unix://")) throw new Error("plugins.entries.codex.config.appServer.url must use unix:// when appServer.transport is unix");
-	assertCodexAppServerConnectionSecurity({
-		transport,
-		url,
-		authToken,
-		headers
-	});
-	const configApprovalPolicy = resolveApprovalPolicy(config.approvalPolicy);
-	const envApprovalPolicy = resolveApprovalPolicy(env.OPENCLAW_CODEX_APP_SERVER_APPROVAL_POLICY);
-	const approvalPolicy = configApprovalPolicy ?? envApprovalPolicy ?? defaultPolicy?.approvalPolicy ?? (policyMode === "guardian" ? "on-request" : "never");
-	const approvalPolicySource = configApprovalPolicy ? "config" : envApprovalPolicy ? "env" : defaultPolicy?.approvalPolicy ? "requirements" : "implicit";
-	const computerUseConfig = resolveCodexComputerUseConfig({
-		pluginConfig: params.pluginConfig,
-		env
-	});
-	const managedCommandOrder = params.managedCommandOrder ?? (homeScope === "user" || computerUseConfig.enabled ? "desktop-first" : "package-first");
-	const includeManagedCommandOrder = commandSource === "managed" && (managedCommandOrder === "desktop-first" || params.managedCommandOrder === "package-first");
-	const managedComputerUsePluginNames = [.../* @__PURE__ */ new Set([DEFAULT_CODEX_COMPUTER_USE_PLUGIN_NAME, computerUseConfig.pluginName])];
-	return {
-		start: {
-			transport,
-			homeScope,
-			command,
-			commandSource,
-			...includeManagedCommandOrder ? { managedCommandOrder } : {},
-			...commandSource === "managed" ? { managedComputerUsePluginNames } : {},
-			args: args.length > 0 ? args : [
-				"app-server",
-				"--listen",
-				"stdio://"
-			],
-			...url ? { url } : {},
-			...authToken ? { authToken } : {},
-			headers,
-			...transport === "stdio" && clearEnv.length > 0 ? { clearEnv } : {}
-		},
-		connectionClass,
-		remoteAppsSubstrate,
-		...remoteWorkspaceRoot ? { remoteWorkspaceRoot } : {},
-		codeModeOnly: config.codeModeOnly === true,
-		loopDetectionPreToolUseRelay: config.loopDetectionPreToolUseRelay !== false,
-		requestTimeoutMs: normalizePositiveNumber(config.requestTimeoutMs, 6e4),
-		turnCompletionIdleTimeoutMs: normalizePositiveNumber(config.turnCompletionIdleTimeoutMs, 6e4),
-		turnAssistantCompletionIdleTimeoutMs: normalizePositiveNumber(config.turnAssistantCompletionIdleTimeoutMs, 1e4),
-		...config.postToolRawAssistantCompletionIdleTimeoutMs !== void 0 ? { postToolRawAssistantCompletionIdleTimeoutMs: normalizePositiveNumber(config.postToolRawAssistantCompletionIdleTimeoutMs, 6e4) } : {},
-		approvalPolicy: forcedPolicy?.approvalPolicy ?? approvalPolicy,
-		approvalPolicySource,
-		sandbox: resolvedSandbox,
-		approvalsReviewer: forcedPolicy?.approvalsReviewer ?? explicitApprovalsReviewer ?? defaultPolicy?.approvalsReviewer ?? (policyMode === "guardian" ? "auto_review" : "user"),
-		...serviceTier ? { serviceTier } : {},
-		...resolveCodexAppServerNetworkProxy(config.networkProxy, resolvedSandbox)
-	};
+function readBooleanEnv(value) {
+	if (value === void 0) return;
+	const normalized = value.trim().toLowerCase();
+	if ([
+		"1",
+		"true",
+		"yes",
+		"on"
+	].includes(normalized)) return true;
+	if ([
+		"0",
+		"false",
+		"no",
+		"off"
+	].includes(normalized)) return false;
 }
-/**
-* Rechecks Codex-owned plugin state at the final spawn boundary, where the
-* effective agent home is known, so Computer Use keeps the desktop app's TCC ownership.
-*/
-function resolveCodexAppServerStartOptionsForAgent(params) {
-	const startOptions = params.startOptions;
-	if (startOptions.transport !== "stdio" || startOptions.commandSource !== "managed" || startOptions.managedCommandOrder !== void 0) return startOptions;
-	if (startOptions.homeScope === "user") return {
-		...startOptions,
-		managedCommandOrder: "desktop-first"
-	};
-	return codexConfigEnablesNativeComputerUse({
-		agentDir: params.agentDir,
-		codexConfigToml: params.codexConfigToml,
-		env: params.env,
-		homeScope: "agent",
-		pluginNames: startOptions.managedComputerUsePluginNames ?? [DEFAULT_CODEX_COMPUTER_USE_PLUGIN_NAME]
-	}) ? {
-		...startOptions,
-		managedCommandOrder: "desktop-first"
-	} : startOptions;
+function readExecSecurity(value) {
+	return value === "deny" || value === "allowlist" || value === "full" ? value : void 0;
 }
-function isCodexAppServerApprovalPolicyAllowedByRequirements(policy, params = {}) {
-	const content = readCodexRequirementsToml(params);
-	if (content === void 0) return true;
-	const allowedApprovalPolicies = parseAllowedApprovalPoliciesFromCodexRequirements(content);
-	return allowedApprovalPolicies === void 0 || allowedApprovalPolicies.has(policy);
+function readExecAsk(value) {
+	return value === "off" || value === "on-miss" || value === "always" ? value : void 0;
 }
-function canUseCodexModelBackedApprovalsReviewerForModel(params) {
-	const explicitProvider = params.modelProvider?.trim().toLowerCase();
-	const inferredProvider = inferProviderFromModelRef(params.model);
-	if (explicitProvider && explicitProvider !== "codex") return isTrustedCodexModelBackedApprovalsReviewerProvider(explicitProvider, params) && (inferredProvider === void 0 || isTrustedCodexModelBackedApprovalsReviewerProvider(inferredProvider, params));
-	if (inferredProvider !== void 0) return isTrustedCodexModelBackedApprovalsReviewerProvider(inferredProvider, params);
-	return isTrustedCodexModelBackedApprovalsReviewerProvider(explicitProvider, params);
+function readNumberEnv(value) {
+	const trimmed = value?.trim();
+	if (!trimmed || !PLAIN_DECIMAL_NUMBER_RE.test(trimmed)) return;
+	const parsed = Number(trimmed);
+	return Number.isFinite(parsed) ? parsed : void 0;
 }
-function isTrustedCodexModelBackedOpenAIProvider(params) {
-	if (!openAIBaseUrlEnvOverridesAreTrustedForModelBackedReview(params.env)) return false;
-	const codexBaseUrlOverrides = readCodexBaseUrlOverridesForModelBackedReview(params);
-	if (codexBaseUrlOverrides === false || !codexBaseUrlOverrides.openAI.every(isNativeOpenAIBaseUrl) || !codexBaseUrlOverrides.chatGPT.every(isNativeChatGPTBaseUrl)) return false;
-	const openAIProviders = readConfiguredOpenAIProvidersForModelBackedReview(params.config);
-	if (openAIProviders.length === 0) return true;
-	return openAIProviders.every((openAIProvider) => configuredOpenAIProviderIsTrustedForModelBackedReview(openAIProvider, params.model));
+function resolveArgs(configArgs, envArgs) {
+	if (Array.isArray(configArgs)) return configArgs.map((entry) => readNonEmptyString(entry)).filter((entry) => entry !== void 0);
+	if (typeof configArgs === "string") return splitShellWords(configArgs);
+	return splitShellWords(envArgs ?? "");
 }
-function resolveCodexModelBackedReviewerPolicyContext(params) {
-	const provider = params.provider?.trim();
-	if (provider && provider.toLowerCase() !== "codex") return {
-		modelProvider: normalizeCodexModelBackedReviewerPolicyProvider(provider),
-		model: params.model
-	};
-	const bindingModelProvider = params.bindingModelProvider?.trim();
-	const currentModel = params.model?.trim();
-	const bindingModel = params.bindingModel?.trim();
-	if (bindingModelProvider && currentModel && bindingModel && currentModel === bindingModel) return {
-		modelProvider: normalizeCodexModelBackedReviewerPolicyProvider(bindingModelProvider),
-		model: params.model ?? params.bindingModel
-	};
-	const currentModelProvider = inferProviderFromModelRef(params.model);
-	if (currentModelProvider) return {
-		modelProvider: normalizeCodexModelBackedReviewerPolicyProvider(currentModelProvider),
-		model: params.model
-	};
-	if (bindingModelProvider) return {
-		modelProvider: normalizeCodexModelBackedReviewerPolicyProvider(bindingModelProvider),
-		model: params.model ?? params.bindingModel
-	};
-	return {
-		modelProvider: params.nativeAuthProfile === true ? "openai" : void 0,
-		model: params.model ?? params.bindingModel
-	};
+function readNonEmptyString(value) {
+	if (typeof value !== "string") return;
+	return value.trim() || void 0;
 }
-function resolveCodexComputerUseConfig(params = {}) {
-	const env = params.env ?? process.env;
-	const config = readCodexPluginConfig(params.pluginConfig).computerUse ?? {};
-	const marketplaceSource = readNonEmptyString(params.overrides?.marketplaceSource) ?? readNonEmptyString(config.marketplaceSource) ?? readNonEmptyString(env.OPENCLAW_CODEX_COMPUTER_USE_MARKETPLACE_SOURCE);
-	const marketplacePath = readNonEmptyString(params.overrides?.marketplacePath) ?? readNonEmptyString(config.marketplacePath) ?? readNonEmptyString(env.OPENCLAW_CODEX_COMPUTER_USE_MARKETPLACE_PATH);
-	const marketplaceName = readNonEmptyString(params.overrides?.marketplaceName) ?? readNonEmptyString(config.marketplaceName) ?? readNonEmptyString(env.OPENCLAW_CODEX_COMPUTER_USE_MARKETPLACE_NAME);
-	const configuredPluginName = readNonEmptyString(params.overrides?.pluginName) ?? readNonEmptyString(config.pluginName) ?? readNonEmptyString(env.OPENCLAW_CODEX_COMPUTER_USE_PLUGIN_NAME);
-	const configuredMcpServerName = readNonEmptyString(params.overrides?.mcpServerName) ?? readNonEmptyString(config.mcpServerName) ?? readNonEmptyString(env.OPENCLAW_CODEX_COMPUTER_USE_MCP_SERVER_NAME);
-	const autoInstall = params.overrides?.autoInstall ?? config.autoInstall ?? readBooleanEnv(env.OPENCLAW_CODEX_COMPUTER_USE_AUTO_INSTALL) ?? false;
-	const marketplaceDiscoveryTimeoutMs = normalizePositiveNumber(params.overrides?.marketplaceDiscoveryTimeoutMs ?? config.marketplaceDiscoveryTimeoutMs ?? readNumberEnv(env.OPENCLAW_CODEX_COMPUTER_USE_MARKETPLACE_DISCOVERY_TIMEOUT_MS), DEFAULT_CODEX_COMPUTER_USE_MARKETPLACE_DISCOVERY_TIMEOUT_MS);
-	const liveTestTimeoutMs = normalizePositiveNumber(params.overrides?.liveTestTimeoutMs ?? config.liveTestTimeoutMs ?? readNumberEnv(env.OPENCLAW_CODEX_COMPUTER_USE_LIVE_TEST_TIMEOUT_MS), DEFAULT_CODEX_COMPUTER_USE_LIVE_TEST_TIMEOUT_MS);
-	const toolCallTimeoutMs = normalizePositiveNumber(params.overrides?.toolCallTimeoutMs ?? config.toolCallTimeoutMs ?? readNumberEnv(env.OPENCLAW_CODEX_COMPUTER_USE_TOOL_CALL_TIMEOUT_MS), DEFAULT_CODEX_COMPUTER_USE_TOOL_CALL_TIMEOUT_MS);
-	const healthCheckIntervalMinutes = normalizeComputerUseHealthCheckIntervalMinutes(params.overrides?.healthCheckIntervalMinutes ?? config.healthCheckIntervalMinutes ?? readNumberEnv(env.OPENCLAW_CODEX_COMPUTER_USE_HEALTH_CHECK_INTERVAL_MINUTES));
-	const healthCheckEnabled = params.overrides?.healthCheckEnabled ?? config.healthCheckEnabled ?? readBooleanEnv(env.OPENCLAW_CODEX_COMPUTER_USE_HEALTH_CHECK_ENABLED) ?? false;
-	const pluginCacheMode = normalizeComputerUsePluginCacheMode(params.overrides?.pluginCacheMode) ?? normalizeComputerUsePluginCacheMode(config.pluginCacheMode) ?? normalizeComputerUsePluginCacheMode(env.OPENCLAW_CODEX_COMPUTER_USE_PLUGIN_CACHE_MODE) ?? "independent";
-	const strictReadiness = params.overrides?.strictReadiness ?? config.strictReadiness ?? readBooleanEnv(env.OPENCLAW_CODEX_COMPUTER_USE_STRICT_READINESS) ?? false;
-	const autoRepair = params.overrides?.autoRepair ?? config.autoRepair ?? readBooleanEnv(env.OPENCLAW_CODEX_COMPUTER_USE_AUTO_REPAIR) ?? false;
-	return {
-		enabled: params.overrides?.enabled ?? config.enabled ?? readBooleanEnv(env.OPENCLAW_CODEX_COMPUTER_USE) ?? Boolean(autoInstall || marketplaceSource || marketplacePath || marketplaceName || configuredPluginName || configuredMcpServerName),
-		autoInstall,
-		marketplaceDiscoveryTimeoutMs,
-		liveTestTimeoutMs,
-		toolCallTimeoutMs,
-		healthCheckEnabled,
-		healthCheckIntervalMinutes,
-		pluginCacheMode,
-		strictReadiness,
-		autoRepair,
-		pluginName: configuredPluginName ?? DEFAULT_CODEX_COMPUTER_USE_PLUGIN_NAME,
-		mcpServerName: configuredMcpServerName ?? DEFAULT_CODEX_COMPUTER_USE_MCP_SERVER_NAME,
-		...marketplaceSource ? { marketplaceSource } : {},
-		...marketplacePath ? { marketplacePath } : {},
-		...marketplaceName ? { marketplaceName } : {}
-	};
+function hashSecretForKey(value, label) {
+	if (!value) return null;
+	return createHmac("sha256", START_OPTIONS_KEY_SECRET).update(label).update("\0").update(value).digest("hex");
 }
-function normalizeComputerUseHealthCheckIntervalMinutes(value) {
-	return value === 30 || value === 60 || value === 120 || value === 240 ? value : DEFAULT_CODEX_COMPUTER_USE_HEALTH_CHECK_INTERVAL_MINUTES;
+function getStartOptionsKeySecret() {
+	const globalState = globalThis;
+	globalState[START_OPTIONS_KEY_SECRET_SYMBOL] ??= randomBytes(32);
+	return globalState[START_OPTIONS_KEY_SECRET_SYMBOL];
 }
-function normalizeComputerUsePluginCacheMode(value) {
-	return value === "shared" || value === "independent" ? value : null;
+function splitShellWords(value) {
+	const words = [];
+	let current = "";
+	let quote = null;
+	for (const char of value) {
+		if (quote) {
+			if (char === quote) quote = null;
+			else current += char;
+			continue;
+		}
+		if (char === "\"" || char === "'") {
+			quote = char;
+			continue;
+		}
+		if (/\s/.test(char)) {
+			if (current) {
+				words.push(current);
+				current = "";
+			}
+			continue;
+		}
+		current += char;
+	}
+	if (current) words.push(current);
+	return words;
 }
-function codexAppServerStartOptionsKey(options, params = {}) {
-	return JSON.stringify({
-		transport: options.transport,
-		command: options.command,
-		commandSource: options.commandSource ?? null,
-		managedCommandOrder: options.managedCommandOrder ?? "package-first",
-		managedComputerUsePluginNames: [...options.managedComputerUsePluginNames ?? []].toSorted(),
-		managedFallbackCommandPaths: [...options.managedFallbackCommandPaths ?? []],
-		args: options.args,
-		cwd: options.cwd ?? null,
-		url: options.url ?? null,
-		authToken: hashSecretForKey(options.authToken, "authToken"),
-		headers: Object.entries(options.headers).toSorted(([left], [right]) => left.localeCompare(right)).map(([key, value]) => [key, hashSecretForKey(value, `header:${key}`)]),
-		env: Object.entries(options.env ?? {}).toSorted(([left], [right]) => left.localeCompare(right)).map(([key, value]) => [key, hashSecretForKey(value, `env:${key}`)]),
-		clearEnv: [...options.clearEnv ?? []].toSorted(),
-		authProfileId: params.authProfileId ?? null,
-		authBindingFingerprint: params.authBindingFingerprint ?? null,
-		agentDir: params.agentDir ?? null,
-		fallbackApiKeyCacheKey: params.fallbackApiKeyCacheKey ?? null
-	});
+//#endregion
+//#region extensions/codex/src/app-server/config-exec-policy.ts
+function selectForcedPromptingSandbox(params) {
+	if (params.configuredSandbox === "read-only" || params.defaultSandbox === "read-only") return "read-only";
+	return params.defaultSandbox ?? "workspace-write";
 }
-function codexSandboxPolicyForTurn(mode, cwd) {
-	if (mode === "danger-full-access") return { type: "dangerFullAccess" };
-	if (mode === "read-only") return {
-		type: "readOnly",
-		networkAccess: false
-	};
-	return {
-		type: "workspaceWrite",
-		writableRoots: [cwd],
-		networkAccess: false,
-		excludeTmpdirEnvVar: false,
-		excludeSlashTmp: false
-	};
+function selectForcedDangerFullAccessSandbox(params) {
+	if (params.configuredSandbox === "read-only") return "read-only";
+	if (params.defaultPolicy?.dangerFullAccessAllowed === false) {
+		if (params.openClawSandboxActive) return params.defaultPolicy.sandbox ?? "workspace-write";
+		throw new Error("legacy full exec security with ask requires Codex app-server danger-full-access");
+	}
+	return "danger-full-access";
 }
-/** Resolves the passive supervision control connection without changing harness defaults. */
-function resolveCodexSupervisionAppServerRuntimeOptions(params = {}) {
-	const pluginConfig = readCodexPluginConfig(params.pluginConfig);
-	const appServer = pluginConfig.appServer ?? {};
-	const transport = resolveTransport(appServer.transport);
-	const homeScope = appServer.homeScope ?? (transport === "websocket" ? "agent" : "user");
-	return resolveCodexAppServerRuntimeOptions({
-		...params,
-		pluginConfig: {
-			...pluginConfig,
-			appServer: {
-				...appServer,
-				homeScope
-			}
-		}
-	});
+function selectGuardianSandbox(allowedSandboxModes) {
+	if (allowedSandboxModes === void 0 || allowedSandboxModes.has("workspace-write")) return "workspace-write";
+	if (allowedSandboxModes.has("read-only")) return "read-only";
+	if (allowedSandboxModes.has("danger-full-access")) return "danger-full-access";
+	return "workspace-write";
 }
-function resolveCodexAppServerNetworkProxy(config, sandbox) {
-	if (config?.enabled !== true) return {};
-	const fileSystemMode = config.baseProfile === "read-only" || !config.baseProfile && sandbox === "read-only" ? "read" : "write";
-	const networkConfig = removeUndefinedJsonFields({
-		enabled: true,
-		mode: config.mode,
-		domains: normalizeNetworkProxyPermissionMap(config.domains),
-		unix_sockets: normalizeNetworkProxyPermissionMap(config.unixSockets),
-		proxy_url: readNonEmptyString(config.proxyUrl),
-		socks_url: readNonEmptyString(config.socksUrl),
-		enable_socks5: config.enableSocks5,
-		enable_socks5_udp: config.enableSocks5Udp,
-		allow_upstream_proxy: config.allowUpstreamProxy,
-		allow_local_binding: config.allowLocalBinding,
-		dangerously_allow_non_loopback_proxy: config.dangerouslyAllowNonLoopbackProxy,
-		dangerously_allow_all_unix_sockets: config.dangerouslyAllowAllUnixSockets
-	});
-	const profile = {
-		filesystem: {
-			":minimal": "read",
-			":project_roots": { ".": fileSystemMode }
-		},
-		network: networkConfig
-	};
-	const profileName = resolveNetworkProxyPermissionProfileName(config, profile);
-	const configPatch = {
-		"features.network_proxy.enabled": true,
-		default_permissions: profileName,
-		permissions: { [profileName]: profile }
-	};
-	return { networkProxy: {
-		profileName,
-		configFingerprint: fingerprintCodexAppServerNetworkProxyConfigPatch(configPatch),
-		configPatch
-	} };
+function resolveApprovalPolicy(value) {
+	if (value === "on-failure") return "on-request";
+	return value === "on-request" || value === "untrusted" || value === "never" ? value : void 0;
 }
-function resolveNetworkProxyPermissionProfileName(config, profile) {
-	const explicitProfileName = readNonEmptyString(config.profileName);
-	if (explicitProfileName) return explicitProfileName;
-	const suffix = createHash("sha256").update(stableStringifyJson({
-		version: 1,
-		profile
-	})).digest("hex").slice(0, 16);
-	return `${DEFAULT_CODEX_APP_SERVER_NETWORK_PROXY_PROFILE_PREFIX}-${suffix}`;
+function resolveSandbox(value) {
+	return value === "read-only" || value === "workspace-write" || value === "danger-full-access" ? value : void 0;
 }
-function fingerprintCodexAppServerNetworkProxyConfigPatch(configPatch) {
-	return createHash("sha256").update(stableStringifyJson(configPatch)).digest("hex");
+function resolveApprovalsReviewer(value) {
+	return value === "auto_review" || value === "guardian_subagent" || value === "user" ? value : void 0;
 }
-function normalizeNetworkProxyPermissionMap(value) {
-	const entries = Object.entries(value ?? {}).map(([key, permission]) => [key.trim(), permission]).filter(([key]) => key.length > 0);
-	return entries.length > 0 ? Object.fromEntries(entries) : void 0;
+function resolveOpenClawExecPolicyFromConfig(params) {
+	const root = readRecord(params.config);
+	const globalExec = readRecord(readRecord(root?.tools)?.exec);
+	const globalPolicy = applyOpenClawExecPolicyLayer(createDefaultOpenClawExecPolicy(), globalExec);
+	const agentId = params.agentId?.trim();
+	if (!agentId) return globalPolicy;
+	const agents = readRecord(root?.agents);
+	const agentList = Array.isArray(agents?.list) ? agents.list : [];
+	const normalizedAgentId = normalizeAgentId(agentId);
+	return applyOpenClawExecPolicyLayer(globalPolicy, readRecord(readRecord(readRecord(agentList.find((entry) => {
+		const id = readRecord(entry)?.id;
+		return typeof id === "string" && normalizeAgentId(id) === normalizedAgentId;
+	}))?.tools)?.exec));
 }
-function removeUndefinedJsonFields(value) {
-	return Object.fromEntries(Object.entries(value).filter((entry) => entry[1] !== void 0));
+function resolveOpenClawExecPolicyForCodexAppServer(params) {
+	const overridePolicy = applyOpenClawExecPolicyLayer(resolveOpenClawExecPolicyFromConfig({
+		config: params.config,
+		agentId: params.agentId
+	}), params.execOverrides);
+	return applyOpenClawExecApprovalFloors(overridePolicy, resolveOpenClawExecApprovalFloorsForCodexAppServer({
+		approvals: params.approvals,
+		agentId: params.agentId,
+		policy: overridePolicy
+	}));
 }
-function stableStringifyJson(value) {
-	if (Array.isArray(value)) return `[${value.map((item) => stableStringifyJson(item)).join(",")}]`;
-	if (value && typeof value === "object") return `{${Object.entries(value).toSorted(([left], [right]) => left.localeCompare(right)).map(([key, item]) => `${JSON.stringify(key)}:${stableStringifyJson(item)}`).join(",")}}`;
-	return JSON.stringify(value);
+function resolveEffectiveOpenClawExecModeForCodexAppServer(params) {
+	if (params.execPolicy?.touched === true) return params.execPolicy.mode;
+	return params.execMode;
 }
-function withMcpElicitationsApprovalPolicy(policy) {
-	if (typeof policy !== "string") return { granular: {
-		...policy.granular,
-		mcp_elicitations: true
-	} };
-	if (policy === "never") return { granular: {
-		mcp_elicitations: true,
-		rules: false,
-		sandbox_approval: false,
-		request_permissions: false,
-		skill_approval: false
-	} };
-	return { granular: {
-		mcp_elicitations: true,
-		rules: true,
-		sandbox_approval: true,
-		request_permissions: true,
-		skill_approval: true
-	} };
+function resolveCodexPolicyModeForOpenClawExecMode(mode) {
+	if (!mode || mode === "full") return;
+	return "guardian";
 }
-function resolveTransport(value) {
-	return value === "websocket" || value === "unix" ? value : "stdio";
+function assertCodexAppServerAllowedForOpenClawExecMode(mode) {
+	if (mode === "deny" || mode === "allowlist") throw new Error(`Codex app-server local execution is not available when tools.exec.mode=${mode}`);
 }
-function normalizeRemoteWorkspaceRoot(value) {
-	return readNonEmptyString(value);
+function createDefaultOpenClawExecPolicy() {
+	return {
+		security: "full",
+		ask: "off",
+		touched: false
+	};
 }
-function inferCodexAppServerConnectionClass(params) {
-	if (params.transport !== "websocket") return "local-loopback";
-	return params.url && isLoopbackWebSocketUrl(params.url) ? "local-loopback" : "remote";
+function applyOpenClawExecPolicyLayer(base, exec) {
+	if (!exec) return base;
+	const mode = readExecMode(exec.mode);
+	if (mode !== void 0) return {
+		...resolveOpenClawExecPolicyForMode(mode),
+		touched: true
+	};
+	const security = readExecSecurity(exec.security);
+	const ask = readExecAsk(exec.ask);
+	if (security === void 0 && ask === void 0) return base;
+	const nextSecurity = security ?? base.security;
+	const nextAsk = ask ?? base.ask;
+	return {
+		mode: resolveOpenClawExecModeFromPolicy({
+			security: nextSecurity,
+			ask: nextAsk
+		}),
+		security: nextSecurity,
+		ask: nextAsk,
+		touched: true
+	};
 }
-function assertCodexAppServerConnectionClassConfig(params) {
-	if (params.connectionClass === "remote" && !hasIdentityBearingWebSocketAuth({
-		authToken: params.authToken,
-		headers: params.headers
-	})) throw new Error("remote Codex app-server WebSocket URLs require appServer.authToken or an Authorization header");
+function resolveOpenClawExecApprovalFloorsForCodexAppServer(params) {
+	if (!params.approvals) return;
+	return resolveExecApprovalsFromFile({
+		file: params.approvals,
+		agentId: params.agentId,
+		overrides: {
+			security: params.policy.security,
+			ask: params.policy.ask
+		}
+	}).agent;
 }
-/** Applies the canonical remote-auth boundary to any Codex AppServer transport. */
-function assertCodexAppServerConnectionSecurity(params) {
-	assertCodexAppServerConnectionClassConfig({
-		connectionClass: inferCodexAppServerConnectionClass(params),
-		authToken: params.authToken,
-		headers: params.headers
-	});
+function applyOpenClawExecApprovalFloors(base, approvalFloors) {
+	if (!approvalFloors) return base;
+	const nextSecurity = approvalFloors.security ? minOpenClawExecSecurity(base.security, approvalFloors.security) : base.security;
+	const nextAsk = approvalFloors.ask ? maxOpenClawExecAsk(base.ask, approvalFloors.ask) : base.ask;
+	if (nextSecurity === base.security && nextAsk === base.ask) return base;
+	return {
+		mode: resolveOpenClawExecModeFromPolicy({
+			security: nextSecurity,
+			ask: nextAsk
+		}),
+		security: nextSecurity,
+		ask: nextAsk,
+		touched: true
+	};
 }
-function isLoopbackWebSocketUrl(value) {
-	let parsed;
-	try {
-		parsed = new URL(value);
-	} catch {
-		return false;
+function resolveOpenClawExecPolicyForMode(mode) {
+	switch (mode) {
+		case "deny": return {
+			mode,
+			security: "deny",
+			ask: "off"
+		};
+		case "allowlist": return {
+			mode,
+			security: "allowlist",
+			ask: "off"
+		};
+		case "ask":
+		case "auto": return {
+			mode,
+			security: "allowlist",
+			ask: "on-miss"
+		};
+		case "full": return {
+			mode,
+			security: "full",
+			ask: "off"
+		};
 	}
-	if (parsed.protocol !== "ws:" && parsed.protocol !== "wss:") return false;
-	const host = parsed.hostname.toLowerCase();
-	return host === "localhost" || host === "127.0.0.1" || host === "::1" || host === "[::1]" || host.startsWith("127.");
+	return mode;
 }
-function hasIdentityBearingWebSocketAuth(params) {
-	if (readNonEmptyString(params.authToken)) return true;
-	return Object.entries(params.headers).some(([key, value]) => key.trim().toLowerCase() === "authorization" && Boolean(readNonEmptyString(value)));
+function resolveOpenClawExecModeFromPolicy(params) {
+	if (params.security === "deny") return "deny";
+	if (params.security === "allowlist" && params.ask === "off") return "allowlist";
+	if (params.security === "full" && params.ask !== "always") return "full";
+	return "ask";
+}
+function minOpenClawExecSecurity(left, right) {
+	const order = {
+		deny: 0,
+		allowlist: 1,
+		full: 2
+	};
+	return order[left] <= order[right] ? left : right;
+}
+function maxOpenClawExecAsk(left, right) {
+	const order = {
+		off: 0,
+		"on-miss": 1,
+		always: 2
+	};
+	return order[left] >= order[right] ? left : right;
+}
+function readExecMode(value) {
+	return value === "deny" || value === "allowlist" || value === "ask" || value === "auto" || value === "full" ? value : void 0;
+}
+//#endregion
+//#region extensions/codex/src/app-server/session-discovery-config.ts
+const codexSessionCatalogConfigSchema = z.object({ enabled: z.boolean().optional() }).strict();
+const codexDiscoveryConfigSchema = z.object({
+	enabled: z.boolean().optional(),
+	timeoutMs: z.number().positive().optional()
+}).strict();
+//#endregion
+//#region extensions/codex/src/app-server/config-parsing.ts
+const DEFAULT_CODEX_COMPUTER_USE_PLUGIN_NAME = "computer-use";
+const DEFAULT_CODEX_COMPUTER_USE_MARKETPLACE_DISCOVERY_TIMEOUT_MS = 6e4;
+const DEFAULT_CODEX_COMPUTER_USE_LIVE_TEST_TIMEOUT_MS = 6e4;
+const DEFAULT_CODEX_COMPUTER_USE_TOOL_CALL_TIMEOUT_MS = 6e4;
+const DEFAULT_CODEX_APP_SERVER_NETWORK_PROXY_PROFILE_PREFIX = "openclaw-network";
+const codexAppServerTransportSchema = z.enum([
+	"stdio",
+	"websocket",
+	"unix"
+]);
+const codexAppServerHomeScopeSchema = z.enum(["agent", "user"]);
+const SecretInputSchema = buildSecretInputSchema();
+const codexAppServerPolicyModeSchema = z.enum(["yolo", "guardian"]);
+const codexAppServerApprovalPolicySchema = z.preprocess((value) => value === "on-failure" ? "on-request" : value, z.enum([
+	"never",
+	"on-request",
+	"untrusted"
+]));
+const codexAppServerSandboxSchema = z.enum([
+	"read-only",
+	"workspace-write",
+	"danger-full-access"
+]);
+const codexAppServerApprovalsReviewerSchema = z.enum([
+	"user",
+	"auto_review",
+	"guardian_subagent"
+]);
+const codexDynamicToolsLoadingSchema = z.enum(["searchable", "direct"]);
+const codexComputerUseHealthIntervalSchema = z.union([
+	z.literal(30),
+	z.literal(60),
+	z.literal(120),
+	z.literal(240)
+]);
+const codexComputerUsePluginCacheModeSchema = z.enum(["shared", "independent"]);
+const codexPluginDestructivePolicySchema = z.union([
+	z.boolean(),
+	z.literal("auto"),
+	z.literal("ask")
+]);
+const codexAppServerServiceTierSchema = z.preprocess((value) => value === null ? null : normalizeCodexServiceTier(value), z.string().trim().min(1).nullable().optional()).optional();
+const codexAppServerExperimentalSchema = z.object({ sandboxExecServer: z.boolean().optional() }).strict();
+const codexAppServerRemoteWorkspaceRootSchema = z.string().trim().min(1);
+const codexAppServerNetworkProxyDomainPermissionSchema = z.enum(["allow", "deny"]);
+const codexAppServerNetworkProxyUnixSocketPermissionSchema = z.enum(["allow", "none"]);
+const codexAppServerNetworkProxySchema = z.object({
+	enabled: z.boolean().optional(),
+	profileName: z.string().trim().min(1).optional(),
+	baseProfile: z.enum(["read-only", "workspace"]).optional(),
+	mode: z.enum(["limited", "full"]).optional(),
+	domains: z.record(z.string(), codexAppServerNetworkProxyDomainPermissionSchema).optional(),
+	unixSockets: z.record(z.string(), codexAppServerNetworkProxyUnixSocketPermissionSchema).optional(),
+	proxyUrl: z.string().trim().min(1).optional(),
+	socksUrl: z.string().trim().min(1).optional(),
+	enableSocks5: z.boolean().optional(),
+	enableSocks5Udp: z.boolean().optional(),
+	allowUpstreamProxy: z.boolean().optional(),
+	allowLocalBinding: z.boolean().optional(),
+	dangerouslyAllowNonLoopbackProxy: z.boolean().optional(),
+	dangerouslyAllowAllUnixSockets: z.boolean().optional()
+}).strict();
+const codexPluginEntryConfigSchema = z.object({
+	enabled: z.boolean().optional(),
+	marketplaceName: z.enum([CODEX_PLUGINS_MARKETPLACE_NAME, CODEX_PLUGINS_WORKSPACE_MARKETPLACE_NAME]).optional(),
+	pluginName: z.string().trim().min(1).optional(),
+	allow_destructive_actions: codexPluginDestructivePolicySchema.optional()
+}).strict();
+const codexPluginsConfigSchema = z.object({
+	enabled: z.boolean().optional(),
+	allow_all_plugins: z.boolean().optional(),
+	allow_destructive_actions: codexPluginDestructivePolicySchema.optional(),
+	plugins: z.record(z.string(), codexPluginEntryConfigSchema).optional()
+}).strict();
+const codexSupervisionEndpointSchema = z.union([z.object({
+	id: z.string().optional(),
+	label: z.string().optional(),
+	transport: z.literal("stdio-proxy").optional(),
+	command: z.string().optional(),
+	args: z.array(z.string()).optional(),
+	cwd: z.string().optional()
+}).strict(), z.object({
+	id: z.string().optional(),
+	label: z.string().optional(),
+	transport: z.literal("websocket"),
+	url: z.string(),
+	authTokenEnv: z.string().optional()
+}).strict()]);
+const codexSupervisionConfigSchema = z.object({
+	enabled: z.boolean().optional(),
+	endpoints: z.array(codexSupervisionEndpointSchema).optional(),
+	allowRawTranscripts: z.boolean().optional(),
+	allowWriteControls: z.boolean().optional()
+}).strict();
+const codexPluginConfigSchema = z.object({
+	codexDynamicToolsLoading: codexDynamicToolsLoadingSchema.optional(),
+	codexDynamicToolsExclude: z.array(z.string()).optional(),
+	sessionCatalog: codexSessionCatalogConfigSchema.optional(),
+	discovery: codexDiscoveryConfigSchema.optional(),
+	computerUse: z.object({
+		enabled: z.boolean().optional(),
+		autoInstall: z.boolean().optional(),
+		marketplaceDiscoveryTimeoutMs: z.number().positive().optional(),
+		liveTestTimeoutMs: z.number().positive().optional(),
+		toolCallTimeoutMs: z.number().positive().optional(),
+		healthCheckEnabled: z.boolean().optional(),
+		healthCheckIntervalMinutes: codexComputerUseHealthIntervalSchema.optional(),
+		pluginCacheMode: codexComputerUsePluginCacheModeSchema.optional(),
+		strictReadiness: z.boolean().optional(),
+		autoRepair: z.boolean().optional(),
+		marketplaceSource: z.string().optional(),
+		marketplacePath: z.string().optional(),
+		marketplaceName: z.string().optional(),
+		pluginName: z.string().optional(),
+		mcpServerName: z.string().optional()
+	}).strict().optional(),
+	codexPlugins: z.unknown().optional(),
+	supervision: codexSupervisionConfigSchema.optional(),
+	appServer: z.object({
+		mode: codexAppServerPolicyModeSchema.optional(),
+		transport: codexAppServerTransportSchema.optional(),
+		homeScope: codexAppServerHomeScopeSchema.optional(),
+		command: z.string().optional(),
+		args: z.union([z.array(z.string()), z.string()]).optional(),
+		url: z.string().optional(),
+		authToken: SecretInputSchema.optional(),
+		headers: z.record(z.string(), SecretInputSchema).optional(),
+		clearEnv: z.array(z.string()).optional(),
+		remoteWorkspaceRoot: codexAppServerRemoteWorkspaceRootSchema.optional(),
+		codeModeOnly: z.boolean().optional(),
+		loopDetectionPreToolUseRelay: z.boolean().optional(),
+		requestTimeoutMs: z.number().positive().optional(),
+		turnCompletionIdleTimeoutMs: z.number().positive().optional(),
+		turnAssistantCompletionIdleTimeoutMs: z.number().positive().optional(),
+		postToolRawAssistantCompletionIdleTimeoutMs: z.number().positive().optional(),
+		approvalPolicy: codexAppServerApprovalPolicySchema.optional(),
+		sandbox: codexAppServerSandboxSchema.optional(),
+		approvalsReviewer: codexAppServerApprovalsReviewerSchema.optional(),
+		serviceTier: codexAppServerServiceTierSchema,
+		networkProxy: codexAppServerNetworkProxySchema.optional(),
+		defaultWorkspaceDir: z.string().optional(),
+		experimental: codexAppServerExperimentalSchema.optional()
+	}).strict().optional()
+}).strict();
+function readCodexPluginConfig(value) {
+	const parsed = codexPluginConfigSchema.safeParse(value);
+	if (!parsed.success) return {};
+	const { codexPlugins: rawCodexPlugins, ...config } = parsed.data;
+	const plugins = codexPluginsConfigSchema.safeParse(rawCodexPlugins);
+	if (!plugins.success) return config;
+	return {
+		...config,
+		...plugins.data ? { codexPlugins: plugins.data } : {}
+	};
+}
+function isCodexSandboxExecServerEnabled(pluginConfig) {
+	return readCodexPluginConfig(pluginConfig).appServer?.experimental?.sandboxExecServer === true;
 }
-function resolvePolicyMode(value) {
-	return value === "guardian" || value === "yolo" ? value : void 0;
+function assertCodexAppServerCommandHasNoInlineArgs(params) {
+	const inlineArgs = detectWindowsSpawnCommandInlineArgs(params.command);
+	if (!inlineArgs) return;
+	const sourceLabel = params.source === "env" ? "OPENCLAW_CODEX_APP_SERVER_BIN" : "plugins.entries.codex.config.appServer.command";
+	const argsLabel = params.source === "env" ? "OPENCLAW_CODEX_APP_SERVER_ARGS" : "plugins.entries.codex.config.appServer.args";
+	throw new Error(`${sourceLabel} must be only the Codex app-server executable path; "${inlineArgs.executable}" was configured with inline arguments "${inlineArgs.arguments}". Move those arguments to ${argsLabel}, or remove the override to use the managed Codex startup path.`);
 }
-function resolveDefaultCodexAppServerPolicy(params) {
-	if (params.transport !== "stdio") return {
-		mode: "yolo",
-		dangerFullAccessAllowed: true
+function resolveCodexPluginsPolicy(pluginConfig) {
+	const config = readCodexPluginConfig(pluginConfig).codexPlugins;
+	const configured = config !== void 0;
+	const enabled = config?.enabled === true;
+	const destructivePolicy = resolveCodexPluginDestructivePolicy(config?.allow_destructive_actions ?? true);
+	const pluginPolicies = Object.entries(config?.plugins ?? {}).flatMap(([configKey, entry]) => {
+		if (!isCodexPluginMarketplaceName(entry.marketplaceName) || !entry.pluginName) return [];
+		const entryDestructivePolicy = resolveCodexPluginDestructivePolicy(entry.allow_destructive_actions ?? config?.allow_destructive_actions ?? true);
+		return [{
+			configKey,
+			marketplaceName: entry.marketplaceName,
+			pluginName: entry.pluginName,
+			enabled: enabled && entry.enabled !== false,
+			allowDestructiveActions: entryDestructivePolicy.allowDestructiveActions,
+			destructiveApprovalMode: entryDestructivePolicy.destructiveApprovalMode
+		}];
+	}).toSorted((left, right) => left.configKey.localeCompare(right.configKey));
+	return {
+		configured,
+		enabled,
+		allowAllPlugins: enabled && config?.allow_all_plugins === true,
+		allowDestructiveActions: destructivePolicy.allowDestructiveActions,
+		destructiveApprovalMode: destructivePolicy.destructiveApprovalMode,
+		pluginPolicies
 	};
-	const content = readCodexRequirementsToml(params);
-	if (content === void 0) {
-		if (!params.forceGuardian) return {
-			mode: "yolo",
-			dangerFullAccessAllowed: true
-		};
-		return {
-			mode: "guardian",
-			dangerFullAccessAllowed: true,
-			approvalPolicy: selectGuardianApprovalPolicy(void 0, params.execModeRequiringPromptingApprovals),
-			approvalsReviewer: params.forceUserReviewer ? selectUserApprovalsReviewer(void 0, params.execModeRequiringUserReviewer) : selectGuardianApprovalsReviewer(void 0, params.execModeRequiringPromptingApprovals === "auto" ? "auto" : void 0),
-			sandbox: selectGuardianSandbox(void 0)
-		};
-	}
-	const allowedSandboxModes = parseAllowedSandboxModesFromCodexRequirements(content, readNonEmptyString(params.hostName) ?? hostname());
-	const allowedApprovalPolicies = parseAllowedApprovalPoliciesFromCodexRequirements(content);
-	const allowedApprovalsReviewers = parseAllowedApprovalsReviewersFromCodexRequirements(content);
-	const yoloSandboxAllowed = allowedSandboxModes === void 0 || allowedSandboxModes.has("danger-full-access");
-	const yoloApprovalAllowed = allowedApprovalPolicies === void 0 || allowedApprovalPolicies.has("never");
-	const yoloReviewerAllowed = allowedApprovalsReviewers === void 0 || allowedApprovalsReviewers.has("user");
-	if (!params.forceGuardian && yoloSandboxAllowed && yoloApprovalAllowed && yoloReviewerAllowed) return {
-		mode: "yolo",
-		dangerFullAccessAllowed: true
+}
+function isCodexPluginMarketplaceName(value) {
+	return value === "openai-curated" || value === "workspace-directory";
+}
+function resolveCodexPluginDestructivePolicy(policy) {
+	if (policy === "auto" || policy === "ask") return {
+		allowDestructiveActions: true,
+		destructiveApprovalMode: policy
 	};
 	return {
-		mode: "guardian",
-		dangerFullAccessAllowed: yoloSandboxAllowed,
-		approvalPolicy: selectGuardianApprovalPolicy(allowedApprovalPolicies, params.execModeRequiringPromptingApprovals),
-		approvalsReviewer: params.forceUserReviewer ? selectUserApprovalsReviewer(allowedApprovalsReviewers, params.execModeRequiringUserReviewer) : selectGuardianApprovalsReviewer(allowedApprovalsReviewers, params.execModeRequiringPromptingApprovals === "auto" ? "auto" : void 0),
-		sandbox: selectGuardianSandbox(allowedSandboxModes)
+		allowDestructiveActions: policy,
+		destructiveApprovalMode: policy ? "allow" : "deny"
 	};
 }
+//#endregion
+//#region extensions/codex/src/app-server/config-requirements.ts
+const UNIX_CODEX_REQUIREMENTS_PATH = "/etc/codex/requirements.toml";
+const WINDOWS_CODEX_REQUIREMENTS_SUFFIX = "\\OpenAI\\Codex\\requirements.toml";
+function isCodexAppServerApprovalPolicyAllowedByRequirements(policy, params = {}) {
+	const content = readCodexRequirementsToml(params);
+	if (content === void 0) return true;
+	const allowedApprovalPolicies = parseAllowedApprovalPoliciesFromCodexRequirements(content);
+	return allowedApprovalPolicies === void 0 || allowedApprovalPolicies.has(policy);
+}
 function readCodexRequirementsToml(params) {
 	if (params.requirementsToml !== void 0) return params.requirementsToml ?? void 0;
 	const requirementsPath = readNonEmptyString(params.requirementsPath) ?? resolveCodexRequirementsPath(params.env ?? process.env, params.platform ?? process.platform);
@@ -889,6 +711,52 @@ function selectUserApprovalsReviewer(allowedApprovalsReviewers, execModeRequirin
 	if (allowedApprovalsReviewers === void 0 || allowedApprovalsReviewers.has("user")) return "user";
 	throw new Error(`tools.exec.mode=${execModeRequiringUserReviewer ?? "ask"} requires Codex app-server user approvals`);
 }
+//#endregion
+//#region extensions/codex/src/app-server/config-reviewer.ts
+const CODEX_APP_SERVER_HOME_DIRNAME = "codex-home";
+const CODEX_CONFIG_TOML_FILENAME = "config.toml";
+function canUseCodexModelBackedApprovalsReviewerForModel(params) {
+	const explicitProvider = params.modelProvider?.trim().toLowerCase();
+	const inferredProvider = inferProviderFromModelRef(params.model);
+	if (explicitProvider && explicitProvider !== "codex") return isTrustedCodexModelBackedApprovalsReviewerProvider(explicitProvider, params) && (inferredProvider === void 0 || isTrustedCodexModelBackedApprovalsReviewerProvider(inferredProvider, params));
+	if (inferredProvider !== void 0) return isTrustedCodexModelBackedApprovalsReviewerProvider(inferredProvider, params);
+	return isTrustedCodexModelBackedApprovalsReviewerProvider(explicitProvider, params);
+}
+function isTrustedCodexModelBackedOpenAIProvider(params) {
+	if (!openAIBaseUrlEnvOverridesAreTrustedForModelBackedReview(params.env)) return false;
+	const codexBaseUrlOverrides = readCodexBaseUrlOverridesForModelBackedReview(params);
+	if (codexBaseUrlOverrides === false || !codexBaseUrlOverrides.openAI.every(isNativeOpenAIBaseUrl) || !codexBaseUrlOverrides.chatGPT.every(isNativeChatGPTBaseUrl)) return false;
+	const openAIProviders = readConfiguredOpenAIProvidersForModelBackedReview(params.config);
+	if (openAIProviders.length === 0) return true;
+	return openAIProviders.every((openAIProvider) => configuredOpenAIProviderIsTrustedForModelBackedReview(openAIProvider, params.model));
+}
+function resolveCodexModelBackedReviewerPolicyContext(params) {
+	const provider = params.provider?.trim();
+	if (provider && provider.toLowerCase() !== "codex") return {
+		modelProvider: normalizeCodexModelBackedReviewerPolicyProvider(provider),
+		model: params.model
+	};
+	const bindingModelProvider = params.bindingModelProvider?.trim();
+	const currentModel = params.model?.trim();
+	const bindingModel = params.bindingModel?.trim();
+	if (bindingModelProvider && currentModel && bindingModel && currentModel === bindingModel) return {
+		modelProvider: normalizeCodexModelBackedReviewerPolicyProvider(bindingModelProvider),
+		model: params.model ?? params.bindingModel
+	};
+	const currentModelProvider = inferProviderFromModelRef(params.model);
+	if (currentModelProvider) return {
+		modelProvider: normalizeCodexModelBackedReviewerPolicyProvider(currentModelProvider),
+		model: params.model
+	};
+	if (bindingModelProvider) return {
+		modelProvider: normalizeCodexModelBackedReviewerPolicyProvider(bindingModelProvider),
+		model: params.model ?? params.bindingModel
+	};
+	return {
+		modelProvider: params.nativeAuthProfile === true ? "openai" : void 0,
+		model: params.model ?? params.bindingModel
+	};
+}
 function isCodexModelBackedApprovalsReviewerProvider(provider) {
 	return provider?.trim().toLowerCase() === "openai";
 }
@@ -1041,278 +909,435 @@ function inferProviderFromModelRef(model) {
 	const slashIndex = normalized?.indexOf("/") ?? -1;
 	return slashIndex > 0 ? normalized?.slice(0, slashIndex) : void 0;
 }
-function selectForcedPromptingSandbox(params) {
-	if (params.configuredSandbox === "read-only" || params.defaultSandbox === "read-only") return "read-only";
-	return params.defaultSandbox ?? "workspace-write";
+//#endregion
+//#region extensions/codex/src/app-server/config-security.ts
+function shouldAutoApproveCodexAppServerApprovals(appServer) {
+	return appServer.networkProxy === void 0 && appServer.approvalPolicy === "never" && appServer.sandbox === "danger-full-access";
 }
-function selectForcedDangerFullAccessSandbox(params) {
-	if (params.configuredSandbox === "read-only") return "read-only";
-	if (params.defaultPolicy?.dangerFullAccessAllowed === false) {
-		if (params.openClawSandboxActive) return params.defaultPolicy.sandbox ?? "workspace-write";
-		throw new Error("legacy full exec security with ask requires Codex app-server danger-full-access");
-	}
-	return "danger-full-access";
+function resolveCodexAppServerNetworkProxy(config, sandbox) {
+	if (config?.enabled !== true) return {};
+	const fileSystemMode = config.baseProfile === "read-only" || !config.baseProfile && sandbox === "read-only" ? "read" : "write";
+	const networkConfig = removeUndefinedJsonFields({
+		enabled: true,
+		mode: config.mode,
+		domains: normalizeNetworkProxyPermissionMap(config.domains),
+		unix_sockets: normalizeNetworkProxyPermissionMap(config.unixSockets),
+		proxy_url: readNonEmptyString(config.proxyUrl),
+		socks_url: readNonEmptyString(config.socksUrl),
+		enable_socks5: config.enableSocks5,
+		enable_socks5_udp: config.enableSocks5Udp,
+		allow_upstream_proxy: config.allowUpstreamProxy,
+		allow_local_binding: config.allowLocalBinding,
+		dangerously_allow_non_loopback_proxy: config.dangerouslyAllowNonLoopbackProxy,
+		dangerously_allow_all_unix_sockets: config.dangerouslyAllowAllUnixSockets
+	});
+	const profile = {
+		filesystem: {
+			":minimal": "read",
+			":project_roots": { ".": fileSystemMode }
+		},
+		network: networkConfig
+	};
+	const profileName = resolveNetworkProxyPermissionProfileName(config, profile);
+	const configPatch = {
+		"features.network_proxy.enabled": true,
+		default_permissions: profileName,
+		permissions: { [profileName]: profile }
+	};
+	return { networkProxy: {
+		profileName,
+		configFingerprint: fingerprintCodexAppServerNetworkProxyConfigPatch(configPatch),
+		configPatch
+	} };
 }
-function selectGuardianSandbox(allowedSandboxModes) {
-	if (allowedSandboxModes === void 0 || allowedSandboxModes.has("workspace-write")) return "workspace-write";
-	if (allowedSandboxModes.has("read-only")) return "read-only";
-	if (allowedSandboxModes.has("danger-full-access")) return "danger-full-access";
-	return "workspace-write";
+function resolveNetworkProxyPermissionProfileName(config, profile) {
+	const explicitProfileName = readNonEmptyString(config.profileName);
+	if (explicitProfileName) return explicitProfileName;
+	return `${DEFAULT_CODEX_APP_SERVER_NETWORK_PROXY_PROFILE_PREFIX}-${createHash("sha256").update(stableStringifyJson({
+		version: 1,
+		profile
+	})).digest("hex").slice(0, 16)}`;
 }
-function resolveApprovalPolicy(value) {
-	if (value === "on-failure") return "on-request";
-	return value === "on-request" || value === "untrusted" || value === "never" ? value : void 0;
+function fingerprintCodexAppServerNetworkProxyConfigPatch(configPatch) {
+	return createHash("sha256").update(stableStringifyJson(configPatch)).digest("hex");
 }
-function resolveSandbox(value) {
-	return value === "read-only" || value === "workspace-write" || value === "danger-full-access" ? value : void 0;
+function normalizeNetworkProxyPermissionMap(value) {
+	const entries = Object.entries(value ?? {}).map(([key, permission]) => [key.trim(), permission]).filter(([key]) => key.length > 0);
+	return entries.length > 0 ? Object.fromEntries(entries) : void 0;
 }
-function resolveApprovalsReviewer(value) {
-	return value === "auto_review" || value === "guardian_subagent" || value === "user" ? value : void 0;
+function removeUndefinedJsonFields(value) {
+	return Object.fromEntries(Object.entries(value).filter((entry) => entry[1] !== void 0));
 }
-function resolveOpenClawExecPolicyFromConfig(params) {
-	const root = readRecord(params.config);
-	const globalExec = readRecord(readRecord(root?.tools)?.exec);
-	const globalPolicy = applyOpenClawExecPolicyLayer(createDefaultOpenClawExecPolicy(), globalExec);
-	const agentId = params.agentId?.trim();
-	if (!agentId) return globalPolicy;
-	const agents = readRecord(root?.agents);
-	const agentList = Array.isArray(agents?.list) ? agents.list : [];
-	const normalizedAgentId = normalizeAgentId(agentId);
-	return applyOpenClawExecPolicyLayer(globalPolicy, readRecord(readRecord(readRecord(agentList.find((entry) => {
-		const id = readRecord(entry)?.id;
-		return typeof id === "string" && normalizeAgentId(id) === normalizedAgentId;
-	}))?.tools)?.exec));
+function stableStringifyJson(value) {
+	if (Array.isArray(value)) return `[${value.map((item) => stableStringifyJson(item)).join(",")}]`;
+	if (value && typeof value === "object") return `{${Object.entries(value).toSorted(([left], [right]) => left.localeCompare(right)).map(([key, item]) => `${JSON.stringify(key)}:${stableStringifyJson(item)}`).join(",")}}`;
+	return JSON.stringify(value);
 }
-function resolveOpenClawExecPolicyForCodexAppServer(params) {
-	const overridePolicy = applyOpenClawExecPolicyLayer(resolveOpenClawExecPolicyFromConfig({
-		config: params.config,
-		agentId: params.agentId
-	}), params.execOverrides);
-	return applyOpenClawExecApprovalFloors(overridePolicy, resolveOpenClawExecApprovalFloorsForCodexAppServer({
-		approvals: params.approvals,
-		agentId: params.agentId,
-		policy: overridePolicy
-	}));
+function withMcpElicitationsApprovalPolicy(policy) {
+	if (typeof policy !== "string") return { granular: {
+		...policy.granular,
+		mcp_elicitations: true
+	} };
+	if (policy === "never") return { granular: {
+		mcp_elicitations: true,
+		rules: false,
+		sandbox_approval: false,
+		request_permissions: false,
+		skill_approval: false
+	} };
+	return { granular: {
+		mcp_elicitations: true,
+		rules: true,
+		sandbox_approval: true,
+		request_permissions: true,
+		skill_approval: true
+	} };
 }
-function resolveEffectiveOpenClawExecModeForCodexAppServer(params) {
-	if (params.execPolicy?.touched === true) return params.execPolicy.mode;
-	return params.execMode;
+function resolveTransport(value) {
+	return value === "websocket" || value === "unix" ? value : "stdio";
+}
+function normalizeRemoteWorkspaceRoot(value) {
+	return readNonEmptyString(value);
+}
+function inferCodexAppServerConnectionClass(params) {
+	if (params.transport !== "websocket") return "local-loopback";
+	return params.url && isLoopbackWebSocketUrl(params.url) ? "local-loopback" : "remote";
 }
-function resolveCodexPolicyModeForOpenClawExecMode(mode) {
-	if (!mode || mode === "full") return;
-	return "guardian";
+function assertCodexAppServerConnectionClassConfig(params) {
+	if (params.connectionClass === "remote" && !hasIdentityBearingWebSocketAuth({
+		authToken: params.authToken,
+		headers: params.headers
+	})) throw new Error("remote Codex app-server WebSocket URLs require appServer.authToken or an Authorization header");
 }
-function assertCodexAppServerAllowedForOpenClawExecMode(mode) {
-	if (mode === "deny" || mode === "allowlist") throw new Error(`Codex app-server local execution is not available when tools.exec.mode=${mode}`);
+/** Applies the canonical remote-auth boundary to any Codex AppServer transport. */
+function assertCodexAppServerConnectionSecurity(params) {
+	assertCodexAppServerConnectionClassConfig({
+		connectionClass: inferCodexAppServerConnectionClass(params),
+		authToken: params.authToken,
+		headers: params.headers
+	});
 }
-function createDefaultOpenClawExecPolicy() {
-	return {
-		security: "full",
-		ask: "off",
-		touched: false
-	};
+function isLoopbackWebSocketUrl(value) {
+	let parsed;
+	try {
+		parsed = new URL(value);
+	} catch {
+		return false;
+	}
+	if (parsed.protocol !== "ws:" && parsed.protocol !== "wss:") return false;
+	const host = parsed.hostname.toLowerCase();
+	return host === "localhost" || host === "127.0.0.1" || host === "::1" || host === "[::1]" || host.startsWith("127.");
 }
-function applyOpenClawExecPolicyLayer(base, exec) {
-	if (!exec) return base;
-	const mode = readExecMode(exec.mode);
-	if (mode !== void 0) return {
-		...resolveOpenClawExecPolicyForMode(mode),
-		touched: true
-	};
-	const security = readExecSecurity(exec.security);
-	const ask = readExecAsk(exec.ask);
-	if (security === void 0 && ask === void 0) return base;
-	const nextSecurity = security ?? base.security;
-	const nextAsk = ask ?? base.ask;
-	return {
-		mode: resolveOpenClawExecModeFromPolicy({
-			security: nextSecurity,
-			ask: nextAsk
-		}),
-		security: nextSecurity,
-		ask: nextAsk,
-		touched: true
-	};
+function hasIdentityBearingWebSocketAuth(params) {
+	if (readNonEmptyString(params.authToken)) return true;
+	return Object.entries(params.headers).some(([key, value]) => key.trim().toLowerCase() === "authorization" && Boolean(readNonEmptyString(value)));
 }
-function resolveOpenClawExecApprovalFloorsForCodexAppServer(params) {
-	if (!params.approvals) return;
-	return resolveExecApprovalsFromFile({
-		file: params.approvals,
-		agentId: params.agentId,
-		overrides: {
-			security: params.policy.security,
-			ask: params.policy.ask
-		}
-	}).agent;
+function resolvePolicyMode(value) {
+	return value === "guardian" || value === "yolo" ? value : void 0;
 }
-function applyOpenClawExecApprovalFloors(base, approvalFloors) {
-	if (!approvalFloors) return base;
-	const nextSecurity = approvalFloors.security ? minOpenClawExecSecurity(base.security, approvalFloors.security) : base.security;
-	const nextAsk = approvalFloors.ask ? maxOpenClawExecAsk(base.ask, approvalFloors.ask) : base.ask;
-	if (nextSecurity === base.security && nextAsk === base.ask) return base;
-	return {
-		mode: resolveOpenClawExecModeFromPolicy({
-			security: nextSecurity,
-			ask: nextAsk
-		}),
-		security: nextSecurity,
-		ask: nextAsk,
-		touched: true
+function resolveDefaultCodexAppServerPolicy(params) {
+	if (params.transport !== "stdio") return {
+		mode: "yolo",
+		dangerFullAccessAllowed: true
 	};
-}
-function resolveOpenClawExecPolicyForMode(mode) {
-	switch (mode) {
-		case "deny": return {
-			mode,
-			security: "deny",
-			ask: "off"
-		};
-		case "allowlist": return {
-			mode,
-			security: "allowlist",
-			ask: "off"
-		};
-		case "ask":
-		case "auto": return {
-			mode,
-			security: "allowlist",
-			ask: "on-miss"
+	const content = readCodexRequirementsToml(params);
+	if (content === void 0) {
+		if (!params.forceGuardian) return {
+			mode: "yolo",
+			dangerFullAccessAllowed: true
 		};
-		case "full": return {
-			mode,
-			security: "full",
-			ask: "off"
+		return {
+			mode: "guardian",
+			dangerFullAccessAllowed: true,
+			approvalPolicy: selectGuardianApprovalPolicy(void 0, params.execModeRequiringPromptingApprovals),
+			approvalsReviewer: params.forceUserReviewer ? selectUserApprovalsReviewer(void 0, params.execModeRequiringUserReviewer) : selectGuardianApprovalsReviewer(void 0, params.execModeRequiringPromptingApprovals === "auto" ? "auto" : void 0),
+			sandbox: selectGuardianSandbox(void 0)
 		};
 	}
-	return mode;
-}
-function resolveOpenClawExecModeFromPolicy(params) {
-	if (params.security === "deny") return "deny";
-	if (params.security === "allowlist" && params.ask === "off") return "allowlist";
-	if (params.security === "full" && params.ask !== "always") return "full";
-	return "ask";
+	const allowedSandboxModes = parseAllowedSandboxModesFromCodexRequirements(content, readNonEmptyString(params.hostName) ?? hostname());
+	const allowedApprovalPolicies = parseAllowedApprovalPoliciesFromCodexRequirements(content);
+	const allowedApprovalsReviewers = parseAllowedApprovalsReviewersFromCodexRequirements(content);
+	const yoloSandboxAllowed = allowedSandboxModes === void 0 || allowedSandboxModes.has("danger-full-access");
+	const yoloApprovalAllowed = allowedApprovalPolicies === void 0 || allowedApprovalPolicies.has("never");
+	const yoloReviewerAllowed = allowedApprovalsReviewers === void 0 || allowedApprovalsReviewers.has("user");
+	if (!params.forceGuardian && yoloSandboxAllowed && yoloApprovalAllowed && yoloReviewerAllowed) return {
+		mode: "yolo",
+		dangerFullAccessAllowed: true
+	};
+	return {
+		mode: "guardian",
+		dangerFullAccessAllowed: yoloSandboxAllowed,
+		approvalPolicy: selectGuardianApprovalPolicy(allowedApprovalPolicies, params.execModeRequiringPromptingApprovals),
+		approvalsReviewer: params.forceUserReviewer ? selectUserApprovalsReviewer(allowedApprovalsReviewers, params.execModeRequiringUserReviewer) : selectGuardianApprovalsReviewer(allowedApprovalsReviewers, params.execModeRequiringPromptingApprovals === "auto" ? "auto" : void 0),
+		sandbox: selectGuardianSandbox(allowedSandboxModes)
+	};
 }
-function minOpenClawExecSecurity(left, right) {
-	const order = {
-		deny: 0,
-		allowlist: 1,
-		full: 2
+//#endregion
+//#region extensions/codex/src/app-server/config-runtime.ts
+function resolveCodexAppServerRuntimeOptions(params = {}) {
+	const env = params.env ?? process.env;
+	const config = readCodexPluginConfig(params.pluginConfig).appServer ?? {};
+	const transport = resolveTransport(config.transport);
+	const homeScope = config.homeScope ?? "agent";
+	const configCommand = readNonEmptyString(config.command);
+	const envCommand = readNonEmptyString(env.OPENCLAW_CODEX_APP_SERVER_BIN);
+	const command = configCommand ?? envCommand ?? "codex";
+	const commandSource = configCommand ? "config" : envCommand ? "env" : "managed";
+	if (commandSource === "config" || commandSource === "env") assertCodexAppServerCommandHasNoInlineArgs({
+		command,
+		source: commandSource
+	});
+	const args = resolveArgs(config.args, env.OPENCLAW_CODEX_APP_SERVER_ARGS);
+	const headers = normalizeHeaders(config.headers);
+	const clearEnv = normalizeStringList(config.clearEnv);
+	const authToken = normalizeCodexAppServerSecretInput({
+		value: config.authToken,
+		path: "plugins.entries.codex.config.appServer.authToken"
+	});
+	const url = readNonEmptyString(config.url) ?? (transport === "unix" ? "unix://" : void 0);
+	const connectionClass = inferCodexAppServerConnectionClass({
+		transport,
+		url
+	});
+	const remoteAppsSubstrate = "preconfigured";
+	const remoteWorkspaceRoot = normalizeRemoteWorkspaceRoot(config.remoteWorkspaceRoot);
+	const execMode = resolveEffectiveOpenClawExecModeForCodexAppServer({
+		execMode: params.execMode,
+		execPolicy: params.execPolicy
+	});
+	assertCodexAppServerAllowedForOpenClawExecMode(execMode);
+	const explicitPolicyMode = resolvePolicyMode(config.mode) ?? resolvePolicyMode(env.OPENCLAW_CODEX_APP_SERVER_MODE);
+	const configuredSandbox = resolveSandbox(config.sandbox) ?? resolveSandbox(env.OPENCLAW_CODEX_APP_SERVER_SANDBOX);
+	const explicitApprovalsReviewer = resolveApprovalsReviewer(config.approvalsReviewer);
+	const normalizedPolicyMode = resolveCodexPolicyModeForOpenClawExecMode(execMode);
+	const ignoreLegacyYoloPolicyMode = normalizedPolicyMode === "guardian" && explicitPolicyMode === "yolo";
+	const canUseModelBackedReviewer = canUseCodexModelBackedApprovalsReviewerForModel({
+		modelProvider: params.modelProvider,
+		model: params.model,
+		config: params.config,
+		env,
+		agentDir: params.agentDir,
+		codexConfigToml: params.codexConfigToml,
+		homeScope
+	});
+	const forceUserReviewer = !canUseModelBackedReviewer && (explicitApprovalsReviewer === "auto_review" || explicitApprovalsReviewer === "guardian_subagent" || explicitPolicyMode === "guardian" && explicitApprovalsReviewer !== "user") || execMode !== void 0 && execMode !== "full" && (execMode !== "auto" || !canUseModelBackedReviewer);
+	const forceGuardianReviewer = execMode === "auto" && canUseModelBackedReviewer;
+	const execModeRequiringPromptingApprovals = execMode === "auto" || execMode === "ask" ? execMode : forceUserReviewer ? "ask" : void 0;
+	const forceDangerFullAccessSandbox = params.execPolicy?.touched === true && params.execPolicy.security === "full" && params.execPolicy.ask === "always";
+	const forceRuntimePolicy = forceUserReviewer || forceGuardianReviewer || forceDangerFullAccessSandbox;
+	const defaultPolicy = explicitPolicyMode && !forceRuntimePolicy && !ignoreLegacyYoloPolicyMode ? void 0 : resolveDefaultCodexAppServerPolicy({
+		transport,
+		env,
+		forceGuardian: normalizedPolicyMode === "guardian",
+		forceUserReviewer: forceUserReviewer || !canUseModelBackedReviewer,
+		execModeRequiringPromptingApprovals,
+		requirementsToml: params.requirementsToml,
+		requirementsPath: params.requirementsPath,
+		readRequirementsFile: params.readRequirementsFile,
+		platform: params.platform,
+		hostName: params.hostName,
+		execModeRequiringUserReviewer: forceUserReviewer ? execMode : void 0
+	});
+	const preserveExplicitAutoSandbox = forceGuardianReviewer && configuredSandbox === "read-only";
+	const forcedPolicy = forceRuntimePolicy ? {
+		approvalPolicy: defaultPolicy?.approvalPolicy ?? "on-request",
+		sandbox: preserveExplicitAutoSandbox ? void 0 : forceDangerFullAccessSandbox ? selectForcedDangerFullAccessSandbox({
+			configuredSandbox,
+			defaultPolicy,
+			openClawSandboxActive: Boolean(params.openClawSandboxActive)
+		}) : selectForcedPromptingSandbox({
+			configuredSandbox,
+			defaultSandbox: defaultPolicy?.sandbox
+		}),
+		approvalsReviewer: defaultPolicy?.approvalsReviewer ?? (forceUserReviewer ? "user" : "auto_review")
+	} : void 0;
+	const policyMode = ignoreLegacyYoloPolicyMode ? normalizedPolicyMode : explicitPolicyMode ?? normalizedPolicyMode ?? defaultPolicy?.mode ?? "yolo";
+	const serviceTier = normalizeCodexServiceTier(config.serviceTier);
+	const resolvedSandbox = forcedPolicy?.sandbox ?? configuredSandbox ?? defaultPolicy?.sandbox ?? (policyMode === "guardian" ? "workspace-write" : "danger-full-access");
+	if (transport === "websocket" && !url) throw new Error("plugins.entries.codex.config.appServer.url is required when appServer.transport is websocket");
+	if (transport === "websocket" && homeScope === "user") throw new Error("plugins.entries.codex.config.appServer.homeScope=user requires appServer.transport=stdio or unix");
+	if (transport === "unix" && homeScope !== "user") throw new Error("plugins.entries.codex.config.appServer.transport=unix requires appServer.homeScope=user");
+	if (transport === "unix" && !url?.startsWith("unix://")) throw new Error("plugins.entries.codex.config.appServer.url must use unix:// when appServer.transport is unix");
+	assertCodexAppServerConnectionSecurity({
+		transport,
+		url,
+		authToken,
+		headers
+	});
+	const configApprovalPolicy = resolveApprovalPolicy(config.approvalPolicy);
+	const envApprovalPolicy = resolveApprovalPolicy(env.OPENCLAW_CODEX_APP_SERVER_APPROVAL_POLICY);
+	const approvalPolicy = configApprovalPolicy ?? envApprovalPolicy ?? defaultPolicy?.approvalPolicy ?? (policyMode === "guardian" ? "on-request" : "never");
+	const approvalPolicySource = configApprovalPolicy ? "config" : envApprovalPolicy ? "env" : defaultPolicy?.approvalPolicy ? "requirements" : "implicit";
+	const computerUseConfig = resolveCodexComputerUseConfig({
+		pluginConfig: params.pluginConfig,
+		env
+	});
+	const managedCommandOrder = params.managedCommandOrder ?? (homeScope === "user" || computerUseConfig.enabled ? "desktop-first" : "package-first");
+	const includeManagedCommandOrder = commandSource === "managed" && (managedCommandOrder === "desktop-first" || params.managedCommandOrder === "package-first");
+	const managedComputerUsePluginNames = [.../* @__PURE__ */ new Set([DEFAULT_CODEX_COMPUTER_USE_PLUGIN_NAME, computerUseConfig.pluginName])];
+	return {
+		start: {
+			transport,
+			homeScope,
+			command,
+			commandSource,
+			...includeManagedCommandOrder ? { managedCommandOrder } : {},
+			...commandSource === "managed" ? { managedComputerUsePluginNames } : {},
+			args: args.length > 0 ? args : [
+				"app-server",
+				"--listen",
+				"stdio://"
+			],
+			...url ? { url } : {},
+			...authToken ? { authToken } : {},
+			headers,
+			...transport === "stdio" && clearEnv.length > 0 ? { clearEnv } : {}
+		},
+		connectionClass,
+		remoteAppsSubstrate,
+		...remoteWorkspaceRoot ? { remoteWorkspaceRoot } : {},
+		codeModeOnly: config.codeModeOnly === true,
+		loopDetectionPreToolUseRelay: config.loopDetectionPreToolUseRelay !== false,
+		requestTimeoutMs: normalizePositiveNumber(config.requestTimeoutMs, 6e4),
+		turnCompletionIdleTimeoutMs: normalizePositiveNumber(config.turnCompletionIdleTimeoutMs, 6e4),
+		turnAssistantCompletionIdleTimeoutMs: normalizePositiveNumber(config.turnAssistantCompletionIdleTimeoutMs, 1e4),
+		...config.postToolRawAssistantCompletionIdleTimeoutMs !== void 0 ? { postToolRawAssistantCompletionIdleTimeoutMs: normalizePositiveNumber(config.postToolRawAssistantCompletionIdleTimeoutMs, 6e4) } : {},
+		approvalPolicy: forcedPolicy?.approvalPolicy ?? approvalPolicy,
+		approvalPolicySource,
+		sandbox: resolvedSandbox,
+		approvalsReviewer: forcedPolicy?.approvalsReviewer ?? explicitApprovalsReviewer ?? defaultPolicy?.approvalsReviewer ?? (policyMode === "guardian" ? "auto_review" : "user"),
+		...serviceTier ? { serviceTier } : {},
+		...resolveCodexAppServerNetworkProxy(config.networkProxy, resolvedSandbox)
 	};
-	return order[left] <= order[right] ? left : right;
 }
-function maxOpenClawExecAsk(left, right) {
-	const order = {
-		off: 0,
-		"on-miss": 1,
-		always: 2
+/**
+* Rechecks Codex-owned plugin state at the final spawn boundary, where the
+* effective agent home is known, so Computer Use keeps the desktop app's TCC ownership.
+*/
+function resolveCodexAppServerStartOptionsForAgent(params) {
+	const startOptions = params.startOptions;
+	if (startOptions.transport !== "stdio" || startOptions.commandSource !== "managed" || startOptions.managedCommandOrder !== void 0) return startOptions;
+	if (startOptions.homeScope === "user") return {
+		...startOptions,
+		managedCommandOrder: "desktop-first"
 	};
-	return order[left] >= order[right] ? left : right;
-}
-function readExecMode(value) {
-	return value === "deny" || value === "allowlist" || value === "ask" || value === "auto" || value === "full" ? value : void 0;
-}
-function readRecord(value) {
-	return value && typeof value === "object" && !Array.isArray(value) ? value : void 0;
-}
-function normalizeCodexServiceTier(value) {
-	if (typeof value !== "string") return;
-	const trimmed = value.trim();
-	if (!trimmed) return;
-	const normalized = trimmed.toLowerCase();
-	if (normalized === "fast" || normalized === "priority") return "priority";
-	if (normalized === "flex") return "flex";
-	return trimmed;
-}
-function isCodexFastServiceTier(value) {
-	return normalizeCodexServiceTier(value) === "priority";
-}
-function normalizePositiveNumber(value, fallback) {
-	return resolvePositiveTimerTimeoutMs(value, fallback);
-}
-function normalizeHeaders(value) {
-	if (!value || typeof value !== "object" || Array.isArray(value)) return {};
-	return Object.fromEntries(Object.entries(value).map(([key, child]) => [key.trim(), normalizeCodexAppServerSecretInput({
-		value: child,
-		path: `plugins.entries.codex.config.appServer.headers.${key}`
-	})]).filter((entry) => Boolean(entry[0] && entry[1])));
-}
-function normalizeCodexAppServerSecretInput(params) {
-	return normalizeResolvedSecretInputString(params);
-}
-function normalizeStringList(value) {
-	return normalizeTrimmedStringList(value);
-}
-function readBooleanEnv(value) {
-	if (value === void 0) return;
-	const normalized = value.trim().toLowerCase();
-	if ([
-		"1",
-		"true",
-		"yes",
-		"on"
-	].includes(normalized)) return true;
-	if ([
-		"0",
-		"false",
-		"no",
-		"off"
-	].includes(normalized)) return false;
-}
-function readExecSecurity(value) {
-	return value === "deny" || value === "allowlist" || value === "full" ? value : void 0;
-}
-function readExecAsk(value) {
-	return value === "off" || value === "on-miss" || value === "always" ? value : void 0;
+	return codexConfigEnablesNativeComputerUse({
+		agentDir: params.agentDir,
+		codexConfigToml: params.codexConfigToml,
+		env: params.env,
+		homeScope: "agent",
+		pluginNames: startOptions.managedComputerUsePluginNames ?? ["computer-use"]
+	}) ? {
+		...startOptions,
+		managedCommandOrder: "desktop-first"
+	} : startOptions;
 }
-function readNumberEnv(value) {
-	const trimmed = value?.trim();
-	if (!trimmed || !PLAIN_DECIMAL_NUMBER_RE.test(trimmed)) return;
-	const parsed = Number(trimmed);
-	return Number.isFinite(parsed) ? parsed : void 0;
+function resolveCodexComputerUseConfig(params = {}) {
+	const env = params.env ?? process.env;
+	const config = readCodexPluginConfig(params.pluginConfig).computerUse ?? {};
+	const marketplaceSource = readNonEmptyString(params.overrides?.marketplaceSource) ?? readNonEmptyString(config.marketplaceSource) ?? readNonEmptyString(env.OPENCLAW_CODEX_COMPUTER_USE_MARKETPLACE_SOURCE);
+	const marketplacePath = readNonEmptyString(params.overrides?.marketplacePath) ?? readNonEmptyString(config.marketplacePath) ?? readNonEmptyString(env.OPENCLAW_CODEX_COMPUTER_USE_MARKETPLACE_PATH);
+	const marketplaceName = readNonEmptyString(params.overrides?.marketplaceName) ?? readNonEmptyString(config.marketplaceName) ?? readNonEmptyString(env.OPENCLAW_CODEX_COMPUTER_USE_MARKETPLACE_NAME);
+	const configuredPluginName = readNonEmptyString(params.overrides?.pluginName) ?? readNonEmptyString(config.pluginName) ?? readNonEmptyString(env.OPENCLAW_CODEX_COMPUTER_USE_PLUGIN_NAME);
+	const configuredMcpServerName = readNonEmptyString(params.overrides?.mcpServerName) ?? readNonEmptyString(config.mcpServerName) ?? readNonEmptyString(env.OPENCLAW_CODEX_COMPUTER_USE_MCP_SERVER_NAME);
+	const autoInstall = params.overrides?.autoInstall ?? config.autoInstall ?? readBooleanEnv(env.OPENCLAW_CODEX_COMPUTER_USE_AUTO_INSTALL) ?? false;
+	const marketplaceDiscoveryTimeoutMs = normalizePositiveNumber(params.overrides?.marketplaceDiscoveryTimeoutMs ?? config.marketplaceDiscoveryTimeoutMs ?? readNumberEnv(env.OPENCLAW_CODEX_COMPUTER_USE_MARKETPLACE_DISCOVERY_TIMEOUT_MS), DEFAULT_CODEX_COMPUTER_USE_MARKETPLACE_DISCOVERY_TIMEOUT_MS);
+	const liveTestTimeoutMs = normalizePositiveNumber(params.overrides?.liveTestTimeoutMs ?? config.liveTestTimeoutMs ?? readNumberEnv(env.OPENCLAW_CODEX_COMPUTER_USE_LIVE_TEST_TIMEOUT_MS), DEFAULT_CODEX_COMPUTER_USE_LIVE_TEST_TIMEOUT_MS);
+	const toolCallTimeoutMs = normalizePositiveNumber(params.overrides?.toolCallTimeoutMs ?? config.toolCallTimeoutMs ?? readNumberEnv(env.OPENCLAW_CODEX_COMPUTER_USE_TOOL_CALL_TIMEOUT_MS), DEFAULT_CODEX_COMPUTER_USE_TOOL_CALL_TIMEOUT_MS);
+	const healthCheckIntervalMinutes = normalizeComputerUseHealthCheckIntervalMinutes(params.overrides?.healthCheckIntervalMinutes ?? config.healthCheckIntervalMinutes ?? readNumberEnv(env.OPENCLAW_CODEX_COMPUTER_USE_HEALTH_CHECK_INTERVAL_MINUTES));
+	const healthCheckEnabled = params.overrides?.healthCheckEnabled ?? config.healthCheckEnabled ?? readBooleanEnv(env.OPENCLAW_CODEX_COMPUTER_USE_HEALTH_CHECK_ENABLED) ?? false;
+	const pluginCacheMode = normalizeComputerUsePluginCacheMode(params.overrides?.pluginCacheMode) ?? normalizeComputerUsePluginCacheMode(config.pluginCacheMode) ?? normalizeComputerUsePluginCacheMode(env.OPENCLAW_CODEX_COMPUTER_USE_PLUGIN_CACHE_MODE) ?? "independent";
+	const strictReadiness = params.overrides?.strictReadiness ?? config.strictReadiness ?? readBooleanEnv(env.OPENCLAW_CODEX_COMPUTER_USE_STRICT_READINESS) ?? false;
+	const autoRepair = params.overrides?.autoRepair ?? config.autoRepair ?? readBooleanEnv(env.OPENCLAW_CODEX_COMPUTER_USE_AUTO_REPAIR) ?? false;
+	return {
+		enabled: params.overrides?.enabled ?? config.enabled ?? readBooleanEnv(env.OPENCLAW_CODEX_COMPUTER_USE) ?? Boolean(autoInstall || marketplaceSource || marketplacePath || marketplaceName || configuredPluginName || configuredMcpServerName),
+		autoInstall,
+		marketplaceDiscoveryTimeoutMs,
+		liveTestTimeoutMs,
+		toolCallTimeoutMs,
+		healthCheckEnabled,
+		healthCheckIntervalMinutes,
+		pluginCacheMode,
+		strictReadiness,
+		autoRepair,
+		pluginName: configuredPluginName ?? "computer-use",
+		mcpServerName: configuredMcpServerName ?? "computer-use",
+		...marketplaceSource ? { marketplaceSource } : {},
+		...marketplacePath ? { marketplacePath } : {},
+		...marketplaceName ? { marketplaceName } : {}
+	};
 }
-function resolveArgs(configArgs, envArgs) {
-	if (Array.isArray(configArgs)) return configArgs.map((entry) => readNonEmptyString(entry)).filter((entry) => entry !== void 0);
-	if (typeof configArgs === "string") return splitShellWords(configArgs);
-	return splitShellWords(envArgs ?? "");
+function normalizeComputerUseHealthCheckIntervalMinutes(value) {
+	return value === 30 || value === 60 || value === 120 || value === 240 ? value : 60;
 }
-function readNonEmptyString(value) {
-	if (typeof value !== "string") return;
-	return value.trim() || void 0;
+function normalizeComputerUsePluginCacheMode(value) {
+	return value === "shared" || value === "independent" ? value : null;
 }
-function hashSecretForKey(value, label) {
-	if (!value) return null;
-	return createHmac("sha256", START_OPTIONS_KEY_SECRET).update(label).update("\0").update(value).digest("hex");
+function codexAppServerStartOptionsKey(options, params = {}) {
+	return JSON.stringify({
+		transport: options.transport,
+		command: options.command,
+		commandSource: options.commandSource ?? null,
+		managedCommandOrder: options.managedCommandOrder ?? "package-first",
+		managedComputerUsePluginNames: [...options.managedComputerUsePluginNames ?? []].toSorted(),
+		managedFallbackCommandPaths: [...options.managedFallbackCommandPaths ?? []],
+		args: options.args,
+		cwd: options.cwd ?? null,
+		url: options.url ?? null,
+		authToken: hashSecretForKey(options.authToken, "authToken"),
+		headers: Object.entries(options.headers).toSorted(([left], [right]) => left.localeCompare(right)).map(([key, value]) => [key, hashSecretForKey(value, `header:${key}`)]),
+		env: Object.entries(options.env ?? {}).toSorted(([left], [right]) => left.localeCompare(right)).map(([key, value]) => [key, hashSecretForKey(value, `env:${key}`)]),
+		clearEnv: [...options.clearEnv ?? []].toSorted(),
+		authProfileId: params.authProfileId ?? null,
+		authBindingFingerprint: params.authBindingFingerprint ?? null,
+		agentDir: params.agentDir ?? null,
+		fallbackApiKeyCacheKey: params.fallbackApiKeyCacheKey ?? null
+	});
 }
-function getStartOptionsKeySecret() {
-	const globalState = globalThis;
-	globalState[START_OPTIONS_KEY_SECRET_SYMBOL] ??= randomBytes(32);
-	return globalState[START_OPTIONS_KEY_SECRET_SYMBOL];
+function codexSandboxPolicyForTurn(mode, cwd, nativeArgs = []) {
+	if (mode === "danger-full-access") return { type: "dangerFullAccess" };
+	if (mode === "read-only") return {
+		type: "readOnly",
+		networkAccess: false
+	};
+	let excludeTmpdirEnvVar = false;
+	let excludeSlashTmp = false;
+	for (let index = 0; index < nativeArgs.length; index += 1) {
+		const arg = nativeArgs[index];
+		const override = arg === "-c" || arg === "--config" ? nativeArgs[++index] : arg?.startsWith("--config=") ? arg.slice(9) : void 0;
+		if (!override) continue;
+		const separator = override.indexOf("=");
+		if (separator < 0) continue;
+		const key = override.slice(0, separator).trim();
+		const value = override.slice(separator + 1).trim();
+		if (value !== "true" && value !== "false") continue;
+		if (key === "sandbox_workspace_write.exclude_tmpdir_env_var") excludeTmpdirEnvVar = value === "true";
+		else if (key === "sandbox_workspace_write.exclude_slash_tmp") excludeSlashTmp = value === "true";
+	}
+	return {
+		type: "workspaceWrite",
+		writableRoots: [cwd],
+		networkAccess: false,
+		excludeTmpdirEnvVar,
+		excludeSlashTmp
+	};
 }
-function splitShellWords(value) {
-	const words = [];
-	let current = "";
-	let quote = null;
-	for (const char of value) {
-		if (quote) {
-			if (char === quote) quote = null;
-			else current += char;
-			continue;
-		}
-		if (char === "\"" || char === "'") {
-			quote = char;
-			continue;
-		}
-		if (/\s/.test(char)) {
-			if (current) {
-				words.push(current);
-				current = "";
+/** Resolves the passive supervision control connection without changing harness defaults. */
+function resolveCodexSupervisionAppServerRuntimeOptions(params = {}) {
+	const pluginConfig = readCodexPluginConfig(params.pluginConfig);
+	const appServer = pluginConfig.appServer ?? {};
+	const transport = resolveTransport(appServer.transport);
+	const homeScope = appServer.homeScope ?? (transport === "websocket" ? "agent" : "user");
+	return resolveCodexAppServerRuntimeOptions({
+		...params,
+		pluginConfig: {
+			...pluginConfig,
+			appServer: {
+				...appServer,
+				homeScope
 			}
-			continue;
 		}
-		current += char;
-	}
-	if (current) words.push(current);
-	return words;
+	});
 }
 //#endregion
 //#region extensions/codex/src/app-server/session-binding.ts
@@ -1348,7 +1373,7 @@ const BINDING_LEASE_RENEW_INTERVAL_MS = Math.floor(BINDING_LEASE_STALE_MS / 3);
 const PHYSICAL_SESSION_RETIRE_TTL_MS = BINDING_LEASE_WAIT_MS;
 /** Resolves the same agent scope OpenClaw uses for transcript/session ownership. */
 function sessionBindingIdentity(params) {
-	const { sessionAgentId } = resolveSessionAgentIds(params);
+	const { sessionAgentId } = resolveSessionAgentIds$1(params);
 	const sessionKey = params.sessionKey?.trim();
 	return {
 		kind: "session",
@@ -1727,10 +1752,17 @@ function createCodexAppServerBindingStore(state) {
 				result: true
 			};
 			const currentSessionId = current.sessionId;
-			if (!currentSessionId || currentSessionId === identity.sessionId) return {
+			if (!currentSessionId) return {
 				kind: "resolved",
 				result: current.state !== "cleared" || current.retired !== true
 			};
+			if (currentSessionId === identity.sessionId) return current.state === "cleared" && current.retired === true ? {
+				kind: "verify",
+				expectedPreviousSessionId: currentSessionId
+			} : {
+				kind: "resolved",
+				result: true
+			};
 			return {
 				kind: "verify",
 				expectedPreviousSessionId: currentSessionId
@@ -1746,7 +1778,18 @@ function createCodexAppServerBindingStore(state) {
 					if (mutation.kind === "reclaim-generation") {
 						if (identity.kind !== "session" || !identity.sessionKey?.trim()) return { result: false };
 						if (!current) return { result: true };
-						if (ownsGeneration) return { result: current.state !== "cleared" || current.retired !== true };
+						if (ownsGeneration) {
+							if (current.state === "cleared" && current.retired === true && current.sessionId === mutation.expectedPreviousSessionId) return {
+								result: true,
+								next: {
+									version: 1,
+									state: "cleared",
+									sessionId: identity.sessionId,
+									...ownedLease
+								}
+							};
+							return { result: current.state !== "cleared" || current.retired !== true };
+						}
 						if (current.sessionId !== mutation.expectedPreviousSessionId) return { result: false };
 						if (current.state === "active" && current.binding.connectionScope === "supervision") return { result: false };
 						return {
@@ -1825,6 +1868,25 @@ function createCodexAppServerBindingStore(state) {
 				});
 			});
 		},
+		async resetSessionGeneration(identity) {
+			return await runBindingMutation(async () => {
+				const key = bindingStoreKey(identity);
+				return await transactKey(key, (current, leaseToken) => {
+					if (!current) return { result: "absent" };
+					if (!ownsStoredSessionGeneration(identity, current)) return { result: "conflict" };
+					if (current.state === "cleared" && current.retired === true) return { result: "conflict" };
+					return {
+						result: "applied",
+						next: {
+							version: 1,
+							state: "cleared",
+							...storedSessionGeneration(identity, current),
+							...current.lease && current.lease.token === leaseToken ? { lease: current.lease } : {}
+						}
+					};
+				}, leaseContext.getStore()?.has(key) ? void 0 : 1);
+			});
+		},
 		async retireSessionGeneration(identity) {
 			return await runBindingMutation(async () => {
 				const key = bindingStoreKey(identity);
@@ -1956,7 +2018,7 @@ function bindingStoreKey(identity) {
 		const sessionId = identity.sessionId.trim();
 		if (!rawAgentId) throw new Error("Codex app-server binding requires an agent id");
 		if (!sessionId) throw new Error("Codex app-server binding requires a session id");
-		const agentId = resolveSessionAgentIds({ agentId: rawAgentId }).sessionAgentId;
+		const agentId = resolveSessionAgentIds$1({ agentId: rawAgentId }).sessionAgentId;
 		const sessionKey = identity.sessionKey?.trim();
 		if (sessionKey) return `session-key:${agentId}:${createHash("sha256").update(sessionKey).digest("base64url")}`;
 		return `session:${agentId}:${sessionId}`;
@@ -2096,4 +2158,4 @@ function resolveCodexAppServerBindingModelProvider(params) {
 	return params.modelProvider?.trim() || (isCodexAppServerNativeAuthProfile(params) ? PUBLIC_OPENAI_MODEL_PROVIDER : void 0);
 }
 //#endregion
-export { withMcpElicitationsApprovalPolicy as A, resolveCodexAppServerUserHomeDir as C, resolveCodexSupervisionAppServerRuntimeOptions as D, resolveCodexPluginsPolicy as E, resolveOpenClawExecPolicyForCodexAppServer as O, resolveCodexAppServerStartOptionsForAgent as S, resolveCodexModelBackedReviewerPolicyContext as T, isCodexAppServerApprovalPolicyAllowedByRequirements as _, hashCodexAppServerBindingFingerprint as a, readCodexPluginConfig as b, reclaimCurrentCodexSessionGeneration as c, CODEX_PLUGINS_MARKETPLACE_NAME as d, CODEX_PLUGINS_WORKSPACE_MARKETPLACE_NAME as f, codexSandboxPolicyForTurn as g, codexAppServerStartOptionsKey as h, createCodexSessionGenerationSupersededError as i, shouldAutoApproveCodexAppServerApprovals as k, sessionBindingIdentity as l, canUseCodexModelBackedApprovalsReviewerForModel as m, assertCodexBindingMayBeReplaced as n, isCodexAppServerNativeAuthProfile as o, assertCodexAppServerConnectionSecurity as p, bindingStoreKey as r, normalizeCodexAppServerBindingModelProvider as s, CODEX_APP_SERVER_BINDING_GUARDED_REQUEST_TIMEOUT_MS as t, session_binding_exports as u, isCodexFastServiceTier as v, resolveCodexComputerUseConfig as w, resolveCodexAppServerRuntimeOptions as x, isCodexSandboxExecServerEnabled as y };
+export { CODEX_PLUGINS_WORKSPACE_MARKETPLACE_NAME as A, isCodexAppServerApprovalPolicyAllowedByRequirements as C, resolveOpenClawExecPolicyForCodexAppServer as D, resolveCodexPluginsPolicy as E, isCodexFastServiceTier as O, resolveCodexModelBackedReviewerPolicyContext as S, readCodexPluginConfig as T, assertCodexAppServerConnectionSecurity as _, hashCodexAppServerBindingFingerprint as a, canUseCodexModelBackedApprovalsReviewerForModel as b, reclaimCurrentCodexSessionGeneration as c, codexAppServerStartOptionsKey as d, codexSandboxPolicyForTurn as f, resolveCodexSupervisionAppServerRuntimeOptions as g, resolveCodexComputerUseConfig as h, createCodexSessionGenerationSupersededError as i, CODEX_PLUGINS_MARKETPLACE_NAME as k, sessionBindingIdentity as l, resolveCodexAppServerStartOptionsForAgent as m, assertCodexBindingMayBeReplaced as n, isCodexAppServerNativeAuthProfile as o, resolveCodexAppServerRuntimeOptions as p, bindingStoreKey as r, normalizeCodexAppServerBindingModelProvider as s, CODEX_APP_SERVER_BINDING_GUARDED_REQUEST_TIMEOUT_MS as t, session_binding_exports as u, shouldAutoApproveCodexAppServerApprovals as v, isCodexSandboxExecServerEnabled as w, resolveCodexAppServerUserHomeDir as x, withMcpElicitationsApprovalPolicy as y };