@openclaw/codex 2026.7.2-beta.4 → 2026.7.2-beta.7

package/dist/{session-binding-ZSMX1omP.js → session-binding-BXpo9ymA.js}

@@ -2,704 +2,527 @@ import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
 import { n as CODEX_APP_SERVER_BINDING_NAMESPACE, t as CODEX_APP_SERVER_BINDING_MAX_ENTRIES } from "./session-binding-meta-B7aEMU7g.js";
 import path from "node:path";
 import { resolvePositiveTimerTimeoutMs } from "openclaw/plugin-sdk/number-runtime";
+import { AgentHarnessSessionSupersededError, embeddedAgentLog } from "openclaw/plugin-sdk/agent-harness-runtime";
 import { createHash, createHmac, randomBytes, randomUUID } from "node:crypto";
+import { ensureAuthProfileStore, resolveDefaultAgentDir, resolveProviderIdForAuth, resolveSessionAgentIds as resolveSessionAgentIds$1 } from "openclaw/plugin-sdk/agent-runtime";
 import { readFileSync } from "node:fs";
 import { homedir, hostname } from "node:os";
-import { ensureAuthProfileStore, resolveDefaultAgentDir, resolveProviderIdForAuth, resolveSessionAgentIds } from "openclaw/plugin-sdk/agent-runtime";
 import { resolveExecApprovalsFromFile } from "openclaw/plugin-sdk/exec-approvals-runtime";
 import { normalizeAgentId } from "openclaw/plugin-sdk/routing";
 import { buildSecretInputSchema, normalizeResolvedSecretInputString } from "openclaw/plugin-sdk/secret-input";
 import { normalizeTrimmedStringList } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { detectWindowsSpawnCommandInlineArgs } from "openclaw/plugin-sdk/windows-spawn";
-import { parse } from "smol-toml";
 import { z } from "zod";
-import { AgentHarnessSessionSupersededError, embeddedAgentLog } from "openclaw/plugin-sdk/agent-harness-runtime";
+import { parse } from "smol-toml";
+import { isLoopbackHost } from "openclaw/plugin-sdk/ssrf-runtime";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { getSessionEntry, resolveStorePath } from "openclaw/plugin-sdk/session-store-runtime";
-//#region extensions/codex/src/app-server/session-discovery-config.ts
-const codexSessionCatalogConfigSchema = z.object({ enabled: z.boolean().optional() }).strict();
-const codexDiscoveryConfigSchema = z.object({
-	enabled: z.boolean().optional(),
-	timeoutMs: z.number().positive().optional()
-}).strict();
+//#region extensions/codex/src/app-server/config-contracts.ts
+const CODEX_PLUGINS_MARKETPLACE_NAME = "openai-curated";
+const CODEX_PLUGINS_WORKSPACE_MARKETPLACE_NAME = "workspace-directory";
 //#endregion
-//#region extensions/codex/src/app-server/config.ts
+//#region extensions/codex/src/app-server/config-utils.ts
 const START_OPTIONS_KEY_SECRET_SYMBOL = Symbol.for("openclaw.codexAppServerStartOptionsKeySecret");
 const START_OPTIONS_KEY_SECRET = getStartOptionsKeySecret();
-const UNIX_CODEX_REQUIREMENTS_PATH = "/etc/codex/requirements.toml";
-const WINDOWS_CODEX_REQUIREMENTS_SUFFIX = "\\OpenAI\\Codex\\requirements.toml";
-const CODEX_APP_SERVER_HOME_DIRNAME = "codex-home";
-const CODEX_CONFIG_TOML_FILENAME = "config.toml";
 const PLAIN_DECIMAL_NUMBER_RE = /^[+-]?(?:(?:\d+\.?\d*)|(?:\.\d+))$/;
-const CODEX_PLUGINS_MARKETPLACE_NAME = "openai-curated";
-const CODEX_PLUGINS_WORKSPACE_MARKETPLACE_NAME = "workspace-directory";
-function shouldAutoApproveCodexAppServerApprovals(appServer) {
-	return appServer.networkProxy === void 0 && appServer.approvalPolicy === "never" && appServer.sandbox === "danger-full-access";
+function readRecord(value) {
+	return value && typeof value === "object" && !Array.isArray(value) ? value : void 0;
 }
-const DEFAULT_CODEX_COMPUTER_USE_PLUGIN_NAME = "computer-use";
-const DEFAULT_CODEX_COMPUTER_USE_MCP_SERVER_NAME = "computer-use";
-const DEFAULT_CODEX_COMPUTER_USE_MARKETPLACE_DISCOVERY_TIMEOUT_MS = 6e4;
-const DEFAULT_CODEX_COMPUTER_USE_LIVE_TEST_TIMEOUT_MS = 6e4;
-const DEFAULT_CODEX_COMPUTER_USE_TOOL_CALL_TIMEOUT_MS = 6e4;
-const DEFAULT_CODEX_COMPUTER_USE_HEALTH_CHECK_INTERVAL_MINUTES = 60;
-const DEFAULT_CODEX_APP_SERVER_NETWORK_PROXY_PROFILE_PREFIX = "openclaw-network";
-const codexAppServerTransportSchema = z.enum([
-	"stdio",
-	"websocket",
-	"unix"
-]);
-const codexAppServerHomeScopeSchema = z.enum(["agent", "user"]);
-const SecretInputSchema = buildSecretInputSchema();
-const codexAppServerPolicyModeSchema = z.enum(["yolo", "guardian"]);
-const codexAppServerApprovalPolicySchema = z.preprocess((value) => value === "on-failure" ? "on-request" : value, z.enum([
-	"never",
-	"on-request",
-	"untrusted"
-]));
-const codexAppServerSandboxSchema = z.enum([
-	"read-only",
-	"workspace-write",
-	"danger-full-access"
-]);
-const codexAppServerApprovalsReviewerSchema = z.enum([
-	"user",
-	"auto_review",
-	"guardian_subagent"
-]);
-const codexDynamicToolsLoadingSchema = z.enum(["searchable", "direct"]);
-const codexComputerUseHealthIntervalSchema = z.union([
-	z.literal(30),
-	z.literal(60),
-	z.literal(120),
-	z.literal(240)
-]);
-const codexComputerUsePluginCacheModeSchema = z.enum(["shared", "independent"]);
-const codexPluginDestructivePolicySchema = z.union([
-	z.boolean(),
-	z.literal("auto"),
-	z.literal("ask")
-]);
-const codexAppServerServiceTierSchema = z.preprocess((value) => value === null ? null : normalizeCodexServiceTier(value), z.string().trim().min(1).nullable().optional()).optional();
-const codexAppServerExperimentalSchema = z.object({ sandboxExecServer: z.boolean().optional() }).strict();
-const codexAppServerRemoteWorkspaceRootSchema = z.string().trim().min(1);
-const codexAppServerNetworkProxyDomainPermissionSchema = z.enum(["allow", "deny"]);
-const codexAppServerNetworkProxyUnixSocketPermissionSchema = z.enum(["allow", "none"]);
-const codexAppServerNetworkProxySchema = z.object({
-	enabled: z.boolean().optional(),
-	profileName: z.string().trim().min(1).optional(),
-	baseProfile: z.enum(["read-only", "workspace"]).optional(),
-	mode: z.enum(["limited", "full"]).optional(),
-	domains: z.record(z.string(), codexAppServerNetworkProxyDomainPermissionSchema).optional(),
-	unixSockets: z.record(z.string(), codexAppServerNetworkProxyUnixSocketPermissionSchema).optional(),
-	proxyUrl: z.string().trim().min(1).optional(),
-	socksUrl: z.string().trim().min(1).optional(),
-	enableSocks5: z.boolean().optional(),
-	enableSocks5Udp: z.boolean().optional(),
-	allowUpstreamProxy: z.boolean().optional(),
-	allowLocalBinding: z.boolean().optional(),
-	dangerouslyAllowNonLoopbackProxy: z.boolean().optional(),
-	dangerouslyAllowAllUnixSockets: z.boolean().optional()
-}).strict();
-const codexPluginEntryConfigSchema = z.object({
-	enabled: z.boolean().optional(),
-	marketplaceName: z.enum([CODEX_PLUGINS_MARKETPLACE_NAME, CODEX_PLUGINS_WORKSPACE_MARKETPLACE_NAME]).optional(),
-	pluginName: z.string().trim().min(1).optional(),
-	allow_destructive_actions: codexPluginDestructivePolicySchema.optional()
-}).strict();
-const codexPluginsConfigSchema = z.object({
-	enabled: z.boolean().optional(),
-	allow_all_plugins: z.boolean().optional(),
-	allow_destructive_actions: codexPluginDestructivePolicySchema.optional(),
-	plugins: z.record(z.string(), codexPluginEntryConfigSchema).optional()
-}).strict();
-const codexSupervisionEndpointSchema = z.union([z.object({
-	id: z.string().optional(),
-	label: z.string().optional(),
-	transport: z.literal("stdio-proxy").optional(),
-	command: z.string().optional(),
-	args: z.array(z.string()).optional(),
-	cwd: z.string().optional()
-}).strict(), z.object({
-	id: z.string().optional(),
-	label: z.string().optional(),
-	transport: z.literal("websocket"),
-	url: z.string(),
-	authTokenEnv: z.string().optional()
-}).strict()]);
-const codexSupervisionConfigSchema = z.object({
-	enabled: z.boolean().optional(),
-	endpoints: z.array(codexSupervisionEndpointSchema).optional(),
-	allowRawTranscripts: z.boolean().optional(),
-	allowWriteControls: z.boolean().optional()
-}).strict();
-const codexPluginConfigSchema = z.object({
-	codexDynamicToolsLoading: codexDynamicToolsLoadingSchema.optional(),
-	codexDynamicToolsExclude: z.array(z.string()).optional(),
-	sessionCatalog: codexSessionCatalogConfigSchema.optional(),
-	discovery: codexDiscoveryConfigSchema.optional(),
-	computerUse: z.object({
-		enabled: z.boolean().optional(),
-		autoInstall: z.boolean().optional(),
-		marketplaceDiscoveryTimeoutMs: z.number().positive().optional(),
-		liveTestTimeoutMs: z.number().positive().optional(),
-		toolCallTimeoutMs: z.number().positive().optional(),
-		healthCheckEnabled: z.boolean().optional(),
-		healthCheckIntervalMinutes: codexComputerUseHealthIntervalSchema.optional(),
-		pluginCacheMode: codexComputerUsePluginCacheModeSchema.optional(),
-		strictReadiness: z.boolean().optional(),
-		autoRepair: z.boolean().optional(),
-		marketplaceSource: z.string().optional(),
-		marketplacePath: z.string().optional(),
-		marketplaceName: z.string().optional(),
-		pluginName: z.string().optional(),
-		mcpServerName: z.string().optional()
-	}).strict().optional(),
-	codexPlugins: z.unknown().optional(),
-	supervision: codexSupervisionConfigSchema.optional(),
-	appServer: z.object({
-		mode: codexAppServerPolicyModeSchema.optional(),
-		transport: codexAppServerTransportSchema.optional(),
-		homeScope: codexAppServerHomeScopeSchema.optional(),
-		command: z.string().optional(),
-		args: z.union([z.array(z.string()), z.string()]).optional(),
-		url: z.string().optional(),
-		authToken: SecretInputSchema.optional(),
-		headers: z.record(z.string(), SecretInputSchema).optional(),
-		clearEnv: z.array(z.string()).optional(),
-		remoteWorkspaceRoot: codexAppServerRemoteWorkspaceRootSchema.optional(),
-		codeModeOnly: z.boolean().optional(),
-		loopDetectionPreToolUseRelay: z.boolean().optional(),
-		requestTimeoutMs: z.number().positive().optional(),
-		turnCompletionIdleTimeoutMs: z.number().positive().optional(),
-		turnAssistantCompletionIdleTimeoutMs: z.number().positive().optional(),
-		postToolRawAssistantCompletionIdleTimeoutMs: z.number().positive().optional(),
-		approvalPolicy: codexAppServerApprovalPolicySchema.optional(),
-		sandbox: codexAppServerSandboxSchema.optional(),
-		approvalsReviewer: codexAppServerApprovalsReviewerSchema.optional(),
-		serviceTier: codexAppServerServiceTierSchema,
-		networkProxy: codexAppServerNetworkProxySchema.optional(),
-		defaultWorkspaceDir: z.string().optional(),
-		experimental: codexAppServerExperimentalSchema.optional()
-	}).strict().optional()
-}).strict();
-function readCodexPluginConfig(value) {
-	const parsed = codexPluginConfigSchema.safeParse(value);
-	if (!parsed.success) return {};
-	const { codexPlugins: rawCodexPlugins, ...config } = parsed.data;
-	const plugins = codexPluginsConfigSchema.safeParse(rawCodexPlugins);
-	if (!plugins.success) return config;
-	return {
-		...config,
-		...plugins.data ? { codexPlugins: plugins.data } : {}
-	};
+function normalizeCodexServiceTier(value) {
+	if (typeof value !== "string") return;
+	const trimmed = value.trim();
+	if (!trimmed) return;
+	const normalized = trimmed.toLowerCase();
+	if (normalized === "fast" || normalized === "priority") return "priority";
+	if (normalized === "flex") return "flex";
+	return trimmed;
 }
-function isCodexSandboxExecServerEnabled(pluginConfig) {
-	return readCodexPluginConfig(pluginConfig).appServer?.experimental?.sandboxExecServer === true;
+function isCodexFastServiceTier(value) {
+	return normalizeCodexServiceTier(value) === "priority";
 }
-function assertCodexAppServerCommandHasNoInlineArgs(params) {
-	const inlineArgs = detectWindowsSpawnCommandInlineArgs(params.command);
-	if (!inlineArgs) return;
-	const sourceLabel = params.source === "env" ? "OPENCLAW_CODEX_APP_SERVER_BIN" : "plugins.entries.codex.config.appServer.command";
-	const argsLabel = params.source === "env" ? "OPENCLAW_CODEX_APP_SERVER_ARGS" : "plugins.entries.codex.config.appServer.args";
-	throw new Error(`${sourceLabel} must be only the Codex app-server executable path; "${inlineArgs.executable}" was configured with inline arguments "${inlineArgs.arguments}". Move those arguments to ${argsLabel}, or remove the override to use the managed Codex startup path.`);
+function normalizePositiveNumber(value, fallback) {
+	return resolvePositiveTimerTimeoutMs(value, fallback);
 }
-function resolveCodexPluginsPolicy(pluginConfig) {
-	const config = readCodexPluginConfig(pluginConfig).codexPlugins;
-	const configured = config !== void 0;
-	const enabled = config?.enabled === true;
-	const destructivePolicy = resolveCodexPluginDestructivePolicy(config?.allow_destructive_actions ?? true);
-	const pluginPolicies = Object.entries(config?.plugins ?? {}).flatMap(([configKey, entry]) => {
-		if (!isCodexPluginMarketplaceName(entry.marketplaceName) || !entry.pluginName) return [];
-		const entryDestructivePolicy = resolveCodexPluginDestructivePolicy(entry.allow_destructive_actions ?? config?.allow_destructive_actions ?? true);
-		return [{
-			configKey,
-			marketplaceName: entry.marketplaceName,
-			pluginName: entry.pluginName,
-			enabled: enabled && entry.enabled !== false,
-			allowDestructiveActions: entryDestructivePolicy.allowDestructiveActions,
-			destructiveApprovalMode: entryDestructivePolicy.destructiveApprovalMode
-		}];
-	}).toSorted((left, right) => left.configKey.localeCompare(right.configKey));
-	return {
-		configured,
-		enabled,
-		allowAllPlugins: enabled && config?.allow_all_plugins === true,
-		allowDestructiveActions: destructivePolicy.allowDestructiveActions,
-		destructiveApprovalMode: destructivePolicy.destructiveApprovalMode,
-		pluginPolicies
-	};
+function normalizeHeaders(value) {
+	if (!value || typeof value !== "object" || Array.isArray(value)) return {};
+	return Object.fromEntries(Object.entries(value).map(([key, child]) => [key.trim(), normalizeCodexAppServerSecretInput({
+		value: child,
+		path: `plugins.entries.codex.config.appServer.headers.${key}`
+	})]).filter((entry) => Boolean(entry[0] && entry[1])));
 }
-function isCodexPluginMarketplaceName(value) {
-	return value === "openai-curated" || value === "workspace-directory";
+function normalizeCodexAppServerSecretInput(params) {
+	return normalizeResolvedSecretInputString(params);
 }
-function resolveCodexPluginDestructivePolicy(policy) {
-	if (policy === "auto" || policy === "ask") return {
-		allowDestructiveActions: true,
-		destructiveApprovalMode: policy
-	};
-	return {
-		allowDestructiveActions: policy,
-		destructiveApprovalMode: policy ? "allow" : "deny"
-	};
+function normalizeStringList(value) {
+	return normalizeTrimmedStringList(value);
 }
-function resolveCodexAppServerRuntimeOptions(params = {}) {
-	const env = params.env ?? process.env;
-	const config = readCodexPluginConfig(params.pluginConfig).appServer ?? {};
-	const transport = resolveTransport(config.transport);
-	const homeScope = config.homeScope ?? "agent";
-	const configCommand = readNonEmptyString(config.command);
-	const envCommand = readNonEmptyString(env.OPENCLAW_CODEX_APP_SERVER_BIN);
-	const command = configCommand ?? envCommand ?? "codex";
-	const commandSource = configCommand ? "config" : envCommand ? "env" : "managed";
-	if (commandSource === "config" || commandSource === "env") assertCodexAppServerCommandHasNoInlineArgs({
-		command,
-		source: commandSource
-	});
-	const args = resolveArgs(config.args, env.OPENCLAW_CODEX_APP_SERVER_ARGS);
-	const headers = normalizeHeaders(config.headers);
-	const clearEnv = normalizeStringList(config.clearEnv);
-	const authToken = normalizeCodexAppServerSecretInput({
-		value: config.authToken,
-		path: "plugins.entries.codex.config.appServer.authToken"
-	});
-	const url = readNonEmptyString(config.url) ?? (transport === "unix" ? "unix://" : void 0);
-	const connectionClass = inferCodexAppServerConnectionClass({
-		transport,
-		url
-	});
-	const remoteAppsSubstrate = "preconfigured";
-	const remoteWorkspaceRoot = normalizeRemoteWorkspaceRoot(config.remoteWorkspaceRoot);
-	const execMode = resolveEffectiveOpenClawExecModeForCodexAppServer({
-		execMode: params.execMode,
-		execPolicy: params.execPolicy
-	});
-	assertCodexAppServerAllowedForOpenClawExecMode(execMode);
-	const explicitPolicyMode = resolvePolicyMode(config.mode) ?? resolvePolicyMode(env.OPENCLAW_CODEX_APP_SERVER_MODE);
-	const configuredSandbox = resolveSandbox(config.sandbox) ?? resolveSandbox(env.OPENCLAW_CODEX_APP_SERVER_SANDBOX);
-	const explicitApprovalsReviewer = resolveApprovalsReviewer(config.approvalsReviewer);
-	const normalizedPolicyMode = resolveCodexPolicyModeForOpenClawExecMode(execMode);
-	const ignoreLegacyYoloPolicyMode = normalizedPolicyMode === "guardian" && explicitPolicyMode === "yolo";
-	const canUseModelBackedReviewer = canUseCodexModelBackedApprovalsReviewerForModel({
-		modelProvider: params.modelProvider,
-		model: params.model,
-		config: params.config,
-		env,
-		agentDir: params.agentDir,
-		codexConfigToml: params.codexConfigToml,
-		homeScope
-	});
-	const forceUserReviewer = !canUseModelBackedReviewer && (explicitApprovalsReviewer === "auto_review" || explicitApprovalsReviewer === "guardian_subagent" || explicitPolicyMode === "guardian" && explicitApprovalsReviewer !== "user") || execMode !== void 0 && execMode !== "full" && (execMode !== "auto" || !canUseModelBackedReviewer);
-	const forceGuardianReviewer = execMode === "auto" && canUseModelBackedReviewer;
-	const execModeRequiringPromptingApprovals = execMode === "auto" || execMode === "ask" ? execMode : forceUserReviewer ? "ask" : void 0;
-	const forceDangerFullAccessSandbox = params.execPolicy?.touched === true && params.execPolicy.security === "full" && params.execPolicy.ask === "always";
-	const forceRuntimePolicy = forceUserReviewer || forceGuardianReviewer || forceDangerFullAccessSandbox;
-	const defaultPolicy = explicitPolicyMode && !forceRuntimePolicy && !ignoreLegacyYoloPolicyMode ? void 0 : resolveDefaultCodexAppServerPolicy({
-		transport,
-		env,
-		forceGuardian: normalizedPolicyMode === "guardian",
-		forceUserReviewer: forceUserReviewer || !canUseModelBackedReviewer,
-		execModeRequiringPromptingApprovals,
-		requirementsToml: params.requirementsToml,
-		requirementsPath: params.requirementsPath,
-		readRequirementsFile: params.readRequirementsFile,
-		platform: params.platform,
-		hostName: params.hostName,
-		execModeRequiringUserReviewer: forceUserReviewer ? execMode : void 0
-	});
-	const preserveExplicitAutoSandbox = forceGuardianReviewer && configuredSandbox === "read-only";
-	const forcedPolicy = forceRuntimePolicy ? {
-		approvalPolicy: defaultPolicy?.approvalPolicy ?? "on-request",
-		sandbox: preserveExplicitAutoSandbox ? void 0 : forceDangerFullAccessSandbox ? selectForcedDangerFullAccessSandbox({
-			configuredSandbox,
-			defaultPolicy,
-			openClawSandboxActive: Boolean(params.openClawSandboxActive)
-		}) : selectForcedPromptingSandbox({
-			configuredSandbox,
-			defaultSandbox: defaultPolicy?.sandbox
-		}),
-		approvalsReviewer: defaultPolicy?.approvalsReviewer ?? (forceUserReviewer ? "user" : "auto_review")
-	} : void 0;
-	const policyMode = ignoreLegacyYoloPolicyMode ? normalizedPolicyMode : explicitPolicyMode ?? normalizedPolicyMode ?? defaultPolicy?.mode ?? "yolo";
-	const serviceTier = normalizeCodexServiceTier(config.serviceTier);
-	const resolvedSandbox = forcedPolicy?.sandbox ?? configuredSandbox ?? defaultPolicy?.sandbox ?? (policyMode === "guardian" ? "workspace-write" : "danger-full-access");
-	if (transport === "websocket" && !url) throw new Error("plugins.entries.codex.config.appServer.url is required when appServer.transport is websocket");
-	if (transport === "websocket" && homeScope === "user") throw new Error("plugins.entries.codex.config.appServer.homeScope=user requires appServer.transport=stdio or unix");
-	if (transport === "unix" && homeScope !== "user") throw new Error("plugins.entries.codex.config.appServer.transport=unix requires appServer.homeScope=user");
-	if (transport === "unix" && !url?.startsWith("unix://")) throw new Error("plugins.entries.codex.config.appServer.url must use unix:// when appServer.transport is unix");
-	assertCodexAppServerConnectionSecurity({
-		transport,
-		url,
-		authToken,
-		headers
-	});
-	const configApprovalPolicy = resolveApprovalPolicy(config.approvalPolicy);
-	const envApprovalPolicy = resolveApprovalPolicy(env.OPENCLAW_CODEX_APP_SERVER_APPROVAL_POLICY);
-	const approvalPolicy = configApprovalPolicy ?? envApprovalPolicy ?? defaultPolicy?.approvalPolicy ?? (policyMode === "guardian" ? "on-request" : "never");
-	const approvalPolicySource = configApprovalPolicy ? "config" : envApprovalPolicy ? "env" : defaultPolicy?.approvalPolicy ? "requirements" : "implicit";
-	const computerUseConfig = resolveCodexComputerUseConfig({
-		pluginConfig: params.pluginConfig,
-		env
-	});
-	const managedCommandOrder = params.managedCommandOrder ?? (homeScope === "user" || computerUseConfig.enabled ? "desktop-first" : "package-first");
-	const includeManagedCommandOrder = commandSource === "managed" && (managedCommandOrder === "desktop-first" || params.managedCommandOrder === "package-first");
-	const managedComputerUsePluginNames = [.../* @__PURE__ */ new Set([DEFAULT_CODEX_COMPUTER_USE_PLUGIN_NAME, computerUseConfig.pluginName])];
-	return {
-		start: {
-			transport,
-			homeScope,
-			command,
-			commandSource,
-			...includeManagedCommandOrder ? { managedCommandOrder } : {},
-			...commandSource === "managed" ? { managedComputerUsePluginNames } : {},
-			args: args.length > 0 ? args : [
-				"app-server",
-				"--listen",
-				"stdio://"
-			],
-			...url ? { url } : {},
-			...authToken ? { authToken } : {},
-			headers,
-			...transport === "stdio" && clearEnv.length > 0 ? { clearEnv } : {}
-		},
-		connectionClass,
-		remoteAppsSubstrate,
-		...remoteWorkspaceRoot ? { remoteWorkspaceRoot } : {},
-		codeModeOnly: config.codeModeOnly === true,
-		loopDetectionPreToolUseRelay: config.loopDetectionPreToolUseRelay !== false,
-		requestTimeoutMs: normalizePositiveNumber(config.requestTimeoutMs, 6e4),
-		turnCompletionIdleTimeoutMs: normalizePositiveNumber(config.turnCompletionIdleTimeoutMs, 6e4),
-		turnAssistantCompletionIdleTimeoutMs: normalizePositiveNumber(config.turnAssistantCompletionIdleTimeoutMs, 1e4),
-		...config.postToolRawAssistantCompletionIdleTimeoutMs !== void 0 ? { postToolRawAssistantCompletionIdleTimeoutMs: normalizePositiveNumber(config.postToolRawAssistantCompletionIdleTimeoutMs, 6e4) } : {},
-		approvalPolicy: forcedPolicy?.approvalPolicy ?? approvalPolicy,
-		approvalPolicySource,
-		sandbox: resolvedSandbox,
-		approvalsReviewer: forcedPolicy?.approvalsReviewer ?? explicitApprovalsReviewer ?? defaultPolicy?.approvalsReviewer ?? (policyMode === "guardian" ? "auto_review" : "user"),
-		...serviceTier ? { serviceTier } : {},
-		...resolveCodexAppServerNetworkProxy(config.networkProxy, resolvedSandbox)
-	};
+function readBooleanEnv(value) {
+	if (value === void 0) return;
+	const normalized = value.trim().toLowerCase();
+	if ([
+		"1",
+		"true",
+		"yes",
+		"on"
+	].includes(normalized)) return true;
+	if ([
+		"0",
+		"false",
+		"no",
+		"off"
+	].includes(normalized)) return false;
 }
-/**
-* Rechecks Codex-owned plugin state at the final spawn boundary, where the
-* effective agent home is known, so Computer Use keeps the desktop app's TCC ownership.
-*/
-function resolveCodexAppServerStartOptionsForAgent(params) {
-	const startOptions = params.startOptions;
-	if (startOptions.transport !== "stdio" || startOptions.commandSource !== "managed" || startOptions.managedCommandOrder !== void 0) return startOptions;
-	if (startOptions.homeScope === "user") return {
-		...startOptions,
-		managedCommandOrder: "desktop-first"
-	};
-	return codexConfigEnablesNativeComputerUse({
-		agentDir: params.agentDir,
-		codexConfigToml: params.codexConfigToml,
-		env: params.env,
-		homeScope: "agent",
-		pluginNames: startOptions.managedComputerUsePluginNames ?? [DEFAULT_CODEX_COMPUTER_USE_PLUGIN_NAME]
-	}) ? {
-		...startOptions,
-		managedCommandOrder: "desktop-first"
-	} : startOptions;
+function readExecSecurity(value) {
+	return value === "deny" || value === "allowlist" || value === "full" ? value : void 0;
 }
-function isCodexAppServerApprovalPolicyAllowedByRequirements(policy, params = {}) {
-	const content = readCodexRequirementsToml(params);
-	if (content === void 0) return true;
-	const allowedApprovalPolicies = parseAllowedApprovalPoliciesFromCodexRequirements(content);
-	return allowedApprovalPolicies === void 0 || allowedApprovalPolicies.has(policy);
+function readExecAsk(value) {
+	return value === "off" || value === "on-miss" || value === "always" ? value : void 0;
 }
-function canUseCodexModelBackedApprovalsReviewerForModel(params) {
-	const explicitProvider = params.modelProvider?.trim().toLowerCase();
-	const inferredProvider = inferProviderFromModelRef(params.model);
-	if (explicitProvider && explicitProvider !== "codex") return isTrustedCodexModelBackedApprovalsReviewerProvider(explicitProvider, params) && (inferredProvider === void 0 || isTrustedCodexModelBackedApprovalsReviewerProvider(inferredProvider, params));
-	if (inferredProvider !== void 0) return isTrustedCodexModelBackedApprovalsReviewerProvider(inferredProvider, params);
-	return isTrustedCodexModelBackedApprovalsReviewerProvider(explicitProvider, params);
+function readNumberEnv(value) {
+	const trimmed = value?.trim();
+	if (!trimmed || !PLAIN_DECIMAL_NUMBER_RE.test(trimmed)) return;
+	const parsed = Number(trimmed);
+	return Number.isFinite(parsed) ? parsed : void 0;
 }
-function isTrustedCodexModelBackedOpenAIProvider(params) {
-	if (!openAIBaseUrlEnvOverridesAreTrustedForModelBackedReview(params.env)) return false;
-	const codexBaseUrlOverrides = readCodexBaseUrlOverridesForModelBackedReview(params);
-	if (codexBaseUrlOverrides === false || !codexBaseUrlOverrides.openAI.every(isNativeOpenAIBaseUrl) || !codexBaseUrlOverrides.chatGPT.every(isNativeChatGPTBaseUrl)) return false;
-	const openAIProviders = readConfiguredOpenAIProvidersForModelBackedReview(params.config);
-	if (openAIProviders.length === 0) return true;
-	return openAIProviders.every((openAIProvider) => configuredOpenAIProviderIsTrustedForModelBackedReview(openAIProvider, params.model));
+function resolveArgs(configArgs, envArgs) {
+	if (Array.isArray(configArgs)) return configArgs.map((entry) => readNonEmptyString(entry)).filter((entry) => entry !== void 0);
+	if (typeof configArgs === "string") return splitShellWords(configArgs);
+	return splitShellWords(envArgs ?? "");
 }
-function resolveCodexModelBackedReviewerPolicyContext(params) {
-	const provider = params.provider?.trim();
-	if (provider && provider.toLowerCase() !== "codex") return {
-		modelProvider: normalizeCodexModelBackedReviewerPolicyProvider(provider),
-		model: params.model
-	};
-	const bindingModelProvider = params.bindingModelProvider?.trim();
-	const currentModel = params.model?.trim();
-	const bindingModel = params.bindingModel?.trim();
-	if (bindingModelProvider && currentModel && bindingModel && currentModel === bindingModel) return {
-		modelProvider: normalizeCodexModelBackedReviewerPolicyProvider(bindingModelProvider),
-		model: params.model ?? params.bindingModel
-	};
-	const currentModelProvider = inferProviderFromModelRef(params.model);
-	if (currentModelProvider) return {
-		modelProvider: normalizeCodexModelBackedReviewerPolicyProvider(currentModelProvider),
-		model: params.model
-	};
-	if (bindingModelProvider) return {
-		modelProvider: normalizeCodexModelBackedReviewerPolicyProvider(bindingModelProvider),
-		model: params.model ?? params.bindingModel
-	};
-	return {
-		modelProvider: params.nativeAuthProfile === true ? "openai" : void 0,
-		model: params.model ?? params.bindingModel
-	};
+function readNonEmptyString(value) {
+	if (typeof value !== "string") return;
+	return value.trim() || void 0;
 }
-function resolveCodexComputerUseConfig(params = {}) {
-	const env = params.env ?? process.env;
-	const config = readCodexPluginConfig(params.pluginConfig).computerUse ?? {};
-	const marketplaceSource = readNonEmptyString(params.overrides?.marketplaceSource) ?? readNonEmptyString(config.marketplaceSource) ?? readNonEmptyString(env.OPENCLAW_CODEX_COMPUTER_USE_MARKETPLACE_SOURCE);
-	const marketplacePath = readNonEmptyString(params.overrides?.marketplacePath) ?? readNonEmptyString(config.marketplacePath) ?? readNonEmptyString(env.OPENCLAW_CODEX_COMPUTER_USE_MARKETPLACE_PATH);
-	const marketplaceName = readNonEmptyString(params.overrides?.marketplaceName) ?? readNonEmptyString(config.marketplaceName) ?? readNonEmptyString(env.OPENCLAW_CODEX_COMPUTER_USE_MARKETPLACE_NAME);
-	const configuredPluginName = readNonEmptyString(params.overrides?.pluginName) ?? readNonEmptyString(config.pluginName) ?? readNonEmptyString(env.OPENCLAW_CODEX_COMPUTER_USE_PLUGIN_NAME);
-	const configuredMcpServerName = readNonEmptyString(params.overrides?.mcpServerName) ?? readNonEmptyString(config.mcpServerName) ?? readNonEmptyString(env.OPENCLAW_CODEX_COMPUTER_USE_MCP_SERVER_NAME);
-	const autoInstall = params.overrides?.autoInstall ?? config.autoInstall ?? readBooleanEnv(env.OPENCLAW_CODEX_COMPUTER_USE_AUTO_INSTALL) ?? false;
-	const marketplaceDiscoveryTimeoutMs = normalizePositiveNumber(params.overrides?.marketplaceDiscoveryTimeoutMs ?? config.marketplaceDiscoveryTimeoutMs ?? readNumberEnv(env.OPENCLAW_CODEX_COMPUTER_USE_MARKETPLACE_DISCOVERY_TIMEOUT_MS), DEFAULT_CODEX_COMPUTER_USE_MARKETPLACE_DISCOVERY_TIMEOUT_MS);
-	const liveTestTimeoutMs = normalizePositiveNumber(params.overrides?.liveTestTimeoutMs ?? config.liveTestTimeoutMs ?? readNumberEnv(env.OPENCLAW_CODEX_COMPUTER_USE_LIVE_TEST_TIMEOUT_MS), DEFAULT_CODEX_COMPUTER_USE_LIVE_TEST_TIMEOUT_MS);
-	const toolCallTimeoutMs = normalizePositiveNumber(params.overrides?.toolCallTimeoutMs ?? config.toolCallTimeoutMs ?? readNumberEnv(env.OPENCLAW_CODEX_COMPUTER_USE_TOOL_CALL_TIMEOUT_MS), DEFAULT_CODEX_COMPUTER_USE_TOOL_CALL_TIMEOUT_MS);
-	const healthCheckIntervalMinutes = normalizeComputerUseHealthCheckIntervalMinutes(params.overrides?.healthCheckIntervalMinutes ?? config.healthCheckIntervalMinutes ?? readNumberEnv(env.OPENCLAW_CODEX_COMPUTER_USE_HEALTH_CHECK_INTERVAL_MINUTES));
-	const healthCheckEnabled = params.overrides?.healthCheckEnabled ?? config.healthCheckEnabled ?? readBooleanEnv(env.OPENCLAW_CODEX_COMPUTER_USE_HEALTH_CHECK_ENABLED) ?? false;
-	const pluginCacheMode = normalizeComputerUsePluginCacheMode(params.overrides?.pluginCacheMode) ?? normalizeComputerUsePluginCacheMode(config.pluginCacheMode) ?? normalizeComputerUsePluginCacheMode(env.OPENCLAW_CODEX_COMPUTER_USE_PLUGIN_CACHE_MODE) ?? "independent";
-	const strictReadiness = params.overrides?.strictReadiness ?? config.strictReadiness ?? readBooleanEnv(env.OPENCLAW_CODEX_COMPUTER_USE_STRICT_READINESS) ?? false;
-	const autoRepair = params.overrides?.autoRepair ?? config.autoRepair ?? readBooleanEnv(env.OPENCLAW_CODEX_COMPUTER_USE_AUTO_REPAIR) ?? false;
-	return {
-		enabled: params.overrides?.enabled ?? config.enabled ?? readBooleanEnv(env.OPENCLAW_CODEX_COMPUTER_USE) ?? Boolean(autoInstall || marketplaceSource || marketplacePath || marketplaceName || configuredPluginName || configuredMcpServerName),
-		autoInstall,
-		marketplaceDiscoveryTimeoutMs,
-		liveTestTimeoutMs,
-		toolCallTimeoutMs,
-		healthCheckEnabled,
-		healthCheckIntervalMinutes,
-		pluginCacheMode,
-		strictReadiness,
-		autoRepair,
-		pluginName: configuredPluginName ?? DEFAULT_CODEX_COMPUTER_USE_PLUGIN_NAME,
-		mcpServerName: configuredMcpServerName ?? DEFAULT_CODEX_COMPUTER_USE_MCP_SERVER_NAME,
-		...marketplaceSource ? { marketplaceSource } : {},
-		...marketplacePath ? { marketplacePath } : {},
-		...marketplaceName ? { marketplaceName } : {}
-	};
+function hashSecretForKey(value, label) {
+	if (!value) return null;
+	return createHmac("sha256", START_OPTIONS_KEY_SECRET).update(label).update("\0").update(value).digest("hex");
 }
-function normalizeComputerUseHealthCheckIntervalMinutes(value) {
-	return value === 30 || value === 60 || value === 120 || value === 240 ? value : DEFAULT_CODEX_COMPUTER_USE_HEALTH_CHECK_INTERVAL_MINUTES;
+function getStartOptionsKeySecret() {
+	const globalState = globalThis;
+	globalState[START_OPTIONS_KEY_SECRET_SYMBOL] ??= randomBytes(32);
+	return globalState[START_OPTIONS_KEY_SECRET_SYMBOL];
 }
-function normalizeComputerUsePluginCacheMode(value) {
-	return value === "shared" || value === "independent" ? value : null;
+function splitShellWords(value) {
+	const words = [];
+	let current = "";
+	let quote = null;
+	for (const char of value) {
+		if (quote) {
+			if (char === quote) quote = null;
+			else current += char;
+			continue;
+		}
+		if (char === "\"" || char === "'") {
+			quote = char;
+			continue;
+		}
+		if (/\s/.test(char)) {
+			if (current) {
+				words.push(current);
+				current = "";
+			}
+			continue;
+		}
+		current += char;
+	}
+	if (current) words.push(current);
+	return words;
 }
-function codexAppServerStartOptionsKey(options, params = {}) {
-	return JSON.stringify({
-		transport: options.transport,
-		command: options.command,
-		commandSource: options.commandSource ?? null,
-		managedCommandOrder: options.managedCommandOrder ?? "package-first",
-		managedComputerUsePluginNames: [...options.managedComputerUsePluginNames ?? []].toSorted(),
-		managedFallbackCommandPaths: [...options.managedFallbackCommandPaths ?? []],
-		args: options.args,
-		cwd: options.cwd ?? null,
-		url: options.url ?? null,
-		authToken: hashSecretForKey(options.authToken, "authToken"),
-		headers: Object.entries(options.headers).toSorted(([left], [right]) => left.localeCompare(right)).map(([key, value]) => [key, hashSecretForKey(value, `header:${key}`)]),
-		env: Object.entries(options.env ?? {}).toSorted(([left], [right]) => left.localeCompare(right)).map(([key, value]) => [key, hashSecretForKey(value, `env:${key}`)]),
-		clearEnv: [...options.clearEnv ?? []].toSorted(),
-		authProfileId: params.authProfileId ?? null,
-		authBindingFingerprint: params.authBindingFingerprint ?? null,
-		agentDir: params.agentDir ?? null,
-		fallbackApiKeyCacheKey: params.fallbackApiKeyCacheKey ?? null
-	});
+//#endregion
+//#region extensions/codex/src/app-server/config-exec-policy.ts
+function selectForcedPromptingSandbox(params) {
+	if (params.configuredSandbox === "read-only" || params.defaultSandbox === "read-only") return "read-only";
+	return params.defaultSandbox ?? "workspace-write";
 }
-function codexSandboxPolicyForTurn(mode, cwd) {
-	if (mode === "danger-full-access") return { type: "dangerFullAccess" };
-	if (mode === "read-only") return {
-		type: "readOnly",
-		networkAccess: false
-	};
+function selectForcedDangerFullAccessSandbox(params) {
+	if (params.configuredSandbox === "read-only") return "read-only";
+	if (params.defaultPolicy?.dangerFullAccessAllowed === false) {
+		if (params.openClawSandboxActive) return params.defaultPolicy.sandbox ?? "workspace-write";
+		throw new Error("legacy full exec security with ask requires Codex app-server danger-full-access");
+	}
+	return "danger-full-access";
+}
+function selectGuardianSandbox(allowedSandboxModes) {
+	if (allowedSandboxModes === void 0 || allowedSandboxModes.has("workspace-write")) return "workspace-write";
+	if (allowedSandboxModes.has("read-only")) return "read-only";
+	if (allowedSandboxModes.has("danger-full-access")) return "danger-full-access";
+	return "workspace-write";
+}
+function resolveApprovalPolicy(value) {
+	if (value === "on-failure") return "on-request";
+	return value === "on-request" || value === "untrusted" || value === "never" ? value : void 0;
+}
+function resolveSandbox(value) {
+	return value === "read-only" || value === "workspace-write" || value === "danger-full-access" ? value : void 0;
+}
+function resolveApprovalsReviewer(value) {
+	return value === "auto_review" || value === "guardian_subagent" || value === "user" ? value : void 0;
+}
+function resolveOpenClawExecPolicyFromConfig(params) {
+	const root = readRecord(params.config);
+	const globalExec = readRecord(readRecord(root?.tools)?.exec);
+	const globalPolicy = applyOpenClawExecPolicyLayer(createDefaultOpenClawExecPolicy(), globalExec);
+	const agentId = params.agentId?.trim();
+	if (!agentId) return globalPolicy;
+	const agents = readRecord(root?.agents);
+	const agentList = Array.isArray(agents?.list) ? agents.list : [];
+	const normalizedAgentId = normalizeAgentId(agentId);
+	return applyOpenClawExecPolicyLayer(globalPolicy, readRecord(readRecord(readRecord(agentList.find((entry) => {
+		const id = readRecord(entry)?.id;
+		return typeof id === "string" && normalizeAgentId(id) === normalizedAgentId;
+	}))?.tools)?.exec));
+}
+function resolveOpenClawExecPolicyForCodexAppServer(params) {
+	const overridePolicy = applyOpenClawExecPolicyLayer(resolveOpenClawExecPolicyFromConfig({
+		config: params.config,
+		agentId: params.agentId
+	}), params.execOverrides);
+	return applyOpenClawExecApprovalFloors(overridePolicy, resolveOpenClawExecApprovalFloorsForCodexAppServer({
+		approvals: params.approvals,
+		agentId: params.agentId,
+		policy: overridePolicy
+	}));
+}
+function resolveEffectiveOpenClawExecModeForCodexAppServer(params) {
+	if (params.execPolicy?.touched === true) return params.execPolicy.mode;
+	return params.execMode;
+}
+function resolveCodexPolicyModeForOpenClawExecMode(mode) {
+	if (!mode || mode === "full") return;
+	return "guardian";
+}
+function assertCodexAppServerAllowedForOpenClawExecMode(mode) {
+	if (mode === "deny" || mode === "allowlist") throw new Error(`Codex app-server local execution is not available when tools.exec.mode=${mode}`);
+}
+function createDefaultOpenClawExecPolicy() {
 	return {
-		type: "workspaceWrite",
-		writableRoots: [cwd],
-		networkAccess: false,
-		excludeTmpdirEnvVar: false,
-		excludeSlashTmp: false
+		security: "full",
+		ask: "off",
+		touched: false
 	};
 }
-/** Resolves the passive supervision control connection without changing harness defaults. */
-function resolveCodexSupervisionAppServerRuntimeOptions(params = {}) {
-	const pluginConfig = readCodexPluginConfig(params.pluginConfig);
-	const appServer = pluginConfig.appServer ?? {};
-	const transport = resolveTransport(appServer.transport);
-	const homeScope = appServer.homeScope ?? (transport === "websocket" ? "agent" : "user");
-	return resolveCodexAppServerRuntimeOptions({
-		...params,
-		pluginConfig: {
-			...pluginConfig,
-			appServer: {
-				...appServer,
-				homeScope
-			}
-		}
-	});
-}
-function resolveCodexAppServerNetworkProxy(config, sandbox) {
-	if (config?.enabled !== true) return {};
-	const fileSystemMode = config.baseProfile === "read-only" || !config.baseProfile && sandbox === "read-only" ? "read" : "write";
-	const networkConfig = removeUndefinedJsonFields({
-		enabled: true,
-		mode: config.mode,
-		domains: normalizeNetworkProxyPermissionMap(config.domains),
-		unix_sockets: normalizeNetworkProxyPermissionMap(config.unixSockets),
-		proxy_url: readNonEmptyString(config.proxyUrl),
-		socks_url: readNonEmptyString(config.socksUrl),
-		enable_socks5: config.enableSocks5,
-		enable_socks5_udp: config.enableSocks5Udp,
-		allow_upstream_proxy: config.allowUpstreamProxy,
-		allow_local_binding: config.allowLocalBinding,
-		dangerously_allow_non_loopback_proxy: config.dangerouslyAllowNonLoopbackProxy,
-		dangerously_allow_all_unix_sockets: config.dangerouslyAllowAllUnixSockets
-	});
-	const profile = {
-		filesystem: {
-			":minimal": "read",
-			":project_roots": { ".": fileSystemMode }
-		},
-		network: networkConfig
+function applyOpenClawExecPolicyLayer(base, exec) {
+	if (!exec) return base;
+	const mode = readExecMode(exec.mode);
+	if (mode !== void 0) return {
+		...resolveOpenClawExecPolicyForMode(mode),
+		touched: true
 	};
-	const profileName = resolveNetworkProxyPermissionProfileName(config, profile);
-	const configPatch = {
-		"features.network_proxy.enabled": true,
-		default_permissions: profileName,
-		permissions: { [profileName]: profile }
+	const security = readExecSecurity(exec.security);
+	const ask = readExecAsk(exec.ask);
+	if (security === void 0 && ask === void 0) return base;
+	const nextSecurity = security ?? base.security;
+	const nextAsk = ask ?? base.ask;
+	return {
+		mode: resolveOpenClawExecModeFromPolicy({
+			security: nextSecurity,
+			ask: nextAsk
+		}),
+		security: nextSecurity,
+		ask: nextAsk,
+		touched: true
 	};
-	return { networkProxy: {
-		profileName,
-		configFingerprint: fingerprintCodexAppServerNetworkProxyConfigPatch(configPatch),
-		configPatch
-	} };
-}
-function resolveNetworkProxyPermissionProfileName(config, profile) {
-	const explicitProfileName = readNonEmptyString(config.profileName);
-	if (explicitProfileName) return explicitProfileName;
-	const suffix = createHash("sha256").update(stableStringifyJson({
-		version: 1,
-		profile
-	})).digest("hex").slice(0, 16);
-	return `${DEFAULT_CODEX_APP_SERVER_NETWORK_PROXY_PROFILE_PREFIX}-${suffix}`;
-}
-function fingerprintCodexAppServerNetworkProxyConfigPatch(configPatch) {
-	return createHash("sha256").update(stableStringifyJson(configPatch)).digest("hex");
 }
-function normalizeNetworkProxyPermissionMap(value) {
-	const entries = Object.entries(value ?? {}).map(([key, permission]) => [key.trim(), permission]).filter(([key]) => key.length > 0);
-	return entries.length > 0 ? Object.fromEntries(entries) : void 0;
+function resolveOpenClawExecApprovalFloorsForCodexAppServer(params) {
+	if (!params.approvals) return;
+	return resolveExecApprovalsFromFile({
+		file: params.approvals,
+		agentId: params.agentId,
+		overrides: {
+			security: params.policy.security,
+			ask: params.policy.ask
+		}
+	}).agent;
 }
-function removeUndefinedJsonFields(value) {
-	return Object.fromEntries(Object.entries(value).filter((entry) => entry[1] !== void 0));
+function applyOpenClawExecApprovalFloors(base, approvalFloors) {
+	if (!approvalFloors) return base;
+	const nextSecurity = approvalFloors.security ? minOpenClawExecSecurity(base.security, approvalFloors.security) : base.security;
+	const nextAsk = approvalFloors.ask ? maxOpenClawExecAsk(base.ask, approvalFloors.ask) : base.ask;
+	if (nextSecurity === base.security && nextAsk === base.ask) return base;
+	return {
+		mode: resolveOpenClawExecModeFromPolicy({
+			security: nextSecurity,
+			ask: nextAsk
+		}),
+		security: nextSecurity,
+		ask: nextAsk,
+		touched: true
+	};
 }
-function stableStringifyJson(value) {
-	if (Array.isArray(value)) return `[${value.map((item) => stableStringifyJson(item)).join(",")}]`;
-	if (value && typeof value === "object") return `{${Object.entries(value).toSorted(([left], [right]) => left.localeCompare(right)).map(([key, item]) => `${JSON.stringify(key)}:${stableStringifyJson(item)}`).join(",")}}`;
-	return JSON.stringify(value);
+function resolveOpenClawExecPolicyForMode(mode) {
+	switch (mode) {
+		case "deny": return {
+			mode,
+			security: "deny",
+			ask: "off"
+		};
+		case "allowlist": return {
+			mode,
+			security: "allowlist",
+			ask: "off"
+		};
+		case "ask":
+		case "auto": return {
+			mode,
+			security: "allowlist",
+			ask: "on-miss"
+		};
+		case "full": return {
+			mode,
+			security: "full",
+			ask: "off"
+		};
+	}
+	return mode;
 }
-function withMcpElicitationsApprovalPolicy(policy) {
-	if (typeof policy !== "string") return { granular: {
-		...policy.granular,
-		mcp_elicitations: true
-	} };
-	if (policy === "never") return { granular: {
-		mcp_elicitations: true,
-		rules: false,
-		sandbox_approval: false,
-		request_permissions: false,
-		skill_approval: false
-	} };
-	return { granular: {
-		mcp_elicitations: true,
-		rules: true,
-		sandbox_approval: true,
-		request_permissions: true,
-		skill_approval: true
-	} };
+function resolveOpenClawExecModeFromPolicy(params) {
+	if (params.security === "deny") return "deny";
+	if (params.security === "allowlist" && params.ask === "off") return "allowlist";
+	if (params.security === "full" && params.ask !== "always") return "full";
+	return "ask";
 }
-function resolveTransport(value) {
-	return value === "websocket" || value === "unix" ? value : "stdio";
+function minOpenClawExecSecurity(left, right) {
+	const order = {
+		deny: 0,
+		allowlist: 1,
+		full: 2
+	};
+	return order[left] <= order[right] ? left : right;
 }
-function normalizeRemoteWorkspaceRoot(value) {
-	return readNonEmptyString(value);
+function maxOpenClawExecAsk(left, right) {
+	const order = {
+		off: 0,
+		"on-miss": 1,
+		always: 2
+	};
+	return order[left] >= order[right] ? left : right;
 }
-function inferCodexAppServerConnectionClass(params) {
-	if (params.transport !== "websocket") return "local-loopback";
-	return params.url && isLoopbackWebSocketUrl(params.url) ? "local-loopback" : "remote";
+function readExecMode(value) {
+	return value === "deny" || value === "allowlist" || value === "ask" || value === "auto" || value === "full" ? value : void 0;
 }
-function assertCodexAppServerConnectionClassConfig(params) {
-	if (params.connectionClass === "remote" && !hasIdentityBearingWebSocketAuth({
-		authToken: params.authToken,
-		headers: params.headers
-	})) throw new Error("remote Codex app-server WebSocket URLs require appServer.authToken or an Authorization header");
+//#endregion
+//#region extensions/codex/src/app-server/session-discovery-config.ts
+const codexSessionCatalogConfigSchema = z.object({ enabled: z.boolean().optional() }).strict();
+const codexDiscoveryConfigSchema = z.object({
+	enabled: z.boolean().optional(),
+	timeoutMs: z.number().positive().optional()
+}).strict();
+//#endregion
+//#region extensions/codex/src/app-server/config-parsing.ts
+const DEFAULT_CODEX_COMPUTER_USE_PLUGIN_NAME = "computer-use";
+const DEFAULT_CODEX_COMPUTER_USE_MARKETPLACE_DISCOVERY_TIMEOUT_MS = 6e4;
+const DEFAULT_CODEX_COMPUTER_USE_LIVE_TEST_TIMEOUT_MS = 6e4;
+const DEFAULT_CODEX_COMPUTER_USE_TOOL_CALL_TIMEOUT_MS = 6e4;
+const DEFAULT_CODEX_APP_SERVER_NETWORK_PROXY_PROFILE_PREFIX = "openclaw-network";
+const codexAppServerTransportSchema = z.enum([
+	"stdio",
+	"websocket",
+	"unix"
+]);
+const codexAppServerHomeScopeSchema = z.enum(["agent", "user"]);
+const SecretInputSchema = buildSecretInputSchema();
+const codexAppServerPolicyModeSchema = z.enum(["yolo", "guardian"]);
+const codexAppServerApprovalPolicySchema = z.preprocess((value) => value === "on-failure" ? "on-request" : value, z.enum([
+	"never",
+	"on-request",
+	"untrusted"
+]));
+const codexAppServerSandboxSchema = z.enum([
+	"read-only",
+	"workspace-write",
+	"danger-full-access"
+]);
+const codexAppServerApprovalsReviewerSchema = z.enum([
+	"user",
+	"auto_review",
+	"guardian_subagent"
+]);
+const codexDynamicToolsLoadingSchema = z.enum(["searchable", "direct"]);
+const codexComputerUseHealthIntervalSchema = z.union([
+	z.literal(30),
+	z.literal(60),
+	z.literal(120),
+	z.literal(240)
+]);
+const codexComputerUsePluginCacheModeSchema = z.enum(["shared", "independent"]);
+const codexPluginDestructivePolicySchema = z.union([
+	z.boolean(),
+	z.literal("auto"),
+	z.literal("ask")
+]);
+const codexAppServerServiceTierSchema = z.preprocess((value) => value === null ? null : normalizeCodexServiceTier(value), z.string().trim().min(1).nullable().optional()).optional();
+const codexAppServerExperimentalSchema = z.object({ sandboxExecServer: z.boolean().optional() }).strict();
+const codexAppServerRemoteWorkspaceRootSchema = z.string().trim().min(1);
+const codexAppServerNetworkProxyDomainPermissionSchema = z.enum(["allow", "deny"]);
+const codexAppServerNetworkProxyUnixSocketPermissionSchema = z.enum(["allow", "none"]);
+const codexAppServerNetworkProxySchema = z.object({
+	enabled: z.boolean().optional(),
+	profileName: z.string().trim().min(1).optional(),
+	baseProfile: z.enum(["read-only", "workspace"]).optional(),
+	mode: z.enum(["limited", "full"]).optional(),
+	domains: z.record(z.string(), codexAppServerNetworkProxyDomainPermissionSchema).optional(),
+	unixSockets: z.record(z.string(), codexAppServerNetworkProxyUnixSocketPermissionSchema).optional(),
+	proxyUrl: z.string().trim().min(1).optional(),
+	socksUrl: z.string().trim().min(1).optional(),
+	enableSocks5: z.boolean().optional(),
+	enableSocks5Udp: z.boolean().optional(),
+	allowUpstreamProxy: z.boolean().optional(),
+	allowLocalBinding: z.boolean().optional(),
+	dangerouslyAllowNonLoopbackProxy: z.boolean().optional(),
+	dangerouslyAllowAllUnixSockets: z.boolean().optional()
+}).strict();
+const codexPluginEntryConfigSchema = z.object({
+	enabled: z.boolean().optional(),
+	marketplaceName: z.enum([CODEX_PLUGINS_MARKETPLACE_NAME, CODEX_PLUGINS_WORKSPACE_MARKETPLACE_NAME]).optional(),
+	pluginName: z.string().trim().min(1).optional(),
+	allow_destructive_actions: codexPluginDestructivePolicySchema.optional()
+}).strict();
+const codexPluginsConfigSchema = z.object({
+	enabled: z.boolean().optional(),
+	allow_all_plugins: z.boolean().optional(),
+	allow_destructive_actions: codexPluginDestructivePolicySchema.optional(),
+	plugins: z.record(z.string(), codexPluginEntryConfigSchema).optional()
+}).strict();
+const codexSupervisionEndpointSchema = z.union([z.object({
+	id: z.string().optional(),
+	label: z.string().optional(),
+	transport: z.literal("stdio-proxy").optional(),
+	command: z.string().optional(),
+	args: z.array(z.string()).optional(),
+	cwd: z.string().optional()
+}).strict(), z.object({
+	id: z.string().optional(),
+	label: z.string().optional(),
+	transport: z.literal("websocket"),
+	url: z.string(),
+	authTokenEnv: z.string().optional()
+}).strict()]);
+const codexSupervisionConfigSchema = z.object({
+	enabled: z.boolean().optional(),
+	endpoints: z.array(codexSupervisionEndpointSchema).optional(),
+	allowRawTranscripts: z.boolean().optional(),
+	allowWriteControls: z.boolean().optional()
+}).strict();
+const codexPluginConfigSchema = z.object({
+	codexDynamicToolsLoading: codexDynamicToolsLoadingSchema.optional(),
+	codexDynamicToolsExclude: z.array(z.string()).optional(),
+	sessionCatalog: codexSessionCatalogConfigSchema.optional(),
+	discovery: codexDiscoveryConfigSchema.optional(),
+	computerUse: z.object({
+		enabled: z.boolean().optional(),
+		autoInstall: z.boolean().optional(),
+		marketplaceDiscoveryTimeoutMs: z.number().positive().optional(),
+		liveTestTimeoutMs: z.number().positive().optional(),
+		toolCallTimeoutMs: z.number().positive().optional(),
+		healthCheckEnabled: z.boolean().optional(),
+		healthCheckIntervalMinutes: codexComputerUseHealthIntervalSchema.optional(),
+		pluginCacheMode: codexComputerUsePluginCacheModeSchema.optional(),
+		strictReadiness: z.boolean().optional(),
+		autoRepair: z.boolean().optional(),
+		marketplaceSource: z.string().optional(),
+		marketplacePath: z.string().optional(),
+		marketplaceName: z.string().optional(),
+		pluginName: z.string().optional(),
+		mcpServerName: z.string().optional()
+	}).strict().optional(),
+	codexPlugins: z.unknown().optional(),
+	supervision: codexSupervisionConfigSchema.optional(),
+	appServer: z.object({
+		mode: codexAppServerPolicyModeSchema.optional(),
+		transport: codexAppServerTransportSchema.optional(),
+		homeScope: codexAppServerHomeScopeSchema.optional(),
+		command: z.string().optional(),
+		args: z.union([z.array(z.string()), z.string()]).optional(),
+		url: z.string().optional(),
+		authToken: SecretInputSchema.optional(),
+		headers: z.record(z.string(), SecretInputSchema).optional(),
+		clearEnv: z.array(z.string()).optional(),
+		remoteWorkspaceRoot: codexAppServerRemoteWorkspaceRootSchema.optional(),
+		codeModeOnly: z.boolean().optional(),
+		loopDetectionPreToolUseRelay: z.boolean().optional(),
+		requestTimeoutMs: z.number().positive().optional(),
+		turnCompletionIdleTimeoutMs: z.number().positive().optional(),
+		turnAssistantCompletionIdleTimeoutMs: z.number().positive().optional(),
+		postToolRawAssistantCompletionIdleTimeoutMs: z.number().positive().optional(),
+		approvalPolicy: codexAppServerApprovalPolicySchema.optional(),
+		sandbox: codexAppServerSandboxSchema.optional(),
+		approvalsReviewer: codexAppServerApprovalsReviewerSchema.optional(),
+		serviceTier: codexAppServerServiceTierSchema,
+		networkProxy: codexAppServerNetworkProxySchema.optional(),
+		defaultWorkspaceDir: z.string().optional(),
+		experimental: codexAppServerExperimentalSchema.optional()
+	}).strict().optional()
+}).strict();
+function readCodexPluginConfig(value) {
+	const parsed = codexPluginConfigSchema.safeParse(value);
+	if (!parsed.success) return {};
+	const { codexPlugins: rawCodexPlugins, ...config } = parsed.data;
+	const plugins = codexPluginsConfigSchema.safeParse(rawCodexPlugins);
+	if (!plugins.success) return config;
+	return {
+		...config,
+		...plugins.data ? { codexPlugins: plugins.data } : {}
+	};
 }
-/** Applies the canonical remote-auth boundary to any Codex AppServer transport. */
-function assertCodexAppServerConnectionSecurity(params) {
-	assertCodexAppServerConnectionClassConfig({
-		connectionClass: inferCodexAppServerConnectionClass(params),
-		authToken: params.authToken,
-		headers: params.headers
-	});
+function isCodexSandboxExecServerEnabled(pluginConfig) {
+	return readCodexPluginConfig(pluginConfig).appServer?.experimental?.sandboxExecServer === true;
 }
-function isLoopbackWebSocketUrl(value) {
-	let parsed;
-	try {
-		parsed = new URL(value);
-	} catch {
-		return false;
-	}
-	if (parsed.protocol !== "ws:" && parsed.protocol !== "wss:") return false;
-	const host = parsed.hostname.toLowerCase();
-	return host === "localhost" || host === "127.0.0.1" || host === "::1" || host === "[::1]" || host.startsWith("127.");
+function assertCodexAppServerCommandHasNoInlineArgs(params) {
+	const inlineArgs = detectWindowsSpawnCommandInlineArgs(params.command);
+	if (!inlineArgs) return;
+	const sourceLabel = params.source === "env" ? "OPENCLAW_CODEX_APP_SERVER_BIN" : "plugins.entries.codex.config.appServer.command";
+	const argsLabel = params.source === "env" ? "OPENCLAW_CODEX_APP_SERVER_ARGS" : "plugins.entries.codex.config.appServer.args";
+	throw new Error(`${sourceLabel} must be only the Codex app-server executable path; "${inlineArgs.executable}" was configured with inline arguments "${inlineArgs.arguments}". Move those arguments to ${argsLabel}, or remove the override to use the managed Codex startup path.`);
 }
-function hasIdentityBearingWebSocketAuth(params) {
-	if (readNonEmptyString(params.authToken)) return true;
-	return Object.entries(params.headers).some(([key, value]) => key.trim().toLowerCase() === "authorization" && Boolean(readNonEmptyString(value)));
+function resolveCodexPluginsPolicy(pluginConfig) {
+	const config = readCodexPluginConfig(pluginConfig).codexPlugins;
+	const configured = config !== void 0;
+	const enabled = config?.enabled === true;
+	const destructivePolicy = resolveCodexPluginDestructivePolicy(config?.allow_destructive_actions ?? true);
+	const pluginPolicies = Object.entries(config?.plugins ?? {}).flatMap(([configKey, entry]) => {
+		if (!isCodexPluginMarketplaceName(entry.marketplaceName) || !entry.pluginName) return [];
+		const entryDestructivePolicy = resolveCodexPluginDestructivePolicy(entry.allow_destructive_actions ?? config?.allow_destructive_actions ?? true);
+		return [{
+			configKey,
+			marketplaceName: entry.marketplaceName,
+			pluginName: entry.pluginName,
+			enabled: enabled && entry.enabled !== false,
+			allowDestructiveActions: entryDestructivePolicy.allowDestructiveActions,
+			destructiveApprovalMode: entryDestructivePolicy.destructiveApprovalMode
+		}];
+	}).toSorted((left, right) => left.configKey.localeCompare(right.configKey));
+	return {
+		configured,
+		enabled,
+		allowAllPlugins: enabled && config?.allow_all_plugins === true,
+		allowDestructiveActions: destructivePolicy.allowDestructiveActions,
+		destructiveApprovalMode: destructivePolicy.destructiveApprovalMode,
+		pluginPolicies
+	};
 }
-function resolvePolicyMode(value) {
-	return value === "guardian" || value === "yolo" ? value : void 0;
+function isCodexPluginMarketplaceName(value) {
+	return value === "openai-curated" || value === "workspace-directory";
 }
-function resolveDefaultCodexAppServerPolicy(params) {
-	if (params.transport !== "stdio") return {
-		mode: "yolo",
-		dangerFullAccessAllowed: true
-	};
-	const content = readCodexRequirementsToml(params);
-	if (content === void 0) {
-		if (!params.forceGuardian) return {
-			mode: "yolo",
-			dangerFullAccessAllowed: true
-		};
-		return {
-			mode: "guardian",
-			dangerFullAccessAllowed: true,
-			approvalPolicy: selectGuardianApprovalPolicy(void 0, params.execModeRequiringPromptingApprovals),
-			approvalsReviewer: params.forceUserReviewer ? selectUserApprovalsReviewer(void 0, params.execModeRequiringUserReviewer) : selectGuardianApprovalsReviewer(void 0, params.execModeRequiringPromptingApprovals === "auto" ? "auto" : void 0),
-			sandbox: selectGuardianSandbox(void 0)
-		};
-	}
-	const allowedSandboxModes = parseAllowedSandboxModesFromCodexRequirements(content, readNonEmptyString(params.hostName) ?? hostname());
-	const allowedApprovalPolicies = parseAllowedApprovalPoliciesFromCodexRequirements(content);
-	const allowedApprovalsReviewers = parseAllowedApprovalsReviewersFromCodexRequirements(content);
-	const yoloSandboxAllowed = allowedSandboxModes === void 0 || allowedSandboxModes.has("danger-full-access");
-	const yoloApprovalAllowed = allowedApprovalPolicies === void 0 || allowedApprovalPolicies.has("never");
-	const yoloReviewerAllowed = allowedApprovalsReviewers === void 0 || allowedApprovalsReviewers.has("user");
-	if (!params.forceGuardian && yoloSandboxAllowed && yoloApprovalAllowed && yoloReviewerAllowed) return {
-		mode: "yolo",
-		dangerFullAccessAllowed: true
+function resolveCodexPluginDestructivePolicy(policy) {
+	if (policy === "auto" || policy === "ask") return {
+		allowDestructiveActions: true,
+		destructiveApprovalMode: policy
 	};
 	return {
-		mode: "guardian",
-		dangerFullAccessAllowed: yoloSandboxAllowed,
-		approvalPolicy: selectGuardianApprovalPolicy(allowedApprovalPolicies, params.execModeRequiringPromptingApprovals),
-		approvalsReviewer: params.forceUserReviewer ? selectUserApprovalsReviewer(allowedApprovalsReviewers, params.execModeRequiringUserReviewer) : selectGuardianApprovalsReviewer(allowedApprovalsReviewers, params.execModeRequiringPromptingApprovals === "auto" ? "auto" : void 0),
-		sandbox: selectGuardianSandbox(allowedSandboxModes)
+		allowDestructiveActions: policy,
+		destructiveApprovalMode: policy ? "allow" : "deny"
 	};
 }
+//#endregion
+//#region extensions/codex/src/app-server/config-requirements.ts
+const UNIX_CODEX_REQUIREMENTS_PATH = "/etc/codex/requirements.toml";
+const WINDOWS_CODEX_REQUIREMENTS_SUFFIX = "\\OpenAI\\Codex\\requirements.toml";
+function isCodexAppServerApprovalPolicyAllowedByRequirements(policy, params = {}) {
+	const content = readCodexRequirementsToml(params);
+	if (content === void 0) return true;
+	const allowedApprovalPolicies = parseAllowedApprovalPoliciesFromCodexRequirements(content);
+	return allowedApprovalPolicies === void 0 || allowedApprovalPolicies.has(policy);
+}
 function readCodexRequirementsToml(params) {
 	if (params.requirementsToml !== void 0) return params.requirementsToml ?? void 0;
 	const requirementsPath = readNonEmptyString(params.requirementsPath) ?? resolveCodexRequirementsPath(params.env ?? process.env, params.platform ?? process.platform);
@@ -889,6 +712,52 @@ function selectUserApprovalsReviewer(allowedApprovalsReviewers, execModeRequirin
 	if (allowedApprovalsReviewers === void 0 || allowedApprovalsReviewers.has("user")) return "user";
 	throw new Error(`tools.exec.mode=${execModeRequiringUserReviewer ?? "ask"} requires Codex app-server user approvals`);
 }
+//#endregion
+//#region extensions/codex/src/app-server/config-reviewer.ts
+const CODEX_APP_SERVER_HOME_DIRNAME = "codex-home";
+const CODEX_CONFIG_TOML_FILENAME = "config.toml";
+function canUseCodexModelBackedApprovalsReviewerForModel(params) {
+	const explicitProvider = params.modelProvider?.trim().toLowerCase();
+	const inferredProvider = inferProviderFromModelRef(params.model);
+	if (explicitProvider && explicitProvider !== "codex") return isTrustedCodexModelBackedApprovalsReviewerProvider(explicitProvider, params) && (inferredProvider === void 0 || isTrustedCodexModelBackedApprovalsReviewerProvider(inferredProvider, params));
+	if (inferredProvider !== void 0) return isTrustedCodexModelBackedApprovalsReviewerProvider(inferredProvider, params);
+	return isTrustedCodexModelBackedApprovalsReviewerProvider(explicitProvider, params);
+}
+function isTrustedCodexModelBackedOpenAIProvider(params) {
+	if (!openAIBaseUrlEnvOverridesAreTrustedForModelBackedReview(params.env)) return false;
+	const codexBaseUrlOverrides = readCodexBaseUrlOverridesForModelBackedReview(params);
+	if (codexBaseUrlOverrides === false || !codexBaseUrlOverrides.openAI.every(isNativeOpenAIBaseUrl) || !codexBaseUrlOverrides.chatGPT.every(isNativeChatGPTBaseUrl)) return false;
+	const openAIProviders = readConfiguredOpenAIProvidersForModelBackedReview(params.config);
+	if (openAIProviders.length === 0) return true;
+	return openAIProviders.every((openAIProvider) => configuredOpenAIProviderIsTrustedForModelBackedReview(openAIProvider, params.model));
+}
+function resolveCodexModelBackedReviewerPolicyContext(params) {
+	const provider = params.provider?.trim();
+	if (provider && provider.toLowerCase() !== "codex") return {
+		modelProvider: normalizeCodexModelBackedReviewerPolicyProvider(provider),
+		model: params.model
+	};
+	const bindingModelProvider = params.bindingModelProvider?.trim();
+	const currentModel = params.model?.trim();
+	const bindingModel = params.bindingModel?.trim();
+	if (bindingModelProvider && currentModel && bindingModel && currentModel === bindingModel) return {
+		modelProvider: normalizeCodexModelBackedReviewerPolicyProvider(bindingModelProvider),
+		model: params.model ?? params.bindingModel
+	};
+	const currentModelProvider = inferProviderFromModelRef(params.model);
+	if (currentModelProvider) return {
+		modelProvider: normalizeCodexModelBackedReviewerPolicyProvider(currentModelProvider),
+		model: params.model
+	};
+	if (bindingModelProvider) return {
+		modelProvider: normalizeCodexModelBackedReviewerPolicyProvider(bindingModelProvider),
+		model: params.model ?? params.bindingModel
+	};
+	return {
+		modelProvider: params.nativeAuthProfile === true ? "openai" : void 0,
+		model: params.model ?? params.bindingModel
+	};
+}
 function isCodexModelBackedApprovalsReviewerProvider(provider) {
 	return provider?.trim().toLowerCase() === "openai";
 }
@@ -1041,278 +910,448 @@ function inferProviderFromModelRef(model) {
 	const slashIndex = normalized?.indexOf("/") ?? -1;
 	return slashIndex > 0 ? normalized?.slice(0, slashIndex) : void 0;
 }
-function selectForcedPromptingSandbox(params) {
-	if (params.configuredSandbox === "read-only" || params.defaultSandbox === "read-only") return "read-only";
-	return params.defaultSandbox ?? "workspace-write";
+//#endregion
+//#region extensions/codex/src/app-server/config-security.ts
+function shouldAutoApproveCodexAppServerApprovals(appServer) {
+	return appServer.networkProxy === void 0 && appServer.approvalPolicy === "never" && appServer.sandbox === "danger-full-access";
 }
-function selectForcedDangerFullAccessSandbox(params) {
-	if (params.configuredSandbox === "read-only") return "read-only";
-	if (params.defaultPolicy?.dangerFullAccessAllowed === false) {
-		if (params.openClawSandboxActive) return params.defaultPolicy.sandbox ?? "workspace-write";
-		throw new Error("legacy full exec security with ask requires Codex app-server danger-full-access");
-	}
-	return "danger-full-access";
+function resolveCodexAppServerNetworkProxy(config, sandbox) {
+	if (config?.enabled !== true) return {};
+	const fileSystemMode = config.baseProfile === "read-only" || !config.baseProfile && sandbox === "read-only" ? "read" : "write";
+	const networkConfig = removeUndefinedJsonFields({
+		enabled: true,
+		mode: config.mode,
+		domains: normalizeNetworkProxyPermissionMap(config.domains),
+		unix_sockets: normalizeNetworkProxyPermissionMap(config.unixSockets),
+		proxy_url: readNonEmptyString(config.proxyUrl),
+		socks_url: readNonEmptyString(config.socksUrl),
+		enable_socks5: config.enableSocks5,
+		enable_socks5_udp: config.enableSocks5Udp,
+		allow_upstream_proxy: config.allowUpstreamProxy,
+		allow_local_binding: config.allowLocalBinding,
+		dangerously_allow_non_loopback_proxy: config.dangerouslyAllowNonLoopbackProxy,
+		dangerously_allow_all_unix_sockets: config.dangerouslyAllowAllUnixSockets
+	});
+	const profile = {
+		filesystem: {
+			":minimal": "read",
+			":project_roots": { ".": fileSystemMode }
+		},
+		network: networkConfig
+	};
+	const profileName = resolveNetworkProxyPermissionProfileName(config, profile);
+	const configPatch = {
+		"features.network_proxy.enabled": true,
+		default_permissions: profileName,
+		permissions: { [profileName]: profile }
+	};
+	return { networkProxy: {
+		profileName,
+		configFingerprint: fingerprintCodexAppServerNetworkProxyConfigPatch(configPatch),
+		configPatch
+	} };
 }
-function selectGuardianSandbox(allowedSandboxModes) {
-	if (allowedSandboxModes === void 0 || allowedSandboxModes.has("workspace-write")) return "workspace-write";
-	if (allowedSandboxModes.has("read-only")) return "read-only";
-	if (allowedSandboxModes.has("danger-full-access")) return "danger-full-access";
-	return "workspace-write";
+function resolveNetworkProxyPermissionProfileName(config, profile) {
+	const explicitProfileName = readNonEmptyString(config.profileName);
+	if (explicitProfileName) return explicitProfileName;
+	return `${DEFAULT_CODEX_APP_SERVER_NETWORK_PROXY_PROFILE_PREFIX}-${createHash("sha256").update(stableStringifyJson({
+		version: 1,
+		profile
+	})).digest("hex").slice(0, 16)}`;
 }
-function resolveApprovalPolicy(value) {
-	if (value === "on-failure") return "on-request";
-	return value === "on-request" || value === "untrusted" || value === "never" ? value : void 0;
+function fingerprintCodexAppServerNetworkProxyConfigPatch(configPatch) {
+	return createHash("sha256").update(stableStringifyJson(configPatch)).digest("hex");
 }
-function resolveSandbox(value) {
-	return value === "read-only" || value === "workspace-write" || value === "danger-full-access" ? value : void 0;
+function normalizeNetworkProxyPermissionMap(value) {
+	const entries = Object.entries(value ?? {}).map(([key, permission]) => [key.trim(), permission]).filter(([key]) => key.length > 0);
+	return entries.length > 0 ? Object.fromEntries(entries) : void 0;
 }
-function resolveApprovalsReviewer(value) {
-	return value === "auto_review" || value === "guardian_subagent" || value === "user" ? value : void 0;
+function removeUndefinedJsonFields(value) {
+	return Object.fromEntries(Object.entries(value).filter((entry) => entry[1] !== void 0));
 }
-function resolveOpenClawExecPolicyFromConfig(params) {
-	const root = readRecord(params.config);
-	const globalExec = readRecord(readRecord(root?.tools)?.exec);
-	const globalPolicy = applyOpenClawExecPolicyLayer(createDefaultOpenClawExecPolicy(), globalExec);
-	const agentId = params.agentId?.trim();
-	if (!agentId) return globalPolicy;
-	const agents = readRecord(root?.agents);
-	const agentList = Array.isArray(agents?.list) ? agents.list : [];
-	const normalizedAgentId = normalizeAgentId(agentId);
-	return applyOpenClawExecPolicyLayer(globalPolicy, readRecord(readRecord(readRecord(agentList.find((entry) => {
-		const id = readRecord(entry)?.id;
-		return typeof id === "string" && normalizeAgentId(id) === normalizedAgentId;
-	}))?.tools)?.exec));
+function stableStringifyJson(value) {
+	if (Array.isArray(value)) return `[${value.map((item) => stableStringifyJson(item)).join(",")}]`;
+	if (value && typeof value === "object") return `{${Object.entries(value).toSorted(([left], [right]) => left.localeCompare(right)).map(([key, item]) => `${JSON.stringify(key)}:${stableStringifyJson(item)}`).join(",")}}`;
+	return JSON.stringify(value);
 }
-function resolveOpenClawExecPolicyForCodexAppServer(params) {
-	const overridePolicy = applyOpenClawExecPolicyLayer(resolveOpenClawExecPolicyFromConfig({
-		config: params.config,
-		agentId: params.agentId
-	}), params.execOverrides);
-	return applyOpenClawExecApprovalFloors(overridePolicy, resolveOpenClawExecApprovalFloorsForCodexAppServer({
-		approvals: params.approvals,
-		agentId: params.agentId,
-		policy: overridePolicy
-	}));
+function withMcpElicitationsApprovalPolicy(policy) {
+	if (typeof policy !== "string") return { granular: {
+		...policy.granular,
+		mcp_elicitations: true
+	} };
+	if (policy === "never") return { granular: {
+		mcp_elicitations: true,
+		rules: false,
+		sandbox_approval: false,
+		request_permissions: false,
+		skill_approval: false
+	} };
+	return { granular: {
+		mcp_elicitations: true,
+		rules: true,
+		sandbox_approval: true,
+		request_permissions: true,
+		skill_approval: true
+	} };
 }
-function resolveEffectiveOpenClawExecModeForCodexAppServer(params) {
-	if (params.execPolicy?.touched === true) return params.execPolicy.mode;
-	return params.execMode;
+function resolveTransport(value) {
+	return value === "websocket" || value === "unix" ? value : "stdio";
 }
-function resolveCodexPolicyModeForOpenClawExecMode(mode) {
-	if (!mode || mode === "full") return;
-	return "guardian";
+function normalizeRemoteWorkspaceRoot(value) {
+	return readNonEmptyString(value);
+}
+function inferCodexAppServerConnectionClass(params) {
+	if (params.transport !== "websocket") return "local-loopback";
+	return params.url && isLoopbackWebSocketUrl(params.url) ? "local-loopback" : "remote";
+}
+function assertCodexAppServerConnectionClassConfig(params) {
+	if (params.connectionClass === "remote" && !hasIdentityBearingWebSocketAuth({
+		authToken: params.authToken,
+		headers: params.headers
+	})) throw new Error("remote Codex app-server WebSocket URLs require appServer.authToken or an Authorization header");
 }
-function assertCodexAppServerAllowedForOpenClawExecMode(mode) {
-	if (mode === "deny" || mode === "allowlist") throw new Error(`Codex app-server local execution is not available when tools.exec.mode=${mode}`);
+/** Applies the canonical remote-auth boundary to any Codex AppServer transport. */
+function assertCodexAppServerConnectionSecurity(params) {
+	assertCodexAppServerConnectionClassConfig({
+		connectionClass: inferCodexAppServerConnectionClass(params),
+		authToken: params.authToken,
+		headers: params.headers
+	});
 }
-function createDefaultOpenClawExecPolicy() {
-	return {
-		security: "full",
-		ask: "off",
-		touched: false
-	};
+function isLoopbackWebSocketUrl(value) {
+	let parsed;
+	try {
+		parsed = new URL(value);
+	} catch {
+		return false;
+	}
+	if (parsed.protocol !== "ws:" && parsed.protocol !== "wss:") return false;
+	return isLoopbackHost(parsed.hostname);
 }
-function applyOpenClawExecPolicyLayer(base, exec) {
-	if (!exec) return base;
-	const mode = readExecMode(exec.mode);
-	if (mode !== void 0) return {
-		...resolveOpenClawExecPolicyForMode(mode),
-		touched: true
-	};
-	const security = readExecSecurity(exec.security);
-	const ask = readExecAsk(exec.ask);
-	if (security === void 0 && ask === void 0) return base;
-	const nextSecurity = security ?? base.security;
-	const nextAsk = ask ?? base.ask;
-	return {
-		mode: resolveOpenClawExecModeFromPolicy({
-			security: nextSecurity,
-			ask: nextAsk
-		}),
-		security: nextSecurity,
-		ask: nextAsk,
-		touched: true
-	};
+function hasIdentityBearingWebSocketAuth(params) {
+	if (readNonEmptyString(params.authToken)) return true;
+	return Object.entries(params.headers).some(([key, value]) => key.trim().toLowerCase() === "authorization" && Boolean(readNonEmptyString(value)));
 }
-function resolveOpenClawExecApprovalFloorsForCodexAppServer(params) {
-	if (!params.approvals) return;
-	return resolveExecApprovalsFromFile({
-		file: params.approvals,
-		agentId: params.agentId,
-		overrides: {
-			security: params.policy.security,
-			ask: params.policy.ask
-		}
-	}).agent;
+function resolvePolicyMode(value) {
+	return value === "guardian" || value === "yolo" ? value : void 0;
 }
-function applyOpenClawExecApprovalFloors(base, approvalFloors) {
-	if (!approvalFloors) return base;
-	const nextSecurity = approvalFloors.security ? minOpenClawExecSecurity(base.security, approvalFloors.security) : base.security;
-	const nextAsk = approvalFloors.ask ? maxOpenClawExecAsk(base.ask, approvalFloors.ask) : base.ask;
-	if (nextSecurity === base.security && nextAsk === base.ask) return base;
-	return {
-		mode: resolveOpenClawExecModeFromPolicy({
-			security: nextSecurity,
-			ask: nextAsk
-		}),
-		security: nextSecurity,
-		ask: nextAsk,
-		touched: true
+function resolveDefaultCodexAppServerPolicy(params) {
+	if (params.transport !== "stdio") return {
+		mode: "yolo",
+		dangerFullAccessAllowed: true
 	};
-}
-function resolveOpenClawExecPolicyForMode(mode) {
-	switch (mode) {
-		case "deny": return {
-			mode,
-			security: "deny",
-			ask: "off"
-		};
-		case "allowlist": return {
-			mode,
-			security: "allowlist",
-			ask: "off"
-		};
-		case "ask":
-		case "auto": return {
-			mode,
-			security: "allowlist",
-			ask: "on-miss"
+	const content = readCodexRequirementsToml(params);
+	if (content === void 0) {
+		if (!params.forceGuardian) return {
+			mode: "yolo",
+			dangerFullAccessAllowed: true
 		};
-		case "full": return {
-			mode,
-			security: "full",
-			ask: "off"
+		return {
+			mode: "guardian",
+			dangerFullAccessAllowed: true,
+			approvalPolicy: selectGuardianApprovalPolicy(void 0, params.execModeRequiringPromptingApprovals),
+			approvalsReviewer: params.forceUserReviewer ? selectUserApprovalsReviewer(void 0, params.execModeRequiringUserReviewer) : selectGuardianApprovalsReviewer(void 0, params.execModeRequiringPromptingApprovals === "auto" ? "auto" : void 0),
+			sandbox: selectGuardianSandbox(void 0)
 		};
 	}
-	return mode;
+	const allowedSandboxModes = parseAllowedSandboxModesFromCodexRequirements(content, readNonEmptyString(params.hostName) ?? hostname());
+	const allowedApprovalPolicies = parseAllowedApprovalPoliciesFromCodexRequirements(content);
+	const allowedApprovalsReviewers = parseAllowedApprovalsReviewersFromCodexRequirements(content);
+	const yoloSandboxAllowed = allowedSandboxModes === void 0 || allowedSandboxModes.has("danger-full-access");
+	const yoloApprovalAllowed = allowedApprovalPolicies === void 0 || allowedApprovalPolicies.has("never");
+	const yoloReviewerAllowed = allowedApprovalsReviewers === void 0 || allowedApprovalsReviewers.has("user");
+	if (!params.forceGuardian && yoloSandboxAllowed && yoloApprovalAllowed && yoloReviewerAllowed) return {
+		mode: "yolo",
+		dangerFullAccessAllowed: true
+	};
+	return {
+		mode: "guardian",
+		dangerFullAccessAllowed: yoloSandboxAllowed,
+		approvalPolicy: selectGuardianApprovalPolicy(allowedApprovalPolicies, params.execModeRequiringPromptingApprovals),
+		approvalsReviewer: params.forceUserReviewer ? selectUserApprovalsReviewer(allowedApprovalsReviewers, params.execModeRequiringUserReviewer) : selectGuardianApprovalsReviewer(allowedApprovalsReviewers, params.execModeRequiringPromptingApprovals === "auto" ? "auto" : void 0),
+		sandbox: selectGuardianSandbox(allowedSandboxModes)
+	};
 }
-function resolveOpenClawExecModeFromPolicy(params) {
-	if (params.security === "deny") return "deny";
-	if (params.security === "allowlist" && params.ask === "off") return "allowlist";
-	if (params.security === "full" && params.ask !== "always") return "full";
-	return "ask";
+//#endregion
+//#region extensions/codex/src/app-server/config-runtime.ts
+/**
+* Sole owner of the app-server home-scope decision. Ordinary harness connections
+* default to the isolated agent home; the supervision connection owns the operator's
+* native Codex home on local transports. Auth handoffs must read the scope from here
+* (or from resolved start options) because a prepared login on a native home rewrites
+* the account Codex CLI and Desktop share.
+*/
+function resolveCodexAppServerHomeScope(params) {
+	const configured = params.appServer?.homeScope;
+	if (configured) return configured;
+	return params.connectionScope === "supervision" && resolveTransport(params.appServer?.transport) !== "websocket" ? "user" : "agent";
 }
-function minOpenClawExecSecurity(left, right) {
-	const order = {
-		deny: 0,
-		allowlist: 1,
-		full: 2
+function resolveCodexAppServerRuntimeOptions(params = {}) {
+	const env = params.env ?? process.env;
+	const config = readCodexPluginConfig(params.pluginConfig).appServer ?? {};
+	const transport = resolveTransport(config.transport);
+	const homeScope = resolveCodexAppServerHomeScope({ appServer: config });
+	const configCommand = readNonEmptyString(config.command);
+	const envCommand = readNonEmptyString(env.OPENCLAW_CODEX_APP_SERVER_BIN);
+	const command = configCommand ?? envCommand ?? "codex";
+	const commandSource = configCommand ? "config" : envCommand ? "env" : "managed";
+	if (commandSource === "config" || commandSource === "env") assertCodexAppServerCommandHasNoInlineArgs({
+		command,
+		source: commandSource
+	});
+	const args = resolveArgs(config.args, env.OPENCLAW_CODEX_APP_SERVER_ARGS);
+	const headers = normalizeHeaders(config.headers);
+	const clearEnv = normalizeStringList(config.clearEnv);
+	const authToken = normalizeCodexAppServerSecretInput({
+		value: config.authToken,
+		path: "plugins.entries.codex.config.appServer.authToken"
+	});
+	const url = readNonEmptyString(config.url) ?? (transport === "unix" ? "unix://" : void 0);
+	const connectionClass = inferCodexAppServerConnectionClass({
+		transport,
+		url
+	});
+	const remoteAppsSubstrate = "preconfigured";
+	const remoteWorkspaceRoot = normalizeRemoteWorkspaceRoot(config.remoteWorkspaceRoot);
+	const execMode = resolveEffectiveOpenClawExecModeForCodexAppServer({
+		execMode: params.execMode,
+		execPolicy: params.execPolicy
+	});
+	assertCodexAppServerAllowedForOpenClawExecMode(execMode);
+	const explicitPolicyMode = resolvePolicyMode(config.mode) ?? resolvePolicyMode(env.OPENCLAW_CODEX_APP_SERVER_MODE);
+	const configuredSandbox = resolveSandbox(config.sandbox) ?? resolveSandbox(env.OPENCLAW_CODEX_APP_SERVER_SANDBOX);
+	const explicitApprovalsReviewer = resolveApprovalsReviewer(config.approvalsReviewer);
+	const normalizedPolicyMode = resolveCodexPolicyModeForOpenClawExecMode(execMode);
+	const ignoreLegacyYoloPolicyMode = normalizedPolicyMode === "guardian" && explicitPolicyMode === "yolo";
+	const canUseModelBackedReviewer = canUseCodexModelBackedApprovalsReviewerForModel({
+		modelProvider: params.modelProvider,
+		model: params.model,
+		config: params.config,
+		env,
+		agentDir: params.agentDir,
+		codexConfigToml: params.codexConfigToml,
+		homeScope
+	});
+	const forceUserReviewer = !canUseModelBackedReviewer && (explicitApprovalsReviewer === "auto_review" || explicitApprovalsReviewer === "guardian_subagent" || explicitPolicyMode === "guardian" && explicitApprovalsReviewer !== "user") || execMode !== void 0 && execMode !== "full" && (execMode !== "auto" || !canUseModelBackedReviewer);
+	const forceGuardianReviewer = execMode === "auto" && canUseModelBackedReviewer;
+	const execModeRequiringPromptingApprovals = execMode === "auto" || execMode === "ask" ? execMode : forceUserReviewer ? "ask" : void 0;
+	const forceDangerFullAccessSandbox = params.execPolicy?.touched === true && params.execPolicy.security === "full" && params.execPolicy.ask === "always";
+	const forceRuntimePolicy = forceUserReviewer || forceGuardianReviewer || forceDangerFullAccessSandbox;
+	const defaultPolicy = explicitPolicyMode && !forceRuntimePolicy && !ignoreLegacyYoloPolicyMode ? void 0 : resolveDefaultCodexAppServerPolicy({
+		transport,
+		env,
+		forceGuardian: normalizedPolicyMode === "guardian",
+		forceUserReviewer: forceUserReviewer || !canUseModelBackedReviewer,
+		execModeRequiringPromptingApprovals,
+		requirementsToml: params.requirementsToml,
+		requirementsPath: params.requirementsPath,
+		readRequirementsFile: params.readRequirementsFile,
+		platform: params.platform,
+		hostName: params.hostName,
+		execModeRequiringUserReviewer: forceUserReviewer ? execMode : void 0
+	});
+	const preserveExplicitAutoSandbox = forceGuardianReviewer && configuredSandbox === "read-only";
+	const forcedPolicy = forceRuntimePolicy ? {
+		approvalPolicy: defaultPolicy?.approvalPolicy ?? "on-request",
+		sandbox: preserveExplicitAutoSandbox ? void 0 : forceDangerFullAccessSandbox ? selectForcedDangerFullAccessSandbox({
+			configuredSandbox,
+			defaultPolicy,
+			openClawSandboxActive: Boolean(params.openClawSandboxActive)
+		}) : selectForcedPromptingSandbox({
+			configuredSandbox,
+			defaultSandbox: defaultPolicy?.sandbox
+		}),
+		approvalsReviewer: defaultPolicy?.approvalsReviewer ?? (forceUserReviewer ? "user" : "auto_review")
+	} : void 0;
+	const policyMode = ignoreLegacyYoloPolicyMode ? normalizedPolicyMode : explicitPolicyMode ?? normalizedPolicyMode ?? defaultPolicy?.mode ?? "yolo";
+	const serviceTier = normalizeCodexServiceTier(config.serviceTier);
+	const resolvedSandbox = forcedPolicy?.sandbox ?? configuredSandbox ?? defaultPolicy?.sandbox ?? (policyMode === "guardian" ? "workspace-write" : "danger-full-access");
+	if (transport === "websocket" && !url) throw new Error("plugins.entries.codex.config.appServer.url is required when appServer.transport is websocket");
+	if (transport === "websocket" && homeScope === "user") throw new Error("plugins.entries.codex.config.appServer.homeScope=user requires appServer.transport=stdio or unix");
+	if (transport === "unix" && homeScope !== "user") throw new Error("plugins.entries.codex.config.appServer.transport=unix requires appServer.homeScope=user");
+	if (transport === "unix" && !url?.startsWith("unix://")) throw new Error("plugins.entries.codex.config.appServer.url must use unix:// when appServer.transport is unix");
+	assertCodexAppServerConnectionSecurity({
+		transport,
+		url,
+		authToken,
+		headers
+	});
+	const configApprovalPolicy = resolveApprovalPolicy(config.approvalPolicy);
+	const envApprovalPolicy = resolveApprovalPolicy(env.OPENCLAW_CODEX_APP_SERVER_APPROVAL_POLICY);
+	const approvalPolicy = configApprovalPolicy ?? envApprovalPolicy ?? defaultPolicy?.approvalPolicy ?? (policyMode === "guardian" ? "on-request" : "never");
+	const approvalPolicySource = configApprovalPolicy ? "config" : envApprovalPolicy ? "env" : defaultPolicy?.approvalPolicy ? "requirements" : "implicit";
+	const computerUseConfig = resolveCodexComputerUseConfig({
+		pluginConfig: params.pluginConfig,
+		env
+	});
+	const managedCommandOrder = params.managedCommandOrder ?? (homeScope === "user" || computerUseConfig.enabled ? "desktop-first" : "package-first");
+	const includeManagedCommandOrder = commandSource === "managed" && (managedCommandOrder === "desktop-first" || params.managedCommandOrder === "package-first");
+	const managedComputerUsePluginNames = [.../* @__PURE__ */ new Set([DEFAULT_CODEX_COMPUTER_USE_PLUGIN_NAME, computerUseConfig.pluginName])];
+	return {
+		start: {
+			transport,
+			homeScope,
+			command,
+			commandSource,
+			...includeManagedCommandOrder ? { managedCommandOrder } : {},
+			...commandSource === "managed" ? { managedComputerUsePluginNames } : {},
+			args: args.length > 0 ? args : [
+				"app-server",
+				"--listen",
+				"stdio://"
+			],
+			...url ? { url } : {},
+			...authToken ? { authToken } : {},
+			headers,
+			...transport === "stdio" && clearEnv.length > 0 ? { clearEnv } : {}
+		},
+		connectionClass,
+		remoteAppsSubstrate,
+		...remoteWorkspaceRoot ? { remoteWorkspaceRoot } : {},
+		codeModeOnly: config.codeModeOnly === true,
+		loopDetectionPreToolUseRelay: config.loopDetectionPreToolUseRelay !== false,
+		requestTimeoutMs: normalizePositiveNumber(config.requestTimeoutMs, 6e4),
+		turnCompletionIdleTimeoutMs: normalizePositiveNumber(config.turnCompletionIdleTimeoutMs, 6e4),
+		turnAssistantCompletionIdleTimeoutMs: normalizePositiveNumber(config.turnAssistantCompletionIdleTimeoutMs, 1e4),
+		...config.postToolRawAssistantCompletionIdleTimeoutMs !== void 0 ? { postToolRawAssistantCompletionIdleTimeoutMs: normalizePositiveNumber(config.postToolRawAssistantCompletionIdleTimeoutMs, 6e4) } : {},
+		approvalPolicy: forcedPolicy?.approvalPolicy ?? approvalPolicy,
+		approvalPolicySource,
+		sandbox: resolvedSandbox,
+		approvalsReviewer: forcedPolicy?.approvalsReviewer ?? explicitApprovalsReviewer ?? defaultPolicy?.approvalsReviewer ?? (policyMode === "guardian" ? "auto_review" : "user"),
+		...serviceTier ? { serviceTier } : {},
+		...resolveCodexAppServerNetworkProxy(config.networkProxy, resolvedSandbox)
 	};
-	return order[left] <= order[right] ? left : right;
 }
-function maxOpenClawExecAsk(left, right) {
-	const order = {
-		off: 0,
-		"on-miss": 1,
-		always: 2
+/**
+* Rechecks Codex-owned plugin state at the final spawn boundary, where the
+* effective agent home is known, so Computer Use keeps the desktop app's TCC ownership.
+*/
+function resolveCodexAppServerStartOptionsForAgent(params) {
+	const startOptions = params.startOptions;
+	if (startOptions.transport !== "stdio" || startOptions.commandSource !== "managed" || startOptions.managedCommandOrder !== void 0) return startOptions;
+	if (startOptions.homeScope === "user") return {
+		...startOptions,
+		managedCommandOrder: "desktop-first"
 	};
-	return order[left] >= order[right] ? left : right;
-}
-function readExecMode(value) {
-	return value === "deny" || value === "allowlist" || value === "ask" || value === "auto" || value === "full" ? value : void 0;
-}
-function readRecord(value) {
-	return value && typeof value === "object" && !Array.isArray(value) ? value : void 0;
-}
-function normalizeCodexServiceTier(value) {
-	if (typeof value !== "string") return;
-	const trimmed = value.trim();
-	if (!trimmed) return;
-	const normalized = trimmed.toLowerCase();
-	if (normalized === "fast" || normalized === "priority") return "priority";
-	if (normalized === "flex") return "flex";
-	return trimmed;
-}
-function isCodexFastServiceTier(value) {
-	return normalizeCodexServiceTier(value) === "priority";
-}
-function normalizePositiveNumber(value, fallback) {
-	return resolvePositiveTimerTimeoutMs(value, fallback);
-}
-function normalizeHeaders(value) {
-	if (!value || typeof value !== "object" || Array.isArray(value)) return {};
-	return Object.fromEntries(Object.entries(value).map(([key, child]) => [key.trim(), normalizeCodexAppServerSecretInput({
-		value: child,
-		path: `plugins.entries.codex.config.appServer.headers.${key}`
-	})]).filter((entry) => Boolean(entry[0] && entry[1])));
-}
-function normalizeCodexAppServerSecretInput(params) {
-	return normalizeResolvedSecretInputString(params);
-}
-function normalizeStringList(value) {
-	return normalizeTrimmedStringList(value);
-}
-function readBooleanEnv(value) {
-	if (value === void 0) return;
-	const normalized = value.trim().toLowerCase();
-	if ([
-		"1",
-		"true",
-		"yes",
-		"on"
-	].includes(normalized)) return true;
-	if ([
-		"0",
-		"false",
-		"no",
-		"off"
-	].includes(normalized)) return false;
-}
-function readExecSecurity(value) {
-	return value === "deny" || value === "allowlist" || value === "full" ? value : void 0;
-}
-function readExecAsk(value) {
-	return value === "off" || value === "on-miss" || value === "always" ? value : void 0;
+	return codexConfigEnablesNativeComputerUse({
+		agentDir: params.agentDir,
+		codexConfigToml: params.codexConfigToml,
+		env: params.env,
+		homeScope: "agent",
+		pluginNames: startOptions.managedComputerUsePluginNames ?? ["computer-use"]
+	}) ? {
+		...startOptions,
+		managedCommandOrder: "desktop-first"
+	} : startOptions;
 }
-function readNumberEnv(value) {
-	const trimmed = value?.trim();
-	if (!trimmed || !PLAIN_DECIMAL_NUMBER_RE.test(trimmed)) return;
-	const parsed = Number(trimmed);
-	return Number.isFinite(parsed) ? parsed : void 0;
+function resolveCodexComputerUseConfig(params = {}) {
+	const env = params.env ?? process.env;
+	const config = readCodexPluginConfig(params.pluginConfig).computerUse ?? {};
+	const marketplaceSource = readNonEmptyString(params.overrides?.marketplaceSource) ?? readNonEmptyString(config.marketplaceSource) ?? readNonEmptyString(env.OPENCLAW_CODEX_COMPUTER_USE_MARKETPLACE_SOURCE);
+	const marketplacePath = readNonEmptyString(params.overrides?.marketplacePath) ?? readNonEmptyString(config.marketplacePath) ?? readNonEmptyString(env.OPENCLAW_CODEX_COMPUTER_USE_MARKETPLACE_PATH);
+	const marketplaceName = readNonEmptyString(params.overrides?.marketplaceName) ?? readNonEmptyString(config.marketplaceName) ?? readNonEmptyString(env.OPENCLAW_CODEX_COMPUTER_USE_MARKETPLACE_NAME);
+	const configuredPluginName = readNonEmptyString(params.overrides?.pluginName) ?? readNonEmptyString(config.pluginName) ?? readNonEmptyString(env.OPENCLAW_CODEX_COMPUTER_USE_PLUGIN_NAME);
+	const configuredMcpServerName = readNonEmptyString(params.overrides?.mcpServerName) ?? readNonEmptyString(config.mcpServerName) ?? readNonEmptyString(env.OPENCLAW_CODEX_COMPUTER_USE_MCP_SERVER_NAME);
+	const autoInstall = params.overrides?.autoInstall ?? config.autoInstall ?? readBooleanEnv(env.OPENCLAW_CODEX_COMPUTER_USE_AUTO_INSTALL) ?? false;
+	const marketplaceDiscoveryTimeoutMs = normalizePositiveNumber(params.overrides?.marketplaceDiscoveryTimeoutMs ?? config.marketplaceDiscoveryTimeoutMs ?? readNumberEnv(env.OPENCLAW_CODEX_COMPUTER_USE_MARKETPLACE_DISCOVERY_TIMEOUT_MS), DEFAULT_CODEX_COMPUTER_USE_MARKETPLACE_DISCOVERY_TIMEOUT_MS);
+	const liveTestTimeoutMs = normalizePositiveNumber(params.overrides?.liveTestTimeoutMs ?? config.liveTestTimeoutMs ?? readNumberEnv(env.OPENCLAW_CODEX_COMPUTER_USE_LIVE_TEST_TIMEOUT_MS), DEFAULT_CODEX_COMPUTER_USE_LIVE_TEST_TIMEOUT_MS);
+	const toolCallTimeoutMs = normalizePositiveNumber(params.overrides?.toolCallTimeoutMs ?? config.toolCallTimeoutMs ?? readNumberEnv(env.OPENCLAW_CODEX_COMPUTER_USE_TOOL_CALL_TIMEOUT_MS), DEFAULT_CODEX_COMPUTER_USE_TOOL_CALL_TIMEOUT_MS);
+	const healthCheckIntervalMinutes = normalizeComputerUseHealthCheckIntervalMinutes(params.overrides?.healthCheckIntervalMinutes ?? config.healthCheckIntervalMinutes ?? readNumberEnv(env.OPENCLAW_CODEX_COMPUTER_USE_HEALTH_CHECK_INTERVAL_MINUTES));
+	const healthCheckEnabled = params.overrides?.healthCheckEnabled ?? config.healthCheckEnabled ?? readBooleanEnv(env.OPENCLAW_CODEX_COMPUTER_USE_HEALTH_CHECK_ENABLED) ?? false;
+	const pluginCacheMode = normalizeComputerUsePluginCacheMode(params.overrides?.pluginCacheMode) ?? normalizeComputerUsePluginCacheMode(config.pluginCacheMode) ?? normalizeComputerUsePluginCacheMode(env.OPENCLAW_CODEX_COMPUTER_USE_PLUGIN_CACHE_MODE) ?? "independent";
+	const strictReadiness = params.overrides?.strictReadiness ?? config.strictReadiness ?? readBooleanEnv(env.OPENCLAW_CODEX_COMPUTER_USE_STRICT_READINESS) ?? false;
+	const autoRepair = params.overrides?.autoRepair ?? config.autoRepair ?? readBooleanEnv(env.OPENCLAW_CODEX_COMPUTER_USE_AUTO_REPAIR) ?? false;
+	return {
+		enabled: params.overrides?.enabled ?? config.enabled ?? readBooleanEnv(env.OPENCLAW_CODEX_COMPUTER_USE) ?? Boolean(autoInstall || marketplaceSource || marketplacePath || marketplaceName || configuredPluginName || configuredMcpServerName),
+		autoInstall,
+		marketplaceDiscoveryTimeoutMs,
+		liveTestTimeoutMs,
+		toolCallTimeoutMs,
+		healthCheckEnabled,
+		healthCheckIntervalMinutes,
+		pluginCacheMode,
+		strictReadiness,
+		autoRepair,
+		pluginName: configuredPluginName ?? "computer-use",
+		mcpServerName: configuredMcpServerName ?? "computer-use",
+		...marketplaceSource ? { marketplaceSource } : {},
+		...marketplacePath ? { marketplacePath } : {},
+		...marketplaceName ? { marketplaceName } : {}
+	};
 }
-function resolveArgs(configArgs, envArgs) {
-	if (Array.isArray(configArgs)) return configArgs.map((entry) => readNonEmptyString(entry)).filter((entry) => entry !== void 0);
-	if (typeof configArgs === "string") return splitShellWords(configArgs);
-	return splitShellWords(envArgs ?? "");
+function normalizeComputerUseHealthCheckIntervalMinutes(value) {
+	return value === 30 || value === 60 || value === 120 || value === 240 ? value : 60;
 }
-function readNonEmptyString(value) {
-	if (typeof value !== "string") return;
-	return value.trim() || void 0;
+function normalizeComputerUsePluginCacheMode(value) {
+	return value === "shared" || value === "independent" ? value : null;
 }
-function hashSecretForKey(value, label) {
-	if (!value) return null;
-	return createHmac("sha256", START_OPTIONS_KEY_SECRET).update(label).update("\0").update(value).digest("hex");
+function codexAppServerStartOptionsKey(options, params = {}) {
+	return JSON.stringify({
+		transport: options.transport,
+		command: options.command,
+		commandSource: options.commandSource ?? null,
+		managedCommandOrder: options.managedCommandOrder ?? "package-first",
+		managedComputerUsePluginNames: [...options.managedComputerUsePluginNames ?? []].toSorted(),
+		managedFallbackCommandPaths: [...options.managedFallbackCommandPaths ?? []],
+		args: options.args,
+		cwd: options.cwd ?? null,
+		url: options.url ?? null,
+		authToken: hashSecretForKey(options.authToken, "authToken"),
+		headers: Object.entries(options.headers).toSorted(([left], [right]) => left.localeCompare(right)).map(([key, value]) => [key, hashSecretForKey(value, `header:${key}`)]),
+		env: Object.entries(options.env ?? {}).toSorted(([left], [right]) => left.localeCompare(right)).map(([key, value]) => [key, hashSecretForKey(value, `env:${key}`)]),
+		clearEnv: [...options.clearEnv ?? []].toSorted(),
+		authProfileId: params.authProfileId ?? null,
+		authBindingFingerprint: params.authBindingFingerprint ?? null,
+		agentDir: params.agentDir ?? null,
+		fallbackApiKeyCacheKey: params.fallbackApiKeyCacheKey ?? null
+	});
 }
-function getStartOptionsKeySecret() {
-	const globalState = globalThis;
-	globalState[START_OPTIONS_KEY_SECRET_SYMBOL] ??= randomBytes(32);
-	return globalState[START_OPTIONS_KEY_SECRET_SYMBOL];
+function codexSandboxPolicyForTurn(mode, cwd, nativeArgs = []) {
+	if (mode === "danger-full-access") return { type: "dangerFullAccess" };
+	if (mode === "read-only") return {
+		type: "readOnly",
+		networkAccess: false
+	};
+	let excludeTmpdirEnvVar = false;
+	let excludeSlashTmp = false;
+	for (let index = 0; index < nativeArgs.length; index += 1) {
+		const arg = nativeArgs[index];
+		const override = arg === "-c" || arg === "--config" ? nativeArgs[++index] : arg?.startsWith("--config=") ? arg.slice(9) : void 0;
+		if (!override) continue;
+		const separator = override.indexOf("=");
+		if (separator < 0) continue;
+		const key = override.slice(0, separator).trim();
+		const value = override.slice(separator + 1).trim();
+		if (value !== "true" && value !== "false") continue;
+		if (key === "sandbox_workspace_write.exclude_tmpdir_env_var") excludeTmpdirEnvVar = value === "true";
+		else if (key === "sandbox_workspace_write.exclude_slash_tmp") excludeSlashTmp = value === "true";
+	}
+	return {
+		type: "workspaceWrite",
+		writableRoots: [cwd],
+		networkAccess: false,
+		excludeTmpdirEnvVar,
+		excludeSlashTmp
+	};
 }
-function splitShellWords(value) {
-	const words = [];
-	let current = "";
-	let quote = null;
-	for (const char of value) {
-		if (quote) {
-			if (char === quote) quote = null;
-			else current += char;
-			continue;
-		}
-		if (char === "\"" || char === "'") {
-			quote = char;
-			continue;
-		}
-		if (/\s/.test(char)) {
-			if (current) {
-				words.push(current);
-				current = "";
+/** Resolves the passive supervision control connection without changing harness defaults. */
+function resolveCodexSupervisionAppServerRuntimeOptions(params = {}) {
+	const pluginConfig = readCodexPluginConfig(params.pluginConfig);
+	const appServer = pluginConfig.appServer ?? {};
+	const homeScope = resolveCodexAppServerHomeScope({
+		appServer,
+		connectionScope: "supervision"
+	});
+	return resolveCodexAppServerRuntimeOptions({
+		...params,
+		pluginConfig: {
+			...pluginConfig,
+			appServer: {
+				...appServer,
+				homeScope
 			}
-			continue;
 		}
-		current += char;
-	}
-	if (current) words.push(current);
-	return words;
+	});
 }
 //#endregion
 //#region extensions/codex/src/app-server/session-binding.ts
@@ -1335,6 +1374,8 @@ var session_binding_exports = /* @__PURE__ */ __exportAll({
 	readStoredCodexAppServerBinding: () => readStoredCodexAppServerBinding,
 	reclaimCurrentCodexSessionGeneration: () => reclaimCurrentCodexSessionGeneration,
 	resolveCodexAppServerBindingModelProvider: () => resolveCodexAppServerBindingModelProvider,
+	resolveCodexRunSessionBindingAuthority: () => resolveCodexRunSessionBindingAuthority,
+	scopeCodexRunBindingStore: () => scopeCodexRunBindingStore,
 	sessionBindingIdentity: () => sessionBindingIdentity
 });
 const CODEX_APP_SERVER_NATIVE_AUTH_PROVIDER = "openai";
@@ -1348,7 +1389,7 @@ const BINDING_LEASE_RENEW_INTERVAL_MS = Math.floor(BINDING_LEASE_STALE_MS / 3);
 const PHYSICAL_SESSION_RETIRE_TTL_MS = BINDING_LEASE_WAIT_MS;
 /** Resolves the same agent scope OpenClaw uses for transcript/session ownership. */
 function sessionBindingIdentity(params) {
-	const { sessionAgentId } = resolveSessionAgentIds(params);
+	const { sessionAgentId } = resolveSessionAgentIds$1(params);
 	const sessionKey = params.sessionKey?.trim();
 	return {
 		kind: "session",
@@ -1357,6 +1398,25 @@ function sessionBindingIdentity(params) {
 		...sessionKey ? { sessionKey } : {}
 	};
 }
+/** Decides whether a run may share the durable stable-key binding owner. */
+function resolveCodexRunSessionBindingAuthority(params) {
+	const sessionKey = params.identity.sessionKey?.trim();
+	if (!sessionKey) return "ephemeral";
+	try {
+		const storePath = params.storePath?.trim() || resolveStorePath(params.config?.session?.store, { agentId: params.identity.agentId });
+		const entry = getSessionEntry({
+			agentId: params.identity.agentId,
+			hydrateSkillPromptRefs: false,
+			readConsistency: "latest",
+			sessionKey,
+			storePath
+		});
+		if (!entry) return "ephemeral";
+		return entry.sessionId === params.identity.sessionId ? "current" : "superseded";
+	} catch {
+		return "superseded";
+	}
+}
 /** Builds the terminal coordination error used when a newer OpenClaw session owns the binding. */
 function createCodexSessionGenerationSupersededError(sessionId) {
 	return new AgentHarnessSessionSupersededError(`Codex session generation is no longer current: ${sessionId}`);
@@ -1424,6 +1484,7 @@ const threadBindingSchema = z.object({
 	threadId: z.string().refine((value) => Boolean(value.trim())),
 	clientId: optionalStringSchema,
 	cwd: z.string(),
+	rolloutPath: optionalNonBlankStringSchema,
 	connectionScope: z.literal("supervision").optional(),
 	supervisionSourceThreadId: z.string().trim().min(1).optional(),
 	authProfileId: optionalStringSchema,
@@ -1447,6 +1508,7 @@ const threadBindingSchema = z.object({
 	dynamicToolsFingerprint: optionalStringSchema,
 	dynamicToolsContainDeferred: optionalBooleanSchema,
 	webSearchThreadConfigFingerprint: optionalStringSchema,
+	nativeSkillIsolationFingerprint: optionalStringSchema,
 	userMcpServersFingerprint: optionalStringSchema,
 	mcpServersFingerprint: optionalStringSchema,
 	ringZeroConfigFingerprint: optionalStringSchema,
@@ -1585,6 +1647,22 @@ function createStoredCodexAppServerBinding(value, options = {}) {
 function bindingLeaseLostError(key, cause) {
 	return new Error(`Lost Codex binding lease: ${key}`, cause === void 0 ? void 0 : { cause });
 }
+/** Carries one prepared run identity through callers that rederive it from public params. */
+function scopeCodexRunBindingStore(params) {
+	const mapSessionIdentity = (identity) => identity.agentId === params.logicalIdentity.agentId && identity.sessionId === params.logicalIdentity.sessionId && identity.sessionKey?.trim() === params.logicalIdentity.sessionKey?.trim() ? params.physicalIdentity : identity;
+	const mapIdentity = (identity) => identity.kind === "session" ? mapSessionIdentity(identity) : identity;
+	return {
+		read: (identity) => params.bindingStore.read(mapIdentity(identity)),
+		hasOtherThreadOwner: (threadId, identity) => params.bindingStore.hasOtherThreadOwner(threadId, identity ? mapIdentity(identity) : void 0),
+		mutate: (identity, mutation) => params.bindingStore.mutate(mapIdentity(identity), mutation),
+		prepareSessionGenerationReclaim: (identity) => params.bindingStore.prepareSessionGenerationReclaim(mapSessionIdentity(identity)),
+		adoptSessionGeneration: (identity, expectedPreviousSessionId) => params.bindingStore.adoptSessionGeneration(mapSessionIdentity(identity), expectedPreviousSessionId),
+		resetSessionGeneration: (identity) => params.bindingStore.resetSessionGeneration(mapSessionIdentity(identity)),
+		retireSessionGeneration: (identity) => params.bindingStore.retireSessionGeneration(mapSessionIdentity(identity)),
+		withThreadArchiveFence: (run) => params.bindingStore.withThreadArchiveFence(run),
+		withLease: (identity, run) => params.bindingStore.withLease(mapIdentity(identity), run)
+	};
+}
 /** Lets the authoritative OpenClaw session generation claim a stale stable binding row. */
 async function reclaimCurrentCodexSessionGeneration(params) {
 	const sessionKey = params.identity.sessionKey?.trim();
@@ -1592,7 +1670,7 @@ async function reclaimCurrentCodexSessionGeneration(params) {
 	const plan = await params.bindingStore.prepareSessionGenerationReclaim(params.identity);
 	if (plan.kind === "resolved") return plan.result;
 	try {
-		const storePath = resolveStorePath(params.config?.session?.store, { agentId: params.identity.agentId });
+		const storePath = params.storePath?.trim() || resolveStorePath(params.config?.session?.store, { agentId: params.identity.agentId });
 		if (getSessionEntry({
 			agentId: params.identity.agentId,
 			hydrateSkillPromptRefs: false,
@@ -1727,10 +1805,17 @@ function createCodexAppServerBindingStore(state) {
 				result: true
 			};
 			const currentSessionId = current.sessionId;
-			if (!currentSessionId || currentSessionId === identity.sessionId) return {
+			if (!currentSessionId) return {
 				kind: "resolved",
 				result: current.state !== "cleared" || current.retired !== true
 			};
+			if (currentSessionId === identity.sessionId) return current.state === "cleared" && current.retired === true ? {
+				kind: "verify",
+				expectedPreviousSessionId: currentSessionId
+			} : {
+				kind: "resolved",
+				result: true
+			};
 			return {
 				kind: "verify",
 				expectedPreviousSessionId: currentSessionId
@@ -1746,7 +1831,18 @@ function createCodexAppServerBindingStore(state) {
 					if (mutation.kind === "reclaim-generation") {
 						if (identity.kind !== "session" || !identity.sessionKey?.trim()) return { result: false };
 						if (!current) return { result: true };
-						if (ownsGeneration) return { result: current.state !== "cleared" || current.retired !== true };
+						if (ownsGeneration) {
+							if (current.state === "cleared" && current.retired === true && current.sessionId === mutation.expectedPreviousSessionId) return {
+								result: true,
+								next: {
+									version: 1,
+									state: "cleared",
+									sessionId: identity.sessionId,
+									...ownedLease
+								}
+							};
+							return { result: current.state !== "cleared" || current.retired !== true };
+						}
 						if (current.sessionId !== mutation.expectedPreviousSessionId) return { result: false };
 						if (current.state === "active" && current.binding.connectionScope === "supervision") return { result: false };
 						return {
@@ -1825,6 +1921,25 @@ function createCodexAppServerBindingStore(state) {
 				});
 			});
 		},
+		async resetSessionGeneration(identity) {
+			return await runBindingMutation(async () => {
+				const key = bindingStoreKey(identity);
+				return await transactKey(key, (current, leaseToken) => {
+					if (!current) return { result: "absent" };
+					if (!ownsStoredSessionGeneration(identity, current)) return { result: "conflict" };
+					if (current.state === "cleared" && current.retired === true) return { result: "conflict" };
+					return {
+						result: "applied",
+						next: {
+							version: 1,
+							state: "cleared",
+							...storedSessionGeneration(identity, current),
+							...current.lease && current.lease.token === leaseToken ? { lease: current.lease } : {}
+						}
+					};
+				}, leaseContext.getStore()?.has(key) ? void 0 : 1);
+			});
+		},
 		async retireSessionGeneration(identity) {
 			return await runBindingMutation(async () => {
 				const key = bindingStoreKey(identity);
@@ -1956,7 +2071,7 @@ function bindingStoreKey(identity) {
 		const sessionId = identity.sessionId.trim();
 		if (!rawAgentId) throw new Error("Codex app-server binding requires an agent id");
 		if (!sessionId) throw new Error("Codex app-server binding requires a session id");
-		const agentId = resolveSessionAgentIds({ agentId: rawAgentId }).sessionAgentId;
+		const agentId = resolveSessionAgentIds$1({ agentId: rawAgentId }).sessionAgentId;
 		const sessionKey = identity.sessionKey?.trim();
 		if (sessionKey) return `session-key:${agentId}:${createHash("sha256").update(sessionKey).digest("base64url")}`;
 		return `session:${agentId}:${sessionId}`;
@@ -2096,4 +2211,4 @@ function resolveCodexAppServerBindingModelProvider(params) {
 	return params.modelProvider?.trim() || (isCodexAppServerNativeAuthProfile(params) ? PUBLIC_OPENAI_MODEL_PROVIDER : void 0);
 }
 //#endregion
-export { withMcpElicitationsApprovalPolicy as A, resolveCodexAppServerUserHomeDir as C, resolveCodexSupervisionAppServerRuntimeOptions as D, resolveCodexPluginsPolicy as E, resolveOpenClawExecPolicyForCodexAppServer as O, resolveCodexAppServerStartOptionsForAgent as S, resolveCodexModelBackedReviewerPolicyContext as T, isCodexAppServerApprovalPolicyAllowedByRequirements as _, hashCodexAppServerBindingFingerprint as a, readCodexPluginConfig as b, reclaimCurrentCodexSessionGeneration as c, CODEX_PLUGINS_MARKETPLACE_NAME as d, CODEX_PLUGINS_WORKSPACE_MARKETPLACE_NAME as f, codexSandboxPolicyForTurn as g, codexAppServerStartOptionsKey as h, createCodexSessionGenerationSupersededError as i, shouldAutoApproveCodexAppServerApprovals as k, sessionBindingIdentity as l, canUseCodexModelBackedApprovalsReviewerForModel as m, assertCodexBindingMayBeReplaced as n, isCodexAppServerNativeAuthProfile as o, assertCodexAppServerConnectionSecurity as p, bindingStoreKey as r, normalizeCodexAppServerBindingModelProvider as s, CODEX_APP_SERVER_BINDING_GUARDED_REQUEST_TIMEOUT_MS as t, session_binding_exports as u, isCodexFastServiceTier as v, resolveCodexComputerUseConfig as w, resolveCodexAppServerRuntimeOptions as x, isCodexSandboxExecServerEnabled as y };
+export { resolveOpenClawExecPolicyForCodexAppServer as A, canUseCodexModelBackedApprovalsReviewerForModel as C, isCodexSandboxExecServerEnabled as D, isCodexAppServerApprovalPolicyAllowedByRequirements as E, CODEX_PLUGINS_MARKETPLACE_NAME as M, CODEX_PLUGINS_WORKSPACE_MARKETPLACE_NAME as N, readCodexPluginConfig as O, withMcpElicitationsApprovalPolicy as S, resolveCodexModelBackedReviewerPolicyContext as T, resolveCodexAppServerStartOptionsForAgent as _, hashCodexAppServerBindingFingerprint as a, assertCodexAppServerConnectionSecurity as b, reclaimCurrentCodexSessionGeneration as c, sessionBindingIdentity as d, session_binding_exports as f, resolveCodexAppServerRuntimeOptions as g, resolveCodexAppServerHomeScope as h, createCodexSessionGenerationSupersededError as i, isCodexFastServiceTier as j, resolveCodexPluginsPolicy as k, resolveCodexRunSessionBindingAuthority as l, codexSandboxPolicyForTurn as m, assertCodexBindingMayBeReplaced as n, isCodexAppServerNativeAuthProfile as o, codexAppServerStartOptionsKey as p, bindingStoreKey as r, normalizeCodexAppServerBindingModelProvider as s, CODEX_APP_SERVER_BINDING_GUARDED_REQUEST_TIMEOUT_MS as t, scopeCodexRunBindingStore as u, resolveCodexComputerUseConfig as v, resolveCodexAppServerUserHomeDir as w, shouldAutoApproveCodexAppServerApprovals as x, resolveCodexSupervisionAppServerRuntimeOptions as y };