@openclaw/codex 2026.7.2-beta.4 → 2026.7.2-beta.7

package/dist/{thread-lifecycle-cqrOlJkq.js → thread-lifecycle-DF53ogiA.js}

@@ -1,19 +1,147 @@
-import { G as isCodexAppServerPrewriteRequestCancellationError, H as isCodexAppServerConnectionClosedError, Q as isJsonObject, R as CodexAppServerRpcError, Z as flattenCodexDynamicToolFunctions, d as retireSharedCodexAppServerClientIfCurrent, n as clearSharedCodexAppServerClientIfCurrentAndUnclaimed, o as isCodexAppServerStartSelectionChangedError, q as resolveCodexAppServerClientInstanceId, t as clearSharedCodexAppServerClientIfCurrent, z as getCodexAppServerClientInstanceId } from "./shared-client-wmgNFNYp.js";
-import { E as resolveCodexPluginsPolicy, a as hashCodexAppServerBindingFingerprint, c as reclaimCurrentCodexSessionGeneration, d as CODEX_PLUGINS_MARKETPLACE_NAME, f as CODEX_PLUGINS_WORKSPACE_MARKETPLACE_NAME, g as codexSandboxPolicyForTurn, i as createCodexSessionGenerationSupersededError, l as sessionBindingIdentity, n as assertCodexBindingMayBeReplaced, o as isCodexAppServerNativeAuthProfile, s as normalizeCodexAppServerBindingModelProvider } from "./session-binding-ZSMX1omP.js";
-import { _ as assertCodexThreadStartResponse, a as projectBoundedCodexThreadHistory, g as assertCodexThreadResumeResponse, h as assertCodexThreadForkResponse } from "./transcript-mirror-2p7kl6e4.js";
-import { a as serializeCodexAppInventoryError, i as defaultCodexAppInventoryCache, t as buildCodexAppServerConnectionFingerprint } from "./plugin-app-cache-key-CvzvmBRz.js";
+import { D as resolveCodexAppServerClientInstanceId, O as consumeCodexAppServerLiveThread, S as isCodexAppServerConnectionClosedError, T as isCodexAppServerPrewriteRequestCancellationError, U as flattenCodexDynamicToolFunctions, W as isJsonObject, n as clearSharedCodexAppServerClientIfCurrentAndUnclaimed, p as retireSharedCodexAppServerClientIfCurrent, s as isCodexAppServerStartSelectionChangedError, t as clearSharedCodexAppServerClientIfCurrent, v as CodexAppServerRpcError, y as getCodexAppServerClientInstanceId } from "./shared-client-DTbvH-XV.js";
+import { M as CODEX_PLUGINS_MARKETPLACE_NAME, N as CODEX_PLUGINS_WORKSPACE_MARKETPLACE_NAME, a as hashCodexAppServerBindingFingerprint, c as reclaimCurrentCodexSessionGeneration, d as sessionBindingIdentity, i as createCodexSessionGenerationSupersededError, k as resolveCodexPluginsPolicy, m as codexSandboxPolicyForTurn, n as assertCodexBindingMayBeReplaced, o as isCodexAppServerNativeAuthProfile, s as normalizeCodexAppServerBindingModelProvider } from "./session-binding-BXpo9ymA.js";
+import { _ as assertCodexThreadStartResponse, a as projectBoundedCodexThreadHistory, g as assertCodexThreadResumeResponse, h as assertCodexThreadForkResponse } from "./transcript-mirror-DzsdNCf5.js";
+import { a as serializeCodexAppInventoryError, i as defaultCodexAppInventoryCache, t as buildCodexAppServerConnectionFingerprint } from "./plugin-app-cache-key-DztPafOA.js";
 import { t as isIncognitoSessionKey } from "./incognito-session-ET_ufDH-.js";
-import { sliceUtf16Safe, truncateUtf16Safe } from "openclaw/plugin-sdk/text-utility-runtime";
+import fs from "node:fs/promises";
+import path from "node:path";
+import { SKILL_WORKSHOP_TOOL_NAME, buildSkillWorkshopPromptSection, embeddedAgentLog, formatErrorMessage, isActiveHarnessContextEngine, isHostScopedAgentToolActive } from "openclaw/plugin-sdk/agent-harness-runtime";
 import * as crypto$1 from "node:crypto";
 import crypto from "node:crypto";
+import os from "node:os";
 import { isRecord } from "openclaw/plugin-sdk/string-coerce-runtime";
-import { SKILL_WORKSHOP_TOOL_NAME, buildSkillWorkshopPromptSection, embeddedAgentLog, formatErrorMessage, isActiveHarnessContextEngine, isHostScopedAgentToolActive } from "openclaw/plugin-sdk/agent-harness-runtime";
+import { sliceUtf16Safe, truncateUtf16Safe } from "openclaw/plugin-sdk/text-utility-runtime";
 import { redactSensitiveFieldValue, redactToolPayloadText } from "openclaw/plugin-sdk/logging-core";
+import { resolveRequiredHomeDir, resolveStateDir } from "openclaw/plugin-sdk/state-paths";
+import { listRegisteredPluginAgentPromptGuidance } from "openclaw/plugin-sdk/plugin-runtime";
 import { buildCodexUserMcpServersThreadConfigPatchForRuntime } from "openclaw/plugin-sdk/codex-mcp-projection";
 import { isDiagnosticFlagEnabled } from "openclaw/plugin-sdk/diagnostic-runtime";
-import { listRegisteredPluginAgentPromptGuidance } from "openclaw/plugin-sdk/plugin-runtime";
 import { GPT5_HEARTBEAT_PROMPT_OVERLAY } from "openclaw/plugin-sdk/provider-model-shared";
 import { INLINE_IMAGE_DATA_URL_PREFIX, sanitizeInlineImageDataUrl } from "openclaw/plugin-sdk/inline-image-data-url-runtime";
+//#region extensions/codex/src/app-server/attempt-client-cleanup.ts
+/**
+* Best-effort cleanup helpers for Codex app-server startup attempts and turns.
+*/
+/** Timeout for best-effort app-server turn interruption during cleanup. */
+const CODEX_APP_SERVER_INTERRUPT_TIMEOUT_MS = 5e3;
+/** Timeout for best-effort thread unsubscribe during cleanup. */
+const CODEX_APP_SERVER_UNSUBSCRIBE_TIMEOUT_MS = 5e3;
+/** Raised when a thread subscription may be live on a client OpenClaw no longer controls. */
+var CodexAppServerUnsafeSubscriptionError = class extends Error {
+	constructor(message, options) {
+		super(message, options);
+		this.name = "CodexAppServerUnsafeSubscriptionError";
+	}
+};
+function isCodexAppServerUnsafeSubscriptionError(error) {
+	return error instanceof CodexAppServerUnsafeSubscriptionError;
+}
+/** Asserts Codex resumed the exact thread this attempt subscribed to. */
+function assertCodexThreadResumeSubscription(requestedThreadId, returnedThreadId) {
+	if (returnedThreadId !== requestedThreadId) throw new CodexAppServerUnsafeSubscriptionError(`Codex thread/resume returned ${returnedThreadId} for ${requestedThreadId}`);
+}
+async function closeClientAndWaitIfAvailable(client) {
+	const closeable = client;
+	if (typeof closeable.closeAndWait === "function") {
+		await closeable.closeAndWait();
+		return;
+	}
+	closeable.close?.();
+}
+async function closeCodexStartupClientBestEffort(client) {
+	if (!client) return;
+	const unclaimedSharedClient = clearSharedCodexAppServerClientIfCurrentAndUnclaimed(client);
+	if (unclaimedSharedClient.closed) {
+		await closeClientAndWaitIfAvailable(client);
+		return;
+	}
+	if (unclaimedSharedClient.found) {
+		if (retireSharedCodexAppServerClientIfCurrent(client)?.closed) await closeClientAndWaitIfAvailable(client);
+		return;
+	}
+	const retiredSharedClient = retireSharedCodexAppServerClientIfCurrent(client);
+	if (retiredSharedClient) {
+		if (retiredSharedClient.closed) await closeClientAndWaitIfAvailable(client);
+		return;
+	}
+	if (clearSharedCodexAppServerClientIfCurrent(client)) {
+		await closeClientAndWaitIfAvailable(client);
+		return;
+	}
+	await closeClientAndWaitIfAvailable(client);
+}
+/** Sends a turn interrupt without blocking abort cleanup on app-server errors. */
+function interruptCodexTurnBestEffort(client, params) {
+	interruptCodexTurnAndWaitBestEffort(client, params);
+}
+/** Sends a bounded turn interrupt and waits for Codex to confirm terminal abort handling. */
+async function interruptCodexTurnAndWaitBestEffort(client, params) {
+	const requestOptions = params.timeoutMs && Number.isFinite(params.timeoutMs) && params.timeoutMs > 0 ? { timeoutMs: params.timeoutMs } : void 0;
+	const requestParams = {
+		threadId: params.threadId,
+		turnId: params.turnId
+	};
+	try {
+		await (requestOptions ? client.request("turn/interrupt", requestParams, requestOptions) : client.request("turn/interrupt", requestParams));
+	} catch (error) {
+		embeddedAgentLog.debug("codex app-server turn interrupt failed during abort", { error });
+	}
+}
+/** Unsubscribes from a thread while swallowing cleanup-only failures. */
+async function unsubscribeCodexThreadBestEffort(client, params) {
+	try {
+		await client.request("thread/unsubscribe", { threadId: params.threadId }, { timeoutMs: params.timeoutMs });
+		return true;
+	} catch (error) {
+		embeddedAgentLog.debug("codex app-server thread unsubscribe cleanup failed", {
+			threadId: params.threadId,
+			error
+		});
+		return false;
+	}
+}
+/**
+* Retires the shared client after a timed-out turn so later runs do not reuse a
+* potentially wedged app-server connection.
+*/
+async function retireCodexAppServerClientAfterTimedOutTurn(client, params) {
+	const retiredSharedClient = retireSharedCodexAppServerClientIfCurrent(client, { failActiveLeases: params.suspectPhysicalClient });
+	const detachedSharedClient = Boolean(retiredSharedClient);
+	if (!(params.suspectPhysicalClient && (retiredSharedClient?.closed ?? false))) {
+		interruptCodexTurnBestEffort(client, {
+			threadId: params.threadId,
+			turnId: params.turnId,
+			timeoutMs: CODEX_APP_SERVER_INTERRUPT_TIMEOUT_MS
+		});
+		await unsubscribeCodexThreadBestEffort(client, {
+			threadId: params.threadId,
+			timeoutMs: CODEX_APP_SERVER_UNSUBSCRIBE_TIMEOUT_MS
+		});
+	}
+	let closedClient = retiredSharedClient?.closed ?? false;
+	if (!detachedSharedClient) {
+		const close = client.close;
+		if (typeof close === "function") try {
+			close.call(client);
+			closedClient = true;
+		} catch (error) {
+			embeddedAgentLog.debug("codex app-server client close failed during timeout cleanup", {
+				threadId: params.threadId,
+				turnId: params.turnId,
+				error
+			});
+		}
+	}
+	embeddedAgentLog.warn("codex app-server client retired after timed-out turn", {
+		threadId: params.threadId,
+		turnId: params.turnId,
+		reason: params.reason,
+		detachedSharedClient,
+		closedClient,
+		activeSharedClientLeases: retiredSharedClient?.activeLeases ?? 0
+	});
+}
+//#endregion
 //#region extensions/codex/src/app-server/event-projector-values.ts
 function readString(record, key) {
 	const value = record[key];
@@ -96,6 +224,7 @@ function readItem(value) {
 * plugin-owned apps can be exposed to a native Codex thread.
 */
 const CODEX_PLUGINS_REMOTE_MARKETPLACE_NAME = `${CODEX_PLUGINS_MARKETPLACE_NAME}-remote`;
+const CODEX_PLUGINS_API_MARKETPLACE_NAME = "openai-api-curated";
 /** Reads configured Codex plugin state and maps owned apps to readiness diagnostics. */
 async function readCodexPluginInventory(params) {
 	const policy = params.policy ?? resolveCodexPluginsPolicy(params.pluginConfig);
@@ -108,21 +237,11 @@ async function readCodexPluginInventory(params) {
 		}]
 	};
 	const appInventory = readCachedAppInventory(params);
-	const curatedListed = await listCodexPluginMetadata(params, "curated-global", {});
-	const shouldListWorkspacePlugins = policy.pluginPolicies.some((pluginPolicy) => pluginPolicy.enabled && pluginPolicy.marketplaceName === "workspace-directory");
-	let workspaceListResult;
-	if (shouldListWorkspacePlugins) try {
-		workspaceListResult = {
-			kind: "listed",
-			response: await listCodexPluginMetadata(params, "workspace-directory", {
-				cwds: [],
-				marketplaceKinds: [CODEX_PLUGINS_WORKSPACE_MARKETPLACE_NAME]
-			})
-		};
-	} catch (error) {
-		if (!(error instanceof CodexAppServerRpcError)) throw error;
-		workspaceListResult = { kind: "rejected" };
-	}
+	const installedPlugins = await readInstalledCodexPluginMetadata({
+		...params,
+		policy
+	});
+	let curatedCatalog;
 	const diagnostics = [];
 	const records = [];
 	if (appInventory?.state === "missing") diagnostics.push({
@@ -134,10 +253,15 @@ async function readCodexPluginInventory(params) {
 		message: "Cached Codex app inventory is stale; using stale app readiness and refreshing."
 	});
 	for (const pluginPolicy of policy.pluginPolicies) {
-		if (!pluginPolicy.enabled) continue;
-		const listed = pluginPolicy.marketplaceName === "workspace-directory" ? workspaceListResult?.kind === "listed" ? workspaceListResult.response : void 0 : curatedListed;
-		const hasMarketplace = pluginPolicy.marketplaceName === "workspace-directory" ? listed?.marketplaces.some((entry) => entry.name === CODEX_PLUGINS_WORKSPACE_MARKETPLACE_NAME) === true : listed?.marketplaces.some(isOpenAiCuratedMarketplace) === true;
-		if (!listed || !hasMarketplace) {
+		if (!pluginPolicy.enabled && !policy.allowAllPlugins) continue;
+		let listed = installedPlugins;
+		let resolvedPlugin = pluginPolicy.marketplaceName === "workspace-directory" ? findWorkspaceMarketplacePlugin(listed, pluginPolicy.pluginName) : findOpenAiCuratedMarketplacePlugin(listed, pluginPolicy.pluginName);
+		if (!resolvedPlugin && pluginPolicy.enabled && pluginPolicy.marketplaceName === "openai-curated") {
+			curatedCatalog ??= listCodexPluginMetadata(params);
+			listed = await curatedCatalog;
+			resolvedPlugin = findOpenAiCuratedMarketplacePlugin(listed, pluginPolicy.pluginName);
+		}
+		if (!(pluginPolicy.marketplaceName === "workspace-directory" ? listed.marketplaces.some((entry) => entry.name === "workspace-directory") : listed.marketplaces.some(isOpenAiCuratedMarketplace))) {
 			diagnostics.push({
 				code: "marketplace_missing",
 				plugin: pluginPolicy,
@@ -145,7 +269,6 @@ async function readCodexPluginInventory(params) {
 			});
 			continue;
 		}
-		const resolvedPlugin = pluginPolicy.marketplaceName === "workspace-directory" ? findWorkspaceMarketplacePlugin(listed, pluginPolicy.pluginName) : findOpenAiCuratedMarketplacePlugin(listed, pluginPolicy.pluginName);
 		if (!resolvedPlugin) {
 			diagnostics.push({
 				code: "plugin_missing",
@@ -181,7 +304,7 @@ async function readCodexPluginInventory(params) {
 			policy: pluginPolicy,
 			summary,
 			...detail ? { detail } : {},
-			activationRequired: !summary.installed || !summary.enabled,
+			activationRequired: pluginPolicy.enabled && (!summary.installed || !summary.enabled),
 			authRequired: apps.some((app) => app.needsAuth || !app.accessible),
 			appOwnership,
 			ownedAppIds,
@@ -216,24 +339,41 @@ function resolveRecoverableCodexPluginConfigKeys(params) {
 	return params.policy.pluginPolicies.filter((pluginPolicy) => pluginPolicy.enabled && !isSettledMissingPluginPolicy({
 		pluginPolicy,
 		metadataCache: params.metadataCache,
-		appCacheKey: params.appCacheKey
+		appCacheKey: params.appCacheKey,
+		configCwd: params.configCwd
 	})).map((pluginPolicy) => pluginPolicy.configKey).toSorted();
 }
-async function listCodexPluginMetadata(params, queryKind, requestParams) {
-	if (!params.metadataCache || !params.appCacheKey || queryKind === "workspace-directory") return await params.request("plugin/list", requestParams);
+async function listCodexPluginMetadata(params) {
+	const requestParams = {};
+	if (!params.metadataCache || !params.appCacheKey) return await params.request("plugin/list", requestParams);
 	return (await params.metadataCache.load({
 		appCacheKey: params.appCacheKey,
-		queryKind,
+		queryKind: "curated-global",
 		requestParams,
 		request: async (method, listedParams) => await params.request(method, listedParams),
-		cacheable: (response) => (response.marketplaces ?? []).some((marketplace) => isOpenAiCuratedMarketplace(marketplace))
+		cacheable: (response) => response.marketplaces.some((marketplace) => isOpenAiCuratedMarketplace(marketplace))
+	})).response;
+}
+async function readInstalledCodexPluginMetadata(params) {
+	const requestParams = params.configCwd ? { cwds: [params.configCwd] } : {};
+	if (!params.metadataCache || !params.appCacheKey) return await params.request("plugin/installed", requestParams);
+	return (await params.metadataCache.load({
+		appCacheKey: params.appCacheKey,
+		queryKind: "installed",
+		requestParams,
+		request: async (method, installedParams) => await params.request(method, installedParams),
+		cacheable: (response) => params.policy.pluginPolicies.every((pluginPolicy) => {
+			if (!pluginPolicy.enabled && !params.policy.allowAllPlugins) return true;
+			return pluginPolicy.marketplaceName === "workspace-directory" ? findWorkspaceMarketplacePlugin(response, pluginPolicy.pluginName) !== void 0 : findOpenAiCuratedMarketplacePlugin(response, pluginPolicy.pluginName) !== void 0;
+		})
 	})).response;
 }
 function isSettledMissingPluginPolicy(params) {
-	const queryKind = params.pluginPolicy.marketplaceName === "workspace-directory" ? "workspace-directory" : "curated-global";
-	const listed = params.metadataCache.read(params.appCacheKey, queryKind)?.response;
+	const queryKind = params.pluginPolicy.marketplaceName === "workspace-directory" ? "installed" : "curated-global";
+	const requestParams = queryKind === "installed" && params.configCwd ? { cwds: [params.configCwd] } : {};
+	const listed = params.metadataCache.read(params.appCacheKey, queryKind, requestParams)?.response;
 	if (!listed) return false;
-	if (queryKind === "workspace-directory") return !findWorkspaceMarketplacePlugin(listed, params.pluginPolicy.pluginName);
+	if (queryKind === "installed") return !findWorkspaceMarketplacePlugin(listed, params.pluginPolicy.pluginName);
 	return !findOpenAiCuratedMarketplacePlugin(listed, params.pluginPolicy.pluginName);
 }
 function readCachedAppInventory(params) {
@@ -248,7 +388,7 @@ function readCachedAppInventory(params) {
 }
 async function readPluginDetail(params, marketplace, pluginPolicy, summary, diagnostics) {
 	if (params.readPluginDetails === false) return;
-	if (marketplace.name === "workspace-directory" && marketplace.remoteMarketplaceName && !summary.remotePluginId) {
+	if (marketplace.remoteMarketplaceName && !summary.remotePluginId) {
 		diagnostics.push({
 			code: "plugin_detail_unavailable",
 			plugin: pluginPolicy,
@@ -297,7 +437,7 @@ function resolveOwnedApps(params) {
 			name: app.name,
 			accessible: info.isAccessible,
 			enabled: info.isEnabled,
-			needsAuth: app.needsAuth || !info.isAccessible
+			needsAuth: !info.isAccessible
 		};
 	}).toSorted((left, right) => left.id.localeCompare(right.id));
 }
@@ -335,9 +475,9 @@ function marketplaceRef(marketplace, name) {
 		...!marketplace.path ? { remoteMarketplaceName: marketplace.name } : {}
 	};
 }
-/** True for either supported OpenAI curated marketplace wire name. */
+/** True for any supported OpenAI curated marketplace wire name, matching Codex's own curated predicate. */
 function isOpenAiCuratedMarketplace(marketplace) {
-	return marketplace.name === "openai-curated" || marketplace.name === CODEX_PLUGINS_REMOTE_MARKETPLACE_NAME;
+	return marketplace.name === "openai-curated" || marketplace.name === CODEX_PLUGINS_REMOTE_MARKETPLACE_NAME || marketplace.name === CODEX_PLUGINS_API_MARKETPLACE_NAME;
 }
 //#endregion
 //#region extensions/codex/src/app-server/plugin-activation.ts
@@ -350,6 +490,7 @@ async function ensureCodexPluginActivation(params) {
 		if (!listed.marketplaces.some(isOpenAiCuratedMarketplace)) return activationFailure(params.identity, "marketplace_missing", { message: `Codex marketplace ${CODEX_PLUGINS_MARKETPLACE_NAME} was not found.` });
 		return activationFailure(params.identity, "plugin_missing", { message: `${params.identity.pluginName} was not found in ${CODEX_PLUGINS_MARKETPLACE_NAME}.` });
 	}
+	if (resolved.marketplace.remoteMarketplaceName && !resolved.summary.remotePluginId) return activationFailure(params.identity, "plugin_missing", { message: `${params.identity.pluginName} detail unavailable: Codex did not return a remote plugin id.` });
 	if (resolved.summary.installed && resolved.summary.enabled && !params.installEvenIfActive) return {
 		identity: params.identity,
 		ok: true,
@@ -368,6 +509,7 @@ async function ensureCodexPluginActivation(params) {
 			appCache: params.appCache,
 			appCacheKey: params.appCacheKey,
 			metadataCache: params.metadataCache,
+			deferAppInventoryRefresh: params.deferAppInventoryRefresh,
 			targetAppIds: params.targetAppIds
 		});
 		refreshDiagnostics.push(...refreshResult.diagnostics);
@@ -389,7 +531,7 @@ async function ensureCodexPluginActivation(params) {
 /** Forces Codex plugin, skill, hook, MCP, and app inventory refreshes after activation. */
 async function refreshCodexPluginRuntimeState(params) {
 	const diagnostics = [];
-	await listCuratedCodexPluginMetadata(params);
+	await listCuratedCodexPluginMetadata(params, { forceRefetch: true });
 	await params.request("skills/list", {
 		cwds: [],
 		forceReload: true
@@ -401,7 +543,8 @@ async function refreshCodexPluginRuntimeState(params) {
 	}
 	await params.request("config/mcpServer/reload", void 0);
 	if (params.appCache && params.appCacheKey) {
-		params.appCache.invalidate(params.appCacheKey, "Codex plugin activation changed app inventory");
+		params.appCache.invalidate(params.appCacheKey, "Codex plugin activation changed app inventory", void 0, params.targetAppIds);
+		if (params.deferAppInventoryRefresh) return { diagnostics };
 		const request = async (method, requestParams) => await params.request(method, requestParams);
 		try {
 			await params.appCache.refreshNow({
@@ -416,15 +559,15 @@ async function refreshCodexPluginRuntimeState(params) {
 	}
 	return { diagnostics };
 }
-async function listCuratedCodexPluginMetadata(params) {
-	const requestParams = {};
+async function listCuratedCodexPluginMetadata(params, options = {}) {
+	const requestParams = options.forceRefetch ? { forceRefetch: true } : {};
 	if (!params.metadataCache || !params.appCacheKey) return await params.request("plugin/list", requestParams);
 	return (await params.metadataCache.load({
 		appCacheKey: params.appCacheKey,
 		queryKind: "curated-global",
 		requestParams,
 		request: async (method, listedParams) => await params.request(method, listedParams),
-		cacheable: (response) => (response.marketplaces ?? []).some((marketplace) => isOpenAiCuratedMarketplace(marketplace))
+		cacheable: (response) => response.marketplaces.some((marketplace) => isOpenAiCuratedMarketplace(marketplace))
 	})).response;
 }
 function activationFailure(identity, reason, diagnostic, extraDiagnostics = []) {
@@ -437,6 +580,129 @@ function activationFailure(identity, reason, diagnostic, extraDiagnostics = [])
 	};
 }
 //#endregion
+//#region extensions/codex/src/app-server/plugin-thread-app-admission.ts
+async function refreshCodexPluginAppInventory(params, appCache, options = {}) {
+	if (!params.appCacheKey) return;
+	const request = async (method, requestParams) => await params.request(method, requestParams);
+	try {
+		return await appCache.refreshNow({
+			key: params.appCacheKey,
+			request,
+			nowMs: params.nowMs,
+			forceRefetch: options.forceRefetch,
+			targetAppIds: options.targetAppIds
+		});
+	} catch (error) {
+		embeddedAgentLog.warn("codex plugin thread config app inventory refresh failed", {
+			reason: options.reason,
+			forceRefetch: options.forceRefetch === true,
+			error: serializeCodexAppInventoryError(error)
+		});
+		return;
+	}
+}
+function collectCodexPluginOwnedAppIds(inventory) {
+	return Array.from(new Set(inventory.records.flatMap((record) => record.ownedAppIds).filter(Boolean))).toSorted();
+}
+function collectCodexReservedPluginAppIds(params) {
+	const reserved = new Set(params.inventory.records.flatMap((record) => record.appOwnership === "proven" ? record.ownedAppIds : []));
+	const recordsByConfigKey = new Map(params.inventory.records.map((record) => [record.policy.configKey, record]));
+	const configuredOwnerNames = new Set(params.policy.pluginPolicies.flatMap((policy) => {
+		const record = recordsByConfigKey.get(policy.configKey);
+		return [
+			policy.configKey,
+			policy.pluginName,
+			record?.summary.name,
+			record?.summary.id
+		].filter((name) => Boolean(name)).map(normalizeCodexPluginOwnerName);
+	}));
+	for (const app of params.accountApps) if (app.pluginDisplayNames.some((name) => configuredOwnerNames.has(normalizeCodexPluginOwnerName(name)))) reserved.add(app.id);
+	return reserved;
+}
+function normalizeCodexPluginOwnerName(name) {
+	return name.trim().toLowerCase().replace(/[^a-z0-9]+/g, "");
+}
+async function readCodexThreadAdmissibleAccountApps(params, appCache) {
+	const request = async (method, requestParams) => await params.request(method, requestParams);
+	const cachedInventory = appCache.read({
+		key: params.appCacheKey,
+		request,
+		nowMs: params.nowMs,
+		suppressRefresh: true
+	});
+	const snapshot = cachedInventory.state === "fresh" && !cachedInventory.snapshot?.targetAppIds?.length ? cachedInventory.snapshot : await refreshCodexPluginAppInventory(params, appCache, {
+		forceRefetch: false,
+		reason: "account_apps_all",
+		targetAppIds: []
+	});
+	if (!snapshot) return {
+		apps: [],
+		diagnostic: {
+			code: "account_app_inventory_unavailable",
+			message: "Codex account app inventory was unavailable; account apps were not exposed."
+		}
+	};
+	const installedAppsById = new Map(snapshot.installedApps.map((app) => [app.id, app]));
+	return { apps: snapshot.apps.filter((app) => resolveCodexInstalledAppThreadAdmission(toCodexPluginOwnedAccountApp(app), installedAppsById.get(app.id)) !== "blocked").toSorted((left, right) => left.id.localeCompare(right.id)) };
+}
+function toCodexPluginOwnedAccountApp(app) {
+	return {
+		id: app.id,
+		name: app.name,
+		accessible: app.isAccessible,
+		enabled: app.isEnabled,
+		needsAuth: !app.isAccessible
+	};
+}
+function resolveCodexThreadConfigAppsForRecord(params) {
+	return params.inventory.appInventory?.state === "missing" ? [] : params.record.apps;
+}
+function resolveCodexPluginAppThreadAdmission(app, inventory) {
+	const snapshot = inventory.appInventory?.snapshot;
+	if (!snapshot) return "blocked";
+	return resolveCodexInstalledAppThreadAdmission(app, snapshot.installedApps.find((candidate) => candidate.id === app.id));
+}
+function resolveCodexInstalledAppThreadAdmission(app, installed) {
+	if (!app.accessible || app.needsAuth || !installed) return "blocked";
+	if (installed.enabled && installed.callable) return "ready";
+	return !installed.enabled && !installed.callable ? "provisional" : "blocked";
+}
+async function readCodexConfigForAppAdmission(params) {
+	try {
+		const response = await params.request("config/read", {
+			includeLayers: true,
+			...params.configCwd ? { cwd: params.configCwd } : {}
+		});
+		if (!isJsonObject(response) || !isJsonObject(response.config) || !Array.isArray(response.layers)) throw new Error("Codex config/read omitted effective config or config layers");
+		return {
+			config: response.config,
+			layers: response.layers.flatMap((layer) => {
+				if (!isJsonObject(layer)) throw new Error("Codex config/read returned an invalid config layer");
+				if (layer.disabledReason !== void 0 && layer.disabledReason !== null) {
+					if (typeof layer.disabledReason !== "string") throw new Error("Codex config/read returned an invalid disabled layer");
+					return [];
+				}
+				if (!isJsonObject(layer.config)) throw new Error("Codex config/read returned an invalid layer config");
+				return [layer.config];
+			})
+		};
+	} catch (error) {
+		embeddedAgentLog.warn("codex plugin app admission config read failed", { error: serializeCodexAppInventoryError(error) });
+		return;
+	}
+}
+function resolveCodexExplicitAppEnablement(layersHighestPrecedenceFirst, appId) {
+	for (const layer of layersHighestPrecedenceFirst) {
+		const apps = layer.apps;
+		const app = isJsonObject(apps) ? apps[appId] : void 0;
+		if (isJsonObject(app) && Object.hasOwn(app, "enabled")) return app.enabled === true;
+	}
+}
+function shouldForceRefreshCodexNotReadyPluginApps(params, policy, inventory) {
+	if (!params.appCacheKey || !policy.pluginPolicies.some((plugin) => plugin.enabled) || inventory.appInventory?.state === "missing") return false;
+	return inventory.records.some((record) => record.appOwnership === "proven" && record.ownedAppIds.length > 0 && (record.apps.length === 0 || record.apps.some((app) => !app.accessible)));
+}
+//#endregion
 //#region extensions/codex/src/app-server/plugin-thread-config.ts
 /**
 * Builds Codex thread config patches that expose only policy-approved apps
@@ -490,16 +756,17 @@ async function buildCodexPluginThreadConfig(params) {
 		request: params.request,
 		appCache,
 		appCacheKey: params.appCacheKey,
+		configCwd: params.configCwd,
 		metadataCache: params.metadataCache,
 		nowMs: params.nowMs,
 		suppressAppInventoryRefresh: true
 	}) : emptyCodexPluginInventory(policy);
 	const appInventoryRefreshDeferredForActivation = inventory.records.some((record) => record.activationRequired) && shouldRefreshMissingAppInventory(params, policy, inventory);
 	if (shouldWaitForInitialAppInventory(params, policy, inventory)) {
-		await refreshAppInventoryNow(params, appCache, {
+		await refreshCodexPluginAppInventory(params, appCache, {
 			forceRefetch: false,
 			reason: "initial_missing",
-			targetAppIds: collectInventoryOwnedAppIds(inventory)
+			targetAppIds: collectCodexPluginOwnedAppIds(inventory)
 		});
 		inventory = await readCodexPluginInventory({
 			pluginConfig: params.pluginConfig,
@@ -507,6 +774,7 @@ async function buildCodexPluginThreadConfig(params) {
 			request: params.request,
 			appCache,
 			appCacheKey: params.appCacheKey,
+			configCwd: params.configCwd,
 			metadataCache: params.metadataCache,
 			nowMs: params.nowMs
 		});
@@ -525,6 +793,7 @@ async function buildCodexPluginThreadConfig(params) {
 			appCache,
 			appCacheKey: params.appCacheKey,
 			metadataCache: params.metadataCache,
+			deferAppInventoryRefresh: true,
 			targetAppIds: record.ownedAppIds
 		});
 		activationResults.push(activation);
@@ -537,10 +806,10 @@ async function buildCodexPluginThreadConfig(params) {
 	const postInstallRefreshRequired = activationResults.some((activation) => activation.ok && activation.installAttempted);
 	const deferredMissingRefreshRequired = appInventoryRefreshDeferredForActivation && !postInstallRefreshRequired && shouldRefreshMissingAppInventory(params, policy, inventory);
 	if (postInstallRefreshRequired || deferredMissingRefreshRequired) {
-		await refreshAppInventoryNow(params, appCache, {
+		await refreshCodexPluginAppInventory(params, appCache, {
 			forceRefetch: true,
 			reason: postInstallRefreshRequired ? "post_install" : "deferred_missing",
-			targetAppIds: collectInventoryOwnedAppIds(inventory)
+			targetAppIds: collectCodexPluginOwnedAppIds(inventory)
 		});
 		inventory = await readCodexPluginInventory({
 			pluginConfig: params.pluginConfig,
@@ -548,6 +817,7 @@ async function buildCodexPluginThreadConfig(params) {
 			request: params.request,
 			appCache,
 			appCacheKey: params.appCacheKey,
+			configCwd: params.configCwd,
 			metadataCache: params.metadataCache,
 			nowMs: params.nowMs
 		});
@@ -556,11 +826,11 @@ async function buildCodexPluginThreadConfig(params) {
 			appCacheKey: params.appCacheKey
 		});
 	}
-	if (shouldForceRefreshForNotReadyPluginApps(params, policy, inventory)) {
-		await refreshAppInventoryNow(params, appCache, {
+	if (shouldForceRefreshCodexNotReadyPluginApps(params, policy, inventory)) {
+		await refreshCodexPluginAppInventory(params, appCache, {
 			forceRefetch: true,
 			reason: "not_ready_plugin_apps",
-			targetAppIds: collectInventoryOwnedAppIds(inventory)
+			targetAppIds: collectCodexPluginOwnedAppIds(inventory)
 		});
 		inventory = await readCodexPluginInventory({
 			pluginConfig: params.pluginConfig,
@@ -568,6 +838,7 @@ async function buildCodexPluginThreadConfig(params) {
 			request: params.request,
 			appCache,
 			appCacheKey: params.appCacheKey,
+			configCwd: params.configCwd,
 			metadataCache: params.metadataCache,
 			nowMs: params.nowMs
 		});
@@ -576,12 +847,13 @@ async function buildCodexPluginThreadConfig(params) {
 			appCacheKey: params.appCacheKey
 		});
 	}
-	const accountAppsResult = policy.allowAllPlugins ? await readAccessibleAccountApps(params, appCache) : { apps: [] };
+	const accountAppsResult = policy.allowAllPlugins ? await readCodexThreadAdmissibleAccountApps(params, appCache) : { apps: [] };
 	const diagnostics = [
 		...inventory.diagnostics,
 		...activationDiagnostics,
 		...accountAppsResult.diagnostic ? [accountAppsResult.diagnostic] : []
 	];
+	const provisionalAppIds = /* @__PURE__ */ new Set();
 	const apps = { _default: {
 		enabled: false,
 		destructive_enabled: false,
@@ -589,17 +861,30 @@ async function buildCodexPluginThreadConfig(params) {
 	} };
 	const policyApps = {};
 	const pluginAppIds = {};
-	const pluginOwnedAppIds = new Set(inventory.records.flatMap((record) => record.appOwnership === "proven" ? record.ownedAppIds : []));
+	let configForAppAdmission;
+	const pluginOwnedAppIds = collectCodexReservedPluginAppIds({
+		policy,
+		inventory,
+		accountApps: accountAppsResult.apps
+	});
+	const unresolvedDisabledPluginOwnership = policy.allowAllPlugins ? policy.pluginPolicies.find((pluginPolicy) => !pluginPolicy.enabled && !inventory.records.some((record) => record.policy.configKey === pluginPolicy.configKey && record.detail)) : void 0;
+	if (unresolvedDisabledPluginOwnership) diagnostics.push({
+		code: "account_app_ownership_unavailable",
+		plugin: unresolvedDisabledPluginOwnership,
+		message: `Could not verify disabled Codex plugin app ownership for ${unresolvedDisabledPluginOwnership.pluginName}; account apps were not exposed.`
+	});
 	for (const record of inventory.records) {
+		if (!record.policy.enabled) continue;
 		const activation = activationResults.find((item) => item.identity.configKey === record.policy.configKey);
 		if (activation?.ok === false || record.activationRequired && !activation?.ok) continue;
 		if (record.appOwnership !== "proven") continue;
 		pluginAppIds[record.policy.configKey] = [...record.ownedAppIds].toSorted();
-		for (const app of resolveThreadConfigAppsForRecord({
+		for (const app of resolveCodexThreadConfigAppsForRecord({
 			record,
 			inventory
 		})) {
-			if (!isPluginAppReadyForThreadStart(app)) {
+			const admissionConfig = resolveCodexPluginAppThreadAdmission(app, inventory) === "blocked" ? void 0 : await (configForAppAdmission ??= readCodexConfigForAppAdmission(params));
+			if (!admissionConfig || resolveCodexExplicitAppEnablement(admissionConfig.layers, app.id) === false) {
 				diagnostics.push({
 					code: "app_not_ready",
 					plugin: record.policy,
@@ -610,10 +895,12 @@ async function buildCodexPluginThreadConfig(params) {
 			if (record.policy.destructiveApprovalMode === "ask" && !await clearPersistedAppToolApprovalOverrides({
 				request: params.request,
 				configCwd: params.configCwd,
+				config: admissionConfig.config,
 				plugin: record.policy,
 				app,
 				diagnostics
 			})) continue;
+			provisionalAppIds.add(app.id);
 			apps[app.id] = buildEnabledAppConfig(record.policy);
 			policyApps[app.id] = {
 				configKey: record.policy.configKey,
@@ -625,15 +912,27 @@ async function buildCodexPluginThreadConfig(params) {
 			};
 		}
 	}
-	for (const app of accountAppsResult.apps) {
+	for (const app of unresolvedDisabledPluginOwnership ? [] : accountAppsResult.apps) {
 		if (pluginOwnedAppIds.has(app.id)) continue;
-		const accountApp = toOwnedAccountApp(app);
+		configForAppAdmission ??= readCodexConfigForAppAdmission(params);
+		const admissionConfig = await configForAppAdmission;
+		if (!admissionConfig) {
+			diagnostics.push({
+				code: "account_app_config_unavailable",
+				message: "Codex account app configuration was unavailable; account apps were not exposed."
+			});
+			break;
+		}
+		if (resolveCodexExplicitAppEnablement(admissionConfig.layers, app.id) === false) continue;
+		const accountApp = toCodexPluginOwnedAccountApp(app);
 		if (policy.destructiveApprovalMode === "ask" && !await clearPersistedAppToolApprovalOverrides({
 			request: params.request,
 			configCwd: params.configCwd,
+			config: admissionConfig.config,
 			app: accountApp,
 			diagnostics
 		})) continue;
+		provisionalAppIds.add(app.id);
 		apps[app.id] = buildEnabledAppConfig(policy);
 		policyApps[app.id] = {
 			source: "account",
@@ -648,6 +947,7 @@ async function buildCodexPluginThreadConfig(params) {
 	return {
 		enabled: true,
 		configPatch,
+		...provisionalAppIds.size > 0 ? { provisionalAppIds: Array.from(provisionalAppIds).toSorted() } : {},
 		fingerprint: fingerprintJson({
 			version: CODEX_PLUGIN_THREAD_CONFIG_FINGERPRINT_VERSION,
 			inputFingerprint,
@@ -736,13 +1036,22 @@ function buildPluginAppPolicyContext(apps, pluginAppIds) {
 }
 async function clearPersistedAppToolApprovalOverrides(params) {
 	try {
-		const overrideNames = await readPersistedAppToolApprovalOverrideNames(params);
-		for (const toolName of overrideNames) if (isOverriddenConfigWriteResponse(await params.request("config/value/write", {
+		const overrideNames = readPersistedAppToolApprovalOverrideNames(params.config, params.app);
+		if (overrideNames.length === 0) return true;
+		const edits = overrideNames.map((toolName) => ({
 			keyPath: `apps.${quoteConfigKeyPathSegment(params.app.id)}.tools.${quoteConfigKeyPathSegment(toolName)}.approval_mode`,
 			value: null,
 			mergeStrategy: "replace"
-		}))) throw new Error(`approval override for ${toolName} is controlled by another config layer`);
-		const remainingOverrideNames = await readPersistedAppToolApprovalOverrideNames(params);
+		}));
+		const response = await params.request("config/batchWrite", { edits });
+		if (!isJsonObject(response) || response.status !== "ok" && response.status !== "okOverridden") throw new Error("Codex did not confirm the approval override batch");
+		if (response.status === "okOverridden") throw new Error(`approval override for ${overrideNames.join(", ")} is controlled by another config layer`);
+		const confirmed = await params.request("config/read", {
+			includeLayers: false,
+			...params.configCwd ? { cwd: params.configCwd } : {}
+		});
+		if (!isJsonObject(confirmed) || !isJsonObject(confirmed.config)) throw new Error("Codex did not confirm effective app approval configuration");
+		const remainingOverrideNames = readPersistedAppToolApprovalOverrideNames(confirmed.config, params.app);
 		if (remainingOverrideNames.length > 0) throw new Error(`effective approval overrides remain for ${remainingOverrideNames.join(", ")}`);
 		return true;
 	} catch (error) {
@@ -754,24 +1063,15 @@ async function clearPersistedAppToolApprovalOverrides(params) {
 		return false;
 	}
 }
-async function readPersistedAppToolApprovalOverrideNames(params) {
-	const response = await params.request("config/read", {
-		includeLayers: false,
-		...params.configCwd ? { cwd: params.configCwd } : {}
-	});
-	const config = isJsonObject(response) ? response.config : void 0;
-	const appsRoot = isJsonObject(config) ? config.apps : void 0;
-	const nestedApps = isJsonObject(appsRoot) ? appsRoot.apps : void 0;
-	const appConfig = isJsonObject(appsRoot) ? appsRoot[params.app.id] ?? (isJsonObject(nestedApps) ? nestedApps[params.app.id] : void 0) : void 0;
+function readPersistedAppToolApprovalOverrideNames(config, app) {
+	const appsRoot = config.apps;
+	const appConfig = isJsonObject(appsRoot) ? appsRoot[app.id] : void 0;
 	const tools = isJsonObject(appConfig) ? appConfig.tools : void 0;
 	if (!isJsonObject(tools)) return [];
 	return Object.entries(tools).filter(([, value]) => hasPersistedToolApprovalOverride(value)).map(([toolName]) => toolName).toSorted();
 }
 function hasPersistedToolApprovalOverride(value) {
-	return isJsonObject(value) && (value.approval_mode !== void 0 || value.approvalMode !== void 0);
-}
-function isOverriddenConfigWriteResponse(response) {
-	return isJsonObject(response) && response.status === "okOverridden";
+	return isJsonObject(value) && value.approval_mode !== void 0;
 }
 function quoteConfigKeyPathSegment(segment) {
 	return `"${segment.replace(/["\\]/g, (char) => `\\${char}`)}"`;
@@ -783,30 +1083,6 @@ function shouldWaitForInitialAppInventory(params, policy, inventory) {
 function shouldRefreshMissingAppInventory(params, policy, inventory) {
 	return Boolean(params.appCacheKey && policy.pluginPolicies.some((plugin) => plugin.enabled) && inventory.appInventory?.state === "missing");
 }
-async function refreshAppInventoryNow(params, appCache, options = {}) {
-	const appCacheKey = params.appCacheKey;
-	if (!appCacheKey) return;
-	const request = async (method, requestParams) => await params.request(method, requestParams);
-	try {
-		return await appCache.refreshNow({
-			key: appCacheKey,
-			request,
-			nowMs: params.nowMs,
-			forceRefetch: options.forceRefetch,
-			targetAppIds: options.targetAppIds
-		});
-	} catch (error) {
-		embeddedAgentLog.warn("codex plugin thread config app inventory refresh failed", {
-			reason: options.reason,
-			forceRefetch: options.forceRefetch === true,
-			error: serializeCodexAppInventoryError(error)
-		});
-		return;
-	}
-}
-function collectInventoryOwnedAppIds(inventory) {
-	return Array.from(new Set(inventory.records.flatMap((record) => record.ownedAppIds).filter(Boolean))).toSorted();
-}
 function emptyCodexPluginInventory(policy) {
 	return {
 		policy,
@@ -814,42 +1090,6 @@ function emptyCodexPluginInventory(policy) {
 		diagnostics: []
 	};
 }
-async function readAccessibleAccountApps(params, appCache) {
-	const snapshot = await refreshAppInventoryNow(params, appCache, {
-		forceRefetch: false,
-		reason: "account_apps_all",
-		targetAppIds: []
-	});
-	if (!snapshot) return {
-		apps: [],
-		diagnostic: {
-			code: "account_app_inventory_unavailable",
-			message: "Codex account app inventory was unavailable; account apps were not exposed."
-		}
-	};
-	return { apps: snapshot.apps.filter((app) => app.isAccessible).toSorted((left, right) => left.id.localeCompare(right.id)) };
-}
-function toOwnedAccountApp(app) {
-	return {
-		id: app.id,
-		name: app.name,
-		accessible: app.isAccessible,
-		enabled: app.isEnabled,
-		needsAuth: !app.isAccessible
-	};
-}
-function resolveThreadConfigAppsForRecord(params) {
-	if (params.inventory.appInventory?.state === "missing") return [];
-	return params.record.apps;
-}
-function isPluginAppReadyForThreadStart(app) {
-	return app.accessible;
-}
-function shouldForceRefreshForNotReadyPluginApps(params, policy, inventory) {
-	if (!params.appCacheKey || !policy.pluginPolicies.some((plugin) => plugin.enabled)) return false;
-	if (inventory.appInventory?.state === "missing") return false;
-	return inventory.records.some((record) => record.appOwnership === "proven" && record.ownedAppIds.length > 0 && (record.apps.length === 0 || record.apps.some((app) => !app.accessible)));
-}
 function policyFingerprint(policy) {
 	return {
 		enabled: policy.enabled,
@@ -1111,8 +1351,8 @@ function hasMessageContent(message) {
 	return "content" in message;
 }
 function normalizeRenderedContextMaxChars(value) {
-	if (typeof value !== "number" || !Number.isFinite(value)) return DEFAULT_RENDERED_CONTEXT_CHARS;
-	return Math.min(MAX_RENDERED_CONTEXT_CHARS, Math.max(DEFAULT_RENDERED_CONTEXT_CHARS, Math.floor(value)));
+	if (typeof value !== "number" || !Number.isFinite(value) || value <= 0) return DEFAULT_RENDERED_CONTEXT_CHARS;
+	return Math.min(MAX_RENDERED_CONTEXT_CHARS, Math.max(1, Math.floor(value)));
 }
 function resolveTextPartMaxChars(maxRenderedContextChars) {
 	return Math.min(MAX_TEXT_PART_CHARS, Math.max(DEFAULT_TEXT_PART_CHARS, Math.floor(maxRenderedContextChars / 4)));
@@ -1229,6 +1469,26 @@ function fingerprintUserMcpServersAuthorizationHeader(value) {
 function fingerprintJsonObject(value) {
 	return JSON.stringify(stabilizeJsonValue(value));
 }
+/** Hash every resume-visible setting without retaining config, credentials, or instructions. */
+function fingerprintCodexThreadConfig(request, authProfileId, dynamicToolsFingerprint) {
+	return hashCodexAppServerBindingFingerprint(fingerprintJsonObject({
+		authProfileId: authProfileId ?? null,
+		dynamicToolsFingerprint: dynamicToolsFingerprint ?? null,
+		model: request.model ?? null,
+		requestedModel: request.requestedModel === void 0 ? request.model ?? null : request.requestedModel,
+		modelProvider: request.modelProvider ?? null,
+		requestedModelProvider: request.requestedModelProvider === void 0 ? request.modelProvider ?? null : request.requestedModelProvider,
+		approvalPolicy: request.approvalPolicy ?? null,
+		approvalsReviewer: request.approvalsReviewer ?? null,
+		sandbox: request.sandbox ?? null,
+		permissions: request.permissions ?? null,
+		personality: request.personality ?? null,
+		serviceTier: request.serviceTier === void 0 ? "<omitted>" : request.serviceTier,
+		baseInstructions: request.baseInstructions ?? null,
+		developerInstructions: request.developerInstructions ?? null,
+		config: request.config ?? {}
+	}));
+}
 function fingerprintEnvironmentSelection(environments) {
 	return environments ? JSON.stringify(environments.map(stabilizeJsonValue)) : void 0;
 }
@@ -1259,145 +1519,222 @@ function readActiveCodexTurnIdsFromResume(response) {
 	const pagedTurns = response.initialTurnsPage?.data;
 	return readActiveCodexTurnIds(Array.isArray(pagedTurns) ? { turns: pagedTurns } : response.thread);
 }
-const LEGACY_EMPTY_DYNAMIC_TOOLS_FINGERPRINT = legacyFingerprintDynamicTools([]);
-const EMPTY_DYNAMIC_TOOLS_FINGERPRINT = hashCodexAppServerBindingFingerprint(LEGACY_EMPTY_DYNAMIC_TOOLS_FINGERPRINT);
-function areDynamicToolFingerprintsCompatible(previous, next, nextLegacy) {
-	return !previous || previous === next || previous === nextLegacy;
-}
-function areUserMcpServersFingerprintsCompatible(params) {
-	return params.previous === params.next || params.previous === params.nextLegacy || params.nextLegacy !== void 0 && params.previous === hashCodexAppServerBindingFingerprint(params.nextLegacy);
-}
-function shouldStartTransientNoToolThread(params) {
-	return Boolean(params.previous && !isEmptyDynamicToolsFingerprint(params.previous) && !params.nextHasDynamicTools);
-}
-function isEmptyDynamicToolsFingerprint(fingerprint) {
-	return fingerprint === EMPTY_DYNAMIC_TOOLS_FINGERPRINT || fingerprint === LEGACY_EMPTY_DYNAMIC_TOOLS_FINGERPRINT;
-}
-function compareJsonFingerprint(left, right) {
-	return JSON.stringify(left).localeCompare(JSON.stringify(right));
-}
-//#endregion
-//#region extensions/codex/src/app-server/attempt-client-cleanup.ts
-/**
-* Best-effort cleanup helpers for Codex app-server startup attempts and turns.
-*/
-/** Timeout for best-effort app-server turn interruption during cleanup. */
-const CODEX_APP_SERVER_INTERRUPT_TIMEOUT_MS = 5e3;
-/** Timeout for best-effort thread unsubscribe during cleanup. */
-const CODEX_APP_SERVER_UNSUBSCRIBE_TIMEOUT_MS = 5e3;
-/** Raised when a thread subscription may be live on a client OpenClaw no longer controls. */
-var CodexAppServerUnsafeSubscriptionError = class extends Error {
-	constructor(message, options) {
-		super(message, options);
-		this.name = "CodexAppServerUnsafeSubscriptionError";
-	}
-};
-function isCodexAppServerUnsafeSubscriptionError(error) {
-	return error instanceof CodexAppServerUnsafeSubscriptionError;
-}
-/** Asserts Codex resumed the exact thread this attempt subscribed to. */
-function assertCodexThreadResumeSubscription(requestedThreadId, returnedThreadId) {
-	if (returnedThreadId !== requestedThreadId) throw new CodexAppServerUnsafeSubscriptionError(`Codex thread/resume returned ${returnedThreadId} for ${requestedThreadId}`);
-}
-async function closeClientAndWaitIfAvailable(client) {
-	const closeable = client;
-	if (typeof closeable.closeAndWait === "function") {
-		await closeable.closeAndWait();
-		return;
-	}
-	closeable.close?.();
-}
-async function closeCodexStartupClientBestEffort(client) {
-	if (!client) return;
-	const unclaimedSharedClient = clearSharedCodexAppServerClientIfCurrentAndUnclaimed(client);
-	if (unclaimedSharedClient.closed) {
-		await closeClientAndWaitIfAvailable(client);
-		return;
-	}
-	if (unclaimedSharedClient.found) {
-		if (retireSharedCodexAppServerClientIfCurrent(client)?.closed) await closeClientAndWaitIfAvailable(client);
-		return;
-	}
-	const retiredSharedClient = retireSharedCodexAppServerClientIfCurrent(client);
-	if (retiredSharedClient) {
-		if (retiredSharedClient.closed) await closeClientAndWaitIfAvailable(client);
-		return;
-	}
-	if (clearSharedCodexAppServerClientIfCurrent(client)) {
-		await closeClientAndWaitIfAvailable(client);
-		return;
-	}
-	await closeClientAndWaitIfAvailable(client);
-}
-/** Sends a turn interrupt without blocking abort cleanup on app-server errors. */
-function interruptCodexTurnBestEffort(client, params) {
-	const requestOptions = params.timeoutMs && Number.isFinite(params.timeoutMs) && params.timeoutMs > 0 ? { timeoutMs: params.timeoutMs } : void 0;
-	const requestParams = {
-		threadId: params.threadId,
-		turnId: params.turnId
-	};
-	try {
-		const interrupt = requestOptions ? client.request("turn/interrupt", requestParams, requestOptions) : client.request("turn/interrupt", requestParams);
-		Promise.resolve(interrupt).catch((error) => {
-			embeddedAgentLog.debug("codex app-server turn interrupt failed during abort", { error });
-		});
-	} catch (error) {
-		embeddedAgentLog.debug("codex app-server turn interrupt failed during abort", { error });
-	}
+const LEGACY_EMPTY_DYNAMIC_TOOLS_FINGERPRINT = legacyFingerprintDynamicTools([]);
+const EMPTY_DYNAMIC_TOOLS_FINGERPRINT = hashCodexAppServerBindingFingerprint(LEGACY_EMPTY_DYNAMIC_TOOLS_FINGERPRINT);
+function areDynamicToolFingerprintsCompatible(previous, next, nextLegacy) {
+	return !previous || previous === next || previous === nextLegacy;
 }
-/** Unsubscribes from a thread while swallowing cleanup-only failures. */
-async function unsubscribeCodexThreadBestEffort(client, params) {
+function areUserMcpServersFingerprintsCompatible(params) {
+	return params.previous === params.next || params.previous === params.nextLegacy || params.nextLegacy !== void 0 && params.previous === hashCodexAppServerBindingFingerprint(params.nextLegacy);
+}
+function shouldStartTransientNoToolThread(params) {
+	return Boolean(params.previous && !isEmptyDynamicToolsFingerprint(params.previous) && !params.nextHasDynamicTools);
+}
+function isEmptyDynamicToolsFingerprint(fingerprint) {
+	return fingerprint === EMPTY_DYNAMIC_TOOLS_FINGERPRINT || fingerprint === LEGACY_EMPTY_DYNAMIC_TOOLS_FINGERPRINT;
+}
+function compareJsonFingerprint(left, right) {
+	return JSON.stringify(left).localeCompare(JSON.stringify(right));
+}
+//#endregion
+//#region extensions/codex/src/app-server/native-skill-isolation.ts
+const MAX_PERSONAL_SKILL_DIRECTORIES = 2e3;
+const MAX_PERSONAL_SKILL_DEPTH = 6;
+const MAX_PERSONAL_SKILL_ENTRIES = 1e4;
+const nativeSkillIsolationByClient = /* @__PURE__ */ new WeakMap();
+function isMissingPathError(error) {
+	return error.code === "ENOENT";
+}
+function isPathWithin(root, candidate) {
+	const relative = path.relative(path.resolve(root), path.resolve(candidate));
+	return relative === "" || !path.isAbsolute(relative) && !relative.startsWith(`..${path.sep}`) && relative !== "..";
+}
+async function canonicalizeExistingPath(candidate) {
 	try {
-		await client.request("thread/unsubscribe", { threadId: params.threadId }, { timeoutMs: params.timeoutMs });
-		return true;
-	} catch (error) {
-		embeddedAgentLog.debug("codex app-server thread unsubscribe cleanup failed", {
-			threadId: params.threadId,
-			error
+		return await fs.realpath(candidate);
+	} catch {
+		return path.resolve(candidate);
+	}
+}
+async function usesDefaultStateDir() {
+	if (!process.env.OPENCLAW_STATE_DIR?.trim()) return true;
+	const home = resolveRequiredHomeDir();
+	const [stateDir, defaultStateDir] = await Promise.all([canonicalizeExistingPath(resolveStateDir()), canonicalizeExistingPath(path.join(home, ".openclaw"))]);
+	return stateDir === defaultStateDir;
+}
+async function collectPersonalSkillRealPaths(homes, codexHome) {
+	const realStateDir = await canonicalizeExistingPath(resolveStateDir());
+	const roots = [];
+	for (const home of homes) {
+		for (const dir of [".agents", ".claude"]) roots.push({
+			dir: path.join(home, dir, "skills"),
+			onlyEscapedStateTargets: false
 		});
-		return false;
-	}
-}
-/**
-* Retires the shared client after a timed-out turn so later runs do not reuse a
-* potentially wedged app-server connection.
-*/
-async function retireCodexAppServerClientAfterTimedOutTurn(client, params) {
-	const retiredSharedClient = retireSharedCodexAppServerClientIfCurrent(client, { failActiveLeases: params.suspectPhysicalClient });
-	const detachedSharedClient = Boolean(retiredSharedClient);
-	if (!(params.suspectPhysicalClient && (retiredSharedClient?.closed ?? false))) {
-		interruptCodexTurnBestEffort(client, {
-			threadId: params.threadId,
-			turnId: params.turnId,
-			timeoutMs: CODEX_APP_SERVER_INTERRUPT_TIMEOUT_MS
+		const defaultCodexHome = path.join(home, ".codex");
+		const realDefaultCodexHome = await canonicalizeExistingPath(defaultCodexHome);
+		roots.push({
+			dir: path.join(defaultCodexHome, "skills"),
+			onlyEscapedStateTargets: isPathWithin(realStateDir, realDefaultCodexHome)
 		});
-		await unsubscribeCodexThreadBestEffort(client, {
-			threadId: params.threadId,
-			timeoutMs: CODEX_APP_SERVER_UNSUBSCRIBE_TIMEOUT_MS
+	}
+	const configuredCodexHome = codexHome?.trim() || process.env.CODEX_HOME?.trim();
+	if (configuredCodexHome) {
+		const stateOwned = isPathWithin(realStateDir, await canonicalizeExistingPath(configuredCodexHome));
+		roots.push({
+			dir: path.join(configuredCodexHome, "skills"),
+			onlyEscapedStateTargets: stateOwned
 		});
 	}
-	let closedClient = retiredSharedClient?.closed ?? false;
-	if (!detachedSharedClient) {
-		const close = client.close;
-		if (typeof close === "function") try {
-			close.call(client);
-			closedClient = true;
+	const skillPaths = /* @__PURE__ */ new Set();
+	let complete = true;
+	const seenDirectories = /* @__PURE__ */ new Set();
+	const queue = roots.map((root) => ({
+		dir: root.dir,
+		onlyEscapedStateTargets: root.onlyEscapedStateTargets,
+		depth: 0
+	}));
+	let entryCount = 0;
+	const recordSkillFile = async (filePath, onlyEscapedStateTargets) => {
+		try {
+			const skillRealPath = await fs.realpath(filePath);
+			if (!onlyEscapedStateTargets || !isPathWithin(realStateDir, skillRealPath)) skillPaths.add(skillRealPath);
 		} catch (error) {
-			embeddedAgentLog.debug("codex app-server client close failed during timeout cleanup", {
-				threadId: params.threadId,
-				turnId: params.turnId,
-				error
-			});
+			if (!isMissingPathError(error)) complete = false;
+		}
+	};
+	for (const current of queue) {
+		let realDir;
+		try {
+			realDir = await fs.realpath(current.dir);
+		} catch (error) {
+			if (isMissingPathError(error)) continue;
+			complete = false;
+			continue;
+		}
+		if (seenDirectories.has(realDir)) continue;
+		seenDirectories.add(realDir);
+		if (seenDirectories.size > MAX_PERSONAL_SKILL_DIRECTORIES) {
+			complete = false;
+			break;
+		}
+		let directory;
+		try {
+			directory = await fs.opendir(current.dir);
+		} catch (error) {
+			if (!isMissingPathError(error)) complete = false;
+			continue;
+		}
+		try {
+			for await (const entry of directory) {
+				entryCount += 1;
+				if (entryCount > MAX_PERSONAL_SKILL_ENTRIES) {
+					complete = false;
+					queue.length = 0;
+					break;
+				}
+				if (entry.name.startsWith(".")) continue;
+				const entryPath = path.join(current.dir, entry.name);
+				if (entry.name === "SKILL.md" && entry.isFile()) {
+					await recordSkillFile(entryPath, current.onlyEscapedStateTargets);
+					continue;
+				}
+				if (entry.isSymbolicLink()) {
+					try {
+						const stat = await fs.stat(entryPath);
+						if (entry.name === "SKILL.md" && stat.isFile()) await recordSkillFile(entryPath, current.onlyEscapedStateTargets);
+						else if (stat.isDirectory()) if (current.depth < MAX_PERSONAL_SKILL_DEPTH) queue.push({
+							dir: entryPath,
+							depth: current.depth + 1,
+							onlyEscapedStateTargets: current.onlyEscapedStateTargets
+						});
+						else complete = false;
+					} catch (error) {
+						if (!isMissingPathError(error)) complete = false;
+					}
+					continue;
+				}
+				if (current.depth >= MAX_PERSONAL_SKILL_DEPTH) {
+					if (entry.isDirectory()) complete = false;
+					continue;
+				}
+				if (entry.isDirectory()) {
+					queue.push({
+						dir: entryPath,
+						depth: current.depth + 1,
+						onlyEscapedStateTargets: current.onlyEscapedStateTargets
+					});
+					continue;
+				}
+			}
+		} catch (error) {
+			if (!isMissingPathError(error)) complete = false;
 		}
 	}
-	embeddedAgentLog.warn("codex app-server client retired after timed-out turn", {
-		threadId: params.threadId,
-		turnId: params.turnId,
-		reason: params.reason,
-		detachedSharedClient,
-		closedClient,
-		activeSharedClientLeases: retiredSharedClient?.activeLeases ?? 0
-	});
+	return {
+		complete,
+		skillPaths
+	};
+}
+/** Resolves the native user-scope skills that an isolated OpenClaw thread must disable. */
+async function resolveCodexNativeSkillIsolation(params) {
+	params.signal?.throwIfAborted();
+	if (!process.env.OPENCLAW_STATE_DIR?.trim()) return;
+	const key = JSON.stringify([
+		path.resolve(resolveStateDir()),
+		path.resolve(params.cwd),
+		params.codexHome?.trim() || process.env.CODEX_HOME?.trim() || "",
+		params.home?.trim() || process.env.HOME?.trim() || "",
+		params.userProfile?.trim() || process.env.USERPROFILE?.trim() || ""
+	]);
+	const cached = nativeSkillIsolationByClient.get(params.client);
+	if (cached?.key === key && (cached.settled || cached.signal === params.signal)) {
+		const isolation = await cached.result;
+		params.signal?.throwIfAborted();
+		return isolation;
+	}
+	const result = resolveUncachedCodexNativeSkillIsolation(params);
+	const entry = {
+		key,
+		result,
+		settled: false,
+		signal: params.signal
+	};
+	nativeSkillIsolationByClient.set(params.client, entry);
+	try {
+		const isolation = await result;
+		entry.settled = true;
+		params.signal?.throwIfAborted();
+		return isolation;
+	} catch (error) {
+		if (nativeSkillIsolationByClient.get(params.client)?.result === result) nativeSkillIsolationByClient.delete(params.client);
+		throw error;
+	}
+}
+async function resolveUncachedCodexNativeSkillIsolation(params) {
+	if (await usesDefaultStateDir()) return;
+	const response = await params.client.request("skills/list", {
+		cwds: [params.cwd],
+		forceReload: true
+	}, { signal: params.signal });
+	const homes = [params.home?.trim() || process.env.HOME?.trim() || process.env.USERPROFILE?.trim() || os.homedir()];
+	if (process.platform === "win32") homes.push(params.userProfile?.trim() || os.homedir());
+	const personalSkills = await collectPersonalSkillRealPaths([...new Set(homes.map((home) => path.resolve(home)))], params.codexHome);
+	return { disabledUserSkillPaths: [...personalSkills.complete ? personalSkills.skillPaths : /* @__PURE__ */ new Set([...personalSkills.skillPaths, ...response.data.flatMap((entry) => entry.skills.filter((skill) => skill.scope === "user").map((skill) => skill.path))])].toSorted((left, right) => left.localeCompare(right)) };
+}
+/** Applies path-exact session rules after caller config so isolated user skills stay disabled. */
+function applyCodexNativeSkillIsolation(config, isolation) {
+	if (!isolation) return config;
+	const existingRules = config?.["skills.config"];
+	if (existingRules !== void 0 && !Array.isArray(existingRules)) throw new Error("Codex thread skills.config must be an array");
+	const disabledRules = isolation.disabledUserSkillPaths.map((skillPath) => ({
+		path: skillPath,
+		enabled: false
+	}));
+	return {
+		...config,
+		"skills.include_instructions": false,
+		"skills.config": [...existingRules ?? [], ...disabledRules]
+	};
 }
 //#endregion
 //#region extensions/codex/src/app-server/dynamic-tool-profile.ts
@@ -1476,7 +1813,8 @@ function filterCodexDynamicToolsWithOpenClawShell(tools, config, env = process.e
 function filterCodexDynamicToolsWithOptions(tools, config, env, options) {
 	const excludes = /* @__PURE__ */ new Set();
 	for (const name of CODEX_NATIVE_GOAL_TOOL_EXCLUDES) excludes.add(name);
-	if (!isForcedPrivateQaCodexRuntime(env)) for (const name of CODEX_APP_SERVER_OWNED_DYNAMIC_TOOL_EXCLUDES) {
+	if (isForcedPrivateQaCodexRuntime(env)) excludes.add("apply_patch");
+	else for (const name of CODEX_APP_SERVER_OWNED_DYNAMIC_TOOL_EXCLUDES) {
 		if (options.preserveOpenClawShell && CODEX_APP_SERVER_OWNED_SHELL_TOOL_EXCLUDES.has(name)) continue;
 		excludes.add(name);
 	}
@@ -1487,13 +1825,6 @@ function filterCodexDynamicToolsWithOptions(tools, config, env, options) {
 	return excludes.size === 0 ? tools : tools.filter((tool) => !excludes.has(normalizeCodexDynamicToolName(tool.name)));
 }
 //#endregion
-//#region extensions/codex/src/app-server/profiler-flag.ts
-const PROFILER_FLAGS = ["profiler", "codex.profiler"];
-/** Checks the generic and Codex-specific profiler diagnostic flags. */
-function isCodexAppServerProfilerEnabled(config, env = process.env) {
-	return PROFILER_FLAGS.some((flag) => isDiagnosticFlagEnabled(flag, config, env));
-}
-//#endregion
 //#region extensions/codex/src/app-server/thread-binding-policy.ts
 function shouldRotateCodexAppServerBindingForRuntime(params) {
 	if (!params.current) return false;
@@ -1571,6 +1902,61 @@ var CodexAdoptedThreadActiveError = class extends Error {
 	}
 };
 //#endregion
+//#region extensions/codex/src/app-server/plugin-thread-attestation.ts
+/**
+* Confirms admitted plugin and account apps against their actual Codex thread before
+* OpenClaw commits a binding or starts a turn.
+*/
+var CodexPluginThreadAppAttestationError = class extends Error {
+	constructor(message, options) {
+		super(message, options);
+		this.name = "CodexPluginThreadAppAttestationError";
+	}
+};
+/** Reads the existing runtime snapshot with the started thread's effective app policy. */
+async function attestCodexPluginThreadApps(params) {
+	const appIds = Array.from(new Set(params.appIds.filter(Boolean))).toSorted();
+	if (appIds.length === 0) return;
+	let response;
+	try {
+		response = await params.client.request("app/installed", {
+			threadId: params.threadId,
+			forceRefresh: false
+		}, { signal: params.signal });
+	} catch (error) {
+		throw new CodexPluginThreadAppAttestationError(`Codex could not confirm admitted apps for thread ${params.threadId}`, { cause: error });
+	}
+	const installedById = new Map(response.apps.map((app) => [app.id, app]));
+	const failures = appIds.flatMap((appId) => {
+		const app = installedById.get(appId);
+		if (!app) return [`${appId}:missing`];
+		if (!app.enabled) return [`${appId}:disabled`];
+		return app.callable ? [] : [`${appId}:not-callable`];
+	});
+	if (failures.length > 0) throw new CodexPluginThreadAppAttestationError(`Codex thread ${params.threadId} did not expose admitted apps: ${failures.join(", ")}`);
+}
+/** Deletes a persistent pre-turn thread; ephemeral threads can only be unsubscribed. */
+async function discardUnattestedCodexPluginThread(params) {
+	if (params.ephemeral) return await unsubscribeCodexThreadBestEffort(params.client, {
+		threadId: params.threadId,
+		timeoutMs: CODEX_APP_SERVER_UNSUBSCRIBE_TIMEOUT_MS
+	});
+	try {
+		await params.client.request("thread/delete", { threadId: params.threadId }, { timeoutMs: CODEX_APP_SERVER_UNSUBSCRIBE_TIMEOUT_MS });
+		return true;
+	} catch (error) {
+		embeddedAgentLog.debug("codex plugin app attestation thread deletion failed", {
+			threadId: params.threadId,
+			error
+		});
+		await unsubscribeCodexThreadBestEffort(params.client, {
+			threadId: params.threadId,
+			timeoutMs: CODEX_APP_SERVER_UNSUBSCRIBE_TIMEOUT_MS
+		});
+		return false;
+	}
+}
+//#endregion
 //#region extensions/codex/src/app-server/reasoning-effort.ts
 const CODEX_REASONING_EFFORTS = [
 	"minimal",
@@ -1721,31 +2107,38 @@ function resolveReasoningEffort(thinkLevel, modelId, supportedReasoningEfforts)
 //#endregion
 //#region extensions/codex/src/app-server/thread-prompt.ts
 function buildDeveloperInstructions(params, options = {}) {
+	const deferredToolNames = /* @__PURE__ */ new Set();
+	let hasSkillWorkshop = false;
+	let hasSessionsYield = false;
+	let hasSeenDirectNamespace = false;
+	let messageToolAvailable = options.dynamicTools ? false : params.disableMessageTool !== true;
+	for (const spec of options.dynamicTools ?? []) {
+		const isDirectNamespace = spec.type === "namespace" && !hasSeenDirectNamespace && spec.name.trim() === "openclaw_direct";
+		if (isDirectNamespace) hasSeenDirectNamespace = true;
+		for (const tool of spec.type === "namespace" ? spec.tools : [spec]) {
+			const name = tool.name.trim();
+			if (tool.deferLoading === true && name) deferredToolNames.add(name);
+			hasSkillWorkshop ||= name === SKILL_WORKSHOP_TOOL_NAME;
+			hasSessionsYield ||= isDirectNamespace && name === "sessions_yield";
+			messageToolAvailable ||= name === "message";
+		}
+	}
 	const nativeCommandGuidance = listRegisteredPluginAgentPromptGuidance({
 		surface: "codex_app_server",
 		includeLegacyGlobalGuidance: false
 	}).join("\n");
 	return [
 		"You are a personal agent running inside OpenClaw. OpenClaw has dynamic tools for OpenClaw-owned messaging, cron, sessions, media, gateway, and nodes.",
-		buildDeferredDynamicToolManifest(options.dynamicTools),
-		buildSkillWorkshopInstruction(options.dynamicTools),
+		deferredToolNames.size > 0 ? `Deferred searchable OpenClaw dynamic tools available: ${[...deferredToolNames].toSorted((left, right) => left.localeCompare(right)).join(", ")}. Use \`tool_search\` to load exact callable specs before use.` : void 0,
+		hasSkillWorkshop ? buildSkillWorkshopPromptSection().join("\n") : void 0,
 		"Use Codex native `spawn_agent` for Codex subagents. `spawn_agent` and the other native collaboration tools may be deferred: when `spawn_agent` is not directly listed, load it with `tool_search` before spawning. Use OpenClaw `sessions_spawn` only for OpenClaw or ACP delegation, never as a substitute for `spawn_agent`.",
-		buildVisibleReplyInstruction(params, options.dynamicTools),
+		hasSessionsYield ? "When a native child's result belongs in a later turn, end the current turn with `openclaw_direct.sessions_yield`; the completion arrives as the next model-visible input. Use native `wait_agent` only for an intentional same-turn wait when the immediate next step is blocked on the child. Never loop-poll for native child completion." : void 0,
+		buildVisibleReplyInstruction(params, messageToolAvailable),
 		nativeCommandGuidance,
 		params.extraSystemPrompt
 	].filter((section) => typeof section === "string" && section.trim()).join("\n\n");
 }
-function buildDeferredDynamicToolManifest(dynamicTools) {
-	const deferredToolNames = [...new Set(flattenCodexDynamicToolFunctions(dynamicTools).filter((tool) => tool.deferLoading === true).map((tool) => tool.name.trim()).filter(Boolean))].toSorted((left, right) => left.localeCompare(right));
-	if (deferredToolNames.length === 0) return;
-	return `Deferred searchable OpenClaw dynamic tools available: ${deferredToolNames.join(", ")}. Use \`tool_search\` to load exact callable specs before use.`;
-}
-function buildSkillWorkshopInstruction(dynamicTools) {
-	if (!flattenCodexDynamicToolFunctions(dynamicTools).some((tool) => tool.name.trim() === SKILL_WORKSHOP_TOOL_NAME)) return;
-	return buildSkillWorkshopPromptSection().join("\n");
-}
-function buildVisibleReplyInstruction(params, dynamicTools) {
-	const messageToolAvailable = dynamicTools ? flattenCodexDynamicToolFunctions(dynamicTools).some((tool) => tool.name.trim() === "message") : params.disableMessageTool !== true;
+function buildVisibleReplyInstruction(params, messageToolAvailable) {
 	if (params.sourceReplyDeliveryMode === "message_tool_only" && messageToolAvailable) return "Visible source replies are not automatically delivered for this run. Use `message(action=send)` for user-visible source-channel output. For progress, set `final=false`. When the message is the completed reply to the current source conversation, set `final=true`; OpenClaw stops after confirming delivery. If `final` is omitted, OpenClaw continues and resolves the latest omitted source reply only when the turn ends successfully. Do not repeat visible message content in your final answer.";
 	if (messageToolAvailable) return "For the current source conversation, reply normally in your final assistant message; OpenClaw will deliver it through the active source conversation. Use `message` only for explicit out-of-band sends, media/file sends, or sends to a different target.";
 	return "For the current source conversation, reply normally in your final assistant message; OpenClaw will deliver it through the active source conversation.";
@@ -2143,12 +2536,17 @@ async function resumeCodexAppServerThread(params) {
 }
 //#endregion
 //#region extensions/codex/src/app-server/thread-lifecycle-io.ts
+function resolveCodexThreadRolloutPath(thread) {
+	const rolloutPath = thread.path?.trim();
+	if (!rolloutPath || !path.isAbsolute(rolloutPath) || path.extname(rolloutPath) !== ".jsonl" || !path.basename(rolloutPath).includes(thread.id)) return;
+	return rolloutPath;
+}
 async function resumeExistingCodexThread(params, context) {
-	const { binding: resumeBinding, bindingIdentity, startModelSelection, startModelProvider, userMcpServersConfigPatch, dynamicToolsFingerprint, dynamicToolsContainDeferred, webSearchThreadConfigFingerprint, userMcpServersFingerprint, ringZeroConfigFingerprint, ringZeroClientInstanceId, networkProxyConfigFingerprint, contextEngineBinding, environmentSelectionFingerprint, hostSystemAgentActive, ringZeroActive, ringZeroInheritedMcpServerNames, lifecycleTiming, normalizeBindingModelProvider, throwIfAborted, clearCurrentBinding } = context;
+	const { binding: resumeBinding, bindingIdentity, startModelSelection, startModelProvider, userMcpServersConfigPatch, dynamicToolsFingerprint, dynamicToolsContainDeferred, webSearchThreadConfigFingerprint, nativeSkillIsolationFingerprint, userMcpServersFingerprint, ringZeroConfigFingerprint, ringZeroClientInstanceId, networkProxyConfigFingerprint, contextEngineBinding, environmentSelectionFingerprint, hostSystemAgentActive, ringZeroActive, ringZeroInheritedMcpServerNames, nativeSkillIsolation, lifecycleTiming, normalizeBindingModelProvider, throwIfAborted, clearCurrentBinding } = context;
 	let resumeReservation;
 	try {
 		const authProfileId = resumeBinding.connectionScope === "supervision" ? void 0 : params.params.authProfileId ?? resumeBinding.authProfileId;
-		const finalConfigPatch = params.buildFinalConfigPatch?.({
+		const finalConfigPatch = context.prebuiltFinalConfigPatch ?? params.buildFinalConfigPatch?.({
 			action: "resume",
 			binding: resumeBinding
 		}) ?? {
@@ -2156,7 +2554,7 @@ async function resumeExistingCodexThread(params, context) {
 			nativeHookRelayGeneration: params.nativeHookRelayGeneration
 		};
 		const pluginAppsConfigPatch = params.pluginThreadConfig?.enabled && resumeBinding.pluginAppPolicyContext ? buildCodexPluginAppsConfigPatchFromPolicyContext(resumeBinding.pluginAppPolicyContext) : void 0;
-		const resumeConfig = mergeCodexThreadConfigs(params.config, userMcpServersConfigPatch, pluginAppsConfigPatch, finalConfigPatch.configPatch);
+		const resumeConfig = applyCodexNativeSkillIsolation(mergeCodexThreadConfigs(params.config, userMcpServersConfigPatch, pluginAppsConfigPatch, finalConfigPatch.configPatch), nativeSkillIsolation);
 		const resumeParams = lifecycleTiming.measureSync("thread-resume-params", () => buildThreadResumeParams(params.params, {
 			threadId: resumeBinding.threadId,
 			authProfileId,
@@ -2202,6 +2600,7 @@ async function resumeExistingCodexThread(params, context) {
 		const nextMcpServersFingerprint = params.mcpServersFingerprintEvaluated === true ? params.mcpServersFingerprint : resumeBinding.mcpServersFingerprint;
 		const resumePatch = {
 			cwd: params.cwd,
+			rolloutPath: resolveCodexThreadRolloutPath(response.thread) ?? resumeBinding.rolloutPath,
 			authProfileId: boundAuthProfileId,
 			model: response.model ?? resumeParams.model ?? params.params.modelId,
 			preserveNativeModel: resumeBinding.preserveNativeModel === true ? true : void 0,
@@ -2209,6 +2608,7 @@ async function resumeExistingCodexThread(params, context) {
 			dynamicToolsFingerprint,
 			dynamicToolsContainDeferred,
 			webSearchThreadConfigFingerprint,
+			nativeSkillIsolationFingerprint,
 			userMcpServersFingerprint,
 			mcpServersFingerprint: nextMcpServersFingerprint,
 			ringZeroConfigFingerprint,
@@ -2250,6 +2650,13 @@ async function resumeExistingCodexThread(params, context) {
 			...resumeBinding,
 			threadId: response.thread.id,
 			...resumePatch,
+			liveThreadConfigFingerprint: fingerprintCodexThreadConfig({
+				...resumeParams,
+				model: resumeBinding.preserveNativeModel === true ? null : response.model ?? resumeParams.model ?? null,
+				requestedModel: resumeBinding.preserveNativeModel === true ? null : resumeParams.model ?? null,
+				modelProvider: resumeBinding.preserveNativeModel === true ? null : resumePatch.modelProvider ?? null,
+				requestedModelProvider: resumeBinding.preserveNativeModel === true ? null : resumeParams.modelProvider ?? resumePatch.modelProvider ?? null
+			}, authProfileId, dynamicToolsFingerprint),
 			lifecycle: {
 				action: "resumed",
 				...activeTurnIds.length ? { activeTurnIds } : {}
@@ -2276,13 +2683,13 @@ async function resumeExistingCodexThread(params, context) {
 }
 async function startFreshCodexThread(params, context) {
 	const clientId = resolveCodexAppServerClientInstanceId(params.client);
-	const { bindingIdentity, startModelSelection, startModelProvider, userMcpServersConfigPatch, dynamicToolsFingerprint, dynamicToolsContainDeferred, webSearchThreadConfigFingerprint, userMcpServersFingerprint, ringZeroConfigFingerprint, ringZeroClientInstanceId, networkProxyConfigFingerprint, contextEngineBinding, environmentSelectionFingerprint, hostSystemAgentActive, ringZeroActive, ringZeroInheritedMcpServerNames, lifecycleTiming, normalizeBindingModelProvider, throwIfAborted, prebuiltPluginThreadConfig, preserveExistingBinding, rotatedContextEngineBinding } = context;
+	const { bindingIdentity, startModelSelection, startModelProvider, userMcpServersConfigPatch, dynamicToolsFingerprint, dynamicToolsContainDeferred, webSearchThreadConfigFingerprint, nativeSkillIsolationFingerprint, userMcpServersFingerprint, ringZeroConfigFingerprint, ringZeroClientInstanceId, networkProxyConfigFingerprint, contextEngineBinding, environmentSelectionFingerprint, hostSystemAgentActive, ringZeroActive, ringZeroInheritedMcpServerNames, nativeSkillIsolation, lifecycleTiming, normalizeBindingModelProvider, throwIfAborted, prebuiltPluginThreadConfig, preserveExistingBinding, rotatedContextEngineBinding } = context;
 	const pluginThreadConfig = params.pluginThreadConfig?.enabled ? prebuiltPluginThreadConfig ?? await lifecycleTiming.measure("plugin-config-build", () => params.pluginThreadConfig?.build()) : void 0;
 	const finalConfigPatch = params.buildFinalConfigPatch?.({ action: "start" }) ?? {
 		configPatch: params.finalConfigPatch,
 		nativeHookRelayGeneration: params.nativeHookRelayGeneration
 	};
-	const config = lifecycleTiming.measureSync("merge-thread-config", () => mergeCodexThreadConfigs(params.config, userMcpServersConfigPatch, pluginThreadConfig?.configPatch, finalConfigPatch.configPatch));
+	const config = lifecycleTiming.measureSync("merge-thread-config", () => applyCodexNativeSkillIsolation(mergeCodexThreadConfigs(params.config, userMcpServersConfigPatch, pluginThreadConfig?.configPatch, finalConfigPatch.configPatch), nativeSkillIsolation));
 	const startParams = lifecycleTiming.measureSync("thread-start-params", () => buildThreadStartParams(params.params, {
 		cwd: params.cwd,
 		dynamicTools: params.dynamicTools,
@@ -2308,6 +2715,26 @@ async function startFreshCodexThread(params, context) {
 			throw error;
 		}
 	}));
+	const provisionalAppIds = pluginThreadConfig?.provisionalAppIds;
+	if (provisionalAppIds?.length) try {
+		await lifecycleTiming.measure("plugin-app-attestation", () => attestCodexPluginThreadApps({
+			client: params.client,
+			threadId: response.thread.id,
+			appIds: provisionalAppIds,
+			signal: params.signal
+		}));
+	} catch (error) {
+		if (!await discardUnattestedCodexPluginThread({
+			client: params.client,
+			threadId: response.thread.id,
+			ephemeral: startParams.ephemeral === true
+		})) {
+			await (params.abandonClient ?? (() => closeCodexStartupClientBestEffort(params.client)))();
+			throw new CodexAppServerUnsafeSubscriptionError("Codex plugin app attestation cleanup failed", { cause: error });
+		}
+		throw error;
+	}
+	const rolloutPath = resolveCodexThreadRolloutPath(response.thread);
 	if (ringZeroActive) try {
 		await lifecycleTiming.measure("ring-zero-mcp-attestation", () => attestCodexRingZeroThreadHasNoMcpServers(params.client, response.thread.id, params.signal));
 	} catch (error) {
@@ -2322,6 +2749,7 @@ async function startFreshCodexThread(params, context) {
 		agentDir: params.params.agentDir,
 		config: params.params.config
 	});
+	const bindingModelProvider = normalizeBindingModelProvider(params.params.authProfileId, response.modelProvider ?? requestModelProvider ?? startModelProvider ?? modelProvider);
 	const nextMcpServersFingerprint = params.mcpServersFingerprintEvaluated === true ? params.mcpServersFingerprint : void 0;
 	if (!preserveExistingBinding) {
 		if (!await lifecycleTiming.measure("thread-start-write-binding", () => params.bindingStore.mutate(bindingIdentity, {
@@ -2331,12 +2759,14 @@ async function startFreshCodexThread(params, context) {
 				threadId: response.thread.id,
 				...clientId ? { clientId } : {},
 				cwd: params.cwd,
+				...rolloutPath ? { rolloutPath } : {},
 				authProfileId: params.params.authProfileId,
 				model: response.model ?? startParams.model ?? params.params.modelId,
-				modelProvider: normalizeBindingModelProvider(params.params.authProfileId, response.modelProvider ?? requestModelProvider ?? startModelProvider ?? modelProvider),
+				modelProvider: bindingModelProvider,
 				dynamicToolsFingerprint,
 				dynamicToolsContainDeferred,
 				webSearchThreadConfigFingerprint,
+				nativeSkillIsolationFingerprint,
 				userMcpServersFingerprint,
 				mcpServersFingerprint: nextMcpServersFingerprint,
 				ringZeroConfigFingerprint,
@@ -2374,11 +2804,13 @@ async function startFreshCodexThread(params, context) {
 		threadId: response.thread.id,
 		...clientId ? { clientId } : {},
 		cwd: params.cwd,
+		...rolloutPath ? { rolloutPath } : {},
 		authProfileId: params.params.authProfileId,
 		model: response.model ?? startParams.model ?? params.params.modelId,
 		modelProvider: response.modelProvider ?? requestModelProvider ?? startModelProvider ?? modelProvider,
 		dynamicToolsFingerprint,
 		dynamicToolsContainDeferred,
+		nativeSkillIsolationFingerprint,
 		userMcpServersFingerprint,
 		mcpServersFingerprint: nextMcpServersFingerprint,
 		ringZeroConfigFingerprint,
@@ -2392,6 +2824,13 @@ async function startFreshCodexThread(params, context) {
 		pluginAppPolicyContext: pluginThreadConfig?.policyContext,
 		contextEngine: contextEngineBinding,
 		environmentSelectionFingerprint,
+		...!preserveExistingBinding ? { liveThreadConfigFingerprint: fingerprintCodexThreadConfig({
+			...startParams,
+			model: response.model ?? startParams.model ?? null,
+			requestedModel: startParams.model ?? null,
+			modelProvider: bindingModelProvider ?? null,
+			requestedModelProvider: startParams.modelProvider ?? bindingModelProvider ?? null
+		}, params.params.authProfileId, dynamicToolsFingerprint) } : {},
 		lifecycle: {
 			action: "started",
 			...rotatedContextEngineBinding ? { rotatedContextEngineBinding } : {}
@@ -2399,6 +2838,13 @@ async function startFreshCodexThread(params, context) {
 	};
 }
 //#endregion
+//#region extensions/codex/src/app-server/profiler-flag.ts
+const PROFILER_FLAGS = ["profiler", "codex.profiler"];
+/** Checks the generic and Codex-specific profiler diagnostic flags. */
+function isCodexAppServerProfilerEnabled(config, env = process.env) {
+	return PROFILER_FLAGS.some((flag) => isDiagnosticFlagEnabled(flag, config, env));
+}
+//#endregion
 //#region extensions/codex/src/app-server/thread-lifecycle-timing.ts
 const CODEX_THREAD_LIFECYCLE_TIMING_WARN_TOTAL_MS = 1e3;
 const CODEX_THREAD_LIFECYCLE_TIMING_WARN_STAGE_MS = 500;
@@ -2488,6 +2934,174 @@ function createCodexThreadLifecycleTimingTracker(options = {}) {
 	};
 }
 //#endregion
+//#region extensions/codex/src/app-server/thread-lifecycle-preflight.ts
+async function prepareCodexThreadLifecyclePreflight(params) {
+	const lifecycleTiming = createCodexThreadLifecycleTimingTracker({
+		...params.timing,
+		enabled: params.timing?.enabled ?? isCodexAppServerProfilerEnabled(params.params.config)
+	});
+	const legacyDynamicToolsFingerprint = lifecycleTiming.measureSync("legacy-dynamic-tools-fingerprint", () => codexLegacyDynamicToolsFingerprint(params.dynamicTools));
+	const dynamicToolsFingerprint = lifecycleTiming.measureSync("dynamic-tools-fingerprint", () => hashCodexAppServerBindingFingerprint(legacyDynamicToolsFingerprint));
+	const dynamicToolsContainDeferred = flattenCodexDynamicToolFunctions(params.dynamicTools).some((tool) => tool.deferLoading === true);
+	const webSearchThreadConfigFingerprint = fingerprintJsonObject(lifecycleTiming.measureSync("web-search-plan", () => resolveCodexWebSearchPlan({
+		config: params.params.config,
+		disableTools: params.params.disableTools,
+		nativeToolSurfaceEnabled: params.nativeCodeModeEnabled,
+		nativeProviderWebSearchSupport: params.nativeProviderWebSearchSupport,
+		webSearchAllowed: params.webSearchAllowed
+	})).threadConfig);
+	const networkProxyConfigFingerprint = params.appServer.networkProxy?.configFingerprint;
+	const contextEngineBinding = lifecycleTiming.measureSync("context-engine-binding", () => buildContextEngineBinding(params.params, params.contextEngineProjection));
+	const userMcpServersConfigPatch = params.userMcpServersEnabled === false ? void 0 : await buildCodexUserMcpServersThreadConfigPatchForRuntime(params.params.config, {
+		agentId: params.agentId ?? params.params.agentId,
+		agentDir: params.params.agentDir,
+		allowLiteralOAuthProjection: params.appServer.connectionClass !== "remote",
+		toolOverrides: params.params.toolOverrides,
+		onServerUnavailable: (serverName, error) => embeddedAgentLog.warn("skipping unavailable MCP OAuth server", {
+			serverName,
+			error: formatErrorMessage(error)
+		})
+	});
+	const nativeSkillIsolation = await lifecycleTiming.measure("native-skill-isolation", () => resolveCodexNativeSkillIsolation({
+		client: params.client,
+		codexHome: params.appServer.start.env?.CODEX_HOME,
+		cwd: params.cwd,
+		home: params.appServer.start.env?.HOME,
+		signal: params.signal,
+		userProfile: params.appServer.start.env?.USERPROFILE
+	}));
+	const nativeSkillIsolationFingerprint = nativeSkillIsolation ? fingerprintJsonObject({
+		version: 1,
+		disabledUserSkillPaths: nativeSkillIsolation.disabledUserSkillPaths
+	}) : void 0;
+	const legacyUserMcpServersFingerprint = legacyFingerprintUserMcpServersConfigPatch(userMcpServersConfigPatch);
+	const userMcpServersFingerprint = fingerprintUserMcpServersConfigPatch(userMcpServersConfigPatch);
+	const environmentSelectionFingerprint = fingerprintEnvironmentSelection(params.environmentSelection);
+	const hostSystemAgentActive = params.hostSystemAgentActive ?? isHostScopedAgentToolActive("openclaw");
+	const ringZeroActive = hostSystemAgentActive && isSystemAgentOnlyCodexDynamicToolAllowlist(params.params.toolsAllow);
+	if (ringZeroActive && params.nativeCodeModeEnabled !== false) throw new Error("Codex ring-zero requires native code mode to be disabled");
+	const ringZeroInheritedMcpServerNames = ringZeroActive ? await lifecycleTiming.measure("ring-zero-mcp-config-read", () => readCodexInheritedMcpServerNames(params.client, params.cwd, params.signal)) : [];
+	if (ringZeroActive) await lifecycleTiming.measure("ring-zero-config-requirements-read", () => assertCodexRingZeroHasNoManagedHooks(params.client, params.signal));
+	const ringZeroConfigFingerprint = ringZeroActive ? fingerprintJsonObject({
+		version: 1,
+		baseInstructions: "",
+		config: buildCodexRingZeroThreadConfigPatch(params.params, true, ringZeroInheritedMcpServerNames)
+	}) : void 0;
+	return {
+		contextEngineBinding,
+		dynamicToolsContainDeferred,
+		dynamicToolsFingerprint,
+		environmentSelectionFingerprint,
+		hostSystemAgentActive,
+		legacyDynamicToolsFingerprint,
+		legacyUserMcpServersFingerprint,
+		lifecycleTiming,
+		nativeSkillIsolation,
+		nativeSkillIsolationFingerprint,
+		networkProxyConfigFingerprint,
+		ringZeroActive,
+		ringZeroClientInstanceId: ringZeroActive ? getCodexAppServerClientInstanceId(params.client) : void 0,
+		ringZeroConfigFingerprint,
+		ringZeroInheritedMcpServerNames,
+		userMcpServersConfigPatch,
+		userMcpServersFingerprint,
+		webSearchThreadConfigFingerprint
+	};
+}
+//#endregion
+//#region extensions/codex/src/app-server/thread-lifecycle-warm.ts
+/** Preserves the caller's abort reason across thread ownership transitions. */
+function throwIfCodexThreadLifecycleAborted(signal) {
+	if (!signal?.aborted) return;
+	const reason = signal.reason;
+	if (reason instanceof Error) throw reason;
+	const error = new Error(typeof reason === "string" && reason.length > 0 ? reason : "codex app-server thread lifecycle aborted");
+	error.name = "AbortError";
+	throw error;
+}
+/** Releases consumed subscription ownership or retires an unsafe client. */
+async function releaseCodexConsumedLiveThread(options) {
+	if (await options.lifecycleTiming.measure("retained-thread-unsubscribe", () => unsubscribeCodexThreadBestEffort(options.client, {
+		threadId: options.threadId,
+		timeoutMs: 5e3
+	}))) return;
+	await (options.abandonClient ?? (() => closeCodexStartupClientBestEffort(options.client)))();
+	throw new CodexAppServerUnsafeSubscriptionError(`Codex retained thread subscription could not be released: ${options.threadId}`, options.cause !== void 0 ? { cause: options.cause } : void 0);
+}
+/** Transfers retained-slot ownership before unconditionally releasing it. */
+async function releaseCodexRetainedLiveThread(options) {
+	if (await consumeCodexAppServerLiveThread(options.client, options.threadId)) await releaseCodexConsumedLiveThread(options);
+}
+/** Reuses one safely owned, fully matching subscription on its original client. */
+async function tryReuseCodexLiveThread(options) {
+	const { params, binding, bindingIdentity, clientId, contextEngineBinding, dynamicToolsFingerprint, hostSystemAgentActive, lifecycleTiming, nativeSkillIsolation, releaseConsumedThread, ringZeroActive, ringZeroInheritedMcpServerNames, startModelProvider, startModelSelection, throwIfAborted, userMcpServersConfigPatch } = options;
+	if (!binding.clientId || binding.clientId !== clientId || binding.preserveNativeModel === true || binding.connectionScope === "supervision" || ringZeroActive || contextEngineBinding) return {};
+	const prebuiltFinalConfigPatch = params.buildFinalConfigPatch?.({
+		action: "resume",
+		binding
+	}) ?? {
+		configPatch: params.finalConfigPatch,
+		nativeHookRelayGeneration: params.nativeHookRelayGeneration
+	};
+	const pluginAppsConfigPatch = params.pluginThreadConfig?.enabled && binding.pluginAppPolicyContext ? buildCodexPluginAppsConfigPatchFromPolicyContext(binding.pluginAppPolicyContext) : void 0;
+	const resumeAuthProfileId = params.params.authProfileId ?? binding.authProfileId;
+	const resumeConfig = mergeCodexThreadConfigs(params.config, userMcpServersConfigPatch, pluginAppsConfigPatch, prebuiltFinalConfigPatch.configPatch);
+	const resumeParams = lifecycleTiming.measureSync("warm-thread-resume-params", () => buildThreadResumeParams(params.params, {
+		threadId: binding.threadId,
+		authProfileId: resumeAuthProfileId,
+		model: startModelSelection.model,
+		modelProvider: startModelProvider,
+		preserveNativeModel: false,
+		appServer: params.appServer,
+		dynamicTools: params.dynamicTools,
+		developerInstructions: params.developerInstructions,
+		config: applyCodexNativeSkillIsolation(resumeConfig, nativeSkillIsolation),
+		nativeCodeModeEnabled: params.nativeCodeModeEnabled,
+		nativeProviderWebSearchSupport: params.nativeProviderWebSearchSupport,
+		nativeCodeModeOnlyEnabled: params.nativeCodeModeOnlyEnabled,
+		webSearchAllowed: params.webSearchAllowed,
+		hostSystemAgentActive,
+		ringZeroInheritedMcpServerNames
+	}));
+	const liveThreadConfigFingerprint = fingerprintCodexThreadConfig({
+		...resumeParams,
+		model: binding.model ?? resumeParams.model ?? null,
+		requestedModel: resumeParams.model ?? null,
+		modelProvider: binding.modelProvider ?? resumeParams.modelProvider ?? null,
+		requestedModelProvider: resumeParams.modelProvider ?? binding.modelProvider ?? null
+	}, resumeAuthProfileId, dynamicToolsFingerprint);
+	if (!await consumeCodexAppServerLiveThread(params.client, binding.threadId, liveThreadConfigFingerprint)) return { prebuiltFinalConfigPatch };
+	try {
+		const nativeHookRelayGeneration = prebuiltFinalConfigPatch.nativeHookRelayGeneration ?? binding.nativeHookRelayGeneration;
+		if (!await lifecycleTiming.measure("warm-thread-write-binding", () => params.bindingStore.mutate(bindingIdentity, {
+			kind: "patch",
+			threadId: binding.threadId,
+			patch: { nativeHookRelayGeneration }
+		}))) throw new CodexThreadBindingConflictError(binding.threadId, "committing a reused thread");
+		throwIfAborted();
+		lifecycleTiming.mark("thread-ready");
+		lifecycleTiming.logSummary({
+			runId: params.params.runId,
+			sessionId: params.params.sessionId,
+			sessionKey: params.params.sessionKey,
+			threadId: binding.threadId,
+			action: "resumed"
+		});
+		return {
+			binding: {
+				...binding,
+				nativeHookRelayGeneration,
+				liveThreadConfigFingerprint,
+				lifecycle: { action: "resumed" }
+			},
+			prebuiltFinalConfigPatch
+		};
+	} catch (error) {
+		await releaseConsumedThread(binding.threadId, error);
+		throw error;
+	}
+}
+//#endregion
 //#region extensions/codex/src/app-server/thread-supervision.ts
 async function materializePendingSupervisionBranch(params) {
 	let pending = params.binding.pendingSupervisionBranch;
@@ -2577,6 +3191,25 @@ async function materializePendingSupervisionBranch(params) {
 			modelProvider: nativeModelProvider,
 			operation: "thread/start response"
 		});
+		if (params.provisionalAppIds?.length) try {
+			await params.lifecycleTiming.measure("plugin-app-attestation", () => attestCodexPluginThreadApps({
+				client: params.client,
+				threadId: finalThreadId,
+				appIds: params.provisionalAppIds ?? [],
+				signal: params.signal
+			}));
+		} catch (error) {
+			if (!await discardUnattestedCodexPluginThread({
+				client: params.client,
+				threadId: finalThreadId,
+				ephemeral: startParams.ephemeral === true
+			}) || !await archiveSupervisionArtifact(params.client, probeThreadId)) {
+				provisionalCleanupSafe = false;
+				throw new CodexAppServerUnsafeSubscriptionError("Codex supervised plugin app attestation cleanup failed", { cause: error });
+			}
+			pending = await trackPendingSupervisionArtifacts(params, pending, []);
+			throw error;
+		}
 		if (history.responseItems.length > 0) {
 			await params.lifecycleTiming.measure("supervision-history-inject", () => params.client.request("thread/inject_items", {
 				threadId: finalThreadId,
@@ -2820,46 +3453,9 @@ async function startOrResumeThread(params) {
 		config: params.params.config
 	});
 	return await params.bindingStore.withLease(bindingIdentity, async () => {
-		const lifecycleTiming = createCodexThreadLifecycleTimingTracker({
-			...params.timing,
-			enabled: params.timing?.enabled ?? isCodexAppServerProfilerEnabled(params.params.config)
-		});
-		const legacyDynamicToolsFingerprint = lifecycleTiming.measureSync("legacy-dynamic-tools-fingerprint", () => codexLegacyDynamicToolsFingerprint(params.dynamicTools));
-		const dynamicToolsFingerprint = lifecycleTiming.measureSync("dynamic-tools-fingerprint", () => hashCodexAppServerBindingFingerprint(legacyDynamicToolsFingerprint));
-		const dynamicToolsContainDeferred = flattenCodexDynamicToolFunctions(params.dynamicTools).some((tool) => tool.deferLoading === true);
-		const webSearchThreadConfigFingerprint = fingerprintJsonObject(lifecycleTiming.measureSync("web-search-plan", () => resolveCodexWebSearchPlan({
-			config: params.params.config,
-			disableTools: params.params.disableTools,
-			nativeToolSurfaceEnabled: params.nativeCodeModeEnabled,
-			nativeProviderWebSearchSupport: params.nativeProviderWebSearchSupport,
-			webSearchAllowed: params.webSearchAllowed
-		})).threadConfig);
-		const networkProxyConfigFingerprint = params.appServer.networkProxy?.configFingerprint;
-		const contextEngineBinding = lifecycleTiming.measureSync("context-engine-binding", () => buildContextEngineBinding(params.params, params.contextEngineProjection));
-		const userMcpServersConfigPatch = params.userMcpServersEnabled === false ? void 0 : await buildCodexUserMcpServersThreadConfigPatchForRuntime(params.params.config, {
-			agentId: params.agentId ?? params.params.agentId,
-			agentDir: params.params.agentDir,
-			allowLiteralOAuthProjection: params.appServer.connectionClass !== "remote",
-			onServerUnavailable: (serverName, error) => embeddedAgentLog.warn("skipping unavailable MCP OAuth server", {
-				serverName,
-				error: formatErrorMessage(error)
-			})
-		});
-		const legacyUserMcpServersFingerprint = legacyFingerprintUserMcpServersConfigPatch(userMcpServersConfigPatch);
-		const userMcpServersFingerprint = fingerprintUserMcpServersConfigPatch(userMcpServersConfigPatch);
-		const environmentSelectionFingerprint = fingerprintEnvironmentSelection(params.environmentSelection);
-		const hostSystemAgentActive = params.hostSystemAgentActive ?? isHostScopedAgentToolActive("openclaw");
-		const ringZeroActive = hostSystemAgentActive && isSystemAgentOnlyCodexDynamicToolAllowlist(params.params.toolsAllow);
-		if (ringZeroActive && params.nativeCodeModeEnabled !== false) throw new Error("Codex ring-zero requires native code mode to be disabled");
-		const ringZeroInheritedMcpServerNames = ringZeroActive ? await lifecycleTiming.measure("ring-zero-mcp-config-read", () => readCodexInheritedMcpServerNames(params.client, params.cwd, params.signal)) : [];
-		if (ringZeroActive) await lifecycleTiming.measure("ring-zero-config-requirements-read", () => assertCodexRingZeroHasNoManagedHooks(params.client, params.signal));
-		const ringZeroConfigFingerprint = ringZeroActive ? fingerprintJsonObject({
-			version: 1,
-			baseInstructions: "",
-			config: buildCodexRingZeroThreadConfigPatch(params.params, true, ringZeroInheritedMcpServerNames)
-		}) : void 0;
-		const ringZeroClientInstanceId = ringZeroActive ? getCodexAppServerClientInstanceId(params.client) : void 0;
+		const { contextEngineBinding, dynamicToolsContainDeferred, dynamicToolsFingerprint, environmentSelectionFingerprint, hostSystemAgentActive, legacyDynamicToolsFingerprint, legacyUserMcpServersFingerprint, lifecycleTiming, nativeSkillIsolation, nativeSkillIsolationFingerprint, networkProxyConfigFingerprint, ringZeroActive, ringZeroClientInstanceId, ringZeroConfigFingerprint, ringZeroInheritedMcpServerNames, userMcpServersConfigPatch, userMcpServersFingerprint, webSearchThreadConfigFingerprint } = await prepareCodexThreadLifecyclePreflight(params);
 		let binding = await lifecycleTiming.measure("read-binding", () => params.bindingStore.read(bindingIdentity));
+		const initialBoundThreadId = binding?.threadId;
 		const normalizeBindingModelProvider = (authProfileId, modelProvider) => normalizeCodexAppServerBindingModelProvider({
 			authProfileId,
 			modelProvider,
@@ -2867,14 +3463,13 @@ async function startOrResumeThread(params) {
 			agentDir: params.params.agentDir,
 			config: params.params.config
 		});
-		const throwIfAborted = () => {
-			if (!params.signal?.aborted) return;
-			const reason = params.signal.reason;
-			if (reason instanceof Error) throw reason;
-			const error = new Error(typeof reason === "string" && reason.length > 0 ? reason : "codex app-server thread lifecycle aborted");
-			error.name = "AbortError";
-			throw error;
-		};
+		const throwIfAborted = () => throwIfCodexThreadLifecycleAborted(params.signal);
+		const releaseRetainedThread = (threadId) => releaseCodexRetainedLiveThread({
+			client: params.client,
+			abandonClient: params.abandonClient,
+			lifecycleTiming,
+			threadId
+		});
 		if (!binding && bindingIdentity.kind === "session" && bindingIdentity.sessionKey) {
 			if (!await lifecycleTiming.measure("reclaim-binding-generation", () => reclaimCurrentCodexSessionGeneration({
 				bindingStore: params.bindingStore,
@@ -2883,13 +3478,14 @@ async function startOrResumeThread(params) {
 			}))) throw createCodexSessionGenerationSupersededError(bindingIdentity.sessionId);
 		}
 		if (binding?.pendingSupervisionBranch) {
+			await releaseRetainedThread(binding.threadId);
 			const pendingBinding = binding;
 			const pluginThreadConfig = params.pluginThreadConfig?.enabled ? await lifecycleTiming.measure("plugin-config-build", () => params.pluginThreadConfig?.build()) : void 0;
 			const finalConfigPatch = params.buildFinalConfigPatch?.({ action: "start" }) ?? {
 				configPatch: params.finalConfigPatch,
 				nativeHookRelayGeneration: params.nativeHookRelayGeneration
 			};
-			const config = lifecycleTiming.measureSync("merge-thread-config", () => mergeCodexThreadConfigs(params.config, userMcpServersConfigPatch, pluginThreadConfig?.configPatch, finalConfigPatch.configPatch));
+			const config = lifecycleTiming.measureSync("merge-thread-config", () => applyCodexNativeSkillIsolation(mergeCodexThreadConfigs(params.config, userMcpServersConfigPatch, pluginThreadConfig?.configPatch, finalConfigPatch.configPatch), nativeSkillIsolation));
 			return await materializePendingSupervisionBranch({
 				client: params.client,
 				abandonClient: params.abandonClient ?? (() => closeCodexStartupClientBestEffort(params.client)),
@@ -2907,6 +3503,7 @@ async function startOrResumeThread(params) {
 				nativeCodeModeOnlyEnabled: params.nativeCodeModeOnlyEnabled,
 				webSearchAllowed: params.webSearchAllowed,
 				environmentSelection: params.environmentSelection,
+				provisionalAppIds: pluginThreadConfig?.provisionalAppIds,
 				signal: params.signal,
 				throwIfAborted,
 				lifecycleTiming,
@@ -2919,6 +3516,7 @@ async function startOrResumeThread(params) {
 					dynamicToolsFingerprint,
 					dynamicToolsContainDeferred,
 					webSearchThreadConfigFingerprint,
+					nativeSkillIsolationFingerprint,
 					userMcpServersFingerprint,
 					mcpServersFingerprint: params.mcpServersFingerprintEvaluated === true ? params.mcpServersFingerprint : pendingBinding.mcpServersFingerprint,
 					networkProxyProfileName: params.appServer.networkProxy?.profileName,
@@ -2944,6 +3542,10 @@ async function startOrResumeThread(params) {
 			})) throw new CodexThreadBindingConflictError(current.threadId, operation);
 			binding = void 0;
 		};
+		if (binding?.threadId && binding.nativeSkillIsolationFingerprint !== nativeSkillIsolationFingerprint) {
+			embeddedAgentLog.debug("codex app-server native skill isolation changed; starting a new thread", { threadId: binding.threadId });
+			await clearCurrentBinding("rotating stale native skill isolation");
+		}
 		if (binding?.threadId && (binding.ringZeroConfigFingerprint !== ringZeroConfigFingerprint || binding.ringZeroClientInstanceId !== ringZeroClientInstanceId) && (ringZeroActive || binding.ringZeroConfigFingerprint !== void 0)) {
 			embeddedAgentLog.debug("codex app-server ring-zero restriction changed; rotating thread", { threadId: binding.threadId });
 			await clearCurrentBinding("rotating a ring-zero thread binding");
@@ -3130,6 +3732,32 @@ async function startOrResumeThread(params) {
 			await clearCurrentBinding("rotating an unavailable ephemeral thread binding");
 			binding = void 0;
 		} else {
+			const warmReuse = await tryReuseCodexLiveThread({
+				params,
+				binding,
+				bindingIdentity,
+				clientId,
+				contextEngineBinding,
+				dynamicToolsFingerprint,
+				hostSystemAgentActive,
+				lifecycleTiming,
+				nativeSkillIsolation,
+				releaseConsumedThread: (threadId, cause) => releaseCodexConsumedLiveThread({
+					client: params.client,
+					abandonClient: params.abandonClient,
+					lifecycleTiming,
+					threadId,
+					cause
+				}),
+				ringZeroActive,
+				ringZeroInheritedMcpServerNames,
+				startModelProvider,
+				startModelSelection,
+				throwIfAborted,
+				userMcpServersConfigPatch
+			});
+			if (warmReuse.binding) return warmReuse.binding;
+			await releaseRetainedThread(binding.threadId);
 			const resumed = await resumeExistingCodexThread(params, {
 				binding,
 				bindingIdentity,
@@ -3139,6 +3767,7 @@ async function startOrResumeThread(params) {
 				dynamicToolsFingerprint,
 				dynamicToolsContainDeferred,
 				webSearchThreadConfigFingerprint,
+				nativeSkillIsolationFingerprint,
 				userMcpServersFingerprint,
 				ringZeroConfigFingerprint,
 				ringZeroClientInstanceId,
@@ -3148,13 +3777,16 @@ async function startOrResumeThread(params) {
 				hostSystemAgentActive,
 				ringZeroActive,
 				ringZeroInheritedMcpServerNames,
+				nativeSkillIsolation,
 				lifecycleTiming,
 				normalizeBindingModelProvider,
 				throwIfAborted,
-				clearCurrentBinding
+				clearCurrentBinding,
+				prebuiltFinalConfigPatch: warmReuse.prebuiltFinalConfigPatch
 			});
 			if (resumed) return resumed;
 		}
+		if (initialBoundThreadId) await releaseRetainedThread(initialBoundThreadId);
 		return await startFreshCodexThread(params, {
 			bindingIdentity,
 			startModelSelection,
@@ -3163,6 +3795,7 @@ async function startOrResumeThread(params) {
 			dynamicToolsFingerprint,
 			dynamicToolsContainDeferred,
 			webSearchThreadConfigFingerprint,
+			nativeSkillIsolationFingerprint,
 			userMcpServersFingerprint,
 			ringZeroConfigFingerprint,
 			ringZeroClientInstanceId,
@@ -3172,6 +3805,7 @@ async function startOrResumeThread(params) {
 			hostSystemAgentActive,
 			ringZeroActive,
 			ringZeroInheritedMcpServerNames,
+			nativeSkillIsolation,
 			lifecycleTiming,
 			normalizeBindingModelProvider,
 			throwIfAborted,
@@ -3282,7 +3916,7 @@ function buildTurnStartParams(params, options) {
 		cwd: options.cwd,
 		approvalPolicy: options.appServer.approvalPolicy,
 		approvalsReviewer: options.appServer.approvalsReviewer,
-		...useThreadPermissionProfile ? {} : { sandboxPolicy: options.sandboxPolicy ?? codexSandboxPolicyForTurn(options.appServer.sandbox, options.cwd) },
+		...useThreadPermissionProfile ? {} : { sandboxPolicy: options.sandboxPolicy ?? codexSandboxPolicyForTurn(options.appServer.sandbox, options.cwd, options.appServer.start?.args) },
 		...modelSelection ? {
 			model: modelSelection.model,
 			personality: CODEX_NATIVE_PERSONALITY_NONE
@@ -3350,4 +3984,4 @@ function joinPresentSections(...sections) {
 	return sections.filter((section) => Boolean(section?.trim())).join("\n\n");
 }
 //#endregion
-export { shouldBuildCodexPluginThreadConfig as $, resolveCodexDynamicToolsLoading as A, codexDynamicToolsFingerprint as B, readCodexSupportedReasoningEfforts as C, isForcedPrivateQaCodexRuntime as D, filterCodexDynamicToolsWithOpenClawShell as E, closeCodexStartupClientBestEffort as F, projectContextEngineAssemblyForCodex as G, buildContextEngineBinding as H, interruptCodexTurnBestEffort as I, buildCodexPluginAppsConfigPatchFromPolicyContext as J, resolveCodexContextEngineProjectionMaxChars as K, retireCodexAppServerClientAfterTimedOutTurn as L, CODEX_APP_SERVER_INTERRUPT_TIMEOUT_MS as M, CODEX_APP_SERVER_UNSUBSCRIBE_TIMEOUT_MS as N, isSystemAgentOnlyCodexDynamicToolAllowlist as O, CodexAppServerUnsafeSubscriptionError as P, mergeCodexThreadConfigs as Q, unsubscribeCodexThreadBestEffort as R, resolveReasoningEffort as S, filterCodexDynamicTools as T, isContextEngineBindingCompatible as U, codexLegacyDynamicToolsFingerprint as V, fitCodexProjectedContextForTurnStart as W, buildCodexPluginThreadConfigInputFingerprint as X, buildCodexPluginThreadConfig as Y, buildCodexPluginThreadConfigTimeoutFallback as Z, CODEX_NATIVE_PERSONALITY_NONE as _, sanitizeCodexHistoryImagePayloads as a, readCodexErrorNotificationMessage as at, resolveCodexAppServerThreadModelSelection as b, resumeCodexAppServerThread as c, readItemString as ct, buildCodexRingZeroThreadConfigPatch as d, readNonNegativeInteger as dt, ensureCodexPluginActivation as et, buildCodexRuntimeThreadConfig as f, readNullableString as ft, buildDeveloperInstructions as g, resolveCodexWebSearchPlan as h, splitPlanText as ht, invalidInlineImageText as i, normalizeNonEmptyString as it, resolveCodexDynamicToolsLoadingForRuntime as j, normalizeCodexDynamicToolName as k, assertCodexRingZeroHasNoManagedHooks as l, readNonEmptyString as lt, buildCodexNativeWebSearchThreadConfig as m, readString as mt, buildTurnStartParams as n, resolveRecoverableCodexPluginConfigKeys as nt, sanitizeInlineImageDataUrl$1 as o, readHookOutputEntries as ot, readCodexInheritedMcpServerNames as p, readNumber as pt, resolveCodexContextEngineProjectionReserveTokens as q, buildCodexUserInput as r, extractRawAssistantText as rt, startOrResumeThread as s, readItem as st, buildTurnCollaborationMode as t, pluginReadParams as tt, attestCodexRingZeroThreadHasNoMcpServers as u, readNonEmptyStringArray as ut, resolveCodexAppServerModelProvider as v, isCodexAppServerProfilerEnabled as w, resolveCodexBindingModelProviderFallback as x, resolveCodexAppServerRequestModelSelection as y, areCodexDynamicToolFingerprintsCompatible as z };
+export { readCodexErrorNotificationMessage as $, resolveCodexDynamicToolsLoading as A, resolveCodexContextEngineProjectionReserveTokens as B, resolveReasoningEffort as C, isForcedPrivateQaCodexRuntime as D, filterCodexDynamicToolsWithOpenClawShell as E, buildContextEngineBinding as F, mergeCodexThreadConfigs as G, buildCodexPluginThreadConfig as H, isContextEngineBindingCompatible as I, isOpenAiCuratedMarketplace as J, shouldBuildCodexPluginThreadConfig as K, fitCodexProjectedContextForTurnStart as L, areCodexDynamicToolFingerprintsCompatible as M, codexDynamicToolsFingerprint as N, isSystemAgentOnlyCodexDynamicToolAllowlist as O, codexLegacyDynamicToolsFingerprint as P, normalizeNonEmptyString as Q, projectContextEngineAssemblyForCodex as R, resolveCodexBindingModelProviderFallback as S, filterCodexDynamicTools as T, buildCodexPluginThreadConfigInputFingerprint as U, buildCodexPluginAppsConfigPatchFromPolicyContext as V, buildCodexPluginThreadConfigTimeoutFallback as W, resolveRecoverableCodexPluginConfigKeys as X, pluginReadParams as Y, extractRawAssistantText as Z, buildDeveloperInstructions as _, unsubscribeCodexThreadBestEffort as _t, sanitizeCodexHistoryImagePayloads as a, readNonNegativeInteger as at, resolveCodexAppServerRequestModelSelection as b, isCodexAppServerProfilerEnabled as c, readString as ct, attestCodexRingZeroThreadHasNoMcpServers as d, CODEX_APP_SERVER_UNSUBSCRIBE_TIMEOUT_MS as dt, readHookOutputEntries as et, buildCodexRingZeroThreadConfigPatch as f, CodexAppServerUnsafeSubscriptionError as ft, resolveCodexWebSearchPlan as g, retireCodexAppServerClientAfterTimedOutTurn as gt, buildCodexNativeWebSearchThreadConfig as h, interruptCodexTurnBestEffort as ht, invalidInlineImageText as i, readNonEmptyStringArray as it, resolveCodexDynamicToolsLoadingForRuntime as j, normalizeCodexDynamicToolName as k, resumeCodexAppServerThread as l, splitPlanText as lt, readCodexInheritedMcpServerNames as m, interruptCodexTurnAndWaitBestEffort as mt, buildTurnStartParams as n, readItemString as nt, sanitizeInlineImageDataUrl$1 as o, readNullableString as ot, buildCodexRuntimeThreadConfig as p, closeCodexStartupClientBestEffort as pt, ensureCodexPluginActivation as q, buildCodexUserInput as r, readNonEmptyString as rt, startOrResumeThread as s, readNumber as st, buildTurnCollaborationMode as t, readItem as tt, assertCodexRingZeroHasNoManagedHooks as u, CODEX_APP_SERVER_INTERRUPT_TIMEOUT_MS as ut, CODEX_NATIVE_PERSONALITY_NONE as v, readCodexSupportedReasoningEfforts as w, resolveCodexAppServerThreadModelSelection as x, resolveCodexAppServerModelProvider as y, resolveCodexContextEngineProjectionMaxChars as z };