@openclaw/codex 2026.7.2-beta.5 → 2026.7.33

package/dist/{thread-lifecycle-DRg_FdzC.js → .setup/thread-lifecycle-u6CZdOOH.mjs}

@@ -1,95 +1,237 @@
-import { B as flattenCodexDynamicToolFunctions, E as resolveCodexAppServerClientInstanceId, V as isJsonObject, _ as CodexAppServerRpcError, s as isCodexAppServerStartSelectionChangedError, v as getCodexAppServerClientInstanceId, w as isCodexAppServerPrewriteRequestCancellationError, x as isCodexAppServerConnectionClosedError } from "./shared-client-BVKE40c-.js";
-import { A as CODEX_PLUGINS_WORKSPACE_MARKETPLACE_NAME, E as resolveCodexPluginsPolicy, a as hashCodexAppServerBindingFingerprint, c as reclaimCurrentCodexSessionGeneration, f as codexSandboxPolicyForTurn, i as createCodexSessionGenerationSupersededError, k as CODEX_PLUGINS_MARKETPLACE_NAME, l as sessionBindingIdentity, n as assertCodexBindingMayBeReplaced, o as isCodexAppServerNativeAuthProfile, s as normalizeCodexAppServerBindingModelProvider } from "./session-binding-DlVQ-Pxs.js";
-import { a as closeCodexStartupClientBestEffort, c as isCodexAppServerUnsafeSubscriptionError, i as assertCodexThreadResumeSubscription, n as CODEX_APP_SERVER_UNSUBSCRIBE_TIMEOUT_MS, r as CodexAppServerUnsafeSubscriptionError, u as unsubscribeCodexThreadBestEffort } from "./attempt-client-cleanup-Ia52yRWc.js";
-import { i as assertCodexThreadStartResponse, n as assertCodexThreadForkResponse, r as assertCodexThreadResumeResponse } from "./protocol-validators-Dm4eXZmt.js";
-import { a as serializeCodexAppInventoryError, i as defaultCodexAppInventoryCache, t as buildCodexAppServerConnectionFingerprint } from "./plugin-app-cache-key-DSXX-rXO.js";
-import { t as isIncognitoSessionKey } from "./incognito-session-ET_ufDH-.js";
-import { a as projectBoundedCodexThreadHistory } from "./transcript-mirror-uKA-A4tB.js";
-import { SKILL_WORKSHOP_TOOL_NAME, buildSkillWorkshopPromptSection, embeddedAgentLog, formatErrorMessage, isActiveHarnessContextEngine, isHostScopedAgentToolActive } from "openclaw/plugin-sdk/agent-harness-runtime";
-import * as crypto$1 from "node:crypto";
+import { n as flattenCodexDynamicToolFunctions, r as isJsonObject } from "./protocol-2POPqAY4.mjs";
+import { h as resolveCodexPluginsPolicy, i as codexSandboxPolicyForTurn, t as CODEX_PLUGINS_MARKETPLACE_NAME } from "./config-CYEDnLJ2.mjs";
+import { n as assertCodexThreadResumeResponse, r as assertCodexThreadStartResponse } from "./protocol-validators-dZQ-UTOa.mjs";
+import { CODEX_GPT5_HEARTBEAT_PROMPT_OVERLAY } from "../prompt-overlay.js";
+import { a as readCodexSupportedReasoningEfforts, i as isModernCodexModel, o as resolveCodexFallbackReasoningEfforts, r as isMaxReasoningCodexModel, s as resolveCodexSupportedReasoningEffort } from "./provider-DGxDs6g8.mjs";
+import { f as isCodexAppServerConnectionClosedError, n as clearSharedCodexAppServerClientIfCurrentAndUnclaimed, s as retireSharedCodexAppServerClientIfCurrent, t as clearSharedCodexAppServerClientIfCurrent, u as CodexAppServerRpcError } from "./shared-client-B2KmLPRw.mjs";
+import { a as normalizeCodexAppServerBindingModelProvider, i as isCodexAppServerNativeAuthProfile, o as reclaimCurrentCodexSessionGeneration, r as hashCodexAppServerBindingFingerprint, s as sessionBindingIdentity } from "./session-binding-DuihlMJc.mjs";
+import "node:fs/promises";
+import "node:path";
+import { isFutureDateTimestampMs, resolveDateTimestampMs, resolveExpiresAtMsFromDurationMs } from "openclaw/plugin-sdk/number-runtime";
+import { truncateUtf16Safe } from "openclaw/plugin-sdk/text-utility-runtime";
 import crypto from "node:crypto";
 import { isRecord } from "openclaw/plugin-sdk/string-coerce-runtime";
-import { sliceUtf16Safe, truncateUtf16Safe } from "openclaw/plugin-sdk/text-utility-runtime";
-import { redactSensitiveFieldValue, redactToolPayloadText } from "openclaw/plugin-sdk/logging-core";
-import { buildCodexUserMcpServersThreadConfigPatchForRuntime } from "openclaw/plugin-sdk/codex-mcp-projection";
-import { isDiagnosticFlagEnabled } from "openclaw/plugin-sdk/diagnostic-runtime";
+import { SKILL_WORKSHOP_TOOL_NAME, buildSkillWorkshopPromptSection, embeddedAgentLog, formatErrorMessage, isActiveHarnessContextEngine } from "openclaw/plugin-sdk/agent-harness-runtime";
+import { buildCodexUserMcpServersThreadConfigPatch } from "openclaw/plugin-sdk/codex-mcp-projection";
 import { listRegisteredPluginAgentPromptGuidance } from "openclaw/plugin-sdk/plugin-runtime";
-import { GPT5_HEARTBEAT_PROMPT_OVERLAY } from "openclaw/plugin-sdk/provider-model-shared";
+import { redactSensitiveFieldValue, redactToolPayloadText } from "openclaw/plugin-sdk/logging-core";
 import { INLINE_IMAGE_DATA_URL_PREFIX, sanitizeInlineImageDataUrl } from "openclaw/plugin-sdk/inline-image-data-url-runtime";
-//#region extensions/codex/src/app-server/event-projector-values.ts
-function readString(record, key) {
-	const value = record[key];
-	return typeof value === "string" ? value : void 0;
-}
-function normalizeNonEmptyString(value) {
-	if (typeof value !== "string") return;
-	return value.trim() || void 0;
-}
-function readNonEmptyString(record, key) {
-	return normalizeNonEmptyString(record[key]);
-}
-function readNonEmptyStringArray(record, key) {
-	const value = record[key];
-	if (!Array.isArray(value)) return [];
-	const entries = [];
-	for (const entry of value) {
-		const normalized = normalizeNonEmptyString(entry);
-		if (normalized) entries.push(normalized);
+import { isDiagnosticFlagEnabled } from "openclaw/plugin-sdk/diagnostic-runtime";
+const CODEX_TARGETED_APP_INVENTORY_LIMIT = 1e3;
+const MAX_SERIALIZED_ERROR_MESSAGE_LENGTH = 500;
+/** In-memory app inventory cache with coalesced refreshes per key. */
+var CodexAppInventoryCache = class {
+	constructor(options = {}) {
+		this.entries = /* @__PURE__ */ new Map();
+		this.inFlight = /* @__PURE__ */ new Map();
+		this.refreshTokens = /* @__PURE__ */ new Map();
+		this.diagnostics = /* @__PURE__ */ new Map();
+		this.revision = 0;
+		this.ttlMs = options.ttlMs ?? 36e5;
+	}
+	/** Reads a snapshot and schedules refresh when missing, stale, or forced. */
+	read(params) {
+		const nowMs = resolveDateTimestampMs(params.nowMs);
+		const entry = this.entries.get(params.key);
+		if (!entry) {
+			const refreshScheduled = params.suppressRefresh ? false : this.scheduleRefresh(params);
+			return {
+				state: "missing",
+				key: params.key,
+				revision: this.revision,
+				refreshScheduled,
+				...this.diagnostics.get(params.key) ? { diagnostic: this.diagnostics.get(params.key) } : {}
+			};
+		}
+		const state = entry.invalidated || !isFutureDateTimestampMs(entry.expiresAtMs, { nowMs }) ? "stale" : "fresh";
+		const refreshScheduled = state === "fresh" && !params.forceRefetch ? false : this.scheduleRefresh(params);
+		return {
+			state,
+			key: params.key,
+			revision: entry.revision,
+			snapshot: stripEntryState(entry),
+			refreshScheduled,
+			...entry.lastError ? { diagnostic: entry.lastError } : {}
+		};
+	}
+	/** Forces or joins an immediate refresh for a cache key. */
+	refreshNow(params) {
+		return this.refresh(params);
+	}
+	/** Marks a key stale and records the reason as a diagnostic. */
+	invalidate(key, reason, nowMs = Date.now()) {
+		this.revision += 1;
+		const diagnostic = {
+			message: reason,
+			atMs: nowMs
+		};
+		const entry = this.entries.get(key);
+		if (entry) {
+			entry.invalidated = true;
+			entry.lastError = diagnostic;
+			entry.revision = this.revision;
+		} else this.diagnostics.set(key, diagnostic);
+		return this.revision;
+	}
+	/** Clears all cached snapshots, diagnostics, in-flight requests, and revision state. */
+	clear() {
+		this.entries.clear();
+		this.inFlight.clear();
+		this.refreshTokens.clear();
+		this.diagnostics.clear();
+		this.revision = 0;
+	}
+	/** Returns the monotonically increasing cache revision. */
+	getRevision() {
+		return this.revision;
+	}
+	scheduleRefresh(params) {
+		if (this.inFlight.has(params.key) && !params.forceRefetch) return true;
+		const promise = this.refresh(params);
+		this.inFlight.set(params.key, promise);
+		promise.catch(() => void 0);
+		return true;
 	}
-	return entries;
+	async refresh(params) {
+		const existing = this.inFlight.get(params.key);
+		if (existing && !params.forceRefetch) return existing;
+		const refreshToken = (this.refreshTokens.get(params.key) ?? 0) + 1;
+		this.refreshTokens.set(params.key, refreshToken);
+		const promise = this.refreshUncoalesced(params, refreshToken);
+		this.inFlight.set(params.key, promise);
+		try {
+			return await promise;
+		} finally {
+			if (this.inFlight.get(params.key) === promise) this.inFlight.delete(params.key);
+		}
+	}
+	async refreshUncoalesced(params, refreshToken) {
+		const nowMs = resolveDateTimestampMs(params.nowMs);
+		try {
+			const apps = await listAllApps(params.request, params.forceRefetch ?? false, params.targetAppIds);
+			this.revision += 1;
+			const expiresAtMs = resolveExpiresAtMsFromDurationMs(this.ttlMs, { nowMs }) ?? 0;
+			const snapshot = {
+				key: params.key,
+				apps,
+				fetchedAtMs: nowMs,
+				expiresAtMs,
+				revision: this.revision
+			};
+			if (this.refreshTokens.get(params.key) === refreshToken) {
+				this.entries.set(params.key, {
+					...snapshot,
+					invalidated: false
+				});
+				this.diagnostics.delete(params.key);
+			}
+			return snapshot;
+		} catch (error) {
+			const diagnostic = {
+				message: sanitizeErrorMessage(error instanceof Error ? error.message : String(error)),
+				atMs: nowMs
+			};
+			this.diagnostics.set(params.key, diagnostic);
+			const entry = this.entries.get(params.key);
+			if (entry) entry.lastError = diagnostic;
+			embeddedAgentLog.warn("codex app inventory refresh failed", {
+				forceRefetch: params.forceRefetch === true,
+				keyFingerprint: fingerprintInventoryCacheKey(params.key),
+				error: serializeCodexAppInventoryError(error)
+			});
+			throw error;
+		}
+	}
+};
+/** Serializes a refresh failure without leaking large or sensitive error data. */
+function serializeCodexAppInventoryError(error) {
+	const record = isRecord(error) ? error : void 0;
+	const data = record && "data" in record ? redactErrorData(record.data) : void 0;
+	return {
+		name: error instanceof Error ? error.name : typeof record?.name === "string" ? record.name : void 0,
+		message: sanitizeErrorMessage(error instanceof Error ? error.message : String(error)),
+		...typeof record?.code === "number" ? { code: record.code } : {},
+		...data !== void 0 ? { data } : {}
+	};
 }
-function readNullableString(record, key) {
-	const value = record[key];
-	if (value === null) return null;
-	return typeof value === "string" ? value : void 0;
-}
-function readNumber(record, key) {
-	const value = record[key];
-	return typeof value === "number" && Number.isFinite(value) ? value : void 0;
-}
-function readNonNegativeInteger(record, key) {
-	const value = readNumber(record, key);
-	return value !== void 0 && Number.isInteger(value) && value >= 0 ? value : void 0;
-}
-function readCodexErrorNotificationMessage(record) {
-	const error = record.error;
-	return isJsonObject(error) ? readString(error, "message") : void 0;
-}
-function readHookOutputEntries(value) {
-	if (!Array.isArray(value)) return [];
-	return value.flatMap((entry) => {
-		if (!isJsonObject(entry)) return [];
-		const text = readString(entry, "text");
-		if (!text) return [];
-		const kind = readString(entry, "kind");
-		return [{
-			...kind ? { kind } : {},
-			text
-		}];
+/** Shared app inventory cache used by Codex app-server runtime paths. */
+const defaultCodexAppInventoryCache = new CodexAppInventoryCache();
+/** Builds a stable cache key from build versions and runtime identity fields. */
+function buildCodexAppInventoryCacheKey(input, openClawVersion, codexPluginVersion) {
+	return JSON.stringify({
+		openClawVersion,
+		codexPluginVersion,
+		codexHome: input.codexHome ?? null,
+		endpoint: input.endpoint ?? null,
+		runtimeIdentity: normalizeRuntimeIdentityForCacheKey(input.runtimeIdentity),
+		authProfileId: input.authProfileId ?? null,
+		accountId: input.accountId ?? null,
+		envApiKeyFingerprint: input.envApiKeyFingerprint ?? null,
+		appServerVersion: input.appServerVersion ?? null
 	});
 }
-function splitPlanText(text) {
-	return text.split(/\r?\n/).map((line) => line.trim().replace(/^[-*]\s+/, "")).filter((line) => line.length > 0);
-}
-function extractRawAssistantText(item) {
-	return (Array.isArray(item.content) ? item.content : []).flatMap((entry) => {
-		if (!isJsonObject(entry)) return [];
-		const type = readString(entry, "type");
-		if (type !== "output_text" && type !== "text") return [];
-		const value = readString(entry, "text");
-		return value ? [value] : [];
-	}).join("").trim() || void 0;
-}
-function readItemString(item, key) {
-	const value = item[key];
-	return typeof value === "string" ? value : void 0;
-}
-function readItem(value) {
-	if (!isJsonObject(value)) return;
-	const type = typeof value.type === "string" ? value.type : void 0;
-	const id = typeof value.id === "string" ? value.id : void 0;
-	if (!type || !id) return;
-	return value;
+function normalizeRuntimeIdentityForCacheKey(value) {
+	if (!value) return null;
+	const entries = Object.entries(value).flatMap(([key, rawValue]) => {
+		const normalized = rawValue?.trim();
+		return normalized ? [[key, normalized]] : [];
+	}).toSorted(([left], [right]) => left.localeCompare(right));
+	return entries.length > 0 ? Object.fromEntries(entries) : null;
+}
+async function listAllApps(request, forceRefetch, targetAppIds = []) {
+	const apps = [];
+	const targetIds = new Set(targetAppIds.filter(Boolean));
+	const remainingTargetIds = new Set(targetIds);
+	const seenCursors = /* @__PURE__ */ new Set();
+	let cursor;
+	do {
+		const response = await request("app/list", {
+			cursor,
+			limit: targetIds.size > 0 ? CODEX_TARGETED_APP_INVENTORY_LIMIT : 100,
+			forceRefetch
+		});
+		apps.push(...response.data);
+		for (const app of response.data) remainingTargetIds.delete(app.id);
+		if (targetIds.size > 0 && remainingTargetIds.size === 0) break;
+		cursor = response.nextCursor;
+		if (cursor && seenCursors.has(cursor)) throw new Error(`app/list returned repeated cursor ${cursor}`);
+		if (cursor) seenCursors.add(cursor);
+	} while (cursor);
+	return apps;
+}
+function stripEntryState(entry) {
+	const { invalidated: _invalidated, ...snapshot } = entry;
+	return snapshot;
+}
+function fingerprintInventoryCacheKey(key) {
+	let hash = 0;
+	for (let index = 0; index < key.length; index += 1) hash = hash * 31 + key.charCodeAt(index) >>> 0;
+	return hash.toString(16).padStart(8, "0");
+}
+function redactErrorData(value, depth = 0) {
+	if (value === void 0) return;
+	if (value === null || typeof value === "boolean" || typeof value === "number") return value;
+	if (depth > 6) return "[truncated]";
+	if (Array.isArray(value)) return value.map((entry) => redactErrorData(entry, depth + 1) ?? null);
+	if (isRecord(value)) {
+		const redacted = {};
+		for (const [key, entry] of Object.entries(value)) redacted[key] = isSensitiveErrorDataKey(key) ? "<redacted>" : redactErrorData(entry, depth + 1) ?? null;
+		return redacted;
+	}
+	if (typeof value === "string" && value.length > 500) return `${truncateUtf16Safe(value, 500)}...`;
+	if (typeof value === "string") return value;
+	if (typeof value === "bigint") return value.toString();
+	if (typeof value === "symbol") return value.description ? `Symbol(${value.description})` : "Symbol()";
+	if (typeof value === "function") return value.name ? `[function ${value.name}]` : "[function]";
+	return "[unserializable]";
+}
+function sanitizeErrorMessage(message) {
+	const htmlStart = message.search(/<html[\s>]/i);
+	const redacted = (htmlStart >= 0 ? `${message.slice(0, htmlStart).trimEnd()} [HTML response body omitted]` : message).replace(/([?&][^=\s"'<>]*(?:api[_-]?key|authorization|cookie|credential|password|secret|token|tk)[^=\s"'<>]*=)[^&\s"'<>]+/gi, "$1<redacted>");
+	return redacted.length > MAX_SERIALIZED_ERROR_MESSAGE_LENGTH ? `${redacted.slice(0, MAX_SERIALIZED_ERROR_MESSAGE_LENGTH)}...` : redacted;
+}
+function isSensitiveErrorDataKey(key) {
+	return /api[_-]?key|authorization|cookie|credential|password|secret|token/i.test(key);
 }
 //#endregion
 //#region extensions/codex/src/app-server/plugin-inventory.ts
@@ -110,21 +252,19 @@ async function readCodexPluginInventory(params) {
 		}]
 	};
 	const appInventory = readCachedAppInventory(params);
-	const curatedListed = await listCodexPluginMetadata(params, "curated-global", {});
-	const shouldListWorkspacePlugins = policy.pluginPolicies.some((pluginPolicy) => pluginPolicy.enabled && pluginPolicy.marketplaceName === "workspace-directory");
-	let workspaceListResult;
-	if (shouldListWorkspacePlugins) try {
-		workspaceListResult = {
-			kind: "listed",
-			response: await listCodexPluginMetadata(params, "workspace-directory", {
-				cwds: [],
-				marketplaceKinds: [CODEX_PLUGINS_WORKSPACE_MARKETPLACE_NAME]
-			})
-		};
-	} catch (error) {
-		if (!(error instanceof CodexAppServerRpcError)) throw error;
-		workspaceListResult = { kind: "rejected" };
-	}
+	const listed = await params.request("plugin/list", { cwds: [] });
+	const marketplaceEntry = listed.marketplaces.find(isOpenAiCuratedMarketplace);
+	if (!marketplaceEntry) return {
+		policy,
+		records: [],
+		diagnostics: policy.pluginPolicies.filter((pluginPolicy) => pluginPolicy.enabled).map((pluginPolicy) => ({
+			code: "marketplace_missing",
+			plugin: pluginPolicy,
+			message: `Codex marketplace ${CODEX_PLUGINS_MARKETPLACE_NAME} was not found.`
+		})),
+		...appInventory ? { appInventory } : {}
+	};
+	let marketplace = marketplaceRef(marketplaceEntry);
 	const diagnostics = [];
 	const records = [];
 	if (appInventory?.state === "missing") diagnostics.push({
@@ -137,27 +277,19 @@ async function readCodexPluginInventory(params) {
 	});
 	for (const pluginPolicy of policy.pluginPolicies) {
 		if (!pluginPolicy.enabled) continue;
-		const listed = pluginPolicy.marketplaceName === "workspace-directory" ? workspaceListResult?.kind === "listed" ? workspaceListResult.response : void 0 : curatedListed;
-		const hasMarketplace = pluginPolicy.marketplaceName === "workspace-directory" ? listed?.marketplaces.some((entry) => entry.name === CODEX_PLUGINS_WORKSPACE_MARKETPLACE_NAME) === true : listed?.marketplaces.some(isOpenAiCuratedMarketplace) === true;
-		if (!listed || !hasMarketplace) {
-			diagnostics.push({
-				code: "marketplace_missing",
-				plugin: pluginPolicy,
-				message: `Codex marketplace ${pluginPolicy.marketplaceName} was not found.`
-			});
-			continue;
-		}
-		const resolvedPlugin = pluginPolicy.marketplaceName === "workspace-directory" ? findWorkspaceMarketplacePlugin(listed, pluginPolicy.pluginName) : findOpenAiCuratedMarketplacePlugin(listed, pluginPolicy.pluginName);
+		const resolvedPlugin = findOpenAiCuratedMarketplacePlugin(listed, pluginPolicy.pluginName);
 		if (!resolvedPlugin) {
 			diagnostics.push({
 				code: "plugin_missing",
 				plugin: pluginPolicy,
-				message: `${pluginPolicy.pluginName} was not found in ${pluginPolicy.marketplaceName}.`
+				message: `${pluginPolicy.pluginName} was not found in ${CODEX_PLUGINS_MARKETPLACE_NAME}.`
 			});
 			continue;
 		}
 		const { summary } = resolvedPlugin;
-		const detail = await readPluginDetail(params, marketplaceRef(resolvedPlugin.marketplace, pluginPolicy.marketplaceName), pluginPolicy, summary, diagnostics);
+		const pluginMarketplace = marketplaceRef(resolvedPlugin.marketplace);
+		if (records.length === 0) marketplace = pluginMarketplace;
+		const detail = await readPluginDetail(params, pluginMarketplace, pluginPolicy, summary, diagnostics);
 		const ownedAppIds = detail?.apps.map((app) => app.id).filter(Boolean).toSorted() ?? [];
 		const appOwnership = resolveAppOwnership({
 			detail,
@@ -192,6 +324,7 @@ async function readCodexPluginInventory(params) {
 	}
 	return {
 		policy,
+		marketplace,
 		records,
 		diagnostics,
 		...appInventory ? { appInventory } : {}
@@ -201,7 +334,7 @@ async function readCodexPluginInventory(params) {
 function findOpenAiCuratedPluginSummary(listed, pluginName) {
 	const resolved = findOpenAiCuratedMarketplacePlugin(listed, pluginName);
 	return resolved ? {
-		marketplace: marketplaceRef(resolved.marketplace, CODEX_PLUGINS_MARKETPLACE_NAME),
+		marketplace: marketplaceRef(resolved.marketplace),
 		summary: resolved.summary
 	} : void 0;
 }
@@ -213,31 +346,6 @@ function pluginReadParams(marketplace, pluginName) {
 		pluginName
 	};
 }
-/** Returns configured plugin keys whose current metadata may still recover. */
-function resolveRecoverableCodexPluginConfigKeys(params) {
-	return params.policy.pluginPolicies.filter((pluginPolicy) => pluginPolicy.enabled && !isSettledMissingPluginPolicy({
-		pluginPolicy,
-		metadataCache: params.metadataCache,
-		appCacheKey: params.appCacheKey
-	})).map((pluginPolicy) => pluginPolicy.configKey).toSorted();
-}
-async function listCodexPluginMetadata(params, queryKind, requestParams) {
-	if (!params.metadataCache || !params.appCacheKey || queryKind === "workspace-directory") return await params.request("plugin/list", requestParams);
-	return (await params.metadataCache.load({
-		appCacheKey: params.appCacheKey,
-		queryKind,
-		requestParams,
-		request: async (method, listedParams) => await params.request(method, listedParams),
-		cacheable: (response) => (response.marketplaces ?? []).some((marketplace) => isOpenAiCuratedMarketplace(marketplace))
-	})).response;
-}
-function isSettledMissingPluginPolicy(params) {
-	const queryKind = params.pluginPolicy.marketplaceName === "workspace-directory" ? "workspace-directory" : "curated-global";
-	const listed = params.metadataCache.read(params.appCacheKey, queryKind)?.response;
-	if (!listed) return false;
-	if (queryKind === "workspace-directory") return !findWorkspaceMarketplacePlugin(listed, params.pluginPolicy.pluginName);
-	return !findOpenAiCuratedMarketplacePlugin(listed, params.pluginPolicy.pluginName);
-}
 function readCachedAppInventory(params) {
 	if (!params.appCache || !params.appCacheKey) return;
 	const request = async (method, requestParams) => await params.request(method, requestParams);
@@ -250,14 +358,6 @@ function readCachedAppInventory(params) {
 }
 async function readPluginDetail(params, marketplace, pluginPolicy, summary, diagnostics) {
 	if (params.readPluginDetails === false) return;
-	if (marketplace.name === "workspace-directory" && marketplace.remoteMarketplaceName && !summary.remotePluginId) {
-		diagnostics.push({
-			code: "plugin_detail_unavailable",
-			plugin: pluginPolicy,
-			message: `${pluginPolicy.pluginName} detail unavailable: Codex did not return a remote plugin id.`
-		});
-		return;
-	}
 	try {
 		return (await params.request("plugin/read", pluginReadParams(marketplace, marketplace.remoteMarketplaceName && summary.remotePluginId ? summary.remotePluginId : pluginPolicy.pluginName))).plugin;
 	} catch (error) {
@@ -316,40 +416,31 @@ function findOpenAiCuratedMarketplacePlugin(listed, pluginName) {
 		};
 	}
 }
-function findWorkspaceMarketplacePlugin(listed, pluginName) {
-	const marketplace = listed.marketplaces.find((entry) => entry.name === CODEX_PLUGINS_WORKSPACE_MARKETPLACE_NAME);
-	const summary = marketplace?.plugins.find((plugin) => plugin.id === pluginName);
-	return marketplace && summary ? {
-		marketplace,
-		summary
-	} : void 0;
-}
 function pluginNameFromPluginId(pluginId, marketplaceName) {
 	const trimmed = pluginId.trim();
 	if (!trimmed) return;
 	const marketplaceSuffix = `@${marketplaceName}`;
 	return (trimmed.endsWith(marketplaceSuffix) ? trimmed.slice(0, -marketplaceSuffix.length) : trimmed).split("/").at(-1)?.trim() || void 0;
 }
-function marketplaceRef(marketplace, name) {
+function marketplaceRef(marketplace) {
 	return {
-		name,
+		name: CODEX_PLUGINS_MARKETPLACE_NAME,
 		...marketplace.path ? { path: marketplace.path } : {},
 		...!marketplace.path ? { remoteMarketplaceName: marketplace.name } : {}
 	};
 }
-/** True for either supported OpenAI curated marketplace wire name. */
 function isOpenAiCuratedMarketplace(marketplace) {
 	return marketplace.name === "openai-curated" || marketplace.name === CODEX_PLUGINS_REMOTE_MARKETPLACE_NAME;
 }
 //#endregion
 //#region extensions/codex/src/app-server/plugin-activation.ts
-/** Activates a curated plugin or rejects a workspace plugin that is not already active. */
+/** Installs/enables a configured Codex plugin and refreshes plugin/app state. */
 async function ensureCodexPluginActivation(params) {
-	if (params.identity.marketplaceName === "workspace-directory") return activationFailure(params.identity, "disabled", { message: "workspace-directory plugins must be installed and enabled outside OpenClaw before use." });
-	const listed = await listCuratedCodexPluginMetadata(params);
+	if (params.identity.marketplaceName !== "openai-curated") return activationFailure(params.identity, "marketplace_missing", { message: "Only openai-curated plugins can be activated." });
+	const listed = await params.request("plugin/list", { cwds: [] });
 	const resolved = findOpenAiCuratedPluginSummary(listed, params.identity.pluginName);
 	if (!resolved) {
-		if (!listed.marketplaces.some(isOpenAiCuratedMarketplace)) return activationFailure(params.identity, "marketplace_missing", { message: `Codex marketplace ${CODEX_PLUGINS_MARKETPLACE_NAME} was not found.` });
+		if (!listed.marketplaces.some((marketplace) => marketplace.name === "openai-curated")) return activationFailure(params.identity, "marketplace_missing", { message: `Codex marketplace ${CODEX_PLUGINS_MARKETPLACE_NAME} was not found.` });
 		return activationFailure(params.identity, "plugin_missing", { message: `${params.identity.pluginName} was not found in ${CODEX_PLUGINS_MARKETPLACE_NAME}.` });
 	}
 	if (resolved.summary.installed && resolved.summary.enabled && !params.installEvenIfActive) return {
@@ -361,7 +452,6 @@ async function ensureCodexPluginActivation(params) {
 		diagnostics: []
 	};
 	const installResponse = await params.request("plugin/install", pluginReadParams(resolved.marketplace, resolved.marketplace.remoteMarketplaceName && resolved.summary.remotePluginId ? resolved.summary.remotePluginId : params.identity.pluginName));
-	if (params.metadataCache && params.appCacheKey) params.metadataCache.invalidate(params.appCacheKey);
 	const refreshDiagnostics = [];
 	let refreshFailed = false;
 	try {
@@ -369,7 +459,6 @@ async function ensureCodexPluginActivation(params) {
 			request: params.request,
 			appCache: params.appCache,
 			appCacheKey: params.appCacheKey,
-			metadataCache: params.metadataCache,
 			targetAppIds: params.targetAppIds
 		});
 		refreshDiagnostics.push(...refreshResult.diagnostics);
@@ -391,7 +480,7 @@ async function ensureCodexPluginActivation(params) {
 /** Forces Codex plugin, skill, hook, MCP, and app inventory refreshes after activation. */
 async function refreshCodexPluginRuntimeState(params) {
 	const diagnostics = [];
-	await listCuratedCodexPluginMetadata(params);
+	await params.request("plugin/list", { cwds: [] });
 	await params.request("skills/list", {
 		cwds: [],
 		forceReload: true
@@ -418,17 +507,6 @@ async function refreshCodexPluginRuntimeState(params) {
 	}
 	return { diagnostics };
 }
-async function listCuratedCodexPluginMetadata(params) {
-	const requestParams = {};
-	if (!params.metadataCache || !params.appCacheKey) return await params.request("plugin/list", requestParams);
-	return (await params.metadataCache.load({
-		appCacheKey: params.appCacheKey,
-		queryKind: "curated-global",
-		requestParams,
-		request: async (method, listedParams) => await params.request(method, listedParams),
-		cacheable: (response) => (response.marketplaces ?? []).some((marketplace) => isOpenAiCuratedMarketplace(marketplace))
-	})).response;
-}
 function activationFailure(identity, reason, diagnostic, extraDiagnostics = []) {
 	return {
 		identity,
@@ -459,20 +537,6 @@ function buildCodexPluginThreadConfigInputFingerprint(params) {
 		appCacheKey: params.appCacheKey ?? null
 	});
 }
-/** Builds the deny-all app patch used when plugin discovery exceeds its turn budget. */
-function buildCodexPluginThreadConfigTimeoutFallback(params) {
-	return {
-		...emptyPluginThreadConfig({
-			enabled: true,
-			inputFingerprint: buildCodexPluginThreadConfigInputFingerprint(params),
-			configPatch: buildDisabledAppsConfigPatch()
-		}),
-		diagnostics: [{
-			code: "plugin_config_timeout",
-			message: params.message
-		}]
-	};
-}
 /** Builds the Codex apps config patch and policy context for a native thread. */
 async function buildCodexPluginThreadConfig(params) {
 	const appCache = params.appCache ?? defaultCodexAppInventoryCache;
@@ -492,7 +556,6 @@ async function buildCodexPluginThreadConfig(params) {
 		request: params.request,
 		appCache,
 		appCacheKey: params.appCacheKey,
-		metadataCache: params.metadataCache,
 		nowMs: params.nowMs,
 		suppressAppInventoryRefresh: true
 	}) : emptyCodexPluginInventory(policy);
@@ -509,7 +572,6 @@ async function buildCodexPluginThreadConfig(params) {
 			request: params.request,
 			appCache,
 			appCacheKey: params.appCacheKey,
-			metadataCache: params.metadataCache,
 			nowMs: params.nowMs
 		});
 		inputFingerprint = buildCodexPluginThreadConfigInputFingerprint({
@@ -526,7 +588,6 @@ async function buildCodexPluginThreadConfig(params) {
 			request: params.request,
 			appCache,
 			appCacheKey: params.appCacheKey,
-			metadataCache: params.metadataCache,
 			targetAppIds: record.ownedAppIds
 		});
 		activationResults.push(activation);
@@ -550,7 +611,6 @@ async function buildCodexPluginThreadConfig(params) {
 			request: params.request,
 			appCache,
 			appCacheKey: params.appCacheKey,
-			metadataCache: params.metadataCache,
 			nowMs: params.nowMs
 		});
 		inputFingerprint = buildCodexPluginThreadConfigInputFingerprint({
@@ -570,7 +630,6 @@ async function buildCodexPluginThreadConfig(params) {
 			request: params.request,
 			appCache,
 			appCacheKey: params.appCacheKey,
-			metadataCache: params.metadataCache,
 			nowMs: params.nowMs
 		});
 		inputFingerprint = buildCodexPluginThreadConfigInputFingerprint({
@@ -888,6 +947,127 @@ function stableStringify(value) {
 	return JSON.stringify(value);
 }
 //#endregion
+//#region extensions/codex/src/app-server/attempt-client-cleanup.ts
+/**
+* Best-effort cleanup helpers for Codex app-server startup attempts and turns.
+*/
+/** Timeout for best-effort app-server turn interruption during cleanup. */
+const CODEX_APP_SERVER_INTERRUPT_TIMEOUT_MS = 5e3;
+/** Timeout for best-effort thread unsubscribe during cleanup. */
+const CODEX_APP_SERVER_UNSUBSCRIBE_TIMEOUT_MS = 5e3;
+/** Raised when a thread subscription may be live on a client OpenClaw no longer controls. */
+var CodexAppServerUnsafeSubscriptionError = class extends Error {
+	constructor(message, options) {
+		super(message, options);
+		this.name = "CodexAppServerUnsafeSubscriptionError";
+	}
+};
+function isCodexAppServerUnsafeSubscriptionError(error) {
+	return error instanceof CodexAppServerUnsafeSubscriptionError;
+}
+/** Asserts Codex resumed the exact thread this attempt subscribed to. */
+function assertCodexThreadResumeSubscription(requestedThreadId, returnedThreadId) {
+	if (returnedThreadId !== requestedThreadId) throw new CodexAppServerUnsafeSubscriptionError(`Codex thread/resume returned ${returnedThreadId} for ${requestedThreadId}`);
+}
+async function closeClientAndWaitIfAvailable(client) {
+	const closeable = client;
+	if (typeof closeable.closeAndWait === "function") {
+		await closeable.closeAndWait();
+		return;
+	}
+	closeable.close?.();
+}
+async function closeCodexStartupClientBestEffort(client) {
+	if (!client) return;
+	const unclaimedSharedClient = clearSharedCodexAppServerClientIfCurrentAndUnclaimed(client);
+	if (unclaimedSharedClient.closed) {
+		await closeClientAndWaitIfAvailable(client);
+		return;
+	}
+	if (unclaimedSharedClient.found) {
+		if (retireSharedCodexAppServerClientIfCurrent(client)?.closed) await closeClientAndWaitIfAvailable(client);
+		return;
+	}
+	const retiredSharedClient = retireSharedCodexAppServerClientIfCurrent(client);
+	if (retiredSharedClient) {
+		if (retiredSharedClient.closed) await closeClientAndWaitIfAvailable(client);
+		return;
+	}
+	if (clearSharedCodexAppServerClientIfCurrent(client)) {
+		await closeClientAndWaitIfAvailable(client);
+		return;
+	}
+	await closeClientAndWaitIfAvailable(client);
+}
+/** Sends a turn interrupt without blocking abort cleanup on app-server errors. */
+function interruptCodexTurnBestEffort(client, params) {
+	const requestOptions = params.timeoutMs && Number.isFinite(params.timeoutMs) && params.timeoutMs > 0 ? { timeoutMs: params.timeoutMs } : void 0;
+	const requestParams = {
+		threadId: params.threadId,
+		turnId: params.turnId
+	};
+	try {
+		const interrupt = requestOptions ? client.request("turn/interrupt", requestParams, requestOptions) : client.request("turn/interrupt", requestParams);
+		Promise.resolve(interrupt).catch((error) => {
+			embeddedAgentLog.debug("codex app-server turn interrupt failed during abort", { error });
+		});
+	} catch (error) {
+		embeddedAgentLog.debug("codex app-server turn interrupt failed during abort", { error });
+	}
+}
+/** Unsubscribes from a thread while swallowing cleanup-only failures. */
+async function unsubscribeCodexThreadBestEffort(client, params) {
+	try {
+		await client.request("thread/unsubscribe", { threadId: params.threadId }, { timeoutMs: params.timeoutMs });
+		return true;
+	} catch (error) {
+		embeddedAgentLog.debug("codex app-server thread unsubscribe cleanup failed", {
+			threadId: params.threadId,
+			error
+		});
+		return false;
+	}
+}
+/**
+* Retires the shared client after a timed-out turn so later runs do not reuse a
+* potentially wedged app-server connection.
+*/
+async function retireCodexAppServerClientAfterTimedOutTurn(client, params) {
+	const retiredSharedClient = retireSharedCodexAppServerClientIfCurrent(client);
+	const detachedSharedClient = Boolean(retiredSharedClient);
+	interruptCodexTurnBestEffort(client, {
+		threadId: params.threadId,
+		turnId: params.turnId,
+		timeoutMs: CODEX_APP_SERVER_INTERRUPT_TIMEOUT_MS
+	});
+	await unsubscribeCodexThreadBestEffort(client, {
+		threadId: params.threadId,
+		timeoutMs: CODEX_APP_SERVER_UNSUBSCRIBE_TIMEOUT_MS
+	});
+	let closedClient = retiredSharedClient?.closed ?? false;
+	if (!detachedSharedClient) {
+		const close = client.close;
+		if (typeof close === "function") try {
+			close.call(client);
+			closedClient = true;
+		} catch (error) {
+			embeddedAgentLog.debug("codex app-server client close failed during timeout cleanup", {
+				threadId: params.threadId,
+				turnId: params.turnId,
+				error
+			});
+		}
+	}
+	embeddedAgentLog.warn("codex app-server client retired after timed-out turn", {
+		threadId: params.threadId,
+		turnId: params.turnId,
+		reason: params.reason,
+		detachedSharedClient,
+		closedClient,
+		activeSharedClientLeases: retiredSharedClient?.activeLeases ?? 0
+	});
+}
+//#endregion
 //#region extensions/codex/src/app-server/context-engine-projection.ts
 const CONTEXT_HEADER = "OpenClaw assembled context for this turn:";
 const CONTEXT_OPEN = "<conversation_context>";
@@ -943,9 +1123,13 @@ function resolveCodexContextEngineProjectionMaxChars(params) {
 		reserveTokens: params.reserveTokens
 	}) * APPROX_RENDERED_CHARS_PER_TOKEN);
 }
-/** Returns the fixed reserve used for Codex context-engine projections. */
-function resolveCodexContextEngineProjectionReserveTokens() {
-	return DEFAULT_CODEX_PROJECTION_RESERVE_TOKENS;
+/** Reads Codex projection reserve tokens from compaction config. */
+function resolveCodexContextEngineProjectionReserveTokens(params) {
+	const compaction = asRecord(asRecord(asRecord(params.config)?.agents)?.defaults)?.compaction;
+	const configuredReserveTokens = toNonNegativeInt(asRecord(compaction)?.reserveTokens);
+	const configuredReserveTokensFloor = toNonNegativeInt(asRecord(compaction)?.reserveTokensFloor);
+	if (configuredReserveTokens !== void 0) return Math.max(configuredReserveTokens, configuredReserveTokensFloor ?? 2e4);
+	if (configuredReserveTokensFloor !== void 0) return configuredReserveTokensFloor;
 }
 /** Fits projected context prompts under Codex app-server turn/start text limits. */
 function fitCodexProjectedContextForTurnStart(params) {
@@ -993,6 +1177,13 @@ function resolveProjectionPromptBudgetTokens(params) {
 	const effectiveReserveTokens = Math.min(requestedReserveTokens, Math.max(0, params.contextTokenBudget - minPromptBudget));
 	return Math.max(1, params.contextTokenBudget - effectiveReserveTokens);
 }
+function asRecord(value) {
+	return value && typeof value === "object" ? value : void 0;
+}
+function toNonNegativeInt(value) {
+	if (typeof value !== "number" || !Number.isFinite(value) || value < 0) return;
+	return Math.floor(value);
+}
 function dropDuplicateTrailingPrompt(messages, prompt) {
 	if (!prompt) return messages;
 	const trailing = messages.at(-1);
@@ -1120,9 +1311,7 @@ function resolveTextPartMaxChars(maxRenderedContextChars) {
 	return Math.min(MAX_TEXT_PART_CHARS, Math.max(DEFAULT_TEXT_PART_CHARS, Math.floor(maxRenderedContextChars / 4)));
 }
 function truncateText(text, maxChars) {
-	if (text.length <= maxChars) return text;
-	const truncated = truncateUtf16Safe(text, maxChars);
-	return `${truncated}\n[truncated ${text.length - truncated.length} chars]`;
+	return text.length > maxChars ? `${text.slice(0, maxChars)}\n[truncated ${text.length - maxChars} chars]` : text;
 }
 function truncateOlderContext(text, maxChars) {
 	if (text.length <= maxChars) return text;
@@ -1133,150 +1322,15 @@ function truncateOlderContext(text, maxChars) {
 	marker = buildMarker(text.length - tailChars);
 	if (marker.length >= maxChars) return marker.slice(0, maxChars);
 	tailChars = maxChars - marker.length;
-	return `${marker}${sliceUtf16Safe(text, -tailChars).trimStart()}`;
-}
-//#endregion
-//#region extensions/codex/src/app-server/thread-context-engine.ts
-function buildContextEngineBinding(params, projection) {
-	const contextEngine = isActiveHarnessContextEngine(params.contextEngine) ? params.contextEngine : void 0;
-	const engineId = contextEngine?.info?.id?.trim();
-	if (!contextEngine || !engineId) return;
-	return {
-		schemaVersion: 1,
-		engineId,
-		policyFingerprint: JSON.stringify({
-			schemaVersion: 1,
-			engineId,
-			engineVersion: contextEngine.info.version,
-			ownsCompaction: contextEngine.info.ownsCompaction === true,
-			turnMaintenanceMode: contextEngine.info.turnMaintenanceMode,
-			citationsMode: resolveContextEngineCitationsMode(params.config),
-			contextTokenBudget: params.contextTokenBudget,
-			projectionMaxChars: resolveCodexContextEngineProjectionMaxChars({
-				contextTokenBudget: params.contextTokenBudget,
-				reserveTokens: resolveCodexContextEngineProjectionReserveTokens()
-			})
-		}),
-		projection: projection ? buildContextEngineProjectionBinding(projection) : void 0
-	};
-}
-function buildContextEngineProjectionBinding(projection) {
-	return {
-		schemaVersion: 1,
-		mode: "thread_bootstrap",
-		epoch: projection.epoch,
-		fingerprint: projection.fingerprint
-	};
-}
-function isContextEngineBindingCompatible(previous, next) {
-	return previous?.schemaVersion === next.schemaVersion && previous.engineId === next.engineId && previous.policyFingerprint === next.policyFingerprint && areContextEngineProjectionBindingsCompatible(previous.projection, next.projection);
-}
-function areContextEngineProjectionBindingsCompatible(previous, next) {
-	if (!next) return previous === void 0;
-	return previous?.schemaVersion === next.schemaVersion && previous.mode === next.mode && previous.epoch === next.epoch && previous.fingerprint === next.fingerprint;
-}
-function resolveContextEngineCitationsMode(config) {
-	const rootConfig = isUnknownRecord(config) ? config : void 0;
-	const citations = (isUnknownRecord(rootConfig?.memory) ? rootConfig.memory : void 0)?.citations;
-	return isJsonConfigValue(citations) ? citations : void 0;
-}
-function isUnknownRecord(value) {
-	return Boolean(value && typeof value === "object" && !Array.isArray(value));
-}
-function isJsonConfigValue(value) {
-	if (value === null || typeof value === "string" || typeof value === "boolean") return true;
-	if (typeof value === "number") return Number.isFinite(value);
-	if (Array.isArray(value)) return value.every(isJsonConfigValue);
-	return isUnknownRecord(value) && Object.values(value).every(isJsonConfigValue);
-}
-//#endregion
-//#region extensions/codex/src/app-server/thread-fingerprints.ts
-function codexDynamicToolsFingerprint(dynamicTools) {
-	return fingerprintDynamicTools(dynamicTools);
-}
-function codexLegacyDynamicToolsFingerprint(dynamicTools) {
-	return legacyFingerprintDynamicTools(dynamicTools);
-}
-function areCodexDynamicToolFingerprintsCompatible(params) {
-	return areDynamicToolFingerprintsCompatible(params.previous, params.next, params.nextLegacy);
-}
-function fingerprintDynamicTools(dynamicTools) {
-	return hashCodexAppServerBindingFingerprint(legacyFingerprintDynamicTools(dynamicTools));
-}
-function legacyFingerprintDynamicTools(dynamicTools) {
-	return JSON.stringify(dynamicTools.map(fingerprintDynamicToolSpec).toSorted(compareJsonFingerprint));
-}
-function legacyFingerprintUserMcpServersConfigPatch(configPatch) {
-	return configPatch ? JSON.stringify(stabilizeJsonValue(configPatch)) : void 0;
-}
-function fingerprintUserMcpServersConfigPatch(configPatch) {
-	return configPatch ? hashCodexAppServerBindingFingerprint(JSON.stringify(stabilizeJsonValue(redactUserMcpServersFingerprintSecrets(configPatch)))) : void 0;
+	return `${marker}${sliceTailFromCodePointBoundary(text, tailChars).trimStart()}`;
 }
-function redactUserMcpServersFingerprintSecrets(value) {
-	if (Array.isArray(value)) return value.map(redactUserMcpServersFingerprintSecrets);
-	if (!value || typeof value !== "object") return value;
-	const next = {};
-	for (const [key, entry] of Object.entries(value)) {
-		if (key === "http_headers" && entry && typeof entry === "object" && !Array.isArray(entry)) {
-			next[key] = Object.fromEntries(Object.entries(entry).map(([header, headerValue]) => [header, header.toLowerCase() === "authorization" ? fingerprintUserMcpServersAuthorizationHeader(headerValue) : headerValue]));
-			continue;
-		}
-		next[key] = redactUserMcpServersFingerprintSecrets(entry);
-	}
-	return next;
-}
-function fingerprintUserMcpServersAuthorizationHeader(value) {
-	return typeof value === "string" && value.length > 0 ? `<redacted:sha256:${crypto$1.createHash("sha256").update(value).digest("hex")}>` : "<redacted>";
-}
-function fingerprintJsonObject(value) {
-	return JSON.stringify(stabilizeJsonValue(value));
-}
-function fingerprintEnvironmentSelection(environments) {
-	return environments ? JSON.stringify(environments.map(stabilizeJsonValue)) : void 0;
-}
-function fingerprintDynamicToolSpec(tool) {
-	return stabilizeDynamicToolFingerprintValue(tool);
-}
-function stabilizeDynamicToolFingerprintValue(value) {
-	if (Array.isArray(value)) return value.map(stabilizeDynamicToolFingerprintValue);
-	if (!isJsonObject(value)) return value;
-	const stable = {};
-	for (const [key, child] of Object.entries(value).toSorted(([left], [right]) => left.localeCompare(right))) {
-		if (key === "description") continue;
-		stable[key] = stabilizeDynamicToolFingerprintValue(child);
+function sliceTailFromCodePointBoundary(text, tailChars) {
+	let start = text.length - tailChars;
+	if (start > 0 && start < text.length) {
+		const code = text.charCodeAt(start);
+		if (code >= 56320 && code <= 57343) start += 1;
 	}
-	return stable;
-}
-function stabilizeJsonValue(value) {
-	if (Array.isArray(value)) return value.map(stabilizeJsonValue);
-	if (!isJsonObject(value)) return value;
-	const stable = {};
-	for (const [key, child] of Object.entries(value).toSorted(([left], [right]) => left.localeCompare(right))) stable[key] = stabilizeJsonValue(child);
-	return stable;
-}
-function readActiveCodexTurnIds(thread) {
-	return (thread.turns ?? []).filter((turn) => turn.status === "inProgress").map((turn) => typeof turn.id === "string" ? turn.id : "").filter((turnId) => turnId.trim().length > 0);
-}
-function readActiveCodexTurnIdsFromResume(response) {
-	const pagedTurns = response.initialTurnsPage?.data;
-	return readActiveCodexTurnIds(Array.isArray(pagedTurns) ? { turns: pagedTurns } : response.thread);
-}
-const LEGACY_EMPTY_DYNAMIC_TOOLS_FINGERPRINT = legacyFingerprintDynamicTools([]);
-const EMPTY_DYNAMIC_TOOLS_FINGERPRINT = hashCodexAppServerBindingFingerprint(LEGACY_EMPTY_DYNAMIC_TOOLS_FINGERPRINT);
-function areDynamicToolFingerprintsCompatible(previous, next, nextLegacy) {
-	return !previous || previous === next || previous === nextLegacy;
-}
-function areUserMcpServersFingerprintsCompatible(params) {
-	return params.previous === params.next || params.previous === params.nextLegacy || params.nextLegacy !== void 0 && params.previous === hashCodexAppServerBindingFingerprint(params.nextLegacy);
-}
-function shouldStartTransientNoToolThread(params) {
-	return Boolean(params.previous && !isEmptyDynamicToolsFingerprint(params.previous) && !params.nextHasDynamicTools);
-}
-function isEmptyDynamicToolsFingerprint(fingerprint) {
-	return fingerprint === EMPTY_DYNAMIC_TOOLS_FINGERPRINT || fingerprint === LEGACY_EMPTY_DYNAMIC_TOOLS_FINGERPRINT;
-}
-function compareJsonFingerprint(left, right) {
-	return JSON.stringify(left).localeCompare(JSON.stringify(right));
+	return text.slice(start);
 }
 //#endregion
 //#region extensions/codex/src/app-server/dynamic-tool-profile.ts
@@ -1294,12 +1348,6 @@ const CODEX_APP_SERVER_OWNED_DYNAMIC_TOOL_EXCLUDES = [
 	"tool_search",
 	"tool_search_code"
 ];
-const CODEX_NATIVE_GOAL_TOOL_EXCLUDES = [
-	"get_goal",
-	"create_goal",
-	"update_goal"
-];
-const CODEX_APP_SERVER_OWNED_SHELL_TOOL_EXCLUDES = /* @__PURE__ */ new Set(["exec", "process"]);
 const DYNAMIC_TOOL_NAME_ALIASES = {
 	bash: "exec",
 	"apply-patch": "apply_patch"
@@ -1309,10 +1357,6 @@ function normalizeCodexDynamicToolName(name) {
 	const normalized = name.trim().toLowerCase();
 	return DYNAMIC_TOOL_NAME_ALIASES[normalized] ?? normalized;
 }
-/** True only for the host-scoped OpenClaw run's exact tool contract. */
-function isSystemAgentOnlyCodexDynamicToolAllowlist(toolsAllow) {
-	return toolsAllow?.length === 1 && normalizeCodexDynamicToolName(toolsAllow[0] ?? "") === "openclaw";
-}
 /** Returns true for private QA runs that force the Codex runtime profile. */
 function isForcedPrivateQaCodexRuntime(env = process.env) {
 	return env.OPENCLAW_BUILD_PRIVATE_QA === "1" && env.OPENCLAW_QA_FORCE_RUNTIME?.trim().toLowerCase() === "codex";
@@ -1346,20 +1390,8 @@ function resolveCodexDynamicToolsLoadingForRuntime(config, modelId, options = {}
 }
 /** Filters OpenClaw tools that Codex owns natively or config explicitly excludes. */
 function filterCodexDynamicTools(tools, config, env = process.env) {
-	return filterCodexDynamicToolsWithOptions(tools, config, env, { preserveOpenClawShell: false });
-}
-/** Keeps exec/process only when Codex cannot advertise an environment-backed native shell. */
-function filterCodexDynamicToolsWithOpenClawShell(tools, config, env = process.env) {
-	return filterCodexDynamicToolsWithOptions(tools, config, env, { preserveOpenClawShell: true });
-}
-function filterCodexDynamicToolsWithOptions(tools, config, env, options) {
 	const excludes = /* @__PURE__ */ new Set();
-	for (const name of CODEX_NATIVE_GOAL_TOOL_EXCLUDES) excludes.add(name);
-	if (isForcedPrivateQaCodexRuntime(env)) excludes.add("apply_patch");
-	else for (const name of CODEX_APP_SERVER_OWNED_DYNAMIC_TOOL_EXCLUDES) {
-		if (options.preserveOpenClawShell && CODEX_APP_SERVER_OWNED_SHELL_TOOL_EXCLUDES.has(name)) continue;
-		excludes.add(name);
-	}
+	if (!isForcedPrivateQaCodexRuntime(env)) for (const name of CODEX_APP_SERVER_OWNED_DYNAMIC_TOOL_EXCLUDES) excludes.add(name);
 	for (const name of config.codexDynamicToolsExclude ?? []) {
 		const trimmed = normalizeCodexDynamicToolName(name);
 		if (trimmed) excludes.add(trimmed);
@@ -1367,268 +1399,98 @@ function filterCodexDynamicToolsWithOptions(tools, config, env, options) {
 	return excludes.size === 0 ? tools : tools.filter((tool) => !excludes.has(normalizeCodexDynamicToolName(tool.name)));
 }
 //#endregion
-//#region extensions/codex/src/app-server/profiler-flag.ts
-const PROFILER_FLAGS = ["profiler", "codex.profiler"];
-/** Checks the generic and Codex-specific profiler diagnostic flags. */
-function isCodexAppServerProfilerEnabled(config, env = process.env) {
-	return PROFILER_FLAGS.some((flag) => isDiagnosticFlagEnabled(flag, config, env));
-}
-//#endregion
-//#region extensions/codex/src/app-server/thread-binding-policy.ts
-function shouldRotateCodexAppServerBindingForRuntime(params) {
-	if (!params.current) return false;
-	if (params.binding === params.current) return false;
-	return params.connectionClass === "remote" || Boolean(params.binding);
-}
-function resolveCodexGpt56MultiAgentVersion(modelRef) {
-	let modelId = modelRef?.trim().toLowerCase();
-	if (!modelId) return;
-	const slashIndex = modelId.indexOf("/");
-	if (slashIndex > 0) {
-		const provider = modelId.slice(0, slashIndex);
-		if (provider !== "openai" && provider !== "codex") return;
-		modelId = modelId.slice(slashIndex + 1);
-	}
-	if (modelId === "gpt-5.6-sol" || modelId === "gpt-5.6-terra") return "v2";
-	return modelId === "gpt-5.6-luna" ? "v1" : void 0;
-}
-function shouldRotateCodexGpt56MultiAgentBinding(params) {
-	const bindingVersion = resolveCodexGpt56MultiAgentVersion(params.bindingModel);
-	const requestedVersion = resolveCodexGpt56MultiAgentVersion(params.requestedModel);
-	return Boolean(bindingVersion && requestedVersion && bindingVersion !== requestedVersion);
-}
-function isTransientWebSearchRestriction(params) {
-	if (params.nativeProviderWebSearchSupport === "unknown") return true;
-	if (params.params.config?.tools?.web?.search?.enabled === false) return false;
-	if (params.params.disableTools === true) return true;
-	const persistentWebSearchRestriction = params.webSearchAllowed === false && params.persistentWebSearchAllowed === false;
-	if (params.nativeCodeModeEnabled === false && !persistentWebSearchRestriction) return true;
-	if (params.webSearchAllowed !== false) return false;
-	if (params.persistentWebSearchAllowed !== void 0) return params.persistentWebSearchAllowed;
-	if (params.params.toolsAllow === void 0) return false;
-	return !params.params.toolsAllow.some((name) => {
-		const normalized = normalizeCodexDynamicToolName(name);
-		return normalized === "*" || normalized === "web_search";
-	});
+//#region extensions/codex/src/app-server/image-payload-sanitizer.ts
+/**
+* Sanitizes inline image payloads mirrored through Codex history so invalid
+* base64 data becomes readable text instead of poisoning replayed transcripts.
+*/
+const IMAGE_OMITTED_TEXT = "omitted image payload: invalid inline image data";
+/** Validates and normalizes an inline image data URL for Codex history payloads. */
+function sanitizeInlineImageDataUrl$1(imageUrl) {
+	return sanitizeInlineImageDataUrl(imageUrl);
 }
-function shouldRecheckRecoverablePluginBinding(params) {
-	if (!params.pluginThreadConfig?.enabled) return false;
-	if (!params.binding.pluginAppsFingerprint || !params.binding.pluginAppsInputFingerprint || params.binding.pluginAppsInputFingerprint !== params.pluginThreadConfig.inputFingerprint) return false;
-	const policyContext = params.binding.pluginAppPolicyContext;
-	if (!policyContext) return false;
-	const enabledPluginConfigKeys = params.pluginThreadConfig.enabledPluginConfigKeys ?? [];
-	const recoverablePluginConfigKeys = params.pluginThreadConfig.recoverablePluginConfigKeys ?? enabledPluginConfigKeys;
-	const recoverablePluginConfigKeySet = new Set(recoverablePluginConfigKeys);
-	const bindingContainsSettledPlugin = enabledPluginConfigKeys.filter((configKey) => !recoverablePluginConfigKeySet.has(configKey)).some((configKey) => (policyContext.pluginAppIds[configKey]?.length ?? 0) > 0 || Object.values(policyContext.apps).some((app) => app.source !== "account" && app.configKey === configKey));
-	const accountAppRecoveryEnabled = params.pluginThreadConfig.accountAppRecoveryEnabled ?? enabledPluginConfigKeys.length === 0;
-	return bindingContainsSettledPlugin || accountAppRecoveryEnabled && Object.keys(policyContext.apps).length === 0 || recoverablePluginConfigKeys.length > 0;
+/** Builds the replacement text inserted when an inline image payload is invalid. */
+function invalidInlineImageText(label) {
+	return `[${label}] ${IMAGE_OMITTED_TEXT}`;
 }
-//#endregion
-//#region extensions/codex/src/app-server/thread-lifecycle-errors.ts
-var CodexThreadStartRequestError = class extends Error {
-	constructor(cause) {
-		super(formatErrorMessage(cause), { cause });
-		this.name = "CodexThreadStartRequestError";
-	}
-};
-var CodexThreadBindingConflictError = class extends Error {
-	constructor(threadId, operation) {
-		super(`Codex thread binding changed while ${operation}: ${threadId}`);
-		this.name = "CodexThreadBindingConflictError";
+function sanitizeImageContentRecord(record, label) {
+	if (record.type === "image" && typeof record.data === "string") {
+		const mimeType = typeof record.mimeType === "string" ? record.mimeType : "image/png";
+		const imageUrl = sanitizeInlineImageDataUrl$1(`data:${mimeType};base64,${record.data}`);
+		if (!imageUrl) return {
+			type: "text",
+			text: invalidInlineImageText(label)
+		};
+		const commaIndex = imageUrl.indexOf(",");
+		const mime = imageUrl.slice(INLINE_IMAGE_DATA_URL_PREFIX.length, commaIndex).split(";")[0] ?? mimeType;
+		return {
+			...record,
+			mimeType: mime,
+			data: imageUrl.slice(commaIndex + 1)
+		};
 	}
-};
-var CodexRingZeroAttestationError = class extends Error {
-	constructor(cause) {
-		super("Codex ring-zero MCP attestation failed", { cause });
-		this.name = "CodexRingZeroAttestationError";
+	if (record.type === "inputImage" && typeof record.imageUrl === "string") {
+		const imageUrl = sanitizeInlineImageDataUrl$1(record.imageUrl);
+		return imageUrl ? {
+			...record,
+			imageUrl
+		} : {
+			type: "inputText",
+			text: invalidInlineImageText(label)
+		};
 	}
-};
-var CodexThreadBindingConflictAfterCleanupError = class extends CodexThreadBindingConflictError {};
-var CodexAdoptedThreadActiveError = class extends Error {
-	constructor() {
-		super("Codex session became active in another runner; wait for it to finish before continuing");
-		this.name = "CodexAdoptedThreadActiveError";
+	if (record.type === "input_image" && typeof record.image_url === "string") {
+		const imageUrl = sanitizeInlineImageDataUrl$1(record.image_url);
+		return imageUrl ? {
+			...record,
+			image_url: imageUrl
+		} : {
+			type: "input_text",
+			text: invalidInlineImageText(label)
+		};
 	}
-};
-//#endregion
-//#region extensions/codex/src/app-server/reasoning-effort.ts
-const CODEX_REASONING_EFFORTS = [
-	"minimal",
-	"low",
-	"medium",
-	"high",
-	"xhigh",
-	"max",
-	"ultra"
-];
-const GPT_56_MAX_REASONING_EFFORTS = [
-	"low",
-	"medium",
-	"high",
-	"xhigh",
-	"max"
-];
-const GPT_56_ULTRA_REASONING_EFFORTS = [...GPT_56_MAX_REASONING_EFFORTS, "ultra"];
-const GPT_5_PRO_REASONING_EFFORTS = [
-	"medium",
-	"high",
-	"xhigh"
-];
-const GPT_56_ULTRA_MODEL_IDS = /* @__PURE__ */ new Set(["gpt-5.6-sol", "gpt-5.6-terra"]);
-const GPT_56_MAX_MODEL_IDS = /* @__PURE__ */ new Set([...GPT_56_ULTRA_MODEL_IDS, "gpt-5.6-luna"]);
-const MODERN_CODEX_MODEL_IDS = /* @__PURE__ */ new Set([
-	...GPT_56_MAX_MODEL_IDS,
-	"gpt-5.5",
-	"gpt-5.5-pro",
-	"gpt-5.4",
-	"gpt-5.4-pro",
-	"gpt-5.4-mini",
-	"gpt-5.3-codex-spark"
-]);
-function normalizeCodexReasoningEfforts(efforts) {
-	if (!efforts) return [];
-	const supported = new Set(efforts.map((effort) => effort.trim().toLowerCase()));
-	return CODEX_REASONING_EFFORTS.filter((effort) => supported.has(effort));
-}
-/** Read reasoning metadata after the Codex app-server route has been selected. */
-function readCodexSupportedReasoningEfforts(compat) {
-	if (!compat || typeof compat !== "object" || Array.isArray(compat)) return;
-	const efforts = compat.supportedReasoningEfforts;
-	if (!Array.isArray(efforts)) return;
-	return efforts.filter((effort) => typeof effort === "string");
-}
-function resolveSupportedReasoningEffort(params) {
-	const supported = normalizeCodexReasoningEfforts(params.supportedReasoningEfforts);
-	if (supported.includes(params.requested)) return params.requested;
-	const fallbackEfforts = params.requested === "ultra" ? supported : supported.filter((effort) => effort !== "ultra");
-	const requestedRank = CODEX_REASONING_EFFORTS.indexOf(params.requested);
-	return fallbackEfforts.find((effort) => CODEX_REASONING_EFFORTS.indexOf(effort) >= requestedRank) ?? fallbackEfforts.at(-1);
-}
-function resolveFallbackReasoningEfforts(modelId) {
-	const normalized = modelId.trim().toLowerCase();
-	if (GPT_56_ULTRA_MODEL_IDS.has(normalized)) return GPT_56_ULTRA_REASONING_EFFORTS;
-	if (normalized === "gpt-5.6-luna") return GPT_56_MAX_REASONING_EFFORTS;
-	if (normalized === "gpt-5.5-pro" || normalized === "gpt-5.4-pro") return GPT_5_PRO_REASONING_EFFORTS;
-}
-/** Resolve a turn effort from app-server metadata, with exact-name offline fallbacks. */
-function resolveCodexAppServerReasoningEffort(params) {
-	if (params.thinkLevel === "off" || params.thinkLevel === "adaptive") return null;
-	const supportedReasoningEfforts = params.supportedReasoningEfforts ?? resolveFallbackReasoningEfforts(params.modelId);
-	if (supportedReasoningEfforts) return resolveSupportedReasoningEffort({
-		requested: params.thinkLevel,
-		supportedReasoningEfforts
-	}) ?? null;
-	const normalizedModelId = params.modelId.trim().toLowerCase();
-	if (params.thinkLevel === "minimal") return MODERN_CODEX_MODEL_IDS.has(normalizedModelId) ? "low" : "minimal";
-	if (params.thinkLevel === "low" || params.thinkLevel === "medium" || params.thinkLevel === "high" || params.thinkLevel === "xhigh") return params.thinkLevel;
-	return params.thinkLevel === "max" && GPT_56_MAX_MODEL_IDS.has(normalizedModelId) ? "max" : null;
-}
-//#endregion
-//#region extensions/codex/src/app-server/thread-model-selection.ts
-const CODEX_NATIVE_PERSONALITY_NONE = "none";
-function resolveCodexBindingModelProviderFallback(params) {
-	const provider = params.provider?.trim().toLowerCase();
-	if (provider && provider !== "codex") return;
-	const currentModel = params.currentModel?.trim();
-	const bindingModel = params.bindingModel?.trim();
-	if (currentModel && bindingModel && currentModel === bindingModel && params.bindingModelProvider) return params.bindingModelProvider;
-	return hasProviderQualifiedModelRef(currentModel) ? void 0 : params.bindingModelProvider;
-}
-function resolveCodexAppServerThreadModelSelection(params) {
-	const authProfileId = params.authProfileId ?? params.binding?.authProfileId;
-	const explicitModelProvider = resolveCodexAppServerModelProvider({
-		provider: params.provider,
-		authProfileId,
-		authProfileStore: params.authProfileStore,
-		agentDir: params.agentDir,
-		config: params.config
-	});
-	const bindingModelProvider = params.binding?.threadId ? resolveCodexBindingModelProviderFallback({
-		provider: params.provider,
-		currentModel: params.model,
-		bindingModel: params.binding.model,
-		bindingModelProvider: params.binding.modelProvider
-	}) : void 0;
-	return resolveCodexAppServerRequestModelSelection({
-		model: params.model,
-		modelProvider: explicitModelProvider ?? bindingModelProvider,
-		authProfileId,
-		authProfileStore: params.authProfileStore,
-		agentDir: params.agentDir,
-		config: params.config
-	});
-}
-function resolveCodexAppServerRequestModelSelection(params) {
-	const model = params.model.trim();
-	const modelProvider = params.modelProvider?.trim();
-	if (modelProvider) return {
-		model,
-		modelProvider
-	};
-	const slashIndex = model.indexOf("/");
-	if (slashIndex <= 0 || slashIndex >= model.length - 1) return { model };
-	const inferredModelProvider = resolveCodexAppServerModelProvider({
-		provider: model.slice(0, slashIndex),
-		authProfileId: params.authProfileId,
-		authProfileStore: params.authProfileStore,
-		agentDir: params.agentDir,
-		config: params.config
-	});
-	return {
-		model: model.slice(slashIndex + 1).trim(),
-		...inferredModelProvider ? { modelProvider: inferredModelProvider } : {}
-	};
-}
-function hasProviderQualifiedModelRef(model) {
-	const trimmed = model?.trim();
-	const slashIndex = trimmed?.indexOf("/") ?? -1;
-	return slashIndex > 0 && slashIndex < (trimmed?.length ?? 0) - 1;
-}
-function resolveCodexAppServerModelProvider(params) {
-	const normalized = params.provider.trim();
-	const normalizedLower = normalized.toLowerCase();
-	if (!normalized || normalizedLower === "codex") return;
-	if (isCodexAppServerNativeAuthProfile(params) && normalizedLower === "openai") return;
-	return normalizedLower === "openai" ? "openai" : normalized;
 }
-function resolveReasoningEffort(thinkLevel, modelId, supportedReasoningEfforts) {
-	return resolveCodexAppServerReasoningEffort({
-		thinkLevel,
-		modelId,
-		supportedReasoningEfforts
-	});
+/** Recursively sanitizes all Codex history image shapes while preserving unknown structure. */
+function sanitizeCodexHistoryImagePayloads(value, label) {
+	if (Array.isArray(value)) return value.map((entry) => sanitizeCodexHistoryImagePayloads(entry, label));
+	if (!isRecord(value)) return value;
+	const imageRecord = sanitizeImageContentRecord(value, label);
+	if (imageRecord) return imageRecord;
+	const next = {};
+	for (const [key, child] of Object.entries(value)) next[key] = sanitizeCodexHistoryImagePayloads(child, label);
+	return next;
 }
 //#endregion
-//#region extensions/codex/src/app-server/thread-prompt.ts
-function buildDeveloperInstructions(params, options = {}) {
-	const nativeCommandGuidance = listRegisteredPluginAgentPromptGuidance({
-		surface: "codex_app_server",
-		includeLegacyGlobalGuidance: false
-	}).join("\n");
-	return [
-		"You are a personal agent running inside OpenClaw. OpenClaw has dynamic tools for OpenClaw-owned messaging, cron, sessions, media, gateway, and nodes.",
-		buildDeferredDynamicToolManifest(options.dynamicTools),
-		buildSkillWorkshopInstruction(options.dynamicTools),
-		"Use Codex native `spawn_agent` for Codex subagents. `spawn_agent` and the other native collaboration tools may be deferred: when `spawn_agent` is not directly listed, load it with `tool_search` before spawning. Use OpenClaw `sessions_spawn` only for OpenClaw or ACP delegation, never as a substitute for `spawn_agent`.",
-		buildVisibleReplyInstruction(params, options.dynamicTools),
-		nativeCommandGuidance,
-		params.extraSystemPrompt
-	].filter((section) => typeof section === "string" && section.trim()).join("\n\n");
-}
-function buildDeferredDynamicToolManifest(dynamicTools) {
-	const deferredToolNames = [...new Set(flattenCodexDynamicToolFunctions(dynamicTools).filter((tool) => tool.deferLoading === true).map((tool) => tool.name.trim()).filter(Boolean))].toSorted((left, right) => left.localeCompare(right));
-	if (deferredToolNames.length === 0) return;
-	return `Deferred searchable OpenClaw dynamic tools available: ${deferredToolNames.join(", ")}. Use \`tool_search\` to load exact callable specs before use.`;
-}
-function buildSkillWorkshopInstruction(dynamicTools) {
-	if (!flattenCodexDynamicToolFunctions(dynamicTools).some((tool) => tool.name.trim() === SKILL_WORKSHOP_TOOL_NAME)) return;
-	return buildSkillWorkshopPromptSection().join("\n");
+//#region extensions/codex/src/app-server/profiler-flag.ts
+const PROFILER_FLAGS = ["profiler", "codex.profiler"];
+/** Checks the generic and Codex-specific profiler diagnostic flags. */
+function isCodexAppServerProfilerEnabled(config, env = process.env) {
+	return PROFILER_FLAGS.some((flag) => isDiagnosticFlagEnabled(flag, config, env));
 }
-function buildVisibleReplyInstruction(params, dynamicTools) {
-	const messageToolAvailable = dynamicTools ? flattenCodexDynamicToolFunctions(dynamicTools).some((tool) => tool.name.trim() === "message") : params.disableMessageTool !== true;
-	if (params.sourceReplyDeliveryMode === "message_tool_only" && messageToolAvailable) return "Visible source replies are not automatically delivered for this run. Use `message(action=send)` for user-visible source-channel output. For progress, set `final=false`. When the message is the completed reply to the current source conversation, set `final=true`; OpenClaw stops after confirming delivery. If `final` is omitted, OpenClaw continues and resolves the latest omitted source reply only when the turn ends successfully. Do not repeat visible message content in your final answer.";
-	if (messageToolAvailable) return "For the current source conversation, reply normally in your final assistant message; OpenClaw will deliver it through the active source conversation. Use `message` only for explicit out-of-band sends, media/file sends, or sends to a different target.";
-	return "For the current source conversation, reply normally in your final assistant message; OpenClaw will deliver it through the active source conversation.";
+//#endregion
+//#region extensions/codex/src/app-server/thread-resume.ts
+/** Owns Codex thread/resume subscription safety. */
+/** Resumes one thread and retires the physical client when acceptance is indeterminate. */
+async function resumeCodexAppServerThread(params) {
+	const threadId = params.request.threadId;
+	let response;
+	try {
+		response = assertCodexThreadResumeResponse(await params.client.request("thread/resume", params.request, {
+			...params.timeoutMs !== void 0 ? { timeoutMs: params.timeoutMs } : {},
+			...params.signal ? { signal: params.signal } : {}
+		}));
+		assertCodexThreadResumeSubscription(threadId, response.thread.id);
+	} catch (error) {
+		if (error instanceof CodexAppServerRpcError) throw error;
+		try {
+			await params.abandonClient();
+		} catch (abandonError) {
+			throw new CodexAppServerUnsafeSubscriptionError(`Codex thread/resume client could not be retired for ${threadId}`, { cause: abandonError });
+		}
+		if (error instanceof CodexAppServerUnsafeSubscriptionError) throw error;
+		throw new CodexAppServerUnsafeSubscriptionError(error instanceof Error ? error.message : `Codex thread/resume outcome is indeterminate for ${threadId}`, { cause: error });
+	}
+	return response;
 }
 //#endregion
 //#region extensions/codex/src/app-server/web-search.ts
@@ -1697,589 +1559,32 @@ function resolveCodexWebSearchPlan(params) {
 		threadConfig: buildCodexNativeWebSearchThreadConfig(params.config)
 	};
 }
+//#endregion
+//#region extensions/codex/src/app-server/thread-lifecycle.ts
+var CodexThreadStartRequestError = class extends Error {
+	constructor(cause) {
+		super(formatErrorMessage(cause), { cause });
+		this.name = "CodexThreadStartRequestError";
+	}
+};
+var CodexThreadBindingConflictError = class extends Error {
+	constructor(threadId, operation) {
+		super(`Codex thread binding changed while ${operation}: ${threadId}`);
+		this.name = "CodexThreadBindingConflictError";
+	}
+};
+const CODEX_NATIVE_PERSONALITY_NONE = "none";
 const CODEX_CODE_MODE_THREAD_CONFIG = {
 	"features.code_mode": true,
 	"features.code_mode_only": false,
 	"features.apply_patch_streaming_events": true
 };
-const CODEX_GOAL_CONTINUATION_DISABLED_THREAD_CONFIG = { "features.goals": false };
 const CODEX_CODE_MODE_DISABLED_THREAD_CONFIG = {
 	"features.code_mode": false,
 	"features.code_mode_only": false
 };
 const CODEX_LIGHTWEIGHT_CONTEXT_THREAD_CONFIG = { project_doc_max_bytes: 0 };
 const CODEX_TOOL_SEARCH_UNSUPPORTED_THREAD_CONFIG = { "features.multi_agent": false };
-const CODEX_DELEGATION_DISABLED_THREAD_CONFIG = {
-	"features.multi_agent": false,
-	"features.multi_agent_v2": false
-};
-const CODEX_RING_ZERO_THREAD_CONFIG = {
-	"features.apps": false,
-	"features.current_time_reminder": false,
-	"features.deferred_executor": false,
-	"features.enable_fanout": false,
-	"features.goals": false,
-	"features.hooks": false,
-	"features.image_generation": false,
-	"features.memories": false,
-	"features.multi_agent": false,
-	"features.multi_agent_v2": false,
-	"features.plugins": false,
-	"features.standalone_web_search": false,
-	"features.token_budget": false,
-	"orchestrator.mcp.enabled": false,
-	"orchestrator.skills.enabled": false,
-	"tools.experimental_request_user_input.enabled": false,
-	hooks: {
-		PreToolUse: [],
-		PermissionRequest: [],
-		PostToolUse: [],
-		PreCompact: [],
-		PostCompact: [],
-		SessionStart: [],
-		UserPromptSubmit: [],
-		SubagentStart: [],
-		SubagentStop: [],
-		Stop: []
-	},
-	project_doc_max_bytes: 0,
-	notify: [],
-	web_search: "disabled"
-};
-const CODEX_RING_ZERO_RESTRICTED_FEATURES = /* @__PURE__ */ new Set([
-	"apps",
-	"code_mode",
-	"code_mode_only",
-	"current_time_reminder",
-	"deferred_executor",
-	"enable_fanout",
-	"goals",
-	"hooks",
-	"image_generation",
-	"memories",
-	"multi_agent",
-	"multi_agent_v2",
-	"plugins",
-	"standalone_web_search",
-	"token_budget"
-]);
-const CODEX_RING_ZERO_OVERRIDABLE_LAYER_TYPES = /* @__PURE__ */ new Set([
-	"mdm",
-	"system",
-	"enterpriseManaged",
-	"user",
-	"project",
-	"sessionFlags"
-]);
-function buildThreadStartParams(params, options) {
-	const ringZeroActive = (options.hostSystemAgentActive ?? isHostScopedAgentToolActive("openclaw")) && isSystemAgentOnlyCodexDynamicToolAllowlist(params.toolsAllow);
-	const resolvedModelProvider = resolveCodexAppServerModelProvider({
-		provider: params.provider,
-		authProfileId: params.authProfileId,
-		authProfileStore: params.authProfileStore,
-		agentDir: params.agentDir,
-		config: params.config
-	});
-	const modelSelection = resolveCodexAppServerRequestModelSelection({
-		model: options.model ?? params.modelId,
-		modelProvider: options.modelProvider ?? resolvedModelProvider,
-		authProfileId: params.authProfileId,
-		authProfileStore: params.authProfileStore,
-		agentDir: params.agentDir,
-		config: params.config
-	});
-	return {
-		model: modelSelection.model,
-		...modelSelection.modelProvider ? { modelProvider: modelSelection.modelProvider } : {},
-		cwd: options.cwd,
-		approvalPolicy: options.appServer.approvalPolicy,
-		approvalsReviewer: resolveCodexThreadApprovalsReviewer(options.appServer, options.config),
-		...codexThreadSandboxOrPermissions(options.appServer),
-		...options.appServer.serviceTier !== void 0 ? { serviceTier: options.appServer.serviceTier } : {},
-		personality: CODEX_NATIVE_PERSONALITY_NONE,
-		serviceName: "OpenClaw",
-		...ringZeroActive ? { baseInstructions: "" } : {},
-		config: buildCodexRuntimeThreadConfigForRun(params, options.config, {
-			nativeCodeModeEnabled: options.nativeCodeModeEnabled,
-			nativeProviderWebSearchSupport: options.nativeProviderWebSearchSupport,
-			nativeCodeModeOnlyEnabled: options.nativeCodeModeOnlyEnabled,
-			directOnlyToolNamespaces: resolveDirectOnlyToolNamespaces(options.dynamicTools),
-			webSearchAllowed: options.webSearchAllowed,
-			appServer: options.appServer,
-			hostSystemAgentActive: options.hostSystemAgentActive,
-			ringZeroInheritedMcpServerNames: options.ringZeroInheritedMcpServerNames
-		}),
-		...resolveCodexThreadEnvironmentSelection(options),
-		developerInstructions: options.developerInstructions ?? buildDeveloperInstructions(params, { dynamicTools: options.dynamicTools }),
-		dynamicTools: [...options.dynamicTools],
-		experimentalRawEvents: true,
-		...isIncognitoSessionKey(params.sessionKey) ? { ephemeral: true } : {}
-	};
-}
-function buildThreadResumeParams(params, options) {
-	const modelSelection = options.preserveNativeModel ? void 0 : resolveCodexAppServerRequestModelSelection({
-		model: options.model ?? params.modelId,
-		modelProvider: options.modelProvider ?? resolveCodexAppServerModelProvider({
-			provider: params.provider,
-			authProfileId: options.authProfileId ?? params.authProfileId,
-			authProfileStore: params.authProfileStore,
-			agentDir: params.agentDir,
-			config: params.config
-		}),
-		authProfileId: options.authProfileId ?? params.authProfileId,
-		authProfileStore: params.authProfileStore,
-		agentDir: params.agentDir,
-		config: params.config
-	});
-	return {
-		threadId: options.threadId,
-		excludeTurns: true,
-		initialTurnsPage: {
-			limit: 1,
-			sortDirection: "desc",
-			itemsView: "notLoaded"
-		},
-		...modelSelection ? {
-			model: modelSelection.model,
-			...modelSelection.modelProvider ? { modelProvider: modelSelection.modelProvider } : {}
-		} : {},
-		approvalPolicy: options.appServer.approvalPolicy,
-		approvalsReviewer: resolveCodexThreadApprovalsReviewer(options.appServer, options.config),
-		...codexThreadSandboxOrPermissions(options.appServer),
-		...options.appServer.serviceTier !== void 0 ? { serviceTier: options.appServer.serviceTier } : {},
-		personality: CODEX_NATIVE_PERSONALITY_NONE,
-		config: buildCodexRuntimeThreadConfigForRun(params, options.config, {
-			nativeCodeModeEnabled: options.nativeCodeModeEnabled,
-			nativeProviderWebSearchSupport: options.nativeProviderWebSearchSupport,
-			nativeCodeModeOnlyEnabled: options.nativeCodeModeOnlyEnabled,
-			directOnlyToolNamespaces: resolveDirectOnlyToolNamespaces(options.dynamicTools),
-			webSearchAllowed: options.webSearchAllowed,
-			appServer: options.appServer,
-			hostSystemAgentActive: options.hostSystemAgentActive,
-			ringZeroInheritedMcpServerNames: options.ringZeroInheritedMcpServerNames
-		}),
-		developerInstructions: options.developerInstructions ?? buildDeveloperInstructions(params, { dynamicTools: options.dynamicTools })
-	};
-}
-function buildCodexRuntimeThreadConfig(config, options = {}) {
-	const codeModeConfig = {
-		...CODEX_CODE_MODE_THREAD_CONFIG,
-		"features.code_mode_only": options.nativeCodeModeOnlyEnabled === true
-	};
-	if (options.nativeCodeModeEnabled === false) {
-		const disabledConfig = mergeCodexThreadConfigs(config, CODEX_CODE_MODE_DISABLED_THREAD_CONFIG, CODEX_GOAL_CONTINUATION_DISABLED_THREAD_CONFIG) ?? { ...CODEX_CODE_MODE_DISABLED_THREAD_CONFIG };
-		delete disabledConfig["features.apply_patch_streaming_events"];
-		return disabledConfig;
-	}
-	if (options.nativeCodeModeOnlyEnabled === true) return ensureDirectOnlyToolNamespaces(mergeCodexThreadConfigs(codeModeConfig, config, CODEX_GOAL_CONTINUATION_DISABLED_THREAD_CONFIG, { "features.code_mode_only": true }) ?? {
-		...codeModeConfig,
-		...CODEX_GOAL_CONTINUATION_DISABLED_THREAD_CONFIG,
-		"features.code_mode_only": true
-	}, options.directOnlyToolNamespaces);
-	return ensureDirectOnlyToolNamespaces(mergeCodexThreadConfigs(codeModeConfig, config, CODEX_GOAL_CONTINUATION_DISABLED_THREAD_CONFIG) ?? {
-		...codeModeConfig,
-		...CODEX_GOAL_CONTINUATION_DISABLED_THREAD_CONFIG
-	}, options.directOnlyToolNamespaces);
-}
-function ensureDirectOnlyToolNamespaces(config, requiredNamespaces) {
-	if (!requiredNamespaces?.length) return config;
-	const configured = config["code_mode.direct_only_tool_namespaces"];
-	const namespaces = Array.isArray(configured) ? configured.filter((entry) => typeof entry === "string" && entry.length > 0) : [];
-	return {
-		...config,
-		"code_mode.direct_only_tool_namespaces": [.../* @__PURE__ */ new Set([...namespaces, ...requiredNamespaces])]
-	};
-}
-function resolveDirectOnlyToolNamespaces(dynamicTools) {
-	return (dynamicTools ?? []).filter((tool) => tool.type === "namespace" && tool.name === "openclaw_direct").map((tool) => tool.name);
-}
-function buildCodexRuntimeThreadConfigForRun(params, config, options = {}) {
-	const ringZeroActive = (options.hostSystemAgentActive ?? isHostScopedAgentToolActive("openclaw")) && isSystemAgentOnlyCodexDynamicToolAllowlist(params.toolsAllow);
-	const configMcpServers = config?.mcp_servers;
-	if (ringZeroActive && configMcpServers !== void 0 && !isJsonObject(configMcpServers)) throw new Error("Codex ring-zero received invalid thread mcp_servers config");
-	const ringZeroMcpServerNames = [...options.ringZeroInheritedMcpServerNames ?? [], ...isJsonObject(configMcpServers) ? Object.keys(configMcpServers) : []];
-	const webSearchConfig = resolveCodexWebSearchPlan({
-		config: params.config,
-		disableTools: params.disableTools,
-		nativeToolSurfaceEnabled: options.nativeCodeModeEnabled,
-		nativeProviderWebSearchSupport: options.nativeProviderWebSearchSupport,
-		webSearchAllowed: options.webSearchAllowed
-	}).threadConfig;
-	const baseConfig = buildCodexRuntimeThreadConfig(mergeCodexThreadConfigs(config, webSearchConfig), options);
-	const runtimeConfig = mergeCodexThreadConfigs(baseConfig, options.appServer?.networkProxy?.configPatch, shouldDisableCodexToolSearchForModel(params.modelId) ? CODEX_TOOL_SEARCH_UNSUPPORTED_THREAD_CONFIG : void 0, params.delegationCapability === "report_only" ? CODEX_DELEGATION_DISABLED_THREAD_CONFIG : void 0, buildCodexRingZeroThreadConfigPatch(params, options.hostSystemAgentActive, ringZeroMcpServerNames)) ?? baseConfig;
-	if (params.bootstrapContextMode !== "lightweight") return runtimeConfig;
-	return mergeCodexThreadConfigs(runtimeConfig, CODEX_LIGHTWEIGHT_CONTEXT_THREAD_CONFIG) ?? {
-		...runtimeConfig,
-		...CODEX_LIGHTWEIGHT_CONTEXT_THREAD_CONFIG
-	};
-}
-function buildCodexRingZeroThreadConfigPatch(params, hostSystemAgentActive = isHostScopedAgentToolActive("openclaw"), inheritedMcpServerNames = []) {
-	if (!hostSystemAgentActive || !isSystemAgentOnlyCodexDynamicToolAllowlist(params.toolsAllow)) return;
-	const mcpServers = Object.fromEntries([...new Set(inheritedMcpServerNames)].toSorted().map((name) => [name, { enabled: false }]));
-	return {
-		...CODEX_RING_ZERO_THREAD_CONFIG,
-		...Object.keys(mcpServers).length > 0 ? { mcp_servers: mcpServers } : {}
-	};
-}
-async function readCodexInheritedMcpServerNames(client, cwd, signal) {
-	const response = await client.request("config/read", {
-		cwd,
-		includeLayers: true
-	}, { signal });
-	if (!isJsonObject(response) || !isJsonObject(response.config)) throw new Error("Codex config/read returned an invalid effective config");
-	if (!Array.isArray(response.layers)) throw new Error("Codex config/read omitted effective config layers");
-	for (const layer of response.layers) {
-		if (!isJsonObject(layer) || !isJsonObject(layer.name) || typeof layer.name.type !== "string") throw new Error("Codex config/read returned invalid effective config layers");
-		if (layer.name.type === "legacyManagedConfigTomlFromFile" || layer.name.type === "legacyManagedConfigTomlFromMdm") throw new Error(`Codex ring-zero cannot override config layer ${layer.name.type}`);
-		if (!CODEX_RING_ZERO_OVERRIDABLE_LAYER_TYPES.has(layer.name.type)) throw new Error(`Codex ring-zero does not recognize config layer ${layer.name.type}`);
-	}
-	const configuredServers = response.config.mcp_servers;
-	if (configuredServers === void 0) return [];
-	if (!isJsonObject(configuredServers)) throw new Error("Codex config/read returned invalid mcp_servers");
-	return Object.keys(configuredServers).toSorted();
-}
-async function assertCodexRingZeroHasNoManagedHooks(client, signal) {
-	const response = await client.request("configRequirements/read", void 0, { signal });
-	if (!isJsonObject(response) || !Object.hasOwn(response, "requirements")) throw new Error("Codex configRequirements/read returned an invalid response");
-	if (response.requirements === null) return;
-	if (!isJsonObject(response.requirements)) throw new Error("Codex configRequirements/read returned invalid requirements");
-	for (const key of [
-		"hooks",
-		"managedHooks",
-		"managed_hooks"
-	]) {
-		const hooks = response.requirements[key];
-		if (hooks === void 0 || hooks === null) continue;
-		if (!isJsonObject(hooks)) throw new Error("Codex configRequirements/read returned invalid managed hooks");
-		if (hasNonEmptyJsonValue(hooks)) throw new Error("Codex ring-zero cannot override managed hooks");
-	}
-	for (const key of ["featureRequirements", "feature_requirements"]) {
-		const requirements = response.requirements[key];
-		if (requirements === void 0 || requirements === null) continue;
-		if (!isJsonObject(requirements)) throw new Error("Codex configRequirements/read returned invalid feature requirements");
-		for (const [feature, enabled] of Object.entries(requirements)) {
-			if (typeof enabled !== "boolean") throw new Error("Codex configRequirements/read returned invalid feature requirements");
-			if (enabled && CODEX_RING_ZERO_RESTRICTED_FEATURES.has(feature)) throw new Error(`Codex ring-zero cannot override required feature ${feature}`);
-		}
-	}
-}
-async function attestCodexRingZeroThreadHasNoMcpServers(client, threadId, signal) {
-	const response = await client.request("mcpServerStatus/list", {
-		threadId,
-		limit: 1,
-		detail: "toolsAndAuthOnly"
-	}, { signal });
-	if (!isJsonObject(response) || !Array.isArray(response.data)) throw new Error("Codex mcpServerStatus/list returned an invalid ring-zero attestation");
-	if (response.data.length > 0) {
-		const first = response.data[0];
-		const serverName = isJsonObject(first) && typeof first.name === "string" ? first.name : "unknown";
-		throw new Error(`Codex ring-zero MCP attestation found server ${serverName}`);
-	}
-	if (response.nextCursor !== void 0 && response.nextCursor !== null) throw new Error("Codex mcpServerStatus/list returned an invalid empty-page cursor");
-}
-function hasNonEmptyJsonValue(value) {
-	if (value === null || value === false || value === "") return false;
-	if (Array.isArray(value)) return value.length > 0;
-	if (typeof value === "object") return Object.values(value).some(hasNonEmptyJsonValue);
-	return true;
-}
-function resolveCodexThreadApprovalsReviewer(appServer, config) {
-	return config?.approvals_reviewer === "user" ? "user" : appServer.approvalsReviewer;
-}
-function codexThreadSandboxOrPermissions(appServer) {
-	if (appServer.networkProxy) return {};
-	return { sandbox: appServer.sandbox };
-}
-function resolveCodexThreadEnvironmentSelection(options) {
-	if (options.nativeCodeModeEnabled === false) return { environments: [] };
-	if (options.environmentSelection) return { environments: options.environmentSelection };
-	return {};
-}
-//#endregion
-//#region extensions/codex/src/app-server/thread-resume.ts
-/** Owns Codex thread/resume subscription safety. */
-/** Resumes one thread and retires the physical client when acceptance is indeterminate. */
-async function resumeCodexAppServerThread(params) {
-	const threadId = params.request.threadId;
-	let response;
-	try {
-		response = assertCodexThreadResumeResponse(await params.client.request("thread/resume", params.request, {
-			...params.timeoutMs !== void 0 ? { timeoutMs: params.timeoutMs } : {},
-			...params.signal ? { signal: params.signal } : {}
-		}));
-		assertCodexThreadResumeSubscription(threadId, response.thread.id);
-	} catch (error) {
-		if (isCodexAppServerStartSelectionChangedError(error) || isCodexAppServerPrewriteRequestCancellationError(error)) throw error;
-		if (error instanceof CodexAppServerRpcError) throw error;
-		try {
-			await params.abandonClient();
-		} catch (abandonError) {
-			throw new CodexAppServerUnsafeSubscriptionError(`Codex thread/resume client could not be retired for ${threadId}`, { cause: abandonError });
-		}
-		if (error instanceof CodexAppServerUnsafeSubscriptionError) throw error;
-		throw new CodexAppServerUnsafeSubscriptionError(error instanceof Error ? error.message : `Codex thread/resume outcome is indeterminate for ${threadId}`, { cause: error });
-	}
-	return response;
-}
-//#endregion
-//#region extensions/codex/src/app-server/thread-lifecycle-io.ts
-async function resumeExistingCodexThread(params, context) {
-	const { binding: resumeBinding, bindingIdentity, startModelSelection, startModelProvider, userMcpServersConfigPatch, dynamicToolsFingerprint, dynamicToolsContainDeferred, webSearchThreadConfigFingerprint, userMcpServersFingerprint, ringZeroConfigFingerprint, ringZeroClientInstanceId, networkProxyConfigFingerprint, contextEngineBinding, environmentSelectionFingerprint, hostSystemAgentActive, ringZeroActive, ringZeroInheritedMcpServerNames, lifecycleTiming, normalizeBindingModelProvider, throwIfAborted, clearCurrentBinding } = context;
-	let resumeReservation;
-	try {
-		const authProfileId = resumeBinding.connectionScope === "supervision" ? void 0 : params.params.authProfileId ?? resumeBinding.authProfileId;
-		const finalConfigPatch = params.buildFinalConfigPatch?.({
-			action: "resume",
-			binding: resumeBinding
-		}) ?? {
-			configPatch: params.finalConfigPatch,
-			nativeHookRelayGeneration: params.nativeHookRelayGeneration
-		};
-		const pluginAppsConfigPatch = params.pluginThreadConfig?.enabled && resumeBinding.pluginAppPolicyContext ? buildCodexPluginAppsConfigPatchFromPolicyContext(resumeBinding.pluginAppPolicyContext) : void 0;
-		const resumeConfig = mergeCodexThreadConfigs(params.config, userMcpServersConfigPatch, pluginAppsConfigPatch, finalConfigPatch.configPatch);
-		const resumeParams = lifecycleTiming.measureSync("thread-resume-params", () => buildThreadResumeParams(params.params, {
-			threadId: resumeBinding.threadId,
-			authProfileId,
-			model: startModelSelection.model,
-			modelProvider: startModelProvider,
-			preserveNativeModel: resumeBinding.preserveNativeModel === true,
-			appServer: params.appServer,
-			dynamicTools: params.dynamicTools,
-			developerInstructions: params.developerInstructions,
-			config: resumeConfig,
-			nativeCodeModeEnabled: params.nativeCodeModeEnabled,
-			nativeProviderWebSearchSupport: params.nativeProviderWebSearchSupport,
-			nativeCodeModeOnlyEnabled: params.nativeCodeModeOnlyEnabled,
-			webSearchAllowed: params.webSearchAllowed,
-			hostSystemAgentActive,
-			ringZeroInheritedMcpServerNames
-		}));
-		const requestModelProvider = typeof resumeParams.modelProvider === "string" && resumeParams.modelProvider.trim() ? resumeParams.modelProvider : void 0;
-		throwIfAborted();
-		if (resumeBinding.preserveNativeModel === true) {
-			const current = await lifecycleTiming.measure("thread-read-adoption-status", () => params.client.request("thread/read", {
-				threadId: resumeBinding.threadId,
-				includeTurns: false
-			}, { signal: params.signal }));
-			throwIfAborted();
-			if (current.thread.status?.type === "active") throw new CodexAdoptedThreadActiveError();
-		}
-		resumeReservation = params.reserveResumeThread?.(resumeBinding.threadId);
-		const response = await lifecycleTiming.measure("thread-resume-request", () => resumeCodexAppServerThread({
-			client: params.client,
-			abandonClient: params.abandonClient ?? (() => closeCodexStartupClientBestEffort(params.client)),
-			request: resumeParams,
-			signal: params.signal
-		}));
-		if (ringZeroActive) try {
-			await lifecycleTiming.measure("ring-zero-mcp-attestation", () => attestCodexRingZeroThreadHasNoMcpServers(params.client, response.thread.id, params.signal));
-		} catch (error) {
-			await (params.abandonClient ?? (() => closeCodexStartupClientBestEffort(params.client)))();
-			throw new CodexRingZeroAttestationError(error);
-		}
-		throwIfAborted();
-		const boundAuthProfileId = authProfileId;
-		const nextMcpServersFingerprint = params.mcpServersFingerprintEvaluated === true ? params.mcpServersFingerprint : resumeBinding.mcpServersFingerprint;
-		const resumePatch = {
-			cwd: params.cwd,
-			authProfileId: boundAuthProfileId,
-			model: response.model ?? resumeParams.model ?? params.params.modelId,
-			preserveNativeModel: resumeBinding.preserveNativeModel === true ? true : void 0,
-			modelProvider: normalizeBindingModelProvider(boundAuthProfileId, response.modelProvider ?? requestModelProvider ?? startModelProvider),
-			dynamicToolsFingerprint,
-			dynamicToolsContainDeferred,
-			webSearchThreadConfigFingerprint,
-			userMcpServersFingerprint,
-			mcpServersFingerprint: nextMcpServersFingerprint,
-			ringZeroConfigFingerprint,
-			ringZeroClientInstanceId,
-			networkProxyProfileName: params.appServer.networkProxy?.profileName,
-			networkProxyConfigFingerprint,
-			nativeHookRelayGeneration: finalConfigPatch.nativeHookRelayGeneration ?? resumeBinding.nativeHookRelayGeneration,
-			appServerRuntimeFingerprint: resumeBinding.connectionScope === "supervision" ? buildCodexAppServerConnectionFingerprint(params.appServer, params.params.agentDir) : params.appServerRuntimeFingerprint,
-			pluginAppsFingerprint: resumeBinding.pluginAppsFingerprint,
-			pluginAppsInputFingerprint: resumeBinding.pluginAppsInputFingerprint,
-			pluginAppPolicyContext: resumeBinding.pluginAppPolicyContext,
-			contextEngine: contextEngineBinding,
-			environmentSelectionFingerprint
-		};
-		if (!await lifecycleTiming.measure("thread-resume-write-binding", () => params.bindingStore.mutate(bindingIdentity, {
-			kind: "patch",
-			threadId: resumeBinding.threadId,
-			patch: resumePatch
-		}))) throw new CodexThreadBindingConflictError(resumeBinding.threadId, "committing a resumed thread");
-		if (contextEngineBinding) embeddedAgentLog.info("codex app-server wrote context-engine thread binding", {
-			sessionId: params.params.sessionId,
-			sessionKey: params.params.sessionKey,
-			threadId: response.thread.id,
-			engineId: contextEngineBinding.engineId,
-			epoch: contextEngineBinding.projection?.epoch,
-			fingerprint: contextEngineBinding.projection?.fingerprint,
-			action: "resumed"
-		});
-		lifecycleTiming.mark("thread-ready");
-		lifecycleTiming.logSummary({
-			runId: params.params.runId,
-			sessionId: params.params.sessionId,
-			sessionKey: params.params.sessionKey,
-			threadId: response.thread.id,
-			action: "resumed"
-		});
-		const activeTurnIds = readActiveCodexTurnIdsFromResume(response);
-		return {
-			...resumeBinding,
-			threadId: response.thread.id,
-			...resumePatch,
-			lifecycle: {
-				action: "resumed",
-				...activeTurnIds.length ? { activeTurnIds } : {}
-			}
-		};
-	} catch (error) {
-		resumeReservation?.release();
-		if (isCodexAppServerStartSelectionChangedError(error)) throw error;
-		if (error instanceof CodexRingZeroAttestationError) {
-			await clearCurrentBinding("retiring a failed ring-zero thread attestation");
-			throw error;
-		}
-		if (error instanceof CodexAdoptedThreadActiveError) throw error;
-		if (isCodexAppServerUnsafeSubscriptionError(error)) throw error;
-		const resumeRejected = error instanceof CodexAppServerRpcError;
-		if (!await unsubscribeCodexThreadBestEffort(params.client, {
-			threadId: resumeBinding.threadId,
-			timeoutMs: 5e3
-		}) && !resumeRejected && !isCodexAppServerConnectionClosedError(error) && !params.signal?.aborted) throw new CodexAppServerUnsafeSubscriptionError("Codex thread/resume subscription cleanup failed", { cause: error });
-		if (isCodexAppServerConnectionClosedError(error) || params.signal?.aborted) throw error;
-		embeddedAgentLog.warn("codex app-server thread resume failed; starting a new thread", { error });
-		await clearCurrentBinding("rotating a stale thread binding");
-	}
-}
-async function startFreshCodexThread(params, context) {
-	const clientId = resolveCodexAppServerClientInstanceId(params.client);
-	const { bindingIdentity, startModelSelection, startModelProvider, userMcpServersConfigPatch, dynamicToolsFingerprint, dynamicToolsContainDeferred, webSearchThreadConfigFingerprint, userMcpServersFingerprint, ringZeroConfigFingerprint, ringZeroClientInstanceId, networkProxyConfigFingerprint, contextEngineBinding, environmentSelectionFingerprint, hostSystemAgentActive, ringZeroActive, ringZeroInheritedMcpServerNames, lifecycleTiming, normalizeBindingModelProvider, throwIfAborted, prebuiltPluginThreadConfig, preserveExistingBinding, rotatedContextEngineBinding } = context;
-	const pluginThreadConfig = params.pluginThreadConfig?.enabled ? prebuiltPluginThreadConfig ?? await lifecycleTiming.measure("plugin-config-build", () => params.pluginThreadConfig?.build()) : void 0;
-	const finalConfigPatch = params.buildFinalConfigPatch?.({ action: "start" }) ?? {
-		configPatch: params.finalConfigPatch,
-		nativeHookRelayGeneration: params.nativeHookRelayGeneration
-	};
-	const config = lifecycleTiming.measureSync("merge-thread-config", () => mergeCodexThreadConfigs(params.config, userMcpServersConfigPatch, pluginThreadConfig?.configPatch, finalConfigPatch.configPatch));
-	const startParams = lifecycleTiming.measureSync("thread-start-params", () => buildThreadStartParams(params.params, {
-		cwd: params.cwd,
-		dynamicTools: params.dynamicTools,
-		appServer: params.appServer,
-		developerInstructions: params.developerInstructions,
-		config,
-		nativeCodeModeEnabled: params.nativeCodeModeEnabled,
-		nativeProviderWebSearchSupport: params.nativeProviderWebSearchSupport,
-		nativeCodeModeOnlyEnabled: params.nativeCodeModeOnlyEnabled,
-		webSearchAllowed: params.webSearchAllowed,
-		environmentSelection: params.environmentSelection,
-		model: startModelSelection.model,
-		modelProvider: startModelProvider,
-		hostSystemAgentActive,
-		ringZeroInheritedMcpServerNames
-	}));
-	const requestModelProvider = typeof startParams.modelProvider === "string" && startParams.modelProvider.trim() ? startParams.modelProvider : void 0;
-	const response = assertCodexThreadStartResponse(await lifecycleTiming.measure("thread-start-request", async () => {
-		try {
-			return await params.client.request("thread/start", startParams, { signal: params.signal });
-		} catch (error) {
-			if (error instanceof CodexAppServerRpcError) throw new CodexThreadStartRequestError(error);
-			throw error;
-		}
-	}));
-	if (ringZeroActive) try {
-		await lifecycleTiming.measure("ring-zero-mcp-attestation", () => attestCodexRingZeroThreadHasNoMcpServers(params.client, response.thread.id, params.signal));
-	} catch (error) {
-		await (params.abandonClient ?? (() => closeCodexStartupClientBestEffort(params.client)))();
-		throw error;
-	}
-	throwIfAborted();
-	const modelProvider = resolveCodexAppServerModelProvider({
-		provider: params.params.provider,
-		authProfileId: params.params.authProfileId,
-		authProfileStore: params.params.authProfileStore,
-		agentDir: params.params.agentDir,
-		config: params.params.config
-	});
-	const nextMcpServersFingerprint = params.mcpServersFingerprintEvaluated === true ? params.mcpServersFingerprint : void 0;
-	if (!preserveExistingBinding) {
-		if (!await lifecycleTiming.measure("thread-start-write-binding", () => params.bindingStore.mutate(bindingIdentity, {
-			kind: "set",
-			if: { kind: "absent" },
-			binding: {
-				threadId: response.thread.id,
-				...clientId ? { clientId } : {},
-				cwd: params.cwd,
-				authProfileId: params.params.authProfileId,
-				model: response.model ?? startParams.model ?? params.params.modelId,
-				modelProvider: normalizeBindingModelProvider(params.params.authProfileId, response.modelProvider ?? requestModelProvider ?? startModelProvider ?? modelProvider),
-				dynamicToolsFingerprint,
-				dynamicToolsContainDeferred,
-				webSearchThreadConfigFingerprint,
-				userMcpServersFingerprint,
-				mcpServersFingerprint: nextMcpServersFingerprint,
-				ringZeroConfigFingerprint,
-				ringZeroClientInstanceId,
-				networkProxyProfileName: params.appServer.networkProxy?.profileName,
-				networkProxyConfigFingerprint,
-				nativeHookRelayGeneration: finalConfigPatch.nativeHookRelayGeneration,
-				appServerRuntimeFingerprint: params.appServerRuntimeFingerprint,
-				pluginAppsFingerprint: pluginThreadConfig?.fingerprint,
-				pluginAppsInputFingerprint: pluginThreadConfig?.inputFingerprint,
-				pluginAppPolicyContext: pluginThreadConfig?.policyContext,
-				contextEngine: contextEngineBinding,
-				environmentSelectionFingerprint
-			}
-		}))) throw new CodexThreadBindingConflictError(response.thread.id, "committing a fresh thread");
-		if (contextEngineBinding) embeddedAgentLog.info("codex app-server wrote context-engine thread binding", {
-			sessionId: params.params.sessionId,
-			sessionKey: params.params.sessionKey,
-			threadId: response.thread.id,
-			engineId: contextEngineBinding.engineId,
-			epoch: contextEngineBinding.projection?.epoch,
-			fingerprint: contextEngineBinding.projection?.fingerprint,
-			action: rotatedContextEngineBinding ? "rotated" : "started"
-		});
-	}
-	lifecycleTiming.mark("thread-ready");
-	lifecycleTiming.logSummary({
-		runId: params.params.runId,
-		sessionId: params.params.sessionId,
-		sessionKey: params.params.sessionKey,
-		threadId: response.thread.id,
-		action: rotatedContextEngineBinding ? "rotated" : "started"
-	});
-	return {
-		threadId: response.thread.id,
-		...clientId ? { clientId } : {},
-		cwd: params.cwd,
-		authProfileId: params.params.authProfileId,
-		model: response.model ?? startParams.model ?? params.params.modelId,
-		modelProvider: response.modelProvider ?? requestModelProvider ?? startModelProvider ?? modelProvider,
-		dynamicToolsFingerprint,
-		dynamicToolsContainDeferred,
-		userMcpServersFingerprint,
-		mcpServersFingerprint: nextMcpServersFingerprint,
-		ringZeroConfigFingerprint,
-		ringZeroClientInstanceId,
-		networkProxyProfileName: params.appServer.networkProxy?.profileName,
-		networkProxyConfigFingerprint,
-		nativeHookRelayGeneration: finalConfigPatch.nativeHookRelayGeneration,
-		appServerRuntimeFingerprint: params.appServerRuntimeFingerprint,
-		pluginAppsFingerprint: pluginThreadConfig?.fingerprint,
-		pluginAppsInputFingerprint: pluginThreadConfig?.inputFingerprint,
-		pluginAppPolicyContext: pluginThreadConfig?.policyContext,
-		contextEngine: contextEngineBinding,
-		environmentSelectionFingerprint,
-		lifecycle: {
-			action: "started",
-			...rotatedContextEngineBinding ? { rotatedContextEngineBinding } : {}
-		}
-	};
-}
-//#endregion
-//#region extensions/codex/src/app-server/thread-lifecycle-timing.ts
 const CODEX_THREAD_LIFECYCLE_TIMING_WARN_TOTAL_MS = 1e3;
 const CODEX_THREAD_LIFECYCLE_TIMING_WARN_STAGE_MS = 500;
 function shouldWarnCodexThreadLifecycleTimingSummary(summary, options = {}) {
@@ -2367,378 +1672,34 @@ function createCodexThreadLifecycleTimingTracker(options = {}) {
 		}
 	};
 }
-//#endregion
-//#region extensions/codex/src/app-server/thread-supervision.ts
-async function materializePendingSupervisionBranch(params) {
-	let pending = params.binding.pendingSupervisionBranch;
-	const connectionFingerprint = buildCodexAppServerConnectionFingerprint(params.appServer, params.attempt.agentDir);
-	if (!pending.connectionFingerprint || pending.connectionFingerprint !== connectionFingerprint) throw new Error("Codex supervision source connection changed before branch materialization");
-	pending = await recoverPendingSupervisionArtifacts(params, pending);
-	params.throwIfAborted();
-	const sourceResponse = await params.lifecycleTiming.measure("supervision-source-read", () => params.client.request("thread/read", {
-		threadId: pending.sourceThreadId,
-		includeTurns: true
-	}, { signal: params.signal }));
-	params.throwIfAborted();
-	const sourceThread = sourceResponse.thread;
-	if (sourceThread.id !== pending.sourceThreadId) throw new Error(`Codex supervision source read returned ${sourceThread.id} for ${pending.sourceThreadId}`);
-	assertPendingSupervisionSnapshotUnchanged(sourceThread, pending);
-	const history = projectBoundedCodexThreadHistory({
-		thread: sourceThread,
-		throughTurnId: pending.lastTurnId ?? null,
-		importedAt: Date.now(),
-		modelProvider: sourceThread.modelProvider
+async function startOrResumeThread(params) {
+	const bindingIdentity = sessionBindingIdentity({
+		sessionId: params.params.sessionId,
+		sessionKey: params.params.sessionKey,
+		agentId: params.agentId ?? params.params.agentId,
+		config: params.params.config
 	});
-	let bindingCommitted = false;
-	let provisionalCleanupSafe = true;
-	try {
-		const probeParams = buildPendingSupervisionProbeForkParams(params, pending);
-		const rawProbeResponse = await params.lifecycleTiming.measure("supervision-model-probe-fork", async () => {
-			try {
-				return await params.client.request("thread/fork", probeParams, { signal: params.signal });
-			} catch (error) {
-				if (!(error instanceof CodexAppServerRpcError)) throw new CodexAppServerUnsafeSubscriptionError("Codex model probe fork may have materialized without a response", { cause: error });
-				throw error;
-			}
-		});
-		const probeThreadId = requireDistinctSupervisionThreadId({
-			threadId: readSupervisionResponseThreadId(rawProbeResponse),
-			sourceThreadId: pending.sourceThreadId,
-			role: "model probe"
-		});
-		pending = await trackPendingSupervisionArtifacts(params, pending, [probeThreadId]);
-		params.throwIfAborted();
-		const probeResponse = assertCodexThreadForkResponse(rawProbeResponse);
-		const nativeModel = requireNonBlankSupervisionValue(probeResponse.model, "native model");
-		const nativeModelProvider = requireNativeSupervisionModelProvider({
-			responseModelProvider: probeResponse.modelProvider,
-			responseThreadModelProvider: probeResponse.thread.modelProvider
+	return await params.bindingStore.withLease(bindingIdentity, async () => {
+		const lifecycleTiming = createCodexThreadLifecycleTimingTracker({
+			...params.timing,
+			enabled: params.timing?.enabled ?? isCodexAppServerProfilerEnabled(params.params.config)
 		});
-		const startParams = buildThreadStartParams({
-			...params.attempt,
-			modelId: nativeModel
-		}, {
-			cwd: params.cwd,
-			dynamicTools: params.dynamicTools,
-			appServer: params.appServer,
-			developerInstructions: params.developerInstructions,
-			config: params.config,
-			nativeCodeModeEnabled: params.nativeCodeModeEnabled,
-			nativeProviderWebSearchSupport: params.nativeProviderWebSearchSupport,
-			nativeCodeModeOnlyEnabled: params.nativeCodeModeOnlyEnabled,
-			webSearchAllowed: params.webSearchAllowed,
-			environmentSelection: params.environmentSelection,
-			model: nativeModel,
-			modelProvider: nativeModelProvider
-		});
-		assertExactSupervisionModelSelection(startParams, {
-			model: nativeModel,
-			modelProvider: nativeModelProvider,
-			operation: "thread/start request"
-		});
-		const rawStartResponse = await params.lifecycleTiming.measure("supervision-thread-start", async () => {
-			try {
-				return await params.client.request("thread/start", startParams, { signal: params.signal });
-			} catch (error) {
-				if (error instanceof CodexAppServerRpcError) throw new CodexThreadStartRequestError(error);
-				throw new CodexAppServerUnsafeSubscriptionError("Canonical Codex branch may have started without a response", { cause: error });
-			}
-		});
-		const finalThreadId = requireDistinctSupervisionThreadId({
-			threadId: readSupervisionResponseThreadId(rawStartResponse),
-			sourceThreadId: pending.sourceThreadId,
-			otherThreadId: probeThreadId,
-			role: "canonical branch"
-		});
-		pending = await trackPendingSupervisionArtifacts(params, pending, [probeThreadId, finalThreadId]);
-		params.throwIfAborted();
-		assertExactSupervisionModelSelection(assertCodexThreadStartResponse(rawStartResponse), {
-			model: nativeModel,
-			modelProvider: nativeModelProvider,
-			operation: "thread/start response"
-		});
-		if (history.responseItems.length > 0) {
-			await params.lifecycleTiming.measure("supervision-history-inject", () => params.client.request("thread/inject_items", {
-				threadId: finalThreadId,
-				items: history.responseItems
-			}, { signal: params.signal }));
-			params.throwIfAborted();
-		}
-		if (!await archiveSupervisionArtifact(params.client, probeThreadId)) throw new Error(`Failed to archive temporary Codex model probe: ${probeThreadId}`);
-		pending = await trackPendingSupervisionArtifacts(params, pending, [finalThreadId]);
-		const historyCoveredThrough = (/* @__PURE__ */ new Date()).toISOString();
-		const bindingModelProvider = params.normalizeBindingModelProvider(params.attempt.authProfileId, nativeModelProvider);
-		let committed = false;
-		try {
-			committed = await params.bindingStore.mutate(params.bindingIdentity, {
-				kind: "commit-pending-supervision-branch",
-				expected: pending,
-				threadId: finalThreadId,
-				patch: {
-					...params.bindingPatch,
-					model: nativeModel,
-					modelProvider: bindingModelProvider,
-					historyCoveredThrough
-				}
-			});
-		} catch (error) {
-			let current;
-			try {
-				current = await params.bindingStore.read(params.bindingIdentity);
-			} catch (readError) {
-				provisionalCleanupSafe = false;
-				throw new CodexAppServerUnsafeSubscriptionError(`Canonical Codex branch binding could not be verified: ${finalThreadId}`, { cause: new AggregateError([error, readError]) });
-			}
-			if (matchesMaterializedSupervisionBranch(current, {
-				sourceThreadId: pending.sourceThreadId,
-				connectionFingerprint,
-				threadId: finalThreadId,
-				model: nativeModel,
-				modelProvider: bindingModelProvider,
-				historyCoveredThrough
-			})) committed = true;
-			else {
-				if (!matchesPendingSupervisionState(current, pending)) {
-					provisionalCleanupSafe = false;
-					throw new CodexAppServerUnsafeSubscriptionError(`Canonical Codex branch binding changed while commit was uncertain: ${finalThreadId}`, { cause: error });
-				}
-				throw error;
-			}
-		}
-		if (!committed) throw new CodexThreadBindingConflictError(pending.sourceThreadId, "committing a supervised Codex branch");
-		bindingCommitted = true;
-		params.lifecycleTiming.mark("thread-ready");
-		params.lifecycleTiming.logSummary({
-			runId: params.attempt.runId,
-			sessionId: params.attempt.sessionId,
-			sessionKey: params.attempt.sessionKey,
-			threadId: finalThreadId,
-			action: "forked"
-		});
-		return {
-			...params.binding,
-			...params.bindingPatch,
-			threadId: finalThreadId,
-			pendingSupervisionBranch: void 0,
-			model: nativeModel,
-			modelProvider: bindingModelProvider,
-			historyCoveredThrough,
-			lifecycle: { action: "forked" }
-		};
-	} catch (error) {
-		if (bindingCommitted) throw error;
-		if (error instanceof CodexThreadBindingConflictAfterCleanupError) throw error;
-		if (!provisionalCleanupSafe) {
-			await params.abandonClient();
-			throw error;
-		}
-		const cleanup = await cleanPendingSupervisionArtifacts(params.client, pending);
-		let cleanupStateError;
-		if (cleanup.remaining.length !== (pending.cleanupThreadIds?.length ?? 0)) {
-			const nextPending = withPendingSupervisionCleanup(pending, cleanup.remaining);
-			try {
-				if (await params.bindingStore.mutate(params.bindingIdentity, {
-					kind: "patch-pending-supervision-branch",
-					expected: pending,
-					pending: nextPending
-				})) pending = nextPending;
-			} catch (stateError) {
-				cleanupStateError = stateError;
-			}
-		}
-		const unsafeCleanup = cleanup.remaining.length > 0 || isCodexAppServerUnsafeSubscriptionError(error);
-		if (unsafeCleanup) await params.abandonClient();
-		if (cleanupStateError) {
-			const cause = new AggregateError([error, cleanupStateError]);
-			if (unsafeCleanup) throw new CodexAppServerUnsafeSubscriptionError("Codex supervised branch cleanup state could not be recorded", { cause });
-			throw new AggregateError([error, cleanupStateError], "Codex supervised branch cleanup state could not be recorded", { cause: error });
-		}
-		if (cleanup.remaining.length > 0) throw new CodexAppServerUnsafeSubscriptionError(`Codex supervised branch cleanup remains pending: ${cleanup.remaining.join(", ")}`, { cause: error });
-		throw error;
-	}
-}
-function buildPendingSupervisionProbeForkParams(params, pending) {
-	const runtimeConfig = buildCodexRuntimeThreadConfigForRun(params.attempt, params.config, {
-		nativeCodeModeEnabled: params.nativeCodeModeEnabled,
-		nativeProviderWebSearchSupport: params.nativeProviderWebSearchSupport,
-		nativeCodeModeOnlyEnabled: params.nativeCodeModeOnlyEnabled,
-		webSearchAllowed: params.webSearchAllowed,
-		appServer: params.appServer
-	});
-	return {
-		threadId: pending.sourceThreadId,
-		...pending.lastTurnId ? { lastTurnId: pending.lastTurnId } : {},
-		cwd: params.cwd,
-		approvalPolicy: params.appServer.approvalPolicy,
-		approvalsReviewer: resolveCodexThreadApprovalsReviewer(params.appServer, runtimeConfig),
-		...codexThreadSandboxOrPermissions(params.appServer),
-		...params.appServer.serviceTier !== void 0 ? { serviceTier: params.appServer.serviceTier } : {},
-		config: runtimeConfig,
-		developerInstructions: params.developerInstructions ?? buildDeveloperInstructions(params.attempt, { dynamicTools: params.dynamicTools }),
-		ephemeral: isIncognitoSessionKey(params.attempt.sessionKey),
-		threadSource: "appServer",
-		excludeTurns: true
-	};
-}
-function assertPendingSupervisionSnapshotUnchanged(thread, pending) {
-	if (pending.lastTurnId) return;
-	if (thread.status?.type === "active" || (thread.turns?.length ?? 0) > 0) throw new Error("Codex source changed after Continue; reopen the source session before sending a message");
-}
-function requireNonBlankSupervisionValue(value, label) {
-	if (typeof value !== "string" || !value.trim()) throw new Error(`Codex supervision ${label} is missing`);
-	return value.trim();
-}
-function requireNativeSupervisionModelProvider(params) {
-	const responseProvider = requireNonBlankSupervisionValue(params.responseModelProvider, "native model provider");
-	const threadProvider = params.responseThreadModelProvider?.trim();
-	if (threadProvider && threadProvider !== responseProvider) throw new Error(`Codex supervision model provider mismatch: ${responseProvider} != ${threadProvider}`);
-	return responseProvider;
-}
-function assertExactSupervisionModelSelection(value, expected) {
-	if (value.model !== expected.model || value.modelProvider !== expected.modelProvider) throw new Error(`Codex supervision ${expected.operation} changed native model selection: ${value.modelProvider ?? "unknown"}/${value.model ?? "unknown"}`);
-}
-function matchesPendingSupervisionState(binding, expected) {
-	const pending = binding?.pendingSupervisionBranch;
-	const cleanupThreadIds = pending?.cleanupThreadIds ?? [];
-	const expectedCleanupThreadIds = expected.cleanupThreadIds ?? [];
-	return binding?.threadId === expected.sourceThreadId && binding.connectionScope === "supervision" && binding.supervisionSourceThreadId === expected.sourceThreadId && pending?.sourceThreadId === expected.sourceThreadId && pending.connectionFingerprint === expected.connectionFingerprint && pending.lastTurnId === expected.lastTurnId && cleanupThreadIds.length === expectedCleanupThreadIds.length && cleanupThreadIds.every((threadId, index) => threadId === expectedCleanupThreadIds[index]);
-}
-function matchesMaterializedSupervisionBranch(binding, expected) {
-	return binding?.threadId === expected.threadId && binding.connectionScope === "supervision" && binding.supervisionSourceThreadId === expected.sourceThreadId && binding.appServerRuntimeFingerprint === expected.connectionFingerprint && binding.pendingSupervisionBranch === void 0 && binding.model === expected.model && binding.modelProvider === expected.modelProvider && binding.historyCoveredThrough === expected.historyCoveredThrough;
-}
-function requireDistinctSupervisionThreadId(params) {
-	let threadId;
-	try {
-		threadId = requireNonBlankSupervisionValue(params.threadId, `${params.role} thread id`);
-	} catch (error) {
-		throw new CodexAppServerUnsafeSubscriptionError(`Codex supervision ${params.role} may have materialized without a safe thread id`, { cause: error });
-	}
-	if (threadId === params.sourceThreadId || threadId === params.otherThreadId) throw new CodexAppServerUnsafeSubscriptionError(`Codex supervision ${params.role} reused an existing thread: ${threadId}`);
-	return threadId;
-}
-function readSupervisionResponseThreadId(value) {
-	if (!value || typeof value !== "object" || Array.isArray(value)) return;
-	const thread = value.thread;
-	if (!thread || typeof thread !== "object" || Array.isArray(thread)) return;
-	return thread.id;
-}
-async function recoverPendingSupervisionArtifacts(params, pending) {
-	if (!pending.cleanupThreadIds?.length) return pending;
-	const cleanup = await cleanPendingSupervisionArtifacts(params.client, pending);
-	const next = withPendingSupervisionCleanup(pending, cleanup.remaining);
-	if (cleanup.remaining.length > 0) {
-		if (cleanup.remaining.length !== pending.cleanupThreadIds.length) {
-			if (!await params.bindingStore.mutate(params.bindingIdentity, {
-				kind: "patch-pending-supervision-branch",
-				expected: pending,
-				pending: next
-			})) throw new CodexThreadBindingConflictError(pending.sourceThreadId, "recording supervised Codex cleanup recovery");
-		}
-		throw new Error(`Codex supervised branch cleanup must finish before retry: ${cleanup.remaining.join(", ")}`);
-	}
-	if (!await params.bindingStore.mutate(params.bindingIdentity, {
-		kind: "patch-pending-supervision-branch",
-		expected: pending,
-		pending: next
-	})) throw new CodexThreadBindingConflictError(pending.sourceThreadId, "recovering a supervised Codex branch");
-	return next;
-}
-async function trackPendingSupervisionArtifacts(params, pending, cleanupThreadIds) {
-	const next = withPendingSupervisionCleanup(pending, cleanupThreadIds);
-	if (!await params.bindingStore.mutate(params.bindingIdentity, {
-		kind: "patch-pending-supervision-branch",
-		expected: pending,
-		pending: next
-	})) {
-		const cleanupFailed = [];
-		for (const threadId of cleanupThreadIds) if (!await archiveSupervisionArtifact(params.client, threadId)) cleanupFailed.push(threadId);
-		if (cleanupFailed.length > 0) throw new CodexAppServerUnsafeSubscriptionError(`Codex supervised branch CAS cleanup failed: ${cleanupFailed.join(", ")}`);
-		throw new CodexThreadBindingConflictAfterCleanupError(pending.sourceThreadId, "tracking supervised Codex branch cleanup");
-	}
-	return next;
-}
-function withPendingSupervisionCleanup(pending, cleanupThreadIds) {
-	return {
-		sourceThreadId: pending.sourceThreadId,
-		...pending.connectionFingerprint ? { connectionFingerprint: pending.connectionFingerprint } : {},
-		...pending.lastTurnId ? { lastTurnId: pending.lastTurnId } : {},
-		...cleanupThreadIds.length > 0 ? { cleanupThreadIds } : {}
-	};
-}
-async function cleanPendingSupervisionArtifacts(client, pending) {
-	const remaining = [];
-	for (const threadId of pending.cleanupThreadIds ?? []) if (!await archiveSupervisionArtifact(client, threadId)) remaining.push(threadId);
-	return { remaining };
-}
-async function archiveSupervisionArtifact(client, threadId) {
-	try {
-		await client.request("thread/archive", { threadId }, { timeoutMs: CODEX_APP_SERVER_UNSUBSCRIBE_TIMEOUT_MS });
-		return true;
-	} catch (error) {
-		const message = formatErrorMessage(error).toLowerCase();
-		if (message.includes("no rollout found for thread id") || message.includes("thread not found") || message.includes("already archived")) return true;
-		await unsubscribeCodexThreadBestEffort(client, {
-			threadId,
-			timeoutMs: CODEX_APP_SERVER_UNSUBSCRIBE_TIMEOUT_MS
-		});
-		embeddedAgentLog.warn("failed to archive temporary Codex supervision thread", {
-			threadId,
-			error
-		});
-		return false;
-	}
-}
-//#endregion
-//#region extensions/codex/src/app-server/thread-lifecycle-run.ts
-async function startOrResumeThread(params) {
-	const incognito = isIncognitoSessionKey(params.params.sessionKey);
-	const clientId = resolveCodexAppServerClientInstanceId(params.client);
-	const bindingIdentity = sessionBindingIdentity({
-		sessionId: params.params.sessionId,
-		sessionKey: params.params.sessionKey,
-		agentId: params.agentId ?? params.params.agentId,
-		config: params.params.config
-	});
-	return await params.bindingStore.withLease(bindingIdentity, async () => {
-		const lifecycleTiming = createCodexThreadLifecycleTimingTracker({
-			...params.timing,
-			enabled: params.timing?.enabled ?? isCodexAppServerProfilerEnabled(params.params.config)
-		});
-		const legacyDynamicToolsFingerprint = lifecycleTiming.measureSync("legacy-dynamic-tools-fingerprint", () => codexLegacyDynamicToolsFingerprint(params.dynamicTools));
-		const dynamicToolsFingerprint = lifecycleTiming.measureSync("dynamic-tools-fingerprint", () => hashCodexAppServerBindingFingerprint(legacyDynamicToolsFingerprint));
-		const dynamicToolsContainDeferred = flattenCodexDynamicToolFunctions(params.dynamicTools).some((tool) => tool.deferLoading === true);
-		const webSearchThreadConfigFingerprint = fingerprintJsonObject(lifecycleTiming.measureSync("web-search-plan", () => resolveCodexWebSearchPlan({
-			config: params.params.config,
-			disableTools: params.params.disableTools,
-			nativeToolSurfaceEnabled: params.nativeCodeModeEnabled,
+		const legacyDynamicToolsFingerprint = lifecycleTiming.measureSync("legacy-dynamic-tools-fingerprint", () => legacyFingerprintDynamicTools(params.dynamicTools));
+		const dynamicToolsFingerprint = lifecycleTiming.measureSync("dynamic-tools-fingerprint", () => hashCodexAppServerBindingFingerprint(legacyDynamicToolsFingerprint));
+		const dynamicToolsContainDeferred = flattenCodexDynamicToolFunctions(params.dynamicTools).some((tool) => tool.deferLoading === true);
+		const webSearchThreadConfigFingerprint = fingerprintJsonObject(lifecycleTiming.measureSync("web-search-plan", () => resolveCodexWebSearchPlan({
+			config: params.params.config,
+			disableTools: params.params.disableTools,
+			nativeToolSurfaceEnabled: params.nativeCodeModeEnabled,
 			nativeProviderWebSearchSupport: params.nativeProviderWebSearchSupport,
 			webSearchAllowed: params.webSearchAllowed
 		})).threadConfig);
 		const networkProxyConfigFingerprint = params.appServer.networkProxy?.configFingerprint;
 		const contextEngineBinding = lifecycleTiming.measureSync("context-engine-binding", () => buildContextEngineBinding(params.params, params.contextEngineProjection));
-		const userMcpServersConfigPatch = params.userMcpServersEnabled === false ? void 0 : await buildCodexUserMcpServersThreadConfigPatchForRuntime(params.params.config, {
-			agentId: params.agentId ?? params.params.agentId,
-			agentDir: params.params.agentDir,
-			allowLiteralOAuthProjection: params.appServer.connectionClass !== "remote",
-			onServerUnavailable: (serverName, error) => embeddedAgentLog.warn("skipping unavailable MCP OAuth server", {
-				serverName,
-				error: formatErrorMessage(error)
-			})
-		});
+		const userMcpServersConfigPatch = params.userMcpServersEnabled === false ? void 0 : buildCodexUserMcpServersThreadConfigPatch(params.params.config, { agentId: params.agentId ?? params.params.agentId });
 		const legacyUserMcpServersFingerprint = legacyFingerprintUserMcpServersConfigPatch(userMcpServersConfigPatch);
 		const userMcpServersFingerprint = fingerprintUserMcpServersConfigPatch(userMcpServersConfigPatch);
 		const environmentSelectionFingerprint = fingerprintEnvironmentSelection(params.environmentSelection);
-		const hostSystemAgentActive = params.hostSystemAgentActive ?? isHostScopedAgentToolActive("openclaw");
-		const ringZeroActive = hostSystemAgentActive && isSystemAgentOnlyCodexDynamicToolAllowlist(params.params.toolsAllow);
-		if (ringZeroActive && params.nativeCodeModeEnabled !== false) throw new Error("Codex ring-zero requires native code mode to be disabled");
-		const ringZeroInheritedMcpServerNames = ringZeroActive ? await lifecycleTiming.measure("ring-zero-mcp-config-read", () => readCodexInheritedMcpServerNames(params.client, params.cwd, params.signal)) : [];
-		if (ringZeroActive) await lifecycleTiming.measure("ring-zero-config-requirements-read", () => assertCodexRingZeroHasNoManagedHooks(params.client, params.signal));
-		const ringZeroConfigFingerprint = ringZeroActive ? fingerprintJsonObject({
-			version: 1,
-			baseInstructions: "",
-			config: buildCodexRingZeroThreadConfigPatch(params.params, true, ringZeroInheritedMcpServerNames)
-		}) : void 0;
-		const ringZeroClientInstanceId = ringZeroActive ? getCodexAppServerClientInstanceId(params.client) : void 0;
 		let binding = await lifecycleTiming.measure("read-binding", () => params.bindingStore.read(bindingIdentity));
 		const normalizeBindingModelProvider = (authProfileId, modelProvider) => normalizeCodexAppServerBindingModelProvider({
 			authProfileId,
@@ -2747,90 +1708,25 @@ async function startOrResumeThread(params) {
 			agentDir: params.params.agentDir,
 			config: params.params.config
 		});
-		const throwIfAborted = () => {
-			if (!params.signal?.aborted) return;
-			const reason = params.signal.reason;
-			if (reason instanceof Error) throw reason;
-			const error = new Error(typeof reason === "string" && reason.length > 0 ? reason : "codex app-server thread lifecycle aborted");
-			error.name = "AbortError";
-			throw error;
-		};
 		if (!binding && bindingIdentity.kind === "session" && bindingIdentity.sessionKey) {
 			if (!await lifecycleTiming.measure("reclaim-binding-generation", () => reclaimCurrentCodexSessionGeneration({
 				bindingStore: params.bindingStore,
 				identity: bindingIdentity,
 				config: params.params.config
-			}))) throw createCodexSessionGenerationSupersededError(bindingIdentity.sessionId);
-		}
-		if (binding?.pendingSupervisionBranch) {
-			const pendingBinding = binding;
-			const pluginThreadConfig = params.pluginThreadConfig?.enabled ? await lifecycleTiming.measure("plugin-config-build", () => params.pluginThreadConfig?.build()) : void 0;
-			const finalConfigPatch = params.buildFinalConfigPatch?.({ action: "start" }) ?? {
-				configPatch: params.finalConfigPatch,
-				nativeHookRelayGeneration: params.nativeHookRelayGeneration
-			};
-			const config = lifecycleTiming.measureSync("merge-thread-config", () => mergeCodexThreadConfigs(params.config, userMcpServersConfigPatch, pluginThreadConfig?.configPatch, finalConfigPatch.configPatch));
-			return await materializePendingSupervisionBranch({
-				client: params.client,
-				abandonClient: params.abandonClient ?? (() => closeCodexStartupClientBestEffort(params.client)),
-				bindingStore: params.bindingStore,
-				bindingIdentity,
-				binding: pendingBinding,
-				attempt: params.params,
-				cwd: params.cwd,
-				dynamicTools: params.dynamicTools,
-				appServer: params.appServer,
-				developerInstructions: params.developerInstructions,
-				config,
-				nativeCodeModeEnabled: params.nativeCodeModeEnabled,
-				nativeProviderWebSearchSupport: params.nativeProviderWebSearchSupport,
-				nativeCodeModeOnlyEnabled: params.nativeCodeModeOnlyEnabled,
-				webSearchAllowed: params.webSearchAllowed,
-				environmentSelection: params.environmentSelection,
-				signal: params.signal,
-				throwIfAborted,
-				lifecycleTiming,
-				normalizeBindingModelProvider,
-				bindingPatch: {
-					cwd: params.cwd,
-					...clientId ? { clientId } : {},
-					authProfileId: void 0,
-					preserveNativeModel: true,
-					dynamicToolsFingerprint,
-					dynamicToolsContainDeferred,
-					webSearchThreadConfigFingerprint,
-					userMcpServersFingerprint,
-					mcpServersFingerprint: params.mcpServersFingerprintEvaluated === true ? params.mcpServersFingerprint : pendingBinding.mcpServersFingerprint,
-					networkProxyProfileName: params.appServer.networkProxy?.profileName,
-					networkProxyConfigFingerprint,
-					nativeHookRelayGeneration: finalConfigPatch.nativeHookRelayGeneration,
-					appServerRuntimeFingerprint: buildCodexAppServerConnectionFingerprint(params.appServer, params.params.agentDir),
-					pluginAppsFingerprint: pluginThreadConfig?.fingerprint,
-					pluginAppsInputFingerprint: pluginThreadConfig?.inputFingerprint,
-					pluginAppPolicyContext: pluginThreadConfig?.policyContext,
-					contextEngine: contextEngineBinding,
-					environmentSelectionFingerprint,
-					conversationSourceTransferComplete: true
-				}
-			});
+			}))) throw new Error(`Codex session generation is no longer current: ${bindingIdentity.sessionId}`);
 		}
 		const clearCurrentBinding = async (operation) => {
 			const current = binding;
 			if (!current?.threadId) return;
-			assertCodexBindingMayBeReplaced(current, operation);
 			if (!await params.bindingStore.mutate(bindingIdentity, {
 				kind: "clear",
 				threadId: current.threadId
 			})) throw new CodexThreadBindingConflictError(current.threadId, operation);
 			binding = void 0;
 		};
-		if (binding?.threadId && (binding.ringZeroConfigFingerprint !== ringZeroConfigFingerprint || binding.ringZeroClientInstanceId !== ringZeroClientInstanceId) && (ringZeroActive || binding.ringZeroConfigFingerprint !== void 0)) {
-			embeddedAgentLog.debug("codex app-server ring-zero restriction changed; rotating thread", { threadId: binding.threadId });
-			await clearCurrentBinding("rotating a ring-zero thread binding");
-		}
 		if (binding?.threadId && shouldRotateCodexAppServerBindingForRuntime({
 			connectionClass: params.appServer.connectionClass,
-			current: binding.connectionScope === "supervision" ? buildCodexAppServerConnectionFingerprint(params.appServer, params.params.agentDir) : params.appServerRuntimeFingerprint,
+			current: params.appServerRuntimeFingerprint,
 			binding: binding.appServerRuntimeFingerprint
 		})) {
 			embeddedAgentLog.debug("codex app-server runtime identity changed; starting a new thread", {
@@ -2862,10 +1758,17 @@ async function startOrResumeThread(params) {
 			config: params.params.config
 		});
 		const startModelProvider = startModelSelection.modelProvider;
-		const transientDelegationRestriction = params.params.delegationCapability === "report_only";
-		let preserveExistingBinding = transientDelegationRestriction || !ringZeroActive && params.nativeProviderWebSearchSupport === "unknown" && !binding?.threadId;
+		let preserveExistingBinding = params.nativeProviderWebSearchSupport === "unknown" && !binding?.threadId;
 		let rotatedContextEngineBinding = false;
 		let prebuiltPluginThreadConfig;
+		const throwIfAborted = () => {
+			if (!params.signal?.aborted) return;
+			const reason = params.signal.reason;
+			if (reason instanceof Error) throw reason;
+			const error = new Error(typeof reason === "string" && reason.length > 0 ? reason : "codex app-server thread lifecycle aborted");
+			error.name = "AbortError";
+			throw error;
+		};
 		const webSearchBindingChanged = binding?.threadId && binding.webSearchThreadConfigFingerprint !== webSearchThreadConfigFingerprint;
 		const persistentWebSearchRestriction = params.webSearchAllowed === false && params.persistentWebSearchAllowed === false;
 		const transientNativeToolRestriction = params.nativeCodeModeEnabled === false && !persistentWebSearchRestriction;
@@ -2873,8 +1776,7 @@ async function startOrResumeThread(params) {
 		const explicitTransientWebSearchRestriction = params.webSearchAllowed === false && params.persistentWebSearchAllowed !== false && transientWebSearchRestriction;
 		const unknownProviderWebSearchSupport = params.nativeProviderWebSearchSupport === "unknown";
 		if (binding?.threadId && params.mcpServersFingerprintEvaluated === true && binding.mcpServersFingerprint !== params.mcpServersFingerprint) {
-			assertCodexBindingMayBeReplaced(binding, "changing MCP configuration");
-			if (!ringZeroActive && (transientNativeToolRestriction || webSearchBindingChanged && (explicitTransientWebSearchRestriction || unknownProviderWebSearchSupport))) {
+			if (transientNativeToolRestriction || webSearchBindingChanged && (explicitTransientWebSearchRestriction || unknownProviderWebSearchSupport)) {
 				embeddedAgentLog.debug("codex app-server MCP config changed during transient restricted turn; starting transient thread", { threadId: binding.threadId });
 				preserveExistingBinding = true;
 			} else {
@@ -2885,8 +1787,7 @@ async function startOrResumeThread(params) {
 		}
 		const deferLegacyWebSearchRotationToTransientNativeSurface = params.nativeCodeModeEnabled === false && binding?.webSearchThreadConfigFingerprint === void 0 && !persistentWebSearchRestriction;
 		if (binding?.threadId && webSearchBindingChanged && !deferLegacyWebSearchRotationToTransientNativeSurface) {
-			assertCodexBindingMayBeReplaced(binding, "changing web-search configuration");
-			if (!ringZeroActive && transientWebSearchRestriction) {
+			if (transientWebSearchRestriction) {
 				embeddedAgentLog.debug("codex app-server web search restricted for turn; starting transient thread", { threadId: binding.threadId });
 				preserveExistingBinding = true;
 			} else {
@@ -2895,17 +1796,11 @@ async function startOrResumeThread(params) {
 			}
 			binding = void 0;
 		}
-		if (binding?.threadId && transientNativeToolRestriction && !ringZeroActive) {
-			assertCodexBindingMayBeReplaced(binding, "starting a native-tool-restricted turn");
+		if (binding?.threadId && transientNativeToolRestriction) {
 			embeddedAgentLog.debug("codex app-server native tool surface disabled for turn; starting transient thread", { threadId: binding.threadId });
 			preserveExistingBinding = true;
 			binding = void 0;
 		}
-		if (binding?.threadId && transientDelegationRestriction) {
-			assertCodexBindingMayBeReplaced(binding, "starting a delegation-restricted turn");
-			embeddedAgentLog.debug("codex app-server delegation restricted for turn; starting transient thread", { threadId: binding.threadId });
-			binding = void 0;
-		}
 		if (binding?.threadId && (binding.contextEngine || contextEngineBinding)) {
 			if (!contextEngineBinding || !isContextEngineBindingCompatible(binding.contextEngine, contextEngineBinding)) {
 				embeddedAgentLog.debug("codex app-server context-engine binding changed; starting a new thread", {
@@ -2976,178 +1871,494 @@ async function startOrResumeThread(params) {
 				binding = void 0;
 			}
 		}
-		if (binding?.threadId) if (binding.dynamicToolsFingerprint && !areDynamicToolFingerprintsCompatible(binding.dynamicToolsFingerprint, dynamicToolsFingerprint, legacyDynamicToolsFingerprint)) {
-			assertCodexBindingMayBeReplaced(binding, "changing the dynamic tool catalog");
-			preserveExistingBinding = shouldStartTransientNoToolThread({
-				previous: binding.dynamicToolsFingerprint,
-				nextHasDynamicTools: params.dynamicTools.length > 0
-			});
-			if (preserveExistingBinding) embeddedAgentLog.debug("codex app-server dynamic tools unavailable for turn; starting transient thread", { threadId: binding.threadId });
-			else {
-				embeddedAgentLog.debug("codex app-server dynamic tool catalog changed; starting a new thread", { threadId: binding.threadId });
-				await clearCurrentBinding("rotating a stale thread binding");
-			}
-		} else if (incognito) {
-			if (binding.clientId && binding.clientId === clientId) {
-				params.buildFinalConfigPatch?.({
-					action: "resume",
-					binding
-				});
-				throwIfAborted();
-				lifecycleTiming.mark("thread-ready");
-				lifecycleTiming.logSummary({
-					runId: params.params.runId,
-					sessionId: params.params.sessionId,
-					sessionKey: params.params.sessionKey,
-					threadId: binding.threadId,
-					action: "resumed"
+		if (binding?.threadId) {
+			if (binding.dynamicToolsFingerprint && !areDynamicToolFingerprintsCompatible(binding.dynamicToolsFingerprint, dynamicToolsFingerprint, legacyDynamicToolsFingerprint)) {
+				preserveExistingBinding = shouldStartTransientNoToolThread({
+					previous: binding.dynamicToolsFingerprint,
+					nextHasDynamicTools: params.dynamicTools.length > 0
 				});
-				return {
-					...binding,
-					lifecycle: { action: "resumed" }
-				};
+				if (preserveExistingBinding) embeddedAgentLog.debug("codex app-server dynamic tools unavailable for turn; starting transient thread", { threadId: binding.threadId });
+				else {
+					embeddedAgentLog.debug("codex app-server dynamic tool catalog changed; starting a new thread", { threadId: binding.threadId });
+					await clearCurrentBinding("rotating a stale thread binding");
+				}
+			} else {
+				const resumeBinding = binding;
+				let resumeReservation;
+				try {
+					const authProfileId = params.params.authProfileId ?? resumeBinding.authProfileId;
+					const finalConfigPatch = params.buildFinalConfigPatch?.({
+						action: "resume",
+						binding: resumeBinding
+					}) ?? {
+						configPatch: params.finalConfigPatch,
+						nativeHookRelayGeneration: params.nativeHookRelayGeneration
+					};
+					const pluginAppsConfigPatch = params.pluginThreadConfig?.enabled && resumeBinding.pluginAppPolicyContext ? buildCodexPluginAppsConfigPatchFromPolicyContext(resumeBinding.pluginAppPolicyContext) : void 0;
+					const resumeConfig = mergeCodexThreadConfigs(params.config, userMcpServersConfigPatch, pluginAppsConfigPatch, finalConfigPatch.configPatch);
+					const resumeParams = lifecycleTiming.measureSync("thread-resume-params", () => buildThreadResumeParams(params.params, {
+						threadId: resumeBinding.threadId,
+						authProfileId,
+						model: startModelSelection.model,
+						modelProvider: startModelProvider,
+						appServer: params.appServer,
+						dynamicTools: params.dynamicTools,
+						developerInstructions: params.developerInstructions,
+						config: resumeConfig,
+						nativeCodeModeEnabled: params.nativeCodeModeEnabled,
+						nativeProviderWebSearchSupport: params.nativeProviderWebSearchSupport,
+						nativeCodeModeOnlyEnabled: params.nativeCodeModeOnlyEnabled,
+						webSearchAllowed: params.webSearchAllowed
+					}));
+					const requestModelProvider = typeof resumeParams.modelProvider === "string" && resumeParams.modelProvider.trim() ? resumeParams.modelProvider : void 0;
+					throwIfAborted();
+					resumeReservation = params.reserveResumeThread?.(resumeBinding.threadId);
+					const response = await lifecycleTiming.measure("thread-resume-request", () => resumeCodexAppServerThread({
+						client: params.client,
+						abandonClient: params.abandonClient ?? (() => closeCodexStartupClientBestEffort(params.client)),
+						request: resumeParams,
+						signal: params.signal
+					}));
+					throwIfAborted();
+					const boundAuthProfileId = authProfileId;
+					const nextMcpServersFingerprint = params.mcpServersFingerprintEvaluated === true ? params.mcpServersFingerprint : resumeBinding.mcpServersFingerprint;
+					const resumePatch = {
+						cwd: params.cwd,
+						authProfileId: boundAuthProfileId,
+						model: response.model ?? resumeParams.model ?? params.params.modelId,
+						modelProvider: normalizeBindingModelProvider(boundAuthProfileId, response.modelProvider ?? requestModelProvider ?? startModelProvider),
+						dynamicToolsFingerprint,
+						dynamicToolsContainDeferred,
+						webSearchThreadConfigFingerprint,
+						userMcpServersFingerprint,
+						mcpServersFingerprint: nextMcpServersFingerprint,
+						networkProxyProfileName: params.appServer.networkProxy?.profileName,
+						networkProxyConfigFingerprint,
+						nativeHookRelayGeneration: finalConfigPatch.nativeHookRelayGeneration ?? resumeBinding.nativeHookRelayGeneration,
+						appServerRuntimeFingerprint: params.appServerRuntimeFingerprint,
+						pluginAppsFingerprint: resumeBinding.pluginAppsFingerprint,
+						pluginAppsInputFingerprint: resumeBinding.pluginAppsInputFingerprint,
+						pluginAppPolicyContext: resumeBinding.pluginAppPolicyContext,
+						contextEngine: contextEngineBinding,
+						environmentSelectionFingerprint
+					};
+					if (!await lifecycleTiming.measure("thread-resume-write-binding", () => params.bindingStore.mutate(bindingIdentity, {
+						kind: "patch",
+						threadId: resumeBinding.threadId,
+						patch: resumePatch
+					}))) throw new CodexThreadBindingConflictError(resumeBinding.threadId, "committing a resumed thread");
+					if (contextEngineBinding) embeddedAgentLog.info("codex app-server wrote context-engine thread binding", {
+						sessionId: params.params.sessionId,
+						sessionKey: params.params.sessionKey,
+						threadId: response.thread.id,
+						engineId: contextEngineBinding.engineId,
+						epoch: contextEngineBinding.projection?.epoch,
+						fingerprint: contextEngineBinding.projection?.fingerprint,
+						action: "resumed"
+					});
+					lifecycleTiming.mark("thread-ready");
+					lifecycleTiming.logSummary({
+						runId: params.params.runId,
+						sessionId: params.params.sessionId,
+						sessionKey: params.params.sessionKey,
+						threadId: response.thread.id,
+						action: "resumed"
+					});
+					const activeTurnIds = readActiveCodexTurnIds(response.thread);
+					return {
+						...resumeBinding,
+						threadId: response.thread.id,
+						...resumePatch,
+						lifecycle: {
+							action: "resumed",
+							...activeTurnIds.length ? { activeTurnIds } : {}
+						}
+					};
+				} catch (error) {
+					resumeReservation?.release();
+					if (isCodexAppServerUnsafeSubscriptionError(error)) throw error;
+					const resumeRejected = error instanceof CodexAppServerRpcError;
+					if (!await unsubscribeCodexThreadBestEffort(params.client, {
+						threadId: resumeBinding.threadId,
+						timeoutMs: 5e3
+					}) && !resumeRejected && !isCodexAppServerConnectionClosedError(error) && !params.signal?.aborted) throw new CodexAppServerUnsafeSubscriptionError("Codex thread/resume subscription cleanup failed", { cause: error });
+					if (isCodexAppServerConnectionClosedError(error) || params.signal?.aborted) throw error;
+					embeddedAgentLog.warn("codex app-server thread resume failed; starting a new thread", { error });
+					await clearCurrentBinding("rotating a stale thread binding");
+				}
 			}
-			await clearCurrentBinding("rotating an unavailable ephemeral thread binding");
-			binding = void 0;
-		} else {
-			const resumed = await resumeExistingCodexThread(params, {
-				binding,
-				bindingIdentity,
-				startModelSelection,
-				startModelProvider,
-				userMcpServersConfigPatch,
-				dynamicToolsFingerprint,
-				dynamicToolsContainDeferred,
-				webSearchThreadConfigFingerprint,
-				userMcpServersFingerprint,
-				ringZeroConfigFingerprint,
-				ringZeroClientInstanceId,
-				networkProxyConfigFingerprint,
-				contextEngineBinding,
-				environmentSelectionFingerprint,
-				hostSystemAgentActive,
-				ringZeroActive,
-				ringZeroInheritedMcpServerNames,
-				lifecycleTiming,
-				normalizeBindingModelProvider,
-				throwIfAborted,
-				clearCurrentBinding
+		}
+		const pluginThreadConfig = params.pluginThreadConfig?.enabled ? prebuiltPluginThreadConfig ?? await lifecycleTiming.measure("plugin-config-build", () => params.pluginThreadConfig?.build()) : void 0;
+		const finalConfigPatch = params.buildFinalConfigPatch?.({ action: "start" }) ?? {
+			configPatch: params.finalConfigPatch,
+			nativeHookRelayGeneration: params.nativeHookRelayGeneration
+		};
+		const config = lifecycleTiming.measureSync("merge-thread-config", () => mergeCodexThreadConfigs(params.config, userMcpServersConfigPatch, pluginThreadConfig?.configPatch, finalConfigPatch.configPatch));
+		const startParams = lifecycleTiming.measureSync("thread-start-params", () => buildThreadStartParams(params.params, {
+			cwd: params.cwd,
+			dynamicTools: params.dynamicTools,
+			appServer: params.appServer,
+			developerInstructions: params.developerInstructions,
+			config,
+			nativeCodeModeEnabled: params.nativeCodeModeEnabled,
+			nativeProviderWebSearchSupport: params.nativeProviderWebSearchSupport,
+			nativeCodeModeOnlyEnabled: params.nativeCodeModeOnlyEnabled,
+			webSearchAllowed: params.webSearchAllowed,
+			environmentSelection: params.environmentSelection,
+			model: startModelSelection.model,
+			modelProvider: startModelProvider
+		}));
+		const requestModelProvider = typeof startParams.modelProvider === "string" && startParams.modelProvider.trim() ? startParams.modelProvider : void 0;
+		const threadStartResponse = await lifecycleTiming.measure("thread-start-request", async () => {
+			try {
+				return await params.client.request("thread/start", startParams, { signal: params.signal });
+			} catch (error) {
+				if (error instanceof CodexAppServerRpcError) throw new CodexThreadStartRequestError(error);
+				throw error;
+			}
+		});
+		const response = assertCodexThreadStartResponse(threadStartResponse);
+		throwIfAborted();
+		const modelProvider = resolveCodexAppServerModelProvider({
+			provider: params.params.provider,
+			authProfileId: params.params.authProfileId,
+			authProfileStore: params.params.authProfileStore,
+			agentDir: params.params.agentDir,
+			config: params.params.config
+		});
+		const nextMcpServersFingerprint = params.mcpServersFingerprintEvaluated === true ? params.mcpServersFingerprint : void 0;
+		if (!preserveExistingBinding) {
+			if (!await lifecycleTiming.measure("thread-start-write-binding", () => params.bindingStore.mutate(bindingIdentity, {
+				kind: "set",
+				if: { kind: "absent" },
+				binding: {
+					threadId: response.thread.id,
+					cwd: params.cwd,
+					authProfileId: params.params.authProfileId,
+					model: response.model ?? startParams.model ?? params.params.modelId,
+					modelProvider: normalizeBindingModelProvider(params.params.authProfileId, response.modelProvider ?? requestModelProvider ?? startModelProvider ?? modelProvider),
+					dynamicToolsFingerprint,
+					dynamicToolsContainDeferred,
+					webSearchThreadConfigFingerprint,
+					userMcpServersFingerprint,
+					mcpServersFingerprint: nextMcpServersFingerprint,
+					networkProxyProfileName: params.appServer.networkProxy?.profileName,
+					networkProxyConfigFingerprint,
+					nativeHookRelayGeneration: finalConfigPatch.nativeHookRelayGeneration,
+					appServerRuntimeFingerprint: params.appServerRuntimeFingerprint,
+					pluginAppsFingerprint: pluginThreadConfig?.fingerprint,
+					pluginAppsInputFingerprint: pluginThreadConfig?.inputFingerprint,
+					pluginAppPolicyContext: pluginThreadConfig?.policyContext,
+					contextEngine: contextEngineBinding,
+					environmentSelectionFingerprint
+				}
+			}))) throw new CodexThreadBindingConflictError(response.thread.id, "committing a fresh thread");
+			if (contextEngineBinding) embeddedAgentLog.info("codex app-server wrote context-engine thread binding", {
+				sessionId: params.params.sessionId,
+				sessionKey: params.params.sessionKey,
+				threadId: response.thread.id,
+				engineId: contextEngineBinding.engineId,
+				epoch: contextEngineBinding.projection?.epoch,
+				fingerprint: contextEngineBinding.projection?.fingerprint,
+				action: rotatedContextEngineBinding ? "rotated" : "started"
 			});
-			if (resumed) return resumed;
 		}
-		return await startFreshCodexThread(params, {
-			bindingIdentity,
-			startModelSelection,
-			startModelProvider,
-			userMcpServersConfigPatch,
+		lifecycleTiming.mark("thread-ready");
+		lifecycleTiming.logSummary({
+			runId: params.params.runId,
+			sessionId: params.params.sessionId,
+			sessionKey: params.params.sessionKey,
+			threadId: response.thread.id,
+			action: rotatedContextEngineBinding ? "rotated" : "started"
+		});
+		return {
+			threadId: response.thread.id,
+			cwd: params.cwd,
+			authProfileId: params.params.authProfileId,
+			model: response.model ?? startParams.model ?? params.params.modelId,
+			modelProvider: response.modelProvider ?? requestModelProvider ?? startModelProvider ?? modelProvider,
 			dynamicToolsFingerprint,
 			dynamicToolsContainDeferred,
-			webSearchThreadConfigFingerprint,
 			userMcpServersFingerprint,
-			ringZeroConfigFingerprint,
-			ringZeroClientInstanceId,
+			mcpServersFingerprint: nextMcpServersFingerprint,
+			networkProxyProfileName: params.appServer.networkProxy?.profileName,
 			networkProxyConfigFingerprint,
-			contextEngineBinding,
+			nativeHookRelayGeneration: finalConfigPatch.nativeHookRelayGeneration,
+			appServerRuntimeFingerprint: params.appServerRuntimeFingerprint,
+			pluginAppsFingerprint: pluginThreadConfig?.fingerprint,
+			pluginAppsInputFingerprint: pluginThreadConfig?.inputFingerprint,
+			pluginAppPolicyContext: pluginThreadConfig?.policyContext,
+			contextEngine: contextEngineBinding,
 			environmentSelectionFingerprint,
-			hostSystemAgentActive,
-			ringZeroActive,
-			ringZeroInheritedMcpServerNames,
-			lifecycleTiming,
-			normalizeBindingModelProvider,
-			throwIfAborted,
-			prebuiltPluginThreadConfig,
-			preserveExistingBinding,
-			rotatedContextEngineBinding
-		});
+			lifecycle: {
+				action: "started",
+				...rotatedContextEngineBinding ? { rotatedContextEngineBinding } : {}
+			}
+		};
 	});
 }
-//#endregion
-//#region extensions/codex/src/app-server/image-payload-sanitizer.ts
-/**
-* Sanitizes inline image payloads mirrored through Codex history so invalid
-* base64 data becomes readable text instead of poisoning replayed transcripts.
-*/
-const IMAGE_OMITTED_TEXT = "omitted image payload: invalid inline image data";
-/** Validates and normalizes an inline image data URL for Codex history payloads. */
-function sanitizeInlineImageDataUrl$1(imageUrl) {
-	return sanitizeInlineImageDataUrl(imageUrl);
-}
-/** Builds the replacement text inserted when an inline image payload is invalid. */
-function invalidInlineImageText(label) {
-	return `[${label}] ${IMAGE_OMITTED_TEXT}`;
+function shouldRotateCodexAppServerBindingForRuntime(params) {
+	if (!params.current) return false;
+	if (params.binding === params.current) return false;
+	return params.connectionClass === "remote" || Boolean(params.binding);
 }
-function sanitizeImageContentRecord(record, label) {
-	if (record.type === "image" && typeof record.data === "string") {
-		const mimeType = typeof record.mimeType === "string" ? record.mimeType : "image/png";
-		const imageUrl = sanitizeInlineImageDataUrl$1(`data:${mimeType};base64,${record.data}`);
-		if (!imageUrl) return {
-			type: "text",
-			text: invalidInlineImageText(label)
-		};
-		const commaIndex = imageUrl.indexOf(",");
-		const mime = imageUrl.slice(INLINE_IMAGE_DATA_URL_PREFIX.length, commaIndex).split(";")[0] ?? mimeType;
-		return {
-			...record,
-			mimeType: mime,
-			data: imageUrl.slice(commaIndex + 1)
-		};
-	}
-	if (record.type === "inputImage" && typeof record.imageUrl === "string") {
-		const imageUrl = sanitizeInlineImageDataUrl$1(record.imageUrl);
-		return imageUrl ? {
-			...record,
-			imageUrl
-		} : {
-			type: "inputText",
-			text: invalidInlineImageText(label)
-		};
-	}
-	if (record.type === "input_image" && typeof record.image_url === "string") {
-		const imageUrl = sanitizeInlineImageDataUrl$1(record.image_url);
-		return imageUrl ? {
-			...record,
-			image_url: imageUrl
-		} : {
-			type: "input_text",
-			text: invalidInlineImageText(label)
-		};
+function resolveCodexGpt56MultiAgentVersion(modelRef) {
+	let modelId = modelRef?.trim().toLowerCase();
+	if (!modelId) return;
+	const slashIndex = modelId.indexOf("/");
+	if (slashIndex > 0) {
+		const provider = modelId.slice(0, slashIndex);
+		if (provider !== "openai" && provider !== "codex") return;
+		modelId = modelId.slice(slashIndex + 1);
 	}
+	if (modelId === "gpt-5.6-sol" || modelId === "gpt-5.6-terra") return "v2";
+	return modelId === "gpt-5.6-luna" ? "v1" : void 0;
 }
-/** Recursively sanitizes all Codex history image shapes while preserving unknown structure. */
-function sanitizeCodexHistoryImagePayloads(value, label) {
-	if (Array.isArray(value)) return value.map((entry) => sanitizeCodexHistoryImagePayloads(entry, label));
-	if (!isRecord(value)) return value;
-	const imageRecord = sanitizeImageContentRecord(value, label);
-	if (imageRecord) return imageRecord;
-	const next = {};
-	for (const [key, child] of Object.entries(value)) next[key] = sanitizeCodexHistoryImagePayloads(child, label);
-	return next;
+function shouldRotateCodexGpt56MultiAgentBinding(params) {
+	const bindingVersion = resolveCodexGpt56MultiAgentVersion(params.bindingModel);
+	const requestedVersion = resolveCodexGpt56MultiAgentVersion(params.requestedModel);
+	return Boolean(bindingVersion && requestedVersion && bindingVersion !== requestedVersion);
 }
-//#endregion
-//#region extensions/codex/src/app-server/user-input.ts
-/** Builds ordered Codex user input for both new turns and same-turn steering. */
-function buildCodexUserInput(text, images) {
-	const imageInputs = (images ?? []).map((image) => {
-		const imageUrl = sanitizeInlineImageDataUrl$1(`data:${image.mimeType};base64,${image.data}`);
-		return imageUrl ? {
-			type: "image",
-			url: imageUrl
-		} : {
-			type: "text",
-			text: invalidInlineImageText("codex user input"),
-			text_elements: []
-		};
+function isTransientWebSearchRestriction(params) {
+	if (params.nativeProviderWebSearchSupport === "unknown") return true;
+	if (params.params.config?.tools?.web?.search?.enabled === false) return false;
+	if (params.params.disableTools === true) return true;
+	const persistentWebSearchRestriction = params.webSearchAllowed === false && params.persistentWebSearchAllowed === false;
+	if (params.nativeCodeModeEnabled === false && !persistentWebSearchRestriction) return true;
+	if (params.webSearchAllowed !== false) return false;
+	if (params.persistentWebSearchAllowed !== void 0) return params.persistentWebSearchAllowed;
+	if (params.params.toolsAllow === void 0) return false;
+	return !params.params.toolsAllow.some((name) => {
+		const normalized = normalizeCodexDynamicToolName(name);
+		return normalized === "*" || normalized === "web_search";
 	});
-	return [...text === void 0 ? [] : [{
-		type: "text",
-		text,
-		text_elements: []
-	}], ...imageInputs];
 }
-//#endregion
-//#region extensions/codex/src/app-server/turn-params.ts
+function buildContextEngineBinding(params, projection) {
+	const contextEngine = isActiveHarnessContextEngine(params.contextEngine) ? params.contextEngine : void 0;
+	const engineId = contextEngine?.info?.id?.trim();
+	if (!contextEngine || !engineId) return;
+	return {
+		schemaVersion: 1,
+		engineId,
+		policyFingerprint: JSON.stringify({
+			schemaVersion: 1,
+			engineId,
+			engineVersion: contextEngine.info.version,
+			ownsCompaction: contextEngine.info.ownsCompaction === true,
+			turnMaintenanceMode: contextEngine.info.turnMaintenanceMode,
+			citationsMode: resolveContextEngineCitationsMode(params.config),
+			contextTokenBudget: params.contextTokenBudget,
+			projectionMaxChars: resolveCodexContextEngineProjectionMaxChars({
+				contextTokenBudget: params.contextTokenBudget,
+				reserveTokens: resolveCodexContextEngineProjectionReserveTokens({ config: params.config })
+			})
+		}),
+		projection: projection ? buildContextEngineProjectionBinding(projection) : void 0
+	};
+}
+function buildContextEngineProjectionBinding(projection) {
+	return {
+		schemaVersion: 1,
+		mode: "thread_bootstrap",
+		epoch: projection.epoch,
+		fingerprint: projection.fingerprint
+	};
+}
+function isContextEngineBindingCompatible(previous, next) {
+	return previous?.schemaVersion === next.schemaVersion && previous.engineId === next.engineId && previous.policyFingerprint === next.policyFingerprint && areContextEngineProjectionBindingsCompatible(previous.projection, next.projection);
+}
+function areContextEngineProjectionBindingsCompatible(previous, next) {
+	if (!next) return previous === void 0;
+	return previous?.schemaVersion === next.schemaVersion && previous.mode === next.mode && previous.epoch === next.epoch && previous.fingerprint === next.fingerprint;
+}
+function resolveContextEngineCitationsMode(config) {
+	const rootConfig = isUnknownRecord(config) ? config : void 0;
+	const citations = (isUnknownRecord(rootConfig?.memory) ? rootConfig.memory : void 0)?.citations;
+	return isJsonConfigValue(citations) ? citations : void 0;
+}
+function isUnknownRecord(value) {
+	return Boolean(value && typeof value === "object" && !Array.isArray(value));
+}
+function isJsonConfigValue(value) {
+	if (value === null || typeof value === "string" || typeof value === "boolean") return true;
+	if (typeof value === "number") return Number.isFinite(value);
+	if (Array.isArray(value)) return value.every(isJsonConfigValue);
+	return isUnknownRecord(value) && Object.values(value).every(isJsonConfigValue);
+}
+function shouldRecheckRecoverablePluginBinding(params) {
+	if (!params.pluginThreadConfig?.enabled) return false;
+	if (!params.binding.pluginAppsFingerprint || !params.binding.pluginAppsInputFingerprint || params.binding.pluginAppsInputFingerprint !== params.pluginThreadConfig.inputFingerprint) return false;
+	const policyContext = params.binding.pluginAppPolicyContext;
+	if (!policyContext) return false;
+	const expectedPluginConfigKeys = params.pluginThreadConfig.enabledPluginConfigKeys ?? [];
+	return Object.keys(policyContext.apps).length === 0 || expectedPluginConfigKeys.length > 0;
+}
+function buildThreadStartParams(params, options) {
+	const resolvedModelProvider = resolveCodexAppServerModelProvider({
+		provider: params.provider,
+		authProfileId: params.authProfileId,
+		authProfileStore: params.authProfileStore,
+		agentDir: params.agentDir,
+		config: params.config
+	});
+	const modelSelection = resolveCodexAppServerRequestModelSelection({
+		model: options.model ?? params.modelId,
+		modelProvider: options.modelProvider ?? resolvedModelProvider,
+		authProfileId: params.authProfileId,
+		authProfileStore: params.authProfileStore,
+		agentDir: params.agentDir,
+		config: params.config
+	});
+	return {
+		model: modelSelection.model,
+		...modelSelection.modelProvider ? { modelProvider: modelSelection.modelProvider } : {},
+		cwd: options.cwd,
+		approvalPolicy: options.appServer.approvalPolicy,
+		approvalsReviewer: resolveCodexThreadApprovalsReviewer(options.appServer, options.config),
+		...codexThreadSandboxOrPermissions(options.appServer),
+		...options.appServer.serviceTier !== void 0 ? { serviceTier: options.appServer.serviceTier } : {},
+		personality: CODEX_NATIVE_PERSONALITY_NONE,
+		serviceName: "OpenClaw",
+		config: buildCodexRuntimeThreadConfigForRun(params, options.config, {
+			nativeCodeModeEnabled: options.nativeCodeModeEnabled,
+			nativeProviderWebSearchSupport: options.nativeProviderWebSearchSupport,
+			nativeCodeModeOnlyEnabled: options.nativeCodeModeOnlyEnabled,
+			webSearchAllowed: options.webSearchAllowed,
+			appServer: options.appServer
+		}),
+		...resolveCodexThreadEnvironmentSelection(options),
+		developerInstructions: options.developerInstructions ?? buildDeveloperInstructions(params, { dynamicTools: options.dynamicTools }),
+		dynamicTools: [...options.dynamicTools],
+		experimentalRawEvents: true
+	};
+}
+function buildThreadResumeParams(params, options) {
+	const resolvedModelProvider = resolveCodexAppServerModelProvider({
+		provider: params.provider,
+		authProfileId: options.authProfileId ?? params.authProfileId,
+		authProfileStore: params.authProfileStore,
+		agentDir: params.agentDir,
+		config: params.config
+	});
+	const modelSelection = resolveCodexAppServerRequestModelSelection({
+		model: options.model ?? params.modelId,
+		modelProvider: options.modelProvider ?? resolvedModelProvider,
+		authProfileId: options.authProfileId ?? params.authProfileId,
+		authProfileStore: params.authProfileStore,
+		agentDir: params.agentDir,
+		config: params.config
+	});
+	return {
+		threadId: options.threadId,
+		model: modelSelection.model,
+		...modelSelection.modelProvider ? { modelProvider: modelSelection.modelProvider } : {},
+		approvalPolicy: options.appServer.approvalPolicy,
+		approvalsReviewer: resolveCodexThreadApprovalsReviewer(options.appServer, options.config),
+		...codexThreadSandboxOrPermissions(options.appServer),
+		...options.appServer.serviceTier !== void 0 ? { serviceTier: options.appServer.serviceTier } : {},
+		personality: CODEX_NATIVE_PERSONALITY_NONE,
+		config: buildCodexRuntimeThreadConfigForRun(params, options.config, {
+			nativeCodeModeEnabled: options.nativeCodeModeEnabled,
+			nativeProviderWebSearchSupport: options.nativeProviderWebSearchSupport,
+			nativeCodeModeOnlyEnabled: options.nativeCodeModeOnlyEnabled,
+			webSearchAllowed: options.webSearchAllowed,
+			appServer: options.appServer
+		}),
+		developerInstructions: options.developerInstructions ?? buildDeveloperInstructions(params, { dynamicTools: options.dynamicTools })
+	};
+}
+function resolveCodexBindingModelProviderFallback(params) {
+	const provider = params.provider?.trim().toLowerCase();
+	if (provider && provider !== "codex") return;
+	const currentModel = params.currentModel?.trim();
+	const bindingModel = params.bindingModel?.trim();
+	if (currentModel && bindingModel && currentModel === bindingModel && params.bindingModelProvider) return params.bindingModelProvider;
+	return hasProviderQualifiedModelRef(currentModel) ? void 0 : params.bindingModelProvider;
+}
+function resolveCodexAppServerThreadModelSelection(params) {
+	const authProfileId = params.authProfileId ?? params.binding?.authProfileId;
+	const explicitModelProvider = resolveCodexAppServerModelProvider({
+		provider: params.provider,
+		authProfileId,
+		authProfileStore: params.authProfileStore,
+		agentDir: params.agentDir,
+		config: params.config
+	});
+	const bindingModelProvider = params.binding?.threadId ? resolveCodexBindingModelProviderFallback({
+		provider: params.provider,
+		currentModel: params.model,
+		bindingModel: params.binding.model,
+		bindingModelProvider: params.binding.modelProvider
+	}) : void 0;
+	return resolveCodexAppServerRequestModelSelection({
+		model: params.model,
+		modelProvider: explicitModelProvider ?? bindingModelProvider,
+		authProfileId,
+		authProfileStore: params.authProfileStore,
+		agentDir: params.agentDir,
+		config: params.config
+	});
+}
+function resolveCodexAppServerRequestModelSelection(params) {
+	const model = params.model.trim();
+	const modelProvider = params.modelProvider?.trim();
+	if (modelProvider) return {
+		model,
+		modelProvider
+	};
+	const slashIndex = model.indexOf("/");
+	if (slashIndex <= 0 || slashIndex >= model.length - 1) return { model };
+	const inferredModelProvider = resolveCodexAppServerModelProvider({
+		provider: model.slice(0, slashIndex),
+		authProfileId: params.authProfileId,
+		authProfileStore: params.authProfileStore,
+		agentDir: params.agentDir,
+		config: params.config
+	});
+	return {
+		model: model.slice(slashIndex + 1).trim(),
+		...inferredModelProvider ? { modelProvider: inferredModelProvider } : {}
+	};
+}
+function hasProviderQualifiedModelRef(model) {
+	const trimmed = model?.trim();
+	const slashIndex = trimmed?.indexOf("/") ?? -1;
+	return slashIndex > 0 && slashIndex < (trimmed?.length ?? 0) - 1;
+}
+function buildCodexRuntimeThreadConfig(config, options = {}) {
+	const codeModeConfig = {
+		...CODEX_CODE_MODE_THREAD_CONFIG,
+		"features.code_mode_only": options.nativeCodeModeOnlyEnabled === true
+	};
+	if (options.nativeCodeModeEnabled === false) {
+		const disabledConfig = mergeCodexThreadConfigs(config, CODEX_CODE_MODE_DISABLED_THREAD_CONFIG) ?? { ...CODEX_CODE_MODE_DISABLED_THREAD_CONFIG };
+		delete disabledConfig["features.apply_patch_streaming_events"];
+		return disabledConfig;
+	}
+	if (options.nativeCodeModeOnlyEnabled === true) return mergeCodexThreadConfigs(codeModeConfig, config, { "features.code_mode_only": true }) ?? {
+		...codeModeConfig,
+		"features.code_mode_only": true
+	};
+	return mergeCodexThreadConfigs(codeModeConfig, config) ?? { ...codeModeConfig };
+}
+function buildCodexRuntimeThreadConfigForRun(params, config, options = {}) {
+	const webSearchConfig = resolveCodexWebSearchPlan({
+		config: params.config,
+		disableTools: params.disableTools,
+		nativeToolSurfaceEnabled: options.nativeCodeModeEnabled,
+		nativeProviderWebSearchSupport: options.nativeProviderWebSearchSupport,
+		webSearchAllowed: options.webSearchAllowed
+	}).threadConfig;
+	const baseConfig = buildCodexRuntimeThreadConfig(mergeCodexThreadConfigs(config, webSearchConfig), options);
+	const runtimeConfig = mergeCodexThreadConfigs(baseConfig, options.appServer?.networkProxy?.configPatch, shouldDisableCodexToolSearchForModel(params.modelId) ? CODEX_TOOL_SEARCH_UNSUPPORTED_THREAD_CONFIG : void 0) ?? baseConfig;
+	if (params.bootstrapContextMode !== "lightweight") return runtimeConfig;
+	return mergeCodexThreadConfigs(runtimeConfig, CODEX_LIGHTWEIGHT_CONTEXT_THREAD_CONFIG) ?? {
+		...runtimeConfig,
+		...CODEX_LIGHTWEIGHT_CONTEXT_THREAD_CONFIG
+	};
+}
 function buildTurnStartParams(params, options) {
-	const modelSelection = options.preserveNativeTurnSettings ? void 0 : resolveCodexAppServerRequestModelSelection({
+	const modelSelection = resolveCodexAppServerRequestModelSelection({
 		model: options.model ?? params.modelId,
 		modelProvider: options.modelProvider,
 		authProfileId: params.authProfileId,
@@ -3158,26 +2369,37 @@ function buildTurnStartParams(params, options) {
 	const useThreadPermissionProfile = options.appServer.networkProxy && !options.sandboxPolicy;
 	return {
 		threadId: options.threadId,
-		input: buildCodexUserInput(options.promptText ?? params.prompt, params.images),
+		input: buildUserInput(params, options.promptText),
 		cwd: options.cwd,
 		approvalPolicy: options.appServer.approvalPolicy,
 		approvalsReviewer: options.appServer.approvalsReviewer,
-		...useThreadPermissionProfile ? {} : { sandboxPolicy: options.sandboxPolicy ?? codexSandboxPolicyForTurn(options.appServer.sandbox, options.cwd, options.appServer.start?.args) },
-		...modelSelection ? {
-			model: modelSelection.model,
-			personality: CODEX_NATIVE_PERSONALITY_NONE
-		} : {},
+		...useThreadPermissionProfile ? {} : { sandboxPolicy: options.sandboxPolicy ?? codexSandboxPolicyForTurn(options.appServer.sandbox, options.cwd) },
+		model: modelSelection.model,
+		personality: CODEX_NATIVE_PERSONALITY_NONE,
 		...options.appServer.serviceTier !== void 0 ? { serviceTier: options.appServer.serviceTier } : {},
-		...modelSelection ? { effort: resolveReasoningEffort(params.thinkLevel, modelSelection.model, readCodexSupportedReasoningEfforts(params.model?.compat)) } : {},
+		effort: resolveReasoningEffort(params.thinkLevel, modelSelection.model, readCodexSupportedReasoningEfforts(params.model?.compat)),
 		...options.environmentSelection ? { environments: options.environmentSelection } : {},
-		...modelSelection ? { collaborationMode: buildTurnCollaborationMode(params, {
+		collaborationMode: buildTurnCollaborationMode(params, {
 			model: modelSelection.model,
 			turnScopedDeveloperInstructions: options.turnScopedDeveloperInstructions,
 			skillsCollaborationInstructions: options.skillsCollaborationInstructions,
-			memoryCollaborationInstructions: options.memoryCollaborationInstructions
-		}) } : {}
+			memoryCollaborationInstructions: options.memoryCollaborationInstructions,
+			heartbeatCollaborationInstructions: options.heartbeatCollaborationInstructions
+		})
 	};
 }
+function resolveCodexThreadApprovalsReviewer(appServer, config) {
+	return config?.approvals_reviewer === "user" ? "user" : appServer.approvalsReviewer;
+}
+function codexThreadSandboxOrPermissions(appServer) {
+	if (appServer.networkProxy) return {};
+	return { sandbox: appServer.sandbox };
+}
+function resolveCodexThreadEnvironmentSelection(options) {
+	if (options.nativeCodeModeEnabled === false) return { environments: [] };
+	if (options.environmentSelection) return { environments: options.environmentSelection };
+	return {};
+}
 function buildTurnCollaborationMode(params, options = {}) {
 	const model = options.model ?? params.modelId;
 	return {
@@ -3192,7 +2414,7 @@ function buildTurnCollaborationMode(params, options = {}) {
 function buildTurnScopedCollaborationInstructions(params, options = {}) {
 	const contextInstructions = joinPresentSections(options.turnScopedDeveloperInstructions, options.memoryCollaborationInstructions, options.skillsCollaborationInstructions);
 	if (params.trigger === "cron") return joinPresentSections(buildCronCollaborationInstructions(), contextInstructions);
-	if (params.trigger === "heartbeat" && params.bootstrapContextRunKind !== "commitment-only") return joinPresentSections(buildHeartbeatCollaborationInstructions(), contextInstructions);
+	if (params.trigger === "heartbeat" && params.bootstrapContextRunKind !== "commitment-only") return joinPresentSections(buildHeartbeatCollaborationInstructions(), contextInstructions, options.heartbeatCollaborationInstructions);
 	if (contextInstructions?.trim()) return joinPresentSections(buildDefaultCollaborationInstructions(), contextInstructions);
 	return null;
 }
@@ -3223,11 +2445,149 @@ function buildHeartbeatCollaborationInstructions() {
 	return [
 		"This is an OpenClaw heartbeat turn. Apply these instructions only to this heartbeat wake; ordinary chat turns should stay in Codex Default mode.",
 		"When you are ready to end the heartbeat, prefer the structured `heartbeat_respond` tool so OpenClaw can record the wake outcome and notification decision. If `heartbeat_respond` is not already available and `tool_search` is available, search for `heartbeat_respond`, load it, then call it. Use `notify=false` when nothing should visibly interrupt the user.",
-		GPT5_HEARTBEAT_PROMPT_OVERLAY
+		CODEX_GPT5_HEARTBEAT_PROMPT_OVERLAY
 	].join("\n\n");
 }
 function joinPresentSections(...sections) {
 	return sections.filter((section) => Boolean(section?.trim())).join("\n\n");
 }
+function codexDynamicToolsFingerprint(dynamicTools) {
+	return fingerprintDynamicTools(dynamicTools);
+}
+function codexLegacyDynamicToolsFingerprint(dynamicTools) {
+	return legacyFingerprintDynamicTools(dynamicTools);
+}
+function areCodexDynamicToolFingerprintsCompatible(params) {
+	return areDynamicToolFingerprintsCompatible(params.previous, params.next, params.nextLegacy);
+}
+function fingerprintDynamicTools(dynamicTools) {
+	return hashCodexAppServerBindingFingerprint(legacyFingerprintDynamicTools(dynamicTools));
+}
+function legacyFingerprintDynamicTools(dynamicTools) {
+	return JSON.stringify(dynamicTools.map(fingerprintDynamicToolSpec).toSorted(compareJsonFingerprint));
+}
+function legacyFingerprintUserMcpServersConfigPatch(configPatch) {
+	return configPatch ? JSON.stringify(stabilizeJsonValue(configPatch)) : void 0;
+}
+function fingerprintUserMcpServersConfigPatch(configPatch) {
+	return configPatch ? hashCodexAppServerBindingFingerprint(JSON.stringify(stabilizeJsonValue(configPatch))) : void 0;
+}
+function fingerprintJsonObject(value) {
+	return JSON.stringify(stabilizeJsonValue(value));
+}
+function fingerprintEnvironmentSelection(environments) {
+	return environments ? JSON.stringify(environments.map(stabilizeJsonValue)) : void 0;
+}
+function fingerprintDynamicToolSpec(tool) {
+	return stabilizeDynamicToolFingerprintValue(tool);
+}
+function stabilizeDynamicToolFingerprintValue(value) {
+	if (Array.isArray(value)) return value.map(stabilizeDynamicToolFingerprintValue);
+	if (!isJsonObject(value)) return value;
+	const stable = {};
+	for (const [key, child] of Object.entries(value).toSorted(([left], [right]) => left.localeCompare(right))) {
+		if (key === "description") continue;
+		stable[key] = stabilizeDynamicToolFingerprintValue(child);
+	}
+	return stable;
+}
+function stabilizeJsonValue(value) {
+	if (Array.isArray(value)) return value.map(stabilizeJsonValue);
+	if (!isJsonObject(value)) return value;
+	const stable = {};
+	for (const [key, child] of Object.entries(value).toSorted(([left], [right]) => left.localeCompare(right))) stable[key] = stabilizeJsonValue(child);
+	return stable;
+}
+function readActiveCodexTurnIds(thread) {
+	return (thread.turns ?? []).filter((turn) => turn.status === "inProgress").map((turn) => typeof turn.id === "string" ? turn.id : "").filter((turnId) => turnId.trim().length > 0);
+}
+const LEGACY_EMPTY_DYNAMIC_TOOLS_FINGERPRINT = legacyFingerprintDynamicTools([]);
+const EMPTY_DYNAMIC_TOOLS_FINGERPRINT = hashCodexAppServerBindingFingerprint(LEGACY_EMPTY_DYNAMIC_TOOLS_FINGERPRINT);
+function areDynamicToolFingerprintsCompatible(previous, next, nextLegacy) {
+	return !previous || previous === next || previous === nextLegacy;
+}
+function areUserMcpServersFingerprintsCompatible(params) {
+	return params.previous === params.next || params.previous === params.nextLegacy || params.nextLegacy !== void 0 && params.previous === hashCodexAppServerBindingFingerprint(params.nextLegacy);
+}
+function shouldStartTransientNoToolThread(params) {
+	return Boolean(params.previous && !isEmptyDynamicToolsFingerprint(params.previous) && !params.nextHasDynamicTools);
+}
+function isEmptyDynamicToolsFingerprint(fingerprint) {
+	return fingerprint === EMPTY_DYNAMIC_TOOLS_FINGERPRINT || fingerprint === LEGACY_EMPTY_DYNAMIC_TOOLS_FINGERPRINT;
+}
+function compareJsonFingerprint(left, right) {
+	return JSON.stringify(left).localeCompare(JSON.stringify(right));
+}
+function buildDeveloperInstructions(params, options = {}) {
+	const nativeCommandGuidance = listRegisteredPluginAgentPromptGuidance({
+		surface: "codex_app_server",
+		includeLegacyGlobalGuidance: false
+	}).join("\n");
+	return [
+		"You are a personal agent running inside OpenClaw. OpenClaw has dynamic tools for OpenClaw-owned messaging, cron, sessions, media, gateway, and nodes.",
+		buildDeferredDynamicToolManifest(options.dynamicTools),
+		buildSkillWorkshopInstruction(options.dynamicTools),
+		"Use Codex native `spawn_agent` for Codex subagents. `spawn_agent` and the other native collaboration tools may be deferred: when `spawn_agent` is not directly listed, load it with `tool_search` before spawning. Use OpenClaw `sessions_spawn` only for OpenClaw or ACP delegation, never as a substitute for `spawn_agent`.",
+		buildVisibleReplyInstruction(params, options.dynamicTools),
+		nativeCommandGuidance,
+		params.extraSystemPrompt
+	].filter((section) => typeof section === "string" && section.trim()).join("\n\n");
+}
+function buildDeferredDynamicToolManifest(dynamicTools) {
+	const deferredToolNames = [...new Set(flattenCodexDynamicToolFunctions(dynamicTools).filter((tool) => tool.deferLoading === true).map((tool) => tool.name.trim()).filter(Boolean))].toSorted((left, right) => left.localeCompare(right));
+	if (deferredToolNames.length === 0) return;
+	return `Deferred searchable OpenClaw dynamic tools available: ${deferredToolNames.join(", ")}. Use \`tool_search\` to load exact callable specs before use.`;
+}
+function buildSkillWorkshopInstruction(dynamicTools) {
+	if (!flattenCodexDynamicToolFunctions(dynamicTools).some((tool) => tool.name.trim() === SKILL_WORKSHOP_TOOL_NAME)) return;
+	return buildSkillWorkshopPromptSection().join("\n");
+}
+function buildVisibleReplyInstruction(params, dynamicTools) {
+	const messageToolAvailable = dynamicTools ? flattenCodexDynamicToolFunctions(dynamicTools).some((tool) => tool.name.trim() === "message") : params.disableMessageTool !== true;
+	if (params.sourceReplyDeliveryMode === "message_tool_only" && messageToolAvailable) return "Visible source replies are not automatically delivered for this run. Use `message(action=send)` for user-visible source-channel output. Do not repeat that visible content in your final answer.";
+	if (messageToolAvailable) return "For the current source conversation, reply normally in your final assistant message; OpenClaw will deliver it through the active source conversation. Use `message` only for explicit out-of-band sends, media/file sends, or sends to a different target.";
+	return "For the current source conversation, reply normally in your final assistant message; OpenClaw will deliver it through the active source conversation.";
+}
+function buildUserInput(params, promptText = params.prompt) {
+	const imageInputs = (params.images ?? []).map((image) => {
+		const imageUrl = sanitizeInlineImageDataUrl$1(`data:${image.mimeType};base64,${image.data}`);
+		return imageUrl ? {
+			type: "image",
+			url: imageUrl
+		} : {
+			type: "text",
+			text: invalidInlineImageText("codex user input"),
+			text_elements: []
+		};
+	});
+	return [{
+		type: "text",
+		text: promptText,
+		text_elements: []
+	}, ...imageInputs];
+}
+function resolveCodexAppServerModelProvider(params) {
+	const normalized = params.provider.trim();
+	const normalizedLower = normalized.toLowerCase();
+	if (!normalized || normalizedLower === "codex") return;
+	if (isCodexAppServerNativeAuthProfile(params) && normalizedLower === "openai") return;
+	return normalizedLower === "openai" ? "openai" : normalized;
+}
+function resolveReasoningEffort(thinkLevel, modelId, supportedReasoningEfforts) {
+	if (thinkLevel === "off" || thinkLevel === "adaptive") return null;
+	if (supportedReasoningEfforts) return resolveCodexSupportedReasoningEffort({
+		requested: thinkLevel,
+		supportedReasoningEfforts
+	}) ?? null;
+	const fallbackReasoningEfforts = resolveCodexFallbackReasoningEfforts(modelId);
+	if (fallbackReasoningEfforts) return resolveCodexSupportedReasoningEffort({
+		requested: thinkLevel,
+		supportedReasoningEfforts: fallbackReasoningEfforts
+	}) ?? null;
+	if (thinkLevel === "minimal") return isModernCodexModel(modelId) ? "low" : "minimal";
+	if (thinkLevel === "low" || thinkLevel === "medium" || thinkLevel === "high" || thinkLevel === "xhigh") return thinkLevel;
+	if (thinkLevel === "max" && isMaxReasoningCodexModel(modelId)) return "max";
+	return null;
+}
 //#endregion
-export { readHookOutputEntries as $, resolveCodexDynamicToolsLoading as A, resolveCodexContextEngineProjectionReserveTokens as B, readCodexSupportedReasoningEfforts as C, isForcedPrivateQaCodexRuntime as D, filterCodexDynamicToolsWithOpenClawShell as E, buildContextEngineBinding as F, mergeCodexThreadConfigs as G, buildCodexPluginThreadConfig as H, isContextEngineBindingCompatible as I, pluginReadParams as J, shouldBuildCodexPluginThreadConfig as K, fitCodexProjectedContextForTurnStart as L, areCodexDynamicToolFingerprintsCompatible as M, codexDynamicToolsFingerprint as N, isSystemAgentOnlyCodexDynamicToolAllowlist as O, codexLegacyDynamicToolsFingerprint as P, readCodexErrorNotificationMessage as Q, projectContextEngineAssemblyForCodex as R, resolveReasoningEffort as S, filterCodexDynamicTools as T, buildCodexPluginThreadConfigInputFingerprint as U, buildCodexPluginAppsConfigPatchFromPolicyContext as V, buildCodexPluginThreadConfigTimeoutFallback as W, extractRawAssistantText as X, resolveRecoverableCodexPluginConfigKeys as Y, normalizeNonEmptyString as Z, CODEX_NATIVE_PERSONALITY_NONE as _, sanitizeCodexHistoryImagePayloads as a, readNullableString as at, resolveCodexAppServerThreadModelSelection as b, resumeCodexAppServerThread as c, splitPlanText as ct, buildCodexRingZeroThreadConfigPatch as d, readItem as et, buildCodexRuntimeThreadConfig as f, buildDeveloperInstructions as g, resolveCodexWebSearchPlan as h, invalidInlineImageText as i, readNonNegativeInteger as it, resolveCodexDynamicToolsLoadingForRuntime as j, normalizeCodexDynamicToolName as k, assertCodexRingZeroHasNoManagedHooks as l, buildCodexNativeWebSearchThreadConfig as m, buildTurnStartParams as n, readNonEmptyString as nt, sanitizeInlineImageDataUrl$1 as o, readNumber as ot, readCodexInheritedMcpServerNames as p, ensureCodexPluginActivation as q, buildCodexUserInput as r, readNonEmptyStringArray as rt, startOrResumeThread as s, readString as st, buildTurnCollaborationMode as t, readItemString as tt, attestCodexRingZeroThreadHasNoMcpServers as u, resolveCodexAppServerModelProvider as v, isCodexAppServerProfilerEnabled as w, resolveCodexBindingModelProviderFallback as x, resolveCodexAppServerRequestModelSelection as y, resolveCodexContextEngineProjectionMaxChars as z };
+export { resolveCodexContextEngineProjectionMaxChars as A, buildCodexPluginThreadConfig as B, filterCodexDynamicTools as C, resolveCodexDynamicToolsLoadingForRuntime as D, resolveCodexDynamicToolsLoading as E, closeCodexStartupClientBestEffort as F, pluginReadParams as G, mergeCodexThreadConfigs as H, interruptCodexTurnBestEffort as I, buildCodexAppInventoryCacheKey as K, retireCodexAppServerClientAfterTimedOutTurn as L, CODEX_APP_SERVER_INTERRUPT_TIMEOUT_MS as M, CODEX_APP_SERVER_UNSUBSCRIBE_TIMEOUT_MS as N, fitCodexProjectedContextForTurnStart as O, CodexAppServerUnsafeSubscriptionError as P, unsubscribeCodexThreadBestEffort as R, sanitizeInlineImageDataUrl$1 as S, normalizeCodexDynamicToolName as T, shouldBuildCodexPluginThreadConfig as U, buildCodexPluginThreadConfigInputFingerprint as V, ensureCodexPluginActivation as W, buildCodexNativeWebSearchThreadConfig as _, buildDeveloperInstructions as a, invalidInlineImageText as b, codexDynamicToolsFingerprint as c, resolveCodexAppServerModelProvider as d, resolveCodexAppServerRequestModelSelection as f, startOrResumeThread as g, resolveReasoningEffort as h, buildContextEngineBinding as i, resolveCodexContextEngineProjectionReserveTokens as j, projectContextEngineAssemblyForCodex as k, codexLegacyDynamicToolsFingerprint as l, resolveCodexBindingModelProviderFallback as m, areCodexDynamicToolFingerprintsCompatible as n, buildTurnCollaborationMode as o, resolveCodexAppServerThreadModelSelection as p, defaultCodexAppInventoryCache as q, buildCodexRuntimeThreadConfig as r, buildTurnStartParams as s, CODEX_NATIVE_PERSONALITY_NONE as t, isContextEngineBindingCompatible as u, resolveCodexWebSearchPlan as v, isForcedPrivateQaCodexRuntime as w, sanitizeCodexHistoryImagePayloads as x, isCodexAppServerProfilerEnabled as y, buildCodexPluginAppsConfigPatchFromPolicyContext as z };