@openclaw/codex 2026.7.2-beta.5 → 2026.8.1-beta.2

package/dist/{thread-lifecycle-DRg_FdzC.js → thread-lifecycle-Bu1BTDXr.js}

@@ -1,103 +1,34 @@
-import { B as flattenCodexDynamicToolFunctions, E as resolveCodexAppServerClientInstanceId, V as isJsonObject, _ as CodexAppServerRpcError, s as isCodexAppServerStartSelectionChangedError, v as getCodexAppServerClientInstanceId, w as isCodexAppServerPrewriteRequestCancellationError, x as isCodexAppServerConnectionClosedError } from "./shared-client-BVKE40c-.js";
-import { A as CODEX_PLUGINS_WORKSPACE_MARKETPLACE_NAME, E as resolveCodexPluginsPolicy, a as hashCodexAppServerBindingFingerprint, c as reclaimCurrentCodexSessionGeneration, f as codexSandboxPolicyForTurn, i as createCodexSessionGenerationSupersededError, k as CODEX_PLUGINS_MARKETPLACE_NAME, l as sessionBindingIdentity, n as assertCodexBindingMayBeReplaced, o as isCodexAppServerNativeAuthProfile, s as normalizeCodexAppServerBindingModelProvider } from "./session-binding-DlVQ-Pxs.js";
-import { a as closeCodexStartupClientBestEffort, c as isCodexAppServerUnsafeSubscriptionError, i as assertCodexThreadResumeSubscription, n as CODEX_APP_SERVER_UNSUBSCRIBE_TIMEOUT_MS, r as CodexAppServerUnsafeSubscriptionError, u as unsubscribeCodexThreadBestEffort } from "./attempt-client-cleanup-Ia52yRWc.js";
-import { i as assertCodexThreadStartResponse, n as assertCodexThreadForkResponse, r as assertCodexThreadResumeResponse } from "./protocol-validators-Dm4eXZmt.js";
-import { a as serializeCodexAppInventoryError, i as defaultCodexAppInventoryCache, t as buildCodexAppServerConnectionFingerprint } from "./plugin-app-cache-key-DSXX-rXO.js";
+import { D as CODEX_PLUGINS_MARKETPLACE_NAME, E as resolveCodexPluginsPolicy, O as CODEX_PLUGINS_WORKSPACE_MARKETPLACE_NAME, a as hashCodexAppServerBindingFingerprint, c as reclaimCurrentCodexSessionGeneration, d as sessionBindingIdentity, i as createCodexSessionGenerationSupersededError, m as codexSandboxPolicyForTurn, n as assertCodexBindingMayBeReplaced, o as isCodexAppServerNativeAuthProfile, s as normalizeCodexAppServerBindingModelProvider } from "./session-binding-DPxIvMgE.js";
+import { M as isCodexAppServerConnectionClosedError, R as resolveCodexAppServerClientInstanceId, V as consumeCodexAppServerLiveThread, ct as isJsonObject, d as retainSharedCodexAppServerClientByInstanceId, k as getCodexAppServerClientInstanceId, s as isCodexAppServerStartSelectionChangedError, st as flattenCodexDynamicToolFunctions, z as CodexAppServerRpcError } from "./shared-client-kIBbGjk4.js";
+import { a as closeCodexStartupClientBestEffort, c as isCodexAppServerUnsafeSubscriptionError, d as unsubscribeCodexThreadBestEffort, n as CODEX_APP_SERVER_UNSUBSCRIBE_TIMEOUT_MS, r as CodexAppServerUnsafeSubscriptionError } from "./attempt-client-cleanup-DMLXUfa8.js";
+import { a as assertCodexThreadStartResponse, r as assertCodexThreadForkResponse } from "./protocol-validators-B4F7L8Rf.js";
+import { a as serializeCodexAppInventoryError, i as defaultCodexAppInventoryCache, t as buildCodexAppServerConnectionFingerprint } from "./plugin-app-cache-key-C3H2CVp6.js";
 import { t as isIncognitoSessionKey } from "./incognito-session-ET_ufDH-.js";
-import { a as projectBoundedCodexThreadHistory } from "./transcript-mirror-uKA-A4tB.js";
-import { SKILL_WORKSHOP_TOOL_NAME, buildSkillWorkshopPromptSection, embeddedAgentLog, formatErrorMessage, isActiveHarnessContextEngine, isHostScopedAgentToolActive } from "openclaw/plugin-sdk/agent-harness-runtime";
+import { t as resumeCodexAppServerThread } from "./thread-resume-CPrJNQVM.js";
+import { u as projectBoundedCodexThreadHistory } from "./transcript-mirror-B9gGgnJS.js";
+import { r as sanitizeInlineImageDataUrl, t as invalidInlineImageText } from "./image-payload-sanitizer-CnfoUPCE.js";
+import { asOptionalRecord, isRecord, normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
+import fs from "node:fs/promises";
+import path from "node:path";
+import { SKILL_WORKSHOP_TOOL_NAME, TRANSCRIPT_CREDENTIAL_SAFETY_PROMPT, buildSkillWorkshopPromptSection, embeddedAgentLog, formatErrorMessage, isActiveHarnessContextEngine, isHostScopedAgentToolActive } from "openclaw/plugin-sdk/agent-harness-runtime";
 import * as crypto$1 from "node:crypto";
 import crypto from "node:crypto";
-import { isRecord } from "openclaw/plugin-sdk/string-coerce-runtime";
+import os from "node:os";
+import { coerceErrorMessage } from "openclaw/plugin-sdk/error-runtime";
 import { sliceUtf16Safe, truncateUtf16Safe } from "openclaw/plugin-sdk/text-utility-runtime";
 import { redactSensitiveFieldValue, redactToolPayloadText } from "openclaw/plugin-sdk/logging-core";
+import { resolveRequiredHomeDir, resolveStateDir } from "openclaw/plugin-sdk/state-paths";
+import { listRegisteredPluginAgentPromptGuidance } from "openclaw/plugin-sdk/plugin-runtime";
 import { buildCodexUserMcpServersThreadConfigPatchForRuntime } from "openclaw/plugin-sdk/codex-mcp-projection";
 import { isDiagnosticFlagEnabled } from "openclaw/plugin-sdk/diagnostic-runtime";
-import { listRegisteredPluginAgentPromptGuidance } from "openclaw/plugin-sdk/plugin-runtime";
 import { GPT5_HEARTBEAT_PROMPT_OVERLAY } from "openclaw/plugin-sdk/provider-model-shared";
-import { INLINE_IMAGE_DATA_URL_PREFIX, sanitizeInlineImageDataUrl } from "openclaw/plugin-sdk/inline-image-data-url-runtime";
-//#region extensions/codex/src/app-server/event-projector-values.ts
-function readString(record, key) {
-	const value = record[key];
-	return typeof value === "string" ? value : void 0;
-}
-function normalizeNonEmptyString(value) {
-	if (typeof value !== "string") return;
-	return value.trim() || void 0;
-}
-function readNonEmptyString(record, key) {
-	return normalizeNonEmptyString(record[key]);
-}
-function readNonEmptyStringArray(record, key) {
-	const value = record[key];
-	if (!Array.isArray(value)) return [];
-	const entries = [];
-	for (const entry of value) {
-		const normalized = normalizeNonEmptyString(entry);
-		if (normalized) entries.push(normalized);
-	}
-	return entries;
-}
-function readNullableString(record, key) {
-	const value = record[key];
-	if (value === null) return null;
-	return typeof value === "string" ? value : void 0;
-}
-function readNumber(record, key) {
-	const value = record[key];
-	return typeof value === "number" && Number.isFinite(value) ? value : void 0;
-}
-function readNonNegativeInteger(record, key) {
-	const value = readNumber(record, key);
-	return value !== void 0 && Number.isInteger(value) && value >= 0 ? value : void 0;
-}
-function readCodexErrorNotificationMessage(record) {
-	const error = record.error;
-	return isJsonObject(error) ? readString(error, "message") : void 0;
-}
-function readHookOutputEntries(value) {
-	if (!Array.isArray(value)) return [];
-	return value.flatMap((entry) => {
-		if (!isJsonObject(entry)) return [];
-		const text = readString(entry, "text");
-		if (!text) return [];
-		const kind = readString(entry, "kind");
-		return [{
-			...kind ? { kind } : {},
-			text
-		}];
-	});
-}
-function splitPlanText(text) {
-	return text.split(/\r?\n/).map((line) => line.trim().replace(/^[-*]\s+/, "")).filter((line) => line.length > 0);
-}
-function extractRawAssistantText(item) {
-	return (Array.isArray(item.content) ? item.content : []).flatMap((entry) => {
-		if (!isJsonObject(entry)) return [];
-		const type = readString(entry, "type");
-		if (type !== "output_text" && type !== "text") return [];
-		const value = readString(entry, "text");
-		return value ? [value] : [];
-	}).join("").trim() || void 0;
-}
-function readItemString(item, key) {
-	const value = item[key];
-	return typeof value === "string" ? value : void 0;
-}
-function readItem(value) {
-	if (!isJsonObject(value)) return;
-	const type = typeof value.type === "string" ? value.type : void 0;
-	const id = typeof value.id === "string" ? value.id : void 0;
-	if (!type || !id) return;
-	return value;
-}
-//#endregion
 //#region extensions/codex/src/app-server/plugin-inventory.ts
 /**
 * Reads Codex plugin marketplace state and app inventory to decide which
 * plugin-owned apps can be exposed to a native Codex thread.
 */
 const CODEX_PLUGINS_REMOTE_MARKETPLACE_NAME = `${CODEX_PLUGINS_MARKETPLACE_NAME}-remote`;
+const CODEX_PLUGINS_API_MARKETPLACE_NAME = "openai-api-curated";
 /** Reads configured Codex plugin state and maps owned apps to readiness diagnostics. */
 async function readCodexPluginInventory(params) {
 	const policy = params.policy ?? resolveCodexPluginsPolicy(params.pluginConfig);
@@ -110,21 +41,11 @@ async function readCodexPluginInventory(params) {
 		}]
 	};
 	const appInventory = readCachedAppInventory(params);
-	const curatedListed = await listCodexPluginMetadata(params, "curated-global", {});
-	const shouldListWorkspacePlugins = policy.pluginPolicies.some((pluginPolicy) => pluginPolicy.enabled && pluginPolicy.marketplaceName === "workspace-directory");
-	let workspaceListResult;
-	if (shouldListWorkspacePlugins) try {
-		workspaceListResult = {
-			kind: "listed",
-			response: await listCodexPluginMetadata(params, "workspace-directory", {
-				cwds: [],
-				marketplaceKinds: [CODEX_PLUGINS_WORKSPACE_MARKETPLACE_NAME]
-			})
-		};
-	} catch (error) {
-		if (!(error instanceof CodexAppServerRpcError)) throw error;
-		workspaceListResult = { kind: "rejected" };
-	}
+	const installedPlugins = await readInstalledCodexPluginMetadata({
+		...params,
+		policy
+	});
+	const pluginCatalogs = /* @__PURE__ */ new Map();
 	const diagnostics = [];
 	const records = [];
 	if (appInventory?.state === "missing") diagnostics.push({
@@ -136,10 +57,21 @@ async function readCodexPluginInventory(params) {
 		message: "Cached Codex app inventory is stale; using stale app readiness and refreshing."
 	});
 	for (const pluginPolicy of policy.pluginPolicies) {
-		if (!pluginPolicy.enabled) continue;
-		const listed = pluginPolicy.marketplaceName === "workspace-directory" ? workspaceListResult?.kind === "listed" ? workspaceListResult.response : void 0 : curatedListed;
-		const hasMarketplace = pluginPolicy.marketplaceName === "workspace-directory" ? listed?.marketplaces.some((entry) => entry.name === CODEX_PLUGINS_WORKSPACE_MARKETPLACE_NAME) === true : listed?.marketplaces.some(isOpenAiCuratedMarketplace) === true;
-		if (!listed || !hasMarketplace) {
+		if (!pluginPolicy.enabled && !policy.allowAllPlugins) continue;
+		let listed = installedPlugins;
+		let resolvedPlugin = findConfiguredMarketplacePlugin(listed, pluginPolicy);
+		if (!resolvedPlugin && pluginPolicy.enabled && pluginPolicy.marketplaceName !== "workspace-directory") {
+			const requestParams = buildPluginCatalogRequestParams(params, pluginPolicy.marketplaceName);
+			const catalogKey = JSON.stringify([requestParams, pluginMetadataCatalogScope(pluginPolicy.marketplaceName)]);
+			let catalog = pluginCatalogs.get(catalogKey);
+			if (!catalog) {
+				catalog = listCodexPluginMetadata(params, pluginPolicy.marketplaceName);
+				pluginCatalogs.set(catalogKey, catalog);
+			}
+			listed = await catalog;
+			resolvedPlugin = findConfiguredMarketplacePlugin(listed, pluginPolicy);
+		}
+		if (!listed.marketplaces.some((marketplace) => marketplaceMatchesConfiguredName(marketplace, pluginPolicy.marketplaceName))) {
 			diagnostics.push({
 				code: "marketplace_missing",
 				plugin: pluginPolicy,
@@ -147,7 +79,6 @@ async function readCodexPluginInventory(params) {
 			});
 			continue;
 		}
-		const resolvedPlugin = pluginPolicy.marketplaceName === "workspace-directory" ? findWorkspaceMarketplacePlugin(listed, pluginPolicy.pluginName) : findOpenAiCuratedMarketplacePlugin(listed, pluginPolicy.pluginName);
 		if (!resolvedPlugin) {
 			diagnostics.push({
 				code: "plugin_missing",
@@ -157,6 +88,15 @@ async function readCodexPluginInventory(params) {
 			continue;
 		}
 		const { summary } = resolvedPlugin;
+		const unavailableByMarketplacePolicy = summary.availability === "DISABLED_BY_ADMIN" || summary.installPolicy === "NOT_AVAILABLE";
+		if (unavailableByMarketplacePolicy) {
+			diagnostics.push({
+				code: "plugin_disabled",
+				plugin: pluginPolicy,
+				message: `${pluginPolicy.pluginName} is unavailable in ${pluginPolicy.marketplaceName}.`
+			});
+			if (!summary.installed) continue;
+		}
 		const detail = await readPluginDetail(params, marketplaceRef(resolvedPlugin.marketplace, pluginPolicy.marketplaceName), pluginPolicy, summary, diagnostics);
 		const ownedAppIds = detail?.apps.map((app) => app.id).filter(Boolean).toSorted() ?? [];
 		const appOwnership = resolveAppOwnership({
@@ -183,7 +123,7 @@ async function readCodexPluginInventory(params) {
 			policy: pluginPolicy,
 			summary,
 			...detail ? { detail } : {},
-			activationRequired: !summary.installed || !summary.enabled,
+			activationRequired: pluginPolicy.enabled && (unavailableByMarketplacePolicy || !summary.installed || !summary.enabled),
 			authRequired: apps.some((app) => app.needsAuth || !app.accessible),
 			appOwnership,
 			ownedAppIds,
@@ -197,11 +137,14 @@ async function readCodexPluginInventory(params) {
 		...appInventory ? { appInventory } : {}
 	};
 }
-/** Finds one plugin summary in the OpenAI curated marketplace response. */
-function findOpenAiCuratedPluginSummary(listed, pluginName) {
-	const resolved = findOpenAiCuratedMarketplacePlugin(listed, pluginName);
+/** Finds a configured plugin only in its authorized marketplace identity. */
+function findCodexMarketplacePluginSummary(listed, marketplaceName, pluginName) {
+	const resolved = findConfiguredMarketplacePlugin(listed, {
+		marketplaceName,
+		pluginName
+	});
 	return resolved ? {
-		marketplace: marketplaceRef(resolved.marketplace, CODEX_PLUGINS_MARKETPLACE_NAME),
+		marketplace: marketplaceRef(resolved.marketplace, marketplaceName),
 		summary: resolved.summary
 	} : void 0;
 }
@@ -218,25 +161,52 @@ function resolveRecoverableCodexPluginConfigKeys(params) {
 	return params.policy.pluginPolicies.filter((pluginPolicy) => pluginPolicy.enabled && !isSettledMissingPluginPolicy({
 		pluginPolicy,
 		metadataCache: params.metadataCache,
-		appCacheKey: params.appCacheKey
+		appCacheKey: params.appCacheKey,
+		configCwd: params.configCwd
 	})).map((pluginPolicy) => pluginPolicy.configKey).toSorted();
 }
-async function listCodexPluginMetadata(params, queryKind, requestParams) {
-	if (!params.metadataCache || !params.appCacheKey || queryKind === "workspace-directory") return await params.request("plugin/list", requestParams);
+async function listCodexPluginMetadata(params, marketplaceName) {
+	const requestParams = buildPluginCatalogRequestParams(params, marketplaceName);
+	if (!params.metadataCache || !params.appCacheKey) return await params.request("plugin/list", requestParams);
 	return (await params.metadataCache.load({
 		appCacheKey: params.appCacheKey,
-		queryKind,
+		queryKind: "curated-global",
 		requestParams,
+		catalogScope: pluginMetadataCatalogScope(marketplaceName),
 		request: async (method, listedParams) => await params.request(method, listedParams),
-		cacheable: (response) => (response.marketplaces ?? []).some((marketplace) => isOpenAiCuratedMarketplace(marketplace))
+		cacheable: (response) => response.marketplaces.some((marketplace) => marketplaceMatchesConfiguredName(marketplace, marketplaceName))
+	})).response;
+}
+async function readInstalledCodexPluginMetadata(params) {
+	const requestParams = params.configCwd ? { cwds: [params.configCwd] } : {};
+	if (!params.metadataCache || !params.appCacheKey) return await params.request("plugin/installed", requestParams);
+	return (await params.metadataCache.load({
+		appCacheKey: params.appCacheKey,
+		queryKind: "installed",
+		requestParams,
+		request: async (method, installedParams) => await params.request(method, installedParams),
+		cacheable: (response) => params.policy.pluginPolicies.every((pluginPolicy) => {
+			if (!pluginPolicy.enabled && !params.policy.allowAllPlugins) return true;
+			return Boolean(findConfiguredMarketplacePlugin(response, pluginPolicy));
+		})
 	})).response;
 }
 function isSettledMissingPluginPolicy(params) {
-	const queryKind = params.pluginPolicy.marketplaceName === "workspace-directory" ? "workspace-directory" : "curated-global";
-	const listed = params.metadataCache.read(params.appCacheKey, queryKind)?.response;
+	const queryKind = params.pluginPolicy.marketplaceName === "workspace-directory" ? "installed" : "curated-global";
+	const requestParams = queryKind === "installed" ? params.configCwd ? { cwds: [params.configCwd] } : {} : buildPluginCatalogRequestParams(params, params.pluginPolicy.marketplaceName);
+	const listed = params.metadataCache.read(params.appCacheKey, queryKind, requestParams, queryKind === "curated-global" ? pluginMetadataCatalogScope(params.pluginPolicy.marketplaceName) : void 0)?.response;
 	if (!listed) return false;
-	if (queryKind === "workspace-directory") return !findWorkspaceMarketplacePlugin(listed, params.pluginPolicy.pluginName);
-	return !findOpenAiCuratedMarketplacePlugin(listed, params.pluginPolicy.pluginName);
+	return !findConfiguredMarketplacePlugin(listed, params.pluginPolicy);
+}
+function pluginMetadataCatalogScope(marketplaceName) {
+	return isOpenAiCuratedMarketplaceName(marketplaceName) ? void 0 : marketplaceName;
+}
+function buildPluginCatalogRequestParams(params, marketplaceName) {
+	const marketplaceKinds = marketplaceName === "created-by-me-remote" ? ["created-by-me-remote"] : marketplaceName.startsWith("workspace-shared-with-me") ? ["shared-with-me"] : void 0;
+	return {
+		...params.configCwd ? { cwds: [params.configCwd] } : {},
+		...marketplaceKinds ? { marketplaceKinds: [...marketplaceKinds] } : {}
+	};
 }
 function readCachedAppInventory(params) {
 	if (!params.appCache || !params.appCacheKey) return;
@@ -250,7 +220,7 @@ function readCachedAppInventory(params) {
 }
 async function readPluginDetail(params, marketplace, pluginPolicy, summary, diagnostics) {
 	if (params.readPluginDetails === false) return;
-	if (marketplace.name === "workspace-directory" && marketplace.remoteMarketplaceName && !summary.remotePluginId) {
+	if (marketplace.remoteMarketplaceName && !summary.remotePluginId) {
 		diagnostics.push({
 			code: "plugin_detail_unavailable",
 			plugin: pluginPolicy,
@@ -299,23 +269,30 @@ function resolveOwnedApps(params) {
 			name: app.name,
 			accessible: info.isAccessible,
 			enabled: info.isEnabled,
-			needsAuth: app.needsAuth || !info.isAccessible
+			needsAuth: !info.isAccessible
 		};
 	}).toSorted((left, right) => left.id.localeCompare(right.id));
 }
 function findPluginSummary(marketplace, pluginName) {
-	return marketplace.plugins.find((plugin) => plugin.name === pluginName || plugin.id === pluginName || plugin.id === `${pluginName}@${marketplace.name}` || pluginNameFromPluginId(plugin.id, marketplace.name) === pluginName);
+	const exact = marketplace.plugins.find((plugin) => plugin.id === pluginName || plugin.id === `${pluginName}@${marketplace.name}`);
+	if (exact) return exact;
+	const matches = marketplace.plugins.filter((plugin) => plugin.name === pluginName || pluginNameFromPluginId(plugin.id, marketplace.name) === pluginName);
+	return matches.length === 1 ? matches[0] : void 0;
 }
-function findOpenAiCuratedMarketplacePlugin(listed, pluginName) {
+function findConfiguredMarketplacePlugin(listed, plugin) {
+	if (plugin.marketplaceName === "workspace-directory") return findWorkspaceMarketplacePlugin(listed, plugin.pluginName);
 	for (const marketplace of listed.marketplaces) {
-		if (!isOpenAiCuratedMarketplace(marketplace)) continue;
-		const summary = findPluginSummary(marketplace, pluginName);
+		if (!marketplaceMatchesConfiguredName(marketplace, plugin.marketplaceName)) continue;
+		const summary = findPluginSummary(marketplace, plugin.pluginName);
 		if (summary) return {
 			marketplace,
 			summary
 		};
 	}
 }
+function marketplaceMatchesConfiguredName(marketplace, configuredMarketplaceName) {
+	return isOpenAiCuratedMarketplaceName(configuredMarketplaceName) ? isOpenAiCuratedMarketplace(marketplace) : marketplace.name === configuredMarketplaceName;
+}
 function findWorkspaceMarketplacePlugin(listed, pluginName) {
 	const marketplace = listed.marketplaces.find((entry) => entry.name === CODEX_PLUGINS_WORKSPACE_MARKETPLACE_NAME);
 	const summary = marketplace?.plugins.find((plugin) => plugin.id === pluginName);
@@ -337,21 +314,35 @@ function marketplaceRef(marketplace, name) {
 		...!marketplace.path ? { remoteMarketplaceName: marketplace.name } : {}
 	};
 }
-/** True for either supported OpenAI curated marketplace wire name. */
+/** True for any supported OpenAI curated marketplace wire name, matching Codex's own curated predicate. */
 function isOpenAiCuratedMarketplace(marketplace) {
-	return marketplace.name === "openai-curated" || marketplace.name === CODEX_PLUGINS_REMOTE_MARKETPLACE_NAME;
+	return isOpenAiCuratedMarketplaceName(marketplace.name);
+}
+/** True for all Codex wire aliases of the same OpenAI-curated catalog. */
+function isOpenAiCuratedMarketplaceName(marketplaceName) {
+	return marketplaceName === "openai-curated" || marketplaceName === CODEX_PLUGINS_REMOTE_MARKETPLACE_NAME || marketplaceName === CODEX_PLUGINS_API_MARKETPLACE_NAME;
 }
 //#endregion
 //#region extensions/codex/src/app-server/plugin-activation.ts
-/** Activates a curated plugin or rejects a workspace plugin that is not already active. */
+/**
+* Activates legacy curated Codex plugins while requiring owner-managed
+* installation for every other marketplace.
+*/
+/** Activates legacy curated plugins without granting install authority to other marketplaces. */
 async function ensureCodexPluginActivation(params) {
 	if (params.identity.marketplaceName === "workspace-directory") return activationFailure(params.identity, "disabled", { message: "workspace-directory plugins must be installed and enabled outside OpenClaw before use." });
+	if (!isOpenAiCuratedMarketplaceName(params.identity.marketplaceName)) {
+		const target = params.identity.pluginName.endsWith(`@${params.identity.marketplaceName}`) ? params.identity.pluginName : `${params.identity.pluginName}@${params.identity.marketplaceName}`;
+		return activationFailure(params.identity, "disabled", { message: `${params.identity.marketplaceName} plugins must be installed and enabled by an owner before use. Run /codex plugins install ${target}.` });
+	}
 	const listed = await listCuratedCodexPluginMetadata(params);
-	const resolved = findOpenAiCuratedPluginSummary(listed, params.identity.pluginName);
+	const resolved = findCodexMarketplacePluginSummary(listed, params.identity.marketplaceName, params.identity.pluginName);
 	if (!resolved) {
-		if (!listed.marketplaces.some(isOpenAiCuratedMarketplace)) return activationFailure(params.identity, "marketplace_missing", { message: `Codex marketplace ${CODEX_PLUGINS_MARKETPLACE_NAME} was not found.` });
+		if (!listed.marketplaces.some((marketplace) => isOpenAiCuratedMarketplace(marketplace))) return activationFailure(params.identity, "marketplace_missing", { message: `Codex marketplace ${CODEX_PLUGINS_MARKETPLACE_NAME} was not found.` });
 		return activationFailure(params.identity, "plugin_missing", { message: `${params.identity.pluginName} was not found in ${CODEX_PLUGINS_MARKETPLACE_NAME}.` });
 	}
+	if (resolved.marketplace.remoteMarketplaceName && !resolved.summary.remotePluginId) return activationFailure(params.identity, "plugin_missing", { message: `${params.identity.pluginName} detail unavailable: Codex did not return a remote plugin id.` });
+	if (resolved.summary.availability === "DISABLED_BY_ADMIN" || resolved.summary.installPolicy === "NOT_AVAILABLE") return activationFailure(params.identity, "disabled", { message: `${params.identity.pluginName} was disabled or made unavailable by its marketplace administrator.` });
 	if (resolved.summary.installed && resolved.summary.enabled && !params.installEvenIfActive) return {
 		identity: params.identity,
 		ok: true,
@@ -360,7 +351,21 @@ async function ensureCodexPluginActivation(params) {
 		marketplace: resolved.marketplace,
 		diagnostics: []
 	};
-	const installResponse = await params.request("plugin/install", pluginReadParams(resolved.marketplace, resolved.marketplace.remoteMarketplaceName && resolved.summary.remotePluginId ? resolved.summary.remotePluginId : params.identity.pluginName));
+	const remotePluginId = resolved.marketplace.remoteMarketplaceName ? resolved.summary.remotePluginId : void 0;
+	let installResponse;
+	try {
+		installResponse = await params.request("plugin/install", pluginReadParams(resolved.marketplace, remotePluginId ?? params.identity.pluginName));
+	} catch (error) {
+		if (!(error instanceof CodexAppServerRpcError) || error.code !== -32600 || !remotePluginId || error.message !== `remote plugin ${remotePluginId} is disabled by admin` && error.message !== `remote plugin ${remotePluginId} is not available for install`) throw error;
+		return {
+			identity: params.identity,
+			ok: false,
+			reason: "install_failed",
+			installAttempted: true,
+			marketplace: resolved.marketplace,
+			diagnostics: [{ message: `Codex plugin install failed: ${coerceErrorMessage(error)}` }]
+		};
+	}
 	if (params.metadataCache && params.appCacheKey) params.metadataCache.invalidate(params.appCacheKey);
 	const refreshDiagnostics = [];
 	let refreshFailed = false;
@@ -369,13 +374,15 @@ async function ensureCodexPluginActivation(params) {
 			request: params.request,
 			appCache: params.appCache,
 			appCacheKey: params.appCacheKey,
+			configCwd: params.configCwd,
 			metadataCache: params.metadataCache,
+			deferAppInventoryRefresh: params.deferAppInventoryRefresh,
 			targetAppIds: params.targetAppIds
 		});
 		refreshDiagnostics.push(...refreshResult.diagnostics);
 	} catch (error) {
 		refreshFailed = true;
-		refreshDiagnostics.push({ message: `Codex plugin runtime refresh failed after install: ${error instanceof Error ? error.message : String(error)}` });
+		refreshDiagnostics.push({ message: `Codex plugin runtime refresh failed after install: ${coerceErrorMessage(error)}` });
 	}
 	const authRequired = installResponse.appsNeedingAuth.length > 0;
 	return {
@@ -391,19 +398,20 @@ async function ensureCodexPluginActivation(params) {
 /** Forces Codex plugin, skill, hook, MCP, and app inventory refreshes after activation. */
 async function refreshCodexPluginRuntimeState(params) {
 	const diagnostics = [];
-	await listCuratedCodexPluginMetadata(params);
+	await listCuratedCodexPluginMetadata(params, { forceRefetch: true });
 	await params.request("skills/list", {
-		cwds: [],
+		cwds: params.configCwd ? [params.configCwd] : [],
 		forceReload: true
 	});
 	try {
-		await params.request("hooks/list", { cwds: [] });
+		await params.request("hooks/list", { cwds: params.configCwd ? [params.configCwd] : [] });
 	} catch (error) {
-		diagnostics.push({ message: `Codex hooks refresh skipped: ${error instanceof Error ? error.message : String(error)}` });
+		diagnostics.push({ message: `Codex hooks refresh skipped: ${coerceErrorMessage(error)}` });
 	}
 	await params.request("config/mcpServer/reload", void 0);
 	if (params.appCache && params.appCacheKey) {
-		params.appCache.invalidate(params.appCacheKey, "Codex plugin activation changed app inventory");
+		params.appCache.invalidate(params.appCacheKey, "Codex plugin activation changed app inventory", void 0, params.targetAppIds);
+		if (params.deferAppInventoryRefresh) return { diagnostics };
 		const request = async (method, requestParams) => await params.request(method, requestParams);
 		try {
 			await params.appCache.refreshNow({
@@ -413,20 +421,23 @@ async function refreshCodexPluginRuntimeState(params) {
 				targetAppIds: params.targetAppIds
 			});
 		} catch (error) {
-			diagnostics.push({ message: `Codex app inventory refresh skipped: ${error instanceof Error ? error.message : String(error)}` });
+			diagnostics.push({ message: `Codex app inventory refresh skipped: ${coerceErrorMessage(error)}` });
 		}
 	}
 	return { diagnostics };
 }
-async function listCuratedCodexPluginMetadata(params) {
-	const requestParams = {};
+async function listCuratedCodexPluginMetadata(params, options = {}) {
+	const requestParams = {
+		...params.configCwd ? { cwds: [params.configCwd] } : {},
+		...options.forceRefetch ? { forceRefetch: true } : {}
+	};
 	if (!params.metadataCache || !params.appCacheKey) return await params.request("plugin/list", requestParams);
 	return (await params.metadataCache.load({
 		appCacheKey: params.appCacheKey,
 		queryKind: "curated-global",
 		requestParams,
 		request: async (method, listedParams) => await params.request(method, listedParams),
-		cacheable: (response) => (response.marketplaces ?? []).some((marketplace) => isOpenAiCuratedMarketplace(marketplace))
+		cacheable: (response) => response.marketplaces.some((marketplace) => isOpenAiCuratedMarketplace(marketplace))
 	})).response;
 }
 function activationFailure(identity, reason, diagnostic, extraDiagnostics = []) {
@@ -439,6 +450,129 @@ function activationFailure(identity, reason, diagnostic, extraDiagnostics = [])
 	};
 }
 //#endregion
+//#region extensions/codex/src/app-server/plugin-thread-app-admission.ts
+async function refreshCodexPluginAppInventory(params, appCache, options = {}) {
+	if (!params.appCacheKey) return;
+	const request = async (method, requestParams) => await params.request(method, requestParams);
+	try {
+		return await appCache.refreshNow({
+			key: params.appCacheKey,
+			request,
+			nowMs: params.nowMs,
+			forceRefetch: options.forceRefetch,
+			targetAppIds: options.targetAppIds
+		});
+	} catch (error) {
+		embeddedAgentLog.warn("codex plugin thread config app inventory refresh failed", {
+			reason: options.reason,
+			forceRefetch: options.forceRefetch === true,
+			error: serializeCodexAppInventoryError(error)
+		});
+		return;
+	}
+}
+function collectCodexPluginOwnedAppIds(inventory) {
+	return Array.from(new Set(inventory.records.flatMap((record) => record.ownedAppIds).filter(Boolean))).toSorted();
+}
+function collectCodexReservedPluginAppIds(params) {
+	const reserved = new Set(params.inventory.records.flatMap((record) => record.appOwnership === "proven" ? record.ownedAppIds : []));
+	const recordsByConfigKey = new Map(params.inventory.records.map((record) => [record.policy.configKey, record]));
+	const configuredOwnerNames = new Set(params.policy.pluginPolicies.flatMap((policy) => {
+		const record = recordsByConfigKey.get(policy.configKey);
+		return [
+			policy.configKey,
+			policy.pluginName,
+			record?.summary.name,
+			record?.summary.id
+		].filter((name) => Boolean(name)).map(normalizeCodexPluginOwnerName);
+	}));
+	for (const app of params.accountApps) if (app.pluginDisplayNames.some((name) => configuredOwnerNames.has(normalizeCodexPluginOwnerName(name)))) reserved.add(app.id);
+	return reserved;
+}
+function normalizeCodexPluginOwnerName(name) {
+	return name.trim().toLowerCase().replace(/[^a-z0-9]+/g, "");
+}
+async function readCodexThreadAdmissibleAccountApps(params, appCache) {
+	const request = async (method, requestParams) => await params.request(method, requestParams);
+	const cachedInventory = appCache.read({
+		key: params.appCacheKey,
+		request,
+		nowMs: params.nowMs,
+		suppressRefresh: true
+	});
+	const snapshot = cachedInventory.state === "fresh" && !cachedInventory.snapshot?.targetAppIds?.length ? cachedInventory.snapshot : await refreshCodexPluginAppInventory(params, appCache, {
+		forceRefetch: false,
+		reason: "account_apps_all",
+		targetAppIds: []
+	});
+	if (!snapshot) return {
+		apps: [],
+		diagnostic: {
+			code: "account_app_inventory_unavailable",
+			message: "Codex account app inventory was unavailable; account apps were not exposed."
+		}
+	};
+	const installedAppsById = new Map(snapshot.installedApps.map((app) => [app.id, app]));
+	return { apps: snapshot.apps.filter((app) => resolveCodexInstalledAppThreadAdmission(toCodexPluginOwnedAccountApp(app), installedAppsById.get(app.id)) !== "blocked").toSorted((left, right) => left.id.localeCompare(right.id)) };
+}
+function toCodexPluginOwnedAccountApp(app) {
+	return {
+		id: app.id,
+		name: app.name,
+		accessible: app.isAccessible,
+		enabled: app.isEnabled,
+		needsAuth: !app.isAccessible
+	};
+}
+function resolveCodexThreadConfigAppsForRecord(params) {
+	return params.inventory.appInventory?.state === "missing" ? [] : params.record.apps;
+}
+function resolveCodexPluginAppThreadAdmission(app, inventory) {
+	const snapshot = inventory.appInventory?.snapshot;
+	if (!snapshot) return "blocked";
+	return resolveCodexInstalledAppThreadAdmission(app, snapshot.installedApps.find((candidate) => candidate.id === app.id));
+}
+function resolveCodexInstalledAppThreadAdmission(app, installed) {
+	if (!app.accessible || app.needsAuth || !installed) return "blocked";
+	if (installed.enabled && installed.callable) return "ready";
+	return !installed.enabled && !installed.callable ? "provisional" : "blocked";
+}
+async function readCodexConfigForAppAdmission(params) {
+	try {
+		const response = await params.request("config/read", {
+			includeLayers: true,
+			...params.configCwd ? { cwd: params.configCwd } : {}
+		});
+		if (!isJsonObject(response) || !isJsonObject(response.config) || !Array.isArray(response.layers)) throw new Error("Codex config/read omitted effective config or config layers");
+		return {
+			config: response.config,
+			layers: response.layers.flatMap((layer) => {
+				if (!isJsonObject(layer)) throw new Error("Codex config/read returned an invalid config layer");
+				if (layer.disabledReason !== void 0 && layer.disabledReason !== null) {
+					if (typeof layer.disabledReason !== "string") throw new Error("Codex config/read returned an invalid disabled layer");
+					return [];
+				}
+				if (!isJsonObject(layer.config)) throw new Error("Codex config/read returned an invalid layer config");
+				return [layer.config];
+			})
+		};
+	} catch (error) {
+		embeddedAgentLog.warn("codex plugin app admission config read failed", { error: serializeCodexAppInventoryError(error) });
+		return;
+	}
+}
+function resolveCodexExplicitAppEnablement(layersHighestPrecedenceFirst, appId) {
+	for (const layer of layersHighestPrecedenceFirst) {
+		const apps = layer.apps;
+		const app = isJsonObject(apps) ? apps[appId] : void 0;
+		if (isJsonObject(app) && Object.hasOwn(app, "enabled")) return app.enabled === true;
+	}
+}
+function shouldForceRefreshCodexNotReadyPluginApps(params, policy, inventory) {
+	if (!params.appCacheKey || !policy.pluginPolicies.some((plugin) => plugin.enabled) || inventory.appInventory?.state === "missing") return false;
+	return inventory.records.some((record) => record.appOwnership === "proven" && record.ownedAppIds.length > 0 && (record.apps.length === 0 || record.apps.some((app) => !app.accessible)));
+}
+//#endregion
 //#region extensions/codex/src/app-server/plugin-thread-config.ts
 /**
 * Builds Codex thread config patches that expose only policy-approved apps
@@ -492,16 +626,17 @@ async function buildCodexPluginThreadConfig(params) {
 		request: params.request,
 		appCache,
 		appCacheKey: params.appCacheKey,
+		configCwd: params.configCwd,
 		metadataCache: params.metadataCache,
 		nowMs: params.nowMs,
 		suppressAppInventoryRefresh: true
 	}) : emptyCodexPluginInventory(policy);
 	const appInventoryRefreshDeferredForActivation = inventory.records.some((record) => record.activationRequired) && shouldRefreshMissingAppInventory(params, policy, inventory);
 	if (shouldWaitForInitialAppInventory(params, policy, inventory)) {
-		await refreshAppInventoryNow(params, appCache, {
+		await refreshCodexPluginAppInventory(params, appCache, {
 			forceRefetch: false,
 			reason: "initial_missing",
-			targetAppIds: collectInventoryOwnedAppIds(inventory)
+			targetAppIds: collectCodexPluginOwnedAppIds(inventory)
 		});
 		inventory = await readCodexPluginInventory({
 			pluginConfig: params.pluginConfig,
@@ -509,6 +644,7 @@ async function buildCodexPluginThreadConfig(params) {
 			request: params.request,
 			appCache,
 			appCacheKey: params.appCacheKey,
+			configCwd: params.configCwd,
 			metadataCache: params.metadataCache,
 			nowMs: params.nowMs
 		});
@@ -526,7 +662,9 @@ async function buildCodexPluginThreadConfig(params) {
 			request: params.request,
 			appCache,
 			appCacheKey: params.appCacheKey,
+			configCwd: params.configCwd,
 			metadataCache: params.metadataCache,
+			deferAppInventoryRefresh: true,
 			targetAppIds: record.ownedAppIds
 		});
 		activationResults.push(activation);
@@ -539,10 +677,10 @@ async function buildCodexPluginThreadConfig(params) {
 	const postInstallRefreshRequired = activationResults.some((activation) => activation.ok && activation.installAttempted);
 	const deferredMissingRefreshRequired = appInventoryRefreshDeferredForActivation && !postInstallRefreshRequired && shouldRefreshMissingAppInventory(params, policy, inventory);
 	if (postInstallRefreshRequired || deferredMissingRefreshRequired) {
-		await refreshAppInventoryNow(params, appCache, {
+		await refreshCodexPluginAppInventory(params, appCache, {
 			forceRefetch: true,
 			reason: postInstallRefreshRequired ? "post_install" : "deferred_missing",
-			targetAppIds: collectInventoryOwnedAppIds(inventory)
+			targetAppIds: collectCodexPluginOwnedAppIds(inventory)
 		});
 		inventory = await readCodexPluginInventory({
 			pluginConfig: params.pluginConfig,
@@ -550,6 +688,7 @@ async function buildCodexPluginThreadConfig(params) {
 			request: params.request,
 			appCache,
 			appCacheKey: params.appCacheKey,
+			configCwd: params.configCwd,
 			metadataCache: params.metadataCache,
 			nowMs: params.nowMs
 		});
@@ -558,11 +697,11 @@ async function buildCodexPluginThreadConfig(params) {
 			appCacheKey: params.appCacheKey
 		});
 	}
-	if (shouldForceRefreshForNotReadyPluginApps(params, policy, inventory)) {
-		await refreshAppInventoryNow(params, appCache, {
+	if (shouldForceRefreshCodexNotReadyPluginApps(params, policy, inventory)) {
+		await refreshCodexPluginAppInventory(params, appCache, {
 			forceRefetch: true,
 			reason: "not_ready_plugin_apps",
-			targetAppIds: collectInventoryOwnedAppIds(inventory)
+			targetAppIds: collectCodexPluginOwnedAppIds(inventory)
 		});
 		inventory = await readCodexPluginInventory({
 			pluginConfig: params.pluginConfig,
@@ -570,6 +709,7 @@ async function buildCodexPluginThreadConfig(params) {
 			request: params.request,
 			appCache,
 			appCacheKey: params.appCacheKey,
+			configCwd: params.configCwd,
 			metadataCache: params.metadataCache,
 			nowMs: params.nowMs
 		});
@@ -578,12 +718,13 @@ async function buildCodexPluginThreadConfig(params) {
 			appCacheKey: params.appCacheKey
 		});
 	}
-	const accountAppsResult = policy.allowAllPlugins ? await readAccessibleAccountApps(params, appCache) : { apps: [] };
+	const accountAppsResult = policy.allowAllPlugins ? await readCodexThreadAdmissibleAccountApps(params, appCache) : { apps: [] };
 	const diagnostics = [
 		...inventory.diagnostics,
 		...activationDiagnostics,
 		...accountAppsResult.diagnostic ? [accountAppsResult.diagnostic] : []
 	];
+	const provisionalAppIds = /* @__PURE__ */ new Set();
 	const apps = { _default: {
 		enabled: false,
 		destructive_enabled: false,
@@ -591,17 +732,35 @@ async function buildCodexPluginThreadConfig(params) {
 	} };
 	const policyApps = {};
 	const pluginAppIds = {};
-	const pluginOwnedAppIds = new Set(inventory.records.flatMap((record) => record.appOwnership === "proven" ? record.ownedAppIds : []));
+	let configForAppAdmission;
+	const pluginOwnedAppIds = collectCodexReservedPluginAppIds({
+		policy,
+		inventory,
+		accountApps: accountAppsResult.apps
+	});
+	const unresolvedDisabledPluginOwnership = policy.allowAllPlugins ? policy.pluginPolicies.find((pluginPolicy) => {
+		const record = inventory.records.find((candidate) => candidate.policy.configKey === pluginPolicy.configKey);
+		const disabledByMarketplacePolicy = record?.summary.availability === "DISABLED_BY_ADMIN" || record?.summary.installPolicy === "NOT_AVAILABLE";
+		const unresolvedPluginIdentity = !record && inventory.diagnostics.some((diagnostic) => diagnostic.plugin?.configKey === pluginPolicy.configKey && (diagnostic.code === "plugin_disabled" || diagnostic.code === "plugin_missing" || diagnostic.code === "marketplace_missing"));
+		return (!pluginPolicy.enabled || disabledByMarketplacePolicy || unresolvedPluginIdentity) && !record?.detail;
+	}) : void 0;
+	if (unresolvedDisabledPluginOwnership) diagnostics.push({
+		code: "account_app_ownership_unavailable",
+		plugin: unresolvedDisabledPluginOwnership,
+		message: `Could not verify disabled Codex plugin app ownership for ${unresolvedDisabledPluginOwnership.pluginName}; account apps were not exposed.`
+	});
 	for (const record of inventory.records) {
+		if (!record.policy.enabled) continue;
 		const activation = activationResults.find((item) => item.identity.configKey === record.policy.configKey);
 		if (activation?.ok === false || record.activationRequired && !activation?.ok) continue;
 		if (record.appOwnership !== "proven") continue;
 		pluginAppIds[record.policy.configKey] = [...record.ownedAppIds].toSorted();
-		for (const app of resolveThreadConfigAppsForRecord({
+		for (const app of resolveCodexThreadConfigAppsForRecord({
 			record,
 			inventory
 		})) {
-			if (!isPluginAppReadyForThreadStart(app)) {
+			const admissionConfig = resolveCodexPluginAppThreadAdmission(app, inventory) === "blocked" ? void 0 : await (configForAppAdmission ??= readCodexConfigForAppAdmission(params));
+			if (!admissionConfig || resolveCodexExplicitAppEnablement(admissionConfig.layers, app.id) === false) {
 				diagnostics.push({
 					code: "app_not_ready",
 					plugin: record.policy,
@@ -612,35 +771,51 @@ async function buildCodexPluginThreadConfig(params) {
 			if (record.policy.destructiveApprovalMode === "ask" && !await clearPersistedAppToolApprovalOverrides({
 				request: params.request,
 				configCwd: params.configCwd,
+				config: admissionConfig.config,
 				plugin: record.policy,
 				app,
 				diagnostics
 			})) continue;
+			provisionalAppIds.add(app.id);
 			apps[app.id] = buildEnabledAppConfig(record.policy);
 			policyApps[app.id] = {
 				configKey: record.policy.configKey,
 				marketplaceName: record.policy.marketplaceName,
 				pluginName: record.policy.pluginName,
 				allowDestructiveActions: record.policy.allowDestructiveActions,
+				allowOpenWorld: true,
 				destructiveApprovalMode: record.policy.destructiveApprovalMode,
 				mcpServerNames: [...record.detail?.mcpServers ?? []].toSorted()
 			};
 		}
 	}
-	for (const app of accountAppsResult.apps) {
+	for (const app of unresolvedDisabledPluginOwnership ? [] : accountAppsResult.apps) {
 		if (pluginOwnedAppIds.has(app.id)) continue;
-		const accountApp = toOwnedAccountApp(app);
+		configForAppAdmission ??= readCodexConfigForAppAdmission(params);
+		const admissionConfig = await configForAppAdmission;
+		if (!admissionConfig) {
+			diagnostics.push({
+				code: "account_app_config_unavailable",
+				message: "Codex account app configuration was unavailable; account apps were not exposed."
+			});
+			break;
+		}
+		if (resolveCodexExplicitAppEnablement(admissionConfig.layers, app.id) === false) continue;
+		const accountApp = toCodexPluginOwnedAccountApp(app);
 		if (policy.destructiveApprovalMode === "ask" && !await clearPersistedAppToolApprovalOverrides({
 			request: params.request,
 			configCwd: params.configCwd,
+			config: admissionConfig.config,
 			app: accountApp,
 			diagnostics
 		})) continue;
+		provisionalAppIds.add(app.id);
 		apps[app.id] = buildEnabledAppConfig(policy);
 		policyApps[app.id] = {
 			source: "account",
 			appName: app.name,
 			allowDestructiveActions: policy.allowDestructiveActions,
+			allowOpenWorld: true,
 			destructiveApprovalMode: policy.destructiveApprovalMode,
 			mcpServerNames: []
 		};
@@ -650,6 +825,7 @@ async function buildCodexPluginThreadConfig(params) {
 	return {
 		enabled: true,
 		configPatch,
+		...provisionalAppIds.size > 0 ? { provisionalAppIds: Array.from(provisionalAppIds).toSorted() } : {},
 		fingerprint: fingerprintJson({
 			version: CODEX_PLUGIN_THREAD_CONFIG_FINGERPRINT_VERSION,
 			inputFingerprint,
@@ -719,7 +895,7 @@ function buildCodexPluginAppsConfigPatchFromPolicyContext(policyContext) {
 	for (const [appId, policy] of Object.entries(policyContext.apps).toSorted(([left], [right]) => left.localeCompare(right))) apps[appId] = {
 		enabled: true,
 		destructive_enabled: policy.allowDestructiveActions,
-		open_world_enabled: true,
+		open_world_enabled: policy.allowOpenWorld !== false,
 		default_tools_approval_mode: "auto",
 		...policy.destructiveApprovalMode === "ask" ? { approvals_reviewer: "user" } : {}
 	};
@@ -738,13 +914,22 @@ function buildPluginAppPolicyContext(apps, pluginAppIds) {
 }
 async function clearPersistedAppToolApprovalOverrides(params) {
 	try {
-		const overrideNames = await readPersistedAppToolApprovalOverrideNames(params);
-		for (const toolName of overrideNames) if (isOverriddenConfigWriteResponse(await params.request("config/value/write", {
+		const overrideNames = readPersistedAppToolApprovalOverrideNames(params.config, params.app);
+		if (overrideNames.length === 0) return true;
+		const edits = overrideNames.map((toolName) => ({
 			keyPath: `apps.${quoteConfigKeyPathSegment(params.app.id)}.tools.${quoteConfigKeyPathSegment(toolName)}.approval_mode`,
 			value: null,
 			mergeStrategy: "replace"
-		}))) throw new Error(`approval override for ${toolName} is controlled by another config layer`);
-		const remainingOverrideNames = await readPersistedAppToolApprovalOverrideNames(params);
+		}));
+		const response = await params.request("config/batchWrite", { edits });
+		if (!isJsonObject(response) || response.status !== "ok" && response.status !== "okOverridden") throw new Error("Codex did not confirm the approval override batch");
+		if (response.status === "okOverridden") throw new Error(`approval override for ${overrideNames.join(", ")} is controlled by another config layer`);
+		const confirmed = await params.request("config/read", {
+			includeLayers: false,
+			...params.configCwd ? { cwd: params.configCwd } : {}
+		});
+		if (!isJsonObject(confirmed) || !isJsonObject(confirmed.config)) throw new Error("Codex did not confirm effective app approval configuration");
+		const remainingOverrideNames = readPersistedAppToolApprovalOverrideNames(confirmed.config, params.app);
 		if (remainingOverrideNames.length > 0) throw new Error(`effective approval overrides remain for ${remainingOverrideNames.join(", ")}`);
 		return true;
 	} catch (error) {
@@ -756,24 +941,15 @@ async function clearPersistedAppToolApprovalOverrides(params) {
 		return false;
 	}
 }
-async function readPersistedAppToolApprovalOverrideNames(params) {
-	const response = await params.request("config/read", {
-		includeLayers: false,
-		...params.configCwd ? { cwd: params.configCwd } : {}
-	});
-	const config = isJsonObject(response) ? response.config : void 0;
-	const appsRoot = isJsonObject(config) ? config.apps : void 0;
-	const nestedApps = isJsonObject(appsRoot) ? appsRoot.apps : void 0;
-	const appConfig = isJsonObject(appsRoot) ? appsRoot[params.app.id] ?? (isJsonObject(nestedApps) ? nestedApps[params.app.id] : void 0) : void 0;
+function readPersistedAppToolApprovalOverrideNames(config, app) {
+	const appsRoot = config.apps;
+	const appConfig = isJsonObject(appsRoot) ? appsRoot[app.id] : void 0;
 	const tools = isJsonObject(appConfig) ? appConfig.tools : void 0;
 	if (!isJsonObject(tools)) return [];
 	return Object.entries(tools).filter(([, value]) => hasPersistedToolApprovalOverride(value)).map(([toolName]) => toolName).toSorted();
 }
 function hasPersistedToolApprovalOverride(value) {
-	return isJsonObject(value) && (value.approval_mode !== void 0 || value.approvalMode !== void 0);
-}
-function isOverriddenConfigWriteResponse(response) {
-	return isJsonObject(response) && response.status === "okOverridden";
+	return isJsonObject(value) && value.approval_mode !== void 0;
 }
 function quoteConfigKeyPathSegment(segment) {
 	return `"${segment.replace(/["\\]/g, (char) => `\\${char}`)}"`;
@@ -785,30 +961,6 @@ function shouldWaitForInitialAppInventory(params, policy, inventory) {
 function shouldRefreshMissingAppInventory(params, policy, inventory) {
 	return Boolean(params.appCacheKey && policy.pluginPolicies.some((plugin) => plugin.enabled) && inventory.appInventory?.state === "missing");
 }
-async function refreshAppInventoryNow(params, appCache, options = {}) {
-	const appCacheKey = params.appCacheKey;
-	if (!appCacheKey) return;
-	const request = async (method, requestParams) => await params.request(method, requestParams);
-	try {
-		return await appCache.refreshNow({
-			key: appCacheKey,
-			request,
-			nowMs: params.nowMs,
-			forceRefetch: options.forceRefetch,
-			targetAppIds: options.targetAppIds
-		});
-	} catch (error) {
-		embeddedAgentLog.warn("codex plugin thread config app inventory refresh failed", {
-			reason: options.reason,
-			forceRefetch: options.forceRefetch === true,
-			error: serializeCodexAppInventoryError(error)
-		});
-		return;
-	}
-}
-function collectInventoryOwnedAppIds(inventory) {
-	return Array.from(new Set(inventory.records.flatMap((record) => record.ownedAppIds).filter(Boolean))).toSorted();
-}
 function emptyCodexPluginInventory(policy) {
 	return {
 		policy,
@@ -816,42 +968,6 @@ function emptyCodexPluginInventory(policy) {
 		diagnostics: []
 	};
 }
-async function readAccessibleAccountApps(params, appCache) {
-	const snapshot = await refreshAppInventoryNow(params, appCache, {
-		forceRefetch: false,
-		reason: "account_apps_all",
-		targetAppIds: []
-	});
-	if (!snapshot) return {
-		apps: [],
-		diagnostic: {
-			code: "account_app_inventory_unavailable",
-			message: "Codex account app inventory was unavailable; account apps were not exposed."
-		}
-	};
-	return { apps: snapshot.apps.filter((app) => app.isAccessible).toSorted((left, right) => left.id.localeCompare(right.id)) };
-}
-function toOwnedAccountApp(app) {
-	return {
-		id: app.id,
-		name: app.name,
-		accessible: app.isAccessible,
-		enabled: app.isEnabled,
-		needsAuth: !app.isAccessible
-	};
-}
-function resolveThreadConfigAppsForRecord(params) {
-	if (params.inventory.appInventory?.state === "missing") return [];
-	return params.record.apps;
-}
-function isPluginAppReadyForThreadStart(app) {
-	return app.accessible;
-}
-function shouldForceRefreshForNotReadyPluginApps(params, policy, inventory) {
-	if (!params.appCacheKey || !policy.pluginPolicies.some((plugin) => plugin.enabled)) return false;
-	if (inventory.appInventory?.state === "missing") return false;
-	return inventory.records.some((record) => record.appOwnership === "proven" && record.ownedAppIds.length > 0 && (record.apps.length === 0 || record.apps.some((app) => !app.accessible)));
-}
 function policyFingerprint(policy) {
 	return {
 		enabled: policy.enabled,
@@ -872,13 +988,10 @@ function mergeJsonObjects(left, right) {
 	const merged = { ...left };
 	for (const [key, value] of Object.entries(right)) {
 		const existing = merged[key];
-		merged[key] = isPlainJsonObject(existing) && isPlainJsonObject(value) ? mergeJsonObjects(existing, value) : value;
+		merged[key] = isJsonObject(existing) && isJsonObject(value) ? mergeJsonObjects(existing, value) : value;
 	}
 	return merged;
 }
-function isPlainJsonObject(value) {
-	return Boolean(value && typeof value === "object" && !Array.isArray(value));
-}
 function fingerprintJson(value) {
 	return crypto.createHash("sha256").update(stableStringify(value)).digest("hex");
 }
@@ -904,15 +1017,18 @@ const CODEX_TURN_START_TEXT_INPUT_MAX_CHARS = 1 << 20;
 const DEFAULT_CODEX_PROJECTION_RESERVE_TOKENS = 2e4;
 const MIN_PROMPT_BUDGET_RATIO = .5;
 const MIN_PROMPT_BUDGET_TOKENS = 8e3;
+function neutralizeCodexExplicitMentionSigils(text) {
+	return text.replace(/\$(?=[A-Za-z0-9_:-])/gu, "＄").replace(/\[@(?=[A-Za-z0-9_:-]+\]\()/gu, "[＠");
+}
 /** Projects assembled OpenClaw context-engine messages into Codex prompt inputs. */
 function projectContextEngineAssemblyForCodex(params) {
 	const prompt = params.prompt.trim();
 	const contextMessages = dropDuplicateTrailingPrompt(params.assembledMessages, prompt);
 	const maxRenderedContextChars = normalizeRenderedContextMaxChars(params.maxRenderedContextChars);
-	const renderedContext = renderMessagesForCodexContext(contextMessages, {
+	const renderedContext = neutralizeCodexExplicitMentionSigils(renderMessagesForCodexContext(contextMessages, {
 		maxTextPartChars: resolveTextPartMaxChars(maxRenderedContextChars),
 		toolPayloadMode: params.toolPayloadMode ?? "elide"
-	});
+	}));
 	const boundedContext = renderedContext ? truncateOlderContext(renderedContext, maxRenderedContextChars) : void 0;
 	const promptPrefix = boundedContext ? [
 		CONTEXT_HEADER,
@@ -1113,8 +1229,8 @@ function hasMessageContent(message) {
 	return "content" in message;
 }
 function normalizeRenderedContextMaxChars(value) {
-	if (typeof value !== "number" || !Number.isFinite(value)) return DEFAULT_RENDERED_CONTEXT_CHARS;
-	return Math.min(MAX_RENDERED_CONTEXT_CHARS, Math.max(DEFAULT_RENDERED_CONTEXT_CHARS, Math.floor(value)));
+	if (typeof value !== "number" || !Number.isFinite(value) || value <= 0) return DEFAULT_RENDERED_CONTEXT_CHARS;
+	return Math.min(MAX_RENDERED_CONTEXT_CHARS, Math.max(1, Math.floor(value)));
 }
 function resolveTextPartMaxChars(maxRenderedContextChars) {
 	return Math.min(MAX_TEXT_PART_CHARS, Math.max(DEFAULT_TEXT_PART_CHARS, Math.floor(maxRenderedContextChars / 4)));
@@ -1176,107 +1292,15 @@ function areContextEngineProjectionBindingsCompatible(previous, next) {
 	return previous?.schemaVersion === next.schemaVersion && previous.mode === next.mode && previous.epoch === next.epoch && previous.fingerprint === next.fingerprint;
 }
 function resolveContextEngineCitationsMode(config) {
-	const rootConfig = isUnknownRecord(config) ? config : void 0;
-	const citations = (isUnknownRecord(rootConfig?.memory) ? rootConfig.memory : void 0)?.citations;
+	const rootConfig = isRecord(config) ? config : void 0;
+	const citations = (isRecord(rootConfig?.memory) ? rootConfig.memory : void 0)?.citations;
 	return isJsonConfigValue(citations) ? citations : void 0;
 }
-function isUnknownRecord(value) {
-	return Boolean(value && typeof value === "object" && !Array.isArray(value));
-}
 function isJsonConfigValue(value) {
 	if (value === null || typeof value === "string" || typeof value === "boolean") return true;
 	if (typeof value === "number") return Number.isFinite(value);
 	if (Array.isArray(value)) return value.every(isJsonConfigValue);
-	return isUnknownRecord(value) && Object.values(value).every(isJsonConfigValue);
-}
-//#endregion
-//#region extensions/codex/src/app-server/thread-fingerprints.ts
-function codexDynamicToolsFingerprint(dynamicTools) {
-	return fingerprintDynamicTools(dynamicTools);
-}
-function codexLegacyDynamicToolsFingerprint(dynamicTools) {
-	return legacyFingerprintDynamicTools(dynamicTools);
-}
-function areCodexDynamicToolFingerprintsCompatible(params) {
-	return areDynamicToolFingerprintsCompatible(params.previous, params.next, params.nextLegacy);
-}
-function fingerprintDynamicTools(dynamicTools) {
-	return hashCodexAppServerBindingFingerprint(legacyFingerprintDynamicTools(dynamicTools));
-}
-function legacyFingerprintDynamicTools(dynamicTools) {
-	return JSON.stringify(dynamicTools.map(fingerprintDynamicToolSpec).toSorted(compareJsonFingerprint));
-}
-function legacyFingerprintUserMcpServersConfigPatch(configPatch) {
-	return configPatch ? JSON.stringify(stabilizeJsonValue(configPatch)) : void 0;
-}
-function fingerprintUserMcpServersConfigPatch(configPatch) {
-	return configPatch ? hashCodexAppServerBindingFingerprint(JSON.stringify(stabilizeJsonValue(redactUserMcpServersFingerprintSecrets(configPatch)))) : void 0;
-}
-function redactUserMcpServersFingerprintSecrets(value) {
-	if (Array.isArray(value)) return value.map(redactUserMcpServersFingerprintSecrets);
-	if (!value || typeof value !== "object") return value;
-	const next = {};
-	for (const [key, entry] of Object.entries(value)) {
-		if (key === "http_headers" && entry && typeof entry === "object" && !Array.isArray(entry)) {
-			next[key] = Object.fromEntries(Object.entries(entry).map(([header, headerValue]) => [header, header.toLowerCase() === "authorization" ? fingerprintUserMcpServersAuthorizationHeader(headerValue) : headerValue]));
-			continue;
-		}
-		next[key] = redactUserMcpServersFingerprintSecrets(entry);
-	}
-	return next;
-}
-function fingerprintUserMcpServersAuthorizationHeader(value) {
-	return typeof value === "string" && value.length > 0 ? `<redacted:sha256:${crypto$1.createHash("sha256").update(value).digest("hex")}>` : "<redacted>";
-}
-function fingerprintJsonObject(value) {
-	return JSON.stringify(stabilizeJsonValue(value));
-}
-function fingerprintEnvironmentSelection(environments) {
-	return environments ? JSON.stringify(environments.map(stabilizeJsonValue)) : void 0;
-}
-function fingerprintDynamicToolSpec(tool) {
-	return stabilizeDynamicToolFingerprintValue(tool);
-}
-function stabilizeDynamicToolFingerprintValue(value) {
-	if (Array.isArray(value)) return value.map(stabilizeDynamicToolFingerprintValue);
-	if (!isJsonObject(value)) return value;
-	const stable = {};
-	for (const [key, child] of Object.entries(value).toSorted(([left], [right]) => left.localeCompare(right))) {
-		if (key === "description") continue;
-		stable[key] = stabilizeDynamicToolFingerprintValue(child);
-	}
-	return stable;
-}
-function stabilizeJsonValue(value) {
-	if (Array.isArray(value)) return value.map(stabilizeJsonValue);
-	if (!isJsonObject(value)) return value;
-	const stable = {};
-	for (const [key, child] of Object.entries(value).toSorted(([left], [right]) => left.localeCompare(right))) stable[key] = stabilizeJsonValue(child);
-	return stable;
-}
-function readActiveCodexTurnIds(thread) {
-	return (thread.turns ?? []).filter((turn) => turn.status === "inProgress").map((turn) => typeof turn.id === "string" ? turn.id : "").filter((turnId) => turnId.trim().length > 0);
-}
-function readActiveCodexTurnIdsFromResume(response) {
-	const pagedTurns = response.initialTurnsPage?.data;
-	return readActiveCodexTurnIds(Array.isArray(pagedTurns) ? { turns: pagedTurns } : response.thread);
-}
-const LEGACY_EMPTY_DYNAMIC_TOOLS_FINGERPRINT = legacyFingerprintDynamicTools([]);
-const EMPTY_DYNAMIC_TOOLS_FINGERPRINT = hashCodexAppServerBindingFingerprint(LEGACY_EMPTY_DYNAMIC_TOOLS_FINGERPRINT);
-function areDynamicToolFingerprintsCompatible(previous, next, nextLegacy) {
-	return !previous || previous === next || previous === nextLegacy;
-}
-function areUserMcpServersFingerprintsCompatible(params) {
-	return params.previous === params.next || params.previous === params.nextLegacy || params.nextLegacy !== void 0 && params.previous === hashCodexAppServerBindingFingerprint(params.nextLegacy);
-}
-function shouldStartTransientNoToolThread(params) {
-	return Boolean(params.previous && !isEmptyDynamicToolsFingerprint(params.previous) && !params.nextHasDynamicTools);
-}
-function isEmptyDynamicToolsFingerprint(fingerprint) {
-	return fingerprint === EMPTY_DYNAMIC_TOOLS_FINGERPRINT || fingerprint === LEGACY_EMPTY_DYNAMIC_TOOLS_FINGERPRINT;
-}
-function compareJsonFingerprint(left, right) {
-	return JSON.stringify(left).localeCompare(JSON.stringify(right));
+	return isRecord(value) && Object.values(value).every(isJsonConfigValue);
 }
 //#endregion
 //#region extensions/codex/src/app-server/dynamic-tool-profile.ts
@@ -1299,6 +1323,14 @@ const CODEX_NATIVE_GOAL_TOOL_EXCLUDES = [
 	"create_goal",
 	"update_goal"
 ];
+const CODEX_APP_SERVER_OWNED_REPLACEABLE_TOOL_EXCLUDES = /* @__PURE__ */ new Set([
+	"read",
+	"write",
+	"edit",
+	"apply_patch",
+	"update_plan",
+	...CODEX_NATIVE_GOAL_TOOL_EXCLUDES
+]);
 const CODEX_APP_SERVER_OWNED_SHELL_TOOL_EXCLUDES = /* @__PURE__ */ new Set(["exec", "process"]);
 const DYNAMIC_TOOL_NAME_ALIASES = {
 	bash: "exec",
@@ -1313,6 +1345,10 @@ function normalizeCodexDynamicToolName(name) {
 function isSystemAgentOnlyCodexDynamicToolAllowlist(toolsAllow) {
 	return toolsAllow?.length === 1 && normalizeCodexDynamicToolName(toolsAllow[0] ?? "") === "openclaw";
 }
+/** True when a private source reply may use the message delivery tool only. */
+function isMessageOnlyCodexSourceReply(params) {
+	return params.sourceReplyDeliveryMode === "message_tool_only" && params.toolsAllow?.length === 1 && normalizeCodexDynamicToolName(params.toolsAllow[0] ?? "") === "message";
+}
 /** Returns true for private QA runs that force the Codex runtime profile. */
 function isForcedPrivateQaCodexRuntime(env = process.env) {
 	return env.OPENCLAW_BUILD_PRIVATE_QA === "1" && env.OPENCLAW_QA_FORCE_RUNTIME?.trim().toLowerCase() === "codex";
@@ -1346,17 +1382,24 @@ function resolveCodexDynamicToolsLoadingForRuntime(config, modelId, options = {}
 }
 /** Filters OpenClaw tools that Codex owns natively or config explicitly excludes. */
 function filterCodexDynamicTools(tools, config, env = process.env) {
-	return filterCodexDynamicToolsWithOptions(tools, config, env, { preserveOpenClawShell: false });
+	return filterCodexDynamicToolsWithOptions(tools, config, env, {
+		preserveOpenClawReplacements: false,
+		preserveOpenClawShell: false
+	});
 }
-/** Keeps exec/process only when Codex cannot advertise an environment-backed native shell. */
-function filterCodexDynamicToolsWithOpenClawShell(tools, config, env = process.env) {
-	return filterCodexDynamicToolsWithOptions(tools, config, env, { preserveOpenClawShell: true });
+/** Keeps OpenClaw coding tools that replace a disabled Codex native surface. */
+function filterCodexDynamicToolsForDisabledNativeSurface(tools, config, options, env = process.env) {
+	return filterCodexDynamicToolsWithOptions(tools, config, env, {
+		preserveOpenClawReplacements: true,
+		preserveOpenClawShell: options.preserveShell
+	});
 }
 function filterCodexDynamicToolsWithOptions(tools, config, env, options) {
 	const excludes = /* @__PURE__ */ new Set();
-	for (const name of CODEX_NATIVE_GOAL_TOOL_EXCLUDES) excludes.add(name);
+	if (!options.preserveOpenClawReplacements) for (const name of CODEX_NATIVE_GOAL_TOOL_EXCLUDES) excludes.add(name);
 	if (isForcedPrivateQaCodexRuntime(env)) excludes.add("apply_patch");
 	else for (const name of CODEX_APP_SERVER_OWNED_DYNAMIC_TOOL_EXCLUDES) {
+		if (options.preserveOpenClawReplacements && CODEX_APP_SERVER_OWNED_REPLACEABLE_TOOL_EXCLUDES.has(name)) continue;
 		if (options.preserveOpenClawShell && CODEX_APP_SERVER_OWNED_SHELL_TOOL_EXCLUDES.has(name)) continue;
 		excludes.add(name);
 	}
@@ -1367,13 +1410,6 @@ function filterCodexDynamicToolsWithOptions(tools, config, env, options) {
 	return excludes.size === 0 ? tools : tools.filter((tool) => !excludes.has(normalizeCodexDynamicToolName(tool.name)));
 }
 //#endregion
-//#region extensions/codex/src/app-server/profiler-flag.ts
-const PROFILER_FLAGS = ["profiler", "codex.profiler"];
-/** Checks the generic and Codex-specific profiler diagnostic flags. */
-function isCodexAppServerProfilerEnabled(config, env = process.env) {
-	return PROFILER_FLAGS.some((flag) => isDiagnosticFlagEnabled(flag, config, env));
-}
-//#endregion
 //#region extensions/codex/src/app-server/thread-binding-policy.ts
 function shouldRotateCodexAppServerBindingForRuntime(params) {
 	if (!params.current) return false;
@@ -1424,6 +1460,299 @@ function shouldRecheckRecoverablePluginBinding(params) {
 	return bindingContainsSettledPlugin || accountAppRecoveryEnabled && Object.keys(policyContext.apps).length === 0 || recoverablePluginConfigKeys.length > 0;
 }
 //#endregion
+//#region extensions/codex/src/app-server/thread-fingerprints.ts
+function codexDynamicToolsFingerprint(dynamicTools) {
+	return fingerprintDynamicTools(dynamicTools);
+}
+function codexLegacyDynamicToolsFingerprint(dynamicTools) {
+	return legacyFingerprintDynamicTools(dynamicTools);
+}
+function areCodexDynamicToolFingerprintsCompatible(params) {
+	return areDynamicToolFingerprintsCompatible(params.previous, params.next, params.nextLegacy);
+}
+function fingerprintDynamicTools(dynamicTools) {
+	return hashCodexAppServerBindingFingerprint(legacyFingerprintDynamicTools(dynamicTools));
+}
+function legacyFingerprintDynamicTools(dynamicTools) {
+	return JSON.stringify(dynamicTools.map(fingerprintDynamicToolSpec).toSorted(compareJsonFingerprint));
+}
+function legacyFingerprintUserMcpServersConfigPatch(configPatch) {
+	return configPatch ? JSON.stringify(stabilizeJsonValue(configPatch)) : void 0;
+}
+function fingerprintUserMcpServersConfigPatch(configPatch) {
+	return configPatch ? hashCodexAppServerBindingFingerprint(JSON.stringify(stabilizeJsonValue(redactUserMcpServersFingerprintSecrets(configPatch)))) : void 0;
+}
+function redactUserMcpServersFingerprintSecrets(value) {
+	if (Array.isArray(value)) return value.map(redactUserMcpServersFingerprintSecrets);
+	if (!value || typeof value !== "object") return value;
+	const next = {};
+	for (const [key, entry] of Object.entries(value)) {
+		if (key === "http_headers" && entry && typeof entry === "object" && !Array.isArray(entry)) {
+			next[key] = Object.fromEntries(Object.entries(entry).map(([header, headerValue]) => [header, header.toLowerCase() === "authorization" ? fingerprintUserMcpServersAuthorizationHeader(headerValue) : headerValue]));
+			continue;
+		}
+		next[key] = redactUserMcpServersFingerprintSecrets(entry);
+	}
+	return next;
+}
+function fingerprintUserMcpServersAuthorizationHeader(value) {
+	return typeof value === "string" && value.length > 0 ? `<redacted:sha256:${crypto$1.createHash("sha256").update(value).digest("hex")}>` : "<redacted>";
+}
+function fingerprintJsonObject(value) {
+	return JSON.stringify(stabilizeJsonValue(value));
+}
+/** Hash thread-creation identity; settings already applied by turn/start must not restart Codex. */
+function fingerprintCodexThreadConfig(request, authProfileId, dynamicToolsFingerprint) {
+	return hashCodexAppServerBindingFingerprint(fingerprintJsonObject({
+		authProfileId: authProfileId ?? null,
+		dynamicToolsFingerprint: dynamicToolsFingerprint ?? null,
+		nativeMultiAgentVersion: resolveCodexGpt56MultiAgentVersion(typeof request.requestedModel === "string" ? request.requestedModel : typeof request.model === "string" ? request.model : void 0) ?? null,
+		modelProvider: request.modelProvider ?? null,
+		requestedModelProvider: request.requestedModelProvider === void 0 ? request.modelProvider ?? null : request.requestedModelProvider,
+		permissions: request.permissions ?? null,
+		baseInstructions: request.baseInstructions ?? null,
+		developerInstructions: request.developerInstructions ?? null,
+		config: request.config ?? {}
+	}));
+}
+function fingerprintEnvironmentSelection(environments) {
+	return environments ? JSON.stringify(environments.map(stabilizeJsonValue)) : void 0;
+}
+function fingerprintDynamicToolSpec(tool) {
+	return stabilizeJsonValue(tool);
+}
+function stabilizeJsonValue(value) {
+	if (Array.isArray(value)) return value.map(stabilizeJsonValue);
+	if (!isJsonObject(value)) return value;
+	const stable = {};
+	for (const [key, child] of Object.entries(value).toSorted(([left], [right]) => left.localeCompare(right))) stable[key] = stabilizeJsonValue(child);
+	return stable;
+}
+function readActiveCodexTurnIds(thread) {
+	return (thread.turns ?? []).filter((turn) => turn.status === "inProgress").map((turn) => typeof turn.id === "string" ? turn.id : "").filter((turnId) => turnId.trim().length > 0);
+}
+function readActiveCodexTurnIdsFromResume(response) {
+	const pagedTurns = response.initialTurnsPage?.data;
+	return readActiveCodexTurnIds(Array.isArray(pagedTurns) ? { turns: pagedTurns } : response.thread);
+}
+const LEGACY_EMPTY_DYNAMIC_TOOLS_FINGERPRINT = legacyFingerprintDynamicTools([]);
+const EMPTY_DYNAMIC_TOOLS_FINGERPRINT = hashCodexAppServerBindingFingerprint(LEGACY_EMPTY_DYNAMIC_TOOLS_FINGERPRINT);
+function areDynamicToolFingerprintsCompatible(previous, next, nextLegacy) {
+	return !previous || previous === next || previous === nextLegacy;
+}
+function areUserMcpServersFingerprintsCompatible(params) {
+	return params.previous === params.next || params.previous === params.nextLegacy || params.nextLegacy !== void 0 && params.previous === hashCodexAppServerBindingFingerprint(params.nextLegacy);
+}
+function shouldStartTransientNoToolThread(params) {
+	return Boolean(params.previous && !isEmptyDynamicToolsFingerprint(params.previous) && !params.nextHasDynamicTools);
+}
+function isEmptyDynamicToolsFingerprint(fingerprint) {
+	return fingerprint === EMPTY_DYNAMIC_TOOLS_FINGERPRINT || fingerprint === LEGACY_EMPTY_DYNAMIC_TOOLS_FINGERPRINT;
+}
+function compareJsonFingerprint(left, right) {
+	return JSON.stringify(left).localeCompare(JSON.stringify(right));
+}
+//#endregion
+//#region extensions/codex/src/app-server/native-skill-isolation.ts
+const MAX_PERSONAL_SKILL_DIRECTORIES = 2e3;
+const MAX_PERSONAL_SKILL_DEPTH = 6;
+const MAX_PERSONAL_SKILL_ENTRIES = 1e4;
+const nativeSkillIsolationByClient = /* @__PURE__ */ new WeakMap();
+function isMissingPathError(error) {
+	return error.code === "ENOENT";
+}
+function isPathWithin(root, candidate) {
+	const relative = path.relative(path.resolve(root), path.resolve(candidate));
+	return relative === "" || !path.isAbsolute(relative) && !relative.startsWith(`..${path.sep}`) && relative !== "..";
+}
+async function canonicalizeExistingPath(candidate) {
+	try {
+		return await fs.realpath(candidate);
+	} catch {
+		return path.resolve(candidate);
+	}
+}
+async function usesDefaultStateDir() {
+	if (!process.env.OPENCLAW_STATE_DIR?.trim()) return true;
+	const home = resolveRequiredHomeDir();
+	const [stateDir, defaultStateDir] = await Promise.all([canonicalizeExistingPath(resolveStateDir()), canonicalizeExistingPath(path.join(home, ".openclaw"))]);
+	return stateDir === defaultStateDir;
+}
+async function collectPersonalSkillRealPaths(homes, codexHome) {
+	const realStateDir = await canonicalizeExistingPath(resolveStateDir());
+	const roots = [];
+	for (const home of homes) {
+		for (const dir of [".agents", ".claude"]) roots.push({
+			dir: path.join(home, dir, "skills"),
+			onlyEscapedStateTargets: false
+		});
+		const defaultCodexHome = path.join(home, ".codex");
+		const realDefaultCodexHome = await canonicalizeExistingPath(defaultCodexHome);
+		roots.push({
+			dir: path.join(defaultCodexHome, "skills"),
+			onlyEscapedStateTargets: isPathWithin(realStateDir, realDefaultCodexHome)
+		});
+	}
+	const configuredCodexHome = codexHome?.trim() || process.env.CODEX_HOME?.trim();
+	if (configuredCodexHome) {
+		const stateOwned = isPathWithin(realStateDir, await canonicalizeExistingPath(configuredCodexHome));
+		roots.push({
+			dir: path.join(configuredCodexHome, "skills"),
+			onlyEscapedStateTargets: stateOwned
+		});
+	}
+	const skillPaths = /* @__PURE__ */ new Set();
+	let complete = true;
+	const seenDirectories = /* @__PURE__ */ new Set();
+	const queue = roots.map((root) => ({
+		dir: root.dir,
+		onlyEscapedStateTargets: root.onlyEscapedStateTargets,
+		depth: 0
+	}));
+	let entryCount = 0;
+	const recordSkillFile = async (filePath, onlyEscapedStateTargets) => {
+		try {
+			const skillRealPath = await fs.realpath(filePath);
+			if (!onlyEscapedStateTargets || !isPathWithin(realStateDir, skillRealPath)) skillPaths.add(skillRealPath);
+		} catch (error) {
+			if (!isMissingPathError(error)) complete = false;
+		}
+	};
+	for (const current of queue) {
+		let realDir;
+		try {
+			realDir = await fs.realpath(current.dir);
+		} catch (error) {
+			if (isMissingPathError(error)) continue;
+			complete = false;
+			continue;
+		}
+		if (seenDirectories.has(realDir)) continue;
+		seenDirectories.add(realDir);
+		if (seenDirectories.size > MAX_PERSONAL_SKILL_DIRECTORIES) {
+			complete = false;
+			break;
+		}
+		let directory;
+		try {
+			directory = await fs.opendir(current.dir);
+		} catch (error) {
+			if (!isMissingPathError(error)) complete = false;
+			continue;
+		}
+		try {
+			for await (const entry of directory) {
+				entryCount += 1;
+				if (entryCount > MAX_PERSONAL_SKILL_ENTRIES) {
+					complete = false;
+					queue.length = 0;
+					break;
+				}
+				if (entry.name.startsWith(".")) continue;
+				const entryPath = path.join(current.dir, entry.name);
+				if (entry.name === "SKILL.md" && entry.isFile()) {
+					await recordSkillFile(entryPath, current.onlyEscapedStateTargets);
+					continue;
+				}
+				if (entry.isSymbolicLink()) {
+					try {
+						const stat = await fs.stat(entryPath);
+						if (entry.name === "SKILL.md" && stat.isFile()) await recordSkillFile(entryPath, current.onlyEscapedStateTargets);
+						else if (stat.isDirectory()) if (current.depth < MAX_PERSONAL_SKILL_DEPTH) queue.push({
+							dir: entryPath,
+							depth: current.depth + 1,
+							onlyEscapedStateTargets: current.onlyEscapedStateTargets
+						});
+						else complete = false;
+					} catch (error) {
+						if (!isMissingPathError(error)) complete = false;
+					}
+					continue;
+				}
+				if (current.depth >= MAX_PERSONAL_SKILL_DEPTH) {
+					if (entry.isDirectory()) complete = false;
+					continue;
+				}
+				if (entry.isDirectory()) {
+					queue.push({
+						dir: entryPath,
+						depth: current.depth + 1,
+						onlyEscapedStateTargets: current.onlyEscapedStateTargets
+					});
+					continue;
+				}
+			}
+		} catch (error) {
+			if (!isMissingPathError(error)) complete = false;
+		}
+	}
+	return {
+		complete,
+		skillPaths
+	};
+}
+/** Resolves the native user-scope skills that an isolated OpenClaw thread must disable. */
+async function resolveCodexNativeSkillIsolation(params) {
+	params.signal?.throwIfAborted();
+	if (!process.env.OPENCLAW_STATE_DIR?.trim()) return;
+	const key = JSON.stringify([
+		path.resolve(resolveStateDir()),
+		path.resolve(params.cwd),
+		params.codexHome?.trim() || process.env.CODEX_HOME?.trim() || "",
+		params.home?.trim() || process.env.HOME?.trim() || "",
+		params.userProfile?.trim() || process.env.USERPROFILE?.trim() || ""
+	]);
+	const cached = nativeSkillIsolationByClient.get(params.client);
+	if (cached?.key === key && (cached.settled || cached.signal === params.signal)) {
+		const isolation = await cached.result;
+		params.signal?.throwIfAborted();
+		return isolation;
+	}
+	const result = resolveUncachedCodexNativeSkillIsolation(params);
+	const entry = {
+		key,
+		result,
+		settled: false,
+		signal: params.signal
+	};
+	nativeSkillIsolationByClient.set(params.client, entry);
+	try {
+		const isolation = await result;
+		entry.settled = true;
+		params.signal?.throwIfAborted();
+		return isolation;
+	} catch (error) {
+		if (nativeSkillIsolationByClient.get(params.client)?.result === result) nativeSkillIsolationByClient.delete(params.client);
+		throw error;
+	}
+}
+async function resolveUncachedCodexNativeSkillIsolation(params) {
+	if (await usesDefaultStateDir()) return;
+	const response = await params.client.request("skills/list", {
+		cwds: [params.cwd],
+		forceReload: true
+	}, { signal: params.signal });
+	const homes = [params.home?.trim() || process.env.HOME?.trim() || process.env.USERPROFILE?.trim() || os.homedir()];
+	if (process.platform === "win32") homes.push(params.userProfile?.trim() || os.homedir());
+	const personalSkills = await collectPersonalSkillRealPaths([...new Set(homes.map((home) => path.resolve(home)))], params.codexHome);
+	return { disabledUserSkillPaths: [...personalSkills.complete ? personalSkills.skillPaths : /* @__PURE__ */ new Set([...personalSkills.skillPaths, ...response.data.flatMap((entry) => entry.skills.filter((skill) => skill.scope === "user").map((skill) => skill.path))])].toSorted((left, right) => left.localeCompare(right)) };
+}
+/** Applies path-exact session rules after caller config so isolated user skills stay disabled. */
+function applyCodexNativeSkillIsolation(config, isolation) {
+	if (!isolation) return config;
+	const existingRules = config?.["skills.config"];
+	if (existingRules !== void 0 && !Array.isArray(existingRules)) throw new Error("Codex thread skills.config must be an array");
+	const disabledRules = isolation.disabledUserSkillPaths.map((skillPath) => ({
+		path: skillPath,
+		enabled: false
+	}));
+	return {
+		...config,
+		"skills.include_instructions": false,
+		"skills.config": [...existingRules ?? [], ...disabledRules]
+	};
+}
+//#endregion
 //#region extensions/codex/src/app-server/thread-lifecycle-errors.ts
 var CodexThreadStartRequestError = class extends Error {
 	constructor(cause) {
@@ -1437,10 +1766,10 @@ var CodexThreadBindingConflictError = class extends Error {
 		this.name = "CodexThreadBindingConflictError";
 	}
 };
-var CodexRingZeroAttestationError = class extends Error {
+var CodexRestrictedToolSurfaceAttestationError = class extends Error {
 	constructor(cause) {
-		super("Codex ring-zero MCP attestation failed", { cause });
-		this.name = "CodexRingZeroAttestationError";
+		super("Codex restricted-tool-surface MCP attestation failed", { cause });
+		this.name = "CodexRestrictedToolSurfaceAttestationError";
 	}
 };
 var CodexThreadBindingConflictAfterCleanupError = class extends CodexThreadBindingConflictError {};
@@ -1449,7 +1778,62 @@ var CodexAdoptedThreadActiveError = class extends Error {
 		super("Codex session became active in another runner; wait for it to finish before continuing");
 		this.name = "CodexAdoptedThreadActiveError";
 	}
-};
+};
+//#endregion
+//#region extensions/codex/src/app-server/plugin-thread-attestation.ts
+/**
+* Confirms admitted plugin and account apps against their actual Codex thread before
+* OpenClaw commits a binding or starts a turn.
+*/
+var CodexPluginThreadAppAttestationError = class extends Error {
+	constructor(message, options) {
+		super(message, options);
+		this.name = "CodexPluginThreadAppAttestationError";
+	}
+};
+/** Reads the existing runtime snapshot with the started thread's effective app policy. */
+async function attestCodexPluginThreadApps(params) {
+	const appIds = Array.from(new Set(params.appIds.filter(Boolean))).toSorted();
+	if (appIds.length === 0) return;
+	let response;
+	try {
+		response = await params.client.request("app/installed", {
+			threadId: params.threadId,
+			forceRefresh: false
+		}, { signal: params.signal });
+	} catch (error) {
+		throw new CodexPluginThreadAppAttestationError(`Codex could not confirm admitted apps for thread ${params.threadId}`, { cause: error });
+	}
+	const installedById = new Map(response.apps.map((app) => [app.id, app]));
+	const failures = appIds.flatMap((appId) => {
+		const app = installedById.get(appId);
+		if (!app) return [`${appId}:missing`];
+		if (!app.enabled) return [`${appId}:disabled`];
+		return app.callable ? [] : [`${appId}:not-callable`];
+	});
+	if (failures.length > 0) throw new CodexPluginThreadAppAttestationError(`Codex thread ${params.threadId} did not expose admitted apps: ${failures.join(", ")}`);
+}
+/** Deletes a persistent pre-turn thread; ephemeral threads can only be unsubscribed. */
+async function discardUnattestedCodexPluginThread(params) {
+	if (params.ephemeral) return await unsubscribeCodexThreadBestEffort(params.client, {
+		threadId: params.threadId,
+		timeoutMs: CODEX_APP_SERVER_UNSUBSCRIBE_TIMEOUT_MS
+	});
+	try {
+		await params.client.request("thread/delete", { threadId: params.threadId }, { timeoutMs: CODEX_APP_SERVER_UNSUBSCRIBE_TIMEOUT_MS });
+		return true;
+	} catch (error) {
+		embeddedAgentLog.debug("codex plugin app attestation thread deletion failed", {
+			threadId: params.threadId,
+			error
+		});
+		await unsubscribeCodexThreadBestEffort(params.client, {
+			threadId: params.threadId,
+			timeoutMs: CODEX_APP_SERVER_UNSUBSCRIBE_TIMEOUT_MS
+		});
+		return false;
+	}
+}
 //#endregion
 //#region extensions/codex/src/app-server/reasoning-effort.ts
 const CODEX_REASONING_EFFORTS = [
@@ -1461,30 +1845,13 @@ const CODEX_REASONING_EFFORTS = [
 	"max",
 	"ultra"
 ];
-const GPT_56_MAX_REASONING_EFFORTS = [
-	"low",
-	"medium",
-	"high",
-	"xhigh",
-	"max"
-];
-const GPT_56_ULTRA_REASONING_EFFORTS = [...GPT_56_MAX_REASONING_EFFORTS, "ultra"];
-const GPT_5_PRO_REASONING_EFFORTS = [
+const LEGACY_PRO_REASONING_EFFORTS = [
 	"medium",
 	"high",
 	"xhigh"
 ];
-const GPT_56_ULTRA_MODEL_IDS = /* @__PURE__ */ new Set(["gpt-5.6-sol", "gpt-5.6-terra"]);
-const GPT_56_MAX_MODEL_IDS = /* @__PURE__ */ new Set([...GPT_56_ULTRA_MODEL_IDS, "gpt-5.6-luna"]);
-const MODERN_CODEX_MODEL_IDS = /* @__PURE__ */ new Set([
-	...GPT_56_MAX_MODEL_IDS,
-	"gpt-5.5",
-	"gpt-5.5-pro",
-	"gpt-5.4",
-	"gpt-5.4-pro",
-	"gpt-5.4-mini",
-	"gpt-5.3-codex-spark"
-]);
+const LEGACY_PRO_MODEL_ID_RE = /^gpt-5\.[45]-pro$/u;
+const MODERN_GPT_5_MODEL_ID_RE = /^gpt-5\.(?:[3-9]|[1-9]\d)(?:$|-)/u;
 function normalizeCodexReasoningEfforts(efforts) {
 	if (!efforts) return [];
 	const supported = new Set(efforts.map((effort) => effort.trim().toLowerCase()));
@@ -1504,24 +1871,21 @@ function resolveSupportedReasoningEffort(params) {
 	const requestedRank = CODEX_REASONING_EFFORTS.indexOf(params.requested);
 	return fallbackEfforts.find((effort) => CODEX_REASONING_EFFORTS.indexOf(effort) >= requestedRank) ?? fallbackEfforts.at(-1);
 }
-function resolveFallbackReasoningEfforts(modelId) {
-	const normalized = modelId.trim().toLowerCase();
-	if (GPT_56_ULTRA_MODEL_IDS.has(normalized)) return GPT_56_ULTRA_REASONING_EFFORTS;
-	if (normalized === "gpt-5.6-luna") return GPT_56_MAX_REASONING_EFFORTS;
-	if (normalized === "gpt-5.5-pro" || normalized === "gpt-5.4-pro") return GPT_5_PRO_REASONING_EFFORTS;
-}
-/** Resolve a turn effort from app-server metadata, with exact-name offline fallbacks. */
+/** Resolve a turn effort from the selected model's provider-owned metadata. */
 function resolveCodexAppServerReasoningEffort(params) {
 	if (params.thinkLevel === "off" || params.thinkLevel === "adaptive") return null;
-	const supportedReasoningEfforts = params.supportedReasoningEfforts ?? resolveFallbackReasoningEfforts(params.modelId);
-	if (supportedReasoningEfforts) return resolveSupportedReasoningEffort({
+	if (params.supportedReasoningEfforts) return resolveSupportedReasoningEffort({
 		requested: params.thinkLevel,
-		supportedReasoningEfforts
+		supportedReasoningEfforts: params.supportedReasoningEfforts
+	}) ?? null;
+	const modelId = params.modelId.trim().toLowerCase();
+	if (LEGACY_PRO_MODEL_ID_RE.test(modelId)) return resolveSupportedReasoningEffort({
+		requested: params.thinkLevel,
+		supportedReasoningEfforts: LEGACY_PRO_REASONING_EFFORTS
 	}) ?? null;
-	const normalizedModelId = params.modelId.trim().toLowerCase();
-	if (params.thinkLevel === "minimal") return MODERN_CODEX_MODEL_IDS.has(normalizedModelId) ? "low" : "minimal";
-	if (params.thinkLevel === "low" || params.thinkLevel === "medium" || params.thinkLevel === "high" || params.thinkLevel === "xhigh") return params.thinkLevel;
-	return params.thinkLevel === "max" && GPT_56_MAX_MODEL_IDS.has(normalizedModelId) ? "max" : null;
+	if (params.thinkLevel === "minimal" && MODERN_GPT_5_MODEL_ID_RE.test(modelId)) return "low";
+	if (params.thinkLevel === "minimal" || params.thinkLevel === "low" || params.thinkLevel === "medium" || params.thinkLevel === "high" || params.thinkLevel === "xhigh") return params.thinkLevel;
+	return null;
 }
 //#endregion
 //#region extensions/codex/src/app-server/thread-model-selection.ts
@@ -1601,33 +1965,46 @@ function resolveReasoningEffort(thinkLevel, modelId, supportedReasoningEfforts)
 //#endregion
 //#region extensions/codex/src/app-server/thread-prompt.ts
 function buildDeveloperInstructions(params, options = {}) {
+	const deferredToolNames = /* @__PURE__ */ new Set();
+	let hasSkillWorkshop = false;
+	let hasSessionsSpawn = false;
+	let hasSessionsYield = false;
+	let hasSeenDirectNamespace = false;
+	let messageToolAvailable = options.dynamicTools ? false : params.disableMessageTool !== true;
+	for (const spec of options.dynamicTools ?? []) {
+		const isDirectNamespace = spec.type === "namespace" && !hasSeenDirectNamespace && spec.name.trim() === "openclaw_direct";
+		if (isDirectNamespace) hasSeenDirectNamespace = true;
+		for (const tool of spec.type === "namespace" ? spec.tools : [spec]) {
+			const name = tool.name.trim();
+			if (tool.deferLoading === true && name) deferredToolNames.add(name);
+			hasSkillWorkshop ||= name === SKILL_WORKSHOP_TOOL_NAME;
+			hasSessionsSpawn ||= name === "sessions_spawn";
+			hasSessionsYield ||= isDirectNamespace && name === "sessions_yield";
+			messageToolAvailable ||= name === "message";
+		}
+	}
 	const nativeCommandGuidance = listRegisteredPluginAgentPromptGuidance({
 		surface: "codex_app_server",
 		includeLegacyGlobalGuidance: false
 	}).join("\n");
+	const nativeDelegationAvailable = params.disableTools !== true && params.delegationCapability !== "report_only" && !isMessageOnlyCodexSourceReply(params) && !isSystemAgentOnlyCodexDynamicToolAllowlist(params.toolsAllow) && !shouldDisableCodexToolSearchForModel(params.modelId);
+	const deferredToolDiscoveryGuidance = deferredToolNames.size > 0 || nativeDelegationAvailable ? "Deferred tools may be absent from the direct tool list. Use `tool_search` when directly callable. On code-mode-only models, use `exec` instead: filter `ALL_TOOLS` by name and description, then call the matching entry through `tools`." : void 0;
 	return [
 		"You are a personal agent running inside OpenClaw. OpenClaw has dynamic tools for OpenClaw-owned messaging, cron, sessions, media, gateway, and nodes.",
-		buildDeferredDynamicToolManifest(options.dynamicTools),
-		buildSkillWorkshopInstruction(options.dynamicTools),
-		"Use Codex native `spawn_agent` for Codex subagents. `spawn_agent` and the other native collaboration tools may be deferred: when `spawn_agent` is not directly listed, load it with `tool_search` before spawning. Use OpenClaw `sessions_spawn` only for OpenClaw or ACP delegation, never as a substitute for `spawn_agent`.",
-		buildVisibleReplyInstruction(params, options.dynamicTools),
+		deferredToolNames.size > 0 ? `Deferred searchable OpenClaw dynamic tools available: ${[...deferredToolNames].toSorted((left, right) => left.localeCompare(right)).join(", ")}.` : void 0,
+		deferredToolDiscoveryGuidance,
+		hasSkillWorkshop ? buildSkillWorkshopPromptSection().join("\n") : void 0,
+		nativeDelegationAvailable ? `Use Codex native \`spawn_agent\` for Codex subagents. \`spawn_agent\` and the other native collaboration tools may be deferred.${hasSessionsSpawn ? " Use OpenClaw `sessions_spawn` only for OpenClaw or ACP delegation, never as a substitute for `spawn_agent`." : ""}` : void 0,
+		hasSessionsYield && nativeDelegationAvailable ? "When a native child's result belongs in a later turn, end the current turn with `openclaw_direct.sessions_yield`; the completion arrives as the next model-visible input. Use native `wait_agent` only for an intentional same-turn wait when the immediate next step is blocked on the child. Never loop-poll for native child completion." : void 0,
+		buildVisibleReplyInstruction(params, messageToolAvailable),
+		TRANSCRIPT_CREDENTIAL_SAFETY_PROMPT,
 		nativeCommandGuidance,
 		params.extraSystemPrompt
 	].filter((section) => typeof section === "string" && section.trim()).join("\n\n");
 }
-function buildDeferredDynamicToolManifest(dynamicTools) {
-	const deferredToolNames = [...new Set(flattenCodexDynamicToolFunctions(dynamicTools).filter((tool) => tool.deferLoading === true).map((tool) => tool.name.trim()).filter(Boolean))].toSorted((left, right) => left.localeCompare(right));
-	if (deferredToolNames.length === 0) return;
-	return `Deferred searchable OpenClaw dynamic tools available: ${deferredToolNames.join(", ")}. Use \`tool_search\` to load exact callable specs before use.`;
-}
-function buildSkillWorkshopInstruction(dynamicTools) {
-	if (!flattenCodexDynamicToolFunctions(dynamicTools).some((tool) => tool.name.trim() === SKILL_WORKSHOP_TOOL_NAME)) return;
-	return buildSkillWorkshopPromptSection().join("\n");
-}
-function buildVisibleReplyInstruction(params, dynamicTools) {
-	const messageToolAvailable = dynamicTools ? flattenCodexDynamicToolFunctions(dynamicTools).some((tool) => tool.name.trim() === "message") : params.disableMessageTool !== true;
-	if (params.sourceReplyDeliveryMode === "message_tool_only" && messageToolAvailable) return "Visible source replies are not automatically delivered for this run. Use `message(action=send)` for user-visible source-channel output. For progress, set `final=false`. When the message is the completed reply to the current source conversation, set `final=true`; OpenClaw stops after confirming delivery. If `final` is omitted, OpenClaw continues and resolves the latest omitted source reply only when the turn ends successfully. Do not repeat visible message content in your final answer.";
-	if (messageToolAvailable) return "For the current source conversation, reply normally in your final assistant message; OpenClaw will deliver it through the active source conversation. Use `message` only for explicit out-of-band sends, media/file sends, or sends to a different target.";
+function buildVisibleReplyInstruction(params, messageToolAvailable) {
+	if (params.sourceReplyDeliveryMode === "message_tool_only" && messageToolAvailable) return "Visible source replies are not automatically delivered for this run. Use `message(action=send)` for user-visible source-channel output. For progress, set `final=false`. Set `final=true`, or omit it, for the completed reply to the current source conversation; OpenClaw stops after confirming delivery. Do not repeat visible message content in your final answer.";
+	if (messageToolAvailable) return "For the current source conversation, reply normally in your final assistant message; OpenClaw will deliver it through the active source conversation. Use `message` for supported non-text actions in the current conversation, such as reacting to its current message. Reserve other `message` actions for explicit out-of-band sends or media/file delivery. Reactions are not delivered automatically.";
 	return "For the current source conversation, reply normally in your final assistant message; OpenClaw will deliver it through the active source conversation.";
 }
 //#endregion
@@ -1636,16 +2013,13 @@ const CODEX_NATIVE_WEB_SEARCH_DISABLED_CONFIG = {
 	"features.standalone_web_search": false,
 	web_search: "disabled"
 };
-function normalizeOptionalString$1(value) {
-	return typeof value === "string" ? value.trim() || void 0 : void 0;
-}
 function normalizeUniqueStrings(value) {
 	if (!Array.isArray(value)) return;
-	const normalized = [...new Set(value.map(normalizeOptionalString$1).filter((entry) => Boolean(entry)))];
+	const normalized = [...new Set(value.map(normalizeOptionalString).filter((entry) => Boolean(entry)))];
 	return normalized.length > 0 ? normalized : void 0;
 }
 function hasManagedSearchProvider(config) {
-	return normalizeOptionalString$1(config?.tools?.web?.search?.provider) !== void 0;
+	return normalizeOptionalString(config?.tools?.web?.search?.provider) !== void 0;
 }
 function hasNativeDomainRestrictions(config) {
 	return normalizeUniqueStrings(config?.tools?.web?.search?.openaiCodex?.allowedDomains) !== void 0;
@@ -1660,10 +2034,10 @@ function buildCodexNativeWebSearchThreadConfig(config) {
 	if (allowedDomains) threadConfig["tools.web_search.allowed_domains"] = allowedDomains;
 	if (nativeConfig?.contextSize) threadConfig["tools.web_search.context_size"] = nativeConfig.contextSize;
 	const location = nativeConfig?.userLocation;
-	const country = normalizeOptionalString$1(location?.country);
-	const region = normalizeOptionalString$1(location?.region);
-	const city = normalizeOptionalString$1(location?.city);
-	const timezone = normalizeOptionalString$1(location?.timezone);
+	const country = normalizeOptionalString(location?.country);
+	const region = normalizeOptionalString(location?.region);
+	const city = normalizeOptionalString(location?.city);
+	const timezone = normalizeOptionalString(location?.timezone);
 	if (country) threadConfig["tools.web_search.location.country"] = country;
 	if (region) threadConfig["tools.web_search.location.region"] = region;
 	if (city) threadConfig["tools.web_search.location.city"] = city;
@@ -1710,26 +2084,50 @@ const CODEX_CODE_MODE_DISABLED_THREAD_CONFIG = {
 const CODEX_LIGHTWEIGHT_CONTEXT_THREAD_CONFIG = { project_doc_max_bytes: 0 };
 const CODEX_TOOL_SEARCH_UNSUPPORTED_THREAD_CONFIG = { "features.multi_agent": false };
 const CODEX_DELEGATION_DISABLED_THREAD_CONFIG = {
+	"agents.enabled": false,
 	"features.multi_agent": false,
 	"features.multi_agent_v2": false
 };
+const CODEX_RING_ZERO_RESTRICTED_FEATURES = /* @__PURE__ */ new Set([
+	"apps",
+	"artifact",
+	"browser_use",
+	"browser_use_external",
+	"browser_use_full_cdp_access",
+	"chronicle",
+	"code_mode",
+	"code_mode_only",
+	"computer_use",
+	"current_time_reminder",
+	"default_mode_request_user_input",
+	"deferred_executor",
+	"goals",
+	"hooks",
+	"image_generation",
+	"memories",
+	"multi_agent",
+	"multi_agent_v2",
+	"plugins",
+	"request_permissions_tool",
+	"skill_search",
+	"shell_tool",
+	"standalone_web_search",
+	"token_budget",
+	"unified_exec",
+	"view_image",
+	"web_search_cached",
+	"web_search_request",
+	"workspace_dependencies"
+]);
 const CODEX_RING_ZERO_THREAD_CONFIG = {
-	"features.apps": false,
-	"features.current_time_reminder": false,
-	"features.deferred_executor": false,
-	"features.enable_fanout": false,
-	"features.goals": false,
-	"features.hooks": false,
-	"features.image_generation": false,
-	"features.memories": false,
-	"features.multi_agent": false,
-	"features.multi_agent_v2": false,
-	"features.plugins": false,
-	"features.standalone_web_search": false,
-	"features.token_budget": false,
+	...CODEX_DELEGATION_DISABLED_THREAD_CONFIG,
+	...Object.fromEntries([...CODEX_RING_ZERO_RESTRICTED_FEATURES].map((feature) => [`features.${feature}`, false])),
 	"orchestrator.mcp.enabled": false,
 	"orchestrator.skills.enabled": false,
+	"skills.bundled.enabled": false,
+	"skills.include_instructions": false,
 	"tools.experimental_request_user_input.enabled": false,
+	"tools.update_plan.enabled": false,
 	hooks: {
 		PreToolUse: [],
 		PermissionRequest: [],
@@ -1746,22 +2144,13 @@ const CODEX_RING_ZERO_THREAD_CONFIG = {
 	notify: [],
 	web_search: "disabled"
 };
-const CODEX_RING_ZERO_RESTRICTED_FEATURES = /* @__PURE__ */ new Set([
-	"apps",
-	"code_mode",
-	"code_mode_only",
-	"current_time_reminder",
-	"deferred_executor",
-	"enable_fanout",
-	"goals",
-	"hooks",
-	"image_generation",
-	"memories",
-	"multi_agent",
-	"multi_agent_v2",
-	"plugins",
-	"standalone_web_search",
-	"token_budget"
+const CODEX_RING_ZERO_RESTRICTED_FEATURE_ALIASES = /* @__PURE__ */ new Map([
+	["connectors", "apps"],
+	["imagegenext", "image_generation"],
+	["collab", "multi_agent"],
+	["memory_tool", "memories"],
+	["telepathy", "chronicle"],
+	["codex_hooks", "hooks"]
 ]);
 const CODEX_RING_ZERO_OVERRIDABLE_LAYER_TYPES = /* @__PURE__ */ new Set([
 	"mdm",
@@ -1807,7 +2196,7 @@ function buildThreadStartParams(params, options) {
 			webSearchAllowed: options.webSearchAllowed,
 			appServer: options.appServer,
 			hostSystemAgentActive: options.hostSystemAgentActive,
-			ringZeroInheritedMcpServerNames: options.ringZeroInheritedMcpServerNames
+			restrictedToolSurfaceInheritedMcpServerNames: options.restrictedToolSurfaceInheritedMcpServerNames
 		}),
 		...resolveCodexThreadEnvironmentSelection(options),
 		developerInstructions: options.developerInstructions ?? buildDeveloperInstructions(params, { dynamicTools: options.dynamicTools }),
@@ -1856,7 +2245,7 @@ function buildThreadResumeParams(params, options) {
 			webSearchAllowed: options.webSearchAllowed,
 			appServer: options.appServer,
 			hostSystemAgentActive: options.hostSystemAgentActive,
-			ringZeroInheritedMcpServerNames: options.ringZeroInheritedMcpServerNames
+			restrictedToolSurfaceInheritedMcpServerNames: options.restrictedToolSurfaceInheritedMcpServerNames
 		}),
 		developerInstructions: options.developerInstructions ?? buildDeveloperInstructions(params, { dynamicTools: options.dynamicTools })
 	};
@@ -1895,9 +2284,15 @@ function resolveDirectOnlyToolNamespaces(dynamicTools) {
 }
 function buildCodexRuntimeThreadConfigForRun(params, config, options = {}) {
 	const ringZeroActive = (options.hostSystemAgentActive ?? isHostScopedAgentToolActive("openclaw")) && isSystemAgentOnlyCodexDynamicToolAllowlist(params.toolsAllow);
+	const messageOnlySourceReply = isMessageOnlyCodexSourceReply(params);
+	const restrictedToolSurface = ringZeroActive || messageOnlySourceReply || params.pluginHarnessToolPolicyRestricted === true;
 	const configMcpServers = config?.mcp_servers;
-	if (ringZeroActive && configMcpServers !== void 0 && !isJsonObject(configMcpServers)) throw new Error("Codex ring-zero received invalid thread mcp_servers config");
-	const ringZeroMcpServerNames = [...options.ringZeroInheritedMcpServerNames ?? [], ...isJsonObject(configMcpServers) ? Object.keys(configMcpServers) : []];
+	if (restrictedToolSurface && configMcpServers !== void 0 && !isJsonObject(configMcpServers)) throw new Error("Codex restricted tool surface received invalid thread mcp_servers config");
+	const restrictedToolSurfaceMcpServerNames = [...options.restrictedToolSurfaceInheritedMcpServerNames ?? [], ...isJsonObject(configMcpServers) ? Object.keys(configMcpServers) : []];
+	const restrictedRunConfig = restrictedToolSurface && isJsonObject(configMcpServers) ? {
+		...config,
+		mcp_servers: {}
+	} : config;
 	const webSearchConfig = resolveCodexWebSearchPlan({
 		config: params.config,
 		disableTools: params.disableTools,
@@ -1905,8 +2300,8 @@ function buildCodexRuntimeThreadConfigForRun(params, config, options = {}) {
 		nativeProviderWebSearchSupport: options.nativeProviderWebSearchSupport,
 		webSearchAllowed: options.webSearchAllowed
 	}).threadConfig;
-	const baseConfig = buildCodexRuntimeThreadConfig(mergeCodexThreadConfigs(config, webSearchConfig), options);
-	const runtimeConfig = mergeCodexThreadConfigs(baseConfig, options.appServer?.networkProxy?.configPatch, shouldDisableCodexToolSearchForModel(params.modelId) ? CODEX_TOOL_SEARCH_UNSUPPORTED_THREAD_CONFIG : void 0, params.delegationCapability === "report_only" ? CODEX_DELEGATION_DISABLED_THREAD_CONFIG : void 0, buildCodexRingZeroThreadConfigPatch(params, options.hostSystemAgentActive, ringZeroMcpServerNames)) ?? baseConfig;
+	const baseConfig = buildCodexRuntimeThreadConfig(mergeCodexThreadConfigs(restrictedRunConfig, webSearchConfig), options);
+	const runtimeConfig = mergeCodexThreadConfigs(baseConfig, options.appServer?.networkProxy?.configPatch, shouldDisableCodexToolSearchForModel(params.modelId) ? CODEX_TOOL_SEARCH_UNSUPPORTED_THREAD_CONFIG : void 0, params.delegationCapability === "report_only" ? CODEX_DELEGATION_DISABLED_THREAD_CONFIG : void 0, messageOnlySourceReply || params.pluginHarnessToolPolicyRestricted === true ? buildCodexRestrictedToolThreadConfigPatch(restrictedToolSurfaceMcpServerNames) : buildCodexRingZeroThreadConfigPatch(params, options.hostSystemAgentActive, restrictedToolSurfaceMcpServerNames)) ?? baseConfig;
 	if (params.bootstrapContextMode !== "lightweight") return runtimeConfig;
 	return mergeCodexThreadConfigs(runtimeConfig, CODEX_LIGHTWEIGHT_CONTEXT_THREAD_CONFIG) ?? {
 		...runtimeConfig,
@@ -1915,6 +2310,9 @@ function buildCodexRuntimeThreadConfigForRun(params, config, options = {}) {
 }
 function buildCodexRingZeroThreadConfigPatch(params, hostSystemAgentActive = isHostScopedAgentToolActive("openclaw"), inheritedMcpServerNames = []) {
 	if (!hostSystemAgentActive || !isSystemAgentOnlyCodexDynamicToolAllowlist(params.toolsAllow)) return;
+	return buildCodexRestrictedToolThreadConfigPatch(inheritedMcpServerNames);
+}
+function buildCodexRestrictedToolThreadConfigPatch(inheritedMcpServerNames) {
 	const mcpServers = Object.fromEntries([...new Set(inheritedMcpServerNames)].toSorted().map((name) => [name, { enabled: false }]));
 	return {
 		...CODEX_RING_ZERO_THREAD_CONFIG,
@@ -1930,15 +2328,15 @@ async function readCodexInheritedMcpServerNames(client, cwd, signal) {
 	if (!Array.isArray(response.layers)) throw new Error("Codex config/read omitted effective config layers");
 	for (const layer of response.layers) {
 		if (!isJsonObject(layer) || !isJsonObject(layer.name) || typeof layer.name.type !== "string") throw new Error("Codex config/read returned invalid effective config layers");
-		if (layer.name.type === "legacyManagedConfigTomlFromFile" || layer.name.type === "legacyManagedConfigTomlFromMdm") throw new Error(`Codex ring-zero cannot override config layer ${layer.name.type}`);
-		if (!CODEX_RING_ZERO_OVERRIDABLE_LAYER_TYPES.has(layer.name.type)) throw new Error(`Codex ring-zero does not recognize config layer ${layer.name.type}`);
+		if (layer.name.type === "legacyManagedConfigTomlFromFile" || layer.name.type === "legacyManagedConfigTomlFromMdm") throw new Error(`Codex restricted tool surface cannot override config layer ${layer.name.type}`);
+		if (!CODEX_RING_ZERO_OVERRIDABLE_LAYER_TYPES.has(layer.name.type)) throw new Error(`Codex restricted tool surface does not recognize config layer ${layer.name.type}`);
 	}
 	const configuredServers = response.config.mcp_servers;
 	if (configuredServers === void 0) return [];
 	if (!isJsonObject(configuredServers)) throw new Error("Codex config/read returned invalid mcp_servers");
 	return Object.keys(configuredServers).toSorted();
 }
-async function assertCodexRingZeroHasNoManagedHooks(client, signal) {
+async function assertCodexRestrictedToolSurfaceHasNoManagedHooks(client, signal) {
 	const response = await client.request("configRequirements/read", void 0, { signal });
 	if (!isJsonObject(response) || !Object.hasOwn(response, "requirements")) throw new Error("Codex configRequirements/read returned an invalid response");
 	if (response.requirements === null) return;
@@ -1951,7 +2349,7 @@ async function assertCodexRingZeroHasNoManagedHooks(client, signal) {
 		const hooks = response.requirements[key];
 		if (hooks === void 0 || hooks === null) continue;
 		if (!isJsonObject(hooks)) throw new Error("Codex configRequirements/read returned invalid managed hooks");
-		if (hasNonEmptyJsonValue(hooks)) throw new Error("Codex ring-zero cannot override managed hooks");
+		if (hasNonEmptyJsonValue(hooks)) throw new Error("Codex restricted tool surface cannot override managed hooks");
 	}
 	for (const key of ["featureRequirements", "feature_requirements"]) {
 		const requirements = response.requirements[key];
@@ -1959,22 +2357,35 @@ async function assertCodexRingZeroHasNoManagedHooks(client, signal) {
 		if (!isJsonObject(requirements)) throw new Error("Codex configRequirements/read returned invalid feature requirements");
 		for (const [feature, enabled] of Object.entries(requirements)) {
 			if (typeof enabled !== "boolean") throw new Error("Codex configRequirements/read returned invalid feature requirements");
-			if (enabled && CODEX_RING_ZERO_RESTRICTED_FEATURES.has(feature)) throw new Error(`Codex ring-zero cannot override required feature ${feature}`);
+			const canonicalFeature = CODEX_RING_ZERO_RESTRICTED_FEATURE_ALIASES.get(feature) ?? feature;
+			if (enabled && CODEX_RING_ZERO_RESTRICTED_FEATURES.has(canonicalFeature)) throw new Error(`Codex restricted tool surface cannot override required feature ${feature}`);
 		}
 	}
 }
-async function attestCodexRingZeroThreadHasNoMcpServers(client, threadId, signal) {
+async function attestCodexRestrictedToolSurfaceMcpServersDisabled(client, threadId, threadConfig, signal) {
+	const configuredServers = threadConfig?.mcp_servers;
+	if (configuredServers !== void 0 && !isJsonObject(configuredServers)) throw new Error("Codex restricted-tool-surface thread config has invalid mcp_servers");
+	const expectedDisabledServerNames = /* @__PURE__ */ new Set();
+	for (const [name, serverConfig] of Object.entries(configuredServers ?? {})) {
+		if (!isJsonObject(serverConfig) || serverConfig.enabled !== false) throw new Error(`Codex restricted-tool-surface MCP server ${name} is not disabled`);
+		expectedDisabledServerNames.add(name);
+	}
 	const response = await client.request("mcpServerStatus/list", {
 		threadId,
-		limit: 1,
 		detail: "toolsAndAuthOnly"
 	}, { signal });
-	if (!isJsonObject(response) || !Array.isArray(response.data)) throw new Error("Codex mcpServerStatus/list returned an invalid ring-zero attestation");
-	if (response.data.length > 0) {
-		const first = response.data[0];
-		const serverName = isJsonObject(first) && typeof first.name === "string" ? first.name : "unknown";
-		throw new Error(`Codex ring-zero MCP attestation found server ${serverName}`);
+	if (!isJsonObject(response) || !Array.isArray(response.data)) throw new Error("Codex mcpServerStatus/list returned an invalid restricted-tool-surface attestation");
+	const observedDisabledServerNames = /* @__PURE__ */ new Set();
+	for (const status of response.data) {
+		if (!isJsonObject(status) || typeof status.name !== "string" || !isJsonObject(status.tools)) throw new Error("Codex mcpServerStatus/list returned an invalid restricted-tool-surface server");
+		if (!expectedDisabledServerNames.has(status.name)) throw new Error(`Codex restricted-tool-surface MCP attestation found unexpected server ${status.name}`);
+		if (observedDisabledServerNames.has(status.name)) throw new Error(`Codex restricted-tool-surface MCP attestation returned duplicate server ${status.name}`);
+		observedDisabledServerNames.add(status.name);
+		if (!Object.hasOwn(status, "serverInfo")) throw new Error(`Codex restricted-tool-surface MCP attestation returned malformed server ${status.name}`);
+		if (status.serverInfo !== null) throw new Error(`Codex restricted-tool-surface MCP attestation found active server ${status.name}`);
+		if (Object.keys(status.tools).length > 0) throw new Error(`Codex restricted-tool-surface MCP attestation found tools for server ${status.name}`);
 	}
+	for (const expectedName of expectedDisabledServerNames) if (!observedDisabledServerNames.has(expectedName)) throw new Error(`Codex restricted-tool-surface MCP attestation is missing server ${expectedName}`);
 	if (response.nextCursor !== void 0 && response.nextCursor !== null) throw new Error("Codex mcpServerStatus/list returned an invalid empty-page cursor");
 }
 function hasNonEmptyJsonValue(value) {
@@ -1996,47 +2407,26 @@ function resolveCodexThreadEnvironmentSelection(options) {
 	return {};
 }
 //#endregion
-//#region extensions/codex/src/app-server/thread-resume.ts
-/** Owns Codex thread/resume subscription safety. */
-/** Resumes one thread and retires the physical client when acceptance is indeterminate. */
-async function resumeCodexAppServerThread(params) {
-	const threadId = params.request.threadId;
-	let response;
-	try {
-		response = assertCodexThreadResumeResponse(await params.client.request("thread/resume", params.request, {
-			...params.timeoutMs !== void 0 ? { timeoutMs: params.timeoutMs } : {},
-			...params.signal ? { signal: params.signal } : {}
-		}));
-		assertCodexThreadResumeSubscription(threadId, response.thread.id);
-	} catch (error) {
-		if (isCodexAppServerStartSelectionChangedError(error) || isCodexAppServerPrewriteRequestCancellationError(error)) throw error;
-		if (error instanceof CodexAppServerRpcError) throw error;
-		try {
-			await params.abandonClient();
-		} catch (abandonError) {
-			throw new CodexAppServerUnsafeSubscriptionError(`Codex thread/resume client could not be retired for ${threadId}`, { cause: abandonError });
-		}
-		if (error instanceof CodexAppServerUnsafeSubscriptionError) throw error;
-		throw new CodexAppServerUnsafeSubscriptionError(error instanceof Error ? error.message : `Codex thread/resume outcome is indeterminate for ${threadId}`, { cause: error });
-	}
-	return response;
-}
-//#endregion
 //#region extensions/codex/src/app-server/thread-lifecycle-io.ts
+function resolveCodexThreadRolloutPath(thread) {
+	const rolloutPath = thread.path?.trim();
+	if (!rolloutPath || !path.isAbsolute(rolloutPath) || path.extname(rolloutPath) !== ".jsonl" || !path.basename(rolloutPath).includes(thread.id)) return;
+	return rolloutPath;
+}
 async function resumeExistingCodexThread(params, context) {
-	const { binding: resumeBinding, bindingIdentity, startModelSelection, startModelProvider, userMcpServersConfigPatch, dynamicToolsFingerprint, dynamicToolsContainDeferred, webSearchThreadConfigFingerprint, userMcpServersFingerprint, ringZeroConfigFingerprint, ringZeroClientInstanceId, networkProxyConfigFingerprint, contextEngineBinding, environmentSelectionFingerprint, hostSystemAgentActive, ringZeroActive, ringZeroInheritedMcpServerNames, lifecycleTiming, normalizeBindingModelProvider, throwIfAborted, clearCurrentBinding } = context;
+	const { binding: resumeBinding, bindingIdentity, startModelSelection, startModelProvider, userMcpServersConfigPatch, dynamicToolsFingerprint, dynamicToolsContainDeferred, webSearchThreadConfigFingerprint, nativeSkillIsolationFingerprint, userMcpServersFingerprint, ringZeroConfigFingerprint, ringZeroClientInstanceId, networkProxyConfigFingerprint, contextEngineBinding, environmentSelectionFingerprint, hostSystemAgentActive, ringZeroActive, restrictedToolSurface, restrictedToolSurfaceInheritedMcpServerNames, nativeSkillIsolation, lifecycleTiming, normalizeBindingModelProvider, throwIfAborted, clearCurrentBinding } = context;
 	let resumeReservation;
 	try {
 		const authProfileId = resumeBinding.connectionScope === "supervision" ? void 0 : params.params.authProfileId ?? resumeBinding.authProfileId;
-		const finalConfigPatch = params.buildFinalConfigPatch?.({
+		const finalConfigPatch = context.prebuiltFinalConfigPatch ?? params.buildFinalConfigPatch?.({
 			action: "resume",
 			binding: resumeBinding
 		}) ?? {
 			configPatch: params.finalConfigPatch,
 			nativeHookRelayGeneration: params.nativeHookRelayGeneration
 		};
-		const pluginAppsConfigPatch = params.pluginThreadConfig?.enabled && resumeBinding.pluginAppPolicyContext ? buildCodexPluginAppsConfigPatchFromPolicyContext(resumeBinding.pluginAppPolicyContext) : void 0;
-		const resumeConfig = mergeCodexThreadConfigs(params.config, userMcpServersConfigPatch, pluginAppsConfigPatch, finalConfigPatch.configPatch);
+		const pluginAppsConfigPatch = context.prebuiltPluginThreadConfig?.configPatch ?? (params.pluginThreadConfig?.enabled && resumeBinding.pluginAppPolicyContext ? buildCodexPluginAppsConfigPatchFromPolicyContext(resumeBinding.pluginAppPolicyContext) : void 0);
+		const resumeConfig = applyCodexNativeSkillIsolation(mergeCodexThreadConfigs(params.config, userMcpServersConfigPatch, pluginAppsConfigPatch, finalConfigPatch.configPatch), nativeSkillIsolation);
 		const resumeParams = lifecycleTiming.measureSync("thread-resume-params", () => buildThreadResumeParams(params.params, {
 			threadId: resumeBinding.threadId,
 			authProfileId,
@@ -2052,7 +2442,7 @@ async function resumeExistingCodexThread(params, context) {
 			nativeCodeModeOnlyEnabled: params.nativeCodeModeOnlyEnabled,
 			webSearchAllowed: params.webSearchAllowed,
 			hostSystemAgentActive,
-			ringZeroInheritedMcpServerNames
+			restrictedToolSurfaceInheritedMcpServerNames
 		}));
 		const requestModelProvider = typeof resumeParams.modelProvider === "string" && resumeParams.modelProvider.trim() ? resumeParams.modelProvider : void 0;
 		throwIfAborted();
@@ -2071,17 +2461,19 @@ async function resumeExistingCodexThread(params, context) {
 			request: resumeParams,
 			signal: params.signal
 		}));
-		if (ringZeroActive) try {
-			await lifecycleTiming.measure("ring-zero-mcp-attestation", () => attestCodexRingZeroThreadHasNoMcpServers(params.client, response.thread.id, params.signal));
+		if (ringZeroActive || isMessageOnlyCodexSourceReply(params.params) || params.params.pluginHarnessToolPolicyRestricted === true) try {
+			await lifecycleTiming.measure("restricted-tool-surface-mcp-attestation", () => attestCodexRestrictedToolSurfaceMcpServersDisabled(params.client, response.thread.id, resumeParams.config, params.signal));
 		} catch (error) {
 			await (params.abandonClient ?? (() => closeCodexStartupClientBestEffort(params.client)))();
-			throw new CodexRingZeroAttestationError(error);
+			throw new CodexRestrictedToolSurfaceAttestationError(error);
 		}
 		throwIfAborted();
 		const boundAuthProfileId = authProfileId;
 		const nextMcpServersFingerprint = params.mcpServersFingerprintEvaluated === true ? params.mcpServersFingerprint : resumeBinding.mcpServersFingerprint;
 		const resumePatch = {
+			clientId: resolveCodexAppServerClientInstanceId(params.client),
 			cwd: params.cwd,
+			rolloutPath: resolveCodexThreadRolloutPath(response.thread) ?? resumeBinding.rolloutPath,
 			authProfileId: boundAuthProfileId,
 			model: response.model ?? resumeParams.model ?? params.params.modelId,
 			preserveNativeModel: resumeBinding.preserveNativeModel === true ? true : void 0,
@@ -2089,17 +2481,20 @@ async function resumeExistingCodexThread(params, context) {
 			dynamicToolsFingerprint,
 			dynamicToolsContainDeferred,
 			webSearchThreadConfigFingerprint,
+			nativeSkillIsolationFingerprint,
 			userMcpServersFingerprint,
 			mcpServersFingerprint: nextMcpServersFingerprint,
+			configuredMcpOwnershipVersion: params.configuredMcpOwnershipVersion,
 			ringZeroConfigFingerprint,
 			ringZeroClientInstanceId,
+			nativeToolPolicyRestricted: restrictedToolSurface ? true : void 0,
 			networkProxyProfileName: params.appServer.networkProxy?.profileName,
 			networkProxyConfigFingerprint,
 			nativeHookRelayGeneration: finalConfigPatch.nativeHookRelayGeneration ?? resumeBinding.nativeHookRelayGeneration,
 			appServerRuntimeFingerprint: resumeBinding.connectionScope === "supervision" ? buildCodexAppServerConnectionFingerprint(params.appServer, params.params.agentDir) : params.appServerRuntimeFingerprint,
-			pluginAppsFingerprint: resumeBinding.pluginAppsFingerprint,
-			pluginAppsInputFingerprint: resumeBinding.pluginAppsInputFingerprint,
-			pluginAppPolicyContext: resumeBinding.pluginAppPolicyContext,
+			pluginAppsFingerprint: context.prebuiltPluginThreadConfig?.fingerprint ?? resumeBinding.pluginAppsFingerprint,
+			pluginAppsInputFingerprint: context.prebuiltPluginThreadConfig?.inputFingerprint ?? resumeBinding.pluginAppsInputFingerprint,
+			pluginAppPolicyContext: context.prebuiltPluginThreadConfig?.policyContext ?? resumeBinding.pluginAppPolicyContext,
 			contextEngine: contextEngineBinding,
 			environmentSelectionFingerprint
 		};
@@ -2130,6 +2525,13 @@ async function resumeExistingCodexThread(params, context) {
 			...resumeBinding,
 			threadId: response.thread.id,
 			...resumePatch,
+			liveThreadConfigFingerprint: fingerprintCodexThreadConfig({
+				...resumeParams,
+				model: resumeBinding.preserveNativeModel === true ? null : response.model ?? resumeParams.model ?? null,
+				requestedModel: resumeBinding.preserveNativeModel === true ? null : resumeParams.model ?? null,
+				modelProvider: resumeBinding.preserveNativeModel === true ? null : resumePatch.modelProvider ?? null,
+				requestedModelProvider: resumeBinding.preserveNativeModel === true ? null : resumeParams.modelProvider ?? resumePatch.modelProvider ?? null
+			}, authProfileId, dynamicToolsFingerprint),
 			lifecycle: {
 				action: "resumed",
 				...activeTurnIds.length ? { activeTurnIds } : {}
@@ -2138,8 +2540,8 @@ async function resumeExistingCodexThread(params, context) {
 	} catch (error) {
 		resumeReservation?.release();
 		if (isCodexAppServerStartSelectionChangedError(error)) throw error;
-		if (error instanceof CodexRingZeroAttestationError) {
-			await clearCurrentBinding("retiring a failed ring-zero thread attestation");
+		if (error instanceof CodexRestrictedToolSurfaceAttestationError) {
+			await clearCurrentBinding("retiring a failed restricted-tool-surface attestation");
 			throw error;
 		}
 		if (error instanceof CodexAdoptedThreadActiveError) throw error;
@@ -2156,13 +2558,13 @@ async function resumeExistingCodexThread(params, context) {
 }
 async function startFreshCodexThread(params, context) {
 	const clientId = resolveCodexAppServerClientInstanceId(params.client);
-	const { bindingIdentity, startModelSelection, startModelProvider, userMcpServersConfigPatch, dynamicToolsFingerprint, dynamicToolsContainDeferred, webSearchThreadConfigFingerprint, userMcpServersFingerprint, ringZeroConfigFingerprint, ringZeroClientInstanceId, networkProxyConfigFingerprint, contextEngineBinding, environmentSelectionFingerprint, hostSystemAgentActive, ringZeroActive, ringZeroInheritedMcpServerNames, lifecycleTiming, normalizeBindingModelProvider, throwIfAborted, prebuiltPluginThreadConfig, preserveExistingBinding, rotatedContextEngineBinding } = context;
+	const { bindingIdentity, startModelSelection, startModelProvider, userMcpServersConfigPatch, dynamicToolsFingerprint, dynamicToolsContainDeferred, webSearchThreadConfigFingerprint, nativeSkillIsolationFingerprint, userMcpServersFingerprint, ringZeroConfigFingerprint, ringZeroClientInstanceId, networkProxyConfigFingerprint, contextEngineBinding, environmentSelectionFingerprint, hostSystemAgentActive, ringZeroActive, restrictedToolSurface, restrictedToolSurfaceInheritedMcpServerNames, nativeSkillIsolation, lifecycleTiming, normalizeBindingModelProvider, throwIfAborted, prebuiltPluginThreadConfig, preserveExistingBinding, rotatedContextEngineBinding, replacementPredecessor } = context;
 	const pluginThreadConfig = params.pluginThreadConfig?.enabled ? prebuiltPluginThreadConfig ?? await lifecycleTiming.measure("plugin-config-build", () => params.pluginThreadConfig?.build()) : void 0;
 	const finalConfigPatch = params.buildFinalConfigPatch?.({ action: "start" }) ?? {
 		configPatch: params.finalConfigPatch,
 		nativeHookRelayGeneration: params.nativeHookRelayGeneration
 	};
-	const config = lifecycleTiming.measureSync("merge-thread-config", () => mergeCodexThreadConfigs(params.config, userMcpServersConfigPatch, pluginThreadConfig?.configPatch, finalConfigPatch.configPatch));
+	const config = lifecycleTiming.measureSync("merge-thread-config", () => applyCodexNativeSkillIsolation(mergeCodexThreadConfigs(params.config, userMcpServersConfigPatch, pluginThreadConfig?.configPatch, finalConfigPatch.configPatch), nativeSkillIsolation));
 	const startParams = lifecycleTiming.measureSync("thread-start-params", () => buildThreadStartParams(params.params, {
 		cwd: params.cwd,
 		dynamicTools: params.dynamicTools,
@@ -2177,7 +2579,7 @@ async function startFreshCodexThread(params, context) {
 		model: startModelSelection.model,
 		modelProvider: startModelProvider,
 		hostSystemAgentActive,
-		ringZeroInheritedMcpServerNames
+		restrictedToolSurfaceInheritedMcpServerNames
 	}));
 	const requestModelProvider = typeof startParams.modelProvider === "string" && startParams.modelProvider.trim() ? startParams.modelProvider : void 0;
 	const response = assertCodexThreadStartResponse(await lifecycleTiming.measure("thread-start-request", async () => {
@@ -2188,13 +2590,47 @@ async function startFreshCodexThread(params, context) {
 			throw error;
 		}
 	}));
-	if (ringZeroActive) try {
-		await lifecycleTiming.measure("ring-zero-mcp-attestation", () => attestCodexRingZeroThreadHasNoMcpServers(params.client, response.thread.id, params.signal));
+	const provisionalAppIds = pluginThreadConfig?.provisionalAppIds;
+	if (provisionalAppIds?.length) try {
+		await lifecycleTiming.measure("plugin-app-attestation", () => attestCodexPluginThreadApps({
+			client: params.client,
+			threadId: response.thread.id,
+			appIds: provisionalAppIds,
+			signal: params.signal
+		}));
+	} catch (error) {
+		if (!await discardUnattestedCodexPluginThread({
+			client: params.client,
+			threadId: response.thread.id,
+			ephemeral: startParams.ephemeral === true
+		})) {
+			await (params.abandonClient ?? (() => closeCodexStartupClientBestEffort(params.client)))();
+			throw new CodexAppServerUnsafeSubscriptionError("Codex plugin app attestation cleanup failed", { cause: error });
+		}
+		throw error;
+	}
+	const rolloutPath = resolveCodexThreadRolloutPath(response.thread);
+	if (ringZeroActive || isMessageOnlyCodexSourceReply(params.params) || params.params.pluginHarnessToolPolicyRestricted === true) try {
+		await lifecycleTiming.measure("restricted-tool-surface-mcp-attestation", () => attestCodexRestrictedToolSurfaceMcpServersDisabled(params.client, response.thread.id, startParams.config, params.signal));
 	} catch (error) {
 		await (params.abandonClient ?? (() => closeCodexStartupClientBestEffort(params.client)))();
 		throw error;
 	}
-	throwIfAborted();
+	try {
+		throwIfAborted();
+	} catch (error) {
+		if (replacementPredecessor) {
+			if (!await discardUnattestedCodexPluginThread({
+				client: params.client,
+				threadId: response.thread.id,
+				ephemeral: startParams.ephemeral === true
+			})) {
+				await (params.abandonClient ?? (() => closeCodexStartupClientBestEffort(params.client)))();
+				throw new CodexAppServerUnsafeSubscriptionError("Codex successor cleanup failed after an aborted binding replacement", { cause: error });
+			}
+		}
+		throw error;
+	}
 	const modelProvider = resolveCodexAppServerModelProvider({
 		provider: params.params.provider,
 		authProfileId: params.params.authProfileId,
@@ -2202,36 +2638,66 @@ async function startFreshCodexThread(params, context) {
 		agentDir: params.params.agentDir,
 		config: params.params.config
 	});
+	const bindingModelProvider = normalizeBindingModelProvider(params.params.authProfileId, response.modelProvider ?? requestModelProvider ?? startModelProvider ?? modelProvider);
 	const nextMcpServersFingerprint = params.mcpServersFingerprintEvaluated === true ? params.mcpServersFingerprint : void 0;
 	if (!preserveExistingBinding) {
-		if (!await lifecycleTiming.measure("thread-start-write-binding", () => params.bindingStore.mutate(bindingIdentity, {
-			kind: "set",
-			if: { kind: "absent" },
-			binding: {
+		const nextBinding = {
+			threadId: response.thread.id,
+			...clientId ? { clientId } : {},
+			cwd: params.cwd,
+			...rolloutPath ? { rolloutPath } : {},
+			authProfileId: params.params.authProfileId,
+			model: response.model ?? startParams.model ?? params.params.modelId,
+			modelProvider: bindingModelProvider,
+			dynamicToolsFingerprint,
+			dynamicToolsContainDeferred,
+			webSearchThreadConfigFingerprint,
+			nativeSkillIsolationFingerprint,
+			userMcpServersFingerprint,
+			mcpServersFingerprint: nextMcpServersFingerprint,
+			configuredMcpOwnershipVersion: params.configuredMcpOwnershipVersion,
+			ringZeroConfigFingerprint,
+			ringZeroClientInstanceId,
+			nativeToolPolicyRestricted: restrictedToolSurface ? true : void 0,
+			networkProxyProfileName: params.appServer.networkProxy?.profileName,
+			networkProxyConfigFingerprint,
+			nativeHookRelayGeneration: finalConfigPatch.nativeHookRelayGeneration,
+			appServerRuntimeFingerprint: params.appServerRuntimeFingerprint,
+			pluginAppsFingerprint: pluginThreadConfig?.fingerprint,
+			pluginAppsInputFingerprint: pluginThreadConfig?.inputFingerprint,
+			pluginAppPolicyContext: pluginThreadConfig?.policyContext,
+			contextEngine: contextEngineBinding,
+			environmentSelectionFingerprint
+		};
+		const cleanupUncommittedSuccessor = async (cause) => {
+			if (!await discardUnattestedCodexPluginThread({
+				client: params.client,
 				threadId: response.thread.id,
-				...clientId ? { clientId } : {},
-				cwd: params.cwd,
-				authProfileId: params.params.authProfileId,
-				model: response.model ?? startParams.model ?? params.params.modelId,
-				modelProvider: normalizeBindingModelProvider(params.params.authProfileId, response.modelProvider ?? requestModelProvider ?? startModelProvider ?? modelProvider),
-				dynamicToolsFingerprint,
-				dynamicToolsContainDeferred,
-				webSearchThreadConfigFingerprint,
-				userMcpServersFingerprint,
-				mcpServersFingerprint: nextMcpServersFingerprint,
-				ringZeroConfigFingerprint,
-				ringZeroClientInstanceId,
-				networkProxyProfileName: params.appServer.networkProxy?.profileName,
-				networkProxyConfigFingerprint,
-				nativeHookRelayGeneration: finalConfigPatch.nativeHookRelayGeneration,
-				appServerRuntimeFingerprint: params.appServerRuntimeFingerprint,
-				pluginAppsFingerprint: pluginThreadConfig?.fingerprint,
-				pluginAppsInputFingerprint: pluginThreadConfig?.inputFingerprint,
-				pluginAppPolicyContext: pluginThreadConfig?.policyContext,
-				contextEngine: contextEngineBinding,
-				environmentSelectionFingerprint
+				ephemeral: startParams.ephemeral === true
+			})) {
+				await (params.abandonClient ?? (() => closeCodexStartupClientBestEffort(params.client)))();
+				throw new CodexAppServerUnsafeSubscriptionError("Codex successor cleanup failed after a binding replacement conflict", cause === void 0 ? void 0 : { cause });
 			}
-		}))) throw new CodexThreadBindingConflictError(response.thread.id, "committing a fresh thread");
+		};
+		let committed;
+		try {
+			committed = await lifecycleTiming.measure("thread-start-write-binding", () => params.bindingStore.mutate(bindingIdentity, replacementPredecessor ? {
+				kind: "replace-thread",
+				expectedThreadId: replacementPredecessor.threadId,
+				binding: nextBinding
+			} : {
+				kind: "set",
+				if: { kind: "absent" },
+				binding: nextBinding
+			}));
+		} catch (error) {
+			if (replacementPredecessor) await cleanupUncommittedSuccessor(error);
+			throw error;
+		}
+		if (!committed) {
+			if (replacementPredecessor) await cleanupUncommittedSuccessor();
+			throw new CodexThreadBindingConflictError(replacementPredecessor?.threadId ?? response.thread.id, "committing a fresh thread");
+		}
 		if (contextEngineBinding) embeddedAgentLog.info("codex app-server wrote context-engine thread binding", {
 			sessionId: params.params.sessionId,
 			sessionKey: params.params.sessionKey,
@@ -2254,13 +2720,16 @@ async function startFreshCodexThread(params, context) {
 		threadId: response.thread.id,
 		...clientId ? { clientId } : {},
 		cwd: params.cwd,
+		...rolloutPath ? { rolloutPath } : {},
 		authProfileId: params.params.authProfileId,
 		model: response.model ?? startParams.model ?? params.params.modelId,
 		modelProvider: response.modelProvider ?? requestModelProvider ?? startModelProvider ?? modelProvider,
 		dynamicToolsFingerprint,
 		dynamicToolsContainDeferred,
+		nativeSkillIsolationFingerprint,
 		userMcpServersFingerprint,
 		mcpServersFingerprint: nextMcpServersFingerprint,
+		configuredMcpOwnershipVersion: params.configuredMcpOwnershipVersion,
 		ringZeroConfigFingerprint,
 		ringZeroClientInstanceId,
 		networkProxyProfileName: params.appServer.networkProxy?.profileName,
@@ -2272,6 +2741,13 @@ async function startFreshCodexThread(params, context) {
 		pluginAppPolicyContext: pluginThreadConfig?.policyContext,
 		contextEngine: contextEngineBinding,
 		environmentSelectionFingerprint,
+		...!preserveExistingBinding ? { liveThreadConfigFingerprint: fingerprintCodexThreadConfig({
+			...startParams,
+			model: response.model ?? startParams.model ?? null,
+			requestedModel: startParams.model ?? null,
+			modelProvider: bindingModelProvider ?? null,
+			requestedModelProvider: startParams.modelProvider ?? bindingModelProvider ?? null
+		}, params.params.authProfileId, dynamicToolsFingerprint) } : {},
 		lifecycle: {
 			action: "started",
 			...rotatedContextEngineBinding ? { rotatedContextEngineBinding } : {}
@@ -2279,6 +2755,13 @@ async function startFreshCodexThread(params, context) {
 	};
 }
 //#endregion
+//#region extensions/codex/src/app-server/profiler-flag.ts
+const PROFILER_FLAGS = ["profiler", "codex.profiler"];
+/** Checks the generic and Codex-specific profiler diagnostic flags. */
+function isCodexAppServerProfilerEnabled(config, env = process.env) {
+	return PROFILER_FLAGS.some((flag) => isDiagnosticFlagEnabled(flag, config, env));
+}
+//#endregion
 //#region extensions/codex/src/app-server/thread-lifecycle-timing.ts
 const CODEX_THREAD_LIFECYCLE_TIMING_WARN_TOTAL_MS = 1e3;
 const CODEX_THREAD_LIFECYCLE_TIMING_WARN_STAGE_MS = 500;
@@ -2368,6 +2851,193 @@ function createCodexThreadLifecycleTimingTracker(options = {}) {
 	};
 }
 //#endregion
+//#region extensions/codex/src/app-server/thread-lifecycle-preflight.ts
+async function prepareCodexThreadLifecyclePreflight(params) {
+	const lifecycleTiming = createCodexThreadLifecycleTimingTracker({
+		...params.timing,
+		enabled: params.timing?.enabled ?? isCodexAppServerProfilerEnabled(params.params.config)
+	});
+	const legacyDynamicToolsFingerprint = lifecycleTiming.measureSync("legacy-dynamic-tools-fingerprint", () => codexLegacyDynamicToolsFingerprint(params.dynamicTools));
+	const dynamicToolsFingerprint = lifecycleTiming.measureSync("dynamic-tools-fingerprint", () => hashCodexAppServerBindingFingerprint(legacyDynamicToolsFingerprint));
+	const dynamicToolsContainDeferred = flattenCodexDynamicToolFunctions(params.dynamicTools).some((tool) => tool.deferLoading === true);
+	const webSearchThreadConfigFingerprint = fingerprintJsonObject(lifecycleTiming.measureSync("web-search-plan", () => resolveCodexWebSearchPlan({
+		config: params.params.config,
+		disableTools: params.params.disableTools,
+		nativeToolSurfaceEnabled: params.nativeCodeModeEnabled,
+		nativeProviderWebSearchSupport: params.nativeProviderWebSearchSupport,
+		webSearchAllowed: params.webSearchAllowed
+	})).threadConfig);
+	const networkProxyConfigFingerprint = params.appServer.networkProxy?.configFingerprint;
+	const contextEngineBinding = lifecycleTiming.measureSync("context-engine-binding", () => buildContextEngineBinding(params.params, params.contextEngineProjection));
+	const userMcpServersConfigPatch = params.userMcpServersEnabled === false ? void 0 : await buildCodexUserMcpServersThreadConfigPatchForRuntime(params.params.config, {
+		agentId: params.agentId ?? params.params.agentId,
+		agentDir: params.params.agentDir,
+		allowLiteralOAuthProjection: params.appServer.connectionClass !== "remote",
+		toolOverrides: params.params.toolOverrides,
+		onServerUnavailable: (serverName, error) => embeddedAgentLog.warn("skipping unavailable MCP OAuth server", {
+			serverName,
+			error: formatErrorMessage(error)
+		})
+	});
+	const nativeSkillIsolation = await lifecycleTiming.measure("native-skill-isolation", () => resolveCodexNativeSkillIsolation({
+		client: params.client,
+		codexHome: params.appServer.start.env?.CODEX_HOME,
+		cwd: params.cwd,
+		home: params.appServer.start.env?.HOME,
+		signal: params.signal,
+		userProfile: params.appServer.start.env?.USERPROFILE
+	}));
+	const nativeSkillIsolationFingerprint = nativeSkillIsolation ? fingerprintJsonObject({
+		version: 1,
+		disabledUserSkillPaths: nativeSkillIsolation.disabledUserSkillPaths
+	}) : void 0;
+	const legacyUserMcpServersFingerprint = legacyFingerprintUserMcpServersConfigPatch(userMcpServersConfigPatch);
+	const userMcpServersFingerprint = fingerprintUserMcpServersConfigPatch(userMcpServersConfigPatch);
+	const environmentSelectionFingerprint = fingerprintEnvironmentSelection(params.environmentSelection);
+	const hostSystemAgentActive = params.hostSystemAgentActive ?? isHostScopedAgentToolActive("openclaw");
+	const ringZeroActive = hostSystemAgentActive && isSystemAgentOnlyCodexDynamicToolAllowlist(params.params.toolsAllow);
+	const messageOnlySourceReply = isMessageOnlyCodexSourceReply(params.params);
+	const restrictedToolSurface = ringZeroActive || messageOnlySourceReply || params.params.pluginHarnessToolPolicyRestricted === true;
+	if (restrictedToolSurface && params.nativeCodeModeEnabled !== false) throw new Error("Codex restricted tool surfaces require native code mode to be disabled");
+	const restrictedToolSurfaceInheritedMcpServerNames = restrictedToolSurface ? await lifecycleTiming.measure("restricted-tool-surface-mcp-config-read", () => readCodexInheritedMcpServerNames(params.client, params.cwd, params.signal)) : [];
+	if (restrictedToolSurface) await lifecycleTiming.measure("restricted-tool-surface-config-requirements-read", () => assertCodexRestrictedToolSurfaceHasNoManagedHooks(params.client, params.signal));
+	const ringZeroConfigFingerprint = ringZeroActive ? fingerprintJsonObject({
+		version: 1,
+		baseInstructions: "",
+		config: buildCodexRingZeroThreadConfigPatch(params.params, true, restrictedToolSurfaceInheritedMcpServerNames)
+	}) : void 0;
+	return {
+		contextEngineBinding,
+		dynamicToolsContainDeferred,
+		dynamicToolsFingerprint,
+		environmentSelectionFingerprint,
+		hostSystemAgentActive,
+		legacyDynamicToolsFingerprint,
+		legacyUserMcpServersFingerprint,
+		lifecycleTiming,
+		nativeSkillIsolation,
+		nativeSkillIsolationFingerprint,
+		networkProxyConfigFingerprint,
+		ringZeroActive,
+		ringZeroClientInstanceId: ringZeroActive ? getCodexAppServerClientInstanceId(params.client) : void 0,
+		ringZeroConfigFingerprint,
+		restrictedToolSurface,
+		restrictedToolSurfaceInheritedMcpServerNames,
+		userMcpServersConfigPatch,
+		userMcpServersFingerprint,
+		webSearchThreadConfigFingerprint
+	};
+}
+//#endregion
+//#region extensions/codex/src/app-server/thread-lifecycle-warm.ts
+/** Preserves the caller's abort reason across thread ownership transitions. */
+function throwIfCodexThreadLifecycleAborted(signal) {
+	if (!signal?.aborted) return;
+	const reason = signal.reason;
+	if (reason instanceof Error) throw reason;
+	const error = new Error(typeof reason === "string" && reason.length > 0 ? reason : "codex app-server thread lifecycle aborted");
+	error.name = "AbortError";
+	throw error;
+}
+/** Releases consumed subscription ownership or retires an unsafe client. */
+async function releaseCodexConsumedLiveThread(options) {
+	if (await options.lifecycleTiming.measure("retained-thread-unsubscribe", () => unsubscribeCodexThreadBestEffort(options.client, {
+		threadId: options.threadId,
+		timeoutMs: 5e3
+	}))) return;
+	await (options.abandonClient ?? (() => closeCodexStartupClientBestEffort(options.client)))();
+	throw new CodexAppServerUnsafeSubscriptionError(`Codex retained thread subscription could not be released: ${options.threadId}`, options.cause !== void 0 ? { cause: options.cause } : void 0);
+}
+/** Transfers retained-slot ownership before unconditionally releasing it. */
+async function releaseCodexRetainedLiveThread(options) {
+	if (await consumeCodexAppServerLiveThread(options.client, options.threadId)) await releaseCodexConsumedLiveThread(options);
+}
+/** Reuses one safely owned, fully matching subscription on its original client. */
+async function tryReuseCodexLiveThread(options) {
+	const { params, binding, bindingIdentity, clientId, dynamicToolsFingerprint, environmentSelectionFingerprint, hostSystemAgentActive, lifecycleTiming, nativeSkillIsolation, releaseConsumedThread, ringZeroActive, restrictedToolSurfaceInheritedMcpServerNames, startModelProvider, startModelSelection, throwIfAborted, userMcpServersConfigPatch } = options;
+	if (!binding.clientId || binding.clientId !== clientId || binding.preserveNativeModel === true || binding.connectionScope === "supervision" || ringZeroActive) return {};
+	const prebuiltFinalConfigPatch = params.buildFinalConfigPatch?.({
+		action: "resume",
+		binding
+	}) ?? {
+		configPatch: params.finalConfigPatch,
+		nativeHookRelayGeneration: params.nativeHookRelayGeneration
+	};
+	const pluginAppsConfigPatch = params.pluginThreadConfig?.enabled && binding.pluginAppPolicyContext ? buildCodexPluginAppsConfigPatchFromPolicyContext(binding.pluginAppPolicyContext) : void 0;
+	const resumeAuthProfileId = params.params.authProfileId ?? binding.authProfileId;
+	const resumeConfig = mergeCodexThreadConfigs(params.config, userMcpServersConfigPatch, pluginAppsConfigPatch, prebuiltFinalConfigPatch.configPatch);
+	const resumeParams = lifecycleTiming.measureSync("warm-thread-resume-params", () => buildThreadResumeParams(params.params, {
+		threadId: binding.threadId,
+		authProfileId: resumeAuthProfileId,
+		model: startModelSelection.model,
+		modelProvider: startModelProvider,
+		preserveNativeModel: false,
+		appServer: params.appServer,
+		dynamicTools: params.dynamicTools,
+		developerInstructions: params.developerInstructions,
+		config: applyCodexNativeSkillIsolation(resumeConfig, nativeSkillIsolation),
+		nativeCodeModeEnabled: params.nativeCodeModeEnabled,
+		nativeProviderWebSearchSupport: params.nativeProviderWebSearchSupport,
+		nativeCodeModeOnlyEnabled: params.nativeCodeModeOnlyEnabled,
+		webSearchAllowed: params.webSearchAllowed,
+		hostSystemAgentActive,
+		restrictedToolSurfaceInheritedMcpServerNames
+	}));
+	const liveThreadConfigFingerprint = fingerprintCodexThreadConfig({
+		...resumeParams,
+		model: binding.model ?? resumeParams.model ?? null,
+		requestedModel: resumeParams.model ?? null,
+		modelProvider: binding.modelProvider ?? resumeParams.modelProvider ?? null,
+		requestedModelProvider: resumeParams.modelProvider ?? binding.modelProvider ?? null
+	}, resumeAuthProfileId, dynamicToolsFingerprint);
+	const retainedThread = await consumeCodexAppServerLiveThread(params.client, binding.threadId, liveThreadConfigFingerprint);
+	if (!retainedThread) {
+		const incompatibleOwnership = await consumeCodexAppServerLiveThread(params.client, binding.threadId);
+		if (incompatibleOwnership) await incompatibleOwnership.release(binding.threadId);
+		return { prebuiltFinalConfigPatch };
+	}
+	try {
+		const nativeHookRelayGeneration = prebuiltFinalConfigPatch.nativeHookRelayGeneration ?? binding.nativeHookRelayGeneration;
+		const model = startModelSelection.model;
+		if (!await lifecycleTiming.measure("warm-thread-write-binding", () => params.bindingStore.mutate(bindingIdentity, {
+			kind: "patch",
+			threadId: binding.threadId,
+			patch: {
+				cwd: params.cwd,
+				model,
+				nativeHookRelayGeneration,
+				environmentSelectionFingerprint
+			}
+		}))) throw new CodexThreadBindingConflictError(binding.threadId, "committing a reused thread");
+		throwIfAborted();
+		lifecycleTiming.mark("thread-ready");
+		lifecycleTiming.logSummary({
+			runId: params.params.runId,
+			sessionId: params.params.sessionId,
+			sessionKey: params.params.sessionKey,
+			threadId: binding.threadId,
+			action: "resumed"
+		});
+		return {
+			binding: {
+				...binding,
+				cwd: params.cwd,
+				model,
+				nativeHookRelayGeneration,
+				environmentSelectionFingerprint,
+				liveThreadConfigFingerprint,
+				liveThreadOwnership: retainedThread,
+				...retainedThread.serviceTier && resumeParams.serviceTier === void 0 ? { clearInheritedServiceTier: true } : {},
+				lifecycle: { action: "resumed" }
+			},
+			prebuiltFinalConfigPatch
+		};
+	} catch (error) {
+		await releaseConsumedThread(binding.threadId, error);
+		throw error;
+	}
+}
+//#endregion
 //#region extensions/codex/src/app-server/thread-supervision.ts
 async function materializePendingSupervisionBranch(params) {
 	let pending = params.binding.pendingSupervisionBranch;
@@ -2409,6 +3079,7 @@ async function materializePendingSupervisionBranch(params) {
 		pending = await trackPendingSupervisionArtifacts(params, pending, [probeThreadId]);
 		params.throwIfAborted();
 		const probeResponse = assertCodexThreadForkResponse(rawProbeResponse);
+		if (params.restrictedToolSurface) await params.lifecycleTiming.measure("restricted-tool-surface-mcp-attestation", () => attestCodexRestrictedToolSurfaceMcpServersDisabled(params.client, probeThreadId, probeParams.config ?? void 0, params.signal));
 		const nativeModel = requireNonBlankSupervisionValue(probeResponse.model, "native model");
 		const nativeModelProvider = requireNativeSupervisionModelProvider({
 			responseModelProvider: probeResponse.modelProvider,
@@ -2429,7 +3100,9 @@ async function materializePendingSupervisionBranch(params) {
 			webSearchAllowed: params.webSearchAllowed,
 			environmentSelection: params.environmentSelection,
 			model: nativeModel,
-			modelProvider: nativeModelProvider
+			modelProvider: nativeModelProvider,
+			hostSystemAgentActive: params.hostSystemAgentActive,
+			restrictedToolSurfaceInheritedMcpServerNames: params.restrictedToolSurfaceInheritedMcpServerNames
 		});
 		assertExactSupervisionModelSelection(startParams, {
 			model: nativeModel,
@@ -2457,6 +3130,26 @@ async function materializePendingSupervisionBranch(params) {
 			modelProvider: nativeModelProvider,
 			operation: "thread/start response"
 		});
+		if (params.restrictedToolSurface) await params.lifecycleTiming.measure("restricted-tool-surface-mcp-attestation", () => attestCodexRestrictedToolSurfaceMcpServersDisabled(params.client, finalThreadId, startParams.config, params.signal));
+		if (params.provisionalAppIds?.length) try {
+			await params.lifecycleTiming.measure("plugin-app-attestation", () => attestCodexPluginThreadApps({
+				client: params.client,
+				threadId: finalThreadId,
+				appIds: params.provisionalAppIds ?? [],
+				signal: params.signal
+			}));
+		} catch (error) {
+			if (!await discardUnattestedCodexPluginThread({
+				client: params.client,
+				threadId: finalThreadId,
+				ephemeral: startParams.ephemeral === true
+			}) || !await archiveSupervisionArtifact(params.client, probeThreadId)) {
+				provisionalCleanupSafe = false;
+				throw new CodexAppServerUnsafeSubscriptionError("Codex supervised plugin app attestation cleanup failed", { cause: error });
+			}
+			pending = await trackPendingSupervisionArtifacts(params, pending, []);
+			throw error;
+		}
 		if (history.responseItems.length > 0) {
 			await params.lifecycleTiming.measure("supervision-history-inject", () => params.client.request("thread/inject_items", {
 				threadId: finalThreadId,
@@ -2563,7 +3256,9 @@ function buildPendingSupervisionProbeForkParams(params, pending) {
 		nativeProviderWebSearchSupport: params.nativeProviderWebSearchSupport,
 		nativeCodeModeOnlyEnabled: params.nativeCodeModeOnlyEnabled,
 		webSearchAllowed: params.webSearchAllowed,
-		appServer: params.appServer
+		appServer: params.appServer,
+		hostSystemAgentActive: params.hostSystemAgentActive,
+		restrictedToolSurfaceInheritedMcpServerNames: params.restrictedToolSurfaceInheritedMcpServerNames
 	});
 	return {
 		threadId: pending.sourceThreadId,
@@ -2700,46 +3395,11 @@ async function startOrResumeThread(params) {
 		config: params.params.config
 	});
 	return await params.bindingStore.withLease(bindingIdentity, async () => {
-		const lifecycleTiming = createCodexThreadLifecycleTimingTracker({
-			...params.timing,
-			enabled: params.timing?.enabled ?? isCodexAppServerProfilerEnabled(params.params.config)
-		});
-		const legacyDynamicToolsFingerprint = lifecycleTiming.measureSync("legacy-dynamic-tools-fingerprint", () => codexLegacyDynamicToolsFingerprint(params.dynamicTools));
-		const dynamicToolsFingerprint = lifecycleTiming.measureSync("dynamic-tools-fingerprint", () => hashCodexAppServerBindingFingerprint(legacyDynamicToolsFingerprint));
-		const dynamicToolsContainDeferred = flattenCodexDynamicToolFunctions(params.dynamicTools).some((tool) => tool.deferLoading === true);
-		const webSearchThreadConfigFingerprint = fingerprintJsonObject(lifecycleTiming.measureSync("web-search-plan", () => resolveCodexWebSearchPlan({
-			config: params.params.config,
-			disableTools: params.params.disableTools,
-			nativeToolSurfaceEnabled: params.nativeCodeModeEnabled,
-			nativeProviderWebSearchSupport: params.nativeProviderWebSearchSupport,
-			webSearchAllowed: params.webSearchAllowed
-		})).threadConfig);
-		const networkProxyConfigFingerprint = params.appServer.networkProxy?.configFingerprint;
-		const contextEngineBinding = lifecycleTiming.measureSync("context-engine-binding", () => buildContextEngineBinding(params.params, params.contextEngineProjection));
-		const userMcpServersConfigPatch = params.userMcpServersEnabled === false ? void 0 : await buildCodexUserMcpServersThreadConfigPatchForRuntime(params.params.config, {
-			agentId: params.agentId ?? params.params.agentId,
-			agentDir: params.params.agentDir,
-			allowLiteralOAuthProjection: params.appServer.connectionClass !== "remote",
-			onServerUnavailable: (serverName, error) => embeddedAgentLog.warn("skipping unavailable MCP OAuth server", {
-				serverName,
-				error: formatErrorMessage(error)
-			})
-		});
-		const legacyUserMcpServersFingerprint = legacyFingerprintUserMcpServersConfigPatch(userMcpServersConfigPatch);
-		const userMcpServersFingerprint = fingerprintUserMcpServersConfigPatch(userMcpServersConfigPatch);
-		const environmentSelectionFingerprint = fingerprintEnvironmentSelection(params.environmentSelection);
-		const hostSystemAgentActive = params.hostSystemAgentActive ?? isHostScopedAgentToolActive("openclaw");
-		const ringZeroActive = hostSystemAgentActive && isSystemAgentOnlyCodexDynamicToolAllowlist(params.params.toolsAllow);
-		if (ringZeroActive && params.nativeCodeModeEnabled !== false) throw new Error("Codex ring-zero requires native code mode to be disabled");
-		const ringZeroInheritedMcpServerNames = ringZeroActive ? await lifecycleTiming.measure("ring-zero-mcp-config-read", () => readCodexInheritedMcpServerNames(params.client, params.cwd, params.signal)) : [];
-		if (ringZeroActive) await lifecycleTiming.measure("ring-zero-config-requirements-read", () => assertCodexRingZeroHasNoManagedHooks(params.client, params.signal));
-		const ringZeroConfigFingerprint = ringZeroActive ? fingerprintJsonObject({
-			version: 1,
-			baseInstructions: "",
-			config: buildCodexRingZeroThreadConfigPatch(params.params, true, ringZeroInheritedMcpServerNames)
-		}) : void 0;
-		const ringZeroClientInstanceId = ringZeroActive ? getCodexAppServerClientInstanceId(params.client) : void 0;
+		const { contextEngineBinding, dynamicToolsContainDeferred, dynamicToolsFingerprint, environmentSelectionFingerprint, hostSystemAgentActive, legacyDynamicToolsFingerprint, legacyUserMcpServersFingerprint, lifecycleTiming, nativeSkillIsolation, nativeSkillIsolationFingerprint, networkProxyConfigFingerprint, ringZeroActive, ringZeroClientInstanceId, ringZeroConfigFingerprint, restrictedToolSurface, restrictedToolSurfaceInheritedMcpServerNames, userMcpServersConfigPatch, userMcpServersFingerprint, webSearchThreadConfigFingerprint } = await prepareCodexThreadLifecyclePreflight(params);
 		let binding = await lifecycleTiming.measure("read-binding", () => params.bindingStore.read(bindingIdentity));
+		let replacementPredecessor;
+		const initialBoundThreadId = binding?.threadId;
+		const initialBoundClientId = binding?.clientId;
 		const normalizeBindingModelProvider = (authProfileId, modelProvider) => normalizeCodexAppServerBindingModelProvider({
 			authProfileId,
 			modelProvider,
@@ -2747,13 +3407,28 @@ async function startOrResumeThread(params) {
 			agentDir: params.params.agentDir,
 			config: params.params.config
 		});
-		const throwIfAborted = () => {
-			if (!params.signal?.aborted) return;
-			const reason = params.signal.reason;
-			if (reason instanceof Error) throw reason;
-			const error = new Error(typeof reason === "string" && reason.length > 0 ? reason : "codex app-server thread lifecycle aborted");
-			error.name = "AbortError";
-			throw error;
+		const throwIfAborted = () => throwIfCodexThreadLifecycleAborted(params.signal);
+		const releaseRetainedThread = async (threadId, ownerClientId = initialBoundClientId) => {
+			if (ownerClientId && ownerClientId !== clientId) {
+				const previousClient = retainSharedCodexAppServerClientByInstanceId(ownerClientId);
+				if (!previousClient) return;
+				try {
+					await releaseCodexRetainedLiveThread({
+						client: previousClient.client,
+						lifecycleTiming,
+						threadId
+					});
+				} finally {
+					previousClient.release();
+				}
+				return;
+			}
+			await releaseCodexRetainedLiveThread({
+				client: params.client,
+				abandonClient: params.abandonClient,
+				lifecycleTiming,
+				threadId
+			});
 		};
 		if (!binding && bindingIdentity.kind === "session" && bindingIdentity.sessionKey) {
 			if (!await lifecycleTiming.measure("reclaim-binding-generation", () => reclaimCurrentCodexSessionGeneration({
@@ -2763,13 +3438,14 @@ async function startOrResumeThread(params) {
 			}))) throw createCodexSessionGenerationSupersededError(bindingIdentity.sessionId);
 		}
 		if (binding?.pendingSupervisionBranch) {
+			await releaseRetainedThread(binding.threadId);
 			const pendingBinding = binding;
 			const pluginThreadConfig = params.pluginThreadConfig?.enabled ? await lifecycleTiming.measure("plugin-config-build", () => params.pluginThreadConfig?.build()) : void 0;
 			const finalConfigPatch = params.buildFinalConfigPatch?.({ action: "start" }) ?? {
 				configPatch: params.finalConfigPatch,
 				nativeHookRelayGeneration: params.nativeHookRelayGeneration
 			};
-			const config = lifecycleTiming.measureSync("merge-thread-config", () => mergeCodexThreadConfigs(params.config, userMcpServersConfigPatch, pluginThreadConfig?.configPatch, finalConfigPatch.configPatch));
+			const config = lifecycleTiming.measureSync("merge-thread-config", () => applyCodexNativeSkillIsolation(mergeCodexThreadConfigs(params.config, userMcpServersConfigPatch, pluginThreadConfig?.configPatch, finalConfigPatch.configPatch), nativeSkillIsolation));
 			return await materializePendingSupervisionBranch({
 				client: params.client,
 				abandonClient: params.abandonClient ?? (() => closeCodexStartupClientBestEffort(params.client)),
@@ -2786,7 +3462,11 @@ async function startOrResumeThread(params) {
 				nativeProviderWebSearchSupport: params.nativeProviderWebSearchSupport,
 				nativeCodeModeOnlyEnabled: params.nativeCodeModeOnlyEnabled,
 				webSearchAllowed: params.webSearchAllowed,
+				hostSystemAgentActive,
+				restrictedToolSurface,
+				restrictedToolSurfaceInheritedMcpServerNames,
 				environmentSelection: params.environmentSelection,
+				provisionalAppIds: pluginThreadConfig?.provisionalAppIds,
 				signal: params.signal,
 				throwIfAborted,
 				lifecycleTiming,
@@ -2799,8 +3479,10 @@ async function startOrResumeThread(params) {
 					dynamicToolsFingerprint,
 					dynamicToolsContainDeferred,
 					webSearchThreadConfigFingerprint,
+					nativeSkillIsolationFingerprint,
 					userMcpServersFingerprint,
 					mcpServersFingerprint: params.mcpServersFingerprintEvaluated === true ? params.mcpServersFingerprint : pendingBinding.mcpServersFingerprint,
+					configuredMcpOwnershipVersion: params.configuredMcpOwnershipVersion,
 					networkProxyProfileName: params.appServer.networkProxy?.profileName,
 					networkProxyConfigFingerprint,
 					nativeHookRelayGeneration: finalConfigPatch.nativeHookRelayGeneration,
@@ -2824,6 +3506,11 @@ async function startOrResumeThread(params) {
 			})) throw new CodexThreadBindingConflictError(current.threadId, operation);
 			binding = void 0;
 		};
+		if (binding?.threadId && !restrictedToolSurface && binding.nativeToolPolicyRestricted === true) await clearCurrentBinding("rotating a host-policy-restricted thread binding");
+		if (binding?.threadId && binding.nativeSkillIsolationFingerprint !== nativeSkillIsolationFingerprint) {
+			embeddedAgentLog.debug("codex app-server native skill isolation changed; starting a new thread", { threadId: binding.threadId });
+			await clearCurrentBinding("rotating stale native skill isolation");
+		}
 		if (binding?.threadId && (binding.ringZeroConfigFingerprint !== ringZeroConfigFingerprint || binding.ringZeroClientInstanceId !== ringZeroClientInstanceId) && (ringZeroActive || binding.ringZeroConfigFingerprint !== void 0)) {
 			embeddedAgentLog.debug("codex app-server ring-zero restriction changed; rotating thread", { threadId: binding.threadId });
 			await clearCurrentBinding("rotating a ring-zero thread binding");
@@ -2872,6 +3559,14 @@ async function startOrResumeThread(params) {
 		const transientWebSearchRestriction = isTransientWebSearchRestriction(params);
 		const explicitTransientWebSearchRestriction = params.webSearchAllowed === false && params.persistentWebSearchAllowed !== false && transientWebSearchRestriction;
 		const unknownProviderWebSearchSupport = params.nativeProviderWebSearchSupport === "unknown";
+		if (binding?.threadId && (params.configuredMcpOwnershipVersion === 1 && (binding.configuredMcpOwnershipVersion !== 1 || binding.dynamicToolsFingerprint === void 0 || binding.mcpServersFingerprint !== void 0 || binding.userMcpServersFingerprint !== void 0) || params.configuredMcpOwnershipVersion !== 1 && binding.configuredMcpOwnershipVersion === 1) && binding?.threadId) {
+			const predecessorBinding = binding;
+			assertCodexBindingMayBeReplaced(predecessorBinding, "changing configured MCP ownership");
+			embeddedAgentLog.debug("codex app-server configured MCP ownership changed; starting a new thread", { threadId: predecessorBinding.threadId });
+			replacementPredecessor = predecessorBinding;
+			binding = void 0;
+			preserveExistingBinding = false;
+		}
 		if (binding?.threadId && params.mcpServersFingerprintEvaluated === true && binding.mcpServersFingerprint !== params.mcpServersFingerprint) {
 			assertCodexBindingMayBeReplaced(binding, "changing MCP configuration");
 			if (!ringZeroActive && (transientNativeToolRestriction || webSearchBindingChanged && (explicitTransientWebSearchRestriction || unknownProviderWebSearchSupport))) {
@@ -2887,7 +3582,7 @@ async function startOrResumeThread(params) {
 		if (binding?.threadId && webSearchBindingChanged && !deferLegacyWebSearchRotationToTransientNativeSurface) {
 			assertCodexBindingMayBeReplaced(binding, "changing web-search configuration");
 			if (!ringZeroActive && transientWebSearchRestriction) {
-				embeddedAgentLog.debug("codex app-server web search restricted for turn; starting transient thread", { threadId: binding.threadId });
+				embeddedAgentLog.debug("codex app-server tool surface restricted for turn; starting transient thread", { threadId: binding.threadId });
 				preserveExistingBinding = true;
 			} else {
 				embeddedAgentLog.debug("codex app-server web search config changed; starting a new thread", { threadId: binding.threadId });
@@ -2933,11 +3628,6 @@ async function startOrResumeThread(params) {
 			await clearCurrentBinding("rotating a stale thread binding");
 			binding = void 0;
 		}
-		if (binding?.threadId && binding.environmentSelectionFingerprint !== environmentSelectionFingerprint) {
-			embeddedAgentLog.debug("codex app-server environment selection changed; starting a new thread", { threadId: binding.threadId });
-			await clearCurrentBinding("rotating a stale thread binding");
-			binding = void 0;
-		}
 		if (binding?.threadId && (binding.networkProxyConfigFingerprint !== networkProxyConfigFingerprint || binding.networkProxyProfileName !== params.appServer.networkProxy?.profileName)) {
 			embeddedAgentLog.debug("codex app-server network proxy config changed; starting a new thread", { threadId: binding.threadId });
 			await clearCurrentBinding("rotating a stale thread binding");
@@ -2951,13 +3641,15 @@ async function startOrResumeThread(params) {
 				currentInputFingerprint: params.pluginThreadConfig?.inputFingerprint,
 				hasBindingPolicyContext: Boolean(binding.pluginAppPolicyContext)
 			});
-			if (!pluginBindingStale && shouldRecheckRecoverablePluginBinding({
+			if (!pluginBindingStale && (params.pluginThreadConfig?.requiresCurrentPolicyCheck || shouldRecheckRecoverablePluginBinding({
 				binding,
 				pluginThreadConfig: params.pluginThreadConfig
-			})) try {
-				prebuiltPluginThreadConfig = await lifecycleTiming.measure("plugin-config-recovery", () => params.pluginThreadConfig?.build());
+			}))) try {
+				const bindingThreadId = binding.threadId;
+				prebuiltPluginThreadConfig = await lifecycleTiming.measure("plugin-config-recovery", () => params.pluginThreadConfig?.build({ threadId: bindingThreadId }));
 				pluginBindingStale = prebuiltPluginThreadConfig?.fingerprint !== binding.pluginAppsFingerprint;
 			} catch (error) {
+				if (params.pluginThreadConfig?.requiresCurrentPolicyCheck) throw error;
 				embeddedAgentLog.warn("codex app-server plugin app config recovery check failed", {
 					error,
 					threadId: binding.threadId
@@ -3010,6 +3702,32 @@ async function startOrResumeThread(params) {
 			await clearCurrentBinding("rotating an unavailable ephemeral thread binding");
 			binding = void 0;
 		} else {
+			const warmReuse = await tryReuseCodexLiveThread({
+				params,
+				binding,
+				bindingIdentity,
+				clientId,
+				dynamicToolsFingerprint,
+				environmentSelectionFingerprint,
+				hostSystemAgentActive,
+				lifecycleTiming,
+				nativeSkillIsolation,
+				releaseConsumedThread: (threadId, cause) => releaseCodexConsumedLiveThread({
+					client: params.client,
+					abandonClient: params.abandonClient,
+					lifecycleTiming,
+					threadId,
+					cause
+				}),
+				ringZeroActive,
+				restrictedToolSurfaceInheritedMcpServerNames,
+				startModelProvider,
+				startModelSelection,
+				throwIfAborted,
+				userMcpServersConfigPatch
+			});
+			if (warmReuse.binding) return warmReuse.binding;
+			await releaseRetainedThread(binding.threadId);
 			const resumed = await resumeExistingCodexThread(params, {
 				binding,
 				bindingIdentity,
@@ -3019,6 +3737,7 @@ async function startOrResumeThread(params) {
 				dynamicToolsFingerprint,
 				dynamicToolsContainDeferred,
 				webSearchThreadConfigFingerprint,
+				nativeSkillIsolationFingerprint,
 				userMcpServersFingerprint,
 				ringZeroConfigFingerprint,
 				ringZeroClientInstanceId,
@@ -3027,15 +3746,20 @@ async function startOrResumeThread(params) {
 				environmentSelectionFingerprint,
 				hostSystemAgentActive,
 				ringZeroActive,
-				ringZeroInheritedMcpServerNames,
+				restrictedToolSurface,
+				restrictedToolSurfaceInheritedMcpServerNames,
+				nativeSkillIsolation,
 				lifecycleTiming,
 				normalizeBindingModelProvider,
 				throwIfAborted,
-				clearCurrentBinding
+				clearCurrentBinding,
+				prebuiltFinalConfigPatch: warmReuse.prebuiltFinalConfigPatch,
+				prebuiltPluginThreadConfig
 			});
 			if (resumed) return resumed;
 		}
-		return await startFreshCodexThread(params, {
+		if (initialBoundThreadId && !preserveExistingBinding && !replacementPredecessor) await releaseRetainedThread(initialBoundThreadId);
+		const started = await startFreshCodexThread(params, {
 			bindingIdentity,
 			startModelSelection,
 			startModelProvider,
@@ -3043,6 +3767,7 @@ async function startOrResumeThread(params) {
 			dynamicToolsFingerprint,
 			dynamicToolsContainDeferred,
 			webSearchThreadConfigFingerprint,
+			nativeSkillIsolationFingerprint,
 			userMcpServersFingerprint,
 			ringZeroConfigFingerprint,
 			ringZeroClientInstanceId,
@@ -3051,84 +3776,27 @@ async function startOrResumeThread(params) {
 			environmentSelectionFingerprint,
 			hostSystemAgentActive,
 			ringZeroActive,
-			ringZeroInheritedMcpServerNames,
+			restrictedToolSurface,
+			restrictedToolSurfaceInheritedMcpServerNames,
+			nativeSkillIsolation,
 			lifecycleTiming,
 			normalizeBindingModelProvider,
 			throwIfAborted,
 			prebuiltPluginThreadConfig,
 			preserveExistingBinding,
-			rotatedContextEngineBinding
+			rotatedContextEngineBinding,
+			replacementPredecessor
 		});
+		if (replacementPredecessor) await releaseRetainedThread(replacementPredecessor.threadId, replacementPredecessor.clientId);
+		return started;
 	});
 }
 //#endregion
-//#region extensions/codex/src/app-server/image-payload-sanitizer.ts
-/**
-* Sanitizes inline image payloads mirrored through Codex history so invalid
-* base64 data becomes readable text instead of poisoning replayed transcripts.
-*/
-const IMAGE_OMITTED_TEXT = "omitted image payload: invalid inline image data";
-/** Validates and normalizes an inline image data URL for Codex history payloads. */
-function sanitizeInlineImageDataUrl$1(imageUrl) {
-	return sanitizeInlineImageDataUrl(imageUrl);
-}
-/** Builds the replacement text inserted when an inline image payload is invalid. */
-function invalidInlineImageText(label) {
-	return `[${label}] ${IMAGE_OMITTED_TEXT}`;
-}
-function sanitizeImageContentRecord(record, label) {
-	if (record.type === "image" && typeof record.data === "string") {
-		const mimeType = typeof record.mimeType === "string" ? record.mimeType : "image/png";
-		const imageUrl = sanitizeInlineImageDataUrl$1(`data:${mimeType};base64,${record.data}`);
-		if (!imageUrl) return {
-			type: "text",
-			text: invalidInlineImageText(label)
-		};
-		const commaIndex = imageUrl.indexOf(",");
-		const mime = imageUrl.slice(INLINE_IMAGE_DATA_URL_PREFIX.length, commaIndex).split(";")[0] ?? mimeType;
-		return {
-			...record,
-			mimeType: mime,
-			data: imageUrl.slice(commaIndex + 1)
-		};
-	}
-	if (record.type === "inputImage" && typeof record.imageUrl === "string") {
-		const imageUrl = sanitizeInlineImageDataUrl$1(record.imageUrl);
-		return imageUrl ? {
-			...record,
-			imageUrl
-		} : {
-			type: "inputText",
-			text: invalidInlineImageText(label)
-		};
-	}
-	if (record.type === "input_image" && typeof record.image_url === "string") {
-		const imageUrl = sanitizeInlineImageDataUrl$1(record.image_url);
-		return imageUrl ? {
-			...record,
-			image_url: imageUrl
-		} : {
-			type: "input_text",
-			text: invalidInlineImageText(label)
-		};
-	}
-}
-/** Recursively sanitizes all Codex history image shapes while preserving unknown structure. */
-function sanitizeCodexHistoryImagePayloads(value, label) {
-	if (Array.isArray(value)) return value.map((entry) => sanitizeCodexHistoryImagePayloads(entry, label));
-	if (!isRecord(value)) return value;
-	const imageRecord = sanitizeImageContentRecord(value, label);
-	if (imageRecord) return imageRecord;
-	const next = {};
-	for (const [key, child] of Object.entries(value)) next[key] = sanitizeCodexHistoryImagePayloads(child, label);
-	return next;
-}
-//#endregion
 //#region extensions/codex/src/app-server/user-input.ts
 /** Builds ordered Codex user input for both new turns and same-turn steering. */
 function buildCodexUserInput(text, images) {
 	const imageInputs = (images ?? []).map((image) => {
-		const imageUrl = sanitizeInlineImageDataUrl$1(`data:${image.mimeType};base64,${image.data}`);
+		const imageUrl = sanitizeInlineImageDataUrl(`data:${image.mimeType};base64,${image.data}`);
 		return imageUrl ? {
 			type: "image",
 			url: imageUrl
@@ -3146,6 +3814,27 @@ function buildCodexUserInput(text, images) {
 }
 //#endregion
 //#region extensions/codex/src/app-server/turn-params.ts
+const CODEX_CURRENT_SENDER_FIELD_MAX_CHARS = 256;
+function buildCodexCurrentSenderContextValue(params) {
+	const metadata = asOptionalRecord(asOptionalRecord(params.userTurnTranscriptRecorder?.message)?.["__openclaw"]);
+	const recorded = [
+		normalizeOptionalString(metadata?.["senderId"]),
+		normalizeOptionalString(metadata?.["senderName"]),
+		normalizeOptionalString(metadata?.["senderUsername"])
+	];
+	const [id, name, username] = recorded.some(Boolean) ? recorded : [
+		normalizeOptionalString(params.senderId),
+		normalizeOptionalString(params.senderName),
+		normalizeOptionalString(params.senderUsername)
+	];
+	if (!id && !name && !username) return;
+	const bound = (value) => truncateUtf16Safe(value, CODEX_CURRENT_SENDER_FIELD_MAX_CHARS);
+	return JSON.stringify({ sender: {
+		...id ? { id: bound(id) } : {},
+		...name ? { name: bound(name) } : {},
+		...username ? { username: bound(username) } : {}
+	} });
+}
 function buildTurnStartParams(params, options) {
 	const modelSelection = options.preserveNativeTurnSettings ? void 0 : resolveCodexAppServerRequestModelSelection({
 		model: options.model ?? params.modelId,
@@ -3156,9 +3845,15 @@ function buildTurnStartParams(params, options) {
 		config: params.config
 	});
 	const useThreadPermissionProfile = options.appServer.networkProxy && !options.sandboxPolicy;
+	const currentSenderContext = params.trigger === "user" ? buildCodexCurrentSenderContextValue(params) : void 0;
+	const additionalContext = currentSenderContext ? { openclaw_current_sender: {
+		kind: "untrusted",
+		value: currentSenderContext
+	} } : void 0;
 	return {
 		threadId: options.threadId,
-		input: buildCodexUserInput(options.promptText ?? params.prompt, params.images),
+		input: [...buildCodexUserInput(options.promptText ?? params.prompt, params.images), ...options.explicitSkillInputs ?? []],
+		...additionalContext ? { additionalContext } : {},
 		cwd: options.cwd,
 		approvalPolicy: options.appServer.approvalPolicy,
 		approvalsReviewer: options.appServer.approvalsReviewer,
@@ -3167,7 +3862,7 @@ function buildTurnStartParams(params, options) {
 			model: modelSelection.model,
 			personality: CODEX_NATIVE_PERSONALITY_NONE
 		} : {},
-		...options.appServer.serviceTier !== void 0 ? { serviceTier: options.appServer.serviceTier } : {},
+		...options.appServer.serviceTier !== void 0 ? { serviceTier: options.appServer.serviceTier } : options.clearInheritedServiceTier ? { serviceTier: null } : {},
 		...modelSelection ? { effort: resolveReasoningEffort(params.thinkLevel, modelSelection.model, readCodexSupportedReasoningEfforts(params.model?.compat)) } : {},
 		...options.environmentSelection ? { environments: options.environmentSelection } : {},
 		...modelSelection ? { collaborationMode: buildTurnCollaborationMode(params, {
@@ -3192,7 +3887,7 @@ function buildTurnCollaborationMode(params, options = {}) {
 function buildTurnScopedCollaborationInstructions(params, options = {}) {
 	const contextInstructions = joinPresentSections(options.turnScopedDeveloperInstructions, options.memoryCollaborationInstructions, options.skillsCollaborationInstructions);
 	if (params.trigger === "cron") return joinPresentSections(buildCronCollaborationInstructions(), contextInstructions);
-	if (params.trigger === "heartbeat" && params.bootstrapContextRunKind !== "commitment-only") return joinPresentSections(buildHeartbeatCollaborationInstructions(), contextInstructions);
+	if (params.trigger === "heartbeat") return joinPresentSections(buildHeartbeatCollaborationInstructions(), contextInstructions);
 	if (contextInstructions?.trim()) return joinPresentSections(buildDefaultCollaborationInstructions(), contextInstructions);
 	return null;
 }
@@ -3230,4 +3925,4 @@ function joinPresentSections(...sections) {
 	return sections.filter((section) => Boolean(section?.trim())).join("\n\n");
 }
 //#endregion
-export { readHookOutputEntries as $, resolveCodexDynamicToolsLoading as A, resolveCodexContextEngineProjectionReserveTokens as B, readCodexSupportedReasoningEfforts as C, isForcedPrivateQaCodexRuntime as D, filterCodexDynamicToolsWithOpenClawShell as E, buildContextEngineBinding as F, mergeCodexThreadConfigs as G, buildCodexPluginThreadConfig as H, isContextEngineBindingCompatible as I, pluginReadParams as J, shouldBuildCodexPluginThreadConfig as K, fitCodexProjectedContextForTurnStart as L, areCodexDynamicToolFingerprintsCompatible as M, codexDynamicToolsFingerprint as N, isSystemAgentOnlyCodexDynamicToolAllowlist as O, codexLegacyDynamicToolsFingerprint as P, readCodexErrorNotificationMessage as Q, projectContextEngineAssemblyForCodex as R, resolveReasoningEffort as S, filterCodexDynamicTools as T, buildCodexPluginThreadConfigInputFingerprint as U, buildCodexPluginAppsConfigPatchFromPolicyContext as V, buildCodexPluginThreadConfigTimeoutFallback as W, extractRawAssistantText as X, resolveRecoverableCodexPluginConfigKeys as Y, normalizeNonEmptyString as Z, CODEX_NATIVE_PERSONALITY_NONE as _, sanitizeCodexHistoryImagePayloads as a, readNullableString as at, resolveCodexAppServerThreadModelSelection as b, resumeCodexAppServerThread as c, splitPlanText as ct, buildCodexRingZeroThreadConfigPatch as d, readItem as et, buildCodexRuntimeThreadConfig as f, buildDeveloperInstructions as g, resolveCodexWebSearchPlan as h, invalidInlineImageText as i, readNonNegativeInteger as it, resolveCodexDynamicToolsLoadingForRuntime as j, normalizeCodexDynamicToolName as k, assertCodexRingZeroHasNoManagedHooks as l, buildCodexNativeWebSearchThreadConfig as m, buildTurnStartParams as n, readNonEmptyString as nt, sanitizeInlineImageDataUrl$1 as o, readNumber as ot, readCodexInheritedMcpServerNames as p, ensureCodexPluginActivation as q, buildCodexUserInput as r, readNonEmptyStringArray as rt, startOrResumeThread as s, readString as st, buildTurnCollaborationMode as t, readItemString as tt, attestCodexRingZeroThreadHasNoMcpServers as u, resolveCodexAppServerModelProvider as v, isCodexAppServerProfilerEnabled as w, resolveCodexBindingModelProviderFallback as x, resolveCodexAppServerRequestModelSelection as y, resolveCodexContextEngineProjectionMaxChars as z };
+export { resolveCodexDynamicToolsLoadingForRuntime as A, buildCodexPluginThreadConfigInputFingerprint as B, codexLegacyDynamicToolsFingerprint as C, isSystemAgentOnlyCodexDynamicToolAllowlist as D, isForcedPrivateQaCodexRuntime as E, projectContextEngineAssemblyForCodex as F, shouldBuildCodexPluginThreadConfig as G, buildDisabledAppsConfigPatch as H, resolveCodexContextEngineProjectionMaxChars as I, isOpenAiCuratedMarketplace as J, ensureCodexPluginActivation as K, resolveCodexContextEngineProjectionReserveTokens as L, isContextEngineBindingCompatible as M, fitCodexProjectedContextForTurnStart as N, normalizeCodexDynamicToolName as O, neutralizeCodexExplicitMentionSigils as P, buildCodexPluginAppsConfigPatchFromPolicyContext as R, codexDynamicToolsFingerprint as S, filterCodexDynamicToolsForDisabledNativeSurface as T, buildPluginAppPolicyContext as U, buildCodexPluginThreadConfigTimeoutFallback as V, mergeCodexThreadConfigs as W, pluginReadParams as X, isOpenAiCuratedMarketplaceName as Y, resolveRecoverableCodexPluginConfigKeys as Z, resolveCodexAppServerThreadModelSelection as _, isCodexAppServerProfilerEnabled as a, readCodexSupportedReasoningEfforts as b, buildCodexRingZeroThreadConfigPatch as c, buildCodexNativeWebSearchThreadConfig as d, resolveCodexWebSearchPlan as f, resolveCodexAppServerRequestModelSelection as g, resolveCodexAppServerModelProvider as h, startOrResumeThread as i, buildContextEngineBinding as j, resolveCodexDynamicToolsLoading as k, buildCodexRuntimeThreadConfig as l, CODEX_NATIVE_PERSONALITY_NONE as m, buildTurnStartParams as n, assertCodexRestrictedToolSurfaceHasNoManagedHooks as o, buildDeveloperInstructions as p, refreshCodexPluginRuntimeState as q, buildCodexUserInput as r, attestCodexRestrictedToolSurfaceMcpServersDisabled as s, buildTurnCollaborationMode as t, readCodexInheritedMcpServerNames as u, resolveCodexBindingModelProviderFallback as v, filterCodexDynamicTools as w, areCodexDynamicToolFingerprintsCompatible as x, resolveReasoningEffort as y, buildCodexPluginThreadConfig as z };