@openclaw/codex 2026.7.2-beta.7 → 2026.7.34

package/dist/{side-question-_ulBk1AL.js → .setup/side-question-Cv6JXWCS.mjs}

@@ -1,15 +1,17 @@
-import { M as readRecentCodexRateLimits, W as isJsonObject, a as getLeasedSharedCodexAppServerClient, b as isCodexAppServerApprovalRequest, c as releaseCodexAppServerClientLease, h as withLeasedCodexAppServerClientStartSelectionRetry, k as ensureCodexAppServerClientRuntime, z as resolveCodexAppServerPreparedAuthHandoff } from "./shared-client-DTbvH-XV.js";
-import { A as resolveOpenClawExecPolicyForCodexAppServer, C as canUseCodexModelBackedApprovalsReviewerForModel, O as readCodexPluginConfig, T as resolveCodexModelBackedReviewerPolicyContext, d as sessionBindingIdentity, h as resolveCodexAppServerHomeScope, x as shouldAutoApproveCodexAppServerApprovals } from "./session-binding-BXpo9ymA.js";
-import { A as resolveCodexDynamicToolsLoading, C as resolveReasoningEffort, G as mergeCodexThreadConfigs, S as resolveCodexBindingModelProviderFallback, T as filterCodexDynamicTools, V as buildCodexPluginAppsConfigPatchFromPolicyContext, b as resolveCodexAppServerRequestModelSelection, g as resolveCodexWebSearchPlan, p as buildCodexRuntimeThreadConfig, v as CODEX_NATIVE_PERSONALITY_NONE, w as readCodexSupportedReasoningEfforts, y as resolveCodexAppServerModelProvider } from "./thread-lifecycle-DF53ogiA.js";
-import { S as readCodexTurn, h as assertCodexThreadForkResponse, v as assertCodexTurnStartResponse, y as readCodexDynamicToolCallParams } from "./transcript-mirror-DzsdNCf5.js";
-import { n as formatCodexUsageLimitErrorMessage } from "./rate-limits-CU-gVCCS.js";
-import { t as resolveCodexAppServerForModelProvider } from "./app-server-policy-BSaO2JIT.js";
-import { n as resolveCodexNativeExecutionBlock } from "./sandbox-guard-NuhpXmPB.js";
-import { a as resolveCodexBindingAppServerConnection, i as requireCodexSupervisionModelSelection, n as readCodexNotificationThreadId, r as readCodexNotificationTurnId } from "./notification-correlation-CU6_AnOb.js";
-import { C as filterToolsForVisionInputs, E as CODEX_NATIVE_HOOK_RELAY_EVENTS, F as handleDynamicToolCallWithTimeout, G as resolveCodexToolAbortTerminalReason, O as buildCodexNativeHookRelayConfig, T as CodexNativeToolLifecycleProjector, a as emitDynamicToolStartedDiagnostic, b as shouldEnableCodexAppServerNativeToolSurface, c as resolveCodexProviderWebSearchSupportForClient, i as emitDynamicToolErrorDiagnostic, j as emitCodexNativePreToolUseFailureDiagnostic, k as buildCodexNativeHookRelayDisabledConfig, n as handleCodexAppServerApprovalRequest, o as emitDynamicToolTerminalDiagnostic, r as handleCodexAppServerElicitationRequest, t as createCodexDynamicToolBridge, v as resolveCodexMessageToolProvider, z as resolveDynamicToolCallTimeoutMs } from "./dynamic-tools-D2gYkSBO.js";
-import { buildAgentHookContextChannelFields, embeddedAgentLog, formatErrorMessage, registerNativeHookRelay, resolveAgentDir, resolveAttemptSpawnWorkspaceDir, resolveModelAuthMode, resolveSandboxContext, resolveSessionAgentIds, supportsModelTools } from "openclaw/plugin-sdk/agent-harness-runtime";
+import { r as isJsonObject } from "./protocol-2POPqAY4.mjs";
+import { _ as shouldAutoApproveCodexAppServerApprovals, d as resolveCodexAppServerRuntimeOptions, g as resolveOpenClawExecPolicyForCodexAppServer, m as resolveCodexModelBackedReviewerPolicyContext, n as canUseCodexModelBackedApprovalsReviewerForModel, u as readCodexPluginConfig } from "./config-CYEDnLJ2.mjs";
+import { a as readCodexDynamicToolCallParams, c as readCodexTurn, i as assertCodexTurnStartResponse, t as assertCodexThreadForkResponse } from "./protocol-validators-dZQ-UTOa.mjs";
+import { C as filterCodexDynamicTools, E as resolveCodexDynamicToolsLoading, H as mergeCodexThreadConfigs, d as resolveCodexAppServerModelProvider, f as resolveCodexAppServerRequestModelSelection, h as resolveReasoningEffort, m as resolveCodexBindingModelProviderFallback, r as buildCodexRuntimeThreadConfig, t as CODEX_NATIVE_PERSONALITY_NONE, v as resolveCodexWebSearchPlan, z as buildCodexPluginAppsConfigPatchFromPolicyContext } from "./thread-lifecycle-u6CZdOOH.mjs";
+import { a as readCodexSupportedReasoningEfforts, c as formatCodexUsageLimitErrorMessage } from "./provider-DGxDs6g8.mjs";
+import { a as getLeasedSharedCodexAppServerClient, d as isCodexAppServerApprovalRequest, h as readRecentCodexRateLimits, o as releaseLeasedSharedCodexAppServerClient, p as ensureCodexAppServerClientRuntime } from "./shared-client-B2KmLPRw.mjs";
+import { i as isCodexAppServerNativeAuthProfile, s as sessionBindingIdentity } from "./session-binding-DuihlMJc.mjs";
+import { t as resolveCodexAppServerForModelProvider } from "./app-server-policy-C_qTMEMy.mjs";
+import { n as resolveCodexNativeExecutionBlock } from "./sandbox-guard-DA2TQfZW.mjs";
+import { n as readCodexNotificationThreadId, r as readCodexNotificationTurnId } from "./notification-correlation-iYs4WieS.mjs";
+import { D as emitDynamicToolStartedDiagnostic, E as emitDynamicToolErrorDiagnostic, I as resolveCodexMessageToolProvider, O as emitDynamicToolTerminalDiagnostic, R as shouldEnableCodexAppServerNativeToolSurface, T as createCodexDynamicToolBridge, U as handleCodexAppServerApprovalRequest, V as filterToolsForVisionInputs, Z as handleDynamicToolCallWithTimeout, _ as buildCodexNativeHookRelayDisabledConfig, g as buildCodexNativeHookRelayConfig, i as CodexNativeToolLifecycleProjector, m as CODEX_NATIVE_HOOK_RELAY_EVENTS, n as resolveCodexProviderWebSearchSupportForClient, st as resolveCodexToolAbortTerminalReason, tt as resolveDynamicToolCallTimeoutMs, w as handleCodexAppServerElicitationRequest, y as emitCodexNativePreToolUseFailureDiagnostic } from "./provider-capabilities-DS2N_zc1.mjs";
 import { randomUUID } from "node:crypto";
 import { loadExecApprovals } from "openclaw/plugin-sdk/exec-approvals-runtime";
+import { buildAgentHookContextChannelFields, embeddedAgentLog, formatErrorMessage, registerNativeHookRelay, resolveAgentDir, resolveAttemptSpawnWorkspaceDir, resolveModelAuthMode, resolveSandboxContext, resolveSessionAgentIds, supportsModelTools } from "openclaw/plugin-sdk/agent-harness-runtime";
 //#region extensions/codex/src/app-server/side-question.ts
 const SIDE_QUESTION_COMPLETION_TIMEOUT_MS = 6e5;
 var CodexSideQuestionTimeoutError = class extends Error {
@@ -18,8 +20,8 @@ var CodexSideQuestionTimeoutError = class extends Error {
 		this.name = "TimeoutError";
 	}
 };
-const CODEX_SIDE_NATIVE_HOOK_RELAY_MIN_TTL_MS = 30 * 6e4;
-const CODEX_SIDE_NATIVE_HOOK_RELAY_TTL_GRACE_MS = 5 * 6e4;
+const CODEX_SIDE_NATIVE_HOOK_RELAY_MIN_TTL_MS = 18e5;
+const CODEX_SIDE_NATIVE_HOOK_RELAY_TTL_GRACE_MS = 3e5;
 const CODEX_SIDE_NATIVE_HOOK_RELAY_STARTUP_REQUEST_COUNT = 3;
 const CODEX_SIDE_NATIVE_HOOK_RELAY_EVENTS_WITH_APP_SERVER_APPROVALS = CODEX_NATIVE_HOOK_RELAY_EVENTS.filter((event) => event !== "permission_request");
 const SIDE_BOUNDARY_PROMPT = `Side conversation boundary.
@@ -65,28 +67,10 @@ async function runCodexAppServerSideQuestion(params, options) {
 		config: params.cfg,
 		agentId: sessionAgentId
 	});
-	const usesSupervisionConnection = binding.connectionScope === "supervision";
-	const supervisionModelSelection = usesSupervisionConnection ? requireCodexSupervisionModelSelection(binding) : void 0;
-	const preparedRuntimeAuth = params.preparedRuntimeAuth;
-	const { authProfileId, nativeAuthProfile: preparedNativeAuthProfile, preparedAuth: startupPreparedAuth } = usesSupervisionConnection ? {
-		authProfileId: void 0,
-		nativeAuthProfile: true,
-		preparedAuth: void 0
-	} : await resolveCodexAppServerPreparedAuthHandoff({
-		authRequirement: preparedRuntimeAuth.plan.modelRoute?.authRequirement,
-		resolvedApiKey: preparedRuntimeAuth.resolvedApiKey,
-		authProfileId: preparedRuntimeAuth.plan.forwardedAuthProfileId,
-		authProfileStore: preparedRuntimeAuth.authProfileStore,
-		agentDir: params.agentDir,
-		homeScope: resolveCodexAppServerHomeScope({ appServer: pluginConfig.appServer }),
-		config: params.cfg,
-		subscriptionProfileRequiredError: "Prepared Codex subscription route requires a scoped native OAuth or token profile.",
-		subscriptionProfileUnusableError: `Prepared Codex auth profile "${preparedRuntimeAuth.plan.forwardedAuthProfileId}" is unusable.`
-	});
-	const modelProvider = supervisionModelSelection ? supervisionModelSelection.modelProvider : resolveCodexAppServerModelProvider({
+	const authProfileId = params.authProfileId ?? binding.authProfileId;
+	const modelProvider = resolveCodexAppServerModelProvider({
 		provider: params.provider,
 		authProfileId,
-		authProfileStore: preparedRuntimeAuth.authProfileStore,
 		agentDir: params.agentDir,
 		config: params.cfg
 	}) ?? resolveCodexBindingModelProviderFallback({
@@ -96,23 +80,24 @@ async function runCodexAppServerSideQuestion(params, options) {
 		bindingModelProvider: binding.modelProvider
 	});
 	const modelSelection = resolveCodexAppServerRequestModelSelection({
-		model: supervisionModelSelection?.model ?? params.model,
+		model: params.model,
 		modelProvider,
 		authProfileId,
-		authProfileStore: preparedRuntimeAuth.authProfileStore,
 		agentDir: params.agentDir,
 		config: params.cfg
 	});
 	const reviewerPolicyContext = resolveCodexModelBackedReviewerPolicyContext({
-		provider: usesSupervisionConnection ? "codex" : params.provider,
-		model: supervisionModelSelection?.model ?? params.model,
+		provider: params.provider,
+		model: params.model,
 		bindingModelProvider: binding.modelProvider,
 		bindingModel: binding.model,
-		nativeAuthProfile: usesSupervisionConnection || preparedNativeAuthProfile
+		nativeAuthProfile: isCodexAppServerNativeAuthProfile({
+			authProfileId,
+			agentDir: params.agentDir,
+			config: params.cfg
+		})
 	});
-	const connection = resolveCodexBindingAppServerConnection({
-		binding,
-		authProfileId,
+	const appServer = resolveCodexAppServerRuntimeOptions({
 		pluginConfig,
 		execPolicy,
 		modelProvider: reviewerPolicyContext.modelProvider,
@@ -120,29 +105,9 @@ async function runCodexAppServerSideQuestion(params, options) {
 		config: params.cfg,
 		agentDir: params.agentDir
 	});
-	const appServer = connection.appServer;
 	const cwd = binding.cwd || params.workspaceDir || process.cwd();
 	const runId = params.opts?.runId ?? randomUUID();
-	const effectiveParams = supervisionModelSelection ? {
-		...params,
-		provider: supervisionModelSelection.modelProvider,
-		model: supervisionModelSelection.model,
-		runtimeModel: {
-			id: supervisionModelSelection.model,
-			name: supervisionModelSelection.model,
-			provider: supervisionModelSelection.modelProvider,
-			api: "openai-chatgpt-responses",
-			reasoning: true,
-			input: ["text", "image"],
-			cost: {
-				input: 0,
-				output: 0,
-				cacheRead: 0,
-				cacheWrite: 0
-			}
-		}
-	} : params;
-	const sideRunParams = buildSideRunAttemptParams(effectiveParams, {
+	const sideRunParams = buildSideRunAttemptParams(params, {
 		cwd,
 		authProfileId,
 		runId
@@ -156,17 +121,13 @@ async function runCodexAppServerSideQuestion(params, options) {
 	if (nativeExecutionBlock) throw new Error(nativeExecutionBlock);
 	const nativeToolSurfaceEnabled = shouldEnableCodexAppServerNativeToolSurface(sideRunParams);
 	if (!nativeToolSurfaceEnabled) throw new Error("Codex-native /btw side-question mode is unavailable because the effective tool policy restricts Codex native tools for this session.");
-	const clientOptions = {
+	const client = await getLeasedSharedCodexAppServerClient({
 		startOptions: appServer.start,
 		timeoutMs: appServer.requestTimeoutMs,
-		authRequirement: preparedRuntimeAuth.plan.modelRoute?.authRequirement,
-		...startupPreparedAuth ? { preparedAuth: startupPreparedAuth } : { authProfileId: connection.clientAuthProfileId },
+		authProfileId,
 		agentDir: params.agentDir,
-		config: params.cfg,
-		...params.opts?.abortSignal ? { abandonSignal: params.opts.abortSignal } : {}
-	};
-	let client = await getLeasedSharedCodexAppServerClient(clientOptions);
-	const clientLease = { client };
+		config: params.cfg
+	});
 	const collector = new CodexSideQuestionCollector(params, () => readRecentCodexRateLimits(client));
 	const runAbortController = new AbortController();
 	let nativeToolLifecycleProjector;
@@ -196,7 +157,7 @@ async function runCodexAppServerSideQuestion(params, options) {
 		}
 		flushPendingNativePreToolUseFailures();
 	};
-	const handleNotification = (notification) => {
+	const removeNotificationHandler = client.addNotificationHandler((notification) => {
 		collector.handleNotification(notification);
 		if (notification.method !== "item/started" && notification.method !== "item/completed" && notification.method !== "rawResponseItem/completed" && notification.method !== "turn/completed") return;
 		if (!nativeToolLifecycleProjector) {
@@ -204,8 +165,7 @@ async function runCodexAppServerSideQuestion(params, options) {
 			return;
 		}
 		nativeToolLifecycleProjector.handleNotification(notification);
-	};
-	let removeNotificationHandler = client.addNotificationHandler(handleNotification);
+	});
 	const abortFromUpstream = () => runAbortController.abort(params.opts?.abortSignal?.reason ?? "codex_side_question_abort");
 	if (params.opts?.abortSignal?.aborted) abortFromUpstream();
 	else params.opts?.abortSignal?.addEventListener("abort", abortFromUpstream, { once: true });
@@ -213,7 +173,6 @@ async function runCodexAppServerSideQuestion(params, options) {
 	let turnId;
 	let removeRequestHandler;
 	let nativeHookRelay;
-	const activeDynamicToolCalls = /* @__PURE__ */ new Set();
 	try {
 		const modelScopedAppServer = resolveCodexAppServerForModelProvider({
 			appServer,
@@ -233,7 +192,7 @@ async function runCodexAppServerSideQuestion(params, options) {
 		const approvalPolicy = useModelScopedPolicy ? modelScopedAppServer.approvalPolicy : binding.approvalPolicy ?? modelScopedAppServer.approvalPolicy;
 		const sandbox = useModelScopedPolicy ? modelScopedAppServer.sandbox : binding.sandbox ?? modelScopedAppServer.sandbox;
 		const { toolBridge, webSearchPlan } = await createCodexSideToolBridge({
-			params: effectiveParams,
+			params,
 			cwd,
 			pluginConfig,
 			sessionAgentId,
@@ -252,14 +211,10 @@ async function runCodexAppServerSideQuestion(params, options) {
 		});
 		ensureCodexAppServerClientRuntime(client, {
 			agentDir: params.agentDir,
-			authProfileId: startupPreparedAuth?.kind === "api-key" ? void 0 : connection.requestAuthProfileId,
-			...!usesSupervisionConnection ? {
-				authProfileStore: preparedRuntimeAuth.authProfileStore,
-				authMode: startupPreparedAuth?.kind === "api-key" ? "prepared-api-key" : "profile"
-			} : {},
+			authProfileId,
 			config: params.cfg
 		});
-		const registerRequestHandler = (targetClient) => targetClient.addRequestHandler(async (request) => {
+		removeRequestHandler = client.addRequestHandler(async (request) => {
 			if (!childThreadId || !turnId) return;
 			if (request.method === "mcpServer/elicitation/request") return handleCodexAppServerElicitationRequest({
 				requestParams: request.params,
@@ -277,6 +232,9 @@ async function runCodexAppServerSideQuestion(params, options) {
 				threadId: childThreadId,
 				turnId,
 				nativeHookRelay,
+				execPolicy,
+				execReviewerAgentId: sessionAgentId,
+				internalExecAutoReview: modelScopedAppServer.approvalsReviewer === "user",
 				autoApprove: shouldAutoApproveCodexAppServerApprovals({
 					approvalPolicy,
 					networkProxy: modelScopedAppServer.networkProxy,
@@ -301,16 +259,13 @@ async function runCodexAppServerSideQuestion(params, options) {
 				sessionKey: params.sessionKey
 			};
 			emitDynamicToolStartedDiagnostic(diagnosticContext);
-			const toolCall = handleDynamicToolCallWithTimeout({
-				call,
-				toolBridge,
-				signal: runAbortController.signal,
-				timeoutMs,
-				observeToolTerminal: sideRunParams.observeToolTerminal
-			});
-			activeDynamicToolCalls.add(toolCall);
 			try {
-				const response = await toolCall;
+				const response = await handleDynamicToolCallWithTimeout({
+					call,
+					toolBridge,
+					signal: runAbortController.signal,
+					timeoutMs
+				});
 				emitDynamicToolTerminalDiagnostic({
 					...diagnosticContext,
 					response,
@@ -327,23 +282,8 @@ async function runCodexAppServerSideQuestion(params, options) {
 					terminalReason: runAbortController.signal.aborted ? resolveCodexToolAbortTerminalReason(runAbortController.signal) : "failed"
 				});
 				throw error;
-			} finally {
-				activeDynamicToolCalls.delete(toolCall);
 			}
 		});
-		removeRequestHandler = registerRequestHandler(client);
-		const rebindClientHandlers = (nextClient) => {
-			removeRequestHandler?.();
-			removeNotificationHandler();
-			client = nextClient;
-			ensureCodexAppServerClientRuntime(client, {
-				agentDir: params.agentDir,
-				authProfileId: connection.requestAuthProfileId,
-				config: params.cfg
-			});
-			removeNotificationHandler = client.addNotificationHandler(handleNotification);
-			removeRequestHandler = registerRequestHandler(client);
-		};
 		const serviceTier = binding.serviceTier ?? appServer.serviceTier;
 		const nativeHookRelayEvents = resolveCodexSideNativeHookRelayEvents({
 			configuredEvents: options.nativeHookRelay?.events,
@@ -365,7 +305,6 @@ async function runCodexAppServerSideQuestion(params, options) {
 			}).channelId,
 			requestTimeoutMs: appServer.requestTimeoutMs,
 			completionTimeoutMs: Math.max(appServer.turnCompletionIdleTimeoutMs, SIDE_QUESTION_COMPLETION_TIMEOUT_MS),
-			loopDetectionPreToolUseRelay: appServer.loopDetectionPreToolUseRelay,
 			signal: runAbortController.signal,
 			onPreToolUseFailure: (failure) => {
 				if (nativePreToolUseFailureFallbackActive) emitNativePreToolUseFailure(failure);
@@ -377,36 +316,32 @@ async function runCodexAppServerSideQuestion(params, options) {
 			relay: nativeHookRelay,
 			events: nativeHookRelayEvents,
 			hookTimeoutSec: options.nativeHookRelay?.hookTimeoutSec,
-			clearOmittedEvents: true,
-			loopDetectionPreToolUseRelay: appServer.loopDetectionPreToolUseRelay
+			clearOmittedEvents: true
 		}) : options.nativeHookRelay?.enabled === false ? buildCodexNativeHookRelayDisabledConfig() : void 0;
 		const runtimeThreadConfig = buildCodexRuntimeThreadConfig(webSearchPlan.threadConfig, {
 			nativeCodeModeEnabled: nativeToolSurfaceEnabled,
 			nativeCodeModeOnlyEnabled: appServer.codeModeOnly
 		});
-		const threadConfig = mergeCodexThreadConfigs(nativeHookRelayConfig, runtimeThreadConfig, binding.pluginAppPolicyContext ? buildCodexPluginAppsConfigPatchFromPolicyContext(binding.pluginAppPolicyContext) : void 0, modelScopedAppServer.networkProxy?.configPatch) ?? runtimeThreadConfig;
-		const forkResponse = assertCodexThreadForkResponse(await withLeasedCodexAppServerClientStartSelectionRetry({
-			lease: clientLease,
-			options: clientOptions,
-			signal: params.opts?.abortSignal,
-			run: async (forkClient, requestOptions) => await forkCodexSideThread(forkClient, {
-				threadId: binding.threadId,
-				model: modelSelection.model,
-				...modelSelection.modelProvider ? { modelProvider: modelSelection.modelProvider } : {},
-				cwd,
-				approvalPolicy,
-				approvalsReviewer: modelScopedAppServer.approvalsReviewer,
-				...modelScopedAppServer.networkProxy ? {} : { sandbox },
-				...serviceTier ? { serviceTier } : {},
-				config: threadConfig,
-				developerInstructions: SIDE_DEVELOPER_INSTRUCTIONS,
-				ephemeral: true,
-				threadSource: "user"
-			}, requestOptions),
-			onClientChange: rebindClientHandlers
-		}));
-		childThreadId = forkResponse.thread.id;
-		if (supervisionModelSelection && (forkResponse.model !== supervisionModelSelection.model || forkResponse.modelProvider !== supervisionModelSelection.modelProvider)) throw new Error("Codex supervised side thread did not preserve its native model and provider");
+		const pluginAppsConfigPatch = binding.pluginAppPolicyContext ? buildCodexPluginAppsConfigPatchFromPolicyContext(binding.pluginAppPolicyContext) : void 0;
+		const threadConfig = mergeCodexThreadConfigs(nativeHookRelayConfig, runtimeThreadConfig, pluginAppsConfigPatch, modelScopedAppServer.networkProxy?.configPatch) ?? runtimeThreadConfig;
+		childThreadId = assertCodexThreadForkResponse(await forkCodexSideThread(client, {
+			threadId: binding.threadId,
+			model: modelSelection.model,
+			...modelSelection.modelProvider ? { modelProvider: modelSelection.modelProvider } : {},
+			personality: CODEX_NATIVE_PERSONALITY_NONE,
+			cwd,
+			approvalPolicy,
+			approvalsReviewer: modelScopedAppServer.approvalsReviewer,
+			...modelScopedAppServer.networkProxy ? {} : { sandbox },
+			...serviceTier ? { serviceTier } : {},
+			config: threadConfig,
+			developerInstructions: SIDE_DEVELOPER_INSTRUCTIONS,
+			ephemeral: true,
+			threadSource: "user"
+		}, {
+			timeoutMs: appServer.requestTimeoutMs,
+			signal: params.opts?.abortSignal
+		})).thread.id;
 		await client.request("thread/inject_items", {
 			threadId: childThreadId,
 			items: [sideBoundaryPromptItem()]
@@ -414,7 +349,7 @@ async function runCodexAppServerSideQuestion(params, options) {
 			timeoutMs: appServer.requestTimeoutMs,
 			signal: params.opts?.abortSignal
 		});
-		const effort = usesSupervisionConnection ? void 0 : resolveReasoningEffort(params.resolvedThinkLevel ?? "off", modelSelection.model, readCodexSupportedReasoningEfforts(params.runtimeModel?.compat));
+		const effort = resolveReasoningEffort(params.resolvedThinkLevel ?? "off", modelSelection.model, readCodexSupportedReasoningEfforts(params.runtimeModel?.compat));
 		turnId = assertCodexTurnStartResponse(await client.request("turn/start", {
 			threadId: childThreadId,
 			input: [{
@@ -424,17 +359,15 @@ async function runCodexAppServerSideQuestion(params, options) {
 			}],
 			cwd,
 			model: modelSelection.model,
-			...usesSupervisionConnection ? {} : { personality: CODEX_NATIVE_PERSONALITY_NONE },
+			personality: CODEX_NATIVE_PERSONALITY_NONE,
 			...serviceTier ? { serviceTier } : {},
-			...usesSupervisionConnection ? {} : {
-				effort,
-				collaborationMode: {
-					mode: "default",
-					settings: {
-						model: modelSelection.model,
-						reasoning_effort: effort,
-						developer_instructions: null
-					}
+			effort,
+			collaborationMode: {
+				mode: "default",
+				settings: {
+					model: modelSelection.model,
+					reasoning_effort: effort,
+					developer_instructions: null
 				}
 			}
 		}, {
@@ -470,7 +403,6 @@ async function runCodexAppServerSideQuestion(params, options) {
 			params.opts?.abortSignal?.removeEventListener("abort", abortFromUpstream);
 			removeRequestHandler?.();
 			if (!runAbortController.signal.aborted) runAbortController.abort("codex_side_question_finished");
-			await Promise.allSettled(activeDynamicToolCalls);
 			try {
 				await cleanupCodexSideThread(client, {
 					threadId: childThreadId,
@@ -488,7 +420,7 @@ async function runCodexAppServerSideQuestion(params, options) {
 			}
 		} finally {
 			flushPendingNativePreToolUseFailures();
-			releaseCodexAppServerClientLease(clientLease);
+			releaseLeasedSharedCodexAppServerClient(client);
 			nativeHookRelay?.unregister();
 		}
 	}
@@ -508,7 +440,6 @@ function registerCodexSideNativeHookRelay(params) {
 		runId: params.runId,
 		...params.channelId ? { channelId: params.channelId } : {},
 		allowedEvents: params.events,
-		preToolUseLoopDetection: params.loopDetectionPreToolUseRelay,
 		ttlMs: resolveCodexSideNativeHookRelayTtlMs({
 			explicitTtlMs: params.options.ttlMs,
 			requestTimeoutMs: params.requestTimeoutMs,
@@ -542,12 +473,9 @@ function buildSideRunAttemptParams(params, options) {
 		agentId: params.agentId,
 		...params.messageChannel ? { messageChannel: params.messageChannel } : {},
 		...params.messageProvider ? { messageProvider: params.messageProvider } : {},
-		...params.chatType ? { chatType: params.chatType } : {},
 		...params.agentAccountId ? { agentAccountId: params.agentAccountId } : {},
 		...params.messageTo ? { messageTo: params.messageTo } : {},
 		...params.messageThreadId !== void 0 ? { messageThreadId: params.messageThreadId } : {},
-		...params.chatId ? { chatId: params.chatId } : {},
-		...params.messageActionTurnCapability ? { messageActionTurnCapability: params.messageActionTurnCapability } : {},
 		...params.groupId !== void 0 ? { groupId: params.groupId } : {},
 		...params.groupChannel !== void 0 ? { groupChannel: params.groupChannel } : {},
 		...params.groupSpace !== void 0 ? { groupSpace: params.groupSpace } : {},
@@ -562,13 +490,12 @@ function buildSideRunAttemptParams(params, options) {
 		...params.toolsAllow ? { toolsAllow: params.toolsAllow } : {},
 		workspaceDir: options.cwd,
 		authProfileId: options.authProfileId,
-		authProfileIdSource: options.authProfileId ? params.preparedRuntimeAuth.plan.forwardedAuthProfileSource : void 0,
+		authProfileIdSource: params.authProfileIdSource,
 		thinkLevel: params.resolvedThinkLevel ?? "off",
 		resolvedReasoningLevel: params.resolvedReasoningLevel,
-		authStorage: params.preparedRuntimeAuth.authStorage,
-		authProfileStore: params.preparedRuntimeAuth.authProfileStore,
-		modelRegistry: params.preparedRuntimeAuth.modelRegistry,
-		...params.preparedRuntimeAuth.resolvedApiKey ? { resolvedApiKey: params.preparedRuntimeAuth.resolvedApiKey } : {},
+		authStorage: void 0,
+		authProfileStore: void 0,
+		modelRegistry: void 0,
 		runId: options.runId,
 		abortSignal: params.opts?.abortSignal,
 		onAgentEvent: (event) => {
@@ -593,7 +520,7 @@ async function createCodexSideToolBridge(input) {
 			sessionKey: sandboxSessionKey,
 			workspaceDir: input.cwd
 		});
-		tools = filterToolsForVisionInputs(filterCodexDynamicTools(createOpenClawCodingTools({
+		const allTools = createOpenClawCodingTools({
 			agentId: input.sessionAgentId,
 			sessionKey: sandboxSessionKey,
 			runSessionKey: input.params.sessionKey && input.params.sessionKey !== sandboxSessionKey ? input.params.sessionKey : void 0,
@@ -618,12 +545,9 @@ async function createCodexSideToolBridge(input) {
 				messageProvider: messageToolProvider,
 				toolPolicyMessageProvider: input.params.messageProvider ?? input.params.messageChannel
 			} : {},
-			...input.params.chatType ? { chatType: input.params.chatType } : {},
 			...input.params.agentAccountId ? { agentAccountId: input.params.agentAccountId } : {},
 			...input.params.messageTo ? { messageTo: input.params.messageTo } : {},
 			...input.params.messageThreadId !== void 0 ? { messageThreadId: input.params.messageThreadId } : {},
-			...input.params.chatId ? { nativeChannelId: input.params.chatId } : {},
-			...input.params.messageActionTurnCapability ? { messageActionTurnCapability: input.params.messageActionTurnCapability } : {},
 			...input.params.groupId !== void 0 ? { groupId: input.params.groupId } : {},
 			...input.params.groupChannel !== void 0 ? { groupChannel: input.params.groupChannel } : {},
 			...input.params.groupSpace !== void 0 ? { groupSpace: input.params.groupSpace } : {},
@@ -645,7 +569,9 @@ async function createCodexSideToolBridge(input) {
 			emitBeforeToolCallDiagnostics: false,
 			modelHasVision: runtimeModel.input?.includes("image") ?? false,
 			requireExplicitMessageTarget: true
-		}), input.pluginConfig), {
+		});
+		const codexFilteredTools = filterCodexDynamicTools(allTools, input.pluginConfig);
+		tools = filterToolsForVisionInputs(codexFilteredTools, {
 			modelHasVision: runtimeModel.input?.includes("image") ?? false,
 			hasInboundImages: false
 		});
@@ -660,7 +586,7 @@ async function createCodexSideToolBridge(input) {
 		config: input.params.cfg,
 		webSearchAllowed: false
 	}) : requestedWebSearchPlan;
-	const exposedTools = tools.filter((tool) => tool.name !== "web_search" && tool.name !== "computer");
+	const exposedTools = tools.filter((tool) => tool.name !== "web_search");
 	const hookChannelFields = buildAgentHookContextChannelFields({
 		sessionKey: input.params.sessionKey,
 		messageChannel: input.params.messageChannel,
@@ -675,7 +601,6 @@ async function createCodexSideToolBridge(input) {
 			hookContext: {
 				agentId: input.sessionAgentId,
 				config: input.params.cfg,
-				contextWindowTokens: runtimeModel.contextWindow,
 				sessionId: input.params.sessionId,
 				sessionKey: input.params.sessionKey,
 				runId: input.runId,