@openclaw/codex 2026.7.2-beta.7 → 2026.8.1-beta.2

package/dist/{dynamic-tools-D2gYkSBO.js → dynamic-tools-BVdyWkUD.js}

@@ -1,136 +1,35 @@
-import { H as CODEX_OPENCLAW_DIRECT_DYNAMIC_TOOL_NAMESPACE, W as isJsonObject, X as resolveCodexGatewayTimeoutWithGraceMs, l as releaseLeasedSharedCodexAppServerClient } from "./shared-client-DTbvH-XV.js";
-import { O as readCodexPluginConfig } from "./session-binding-BXpo9ymA.js";
-import { D as isForcedPrivateQaCodexRuntime, E as filterCodexDynamicToolsWithOpenClawShell, O as isSystemAgentOnlyCodexDynamicToolAllowlist, T as filterCodexDynamicTools, ct as readString$2, g as resolveCodexWebSearchPlan, i as invalidInlineImageText, k as normalizeCodexDynamicToolName, nt as readItemString, o as sanitizeInlineImageDataUrl, tt as readItem } from "./thread-lifecycle-DF53ogiA.js";
-import { S as readCodexTurn } from "./transcript-mirror-DzsdNCf5.js";
-import { r as formatCodexDisplayText } from "./command-formatters-C336eRVS.js";
-import { a as resolveCodexNodeExecToolOverrides, i as resolveCodexNativeExecutionPolicy } from "./sandbox-guard-NuhpXmPB.js";
-import { n as readCodexNotificationThreadId, r as readCodexNotificationTurnId } from "./notification-correlation-CU6_AnOb.js";
-import path from "node:path";
+import { C as isCodexRemoteExecPlacementSandbox, T as readCodexPluginConfig } from "./session-binding-DPxIvMgE.js";
+import { S as resolveCodexGatewayTimeoutWithGraceMs, ct as isJsonObject, l as releaseLeasedSharedCodexAppServerClient, ot as CODEX_OPENCLAW_DIRECT_DYNAMIC_TOOL_NAMESPACE } from "./shared-client-kIBbGjk4.js";
+import { E as itemStatus, F as readItem, b as auditNativeToolUnfinishedStatus, h as isCodexNotificationForTurn, v as auditNativeToolName, y as auditNativeToolTerminalStatus } from "./attempt-client-cleanup-DMLXUfa8.js";
+import { l as readCodexTurn } from "./protocol-validators-B4F7L8Rf.js";
+import { D as isSystemAgentOnlyCodexDynamicToolAllowlist, E as isForcedPrivateQaCodexRuntime, O as normalizeCodexDynamicToolName, T as filterCodexDynamicToolsForDisabledNativeSurface, f as resolveCodexWebSearchPlan, w as filterCodexDynamicTools } from "./thread-lifecycle-Bu1BTDXr.js";
+import { r as sanitizeInlineImageDataUrl, t as invalidInlineImageText } from "./image-payload-sanitizer-CnfoUPCE.js";
+import { r as formatCodexDisplayText } from "./command-formatters-B1AEz8ZA.js";
+import { a as resolveCodexNodeExecToolOverrides, i as resolveCodexNativeExecutionPolicy } from "./sandbox-guard-Cmwc9eIk.js";
+import { asNonArrayRecord, asOptionalRecord, isRecord, normalizeOptionalString, normalizeTrimmedStringList, readStringField } from "openclaw/plugin-sdk/string-coerce-runtime";
+import path, { posix } from "node:path";
+import { createDeferred } from "openclaw/plugin-sdk/extension-shared";
 import { addTimerTimeoutGraceMs, asDateTimestampMs, finiteSecondsToTimerSafeMilliseconds, parseStrictNonNegativeInteger } from "openclaw/plugin-sdk/number-runtime";
-import { HEARTBEAT_RESPONSE_TOOL_NAME, buildAgentHookContextChannelFields, buildEmbeddedAttemptToolRunContext, callGatewayTool, consumeAdjustedParamsForToolCall, consumePreExecutionBlockedToolCall, createAgentToolResultMiddlewareRunner, createCodexAppServerToolResultExtensionRunner, embeddedAgentLog, extractMessagingToolSend, extractMessagingToolSendResult, extractToolResultMediaArtifact, filterProviderNormalizableTools, filterToolResultMediaUrls, finalizeToolTerminalPresentation, formatApprovalDisplayPath, formatToolExecutionErrorMessage, getBeforeToolCallFailureDisposition, getChannelAgentToolMeta, getPluginToolMeta, hasNativeHookRelayInvocation, invokeNativeHookRelay, isDeliveredMessageToolOnlySourceReplyResult, isDeliveredMessagingToolResult, isHostScopedAgentToolActive, isMessagingTool, isMessagingToolSendAction, isReplaySafeToolCall, isSubagentSessionKey, isToolResultError, isToolWrappedWithBeforeToolCallHook, normalizeAgentRuntimeTools, normalizeHeartbeatToolResponse, projectRuntimeToolInputSchema, registerNativeHookRelay, resolveAttemptSpawnWorkspaceDir, resolveModelAuthMode, resolveNativeHookRelayDeferredToolApproval, resolveToolExecutionErrorKind, resolveToolResultFailureKind, runAgentHarnessAfterToolCallHook, runBeforeToolCallHook, sanitizeToolResult, setBeforeToolCallDiagnosticsEnabled, supportsModelTools, wrapToolWithBeforeToolCallHook } from "openclaw/plugin-sdk/agent-harness-runtime";
-import { createHash } from "node:crypto";
+import { HEARTBEAT_RESPONSE_TOOL_NAME, buildAgentHookContextChannelFields, buildEmbeddedAttemptToolRunContext, consumeAdjustedParamsForToolCall, consumePreExecutionBlockedToolCall, createAgentToolResultMiddlewareRunner, createCodexAppServerToolResultExtensionRunner, embeddedAgentLog, extractMessagingToolSend, extractMessagingToolSendResult, extractToolResultMediaArtifact, filterProviderNormalizableTools, filterToolResultMediaUrls, finalizeToolTerminalPresentation, formatApprovalDisplayPath, formatToolExecutionErrorMessage, getBeforeToolCallFailureDisposition, getChannelAgentToolMeta, getPluginToolMeta, hasNativeHookRelayInvocation, invokeNativeHookRelay, isDeliveredMessageToolOnlySourceReplyResult, isDeliveredMessagingToolResult, isHostScopedAgentToolActive, isMessagingTool, isMessagingToolSendAction, isReplaySafeToolCall, isSubagentSessionKey, isToolResultError, isToolWrappedWithBeforeToolCallHook, normalizeAgentRuntimeTools, normalizeHeartbeatToolResponse, projectRuntimeToolInputSchema, resolveAttemptSpawnWorkspaceDir, resolveModelAuthMode, resolveNativeHookRelayDeferredToolApproval, resolveToolExecutionErrorKind, resolveToolResultFailureKind, runAgentHarnessAfterToolCallHook, sanitizeToolResult, setBeforeToolCallDiagnosticsEnabled, supportsModelTools, wrapToolWithBeforeToolCallHook } from "openclaw/plugin-sdk/agent-harness-runtime";
+import { createHash, randomUUID } from "node:crypto";
 import { resolveAgentDir as resolveAgentDir$1 } from "openclaw/plugin-sdk/agent-runtime";
-import { isRecord, normalizeTrimmedStringList } from "openclaw/plugin-sdk/string-coerce-runtime";
-import { sliceUtf16Safe, truncateUtf16Safe } from "openclaw/plugin-sdk/text-utility-runtime";
+import { SsrFBlockedError, isBlockedHostnameOrIp } from "openclaw/plugin-sdk/ssrf-runtime";
+import { spawn } from "node:child_process";
+import { coerceErrorMessage, isApprovalNotFoundError, toErrorObject } from "openclaw/plugin-sdk/error-runtime";
+import { DEFAULT_MAX_LIVE_TOOL_RESULT_CHARS, estimateToolResultTextChars, resolveLiveToolResultMaxChars, sliceToolResultTextToBudget, sliceUtf16Safe, truncateUtf16Safe } from "openclaw/plugin-sdk/text-utility-runtime";
+import { once } from "node:events";
+import { isIP } from "node:net";
+import { WebSocketServer } from "ws";
+import { fileURLToPath, pathToFileURL } from "node:url";
 import { expectDefined } from "openclaw/plugin-sdk/expect-runtime";
+import { runWithCronCreatorAuthorityCapabilityResolver } from "openclaw/plugin-sdk/codex-mcp-projection";
 import { emitTrustedDiagnosticEvent, hasPendingInternalDiagnosticEvent } from "openclaw/plugin-sdk/diagnostic-runtime";
-import { isToolAllowed } from "openclaw/plugin-sdk/sandbox";
+import { isToolAllowed, sanitizeEnvVars } from "openclaw/plugin-sdk/sandbox";
 import { saveMediaBuffer } from "openclaw/plugin-sdk/media-store";
+import { registerRetainedNativeHookRelayForBundledRuntime } from "openclaw/plugin-sdk/native-hook-relay-runtime";
 import { root } from "openclaw/plugin-sdk/file-access-runtime";
 import { getMediaDir } from "openclaw/plugin-sdk/media-runtime";
-import { isApprovalNotFoundError } from "openclaw/plugin-sdk/error-runtime";
 import { normalizeOpenAIToolSchemas } from "openclaw/plugin-sdk/provider-tools";
-//#region extensions/codex/src/app-server/event-projector-items.ts
-function itemKind(item) {
-	switch (item.type) {
-		case "dynamicToolCall":
-		case "mcpToolCall": return "tool";
-		case "commandExecution": return "command";
-		case "fileChange": return "patch";
-		case "webSearch": return "search";
-		case "reasoning":
-		case "contextCompaction": return "analysis";
-		default: return;
-	}
-}
-function itemTitle(item) {
-	switch (item.type) {
-		case "commandExecution": return "Command";
-		case "fileChange": return "File change";
-		case "mcpToolCall": return "MCP tool";
-		case "dynamicToolCall": return "Tool";
-		case "webSearch": return "Web search";
-		case "contextCompaction": return "Context compaction";
-		case "reasoning": return "Reasoning";
-		default: return item.type;
-	}
-}
-function itemStatus(item) {
-	const status = readItemString(item, "status");
-	if (status === "failed" || status === "error") return "failed";
-	if (status === "declined") return "blocked";
-	if (status === "inProgress" || status === "in_progress" || status === "running") return "running";
-	return "completed";
-}
-function unknownItemStatus(item) {
-	const status = readItemString(item, "status");
-	switch (status) {
-		case void 0:
-		case "completed":
-		case "failed":
-		case "error":
-		case "declined":
-		case "inProgress":
-		case "in_progress":
-		case "running": return;
-		default: return status;
-	}
-}
-function auditNativeToolTerminalStatus(item) {
-	if (item.type === "imageView" || item.type === "sleep") return "completed";
-	const status = readItemString(item, "status");
-	if (status === "completed") return "completed";
-	if (status === "failed" || status === "error") return "failed";
-	if (status === "declined") return "blocked";
-	return "unknown";
-}
-function auditNativeToolUnfinishedStatus(item) {
-	return item.type === "webSearch" || item.type === "imageGeneration" ? "unknown" : "failed";
-}
-function isNonSuccessItemStatus(status) {
-	return status === "failed" || status === "blocked";
-}
-function itemName(item) {
-	if (item.type === "dynamicToolCall" && typeof item.tool === "string") return item.tool;
-	if (item.type === "mcpToolCall" && typeof item.tool === "string") {
-		const server = typeof item.server === "string" ? item.server : void 0;
-		return server ? `${server}.${item.tool}` : item.tool;
-	}
-	if (item.type === "commandExecution") return "bash";
-	if (item.type === "fileChange") return "apply_patch";
-	if (item.type === "webSearch") return "web_search";
-}
-function auditNativeToolName(item) {
-	if (item.type === "dynamicToolCall") return;
-	const progressName = itemName(item);
-	if (progressName) return progressName;
-	if (item.type === "collabAgentToolCall") return typeof item.tool === "string" && item.tool.trim() ? `collab.${item.tool.trim()}` : "collab_agent";
-	if (item.type === "imageGeneration") return "image_generation";
-	if (item.type === "imageView") return "image_view";
-	if (item.type === "sleep") return "sleep";
-}
-function isSideEffectingNativeToolItem(item) {
-	return itemStatus(item) !== "blocked" && (isMutatingNativeToolItem(item) || item.type === "mcpToolCall");
-}
-function shouldSynthesizeToolProgressForItem(item) {
-	switch (item.type) {
-		case "commandExecution":
-		case "fileChange":
-		case "webSearch":
-		case "mcpToolCall": return true;
-		default: return false;
-	}
-}
-function shouldRecordNativeToolTranscript(item) {
-	return shouldSynthesizeToolProgressForItem(item);
-}
-function isMutatingNativeToolItem(item) {
-	if (item.type === "commandExecution") return true;
-	return item.type === "fileChange" || item.type === "collabAgentToolCall" || item.type === "imageGeneration";
-}
-function shouldClearTerminalPresentationForNativeItem(item) {
-	switch (item.type) {
-		case "collabAgentToolCall":
-		case "commandExecution":
-		case "fileChange":
-		case "imageGeneration":
-		case "imageView":
-		case "mcpToolCall":
-		case "webSearch": return true;
-		default: return false;
-	}
-}
-//#endregion
 //#region extensions/codex/src/app-server/dynamic-tool-response-state.ts
 /** Retains the host-owned app preview without adding it to Codex's response payload. */
 function withDynamicToolTranscriptDetails(response, details) {
@@ -608,6 +507,7 @@ const CODEX_NATIVE_HOOK_RELAY_COMMAND_MAX_PARENT_MARGIN_MS = 1e3;
 const CODEX_NATIVE_HOOK_RELAY_DEFAULT_TIMEOUT_SEC = 10;
 const CODEX_NATIVE_HOOK_RELAY_UNREGISTER_GRACE_MS = 1e4;
 const CODEX_NATIVE_HOOK_RELAY_UNREGISTER_EXTRA_GRACE_MS = 5e3;
+const MAX_PENDING_DIRECT_CHILD_ADMISSIONS = 32;
 const CODEX_HOOK_MATCHER_NAMES_BY_TOOL_ID = {
 	exec: [
 		"Bash",
@@ -663,7 +563,16 @@ function emitCodexNativePreToolUseFailureDiagnostic(params) {
 /** Registers an OpenClaw native hook relay for a Codex app-server turn. */
 function createCodexNativeHookRelay(params) {
 	if (params.options?.enabled === false) return;
-	return registerNativeHookRelay({
+	const directChildClaims = /* @__PURE__ */ new Map();
+	const pendingDirectChildAdmissions = /* @__PURE__ */ new Map();
+	let foregroundClosed = false;
+	let successfulYieldRetentionAuthorized = false;
+	const assertClaim = (threadId, claim) => () => directChildClaims.get(threadId) === claim;
+	const rejectPendingAdmissions = (reason) => {
+		for (const pending of pendingDirectChildAdmissions.values()) pending.reject(new Error(reason));
+		pendingDirectChildAdmissions.clear();
+	};
+	const relay = registerRetainedNativeHookRelayForBundledRuntime({
 		provider: "codex",
 		relayId: buildCodexNativeHookRelayId({
 			agentId: params.agentId,
@@ -689,12 +598,79 @@ function createCodexNativeHookRelay(params) {
 			turnStartTimeoutMs: params.turnStartTimeoutMs
 		}),
 		signal: params.signal,
+		runBeforeToolCall: params.hostCapabilities.runBeforeToolCall,
+		assertActive: params.hostCapabilities.assertActive,
+		retention: {
+			readClaim: readCodexNativeChildThreadId,
+			shouldRetainAfterForegroundClose: () => successfulYieldRetentionAuthorized && directChildClaims.size > 0,
+			allowPreToolUse: (childThreadId) => directChildClaims.has(childThreadId),
+			awaitForegroundAdmission: (childThreadId) => {
+				if (foregroundClosed) return Promise.reject(/* @__PURE__ */ new Error("native hook relay foreground admission unavailable"));
+				const existingClaim = directChildClaims.get(childThreadId);
+				if (existingClaim) return Promise.resolve(assertClaim(childThreadId, existingClaim));
+				const existingPending = pendingDirectChildAdmissions.get(childThreadId);
+				if (existingPending) return existingPending.promise.then((claim) => assertClaim(childThreadId, claim));
+				if (pendingDirectChildAdmissions.size >= MAX_PENDING_DIRECT_CHILD_ADMISSIONS) return Promise.reject(/* @__PURE__ */ new Error("native hook relay foreground admission capacity reached"));
+				const { promise, resolve, reject } = createDeferred();
+				pendingDirectChildAdmissions.set(childThreadId, {
+					promise,
+					resolve,
+					reject
+				});
+				return promise.then((claim) => assertClaim(childThreadId, claim));
+			},
+			onDispose: () => {
+				foregroundClosed = true;
+				rejectPendingAdmissions("native hook relay registration closed");
+			}
+		},
 		onPreToolUseFailure: params.onPreToolUseFailure,
 		command: {
 			nice: 10,
 			timeoutMs: params.options?.gatewayTimeoutMs
 		}
 	});
+	const unregister = () => {
+		foregroundClosed = true;
+		rejectPendingAdmissions("native hook relay foreground closed");
+		relay.unregister();
+	};
+	return {
+		...relay,
+		unregister,
+		authorizeRetentionAfterSuccessfulYield: () => {
+			successfulYieldRetentionAuthorized = true;
+		},
+		rejectPendingDirectChild: (threadIdInput, reason) => {
+			const threadId = threadIdInput.trim();
+			const pending = threadId ? pendingDirectChildAdmissions.get(threadId) : void 0;
+			if (!pending) return;
+			pendingDirectChildAdmissions.delete(threadId);
+			pending.reject(new Error(reason));
+		},
+		claimDirectChild: (threadIdInput) => {
+			const threadId = threadIdInput.trim();
+			if (!threadId) return () => void 0;
+			if (directChildClaims.get(threadId)) return () => void 0;
+			const claim = Symbol(threadId);
+			directChildClaims.set(threadId, claim);
+			const pending = pendingDirectChildAdmissions.get(threadId);
+			pendingDirectChildAdmissions.delete(threadId);
+			pending?.resolve(claim);
+			let released = false;
+			return () => {
+				if (released) return;
+				released = true;
+				if (directChildClaims.get(threadId) !== claim) return;
+				directChildClaims.delete(threadId);
+				if (foregroundClosed && directChildClaims.size === 0) relay.unregister();
+			};
+		}
+	};
+}
+function readCodexNativeChildThreadId(rawPayload) {
+	if (!isJsonObject(rawPayload) || typeof rawPayload.agent_id !== "string") return;
+	return rawPayload.agent_id.trim() || void 0;
 }
 /** Selects the native hook events Codex should install for the current approval mode. */
 function resolveCodexNativeHookRelayEvents(params) {
@@ -848,7 +824,7 @@ var CodexNativeToolLifecycleProjector = class {
 	}
 	handleNotification(notification) {
 		const params = isJsonObject(notification.params) ? notification.params : void 0;
-		if (!params || readCodexNotificationThreadId(params) !== this.threadId || readCodexNotificationTurnId(params) !== this.turnId) return;
+		if (!params || !isCodexNotificationForTurn(params, this.threadId, this.turnId)) return;
 		if (notification.method === "turn/completed") {
 			const turn = readCodexTurn(params.turn);
 			if (!turn || turn.id !== this.turnId) return;
@@ -906,12 +882,12 @@ var CodexNativeToolLifecycleProjector = class {
 		this.preToolUseFailureByItem.set(failure.toolCallId, record);
 	}
 	recordRawWebSearchResult(item) {
-		if (readString$2(item, "type") !== "web_search_call") return;
-		const toolCallId = readString$2(item, "id");
+		if (readStringField(item, "type") !== "web_search_call") return;
+		const toolCallId = readStringField(item, "id");
 		if (!toolCallId || this.completedItemIds.has(toolCallId)) return;
 		const toolName = "web_search";
 		this.recordStarted(toolCallId, toolName, "unknown");
-		const rawStatus = readString$2(item, "status");
+		const rawStatus = readStringField(item, "status");
 		if (rawStatus === "in_progress" || rawStatus === "running") return;
 		const status = rawStatus === "completed" ? "completed" : rawStatus === "cancelled" ? "cancelled" : rawStatus === "failed" || rawStatus === "error" || rawStatus === "incomplete" ? "failed" : "unknown";
 		this.recordTerminal(toolCallId, toolName, status, { sourceTimestampMs: this.webSearchCompletionByItem.get(toolCallId)?.sourceTimestampMs });
@@ -1344,37 +1320,6 @@ function mapMessageMediaValues(args, mapValue) {
 /** Mutable dependency seam shared by dynamic-tool construction and its behavioral tests. */
 const dynamicToolBuildState = {};
 //#endregion
-//#region extensions/codex/src/app-server/message-tool-final-control.ts
-/**
-* `final` is a Codex-only control for message-tool-only source delivery. Keep
-* it on the projected Codex schema so other agent runtimes never receive an
-* API contract they do not implement.
-*/
-function addCodexMessageToolOnlyFinalControl(tools, sourceReplyDeliveryMode) {
-	if (sourceReplyDeliveryMode !== "message_tool_only") return tools;
-	for (const tool of tools) if (normalizeCodexDynamicToolName(tool.name) === "message") {
-		const mutableTool = tool;
-		mutableTool.parameters = addCodexMessageToolOnlyFinalParameter(mutableTool.parameters);
-	}
-	return tools;
-}
-function addCodexMessageToolOnlyFinalParameter(parameters) {
-	if (!parameters || typeof parameters !== "object" || Array.isArray(parameters)) return parameters;
-	const schema = parameters;
-	const rawProperties = schema.properties;
-	if (!rawProperties || typeof rawProperties !== "object" || Array.isArray(rawProperties)) return parameters;
-	return {
-		...schema,
-		properties: {
-			...rawProperties,
-			final: {
-				type: "boolean",
-				description: "Set false for progress or true to complete the current source reply. If omitted, OpenClaw continues and resolves the latest omitted source reply when the turn ends."
-			}
-		}
-	};
-}
-//#endregion
 //#region extensions/codex/src/app-server/shell-dynamic-tools.ts
 const CODEX_NODE_EXEC_DYNAMIC_TOOL_NAME = "node_exec";
 const CODEX_NODE_PROCESS_DYNAMIC_TOOL_NAME = "node_process";
@@ -1556,7 +1501,7 @@ async function buildDynamicTools(input) {
 	toolBuildStages.mark("load-agent-harness-tools");
 	const sessionKeys = resolveOpenClawCodingToolsSessionKeys(params, input.sandboxSessionKey);
 	const nativeExecutionPolicy = resolveCodexNativeExecutionPolicyForDynamicTools(input);
-	const codexScopedTools = addCodexMessageToolOnlyFinalControl(createOpenClawCodingTools({
+	const buildOpenClawCodingTools = () => params.hostCapabilities.bindToolSurface(createOpenClawCodingTools({
 		agentId: input.sessionAgentId,
 		...buildEmbeddedAttemptToolRunContext(params),
 		exec: {
@@ -1622,6 +1567,7 @@ async function buildDynamicTools(input) {
 		computerContextEpoch: input.computerContextEpoch,
 		requireExplicitMessageTarget: params.requireExplicitMessageTarget ?? isSubagentSessionKey(params.sessionKey),
 		sourceReplyDeliveryMode: params.sourceReplyDeliveryMode,
+		taskSuggestionDeliveryMode: params.taskSuggestionDeliveryMode,
 		disableMessageTool: input.ignoreDisableMessageTool ? false : params.disableMessageTool,
 		forceMessageTool: shouldForceMessageTool(messagePolicyParams),
 		enableHeartbeatTool: params.trigger === "heartbeat" || input.forceHeartbeatTool === true,
@@ -1640,11 +1586,21 @@ async function buildDynamicTools(input) {
 			toolBuildStages.mark(name);
 		},
 		onToolOutcome: params.onToolOutcome,
-		allocateToolOutcomeOrdinal: params.allocateToolOutcomeOrdinal
-	}), params.sourceReplyDeliveryMode);
+		isTurnTainted: params.isTurnTainted,
+		allocateToolOutcomeOrdinal: params.allocateToolOutcomeOrdinal,
+		cronCreatorToolAllowlistRef: input.cronCreatorToolAllowlistRef,
+		cronCreatorToolAllowlistCaptureRef: input.cronCreatorToolAllowlistCaptureRef,
+		cronCreatorAuthorityUnavailableReason: input.cronCreatorAuthorityUnavailableReason
+	}), { cwd: input.effectiveCwd ?? input.effectiveWorkspace });
+	const allTools = input.resolveCronCreatorToolAuthority ? runWithCronCreatorAuthorityCapabilityResolver({
+		capability: params.cronCreatorAuthorityCapability,
+		runId: params.runId,
+		resolve: input.resolveCronCreatorToolAuthority,
+		run: buildOpenClawCodingTools
+	}) : buildOpenClawCodingTools();
 	toolBuildStages.mark("create-openclaw-coding-tools");
 	const preNormalizationDiagnostics = [];
-	const readableAllToolProjection = filterProviderNormalizableTools(codexScopedTools);
+	const readableAllToolProjection = filterProviderNormalizableTools(allTools);
 	preNormalizationDiagnostics.push(...readableAllToolProjection.diagnostics);
 	const webSearchPlan = resolveCodexWebSearchPlan({
 		config: params.config,
@@ -1653,7 +1609,7 @@ async function buildDynamicTools(input) {
 		nativeProviderWebSearchSupport: input.nativeProviderWebSearchSupport
 	});
 	const readableAllTools = [...readableAllToolProjection.tools];
-	const normallyProfiledTools = shouldKeepOpenClawShellDynamicTools(input, nativeExecutionPolicy) ? filterCodexDynamicToolsWithOpenClawShell(readableAllTools, input.pluginConfig) : filterCodexDynamicTools(readableAllTools, input.pluginConfig);
+	const normallyProfiledTools = input.nativeToolSurfaceEnabled === false ? filterCodexDynamicToolsForDisabledNativeSurface(readableAllTools, input.pluginConfig, { preserveShell: shouldKeepOpenClawShellDynamicTools(input, nativeExecutionPolicy) }) : filterCodexDynamicTools(readableAllTools, input.pluginConfig);
 	const profileFilteredTools = (input.isHostScopedToolActive?.("openclaw") ?? isHostScopedAgentToolActive("openclaw")) && isSystemAgentOnlyCodexDynamicToolAllowlist(params.toolsAllow) ? preserveRingZeroSystemAgentTool(readableAllTools, normallyProfiledTools) : normallyProfiledTools;
 	const codexFilteredTools = addNodeShellDynamicToolsIfNeeded(addSandboxShellDynamicToolsIfAvailable(isCodexMemoryFlushRun(params) ? filterCodexMemoryFlushDynamicTools(readableAllTools) : profileFilteredTools, readableAllTools, input), readableAllTools, input, nativeExecutionPolicy);
 	toolBuildStages.mark("codex-filtering");
@@ -1702,6 +1658,7 @@ async function buildDynamicTools(input) {
 		modelId: params.modelId,
 		modelApi: params.model.api,
 		model: params.model,
+		allowProviderRuntimePluginLoad: input.ignoreRuntimePlan ? false : void 0,
 		onPreNormalizationSchemaDiagnostics: (diagnostics) => preNormalizationDiagnostics.push(...diagnostics)
 	});
 	toolBuildStages.mark("runtime-normalization");
@@ -1750,6 +1707,7 @@ function includeForcedCodexDynamicToolAllow(toolsAllow, params) {
 }
 /** Decides whether Codex native code mode can own shell/file tools for this turn. */
 function shouldEnableCodexAppServerNativeToolSurface(params, sandbox, options = {}) {
+	if (params.pluginHarnessToolPolicyRestricted === true) return false;
 	if (isCodexMemoryFlushRun(params)) return false;
 	if (params.disableTools) return false;
 	const toolsAllow = includeForcedCodexDynamicToolAllow(params.toolsAllow, params);
@@ -1787,11 +1745,11 @@ function filterCodexMemoryFlushDynamicTools(tools) {
 }
 /** Requires a Codex sandbox environment only when native tools must run inside OpenClaw sandboxing. */
 function shouldRequireCodexSandboxExecServerEnvironment(params) {
-	return Boolean(params.sandbox?.enabled && params.nativeToolSurfaceEnabled && params.sandboxExecServerEnabled);
+	return Boolean(isCodexRemoteExecPlacementSandbox(params.sandbox) || params.sandbox?.enabled && params.nativeToolSurfaceEnabled && params.sandboxExecServerEnabled);
 }
 /** Selects the sandbox exec-server environment passed through the Codex app-server protocol. */
 function resolveCodexSandboxEnvironmentSelection(environment, nativeToolSurfaceEnabled) {
-	return environment && nativeToolSurfaceEnabled ? [environment] : void 0;
+	return nativeToolSurfaceEnabled ? environment ? [environment] : void 0 : [];
 }
 /** Chooses the cwd visible to Codex native execution after sandbox exec-server setup. */
 function resolveCodexAppServerExecutionCwd(params) {
@@ -1808,8 +1766,12 @@ function resolveCodexExternalSandboxPolicyForOpenClawSandbox(sandbox) {
 		networkAccess: codexNetworkAccessForOpenClawSandbox(sandbox) ? "enabled" : "restricted"
 	};
 }
+function usesDockerNetworkConfig(sandbox) {
+	const backendId = sandbox?.backendId.trim().toLowerCase();
+	return backendId === "docker" || backendId === "podman";
+}
 function codexNetworkAccessForOpenClawSandbox(sandbox) {
-	if (sandbox?.backendId !== "docker") return true;
+	if (!usesDockerNetworkConfig(sandbox)) return true;
 	const network = sandbox?.docker?.network?.trim().toLowerCase();
 	return Boolean(network && network !== "none");
 }
@@ -1918,834 +1880,1700 @@ function shouldForceMessageTool(params) {
 	return params.disableMessageTool !== true && params.sourceReplyDeliveryMode === "message_tool_only";
 }
 //#endregion
-//#region extensions/codex/src/app-server/source-reply-finality.ts
-const sourceReplyDeliveryIntents = /* @__PURE__ */ new WeakMap();
-/** Retain source-reply intent until the owning Codex turn has an authoritative outcome. */
-function recordCodexSourceReplyDeliveryIntent(owner, intent) {
-	const intents = sourceReplyDeliveryIntents.get(owner);
-	if (intents) {
-		intents.push(intent);
-		return;
+//#region extensions/codex/src/app-server/sandbox-exec-server-registry.ts
+const sandboxExecServerRegistry = {
+	servers: /* @__PURE__ */ new Map(),
+	async closeAll() {
+		const servers = await Promise.allSettled(this.servers.values());
+		this.servers.clear();
+		await Promise.all(servers.map(async (entry) => {
+			if (entry.status !== "fulfilled") return;
+			const server = entry.value;
+			server.refCount = 0;
+			if (server.closed) return;
+			server.closed = true;
+			for (const client of server.server.clients) client.close(1001, "shutdown");
+			await new Promise((resolve) => {
+				server.server.close(() => resolve());
+			});
+		}));
 	}
-	sourceReplyDeliveryIntents.set(owner, [intent]);
-}
-/** Resolve omitted finality without changing explicit progress or final markers. */
-function settleCodexSourceReplyFinality(owner, turnSucceeded) {
-	const intents = sourceReplyDeliveryIntents.get(owner);
-	if (!intents) return false;
-	const lastIntent = intents.at(-1);
-	for (const intent of intents) {
-		if (intent.final !== void 0) continue;
-		intent.record.sourceReplyFinal = turnSucceeded && intent === lastIntent;
+};
+//#endregion
+//#region extensions/codex/src/app-server/sandbox-exec-server/json-rpc.ts
+/** JSON-RPC error code used when a sandbox filesystem resource does not exist. */
+const JSON_RPC_NOT_FOUND = -32004;
+/** JSON-RPC error code used when a sandbox exec-server method is unsupported. */
+const JSON_RPC_METHOD_NOT_FOUND = -32601;
+/** Protocol-level error carrying the JSON-RPC error code to send to the client. */
+var JsonRpcProtocolError = class extends Error {
+	constructor(code, message) {
+		super(message);
+		this.code = code;
 	}
-	sourceReplyDeliveryIntents.delete(owner);
-	return turnSucceeded && intents.some((intent) => intent.record.sourceReplyFinal === true);
+};
+/** Parses raw WebSocket data into a JSON-RPC request object. */
+function parseRequest(data) {
+	const text = (Array.isArray(data) ? Buffer.concat(data) : Buffer.isBuffer(data) ? data : Buffer.from(data)).toString("utf8");
+	return requireObject(JSON.parse(text), "JSON-RPC request");
+}
+/** Validates that a JSON value is a non-array object. */
+function requireObject(value, label) {
+	if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error(`${label} must be an object.`);
+	return value;
+}
+/** Validates a non-empty string JSON-RPC parameter. */
+function requireString(value, label) {
+	if (typeof value !== "string" || !value) throw new Error(`${label} must be a non-empty string.`);
+	return value;
+}
+/** Validates a base64 payload parameter as a string; decoding happens at call sites. */
+function requireBase64String(value, label) {
+	if (typeof value !== "string") throw new Error(`${label} must be a string.`);
+	return value;
+}
+/** Validates a finite numeric JSON-RPC parameter. */
+function requireNumber(value, label) {
+	if (typeof value !== "number" || !Number.isFinite(value)) throw new Error(`${label} must be a finite number.`);
+	return value;
+}
+/** Validates a non-empty string-array JSON-RPC parameter. */
+function requireStringArray(value, label) {
+	if (!Array.isArray(value) || value.some((item) => typeof item !== "string")) throw new Error(`${label} must be a string array.`);
+	if (value.length === 0) throw new Error(`${label} must not be empty.`);
+	return value;
+}
+/** Reads HTTP headers from JSON-RPC params, defaulting to an empty header list. */
+function readHttpHeaders(value) {
+	if (!Array.isArray(value)) return [];
+	return value.map((entry, index) => {
+		const record = requireObject(entry, `header ${index}`);
+		return {
+			name: requireString(record.name, "header name"),
+			value: requireString(record.value, "header value")
+		};
+	});
+}
+/** Sends a JSON-RPC success response over the WebSocket. */
+function sendResult(socket, id, result) {
+	socket.send(JSON.stringify({
+		jsonrpc: "2.0",
+		id,
+		result: result === void 0 ? {} : result
+	}));
+}
+/** Sends a JSON-RPC error response over the WebSocket. */
+function sendError(socket, id, code, message) {
+	socket.send(JSON.stringify({
+		jsonrpc: "2.0",
+		id: id ?? null,
+		error: {
+			code,
+			message
+		}
+	}));
 }
 //#endregion
-//#region extensions/codex/src/app-server/hook-requester.ts
-/** Rebuilds the host-proven requester identity shared by native and bridged tool hooks. */
-function buildCodexHookRequester(params) {
-	const channel = params.messageChannel ?? params.messageProvider;
-	const requester = {
-		...channel ? { channel } : {},
-		...params.agentAccountId ? { accountId: params.agentAccountId } : {},
-		...params.senderId ? { senderId: params.senderId } : {},
-		...params.senderIsOwner !== void 0 ? { senderIsOwner: params.senderIsOwner } : {},
-		...params.memberRoleIds?.length ? { roleIds: [...params.memberRoleIds] } : {}
-	};
-	return Object.keys(requester).length > 0 ? requester : void 0;
+//#region extensions/codex/src/app-server/sandbox-exec-server/path-uri.ts
+/** Converts Codex PathUri protocol values into sandbox-backend path strings. */
+const WINDOWS_DRIVE_PATH_RE = /^\/[A-Za-z]:(?:\/|$)/u;
+/** Resolves one Codex exec-server PathUri into a POSIX sandbox path. */
+function resolveExecServerPath(rawPath, label) {
+	let pathUrl;
+	try {
+		pathUrl = new URL(rawPath);
+	} catch (error) {
+		throw new Error(`${label} must be a valid file URI: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
+	}
+	if (pathUrl.protocol !== "file:") throw new Error(`${label} URI must use the file scheme, received ${pathUrl.protocol.slice(0, -1)}.`);
+	if (pathUrl.search || pathUrl.hash) throw new Error(`${label} file URI must not include a query or fragment.`);
+	let resolved;
+	try {
+		resolved = fileURLToPath(pathUrl, { windows: false });
+	} catch (error) {
+		throw new Error(`${label} file URI is not valid for the sandbox: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
+	}
+	if (WINDOWS_DRIVE_PATH_RE.test(resolved)) throw new Error(`${label} Windows file URI is not supported by the sandbox.`);
+	if (resolved.includes("\0")) throw new Error(`${label} file URI must not contain a null byte.`);
+	return resolved;
 }
 //#endregion
-//#region extensions/codex/src/app-server/provider-capabilities.ts
-function resolveOverriddenProviderWebSearchSupport(modelProviderOverride) {
-	const provider = modelProviderOverride?.trim().toLowerCase();
-	if (!provider) return;
-	return provider === "openai" ? "supported" : "unsupported";
+//#region extensions/codex/src/app-server/sandbox-exec-server/fs-policy.ts
+/**
+* Resolves Codex filesystem sandbox policy payloads into OpenClaw path/glob
+* checks for sandbox exec-server filesystem operations.
+*/
+/** Resolves request-local sandbox policy and asserts each requested path has the needed access. */
+function assertFsSandboxAccess(execServer, record, requests) {
+	assertResolvedFsSandboxAccess(resolveFsSandboxPolicy(execServer, record), requests);
+}
+/** Parses a Codex managed filesystem sandbox context into normalized access entries. */
+function resolveFsSandboxPolicy(execServer, record) {
+	if (record.sandbox === void 0 || record.sandbox === null) return;
+	const sandbox = requireObject(record.sandbox, "fs sandbox context");
+	const permissions = requireObject(sandbox.permissions, "fs sandbox permissions");
+	const permissionType = requireString(permissions.type, "fs sandbox permissions type");
+	if (permissionType === "disabled" || permissionType === "external") return {
+		unrestricted: true,
+		entries: []
+	};
+	if (permissionType !== "managed") throw new Error(`Unsupported Codex fs sandbox permission type: ${permissionType}`);
+	const fileSystem = requireObject(permissions.file_system, "fs sandbox file system permissions");
+	const fileSystemType = requireString(fileSystem.type, "fs sandbox file system permissions type");
+	if (fileSystemType === "unrestricted") return {
+		unrestricted: true,
+		entries: []
+	};
+	if (fileSystemType !== "restricted") throw new Error(`Unsupported Codex fs sandbox file system type: ${fileSystemType}`);
+	if (!Array.isArray(fileSystem.entries)) throw new Error("fs sandbox file system entries must be an array.");
+	const cwd = readFsSandboxCwd(execServer, sandbox);
+	return {
+		unrestricted: false,
+		entries: fileSystem.entries.flatMap((entry, index) => {
+			const resolved = resolveFsSandboxEntry(requireObject(entry, `fs sandbox entry ${index}`), cwd);
+			return resolved ? [resolved] : [];
+		})
+	};
 }
-async function readConfiguredProviderWebSearchSupport(params) {
-	return (await params.client.request("modelProvider/capabilities/read", {}, {
-		timeoutMs: params.timeoutMs,
-		signal: params.signal
-	})).webSearch ? "supported" : "unsupported";
+function readFsSandboxCwd(execServer, sandbox) {
+	if (sandbox.cwd === void 0 || sandbox.cwd === null) return normalizeSandboxAbsolutePath(execServer.sandbox.containerWorkdir, "sandbox cwd");
+	return normalizeSandboxAbsolutePath(resolveExecServerPath(requireString(sandbox.cwd, "sandbox cwd"), "sandbox cwd"), "sandbox cwd");
+}
+function resolveFsSandboxEntry(entry, cwd) {
+	const access = readFsAccessMode(entry.access);
+	const pathSpec = requireObject(entry.path, "fs sandbox entry path");
+	const pathType = requireString(pathSpec.type, "fs sandbox entry path type");
+	if (pathType === "path") return {
+		kind: "path",
+		path: normalizeSandboxAbsolutePath(resolveExecServerPath(requireString(pathSpec.path, "fs sandbox path"), "fs sandbox path"), "fs sandbox path"),
+		access
+	};
+	if (pathType === "special") {
+		if (isNonGrantingFsSpecialPath(requireObject(pathSpec.value, "fs sandbox special path"))) return;
+		return {
+			kind: "path",
+			path: resolveFsSpecialPath(requireObject(pathSpec.value, "fs sandbox special path"), cwd),
+			access
+		};
+	}
+	if (pathType === "glob_pattern") {
+		const pattern = requireString(pathSpec.pattern, "fs sandbox glob pattern");
+		const absolutePattern = normalizeSandboxGlobPattern(pattern.startsWith("/") ? pattern : posix.join(cwd, pattern));
+		return {
+			kind: "glob",
+			pattern: absolutePattern,
+			matcher: compileSandboxGlobPattern(absolutePattern),
+			literalPrefix: sandboxGlobLiteralPrefix(absolutePattern),
+			access
+		};
+	}
+	throw new Error(`Unsupported Codex fs sandbox path type: ${pathType}`);
+}
+function isNonGrantingFsSpecialPath(value) {
+	const kind = requireString(value.kind, "fs sandbox special path kind");
+	return kind === "minimal" || kind === "unknown";
+}
+function readFsAccessMode(value) {
+	if (value === "read" || value === "write" || value === "none") return value;
+	if (value === "deny") return "none";
+	throw new Error("fs sandbox entry access must be read, write, none, or deny.");
+}
+function resolveFsSpecialPath(value, cwd) {
+	const kind = requireString(value.kind, "fs sandbox special path kind");
+	if (kind === "root") return "/";
+	if (kind === "project_roots" || kind === "current_working_directory") {
+		const subpath = value.subpath === void 0 || value.subpath === null ? void 0 : requireString(value.subpath, "fs sandbox project roots subpath");
+		return normalizeSandboxAbsolutePath(subpath ? posix.join(cwd, subpath) : cwd, "fs sandbox project roots path");
+	}
+	if (kind === "slash_tmp" || kind === "tmpdir") return "/tmp";
+	throw new Error(`Unsupported Codex fs sandbox special path: ${kind}`);
+}
+/** Asserts access against an already resolved filesystem sandbox policy. */
+function assertResolvedFsSandboxAccess(policy, requests) {
+	if (!policy?.unrestricted && policy) for (const request of requests) {
+		const access = resolveFsAccess(policy, request.path);
+		if (request.access === "read" && access === "none") throw new Error(`Codex fs sandbox denied read access to ${request.path}`);
+		if (request.access === "write" && access !== "write") throw new Error(`Codex fs sandbox denied write access to ${request.path}`);
+	}
 }
-async function resolveCodexProviderWebSearchSupportForClient(params) {
-	const overrideSupport = resolveOverriddenProviderWebSearchSupport(params.modelProviderOverride);
-	if (overrideSupport) return overrideSupport;
-	try {
-		return await readConfiguredProviderWebSearchSupport(params);
-	} catch {
-		return "unknown";
+function resolveFsAccess(policy, rawPath) {
+	if (policy.unrestricted) return "write";
+	const target = normalizeSandboxAbsolutePath(rawPath, "fs path");
+	let selected;
+	for (const entry of policy.entries) {
+		if (!fsSandboxEntryMatches(entry, target)) continue;
+		const candidate = {
+			specificity: fsSandboxEntrySpecificity(entry),
+			rank: fsAccessRank(entry.access),
+			access: entry.access
+		};
+		if (!selected || candidate.specificity > selected.specificity || candidate.specificity === selected.specificity && candidate.rank > selected.rank) selected = candidate;
+	}
+	return selected?.access ?? "none";
+}
+/** Rejects recursive writes/removes that would cross protected read-only descendants. */
+function assertNoReadOnlyDescendant(policy, rawPath, operation) {
+	if (!policy || policy.unrestricted) return;
+	const target = normalizeSandboxAbsolutePath(rawPath, "fs path");
+	const protectedDescendant = policy.entries.find((entry) => {
+		if (entry.access === "write" || !fsSandboxEntryCanAffectDescendant(entry, target)) return false;
+		if (entry.kind === "glob") return true;
+		const protectedPath = entry.path;
+		return protectedPath && resolveFsAccess(policy, protectedPath) !== "write";
+	});
+	if (protectedDescendant) {
+		const protectedPath = protectedDescendant.kind === "path" ? protectedDescendant.path : protectedDescendant.pattern;
+		throw new Error(`Codex fs sandbox denied recursive ${operation} of ${rawPath} because ${protectedPath} is not writable.`);
 	}
 }
-async function resolveCodexProviderWebSearchSupport(params) {
-	const overrideSupport = resolveOverriddenProviderWebSearchSupport(params.modelProviderOverride);
-	if (overrideSupport) return overrideSupport;
-	let client;
-	try {
-		client = await params.clientFactory({
-			startOptions: params.appServer.start,
-			...params.preparedAuth ? { preparedAuth: params.preparedAuth } : { authProfileId: params.authProfileId },
-			agentDir: params.agentDir,
-			config: params.config,
-			timeoutMs: params.appServer.requestTimeoutMs
-		});
-		return await resolveCodexProviderWebSearchSupportForClient({
-			client,
-			timeoutMs: params.appServer.requestTimeoutMs,
-			modelProviderOverride: params.modelProviderOverride,
-			signal: params.signal
-		});
-	} catch {
-		return "unknown";
-	} finally {
-		if (client) releaseLeasedSharedCodexAppServerClient(client);
+/** Normalizes and validates an absolute POSIX path inside the sandbox namespace. */
+function normalizeSandboxAbsolutePath(rawPath, label) {
+	if (!rawPath || rawPath.includes("\0") || !rawPath.startsWith("/")) throw new Error(`${label} must be an absolute sandbox path.`);
+	const normalized = posix.normalize(rawPath);
+	return normalized === "//" ? "/" : normalized;
+}
+/** Returns true when target is root itself or a descendant of root. */
+function pathContains(root, target) {
+	return root === "/" || target === root || target.startsWith(`${root}/`);
+}
+function fsSandboxEntryMatches(entry, target) {
+	if (entry.kind === "path") return pathContains(entry.path, target);
+	return entry.matcher.test(target);
+}
+function fsSandboxEntryCanAffectDescendant(entry, target) {
+	if (entry.kind === "path") return pathContains(target, entry.path) && target !== entry.path;
+	return pathContains(target, entry.literalPrefix) || pathContains(entry.literalPrefix, target);
+}
+function fsSandboxEntrySpecificity(entry) {
+	return pathSpecificity(entry.kind === "path" ? entry.path : entry.literalPrefix);
+}
+function pathSpecificity(filePath) {
+	return filePath === "/" ? 0 : filePath.split("/").filter(Boolean).length;
+}
+function fsAccessRank(access) {
+	if (access === "none") return 2;
+	if (access === "write") return 1;
+	return 0;
+}
+function normalizeSandboxGlobPattern(pattern) {
+	if (!pattern || pattern.includes("\0") || !pattern.startsWith("/")) throw new Error("fs sandbox glob pattern must be absolute.");
+	return pattern.replace(/\/{2,}/gu, "/");
+}
+function compileSandboxGlobPattern(pattern) {
+	let source = "^";
+	for (let index = 0; index < pattern.length; index += 1) {
+		const char = pattern[index];
+		const next = pattern[index + 1];
+		if (char === "*" && next === "*" && pattern[index + 2] === "/") {
+			source += "(?:.*/)?";
+			index += 2;
+		} else if (char === "*" && next === "*") {
+			source += ".*";
+			index += 1;
+		} else if (char === "*") source += "[^/]*";
+		else if (char === "?") source += "[^/]";
+		else if (char === "[") {
+			const compiledClass = compileSandboxGlobCharacterClass(pattern, index);
+			source += compiledClass.source;
+			index = compiledClass.endIndex;
+		} else source += char?.replace(/[\\^$+?.()|[\]{}]/gu, "\\$&") ?? "";
+	}
+	source += "$";
+	return new RegExp(source, "u");
+}
+function compileSandboxGlobCharacterClass(pattern, startIndex) {
+	let index = startIndex + 1;
+	if (index >= pattern.length) throw new Error("fs sandbox glob character class must be closed.");
+	const negated = pattern[index] === "!" || pattern[index] === "^";
+	if (negated) index += 1;
+	let body = "";
+	for (; index < pattern.length; index += 1) {
+		const char = pattern[index];
+		if (char === "]" && body) return {
+			source: `[${negated ? "^" : ""}${body}]`,
+			endIndex: index
+		};
+		if (!char || char === "/") throw new Error("fs sandbox glob character class cannot match path separators.");
+		body += escapeSandboxGlobCharacterClassChar(char, body.length === 0);
 	}
+	throw new Error("fs sandbox glob character class must be closed.");
+}
+function escapeSandboxGlobCharacterClassChar(char, first) {
+	if (char === "\\" || char === "]") return `\\${char}`;
+	if (first && char === "^") return "\\^";
+	return char;
+}
+function sandboxGlobLiteralPrefix(pattern) {
+	const wildcardIndex = pattern.search(/[*?[]/u);
+	const prefix = wildcardIndex === -1 ? pattern : pattern.slice(0, wildcardIndex);
+	const slash = prefix.lastIndexOf("/");
+	if (slash <= 0) return "/";
+	return normalizeSandboxAbsolutePath(prefix.slice(0, slash), "fs sandbox glob prefix");
+}
+/** Safely joins a single directory entry name onto a sandbox parent path. */
+function joinSandboxChildPath(parent, child) {
+	if (!child || child === "." || child === ".." || child.includes("/") || child.includes("\0")) throw new Error(`Invalid sandbox directory entry name: ${child}`);
+	return parent.endsWith("/") ? `${parent}${child}` : `${parent}/${child}`;
 }
 //#endregion
-//#region extensions/codex/src/app-server/dynamic-tool-diagnostics.ts
+//#region extensions/codex/src/app-server/sandbox-exec-server/runtime.ts
+/** Returns the configured sandbox backend or fails the current JSON-RPC request. */
+function requireBackend(execServer) {
+	const backend = execServer.sandbox.backend;
+	if (!backend) throw new Error("OpenClaw sandbox backend is unavailable.");
+	return backend;
+}
+/** Returns the configured filesystem bridge or fails the current JSON-RPC request. */
+function requireFsBridge(execServer) {
+	const fsBridge = execServer.sandbox.fsBridge;
+	if (!fsBridge) throw new Error("Sandbox filesystem bridge is unavailable.");
+	return fsBridge;
+}
+//#endregion
+//#region extensions/codex/src/app-server/sandbox-exec-server/filesystem.ts
 /**
-* Trusted diagnostics emitted around Codex dynamic tool execution lifecycle.
+* Implements filesystem JSON-RPC handlers for the Codex sandbox exec-server
+* with OpenClaw sandbox policy checks before every bridge operation.
 */
-/** Emits a start event for one Codex dynamic tool call. */
-function emitDynamicToolStartedDiagnostic(params) {
-	emitTrustedDiagnosticEvent({
-		type: "tool.execution.started",
-		agentId: params.agentId,
-		runId: params.runId,
-		sessionId: params.sessionId,
-		sessionKey: params.sessionKey,
-		toolName: params.call.tool,
-		toolCallId: params.call.callId
+const CODEX_SANDBOX_EXEC_SERVER_MAX_READ_FILE_BYTES = 512 * 1024 * 1024;
+const CODEX_SANDBOX_EXEC_SERVER_MAX_OPEN_FILE_READS = 128;
+const CODEX_SANDBOX_EXEC_SERVER_MAX_BUFFERED_FILE_READ_BYTES = 64 * 1024 * 1024;
+const CODEX_SANDBOX_EXEC_SERVER_MAX_READ_BLOCK_BYTES = 1024 * 1024;
+const CODEX_SANDBOX_EXEC_SERVER_MAX_FILE_READ_HANDLE_ID_BYTES = 32;
+/** Opens a policy-checked sandbox file under a bounded, connection-owned handle. */
+async function openFile(execServer, handles, params) {
+	const record = requireObject(params, "fs/open params");
+	const handleId = requireFileReadHandleId(record.handleId);
+	if (handles.closed) throw new JsonRpcProtocolError(JSON_RPC_NOT_FOUND, `unknown file read handle \`${handleId}\``);
+	if (handles.has(handleId)) throw new JsonRpcProtocolError(-32600, `file read handle \`${handleId}\` already exists`);
+	if (handles.size >= CODEX_SANDBOX_EXEC_SERVER_MAX_OPEN_FILE_READS) throw new JsonRpcProtocolError(-32600, `at most ${CODEX_SANDBOX_EXEC_SERVER_MAX_OPEN_FILE_READS} file reads may be open per connection`);
+	const filePath = resolveExecServerPath(requireString(record.path, "path"), "read path");
+	assertFsSandboxAccess(execServer, record, [{
+		path: filePath,
+		access: "read"
+	}]);
+	const fsBridge = requireFsBridge(execServer);
+	const handle = {
+		abortController: new AbortController(),
+		closeRequested: false,
+		reservedBytes: 0
+	};
+	handles.set(handleId, handle);
+	try {
+		const stat = await fsBridge.stat({
+			filePath,
+			signal: handle.abortController.signal
+		});
+		if (handles.get(handleId) !== handle || handle.closeRequested || handles.closed) throw new JsonRpcProtocolError(JSON_RPC_NOT_FOUND, `unknown file read handle \`${handleId}\``);
+		if (!stat) throw new JsonRpcProtocolError(JSON_RPC_NOT_FOUND, "file not found");
+		if (stat.type !== "file") throw new JsonRpcProtocolError(-32600, "file read handle requires a regular file");
+		if (!Number.isSafeInteger(stat.size) || stat.size < 0) throw new JsonRpcProtocolError(-32600, "file size must be a non-negative safe integer");
+		if (stat.size > CODEX_SANDBOX_EXEC_SERVER_MAX_BUFFERED_FILE_READ_BYTES - bufferedFileReadBytes(handles)) throw new JsonRpcProtocolError(-32600, "sandbox file read exceeds the per-connection buffered file limit");
+		handle.reservedBytes = stat.size;
+		const data = await fsBridge.readFile({
+			filePath,
+			maxBytes: handle.reservedBytes,
+			signal: handle.abortController.signal
+		});
+		if (handles.get(handleId) !== handle || handle.closeRequested || handles.closed) throw new JsonRpcProtocolError(JSON_RPC_NOT_FOUND, `unknown file read handle \`${handleId}\``);
+		if (data.byteLength > handle.reservedBytes) throw new JsonRpcProtocolError(-32600, "sandbox file read exceeds the per-connection buffered file limit");
+		handle.reservedBytes = data.byteLength;
+		handle.data = data;
+		return { handleId };
+	} catch (error) {
+		if (handles.get(handleId) === handle) handles.delete(handleId);
+		throw error;
+	}
+}
+/** Reads a bounded base64 block from a handle belonging to this connection. */
+function readFileBlock(handles, params) {
+	const record = requireObject(params, "fs/readBlock params");
+	const handleId = requireFileReadHandleId(record.handleId);
+	const handle = handles.get(handleId);
+	if (!handle?.data) throw new JsonRpcProtocolError(JSON_RPC_NOT_FOUND, `unknown file read handle \`${handleId}\``);
+	const offset = requireNumber(record.offset, "offset");
+	const length = requireNumber(record.len, "len");
+	if (!Number.isSafeInteger(offset) || offset < 0) throw new JsonRpcProtocolError(-32600, "file read offset must be a non-negative safe integer");
+	if (!Number.isSafeInteger(length) || length < 1 || length > CODEX_SANDBOX_EXEC_SERVER_MAX_READ_BLOCK_BYTES) throw new JsonRpcProtocolError(-32600, `file read block length must be between 1 and ${CODEX_SANDBOX_EXEC_SERVER_MAX_READ_BLOCK_BYTES}`);
+	const chunk = handle.data.subarray(offset, Math.min(offset + length, handle.data.byteLength));
+	return {
+		chunk: chunk.toString("base64"),
+		eof: offset + chunk.byteLength >= handle.data.byteLength
+	};
+}
+/** Closes one connection-owned file handle; repeated closes are harmless. */
+function closeFile(handles, params) {
+	closeFileReadHandle(handles, requireFileReadHandleId(requireObject(params, "fs/close params").handleId));
+	return {};
+}
+/** Cancels a disconnected socket without releasing unsettled read reservations. */
+function closeAllFileReads(handles) {
+	handles.closed = true;
+	for (const handleId of handles.keys()) closeFileReadHandle(handles, handleId);
+}
+function closeFileReadHandle(handles, handleId) {
+	const handle = handles.get(handleId);
+	if (!handle) return;
+	handle.closeRequested = true;
+	if (handle.data !== void 0) {
+		handles.delete(handleId);
+		return;
+	}
+	handle.abortController.abort();
+}
+function bufferedFileReadBytes(handles) {
+	let total = 0;
+	for (const handle of handles.values()) total += handle.reservedBytes;
+	return total;
+}
+function requireFileReadHandleId(value) {
+	const handleId = requireString(value, "handleId");
+	if (Buffer.byteLength(handleId, "utf8") > CODEX_SANDBOX_EXEC_SERVER_MAX_FILE_READ_HANDLE_ID_BYTES) throw new JsonRpcProtocolError(-32600, `file read handle ID must not exceed ${CODEX_SANDBOX_EXEC_SERVER_MAX_FILE_READ_HANDLE_ID_BYTES} bytes`);
+	return handleId;
+}
+/** Reads a sandbox file as base64 after read-policy and size checks. */
+async function readFile(execServer, params) {
+	const record = requireObject(params, "fs/readFile params");
+	const filePath = resolveExecServerPath(requireString(record.path, "path"), "read path");
+	assertFsSandboxAccess(execServer, record, [{
+		path: filePath,
+		access: "read"
+	}]);
+	const fsBridge = requireFsBridge(execServer);
+	const stat = await fsBridge.stat({ filePath });
+	if (!stat) throw new JsonRpcProtocolError(JSON_RPC_NOT_FOUND, "file not found");
+	assertSandboxFileReadWithinLimit(stat);
+	return { dataBase64: (await fsBridge.readFile({
+		filePath,
+		maxBytes: CODEX_SANDBOX_EXEC_SERVER_MAX_READ_FILE_BYTES
+	})).toString("base64") };
+}
+/** Writes base64 data to an existing sandbox directory after write-policy checks. */
+async function writeFile(execServer, params) {
+	const record = requireObject(params, "fs/writeFile params");
+	const filePath = resolveExecServerPath(requireString(record.path, "path"), "write path");
+	assertFsSandboxAccess(execServer, record, [{
+		path: filePath,
+		access: "write"
+	}]);
+	const fsBridge = requireFsBridge(execServer);
+	if ((await fsBridge.stat({ filePath: posix.dirname(filePath) }))?.type !== "directory") throw new JsonRpcProtocolError(JSON_RPC_NOT_FOUND, "parent directory not found");
+	await fsBridge.writeFile({
+		filePath,
+		data: Buffer.from(requireBase64String(record.dataBase64, "dataBase64"), "base64"),
+		mkdir: false
 	});
 }
-/** Emits an error event for one Codex dynamic tool call. */
-function emitDynamicToolErrorDiagnostic(params) {
-	emitTrustedDiagnosticEvent({
-		type: "tool.execution.error",
-		agentId: params.agentId,
-		runId: params.runId,
-		sessionId: params.sessionId,
-		sessionKey: params.sessionKey,
-		toolName: params.call.tool,
-		toolCallId: params.call.callId,
-		durationMs: params.durationMs,
-		errorCategory: "codex_dynamic_tool_error",
-		terminalReason: params.terminalReason ?? "failed"
+/** Creates a sandbox directory, respecting recursive and parent-directory semantics. */
+async function createDirectory(execServer, params) {
+	const record = requireObject(params, "fs/createDirectory params");
+	const filePath = resolveExecServerPath(requireString(record.path, "path"), "create-directory path");
+	assertFsSandboxAccess(execServer, record, [{
+		path: filePath,
+		access: "write"
+	}]);
+	const fsBridge = requireFsBridge(execServer);
+	if (record.recursive === false) {
+		const parentPath = posix.dirname(filePath);
+		if ((await fsBridge.stat({ filePath: parentPath }))?.type !== "directory") throw new JsonRpcProtocolError(JSON_RPC_NOT_FOUND, "parent directory not found");
+	}
+	await fsBridge.mkdirp({ filePath });
+}
+/** Returns normalized metadata for a sandbox path. */
+async function getMetadata(execServer, params) {
+	const record = requireObject(params, "fs/getMetadata params");
+	const filePath = resolveExecServerPath(requireString(record.path, "path"), "metadata path");
+	assertFsSandboxAccess(execServer, record, [{
+		path: filePath,
+		access: "read"
+	}]);
+	const stat = await requireFsBridge(execServer).stat({ filePath });
+	if (!stat) throw new JsonRpcProtocolError(JSON_RPC_NOT_FOUND, "file not found");
+	return metadataResponse(stat);
+}
+/** Lists sandbox directory entries visible under the resolved filesystem policy. */
+async function readDirectory(execServer, params) {
+	const record = requireObject(params, "fs/readDirectory params");
+	return { entries: await listDirectoryEntries(execServer, resolveExecServerPath(requireString(record.path, "path"), "read-directory path"), resolveFsSandboxPolicy(execServer, record)) };
+}
+async function listDirectoryEntries(execServer, filePath, fsSandboxPolicy) {
+	assertResolvedFsSandboxAccess(fsSandboxPolicy, [{
+		path: filePath,
+		access: "read"
+	}]);
+	const fsBridge = requireFsBridge(execServer);
+	const backend = requireBackend(execServer);
+	const resolved = fsBridge.resolvePath({ filePath });
+	if (!resolved) throw new Error(`Cannot resolve sandbox path: ${filePath}`);
+	const result = await backend.runShellCommand({
+		script: "find \"$1\" -mindepth 1 -maxdepth 1 -exec sh -c 'for path do name=${path##*/}; if [ -L \"$path\" ]; then kind=o; elif [ -d \"$path\" ]; then kind=d; elif [ -f \"$path\" ]; then kind=f; else kind=o; fi; printf \"%s\\t%s\\n\" \"$kind\" \"$name\"; done' sh {} +",
+		args: [resolved.containerPath],
+		allowFailure: true
+	});
+	if (result.code !== 0) {
+		const stderr = result.stderr.toString("utf8").trim();
+		throw new Error(stderr || `sandbox directory listing failed with code ${result.code}`);
+	}
+	return result.stdout.toString("utf8").split("\n").filter(Boolean).map((line) => {
+		const [kind = "o", fileName = ""] = line.split("	");
+		return {
+			fileName,
+			isDirectory: kind === "d",
+			isFile: kind === "f"
+		};
 	});
 }
-/** Emits the terminal event matching a dynamic tool response's diagnostic type. */
-function emitDynamicToolTerminalDiagnostic(params) {
-	const terminalType = params.response.diagnosticTerminalType ?? (params.response.success ? "completed" : "error");
-	if (terminalType === "completed") {
-		emitTrustedDiagnosticEvent({
-			type: "tool.execution.completed",
-			agentId: params.agentId,
-			runId: params.runId,
-			sessionId: params.sessionId,
-			sessionKey: params.sessionKey,
-			toolName: params.call.tool,
-			toolCallId: params.call.callId,
-			durationMs: params.durationMs
-		});
+/** Removes a sandbox path after rejecting writes outside policy or under read-only descendants. */
+async function removePath(execServer, params) {
+	const record = requireObject(params, "fs/remove params");
+	const filePath = resolveExecServerPath(requireString(record.path, "path"), "remove path");
+	const fsSandboxPolicy = resolveFsSandboxPolicy(execServer, record);
+	assertResolvedFsSandboxAccess(fsSandboxPolicy, [{
+		path: filePath,
+		access: "write"
+	}]);
+	if (record.recursive !== false) assertNoReadOnlyDescendant(fsSandboxPolicy, filePath, "remove");
+	await requireFsBridge(execServer).remove({
+		filePath,
+		recursive: record.recursive !== false,
+		force: record.force !== false
+	});
+}
+/** Copies sandbox files or recursive directories while enforcing source and destination policy. */
+async function copyPath(execServer, params) {
+	const record = requireObject(params, "fs/copy params");
+	const sourcePath = resolveExecServerPath(requireString(record.sourcePath ?? record.source, "sourcePath"), "copy source path");
+	const destinationPath = resolveExecServerPath(requireString(record.destinationPath ?? record.destination, "destinationPath"), "copy destination path");
+	const fsSandboxPolicy = resolveFsSandboxPolicy(execServer, record);
+	assertResolvedFsSandboxAccess(fsSandboxPolicy, [{
+		path: sourcePath,
+		access: "read"
+	}, {
+		path: destinationPath,
+		access: "write"
+	}]);
+	await copySandboxPath(execServer, {
+		sourcePath,
+		destinationPath,
+		recursive: record.recursive === true,
+		fsSandboxPolicy
+	});
+}
+async function copySandboxPath(execServer, params) {
+	const fsBridge = execServer.sandbox.fsBridge;
+	if (!fsBridge) throw new Error("Sandbox filesystem bridge is unavailable.");
+	assertResolvedFsSandboxAccess(params.fsSandboxPolicy, [{
+		path: params.sourcePath,
+		access: "read"
+	}, {
+		path: params.destinationPath,
+		access: "write"
+	}]);
+	const sourceStat = await fsBridge.stat({ filePath: params.sourcePath });
+	if (!sourceStat) throw new JsonRpcProtocolError(JSON_RPC_NOT_FOUND, "file not found");
+	if (sourceStat?.type === "directory") {
+		if (!params.recursive) throw new Error(`Cannot copy directory without recursive=true: ${params.sourcePath}`);
+		if (pathContains(normalizeSandboxAbsolutePath(params.sourcePath, "copy source path"), normalizeSandboxAbsolutePath(params.destinationPath, "copy destination path"))) throw new Error("Cannot recursively copy a directory into itself.");
+		await fsBridge.mkdirp({ filePath: params.destinationPath });
+		for (const entry of await listDirectoryEntries(execServer, params.sourcePath, params.fsSandboxPolicy)) {
+			if (!entry.isDirectory && !entry.isFile) throw new Error(`Cannot copy unsupported filesystem entry: ${entry.fileName}`);
+			await copySandboxPath(execServer, {
+				sourcePath: joinSandboxChildPath(params.sourcePath, entry.fileName),
+				destinationPath: joinSandboxChildPath(params.destinationPath, entry.fileName),
+				recursive: true,
+				fsSandboxPolicy: params.fsSandboxPolicy
+			});
+		}
 		return;
 	}
-	if (terminalType === "blocked") {
-		emitTrustedDiagnosticEvent({
-			type: "tool.execution.blocked",
-			agentId: params.agentId,
-			runId: params.runId,
-			sessionId: params.sessionId,
-			sessionKey: params.sessionKey,
-			toolName: params.call.tool,
-			toolCallId: params.call.callId,
-			deniedReason: "plugin-before-tool-call",
-			reason: "Tool call blocked"
+	if (sourceStat.type === "file" && fsBridge.copyFile) {
+		await fsBridge.copyFile({
+			sourcePath: params.sourcePath,
+			destinationPath: params.destinationPath,
+			mkdir: true
 		});
 		return;
 	}
-	emitDynamicToolErrorDiagnostic({
-		...params,
-		terminalReason: params.response.diagnosticTerminalReason ?? "failed"
+	assertSandboxFileReadWithinLimit(sourceStat);
+	const data = await fsBridge.readFile({
+		filePath: params.sourcePath,
+		maxBytes: CODEX_SANDBOX_EXEC_SERVER_MAX_READ_FILE_BYTES
+	});
+	await fsBridge.writeFile({
+		filePath: params.destinationPath,
+		data,
+		mkdir: true
 	});
 }
+function assertSandboxFileReadWithinLimit(stat) {
+	if (stat.type === "file" && stat.size > CODEX_SANDBOX_EXEC_SERVER_MAX_READ_FILE_BYTES) throw new Error(`file is too large to read through Codex sandbox exec-server: ${stat.size} bytes`);
+}
+function metadataResponse(stat) {
+	return {
+		isDirectory: stat?.type === "directory",
+		isFile: stat?.type === "file",
+		isSymlink: false,
+		size: stat?.size ?? 0,
+		createdAtMs: 0,
+		modifiedAtMs: stat?.mtimeMs ?? 0
+	};
+}
 //#endregion
-//#region extensions/codex/src/app-server/plugin-approval-roundtrip.ts
+//#region extensions/codex/src/app-server/sandbox-exec-server/http.ts
 /**
-* Routes Codex app-server plugin approval prompts through OpenClaw's gateway
-* approval tool and maps gateway decisions back to Codex outcomes.
+* Implements sandboxed HTTP requests for Codex native tools by routing network
+* access through the active OpenClaw sandbox backend.
 */
-const DEFAULT_CODEX_APPROVAL_TIMEOUT_MS = 12e4;
-const MAX_PLUGIN_APPROVAL_TITLE_LENGTH = 80;
-const MAX_PLUGIN_APPROVAL_DESCRIPTION_LENGTH = 256;
-/** Starts a two-phase plugin approval request through the OpenClaw gateway. */
-async function requestPluginApproval(params) {
-	const timeoutMs = DEFAULT_CODEX_APPROVAL_TIMEOUT_MS;
-	return callGatewayTool("plugin.approval.request", { timeoutMs: resolveCodexGatewayTimeoutWithGraceMs(timeoutMs) }, {
-		pluginId: "openclaw-codex-app-server",
-		title: truncateForGateway(params.title, MAX_PLUGIN_APPROVAL_TITLE_LENGTH),
-		description: truncateForGateway(params.description, MAX_PLUGIN_APPROVAL_DESCRIPTION_LENGTH),
-		severity: params.severity,
-		toolName: params.toolName,
-		toolCallId: params.toolCallId,
-		agentId: params.paramsForRun.agentId,
-		sessionKey: params.paramsForRun.sessionKey,
-		turnSourceChannel: params.paramsForRun.messageChannel ?? params.paramsForRun.messageProvider,
-		turnSourceTo: params.paramsForRun.currentChannelId,
-		turnSourceAccountId: params.paramsForRun.agentAccountId,
-		turnSourceThreadId: params.paramsForRun.currentThreadTs,
-		timeoutMs,
-		twoPhase: true,
-		...params.allowedDecisions ? { allowedDecisions: params.allowedDecisions } : {}
-	}, { expectFinal: false });
+/** Maximum JSON-line size accepted from the streaming HTTP helper process. */
+const SANDBOX_HTTP_STREAM_LINE_MAX_CHARS = 256 * 1024;
+/** Handles one sandbox HTTP JSON-RPC request, optionally streaming response body deltas. */
+async function httpRequest(execServer, socket, params) {
+	const record = requireObject(params, "http/request params");
+	const requestId = requireString(record.requestId, "requestId");
+	const url = requireString(record.url, "url");
+	assertSandboxHttpRequestTargetAllowed(url);
+	const request = {
+		method: requireString(record.method, "method"),
+		url,
+		headers: readHttpHeaders(record.headers),
+		bodyBase64: typeof record.bodyBase64 === "string" ? record.bodyBase64 : void 0,
+		timeoutMs: typeof record.timeoutMs === "number" && record.timeoutMs > 0 ? Math.floor(record.timeoutMs) : void 0,
+		streamResponse: record.streamResponse === true
+	};
+	if (request.streamResponse) return await runStreamingSandboxHttpRequest(execServer, socket, requestId, request);
+	return await runSandboxHttpRequest(execServer, {
+		...request,
+		streamResponse: false
+	});
 }
-/** Detects the gateway's explicit null-decision marker for unavailable approvals. */
-function approvalRequestExplicitlyUnavailable(result) {
-	if (result === null || result === void 0 || typeof result !== "object") return false;
-	let descriptor;
+function assertSandboxHttpRequestTargetAllowed(url) {
+	let parsed;
 	try {
-		descriptor = Object.getOwnPropertyDescriptor(result, "decision");
+		parsed = new URL(url);
 	} catch {
-		return false;
+		throw new SsrFBlockedError("Invalid URL supplied to sandbox http/request");
 	}
-	return descriptor !== void 0 && "value" in descriptor && descriptor.value === null;
+	if (parsed.protocol !== "http:" && parsed.protocol !== "https:") throw new SsrFBlockedError(`Blocked non-HTTP(S) protocol in sandbox http/request: ${parsed.protocol}`);
+	if (isBlockedHostnameOrIp(parsed.hostname)) throw new SsrFBlockedError(`Blocked hostname or private/internal IP in sandbox http/request: ${parsed.hostname}`);
+}
+async function runSandboxHttpRequest(execServer, params) {
+	const result = await requireBackend(execServer).runShellCommand({
+		script: SANDBOX_HTTP_REQUEST_SCRIPT,
+		stdin: JSON.stringify(params),
+		allowFailure: true
+	});
+	if (result.code !== 0) {
+		const stderr = result.stderr.toString("utf8").trim();
+		throw new Error(stderr || `sandbox http/request failed with code ${result.code}`);
+	}
+	const parsed = JSON.parse(result.stdout.toString("utf8"));
+	if (typeof parsed.status !== "number" || !Array.isArray(parsed.headers)) throw new Error("sandbox http/request returned an invalid response envelope");
+	return {
+		status: parsed.status,
+		headers: readHttpHeaders(parsed.headers),
+		bodyBase64: typeof parsed.bodyBase64 === "string" ? parsed.bodyBase64 : ""
+	};
 }
-/** Waits for the gateway's final approval decision, respecting turn aborts. */
-async function waitForPluginApprovalDecision(params) {
-	const waitPromise = callGatewayTool("plugin.approval.waitDecision", { timeoutMs: resolveCodexGatewayTimeoutWithGraceMs(DEFAULT_CODEX_APPROVAL_TIMEOUT_MS) }, { id: params.approvalId }).catch((error) => {
-		if (isApprovalNotFoundError(error)) return null;
-		throw error;
-	});
-	const bindDecision = (result) => result === null ? null : result?.id === params.approvalId ? result.decision : void 0;
-	if (!params.signal) return bindDecision(await waitPromise);
-	let onAbort;
-	const abortPromise = new Promise((_, reject) => {
-		if (params.signal.aborted) {
-			reject(toLintErrorObject(params.signal.reason, "Non-Error rejection"));
-			return;
-		}
-		onAbort = () => reject(toLintErrorObject(params.signal.reason, "Non-Error rejection"));
-		params.signal.addEventListener("abort", onAbort, { once: true });
+async function runStreamingSandboxHttpRequest(execServer, socket, requestId, params) {
+	const backend = requireBackend(execServer);
+	const execSpec = await backend.buildExecSpec({
+		command: SANDBOX_HTTP_REQUEST_SCRIPT,
+		workdir: execServer.sandbox.containerWorkdir,
+		env: {},
+		usePty: false
 	});
+	let child;
 	try {
-		return bindDecision(await Promise.race([waitPromise, abortPromise]));
-	} finally {
-		if (onAbort) params.signal.removeEventListener("abort", onAbort);
+		const [command, ...args] = execSpec.argv;
+		if (!command) throw new Error("OpenClaw sandbox HTTP exec spec did not provide a command.");
+		child = spawn(command, args, {
+			env: execSpec.env,
+			stdio: [
+				"pipe",
+				"pipe",
+				"pipe"
+			]
+		});
+	} catch (error) {
+		try {
+			await backend.finalizeExec?.({
+				status: "failed",
+				exitCode: null,
+				timedOut: false,
+				token: execSpec.finalizeToken
+			});
+		} catch (finalizeError) {
+			embeddedAgentLog.warn("codex sandbox http/request finalize after start failure failed", { error: finalizeError });
+		}
+		throw error;
 	}
+	const abortOnSocketClose = () => child.kill("SIGTERM");
+	socket.once("close", abortOnSocketClose);
+	child.once("close", () => {
+		socket.off("close", abortOnSocketClose);
+	});
+	child.stdin.on("error", (error) => {
+		if (error.code === "EPIPE" || error.code === "ERR_STREAM_DESTROYED") return;
+		embeddedAgentLog.warn("codex sandbox http/request stdin write failed", { error });
+	});
+	child.stdin.end(JSON.stringify(params));
+	return await readStreamingSandboxHttpResponse({
+		child,
+		execSpec,
+		finalizeExec: backend.finalizeExec,
+		requestId,
+		socket
+	});
 }
-/** Converts a gateway exec approval decision into the app-server approval outcome enum. */
-function mapExecDecisionToOutcome(decision) {
-	if (decision === "allow-once") return "approved-once";
-	if (decision === "allow-always") return "approved-session";
-	if (decision === null || decision === void 0) return "unavailable";
-	return "denied";
-}
-function truncateForGateway(value, maxLength) {
-	return value.length <= maxLength ? value : `${truncateUtf16Safe(value, maxLength - 3)}...`;
+function readStreamingSandboxHttpResponse(params) {
+	return new Promise((resolve, reject) => {
+		let headerResolved = false;
+		let failed = false;
+		let childFailure = null;
+		let lastBodySeq = 0;
+		let stdoutBuffer = "";
+		let stderr = "";
+		const finalize = async (status, exitCode) => {
+			await params.finalizeExec?.({
+				status,
+				exitCode,
+				timedOut: false,
+				token: params.execSpec.finalizeToken
+			});
+		};
+		const fail = (message, exitCode) => {
+			if (failed) return;
+			failed = true;
+			finalize("failed", exitCode).catch((error) => {
+				embeddedAgentLog.warn("codex sandbox http/request finalize failed", { error });
+			});
+			if (headerResolved) {
+				sendHttpBodyDelta(params.socket, {
+					requestId: params.requestId,
+					seq: lastBodySeq + 1,
+					deltaBase64: "",
+					done: true,
+					error: message
+				});
+				return;
+			}
+			reject(new Error(message));
+		};
+		params.child.stdout.setEncoding("utf8");
+		params.child.stdout.on("data", (chunk) => {
+			stdoutBuffer += chunk;
+			let newline = stdoutBuffer.indexOf("\n");
+			while (newline >= 0) {
+				const line = stdoutBuffer.slice(0, newline).trim();
+				stdoutBuffer = stdoutBuffer.slice(newline + 1);
+				if (line) try {
+					const message = requireObject(JSON.parse(line), "http stream message");
+					const type = requireString(message.type, "http stream message type");
+					if (type === "headers") {
+						headerResolved = true;
+						resolve({
+							status: requireNumber(message.status, "http status"),
+							headers: readHttpHeaders(message.headers),
+							bodyBase64: ""
+						});
+					} else if (type === "bodyDelta") {
+						const seq = requireNumber(message.seq, "http body sequence");
+						lastBodySeq = Math.max(lastBodySeq, seq);
+						sendHttpBodyDelta(params.socket, {
+							requestId: params.requestId,
+							seq,
+							deltaBase64: typeof message.deltaBase64 === "string" ? message.deltaBase64 : "",
+							done: message.done === true,
+							error: typeof message.error === "string" ? message.error : null
+						});
+					}
+				} catch (error) {
+					fail(error instanceof Error ? error.message : String(error), null);
+				}
+				newline = stdoutBuffer.indexOf("\n");
+			}
+			if (stdoutBuffer.length > SANDBOX_HTTP_STREAM_LINE_MAX_CHARS) {
+				params.child.kill("SIGKILL");
+				fail(`sandbox http/request produced an unterminated stdout line longer than ${SANDBOX_HTTP_STREAM_LINE_MAX_CHARS} characters`, null);
+			}
+		});
+		params.child.stderr.setEncoding("utf8");
+		params.child.stderr.on("data", (chunk) => {
+			stderr = sliceUtf16Safe(`${stderr}${chunk}`, -4096);
+		});
+		params.child.once("error", (error) => {
+			childFailure ??= error.message;
+		});
+		params.child.once("close", (code) => {
+			const exitCode = code ?? 1;
+			if (failed) return;
+			if (childFailure) {
+				fail(childFailure, exitCode);
+				return;
+			}
+			if (exitCode === 0) {
+				finalize("completed", exitCode).catch((error) => {
+					embeddedAgentLog.warn("codex sandbox http/request finalize failed", { error });
+				});
+				if (!headerResolved) reject(/* @__PURE__ */ new Error("sandbox http/request exited before returning headers"));
+				return;
+			}
+			fail(stderr.trim() || `sandbox http/request failed with code ${exitCode}`, exitCode);
+		});
+	});
 }
-function toLintErrorObject(value, fallbackMessage) {
-	if (value instanceof Error) return value;
-	if (typeof value === "string") return new Error(value);
-	const error = new Error(fallbackMessage, { cause: value });
-	if (typeof value === "object" && value !== null || typeof value === "function") Object.assign(error, value);
-	return error;
+const SANDBOX_HTTP_REQUEST_SCRIPT = String.raw`
+tmp=$(mktemp "$TMPDIR/openclaw-http.XXXXXX.py" 2>/dev/null || mktemp "/tmp/openclaw-http.XXXXXX.py") || exit 1
+trap 'rm -f "$tmp"' EXIT
+cat > "$tmp" <<'PY'
+import base64
+import json
+import ipaddress
+import socket
+import sys
+import urllib.error
+import urllib.parse
+import urllib.request
+
+def emit(payload):
+    print(json.dumps(payload, separators=(",", ":")), flush=True)
+
+def response_headers(response):
+    return [{"name": name, "value": value} for name, value in response.headers.items()]
+
+BLOCKED_HOSTNAMES = {
+    "localhost",
+    "localhost.localdomain",
+    "metadata.google.internal",
+}
+CLOUD_METADATA_IP_ADDRESSES = {
+    "100.100.100.200",
+    "fd00:ec2::254",
+}
+BLOCKED_IPV4_NETWORKS = tuple(
+    ipaddress.ip_network(network)
+    for network in (
+        "100.64.0.0/10",
+        "198.18.0.0/15",
+    )
+)
+BLOCKED_IPV6_NETWORKS = tuple(
+    ipaddress.ip_network(network)
+    for network in (
+        "100::/64",
+        "2001:2::/48",
+        "2001:20::/28",
+        "2001:db8::/32",
+        "fec0::/10",
+    )
+)
+PINNED_ADDRESSES = {}
+
+def normalize_hostname(hostname):
+    return (hostname or "").strip("[]").rstrip(".").lower()
+
+def is_blocked_hostname(hostname):
+    normalized = normalize_hostname(hostname)
+    return (
+        normalized in BLOCKED_HOSTNAMES
+        or normalized.endswith(".localhost")
+        or normalized.endswith(".local")
+        or normalized.endswith(".internal")
+    )
+
+def is_blocked_ip(address):
+    try:
+        parsed = ipaddress.ip_address(address)
+    except ValueError:
+        return False
+    embedded_ipv4 = extract_embedded_ipv4(parsed)
+    if embedded_ipv4 is not None and is_blocked_ip(str(embedded_ipv4)):
+        return True
+    if str(parsed).lower() in CLOUD_METADATA_IP_ADDRESSES:
+        return True
+    if isinstance(parsed, ipaddress.IPv4Address):
+        if any(parsed in network for network in BLOCKED_IPV4_NETWORKS):
+            return True
+    else:
+        if any(parsed in network for network in BLOCKED_IPV6_NETWORKS):
+            return True
+    return (
+        parsed.is_loopback
+        or parsed.is_private
+        or parsed.is_link_local
+        or parsed.is_multicast
+        or parsed.is_reserved
+        or parsed.is_unspecified
+    )
+
+def ipv4_from_int(value):
+    return ipaddress.IPv4Address(value & 0xffffffff)
+
+def extract_embedded_ipv4(address):
+    if not isinstance(address, ipaddress.IPv6Address):
+        return None
+    if address.ipv4_mapped is not None:
+        return address.ipv4_mapped
+    value = int(address)
+    hextets = [(value >> shift) & 0xffff for shift in range(112, -1, -16)]
+    if hextets[:6] == [0, 0, 0, 0, 0, 0]:
+        return ipv4_from_int(value)
+    if hextets[:6] == [0x64, 0xff9b, 0, 0, 0, 0]:
+        return ipv4_from_int(value)
+    if hextets[:6] == [0x64, 0xff9b, 1, 0, 0, 0]:
+        return ipv4_from_int(value)
+    if hextets[0] == 0x2002:
+        return ipv4_from_int((hextets[1] << 16) | hextets[2])
+    if hextets[0] == 0x2001 and hextets[1] == 0:
+        return ipv4_from_int(((hextets[6] << 16) | hextets[7]) ^ 0xffffffff)
+    if (hextets[4] & 0xfcff) == 0 and hextets[5] == 0x5efe:
+        return ipv4_from_int((hextets[6] << 16) | hextets[7])
+    return None
+
+def assert_url_allowed(url):
+    parsed = urllib.parse.urlparse(url)
+    if parsed.scheme not in ("http", "https"):
+        raise ValueError("http/request only supports http and https URLs")
+    hostname = normalize_hostname(parsed.hostname)
+    if not hostname or is_blocked_hostname(hostname) or is_blocked_ip(hostname):
+        raise ValueError("Blocked hostname or private/internal/special-use IP address")
+    try:
+        results = socket.getaddrinfo(hostname, parsed.port, proto=socket.IPPROTO_TCP)
+    except socket.gaierror as error:
+        raise ValueError(f"Unable to resolve hostname: {hostname}") from error
+    addresses = {entry[4][0] for entry in results if entry[4]}
+    if not addresses or any(is_blocked_ip(address) for address in addresses):
+        raise ValueError("Blocked: resolves to private/internal/special-use IP address")
+    PINNED_ADDRESSES[hostname] = sorted(addresses)
+
+class GuardedRedirectHandler(urllib.request.HTTPRedirectHandler):
+    def redirect_request(self, req, fp, code, msg, headers, newurl):
+        assert_url_allowed(newurl)
+        return super().redirect_request(req, fp, code, msg, headers, newurl)
+
+def pinned_getaddrinfo(original_getaddrinfo):
+    def getaddrinfo(host, port, family=0, type=0, proto=0, flags=0):
+        pinned = PINNED_ADDRESSES.get(normalize_hostname(host))
+        if not pinned:
+            return original_getaddrinfo(host, port, family, type, proto, flags)
+        results = []
+        for address in pinned:
+            results.extend(original_getaddrinfo(address, port, family, type, proto, flags))
+        return results
+    return getaddrinfo
+
+def handle_response(input_data, response):
+    headers = response_headers(response)
+    status = int(getattr(response, "status", getattr(response, "code", 0)))
+    if input_data.get("streamResponse"):
+        emit({"type": "headers", "status": status, "headers": headers})
+        seq = 1
+        while True:
+            chunk = response.read(65536)
+            if not chunk:
+                break
+            emit({
+                "type": "bodyDelta",
+                "seq": seq,
+                "deltaBase64": base64.b64encode(chunk).decode("ascii"),
+                "done": False,
+            })
+            seq += 1
+        emit({"type": "bodyDelta", "seq": seq, "deltaBase64": "", "done": True})
+        return
+    body = response.read()
+    emit({
+        "status": status,
+        "headers": headers,
+        "bodyBase64": base64.b64encode(body).decode("ascii"),
+    })
+
+def main():
+    input_data = json.load(sys.stdin)
+    url = str(input_data.get("url", ""))
+    assert_url_allowed(url)
+    body_base64 = input_data.get("bodyBase64")
+    data = base64.b64decode(body_base64) if isinstance(body_base64, str) else None
+    request = urllib.request.Request(
+        url,
+        data=data,
+        method=str(input_data.get("method", "GET")),
+    )
+    for header in input_data.get("headers") or []:
+        request.add_header(str(header.get("name", "")), str(header.get("value", "")))
+    timeout_ms = input_data.get("timeoutMs")
+    timeout = None
+    if isinstance(timeout_ms, (int, float)) and timeout_ms > 0:
+        timeout = timeout_ms / 1000
+    opener = urllib.request.build_opener(urllib.request.ProxyHandler({}), GuardedRedirectHandler)
+    original_getaddrinfo = socket.getaddrinfo
+    socket.getaddrinfo = pinned_getaddrinfo(original_getaddrinfo)
+    try:
+        with opener.open(request, timeout=timeout) as response:
+            handle_response(input_data, response)
+    except urllib.error.HTTPError as response:
+        handle_response(input_data, response)
+    finally:
+        socket.getaddrinfo = original_getaddrinfo
+
+if __name__ == "__main__":
+    main()
+PY
+python3 "$tmp"
+`.trim();
+function sendHttpBodyDelta(socket, params) {
+	if (socket.readyState !== 1) return;
+	socket.send(JSON.stringify({
+		jsonrpc: "2.0",
+		method: "http/request/bodyDelta",
+		params: {
+			requestId: params.requestId,
+			seq: params.seq,
+			deltaBase64: params.deltaBase64,
+			done: params.done,
+			error: params.error ?? null
+		}
+	}));
 }
 //#endregion
-//#region extensions/codex/src/app-server/elicitation-bridge.ts
-const MCP_TOOL_APPROVAL_KIND = "mcp_tool_call";
-const MCP_TOOL_APPROVAL_KIND_KEY = "codex_approval_kind";
-const MCP_TOOL_APPROVAL_CONNECTOR_NAME_KEY = "connector_name";
-const MCP_TOOL_APPROVAL_TOOL_TITLE_KEY = "tool_title";
-const MCP_TOOL_APPROVAL_TOOL_DESCRIPTION_KEY = "tool_description";
-const MCP_TOOL_APPROVAL_TOOL_PARAMS_DISPLAY_KEY = "tool_params_display";
-const MCP_TOOL_APPROVAL_SOURCE_KEY = "source";
-const MCP_TOOL_APPROVAL_CONNECTOR_SOURCE = "connector";
-const CODEX_APPS_SERVER_NAME = "codex_apps";
-const COMPUTER_USE_APPROVAL_TITLE = "Computer Use approval";
-const EMPTY_OBJECT_SCHEMA = {
-	type: "object",
-	properties: {}
-};
-const PLUGIN_APP_ID_META_KEYS = [
-	"app_id",
-	"appId",
-	"codex_app_id",
-	"codexAppId"
-];
-const PLUGIN_CONNECTOR_ID_META_KEYS = ["connector_id", "connectorId"];
-const PLUGIN_NAME_META_KEYS = [
-	"plugin_name",
-	"pluginName",
-	"codex_plugin_name",
-	"codexPluginName"
-];
-const PLUGIN_CONFIG_KEY_META_KEYS = [
-	"config_key",
-	"configKey",
-	"codex_config_key"
-];
-const PLUGIN_MARKETPLACE_NAME_META_KEYS = [
-	"marketplace_name",
-	"marketplaceName",
-	"codex_marketplace_name",
-	"codexMarketplaceName"
-];
-const MAX_DISPLAY_PARAM_ENTRIES = 8;
-const MAX_DISPLAY_PARAM_VALUE_LENGTH = 120;
-const MAX_DISPLAY_VALUE_ARRAY_ITEMS = 8;
-const MAX_DISPLAY_VALUE_OBJECT_KEYS = 8;
-const MAX_DISPLAY_VALUE_DEPTH = 3;
-const DISPLAY_TEXT_SCAN_MAX_LENGTH = 4096;
-const ANSI_OSC_SEQUENCE_RE$1 = new RegExp(String.raw`(?:\u001b]|\u009d)[^\u001b\u009c\u0007]*(?:\u0007|\u001b\\|\u009c)`, "g");
-const ANSI_CONTROL_SEQUENCE_RE$1 = new RegExp(String.raw`(?:\u001b\[[0-?]*[ -/]*[@-~]|\u009b[0-?]*[ -/]*[@-~]|\u001b[@-Z\\-_])`, "g");
-const CONTROL_CHARACTER_RE$1 = new RegExp(String.raw`[\u0000-\u001f\u007f-\u009f]+`, "g");
-const INVISIBLE_FORMATTING_CONTROL_RE$1 = new RegExp(String.raw`[\u00ad\u034f\u061c\u200b-\u200f\u202a-\u202e\u2060-\u206f\ufeff\ufe00-\ufe0f\u{e0100}-\u{e01ef}]`, "gu");
-const DANGLING_TERMINAL_SEQUENCE_SUFFIX_RE$1 = new RegExp(String.raw`(?:\u001b\][^\u001b\u009c\u0007]*|\u009d[^\u001b\u009c\u0007]*|\u001b\[[0-?]*[ -/]*|\u009b[0-?]*[ -/]*|\u001b)$`);
-async function handleCodexAppServerElicitationRequest(params) {
-	const requestParams = isJsonObject(params.requestParams) ? params.requestParams : void 0;
-	if (!requestParams) return;
-	if (!matchesCurrentThread(requestParams, params.threadId)) return;
-	if (turnIdMismatches(requestParams, params.turnId)) return;
-	const pluginResolution = resolvePluginElicitation({
-		requestParams,
-		pluginAppPolicyContext: params.pluginAppPolicyContext
-	});
-	if (pluginResolution.kind !== "not_plugin") {
-		if (pluginResolution.kind === "decline") {
-			logPluginElicitationDecline(pluginResolution.reason, requestParams);
-			return declineElicitationResponse();
-		}
-		if (!hasExactTurnId(requestParams, params.turnId)) {
-			logPluginElicitationDecline("missing_active_turn", requestParams);
-			return declineElicitationResponse();
+//#region extensions/codex/src/app-server/sandbox-exec-server/processes.ts
+/**
+* Manages subprocess lifecycle, streaming output buffers, stdin writes, and
+* termination for Codex sandbox exec-server process RPCs.
+*/
+const ENV_KEY_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
+const RETAINED_PROCESS_OUTPUT_BYTES = 1024 * 1024;
+const CLOSED_PROCESS_EVICTION_MS = 6e4;
+/** Starts a sandbox-backed process and registers it in the connection-local process table. */
+async function startProcess(execServer, processes, socket, params) {
+	const record = requireObject(params, "process/start params");
+	const processId = requireString(record.processId, "processId");
+	if (processes.has(processId)) throw new Error(`process already exists: ${processId}`);
+	const argv = requireStringArray(record.argv, "argv");
+	const cwd = resolveExecServerPath(requireString(record.cwd, "cwd"), "process cwd");
+	rejectUnsupportedArg0(record.arg0);
+	const env = readProcessEnv(record);
+	const managed = {
+		processId,
+		chunks: [],
+		retainedOutputBytes: 0,
+		nextSeq: 1,
+		exited: false,
+		exitCode: null,
+		closed: false,
+		failure: null,
+		tty: record.tty === true,
+		pipeStdin: record.pipeStdin === true,
+		abortController: new AbortController(),
+		child: null,
+		finalized: false,
+		waiters: [],
+		emitNotification: (method, notificationParams) => {
+			if (socket.readyState === 1) socket.send(JSON.stringify({
+				jsonrpc: "2.0",
+				method,
+				params: notificationParams
+			}));
+		},
+		evictProcess: () => {
+			if (managed.evictionTimer) return;
+			managed.evictionTimer = setTimeout(() => {
+				if (processes.get(processId) === managed && managed.closed) processes.delete(processId);
+			}, CLOSED_PROCESS_EVICTION_MS);
+			managed.evictionTimer.unref?.();
 		}
-		return await buildPluginPolicyElicitationResponse({
-			entry: pluginResolution.entry,
-			requestParams,
-			paramsForRun: params.paramsForRun,
-			signal: params.signal
+	};
+	processes.set(processId, managed);
+	try {
+		await runProcess(execServer, managed, {
+			argv,
+			cwd,
+			env
 		});
+	} catch (error) {
+		processes.delete(processId);
+		managed.failure = coerceErrorMessage(error);
+		managed.exitCode = null;
+		managed.exited = true;
+		managed.closed = true;
+		notifyProcessWaiters(managed);
+		throw error;
 	}
-	const approvalPrompt = readComputerUseApprovalElicitation(requestParams, params.computerUseMcpServerName) ?? readBridgeableApprovalElicitation(requestParams);
-	if (!approvalPrompt) return;
-	return buildElicitationResponse(approvalPrompt, await requestPluginApprovalOutcome({
-		paramsForRun: params.paramsForRun,
-		title: approvalPrompt.title,
-		description: approvalPrompt.description,
-		allowedDecisions: approvalPrompt.allowedDecisions,
-		signal: params.signal
-	}));
-}
-function matchesCurrentThread(requestParams, threadId) {
-	if (!requestParams) return false;
-	return readString$1(requestParams, "threadId") === threadId;
-}
-function turnIdMismatches(requestParams, turnId) {
-	const rawTurnId = requestParams?.turnId;
-	return rawTurnId !== null && rawTurnId !== void 0 && rawTurnId !== turnId;
+	return { processId };
+}
+async function runProcess(execServer, managed, params) {
+	const backend = execServer.sandbox.backend;
+	if (!backend) throw new Error("OpenClaw sandbox backend is unavailable.");
+	throwIfProcessStartCancelled(managed);
+	const execSpec = await backend.buildExecSpec({
+		command: shellCommandFromArgv(params.argv),
+		workdir: params.cwd,
+		env: params.env,
+		usePty: false
+	});
+	managed.finalizeToken = execSpec.finalizeToken;
+	managed.finalizeExec = backend.finalizeExec;
+	let child;
+	try {
+		if (managed.abortController.signal.aborted) throw new Error("process start cancelled");
+		const [command, ...args] = execSpec.argv;
+		if (!command) throw new Error("OpenClaw sandbox exec spec did not provide a command.");
+		child = spawn(command, args, {
+			env: execSpec.env,
+			stdio: [
+				"pipe",
+				"pipe",
+				"pipe"
+			]
+		});
+	} catch (error) {
+		managed.failure = coerceErrorMessage(error);
+		await finalizeProcess(managed).catch((finalizeError) => {
+			embeddedAgentLog.warn("codex sandbox exec-server finalize after start failure failed", {
+				processId: managed.processId,
+				error: coerceErrorMessage(finalizeError)
+			});
+		});
+		throw error;
+	}
+	managed.child = child;
+	const abortListener = () => child.kill("SIGTERM");
+	managed.abortController.signal.addEventListener("abort", abortListener, { once: true });
+	child.stdout.on("data", (chunk) => appendProcessChunk(managed, managed.tty ? "pty" : "stdout", chunk));
+	child.stderr.on("data", (chunk) => appendProcessChunk(managed, "stderr", chunk));
+	child.once("error", (error) => {
+		managed.failure ??= error.message;
+		notifyProcessWaiters(managed);
+	});
+	child.once("close", (code) => {
+		managed.abortController.signal.removeEventListener("abort", abortListener);
+		emitProcessClosed(managed, code ?? 1);
+	});
+	if (!managed.tty && !managed.pipeStdin) child.stdin.end();
 }
-function hasExactTurnId(requestParams, turnId) {
-	return requestParams?.turnId === turnId;
+function throwIfProcessStartCancelled(managed) {
+	if (managed.abortController.signal.aborted) throw new Error("process start cancelled");
 }
-function resolvePluginElicitation(params) {
-	const requestParams = params.requestParams;
-	if (!requestParams) return { kind: "not_plugin" };
-	const meta = isJsonObject(requestParams["_meta"]) ? requestParams["_meta"] : {};
-	const context = params.pluginAppPolicyContext;
-	const entries = context ? Object.values(context.apps) : [];
-	const pluginEntries = entries.filter(isPluginAppPolicyContextEntry);
-	const appId = readFirstString$1(meta, PLUGIN_APP_ID_META_KEYS) ?? readFirstString$1(requestParams, PLUGIN_APP_ID_META_KEYS);
-	const connectorId = readFirstString$1(meta, PLUGIN_CONNECTOR_ID_META_KEYS);
-	const isCodexConnectorApproval = isCodexConnectorApprovalElicitation(requestParams, meta);
-	if (isCodexConnectorApproval && appId && connectorId && appId !== connectorId) return {
-		kind: "decline",
-		reason: "app_id_connector_id_mismatch"
+function appendProcessChunk(managed, stream, data) {
+	if (data.length === 0) return;
+	const chunk = {
+		seq: managed.nextSeq,
+		stream,
+		chunk: data.toString("base64")
 	};
-	if (appId) {
-		if (!context) return {
-			kind: "decline",
-			reason: "missing_policy_context"
-		};
-		const entry = context.apps[appId];
-		if (entry?.source === "account" && !isCodexConnectorApproval) return {
-			kind: "decline",
-			reason: "account_app_source_mismatch"
-		};
-		return uniquePluginMatch(entry ? [entry] : [], "app_id");
+	managed.chunks.push(chunk);
+	managed.retainedOutputBytes += data.length;
+	while (managed.retainedOutputBytes > RETAINED_PROCESS_OUTPUT_BYTES && managed.chunks.length > 1) {
+		const removed = managed.chunks.shift();
+		if (!removed) break;
+		managed.retainedOutputBytes -= Buffer.from(removed.chunk, "base64").byteLength;
 	}
-	if (isCodexConnectorApproval && connectorId) {
-		if (!context) return {
-			kind: "decline",
-			reason: "missing_policy_context"
-		};
-		const entry = context.apps[connectorId];
-		return uniquePluginMatch(entry ? [entry] : [], "connector_id");
+	managed.nextSeq += 1;
+	managed.emitNotification("process/output", {
+		processId: managed.processId,
+		seq: chunk.seq,
+		stream: chunk.stream,
+		chunk: chunk.chunk
+	});
+	notifyProcessWaiters(managed);
+}
+function emitProcessClosed(managed, exitCode) {
+	if (!managed.exited) {
+		const exitSeq = managed.nextSeq;
+		managed.nextSeq += 1;
+		managed.exitCode = exitCode;
+		managed.exited = true;
+		if (exitCode !== null) managed.emitNotification("process/exited", {
+			processId: managed.processId,
+			seq: exitSeq,
+			exitCode
+		});
 	}
-	const serverName = readString$1(requestParams, "serverName");
-	if (serverName && context) {
-		const matches = entries.filter((entry) => entry.mcpServerNames.includes(serverName));
-		if (matches.length > 0) return uniquePluginMatch(matches, "server_name");
+	if (!managed.closed) {
+		const closeSeq = managed.nextSeq;
+		managed.nextSeq += 1;
+		managed.closed = true;
+		managed.emitNotification("process/closed", {
+			processId: managed.processId,
+			seq: closeSeq
+		});
 	}
-	const metadataResolution = resolvePluginStableMetadataMatch({
-		meta,
-		requestParams,
-		entries: pluginEntries,
-		context
+	finalizeProcess(managed).catch((error) => {
+		const message = coerceErrorMessage(error);
+		managed.failure ??= message;
+		embeddedAgentLog.warn("codex sandbox exec-server finalize failed", {
+			processId: managed.processId,
+			error: message
+		});
 	});
-	if (metadataResolution.kind !== "not_plugin") return metadataResolution;
-	if (context && hasDisplayNameOnlyPluginMatch(meta, entries)) return {
-		kind: "decline",
-		reason: "display_name_only"
+	managed.evictProcess();
+	notifyProcessWaiters(managed);
+}
+async function finalizeProcess(managed) {
+	if (managed.finalized) return;
+	managed.finalized = true;
+	managed.child?.stdin.destroy();
+	await managed.finalizeExec?.({
+		status: managed.failure ? "failed" : "completed",
+		exitCode: managed.exitCode,
+		timedOut: false,
+		token: managed.finalizeToken
+	});
+}
+function limitProcessChunks(chunks, maxBytes) {
+	if (!maxBytes) return chunks;
+	const retained = [];
+	let retainedBytes = 0;
+	for (const chunk of chunks) {
+		const byteLength = Buffer.from(chunk.chunk, "base64").byteLength;
+		if (retained.length > 0 && retainedBytes + byteLength > maxBytes) break;
+		retained.push(chunk);
+		retainedBytes += byteLength;
+		if (retainedBytes >= maxBytes) break;
+	}
+	return retained;
+}
+/** Reads buffered process output, optionally waiting for new output or process close. */
+async function readProcess(processes, params) {
+	const record = requireObject(params, "process/read params");
+	const managed = requireProcess(processes, requireString(record.processId, "processId"));
+	const afterSeq = typeof record.afterSeq === "number" ? record.afterSeq : 0;
+	const waitMs = typeof record.waitMs === "number" && record.waitMs > 0 ? record.waitMs : 0;
+	if (!managed.exited && !hasChunksAtOrAfter(managed, afterSeq) && waitMs > 0) await waitForProcessUpdate(managed, waitMs);
+	const chunks = limitProcessChunks(managed.chunks.filter((chunk) => chunk.seq > afterSeq), typeof record.maxBytes === "number" && record.maxBytes > 0 ? record.maxBytes : void 0);
+	const lastChunk = chunks.at(-1);
+	return {
+		chunks,
+		nextSeq: lastChunk ? lastChunk.seq + 1 : managed.nextSeq,
+		exited: managed.exited,
+		exitCode: managed.exitCode,
+		closed: managed.closed,
+		failure: managed.failure
 	};
-	return { kind: "not_plugin" };
 }
-function isCodexConnectorApprovalElicitation(requestParams, meta) {
-	return readString$1(requestParams, "serverName") === CODEX_APPS_SERVER_NAME && readString$1(meta, MCP_TOOL_APPROVAL_KIND_KEY) === MCP_TOOL_APPROVAL_KIND && readString$1(meta, MCP_TOOL_APPROVAL_SOURCE_KEY) === MCP_TOOL_APPROVAL_CONNECTOR_SOURCE;
+/** Writes base64 stdin data to a running process when stdin is still open. */
+function writeProcess(processes, params) {
+	const record = requireObject(params, "process/write params");
+	const processId = requireString(record.processId, "processId");
+	const managed = processes.get(processId);
+	if (!managed) return { status: "unknownProcess" };
+	const chunk = Buffer.from(requireString(record.chunk, "chunk"), "base64");
+	if (!managed.tty && !managed.pipeStdin || managed.closed || !managed.child?.stdin.writable) return { status: "stdinClosed" };
+	managed.child.stdin.write(chunk);
+	return { status: "accepted" };
+}
+/** Requests process termination and reports whether it was running at call time. */
+function terminateProcess(processes, params) {
+	const processId = requireString(requireObject(params, "process/terminate params").processId, "processId");
+	const managed = processes.get(processId);
+	if (!managed) return { running: false };
+	const running = !managed.exited;
+	managed.abortController.abort();
+	managed.child?.kill("SIGTERM");
+	if (running && !managed.child) emitProcessClosed(managed, null);
+	return { running };
+}
+function waitForProcessUpdate(managed, waitMs) {
+	return new Promise((resolve) => {
+		const timer = setTimeout(done, Math.min(waitMs, 3e4));
+		function done() {
+			clearTimeout(timer);
+			managed.waiters = managed.waiters.filter((waiter) => waiter !== done);
+			resolve();
+		}
+		managed.waiters.push(done);
+	});
 }
-function resolvePluginStableMetadataMatch(params) {
-	const pluginName = readFirstString$1(params.meta, PLUGIN_NAME_META_KEYS) ?? readFirstString$1(params.requestParams, PLUGIN_NAME_META_KEYS);
-	const configKey = readFirstString$1(params.meta, PLUGIN_CONFIG_KEY_META_KEYS) ?? readFirstString$1(params.requestParams, PLUGIN_CONFIG_KEY_META_KEYS);
-	const marketplaceName = readFirstString$1(params.meta, PLUGIN_MARKETPLACE_NAME_META_KEYS) ?? readFirstString$1(params.requestParams, PLUGIN_MARKETPLACE_NAME_META_KEYS);
-	if (!pluginName && !configKey) return { kind: "not_plugin" };
-	if (!params.context) return {
-		kind: "decline",
-		reason: "missing_policy_context"
-	};
-	return uniquePluginMatch(params.entries.filter((entry) => {
-		if (marketplaceName && entry.marketplaceName !== marketplaceName) return false;
-		if (pluginName && entry.pluginName !== pluginName) return false;
-		if (configKey && entry.configKey !== configKey) return false;
-		return true;
-	}), "metadata");
+function notifyProcessWaiters(managed) {
+	const waiters = managed.waiters;
+	managed.waiters = [];
+	for (const waiter of waiters) waiter();
 }
-function uniquePluginMatch(matches, source) {
-	if (matches.length === 1 && matches[0]) return {
-		kind: "matched",
-		entry: matches[0]
-	};
-	return {
-		kind: "decline",
-		reason: matches.length === 0 ? `${source}_not_enabled` : `${source}_ambiguous`
-	};
+function hasChunksAtOrAfter(managed, afterSeq) {
+	return managed.chunks.some((chunk) => chunk.seq > afterSeq);
 }
-function hasDisplayNameOnlyPluginMatch(meta, entries) {
-	const connectorName = readString$1(meta, MCP_TOOL_APPROVAL_CONNECTOR_NAME_KEY);
-	if (!connectorName) return false;
-	const normalized = normalizePluginIdentityText(connectorName);
-	return entries.some((entry) => normalizePluginIdentityText(appPolicyDisplayName(entry)) === normalized || isPluginAppPolicyContextEntry(entry) && normalizePluginIdentityText(entry.configKey) === normalized);
+function shellCommandFromArgv(argv) {
+	return argv.map(shellEscape).join(" ");
 }
-function isPluginAppPolicyContextEntry(entry) {
-	return entry.source !== "account";
+function shellEscape(value) {
+	return `'${value.replaceAll("'", `'"'"'`)}'`;
 }
-function appPolicyDisplayName(entry) {
-	return isPluginAppPolicyContextEntry(entry) ? entry.pluginName : entry.appName;
+function requireProcess(processes, processId) {
+	const managed = processes.get(processId);
+	if (!managed) throw new Error(`unknown process: ${processId}`);
+	return managed;
 }
-function normalizePluginIdentityText(value) {
-	return value.toLowerCase().replace(/[^a-z0-9]+/g, "");
+function rejectUnsupportedArg0(value) {
+	if (value === void 0 || value === null) return;
+	if (typeof value === "string") throw new Error("Codex sandbox exec-server does not support arg0 overrides.");
+	throw new Error("arg0 must be a string or null.");
 }
-async function buildPluginPolicyElicitationResponse(params) {
-	const mode = resolvePluginDestructiveApprovalMode(params.entry);
-	if (mode === "deny") {
-		logPluginElicitationDecline("destructive_actions_disabled", params.requestParams);
-		return declineElicitationResponse();
-	}
-	const approvalPrompt = readPluginApprovalElicitation(params.entry, params.requestParams);
-	if (!approvalPrompt) {
-		logPluginElicitationDecline("unsupported_schema", params.requestParams);
-		return declineElicitationResponse();
-	}
-	const response = buildElicitationResponse(approvalPrompt, "approved-once");
-	if (isJsonObject(response) && response.action === "accept") {
-		if (mode === "allow") return response;
-		return buildElicitationResponse(approvalPrompt, oneShotPluginPolicyApprovalOutcome(mode, await requestPluginApprovalOutcome({
-			paramsForRun: params.paramsForRun,
-			title: approvalPrompt.title,
-			description: approvalPrompt.description,
-			allowedDecisions: allowedPluginPolicyApprovalDecisions(mode, approvalPrompt),
-			signal: params.signal
-		})));
-	}
-	logPluginElicitationDecline("unmappable_schema", params.requestParams);
-	return declineElicitationResponse();
+function readEnv(value) {
+	if (!value || typeof value !== "object" || Array.isArray(value)) return {};
+	const env = {};
+	for (const [key, rawValue] of Object.entries(value)) if (typeof rawValue === "string" && ENV_KEY_RE.test(key)) env[key] = rawValue;
+	return env;
 }
-function resolvePluginDestructiveApprovalMode(entry) {
-	return entry.destructiveApprovalMode ?? (entry.allowDestructiveActions ? "allow" : "deny");
+function readProcessEnv(record) {
+	return sanitizeEnvVars({
+		...buildEnvFromPolicy(record.envPolicy),
+		...readEnv(record.env)
+	}).allowed;
 }
-function allowedPluginPolicyApprovalDecisions(mode, approvalPrompt) {
-	const allowedDecisions = approvalPrompt.allowedDecisions ?? ["allow-once", "deny"];
-	if (mode !== "ask") return allowedDecisions;
-	return allowedDecisions.filter((decision) => decision !== "allow-always");
+function buildEnvFromPolicy(value) {
+	if (!value || typeof value !== "object" || Array.isArray(value)) return {};
+	const policy = value;
+	const inheritedEnv = readEnv(policy.set);
+	const includeOnly = readStringList(policy.includeOnly);
+	if (includeOnly.length > 0) filterEnvKeys(inheritedEnv, includeOnly, true);
+	return inheritedEnv;
 }
-function oneShotPluginPolicyApprovalOutcome(mode, outcome) {
-	return mode === "ask" && outcome === "approved-session" ? "approved-once" : outcome;
+function filterEnvKeys(env, patterns, keepMatches) {
+	if (patterns.length === 0) return;
+	const regexes = patterns.map((pattern) => wildcardPatternToRegex(pattern));
+	for (const key of Object.keys(env)) if (regexes.some((regex) => regex.test(key)) !== keepMatches) delete env[key];
 }
-function readPluginApprovalElicitation(entry, requestParams) {
-	if (readString$1(requestParams, "mode") !== "form" || !isJsonObject(requestParams.requestedSchema)) return;
-	const requestedSchema = requestParams.requestedSchema;
-	if (readString$1(requestedSchema, "type") !== "object" || !isJsonObject(requestedSchema.properties)) return;
-	const meta = isJsonObject(requestParams["_meta"]) ? requestParams["_meta"] : {};
-	const title = sanitizeDisplayText(readString$1(requestParams, "message") ?? "") || "Codex plugin approval";
-	const descriptionMeta = { ...meta };
-	if (!readString$1(descriptionMeta, MCP_TOOL_APPROVAL_CONNECTOR_NAME_KEY)) descriptionMeta[MCP_TOOL_APPROVAL_CONNECTOR_NAME_KEY] = appPolicyDisplayName(entry);
+function wildcardPatternToRegex(pattern) {
+	const escaped = pattern.replace(/[.+^${}()|[\]\\]/gu, "\\$&");
+	return new RegExp(`^${escaped.replaceAll("*", ".*").replaceAll("?", ".")}$`, "iu");
+}
+function readStringList(value) {
+	return Array.isArray(value) ? value.filter((entry) => typeof entry === "string") : [];
+}
+//#endregion
+//#region extensions/codex/src/app-server/sandbox-exec-server.ts
+/**
+* Hosts the local OpenClaw sandbox exec-server that Codex app-server native
+* execution can register as an external environment.
+*/
+const CODEX_SANDBOX_EXEC_SERVER_MAX_INBOUND_MESSAGE_BYTES = 100 * 1024 * 1024;
+/** Starts or reuses a sandbox exec-server and registers it with Codex app-server. */
+async function ensureCodexSandboxExecServerEnvironment(params) {
+	if (!params.sandbox?.enabled || !params.sandbox.backend) return;
+	if (!canExposeLocalExecServerToAppServer(params.appServerStartOptions)) throw new Error("OpenClaw Codex exec-server uses a local loopback URL and cannot be registered with a remote Codex app-server.");
+	const execServer = await acquireOpenClawExecServer(params.sandbox);
+	try {
+		await params.client.request("environment/add", {
+			environmentId: execServer.environmentId,
+			execServerUrl: execServer.url
+		}, {
+			timeoutMs: params.timeoutMs,
+			signal: params.signal
+		});
+	} catch (error) {
+		await releaseOpenClawExecServer(execServer);
+		if (isEnvironmentAddUnsupported(error)) {
+			embeddedAgentLog.warn("codex app-server does not support remote environments yet", { environmentId: execServer.environmentId });
+			return;
+		}
+		throw error;
+	}
 	return {
-		title,
-		description: buildApprovalDescription({
-			title,
-			meta: descriptionMeta,
-			requestedSchema,
-			serverName: sanitizeOptionalDisplayText(readString$1(requestParams, "serverName"))
-		}),
-		requestedSchema,
-		meta,
-		persistHintsMode: "explicit",
-		allowedDecisions: buildApprovalAllowedDecisions(requestedSchema, meta)
+		environmentId: execServer.environmentId,
+		cwd: params.sandbox.containerWorkdir
 	};
 }
-function buildApprovalAllowedDecisions(requestedSchema, meta) {
-	return canMapPersistentApproval(requestedSchema, meta) ? [
-		"allow-once",
-		"allow-always",
-		"deny"
-	] : ["allow-once", "deny"];
+/** Releases the sandbox exec-server lease associated with a sandbox runtime. */
+async function releaseCodexSandboxExecServerEnvironment(sandbox) {
+	if (!sandbox?.enabled) return;
+	const server = await sandboxExecServerRegistry.servers.get(sandbox.runtimeId)?.catch(() => void 0);
+	if (server) await releaseOpenClawExecServer(server);
 }
-function canMapPersistentApproval(requestedSchema, meta) {
-	const persistHints = readPersistHints(meta, "explicit");
-	if (persistHints.length > 0) return persistHints.includes("always");
-	const properties = isJsonObject(requestedSchema.properties) ? requestedSchema.properties : {};
-	return Object.entries(properties).some(([name, value]) => {
-		const schema = isJsonObject(value) ? value : void 0;
-		if (!schema) return false;
-		return isPersistField({
-			name,
-			schema,
-			required: false
-		}) && chooseAlwaysPersistOptionValue(readEnumOptions(schema)) !== void 0;
-	});
+function isEnvironmentAddUnsupported(error) {
+	if (!(error instanceof Error)) return false;
+	return error.message.includes("environment/add") && (error.message.includes("unknown variant") || error.message.includes("Method not found"));
 }
-function declineElicitationResponse() {
-	return {
-		action: "decline",
-		content: null,
-		_meta: null
-	};
+function canExposeLocalExecServerToAppServer(startOptions) {
+	if (!startOptions || startOptions.transport !== "websocket") return true;
+	if (typeof startOptions.url !== "string") return false;
+	try {
+		const host = new URL(startOptions.url).hostname.toLowerCase();
+		const ipHost = host.startsWith("[") && host.endsWith("]") ? host.slice(1, -1) : host;
+		if (host === "localhost" || ipHost === "::1") return true;
+		return isIP(ipHost) === 4 && ipHost.split(".")[0] === "127";
+	} catch {
+		return false;
+	}
 }
-function logPluginElicitationDecline(reason, requestParams) {
-	embeddedAgentLog.debug("codex plugin elicitation declined", {
-		reason,
-		serverName: readString$1(requestParams, "serverName"),
-		mode: readString$1(requestParams, "mode")
-	});
+async function acquireOpenClawExecServer(sandbox) {
+	const key = sandbox.runtimeId;
+	while (true) {
+		const promise = sandboxExecServerRegistry.servers.get(key) ?? startAndRememberOpenClawExecServer(sandbox);
+		const server = await promise;
+		if (!server.closed && sandboxExecServerRegistry.servers.get(key) === promise) {
+			server.refCount += 1;
+			return server;
+		}
+	}
 }
-function readBridgeableApprovalElicitation(requestParams) {
-	if (!requestParams || readString$1(requestParams, "mode") !== "form" || !isJsonObject(requestParams["_meta"]) || requestParams["_meta"][MCP_TOOL_APPROVAL_KIND_KEY] !== MCP_TOOL_APPROVAL_KIND || !isJsonObject(requestParams.requestedSchema)) return;
-	const requestedSchema = requestParams.requestedSchema;
-	if (readString$1(requestedSchema, "type") !== "object" || !isJsonObject(requestedSchema.properties)) return;
-	const title = sanitizeDisplayText(readString$1(requestParams, "message") ?? "") || "Codex MCP tool approval";
-	return {
-		title,
-		description: buildApprovalDescription({
-			title,
-			meta: requestParams["_meta"],
-			requestedSchema,
-			serverName: sanitizeOptionalDisplayText(readString$1(requestParams, "serverName"))
-		}),
-		requestedSchema,
-		meta: requestParams["_meta"]
-	};
+function startAndRememberOpenClawExecServer(sandbox) {
+	const created = startOpenClawExecServer(sandbox);
+	const key = sandbox.runtimeId;
+	sandboxExecServerRegistry.servers.set(key, created);
+	created.catch(() => {
+		if (sandboxExecServerRegistry.servers.get(key) === created) sandboxExecServerRegistry.servers.delete(key);
+	});
+	return created;
 }
-function readComputerUseApprovalElicitation(requestParams, expectedServerName) {
-	const serverName = readString$1(requestParams, "serverName");
-	if (!serverName || !expectedServerName || serverName !== expectedServerName || readString$1(requestParams, "mode") !== "form") return;
-	const requestedSchema = isJsonObject(requestParams?.requestedSchema) ? requestParams.requestedSchema : EMPTY_OBJECT_SCHEMA;
-	if (readString$1(requestedSchema, "type") !== "object" || !isJsonObject(requestedSchema.properties)) return;
-	const meta = isJsonObject(requestParams?.["_meta"]) ? requestParams["_meta"] : {};
-	const title = sanitizeDisplayText(readString$1(requestParams, "message") ?? "") || COMPUTER_USE_APPROVAL_TITLE;
-	return {
-		title,
-		description: buildApprovalDescription({
-			title,
-			meta,
-			requestedSchema,
-			serverName: sanitizeOptionalDisplayText(serverName)
-		}),
-		requestedSchema,
-		meta
+async function startOpenClawExecServer(sandbox) {
+	const server = new WebSocketServer({
+		host: "127.0.0.1",
+		port: 0,
+		maxPayload: CODEX_SANDBOX_EXEC_SERVER_MAX_INBOUND_MESSAGE_BYTES
+	});
+	await once(server, "listening");
+	const address = server.address();
+	if (!address || typeof address === "string") throw new Error("OpenClaw Codex exec-server did not bind to a TCP port.");
+	const environmentId = buildEnvironmentId(sandbox);
+	const authPath = `/openclaw-${randomUUID()}`;
+	const execServer = {
+		authPath,
+		closed: false,
+		environmentId,
+		refCount: 0,
+		url: `ws://127.0.0.1:${address.port}${authPath}`,
+		sandbox,
+		server
 	};
+	server.on("connection", (socket, request) => {
+		socket.on("error", handleExecServerSocketError);
+		if (!isAuthorizedExecServerRequest(execServer, request)) {
+			socket.close(1008, "unauthorized");
+			return;
+		}
+		handleConnection(execServer, socket);
+	});
+	embeddedAgentLog.info("codex sandbox exec-server started", {
+		environmentId,
+		runtimeId: sandbox.runtimeId,
+		backendId: sandbox.backendId
+	});
+	return execServer;
+}
+async function releaseOpenClawExecServer(execServer) {
+	if (execServer.closed) return;
+	execServer.refCount = Math.max(0, execServer.refCount - 1);
+	if (execServer.refCount > 0) return;
+	const current = await sandboxExecServerRegistry.servers.get(execServer.sandbox.runtimeId)?.catch(() => void 0);
+	if (execServer.refCount > 0 || execServer.closed) return;
+	if (current === execServer) sandboxExecServerRegistry.servers.delete(execServer.sandbox.runtimeId);
+	await closeOpenClawExecServer(execServer);
+}
+async function closeOpenClawExecServer(execServer) {
+	if (execServer.closed) return;
+	execServer.closed = true;
+	for (const client of execServer.server.clients) client.close(1001, "shutdown");
+	await new Promise((resolve) => {
+		execServer.server.close(() => resolve());
+	});
 }
-function buildApprovalDescription(params) {
-	const connectorName = sanitizeOptionalDisplayText(readString$1(params.meta, MCP_TOOL_APPROVAL_CONNECTOR_NAME_KEY));
-	const toolTitle = sanitizeOptionalDisplayText(readString$1(params.meta, MCP_TOOL_APPROVAL_TOOL_TITLE_KEY));
-	const toolDescription = sanitizeOptionalDisplayText(readString$1(params.meta, MCP_TOOL_APPROVAL_TOOL_DESCRIPTION_KEY));
-	const summaryLines = [
-		connectorName && `App: ${connectorName}`,
-		toolTitle && `Tool: ${toolTitle}`,
-		params.serverName && `MCP server: ${params.serverName}`,
-		toolDescription
-	].filter((line) => Boolean(line));
-	const paramLines = readDisplayParamLines(params.meta);
-	const propertyLines = readPropertyDescriptionLines(params.requestedSchema);
-	return [
-		params.title,
-		summaryLines.join("\n"),
-		paramLines.length > 0 ? ["Parameters:", ...paramLines].join("\n") : "",
-		propertyLines.length > 0 ? ["Fields:", ...propertyLines].join("\n") : ""
-	].filter(Boolean).join("\n\n");
+function buildEnvironmentId(sandbox) {
+	return `openclaw-sandbox-${createHash("sha256").update(sandbox.runtimeId).digest("hex").slice(0, 16)}`;
 }
-function readPropertyDescriptionLines(requestedSchema) {
-	const properties = isJsonObject(requestedSchema.properties) ? requestedSchema.properties : {};
-	return Object.entries(properties).map(([name, value]) => {
-		const schema = isJsonObject(value) ? value : void 0;
-		if (!schema) return;
-		const propTitle = sanitizeDisplayText(readString$1(schema, "title") ?? "") || sanitizeDisplayText(name) || "field";
-		const description = sanitizeOptionalDisplayText(readString$1(schema, "description"));
-		return description ? `- ${propTitle}: ${description}` : `- ${propTitle}`;
-	}).filter((line) => Boolean(line));
+function isAuthorizedExecServerRequest(execServer, request) {
+	return new URL(request.url ?? "", "ws://127.0.0.1").pathname === execServer.authPath;
 }
-function readDisplayParamLines(meta) {
-	const displayParams = meta[MCP_TOOL_APPROVAL_TOOL_PARAMS_DISPLAY_KEY];
-	if (!Array.isArray(displayParams)) return [];
-	const lines = displayParams.slice(0, MAX_DISPLAY_PARAM_ENTRIES).map((entry) => {
-		const param = isJsonObject(entry) ? entry : void 0;
-		if (!param) return;
-		const name = sanitizeOptionalDisplayText(readString$1(param, "display_name")) ?? sanitizeOptionalDisplayText(readString$1(param, "name"));
-		if (!name) return;
-		return `- ${name}: ${formatDisplayParamValue(param.value)}`;
-	}).filter((line) => Boolean(line));
-	const remaining = displayParams.length - MAX_DISPLAY_PARAM_ENTRIES;
-	return remaining > 0 ? [...lines, `- Additional parameters: ${remaining} more`] : lines;
+function handleConnection(execServer, socket) {
+	const processes = /* @__PURE__ */ new Map();
+	const fileReads = /* @__PURE__ */ new Map();
+	socket.on("message", (data) => {
+		handleMessage(execServer, processes, fileReads, socket, data).catch((error) => {
+			embeddedAgentLog.warn("codex sandbox exec-server message failed", { error });
+		});
+	});
+	socket.on("close", () => {
+		closeAllFileReads(fileReads);
+		for (const process of processes.values()) process.abortController.abort();
+	});
 }
-function formatDisplayParamValue(value) {
-	return truncateDisplayText(sanitizeDisplayText(typeof value === "string" ? value : formatDisplayJsonValue(value ?? null)), MAX_DISPLAY_PARAM_VALUE_LENGTH);
+function handleExecServerSocketError(error) {
+	embeddedAgentLog.debug("codex sandbox exec-server websocket failed", { error });
 }
-function formatDisplayJsonValue(value, depth = MAX_DISPLAY_VALUE_DEPTH) {
-	if (value === null) return "null";
-	if (typeof value === "string") return JSON.stringify(truncateDisplayText(sanitizeDisplayText(value), 80));
-	if (typeof value === "number" || typeof value === "boolean") return String(value);
-	if (Array.isArray(value)) {
-		if (depth <= 0) return "[truncated]";
-		const parts = [];
-		const limit = Math.min(value.length, MAX_DISPLAY_VALUE_ARRAY_ITEMS);
-		for (let i = 0; i < limit; i += 1) parts.push(formatDisplayJsonValue(value[i] ?? null, depth - 1));
-		if (value.length > MAX_DISPLAY_VALUE_ARRAY_ITEMS) parts.push("...");
-		return `[${parts.join(",")}]`;
+async function handleMessage(execServer, processes, fileReads, socket, data) {
+	const request = parseRequest(data);
+	if (!request.method) {
+		sendError(socket, request.id, -32600, "Invalid Request");
+		return;
 	}
-	if (typeof value === "object") {
-		if (depth <= 0) return "{truncated}";
-		const parts = [];
-		let count = 0;
-		let truncated = false;
-		for (const key in value) {
-			if (!Object.hasOwn(value, key)) continue;
-			if (count >= MAX_DISPLAY_VALUE_OBJECT_KEYS) {
-				truncated = true;
-				break;
-			}
-			const safeKey = truncateDisplayText(sanitizeDisplayText(key), 80);
-			parts.push(`${JSON.stringify(safeKey)}:${formatDisplayJsonValue(value[key] ?? null, depth - 1)}`);
-			count += 1;
-		}
-		if (truncated) parts.push("...");
-		return `{${parts.join(",")}}`;
+	const method = request.method;
+	if (request.id === void 0) {
+		if (method !== "initialized") sendError(socket, -1, -32600, `Unexpected notification: ${method}`);
+		return;
+	}
+	try {
+		const result = await dispatchRequest(execServer, processes, fileReads, socket, {
+			...request,
+			method
+		});
+		sendResult(socket, request.id, result);
+	} catch (error) {
+		sendError(socket, request.id, error instanceof JsonRpcProtocolError ? error.code : -32603, error instanceof Error ? error.message : String(error));
 	}
-	return "null";
 }
-function sanitizeOptionalDisplayText(value) {
-	return (value === void 0 ? "" : sanitizeDisplayText(value)) || void 0;
+async function dispatchRequest(execServer, processes, fileReads, socket, request) {
+	switch (request.method) {
+		case "initialize": return { sessionId: randomUUID() };
+		case "environment/info": return {
+			shell: {
+				name: "sh",
+				path: "/bin/sh"
+			},
+			cwd: pathToFileURL(execServer.sandbox.containerWorkdir, { windows: false }).href,
+			capabilities: { networkProxyLaunch: false }
+		};
+		case "environment/status": return { status: "ready" };
+		case "process/start": return startProcess(execServer, processes, socket, request.params);
+		case "process/read": return await readProcess(processes, request.params);
+		case "process/write": return writeProcess(processes, request.params);
+		case "process/terminate": return terminateProcess(processes, request.params);
+		case "fs/open": return await openFile(execServer, fileReads, request.params);
+		case "fs/readBlock": return readFileBlock(fileReads, request.params);
+		case "fs/close": return closeFile(fileReads, request.params);
+		case "fs/readFile": return await readFile(execServer, request.params);
+		case "fs/writeFile":
+			await writeFile(execServer, request.params);
+			return {};
+		case "fs/createDirectory":
+			await createDirectory(execServer, request.params);
+			return {};
+		case "fs/getMetadata": return await getMetadata(execServer, request.params);
+		case "fs/readDirectory": return await readDirectory(execServer, request.params);
+		case "fs/remove":
+			await removePath(execServer, request.params);
+			return {};
+		case "fs/copy":
+			await copyPath(execServer, request.params);
+			return {};
+		case "http/request": return await httpRequest(execServer, socket, request.params);
+		default: throw new JsonRpcProtocolError(JSON_RPC_METHOD_NOT_FOUND, `Unsupported OpenClaw sandbox exec-server method: ${request.method}`);
+	}
 }
-function sanitizeDisplayText(value) {
-	const scanned = sliceUtf16Safe(value, 0, DISPLAY_TEXT_SCAN_MAX_LENGTH);
-	const clipped = value.length > DISPLAY_TEXT_SCAN_MAX_LENGTH;
-	const sanitized = scanned.replace(ANSI_OSC_SEQUENCE_RE$1, "").replace(ANSI_CONTROL_SEQUENCE_RE$1, "").replace(DANGLING_TERMINAL_SEQUENCE_SUFFIX_RE$1, "").replace(INVISIBLE_FORMATTING_CONTROL_RE$1, " ").replace(CONTROL_CHARACTER_RE$1, " ").replace(/\s+/g, " ").trim();
-	const escaped = sanitized ? formatCodexDisplayText(sanitized) : "";
-	return clipped && escaped ? `${escaped}...` : escaped;
+//#endregion
+//#region extensions/codex/src/app-server/provider-capabilities.ts
+function resolveOverriddenProviderWebSearchSupport(modelProviderOverride) {
+	const provider = modelProviderOverride?.trim().toLowerCase();
+	if (!provider) return;
+	return provider === "openai" ? "supported" : "unsupported";
 }
-function truncateDisplayText(value, maxLength) {
-	return value.length <= maxLength ? value : `${truncateUtf16Safe(value, maxLength - 3)}...`;
+async function readConfiguredProviderWebSearchSupport(params) {
+	return (await params.client.request("modelProvider/capabilities/read", {}, {
+		timeoutMs: params.timeoutMs,
+		signal: params.signal
+	})).webSearch ? "supported" : "unsupported";
 }
-async function requestPluginApprovalOutcome(params) {
+async function resolveCodexProviderWebSearchSupportForClient(params) {
+	const overrideSupport = resolveOverriddenProviderWebSearchSupport(params.modelProviderOverride);
+	if (overrideSupport) return overrideSupport;
 	try {
-		const requestResult = await requestPluginApproval({
-			paramsForRun: params.paramsForRun,
-			title: params.title,
-			description: params.description,
-			severity: "warning",
-			toolName: "codex_mcp_tool_approval",
-			allowedDecisions: params.allowedDecisions
-		});
-		const approvalId = requestResult?.id;
-		if (!approvalId) return "unavailable";
-		return mapExecDecisionToOutcome(approvalRequestExplicitlyUnavailable(requestResult) ? null : await waitForPluginApprovalDecision({
-			approvalId,
-			signal: params.signal
-		}));
+		return await readConfiguredProviderWebSearchSupport(params);
 	} catch {
-		return params.signal?.aborted ? "cancelled" : "denied";
+		return "unknown";
 	}
 }
-function buildElicitationResponse(approvalPrompt, outcome) {
-	const { requestedSchema, meta } = approvalPrompt;
-	if (outcome === "cancelled") return {
-		action: "cancel",
-		content: null,
-		_meta: null
-	};
-	if (outcome === "denied" || outcome === "unavailable") return {
-		action: "decline",
-		content: null,
-		_meta: null
-	};
-	const content = buildAcceptedContent(approvalPrompt, outcome);
-	if (!content) {
-		if (hasNoSchemaProperties(requestedSchema)) return {
-			action: "accept",
-			content: null,
-			_meta: buildAcceptedMeta(meta, outcome, approvalPrompt.persistHintsMode ?? "legacy")
-		};
-		embeddedAgentLog.warn("codex MCP approval elicitation approved without a mappable response", {
-			approvalKind: meta[MCP_TOOL_APPROVAL_KIND_KEY],
-			fields: Object.keys(requestedSchema.properties ?? {}),
-			outcome
+async function resolveCodexProviderWebSearchSupport(params) {
+	const overrideSupport = resolveOverriddenProviderWebSearchSupport(params.modelProviderOverride);
+	if (overrideSupport) return overrideSupport;
+	let client;
+	try {
+		client = await params.clientFactory({
+			startOptions: params.appServer.start,
+			...params.preparedAuth ? { preparedAuth: params.preparedAuth } : { authProfileId: params.authProfileId },
+			agentDir: params.agentDir,
+			config: params.config,
+			timeoutMs: params.appServer.requestTimeoutMs
 		});
-		return {
-			action: "decline",
-			content: null,
-			_meta: null
-		};
+		return await resolveCodexProviderWebSearchSupportForClient({
+			client,
+			timeoutMs: params.appServer.requestTimeoutMs,
+			modelProviderOverride: params.modelProviderOverride,
+			signal: params.signal
+		});
+	} catch {
+		return "unknown";
+	} finally {
+		if (client) releaseLeasedSharedCodexAppServerClient(client);
 	}
-	return {
-		action: "accept",
-		content,
-		_meta: buildAcceptedMeta(meta, outcome, approvalPrompt.persistHintsMode ?? "legacy")
-	};
-}
-function buildAcceptedContent(approvalPrompt, outcome) {
-	const { requestedSchema, meta } = approvalPrompt;
-	const properties = isJsonObject(requestedSchema.properties) ? requestedSchema.properties : void 0;
-	if (!properties) return;
-	const required = Array.isArray(requestedSchema.required) ? new Set(requestedSchema.required.filter((entry) => typeof entry === "string")) : /* @__PURE__ */ new Set();
-	const content = {};
-	let sawApprovalField = false;
-	for (const [name, value] of Object.entries(properties)) {
-		const schema = isJsonObject(value) ? value : void 0;
-		if (!schema) continue;
-		const property = {
-			name,
-			schema,
-			required: required.has(name)
-		};
-		const next = readApprovalFieldValue(property, outcome) ?? readPersistFieldValue(property, meta, outcome, approvalPrompt.persistHintsMode ?? "legacy") ?? readFallbackFieldValue(property, outcome);
-		if (next === void 0) {
-			if (isApprovalField(property)) sawApprovalField = true;
-			if (property.required) return;
-			continue;
-		}
-		if (isApprovalField(property)) sawApprovalField = true;
-		content[name] = next;
-	}
-	return sawApprovalField ? content : void 0;
-}
-function readApprovalFieldValue(property, outcome) {
-	if (!isApprovalField(property)) return;
-	if (readString$1(property.schema, "type") === "boolean") return true;
-	const options = readEnumOptions(property.schema);
-	if (options.length === 0) return;
-	const sessionChoice = options.find((option) => isSessionApprovalOption(option));
-	const acceptChoice = options.find((option) => isPositiveApprovalOption(option));
-	if (outcome === "approved-session") return sessionChoice?.value ?? acceptChoice?.value;
-	return acceptChoice?.value ?? sessionChoice?.value;
-}
-function readPersistFieldValue(property, meta, outcome, persistHintsMode) {
-	if (!isPersistField(property) || outcome !== "approved-session") return;
-	const persistHints = readPersistHints(meta, persistHintsMode);
-	const options = readEnumOptions(property.schema);
-	if (options.length === 0) return;
-	const preferred = choosePersistHint(persistHints);
-	if (preferred) return options.find((option) => option.value === preferred || option.label === preferred)?.value;
-	if (persistHintsMode === "explicit") return chooseAlwaysPersistOptionValue(options);
-}
-function readDefaultValue(schema) {
-	return schema.default;
-}
-function readFallbackFieldValue(property, outcome) {
-	if (outcome === "approved-once" && isPersistField(property)) return;
-	return readDefaultValue(property.schema);
-}
-function isApprovalField(property) {
-	const haystack = propertyText(property).toLowerCase();
-	return /\b(approve|approval|allow|accept|decision)\b/.test(haystack);
-}
-function isPersistField(property) {
-	const haystack = propertyText(property).toLowerCase();
-	return /\b(persist|session|always|scope)\b/.test(haystack);
-}
-function propertyText(property) {
-	return [
-		property.name,
-		readString$1(property.schema, "title"),
-		readString$1(property.schema, "description")
-	].filter(Boolean).join(" ");
-}
-function readPersistHints(meta, mode = "legacy") {
-	const raw = meta.persist;
-	if (typeof raw === "string") return [raw];
-	if (Array.isArray(raw)) return raw.filter((entry) => typeof entry === "string");
-	return mode === "legacy" ? ["session", "always"] : [];
-}
-function buildAcceptedMeta(meta, outcome, persistHintsMode) {
-	if (outcome !== "approved-session") return null;
-	const persist = choosePersistHint(readPersistHints(meta, persistHintsMode));
-	return persist ? { persist } : null;
-}
-function choosePersistHint(persistHints) {
-	if (persistHints.includes("always")) return "always";
-	if (persistHints.includes("session")) return "session";
-}
-function chooseAlwaysPersistOptionValue(options) {
-	return options.find((option) => optionMatchesPersist(option, "always"))?.value;
 }
-function optionMatchesPersist(option, persist) {
-	return option.value.toLowerCase() === persist || option.label.toLowerCase() === persist;
+//#endregion
+//#region extensions/codex/src/app-server/plugin-approval-roundtrip.ts
+const DEFAULT_CODEX_APPROVAL_TIMEOUT_MS = 12e4;
+const MAX_PLUGIN_APPROVAL_TITLE_LENGTH = 80;
+const MAX_PLUGIN_APPROVAL_DESCRIPTION_LENGTH = 256;
+const ANSI_OSC_SEQUENCE_RE = new RegExp(String.raw`(?:\u001b]|\u009d)[^\u001b\u009c\u0007]*(?:\u0007|\u001b\\|\u009c)`, "g");
+const ANSI_CONTROL_SEQUENCE_RE = new RegExp(String.raw`(?:\u001b\[[0-?]*[ -/]*[@-~]|\u009b[0-?]*[ -/]*[@-~]|\u001b[@-Z\\-_])`, "g");
+const CONTROL_CHARACTER_RE = new RegExp(String.raw`[\u0000-\u001f\u007f-\u009f]+`, "g");
+const INVISIBLE_FORMATTING_CONTROL_RE = new RegExp(String.raw`[\u00ad\u034f\u061c\u200b-\u200f\u202a-\u202e\u2060-\u206f\ufeff\ufe00-\ufe0f\u{e0100}-\u{e01ef}]`, "gu");
+const DANGLING_TERMINAL_SEQUENCE_SUFFIX_RE = new RegExp(String.raw`(?:\u001b\][^\u001b\u009c\u0007]*|\u009d[^\u001b\u009c\u0007]*|\u001b\[[0-?]*[ -/]*|\u009b[0-?]*[ -/]*|\u001b)$`);
+/** Starts a two-phase plugin approval request through the OpenClaw gateway. */
+async function requestPluginApproval(params) {
+	const timeoutMs = DEFAULT_CODEX_APPROVAL_TIMEOUT_MS;
+	return params.hostCapabilities.requestApproval({
+		title: truncateCodexApprovalDisplayText(params.title, MAX_PLUGIN_APPROVAL_TITLE_LENGTH),
+		description: truncateCodexApprovalDisplayText(params.description, MAX_PLUGIN_APPROVAL_DESCRIPTION_LENGTH),
+		severity: params.severity,
+		toolName: params.toolName,
+		toolCallId: params.toolCallId,
+		timeoutMs,
+		transportTimeoutMs: resolveCodexGatewayTimeoutWithGraceMs(timeoutMs),
+		...params.allowedDecisions ? { allowedDecisions: params.allowedDecisions } : {}
+	});
 }
-function hasNoSchemaProperties(requestedSchema) {
-	const properties = isJsonObject(requestedSchema.properties) ? requestedSchema.properties : {};
-	return Object.keys(properties).length === 0;
+/** Detects the gateway's explicit null-decision marker for unavailable approvals. */
+function approvalRequestExplicitlyUnavailable(result) {
+	if (result === null || result === void 0 || typeof result !== "object") return false;
+	let descriptor;
+	try {
+		descriptor = Object.getOwnPropertyDescriptor(result, "decision");
+	} catch {
+		return false;
+	}
+	return descriptor !== void 0 && "value" in descriptor && descriptor.value === null;
 }
-function readEnumOptions(schema) {
-	if (Array.isArray(schema.enum)) {
-		const values = schema.enum.filter((entry) => typeof entry === "string");
-		const labels = Array.isArray(schema.enumNames) ? schema.enumNames.filter((entry) => typeof entry === "string") : [];
-		return values.map((value, index) => ({
-			value,
-			label: labels[index] ?? value
-		}));
+/** Waits for the gateway's final approval decision, respecting turn aborts. */
+async function waitForPluginApprovalDecision(params) {
+	const timeoutMs = DEFAULT_CODEX_APPROVAL_TIMEOUT_MS;
+	const waitPromise = params.hostCapabilities.waitForApproval({
+		approvalId: params.approvalId,
+		timeoutMs,
+		transportTimeoutMs: resolveCodexGatewayTimeoutWithGraceMs(timeoutMs),
+		signal: params.signal
+	}).catch((error) => {
+		if (isApprovalNotFoundError(error)) return null;
+		throw error;
+	});
+	const bindDecision = (result) => result;
+	if (!params.signal) return bindDecision(await waitPromise);
+	let onAbort;
+	const abortPromise = new Promise((_, reject) => {
+		if (params.signal.aborted) {
+			reject(toErrorObject(params.signal.reason, "Non-Error rejection"));
+			return;
+		}
+		onAbort = () => reject(toErrorObject(params.signal.reason, "Non-Error rejection"));
+		params.signal.addEventListener("abort", onAbort, { once: true });
+	});
+	try {
+		return bindDecision(await Promise.race([waitPromise, abortPromise]));
+	} finally {
+		if (onAbort) params.signal.removeEventListener("abort", onAbort);
 	}
-	if (Array.isArray(schema.oneOf)) return schema.oneOf.map((entry) => {
-		const option = isJsonObject(entry) ? entry : void 0;
-		const value = readString$1(option, "const");
-		if (!value) return;
-		return {
-			value,
-			label: readString$1(option, "title") ?? value
-		};
-	}).filter((entry) => Boolean(entry));
-	return [];
 }
-function isPositiveApprovalOption(option) {
-	const haystack = `${option.value} ${option.label}`.toLowerCase();
-	return /\b(allow|approve|accept|yes|continue|proceed|true)\b/.test(haystack);
+/** Converts a gateway exec approval decision into the app-server approval outcome enum. */
+function mapExecDecisionToOutcome(decision) {
+	if (decision === "allow-once") return "approved-once";
+	if (decision === "allow-always") return "approved-session";
+	if (decision === null || decision === void 0) return "unavailable";
+	return "denied";
 }
-function isSessionApprovalOption(option) {
-	const haystack = `${option.value} ${option.label}`.toLowerCase();
-	return /\b(session|always|persistent)\b/.test(haystack) && /\b(allow|approve|accept)\b/.test(haystack);
+function truncateCodexApprovalDisplayText(value, maxLength) {
+	return value.length <= maxLength ? value : `${truncateUtf16Safe(value, maxLength - 3)}...`;
 }
-function readString$1(record, key) {
-	const value = record?.[key];
-	return typeof value === "string" && value.trim() ? value : void 0;
+function stripDanglingCodexApprovalTerminalSequence(value) {
+	return value.replace(DANGLING_TERMINAL_SEQUENCE_SUFFIX_RE, "");
 }
-function readFirstString$1(record, keys) {
-	for (const key of keys) {
-		const value = readString$1(record, key);
-		if (value) return value;
-	}
+function sanitizeCodexApprovalVisibleText(value, options = {}) {
+	const terminalSafe = value.replace(ANSI_OSC_SEQUENCE_RE, "").replace(ANSI_CONTROL_SEQUENCE_RE, "");
+	return (options.stripDanglingTerminalSequence ? stripDanglingCodexApprovalTerminalSequence(terminalSafe) : terminalSafe).replace(INVISIBLE_FORMATTING_CONTROL_RE, " ").replace(CONTROL_CHARACTER_RE, " ").replace(/\s+/g, " ").trim();
 }
 //#endregion
 //#region extensions/codex/src/app-server/approval-bridge.ts
@@ -2760,11 +3588,6 @@ const COMMAND_PREVIEW_WITH_DETAILS_MAX_LENGTH = 80;
 const APPROVAL_PREVIEW_SCAN_MAX_LENGTH = 4096;
 const APPROVAL_PREVIEW_OMITTED = "[preview truncated or unsafe content omitted]";
 const CONCRETE_TOOL_AUTO_APPROVAL_METHODS = /* @__PURE__ */ new Set(["item/commandExecution/requestApproval", "item/fileChange/requestApproval"]);
-const ANSI_OSC_SEQUENCE_RE = new RegExp(String.raw`(?:\u001b]|\u009d)[^\u001b\u009c\u0007]*(?:\u0007|\u001b\\|\u009c)`, "g");
-const ANSI_CONTROL_SEQUENCE_RE = new RegExp(String.raw`(?:\u001b\[[0-?]*[ -/]*[@-~]|\u009b[0-?]*[ -/]*[@-~]|\u001b[@-Z\\-_])`, "g");
-const CONTROL_CHARACTER_RE = new RegExp(String.raw`[\u0000-\u001f\u007f-\u009f]+`, "g");
-const INVISIBLE_FORMATTING_CONTROL_RE = new RegExp(String.raw`[\u00ad\u034f\u061c\u200b-\u200f\u202a-\u202e\u2060-\u206f\ufeff\ufe00-\ufe0f\u{e0100}-\u{e01ef}]`, "gu");
-const DANGLING_TERMINAL_SEQUENCE_SUFFIX_RE = new RegExp(String.raw`(?:\u001b\][^\u001b\u009c\u0007]*|\u009d[^\u001b\u009c\u0007]*|\u001b\[[0-?]*[ -/]*|\u009b[0-?]*[ -/]*|\u001b)$`);
 /**
 * Handles one app-server approval request for the active thread/turn, returning
 * the app-server response payload when the request belongs to this run.
@@ -2777,6 +3600,18 @@ async function handleCodexAppServerApprovalRequest(params) {
 		requestParams,
 		paramsForRun: params.paramsForRun
 	});
+	const resolvePolicyApproval = (outcome, message = approvalResolutionMessage(outcome)) => {
+		emitApprovalEvent(params.paramsForRun, {
+			phase: "resolved",
+			kind: context.kind,
+			status: outcome === "denied" ? "denied" : "approved",
+			title: context.title,
+			...context.eventDetails,
+			...approvalEventScope(params.method, outcome),
+			message
+		});
+		return buildApprovalResponse(params.method, context.requestParams, outcome);
+	};
 	try {
 		const policyOutcome = await runOpenClawToolPolicyForApprovalRequest({
 			method: params.method,
@@ -2789,56 +3624,14 @@ async function handleCodexAppServerApprovalRequest(params) {
 		});
 		if (policyOutcome?.outcome === "denied") {
 			recordNativeToolFailureDisposition(params, context, policyOutcome.failureDisposition);
-			emitApprovalEvent(params.paramsForRun, {
-				phase: "resolved",
-				kind: context.kind,
-				status: "denied",
-				title: context.title,
-				...context.eventDetails,
-				...approvalEventScope(params.method, "denied"),
-				message: policyOutcome.reason
-			});
-			return buildApprovalResponse(params.method, context.requestParams, "denied");
-		}
-		if (policyOutcome?.outcome === "approved-once" || policyOutcome?.outcome === "approved-session") {
-			emitApprovalEvent(params.paramsForRun, {
-				phase: "resolved",
-				kind: context.kind,
-				status: "approved",
-				title: context.title,
-				...context.eventDetails,
-				...approvalEventScope(params.method, policyOutcome.outcome),
-				message: approvalResolutionMessage(policyOutcome.outcome)
-			});
-			return buildApprovalResponse(params.method, context.requestParams, policyOutcome.outcome);
+			return resolvePolicyApproval("denied", policyOutcome.reason);
 		}
+		if (policyOutcome?.outcome === "approved-once" || policyOutcome?.outcome === "approved-session") return resolvePolicyApproval(policyOutcome.outcome);
 		const canAutoApproveConcreteToolCall = CONCRETE_TOOL_AUTO_APPROVAL_METHODS.has(params.method);
-		if (canAutoApproveConcreteToolCall && params.autoApproveOpenClawToolPolicy === true && policyOutcome?.outcome === "allowed") {
-			emitApprovalEvent(params.paramsForRun, {
-				phase: "resolved",
-				kind: context.kind,
-				status: "approved",
-				title: context.title,
-				...context.eventDetails,
-				...approvalEventScope(params.method, "approved-once"),
-				message: "Codex app-server approval accepted by OpenClaw tool policy."
-			});
-			return buildApprovalResponse(params.method, context.requestParams, "approved-once");
-		}
-		if (canAutoApproveConcreteToolCall && params.autoApprove === true) {
-			emitApprovalEvent(params.paramsForRun, {
-				phase: "resolved",
-				kind: context.kind,
-				status: "approved",
-				title: context.title,
-				...context.eventDetails,
-				...approvalEventScope(params.method, "approved-session"),
-				message: "Codex app-server approval auto-approved by runtime policy."
-			});
-			return buildApprovalResponse(params.method, context.requestParams, "approved-session");
-		}
+		if (canAutoApproveConcreteToolCall && params.autoApproveOpenClawToolPolicy === true && policyOutcome?.outcome === "allowed") return resolvePolicyApproval("approved-once", "Codex app-server approval accepted by OpenClaw tool policy.");
+		if (canAutoApproveConcreteToolCall && params.autoApprove === true) return resolvePolicyApproval("approved-session", "Codex app-server approval auto-approved by runtime policy.");
 		const requestResult = await requestPluginApproval({
-			paramsForRun: params.paramsForRun,
+			hostCapabilities: params.paramsForRun.hostCapabilities,
 			title: context.title,
 			description: context.description,
 			severity: context.severity,
@@ -2872,7 +3665,8 @@ async function handleCodexAppServerApprovalRequest(params) {
 		const requestUnavailable = approvalRequestExplicitlyUnavailable(requestResult);
 		const decision = requestUnavailable ? null : await waitForPluginApprovalDecision({
 			approvalId,
-			signal: params.signal
+			signal: params.signal,
+			hostCapabilities: params.paramsForRun.hostCapabilities
 		});
 		const approvalExpired = !requestUnavailable && decision === null;
 		const outcome = params.signal?.aborted ? "cancelled" : mapExecDecisionToOutcome(decision);
@@ -2900,7 +3694,7 @@ async function handleCodexAppServerApprovalRequest(params) {
 			title: context.title,
 			...context.eventDetails,
 			...approvalEventScope(params.method, cancelled ? "cancelled" : "denied"),
-			message: cancelled ? "Codex app-server approval cancelled because the run stopped." : `Codex app-server approval route failed: ${formatCodexDisplayText(formatErrorMessage$1(error))}`
+			message: cancelled ? "Codex app-server approval cancelled because the run stopped." : `Codex app-server approval route failed: ${formatCodexDisplayText(coerceErrorMessage(error))}`
 		});
 		return buildApprovalResponse(params.method, context.requestParams, cancelled ? "cancelled" : "denied");
 	}
@@ -2929,13 +3723,13 @@ function buildApprovalResponse(method, requestParams, outcome) {
 }
 function matchesCurrentTurn(requestParams, threadId, turnId) {
 	if (!requestParams) return false;
-	const requestThreadId = readString(requestParams, "threadId");
-	const requestTurnId = readString(requestParams, "turnId");
+	const requestThreadId = readStringField(requestParams, "threadId");
+	const requestTurnId = readStringField(requestParams, "turnId");
 	return requestThreadId === threadId && requestTurnId === turnId;
 }
 function buildApprovalContext(params) {
-	const itemId = readString(params.requestParams, "itemId") ?? readString(params.requestParams, "callId") ?? readString(params.requestParams, "approvalId");
-	const approvalId = readString(params.requestParams, "approvalId") ?? itemId;
+	const itemId = readStringField(params.requestParams, "itemId") ?? readStringField(params.requestParams, "callId") ?? readStringField(params.requestParams, "approvalId");
+	const approvalId = readStringField(params.requestParams, "approvalId") ?? itemId;
 	const commandDetailLines = params.method === "item/commandExecution/requestApproval" ? describeCommandApprovalDetails(params.requestParams) : [];
 	const commandPreview = sanitizeApprovalPreview(readDisplayCommandPreview(params.requestParams), commandDetailLines.length > 0 ? COMMAND_PREVIEW_WITH_DETAILS_MAX_LENGTH : 180);
 	const reasonPreview = sanitizeApprovalPreview(readStringPreview(params.requestParams, "reason"), 180);
@@ -2970,7 +3764,7 @@ function buildApprovalContext(params) {
 async function runOpenClawToolPolicyForApprovalRequest(params) {
 	const policyRequest = buildOpenClawToolPolicyRequest(params.method, params.requestParams);
 	if (!policyRequest) return;
-	const cwd = readString(params.requestParams, "cwd") ?? params.paramsForRun.workspaceDir;
+	const cwd = readStringField(params.requestParams, "cwd") ?? params.paramsForRun.workspaceDir;
 	const nativeRelayOutcome = await runNativeRelayToolPolicyForApprovalRequest({
 		method: params.method,
 		requestParams: params.requestParams,
@@ -2978,6 +3772,7 @@ async function runOpenClawToolPolicyForApprovalRequest(params) {
 		policyRequest,
 		nativeHookRelay: params.nativeHookRelay,
 		autoApprove: params.autoApprove,
+		assertActive: params.paramsForRun.hostCapabilities.assertActive,
 		cwd,
 		signal: params.signal
 	});
@@ -2988,37 +3783,12 @@ async function runOpenClawToolPolicyForApprovalRequest(params) {
 	};
 	if (nativeRelayOutcome?.outcome === "approved-once" || nativeRelayOutcome?.outcome === "approved-session") return { outcome: nativeRelayOutcome.outcome };
 	if (nativeRelayOutcome?.handled) return { outcome: "allowed" };
-	const hookChannelId = buildAgentHookContextChannelFields({
-		sessionKey: params.paramsForRun.sessionKey,
-		messageChannel: params.paramsForRun.messageChannel,
-		messageProvider: params.paramsForRun.messageProvider,
-		currentChannelId: params.paramsForRun.currentChannelId,
-		messageTo: params.paramsForRun.messageTo
-	}).channelId;
-	const requester = buildCodexHookRequester(params.paramsForRun);
-	const outcome = await runBeforeToolCallHook({
+	const outcome = await params.paramsForRun.hostCapabilities.runBeforeToolCall({
 		toolName: policyRequest.toolName,
 		params: policyRequest.params,
+		...cwd ? { nativeOperation: { cwd } } : {},
 		...params.context.approvalId ? { toolCallId: params.context.approvalId } : {},
-		approvalMode: "request",
-		signal: params.signal,
-		ctx: {
-			...params.paramsForRun.agentId ? { agentId: params.paramsForRun.agentId } : {},
-			...params.paramsForRun.config ? { config: params.paramsForRun.config } : {},
-			...cwd ? { cwd } : {},
-			workspaceDir: params.paramsForRun.workspaceDir,
-			...params.paramsForRun.sessionKey ? { sessionKey: params.paramsForRun.sessionKey } : {},
-			...params.paramsForRun.sessionId ? { sessionId: params.paramsForRun.sessionId } : {},
-			...params.paramsForRun.runId ? { runId: params.paramsForRun.runId } : {},
-			...hookChannelId ? { channelId: hookChannelId } : {},
-			...requester ? { requester } : {},
-			trigger: params.paramsForRun.trigger,
-			approvalReviewerDeviceId: params.paramsForRun.approvalReviewerDeviceId,
-			turnSourceChannel: params.paramsForRun.messageChannel ?? params.paramsForRun.messageProvider,
-			turnSourceTo: params.paramsForRun.currentMessagingTarget ?? params.paramsForRun.currentChannelId,
-			turnSourceAccountId: params.paramsForRun.agentAccountId,
-			turnSourceThreadId: params.paramsForRun.currentThreadTs
-		}
+		signal: params.signal
 	});
 	if (outcome.blocked) return {
 		outcome: "denied",
@@ -3033,7 +3803,8 @@ async function runOpenClawToolPolicyForApprovalRequest(params) {
 	return { outcome: "allowed" };
 }
 async function runNativeRelayToolPolicyForApprovalRequest(params) {
-	if (params.method !== "item/commandExecution/requestApproval" || !params.nativeHookRelay?.allowedEvents.includes("pre_tool_use")) return;
+	const nativeHookRelay = params.nativeHookRelay;
+	if (params.method !== "item/commandExecution/requestApproval" || !nativeHookRelay?.allowedEvents.includes("pre_tool_use")) return;
 	const payload = buildNativeRelayPreToolUsePayload({
 		requestParams: params.requestParams,
 		policyRequest: params.policyRequest,
@@ -3041,33 +3812,34 @@ async function runNativeRelayToolPolicyForApprovalRequest(params) {
 		cwd: params.cwd
 	});
 	if (!payload) return;
-	if (hasNativeHookRelayInvocation({
-		relayId: params.nativeHookRelay.relayId,
-		event: "pre_tool_use",
-		toolUseId: params.context.approvalId
-	})) {
+	const resolveDeferredApproval = async () => {
 		const approvalOutcome = await resolveNativeHookRelayDeferredToolApproval({
-			relayId: params.nativeHookRelay.relayId,
+			relayId: nativeHookRelay.relayId,
 			toolUseId: params.context.approvalId,
 			signal: params.signal
 		});
+		params.assertActive();
 		if (approvalOutcome?.outcome === "denied") return {
 			handled: true,
 			blocked: true,
 			reason: approvalOutcome.reason,
 			...approvalOutcome.failureDisposition ? { failureDisposition: approvalOutcome.failureDisposition } : {}
 		};
-		if (approvalOutcome?.outcome === "approved-once") return {
+		return approvalOutcome?.outcome === "approved-once" ? {
 			handled: true,
 			outcome: approvalOutcome.outcome
-		};
-		return { handled: true };
-	}
+		} : { handled: true };
+	};
+	if (hasNativeHookRelayInvocation({
+		relayId: nativeHookRelay.relayId,
+		event: "pre_tool_use",
+		toolUseId: params.context.approvalId
+	})) return resolveDeferredApproval();
 	try {
 		const decision = readNativeRelayPreToolUseDecision(await invokeNativeHookRelay({
 			provider: "codex",
-			relayId: params.nativeHookRelay.relayId,
-			generation: params.nativeHookRelay.generation,
+			relayId: nativeHookRelay.relayId,
+			generation: nativeHookRelay.generation,
 			event: "pre_tool_use",
 			rawPayload: payload,
 			requireGeneration: true
@@ -3078,40 +3850,25 @@ async function runNativeRelayToolPolicyForApprovalRequest(params) {
 			reason: decision.reason,
 			...decision.failureDisposition ? { failureDisposition: decision.failureDisposition } : {}
 		};
-		const approvalOutcome = await resolveNativeHookRelayDeferredToolApproval({
-			relayId: params.nativeHookRelay.relayId,
-			toolUseId: params.context.approvalId,
-			signal: params.signal
-		});
-		if (approvalOutcome?.outcome === "denied") return {
-			handled: true,
-			blocked: true,
-			reason: approvalOutcome.reason,
-			...approvalOutcome.failureDisposition ? { failureDisposition: approvalOutcome.failureDisposition } : {}
-		};
-		if (approvalOutcome?.outcome === "approved-once") return {
-			handled: true,
-			outcome: approvalOutcome.outcome
-		};
-		return { handled: true };
+		return await resolveDeferredApproval();
 	} catch (error) {
 		if (params.autoApprove === true && !hasNativeHookRelayInvocation({
-			relayId: params.nativeHookRelay.relayId,
+			relayId: nativeHookRelay.relayId,
 			event: "pre_tool_use",
 			toolUseId: params.context.approvalId
 		})) return;
 		return {
 			handled: true,
 			blocked: true,
-			reason: `OpenClaw native hook relay unavailable for Codex app-server approval: ${formatCodexDisplayText(formatErrorMessage$1(error))}`,
+			reason: `OpenClaw native hook relay unavailable for Codex app-server approval: ${formatCodexDisplayText(coerceErrorMessage(error))}`,
 			failureDisposition: "failed"
 		};
 	}
 }
 function buildNativeRelayPreToolUsePayload(params) {
-	const command = readString(params.policyRequest.params, "command");
+	const command = readStringField(params.policyRequest.params, "command");
 	if (!command) return;
-	const turnId = readString(params.requestParams, "turnId");
+	const turnId = readStringField(params.requestParams, "turnId");
 	return {
 		hook_event_name: "PreToolUse",
 		openclaw_approval_mode: "report",
@@ -3138,7 +3895,7 @@ function readNativeRelayPreToolUseDecision(response) {
 	const output = isJsonObject(parsed?.hookSpecificOutput) ? parsed.hookSpecificOutput : void 0;
 	if (output?.permissionDecision === "deny") return {
 		blocked: true,
-		reason: readString(output, "permissionDecisionReason") || "OpenClaw native hook policy denied Codex app-server approval.",
+		reason: readStringField(output, "permissionDecisionReason") || "OpenClaw native hook policy denied Codex app-server approval.",
 		...response.failureDisposition ? { failureDisposition: response.failureDisposition } : {}
 	};
 	return {
@@ -3168,7 +3925,7 @@ function buildOpenClawToolPolicyRequest(method, requestParams) {
 			toolName: "exec",
 			params: {
 				...command ? { command } : {},
-				...readString(requestParams, "cwd") ? { cwd: readString(requestParams, "cwd") } : {},
+				...readStringField(requestParams, "cwd") ? { cwd: readStringField(requestParams, "cwd") } : {},
 				approval: requestParams ?? {}
 			}
 		};
@@ -3194,7 +3951,7 @@ function stableJsonText(value) {
 		const items = value.map((item) => stableJsonText(item));
 		return items.every((item) => item !== void 0) ? `[${items.join(",")}]` : void 0;
 	}
-	if (isPlainRecord(value)) {
+	if (isJsonObject(value)) {
 		const entries = Object.entries(value).toSorted(([left], [right]) => left.localeCompare(right)).map(([key, item]) => {
 			const text = stableJsonText(item);
 			return text === void 0 ? void 0 : `${JSON.stringify(key)}:${text}`;
@@ -3202,9 +3959,6 @@ function stableJsonText(value) {
 		return entries.every((entry) => entry !== void 0) ? `{${entries.join(",")}}` : void 0;
 	}
 }
-function isPlainRecord(value) {
-	return Boolean(value && typeof value === "object" && !Array.isArray(value));
-}
 function commandApprovalDecision(requestParams, outcome) {
 	if (outcome === "cancelled") return commandRejectionDecision(requestParams, "cancel");
 	if (outcome === "denied" || outcome === "unavailable") return commandRejectionDecision(requestParams, "decline");
@@ -3330,15 +4084,10 @@ function summarizeFileSystemEntries(permission, risks) {
 	return `entries: ${samples.join(", ")}${remainderSuffix}`;
 }
 function summarizePermissionRecord(permission, risks, descriptors) {
-	const details = [];
-	for (const descriptor of descriptors) {
-		const summary = summarizePermissionArray(permission, descriptor, risks);
-		if (summary) details.push(summary);
-	}
-	return details.length > 0 ? details.join("; ") : void 0;
+	return descriptors.map((descriptor) => summarizePermissionArray(permission, descriptor, risks)).filter(Boolean).join("; ") || void 0;
 }
 function summarizePermissionArray(record, descriptor, risks) {
-	const values = readStringArray(record, descriptor.key);
+	const values = normalizeTrimmedStringList(record[descriptor.key]);
 	if (values.length === 0) return;
 	for (const value of values) for (const risk of descriptor.risksFor(value)) risks.add(risk);
 	const sampleValues = values.slice(0, PERMISSION_SAMPLE_LIMIT).map(descriptor.sanitize).filter(Boolean);
@@ -3373,178 +4122,797 @@ function summarizeNetworkPolicyAmendments(value) {
 	const remainderSuffix = remaining > 0 ? ` (+${remaining} more)` : "";
 	return `Proposed network policy: ${samples.join(", ")}${remainderSuffix}`;
 }
-function readStringArray(record, key) {
-	return normalizeTrimmedStringList(record[key]);
-}
 function sanitizePermissionHostValue(value) {
 	const withoutScheme = sanitizePermissionScalar(value).toLowerCase().replace(/^[a-z][a-z0-9+.-]*:\/\//, "");
 	const authority = withoutScheme.split(/[/?#]/, 1)[0] ?? withoutScheme;
-	return truncate(authority.includes("@") ? authority.slice(authority.lastIndexOf("@") + 1) : authority, PERMISSION_VALUE_MAX_LENGTH);
+	return truncateCodexApprovalDisplayText(authority.includes("@") ? authority.slice(authority.lastIndexOf("@") + 1) : authority, PERMISSION_VALUE_MAX_LENGTH);
 }
 function sanitizePermissionPathValue(value) {
-	return truncate(formatApprovalDisplayPath(sanitizePermissionScalar(value)), PERMISSION_VALUE_MAX_LENGTH);
+	return truncateCodexApprovalDisplayText(formatApprovalDisplayPath(sanitizePermissionScalar(value)), PERMISSION_VALUE_MAX_LENGTH);
 }
 function sanitizePermissionScalar(value) {
-	return sanitizeVisibleScalar(value);
+	return sanitizeCodexApprovalVisibleText(value);
+}
+function permissionHostRisks(value) {
+	const normalized = value.trim().toLowerCase();
+	const risks = [];
+	if (normalized.includes("*")) {
+		risks.push("wildcard hosts");
+		if (isPrivateNetworkHostPattern(normalized)) risks.push("private-network wildcards");
+	}
+	return risks;
+}
+function permissionPathRisks(value) {
+	const normalized = sanitizePermissionScalar(value);
+	const risks = [];
+	if (normalized === "/" || normalized === "\\" || /^[A-Za-z]:[\\/]*$/.test(normalized)) risks.push("filesystem root");
+	return risks;
+}
+function isPrivateNetworkHostPattern(value) {
+	const wildcardStripped = value.toLowerCase().replace(/^\*\./, "");
+	if (wildcardStripped === "localhost" || wildcardStripped === "local" || wildcardStripped === "internal" || wildcardStripped === "lan" || wildcardStripped === "home" || wildcardStripped === "corp" || wildcardStripped === "private" || wildcardStripped.endsWith(".local") || wildcardStripped.endsWith(".internal") || wildcardStripped.endsWith(".lan") || wildcardStripped.endsWith(".home") || wildcardStripped.endsWith(".corp") || wildcardStripped.endsWith(".private")) return true;
+	if (wildcardStripped.startsWith("10.") || wildcardStripped.startsWith("127.") || wildcardStripped.startsWith("192.168.") || wildcardStripped.startsWith("169.254.")) return true;
+	return /^172\.(1[6-9]|2\d|3[0-1])\./.test(wildcardStripped);
+}
+function hasAvailableDecision(requestParams, decision) {
+	const available = requestParams?.availableDecisions;
+	if (!Array.isArray(available)) return true;
+	return available.includes(decision);
+}
+function findAvailableCommandAmendmentDecision(requestParams) {
+	const available = requestParams?.availableDecisions;
+	if (!Array.isArray(available)) return;
+	return available.find((entry) => isJsonObject(entry) && (isJsonObject(entry.acceptWithExecpolicyAmendment) || isJsonObject(entry.applyNetworkPolicyAmendment)));
+}
+function commandRejectionDecision(requestParams, preferred) {
+	const available = requestParams?.availableDecisions;
+	if (!Array.isArray(available)) return preferred;
+	if (available.includes(preferred)) return preferred;
+	const alternate = preferred === "decline" ? "cancel" : "decline";
+	if (available.includes(alternate)) return alternate;
+	return preferred;
+}
+function approvalResolutionMessage(outcome) {
+	if (outcome === "approved-session") return "Codex app-server approval granted for the session.";
+	if (outcome === "approved-once") return "Codex app-server approval granted for this turn.";
+	if (outcome === "cancelled") return "Codex app-server approval cancelled.";
+	if (outcome === "unavailable") return "Codex app-server approval unavailable.";
+	return "Codex app-server approval denied.";
+}
+function approvalEventScope(method, outcome) {
+	return method === "item/permissions/requestApproval" ? { scope: outcome === "approved-session" ? "session" : "turn" } : {};
+}
+function approvalKindForMethod(method) {
+	if (method.includes("commandExecution") || method.includes("execCommand")) return "exec";
+	if (method.includes("fileChange") || method.includes("Patch") || method.includes("permissions")) return "plugin";
+	return "unknown";
+}
+function emitApprovalEvent(params, data) {
+	params.onAgentEvent?.({
+		stream: "approval",
+		data
+	});
+}
+function readDisplayCommandPreview(record) {
+	const actionCommand = readCommandActionsPreview(record);
+	if (actionCommand) return actionCommand;
+	return readCommandPreview(record);
+}
+function readPolicyCommand(record) {
+	const command = record?.command;
+	if (typeof command === "string") return command;
+	if (Array.isArray(command) && command.every((part) => typeof part === "string")) return command.join(" ");
+	const actionCommands = readCommandActions(record);
+	if (actionCommands.length > 0) return actionCommands.join(" && ");
+}
+function readCommandActions(record) {
+	const actions = record?.commandActions;
+	if (!Array.isArray(actions)) return [];
+	return actions.map((action) => isJsonObject(action) ? readStringField(action, "command") : void 0).filter((command) => Boolean(command));
+}
+function readCommandActionsPreview(record) {
+	let source;
+	for (const command of readCommandActions(record)) {
+		source = appendPreviewPart(source, command, " && ");
+		if (source.clipped) break;
+	}
+	return source;
+}
+function readCommandPreview(record) {
+	const command = record?.command;
+	if (typeof command === "string") return previewSource(command);
+	if (!Array.isArray(command)) return;
+	let source;
+	for (const part of command) {
+		if (typeof part !== "string") return;
+		source = appendPreviewPart(source, part, " ");
+		if (source.clipped) break;
+	}
+	return source;
+}
+function readStringPreview(record, key) {
+	const value = readStringField(record, key);
+	return value === void 0 ? void 0 : previewSource(value);
+}
+function previewSource(value) {
+	return {
+		value: sliceUtf16Safe(value, 0, APPROVAL_PREVIEW_SCAN_MAX_LENGTH),
+		clipped: value.length > APPROVAL_PREVIEW_SCAN_MAX_LENGTH
+	};
+}
+function appendPreviewPart(source, part, separator) {
+	const value = `${source?.value ? `${source.value}${separator}` : ""}${part}`;
+	const clipped = source?.clipped === true || value.length > APPROVAL_PREVIEW_SCAN_MAX_LENGTH;
+	return {
+		value: sliceUtf16Safe(value, 0, APPROVAL_PREVIEW_SCAN_MAX_LENGTH),
+		clipped
+	};
+}
+function sanitizeApprovalPreview(source, maxLength) {
+	if (!source || !source.value) return { omitted: false };
+	const sanitized = sanitizeCodexApprovalVisibleText(stripDanglingCodexApprovalTerminalSequence(source.value));
+	if (!sanitized) return { omitted: true };
+	return {
+		text: formatCodexDisplayText(truncateCodexApprovalDisplayText(sanitized, maxLength)),
+		omitted: source.clipped
+	};
+}
+function formatApprovalPreviewSubject(text, omitted) {
+	return omitted ? `${text} ${APPROVAL_PREVIEW_OMITTED}` : text;
+}
+function joinDescriptionLinesWithinLimit(lines, maxLength) {
+	let description = "";
+	for (const line of lines) {
+		const prefix = description ? "\n" : "";
+		const next = `${description}${prefix}${line}`;
+		if (next.length <= maxLength) {
+			description = next;
+			continue;
+		}
+		const remaining = maxLength - description.length - prefix.length;
+		if (remaining < 3) break;
+		description += `${prefix}${truncateCodexApprovalDisplayText(line, remaining)}`;
+		break;
+	}
+	return description;
+}
+//#endregion
+//#region extensions/codex/src/app-server/dynamic-tool-diagnostics.ts
+/**
+* Trusted diagnostics emitted around Codex dynamic tool execution lifecycle.
+*/
+/** Emits a start event for one Codex dynamic tool call. */
+function emitDynamicToolStartedDiagnostic(params) {
+	emitTrustedDiagnosticEvent({
+		type: "tool.execution.started",
+		agentId: params.agentId,
+		runId: params.runId,
+		sessionId: params.sessionId,
+		sessionKey: params.sessionKey,
+		toolName: params.call.tool,
+		toolCallId: params.call.callId
+	});
+}
+/** Emits an error event for one Codex dynamic tool call. */
+function emitDynamicToolErrorDiagnostic(params) {
+	emitTrustedDiagnosticEvent({
+		type: "tool.execution.error",
+		agentId: params.agentId,
+		runId: params.runId,
+		sessionId: params.sessionId,
+		sessionKey: params.sessionKey,
+		toolName: params.call.tool,
+		toolCallId: params.call.callId,
+		durationMs: params.durationMs,
+		errorCategory: "codex_dynamic_tool_error",
+		terminalReason: params.terminalReason ?? "failed"
+	});
+}
+/** Emits the terminal event matching a dynamic tool response's diagnostic type. */
+function emitDynamicToolTerminalDiagnostic(params) {
+	const terminalType = params.response.diagnosticTerminalType ?? (params.response.success ? "completed" : "error");
+	if (terminalType === "completed") {
+		emitTrustedDiagnosticEvent({
+			type: "tool.execution.completed",
+			agentId: params.agentId,
+			runId: params.runId,
+			sessionId: params.sessionId,
+			sessionKey: params.sessionKey,
+			toolName: params.call.tool,
+			toolCallId: params.call.callId,
+			durationMs: params.durationMs
+		});
+		return;
+	}
+	if (terminalType === "blocked") {
+		emitTrustedDiagnosticEvent({
+			type: "tool.execution.blocked",
+			agentId: params.agentId,
+			runId: params.runId,
+			sessionId: params.sessionId,
+			sessionKey: params.sessionKey,
+			toolName: params.call.tool,
+			toolCallId: params.call.callId,
+			deniedReason: "plugin-before-tool-call",
+			reason: "Tool call blocked"
+		});
+		return;
+	}
+	emitDynamicToolErrorDiagnostic({
+		...params,
+		terminalReason: params.response.diagnosticTerminalReason ?? "failed"
+	});
+}
+//#endregion
+//#region extensions/codex/src/app-server/elicitation-bridge.ts
+const MCP_TOOL_APPROVAL_KIND = "mcp_tool_call";
+const MCP_TOOL_APPROVAL_KIND_KEY = "codex_approval_kind";
+const MCP_TOOL_APPROVAL_CONNECTOR_NAME_KEY = "connector_name";
+const MCP_TOOL_APPROVAL_TOOL_TITLE_KEY = "tool_title";
+const MCP_TOOL_APPROVAL_TOOL_DESCRIPTION_KEY = "tool_description";
+const MCP_TOOL_APPROVAL_TOOL_PARAMS_DISPLAY_KEY = "tool_params_display";
+const MCP_TOOL_APPROVAL_SOURCE_KEY = "source";
+const MCP_TOOL_APPROVAL_CONNECTOR_SOURCE = "connector";
+const CODEX_APPS_SERVER_NAME = "codex_apps";
+const COMPUTER_USE_APPROVAL_TITLE = "Computer Use approval";
+const EMPTY_OBJECT_SCHEMA = {
+	type: "object",
+	properties: {}
+};
+const PLUGIN_APP_ID_META_KEYS = [
+	"app_id",
+	"appId",
+	"codex_app_id",
+	"codexAppId"
+];
+const PLUGIN_CONNECTOR_ID_META_KEYS = ["connector_id", "connectorId"];
+const PLUGIN_NAME_META_KEYS = [
+	"plugin_name",
+	"pluginName",
+	"codex_plugin_name",
+	"codexPluginName"
+];
+const PLUGIN_CONFIG_KEY_META_KEYS = [
+	"config_key",
+	"configKey",
+	"codex_config_key"
+];
+const PLUGIN_MARKETPLACE_NAME_META_KEYS = [
+	"marketplace_name",
+	"marketplaceName",
+	"codex_marketplace_name",
+	"codexMarketplaceName"
+];
+const MAX_DISPLAY_PARAM_ENTRIES = 8;
+const MAX_DISPLAY_PARAM_VALUE_LENGTH = 120;
+const MAX_DISPLAY_VALUE_ARRAY_ITEMS = 8;
+const MAX_DISPLAY_VALUE_OBJECT_KEYS = 8;
+const MAX_DISPLAY_VALUE_DEPTH = 3;
+const DISPLAY_TEXT_SCAN_MAX_LENGTH = 4096;
+async function handleCodexAppServerElicitationRequest(params) {
+	const requestParams = isJsonObject(params.requestParams) ? params.requestParams : void 0;
+	if (!requestParams || readNonBlankStringField(requestParams, "threadId") !== params.threadId) return;
+	const requestTurnId = requestParams.turnId;
+	if (requestTurnId !== null && requestTurnId !== void 0 && requestTurnId !== params.turnId) return;
+	const pluginResolution = resolvePluginElicitation({
+		requestParams,
+		pluginAppPolicyContext: params.pluginAppPolicyContext
+	});
+	if (pluginResolution.kind !== "not_plugin") {
+		if (params.paramsForRun.trigger === "cron" && params.paramsForRun.scheduledRuntimeAuthority) {
+			logPluginElicitationDecline("scheduled_authority_non_interactive", requestParams);
+			return declineElicitationResponse();
+		}
+		if (pluginResolution.kind === "decline") {
+			logPluginElicitationDecline(pluginResolution.reason, requestParams);
+			return declineElicitationResponse();
+		}
+		if (requestTurnId !== params.turnId) {
+			logPluginElicitationDecline("missing_active_turn", requestParams);
+			return declineElicitationResponse();
+		}
+		return await buildPluginPolicyElicitationResponse({
+			entry: pluginResolution.entry,
+			requestParams,
+			paramsForRun: params.paramsForRun,
+			signal: params.signal
+		});
+	}
+	const approvalPrompt = readComputerUseApprovalElicitation(requestParams, params.computerUseMcpServerName) ?? readBridgeableApprovalElicitation(requestParams);
+	if (!approvalPrompt) return;
+	return buildElicitationResponse(approvalPrompt, await requestPluginApprovalOutcome({
+		paramsForRun: params.paramsForRun,
+		title: approvalPrompt.title,
+		description: approvalPrompt.description,
+		allowedDecisions: approvalPrompt.allowedDecisions,
+		signal: params.signal
+	}));
+}
+function resolvePluginElicitation(params) {
+	const requestParams = params.requestParams;
+	const meta = isJsonObject(requestParams["_meta"]) ? requestParams["_meta"] : {};
+	const context = params.pluginAppPolicyContext;
+	const entries = context ? Object.values(context.apps) : [];
+	const pluginEntries = entries.filter(isPluginAppPolicyContextEntry);
+	const appId = readFirstString$1(meta, PLUGIN_APP_ID_META_KEYS) ?? readFirstString$1(requestParams, PLUGIN_APP_ID_META_KEYS);
+	const connectorId = readFirstString$1(meta, PLUGIN_CONNECTOR_ID_META_KEYS);
+	const isCodexConnectorApproval = isCodexConnectorApprovalElicitation(requestParams, meta);
+	if (isCodexConnectorApproval && appId && connectorId && appId !== connectorId) return {
+		kind: "decline",
+		reason: "app_id_connector_id_mismatch"
+	};
+	if (appId) {
+		if (!context) return {
+			kind: "decline",
+			reason: "missing_policy_context"
+		};
+		const entry = context.apps[appId];
+		if (entry?.source === "account" && !isCodexConnectorApproval) return {
+			kind: "decline",
+			reason: "account_app_source_mismatch"
+		};
+		return uniquePluginMatch(entry ? [entry] : [], "app_id");
+	}
+	if (isCodexConnectorApproval && connectorId) {
+		if (!context) return {
+			kind: "decline",
+			reason: "missing_policy_context"
+		};
+		const entry = context.apps[connectorId];
+		return uniquePluginMatch(entry ? [entry] : [], "connector_id");
+	}
+	const serverName = readNonBlankStringField(requestParams, "serverName");
+	if (serverName && context) {
+		const matches = entries.filter((entry) => entry.mcpServerNames.includes(serverName));
+		if (matches.length > 0) return uniquePluginMatch(matches, "server_name");
+	}
+	const metadataResolution = resolvePluginStableMetadataMatch({
+		meta,
+		requestParams,
+		entries: pluginEntries,
+		context
+	});
+	if (metadataResolution.kind !== "not_plugin") return metadataResolution;
+	if (context && hasDisplayNameOnlyPluginMatch(meta, entries)) return {
+		kind: "decline",
+		reason: "display_name_only"
+	};
+	return { kind: "not_plugin" };
+}
+function isCodexConnectorApprovalElicitation(requestParams, meta) {
+	return readNonBlankStringField(requestParams, "serverName") === CODEX_APPS_SERVER_NAME && readNonBlankStringField(meta, MCP_TOOL_APPROVAL_KIND_KEY) === MCP_TOOL_APPROVAL_KIND && readNonBlankStringField(meta, MCP_TOOL_APPROVAL_SOURCE_KEY) === MCP_TOOL_APPROVAL_CONNECTOR_SOURCE;
+}
+function resolvePluginStableMetadataMatch(params) {
+	const pluginName = readFirstString$1(params.meta, PLUGIN_NAME_META_KEYS) ?? readFirstString$1(params.requestParams, PLUGIN_NAME_META_KEYS);
+	const configKey = readFirstString$1(params.meta, PLUGIN_CONFIG_KEY_META_KEYS) ?? readFirstString$1(params.requestParams, PLUGIN_CONFIG_KEY_META_KEYS);
+	const marketplaceName = readFirstString$1(params.meta, PLUGIN_MARKETPLACE_NAME_META_KEYS) ?? readFirstString$1(params.requestParams, PLUGIN_MARKETPLACE_NAME_META_KEYS);
+	if (!pluginName && !configKey) return { kind: "not_plugin" };
+	if (!params.context) return {
+		kind: "decline",
+		reason: "missing_policy_context"
+	};
+	return uniquePluginMatch(params.entries.filter((entry) => {
+		if (marketplaceName && entry.marketplaceName !== marketplaceName) return false;
+		if (pluginName && entry.pluginName !== pluginName) return false;
+		if (configKey && entry.configKey !== configKey) return false;
+		return true;
+	}), "metadata");
+}
+function uniquePluginMatch(matches, source) {
+	if (matches.length === 1 && matches[0]) return {
+		kind: "matched",
+		entry: matches[0]
+	};
+	return {
+		kind: "decline",
+		reason: matches.length === 0 ? `${source}_not_enabled` : `${source}_ambiguous`
+	};
+}
+function hasDisplayNameOnlyPluginMatch(meta, entries) {
+	const connectorName = readNonBlankStringField(meta, MCP_TOOL_APPROVAL_CONNECTOR_NAME_KEY);
+	if (!connectorName) return false;
+	const normalized = normalizePluginIdentityText(connectorName);
+	return entries.some((entry) => normalizePluginIdentityText(appPolicyDisplayName(entry)) === normalized || isPluginAppPolicyContextEntry(entry) && normalizePluginIdentityText(entry.configKey) === normalized);
+}
+function isPluginAppPolicyContextEntry(entry) {
+	return entry.source !== "account";
+}
+function appPolicyDisplayName(entry) {
+	return isPluginAppPolicyContextEntry(entry) ? entry.pluginName : entry.appName;
+}
+function normalizePluginIdentityText(value) {
+	return value.toLowerCase().replace(/[^a-z0-9]+/g, "");
+}
+async function buildPluginPolicyElicitationResponse(params) {
+	const mode = resolvePluginDestructiveApprovalMode(params.entry);
+	if (mode === "deny") {
+		logPluginElicitationDecline("destructive_actions_disabled", params.requestParams);
+		return declineElicitationResponse();
+	}
+	const approvalPrompt = readPluginApprovalElicitation(params.entry, params.requestParams);
+	if (!approvalPrompt) {
+		logPluginElicitationDecline("unsupported_schema", params.requestParams);
+		return declineElicitationResponse();
+	}
+	const response = buildElicitationResponse(approvalPrompt, "approved-once");
+	if (isJsonObject(response) && response.action === "accept") {
+		if (mode === "allow") return response;
+		return buildElicitationResponse(approvalPrompt, oneShotPluginPolicyApprovalOutcome(mode, await requestPluginApprovalOutcome({
+			paramsForRun: params.paramsForRun,
+			title: approvalPrompt.title,
+			description: approvalPrompt.description,
+			allowedDecisions: allowedPluginPolicyApprovalDecisions(mode, approvalPrompt),
+			signal: params.signal
+		})));
+	}
+	logPluginElicitationDecline("unmappable_schema", params.requestParams);
+	return declineElicitationResponse();
+}
+function resolvePluginDestructiveApprovalMode(entry) {
+	return entry.destructiveApprovalMode ?? (entry.allowDestructiveActions ? "allow" : "deny");
+}
+function allowedPluginPolicyApprovalDecisions(mode, approvalPrompt) {
+	const allowedDecisions = approvalPrompt.allowedDecisions ?? ["allow-once", "deny"];
+	if (mode !== "ask") return allowedDecisions;
+	return allowedDecisions.filter((decision) => decision !== "allow-always");
+}
+function oneShotPluginPolicyApprovalOutcome(mode, outcome) {
+	return mode === "ask" && outcome === "approved-session" ? "approved-once" : outcome;
+}
+function readPluginApprovalElicitation(entry, requestParams) {
+	if (readNonBlankStringField(requestParams, "mode") !== "form" || !isJsonObject(requestParams.requestedSchema)) return;
+	const requestedSchema = requestParams.requestedSchema;
+	if (readNonBlankStringField(requestedSchema, "type") !== "object" || !isJsonObject(requestedSchema.properties)) return;
+	const meta = isJsonObject(requestParams["_meta"]) ? requestParams["_meta"] : {};
+	const title = sanitizeDisplayText(readNonBlankStringField(requestParams, "message") ?? "") || "Codex plugin approval";
+	const descriptionMeta = { ...meta };
+	if (!readNonBlankStringField(descriptionMeta, MCP_TOOL_APPROVAL_CONNECTOR_NAME_KEY)) descriptionMeta[MCP_TOOL_APPROVAL_CONNECTOR_NAME_KEY] = appPolicyDisplayName(entry);
+	return {
+		title,
+		description: buildApprovalDescription({
+			title,
+			meta: descriptionMeta,
+			requestedSchema,
+			serverName: sanitizeOptionalDisplayText(readNonBlankStringField(requestParams, "serverName"))
+		}),
+		requestedSchema,
+		meta,
+		persistHintsMode: "explicit",
+		allowedDecisions: buildApprovalAllowedDecisions(requestedSchema, meta)
+	};
+}
+function buildApprovalAllowedDecisions(requestedSchema, meta) {
+	return canMapPersistentApproval(requestedSchema, meta) ? [
+		"allow-once",
+		"allow-always",
+		"deny"
+	] : ["allow-once", "deny"];
+}
+function canMapPersistentApproval(requestedSchema, meta) {
+	const persistHints = readPersistHints(meta, "explicit");
+	if (persistHints.length > 0) return persistHints.includes("always");
+	const properties = isJsonObject(requestedSchema.properties) ? requestedSchema.properties : {};
+	return Object.entries(properties).some(([name, value]) => {
+		const schema = isJsonObject(value) ? value : void 0;
+		if (!schema) return false;
+		return isPersistField({
+			name,
+			schema,
+			required: false
+		}) && chooseAlwaysPersistOptionValue(readEnumOptions(schema)) !== void 0;
+	});
+}
+function declineElicitationResponse() {
+	return {
+		action: "decline",
+		content: null,
+		_meta: null
+	};
+}
+function logPluginElicitationDecline(reason, requestParams) {
+	embeddedAgentLog.debug("codex plugin elicitation declined", {
+		reason,
+		serverName: readNonBlankStringField(requestParams, "serverName"),
+		mode: readNonBlankStringField(requestParams, "mode")
+	});
+}
+function readBridgeableApprovalElicitation(requestParams) {
+	if (!requestParams || readNonBlankStringField(requestParams, "mode") !== "form" || !isJsonObject(requestParams["_meta"]) || requestParams["_meta"][MCP_TOOL_APPROVAL_KIND_KEY] !== MCP_TOOL_APPROVAL_KIND || !isJsonObject(requestParams.requestedSchema)) return;
+	const requestedSchema = requestParams.requestedSchema;
+	if (readNonBlankStringField(requestedSchema, "type") !== "object" || !isJsonObject(requestedSchema.properties)) return;
+	const title = sanitizeDisplayText(readNonBlankStringField(requestParams, "message") ?? "") || "Codex MCP tool approval";
+	return {
+		title,
+		description: buildApprovalDescription({
+			title,
+			meta: requestParams["_meta"],
+			requestedSchema,
+			serverName: sanitizeOptionalDisplayText(readNonBlankStringField(requestParams, "serverName"))
+		}),
+		requestedSchema,
+		meta: requestParams["_meta"]
+	};
+}
+function readComputerUseApprovalElicitation(requestParams, expectedServerName) {
+	const serverName = readNonBlankStringField(requestParams, "serverName");
+	if (!serverName || !expectedServerName || serverName !== expectedServerName || readNonBlankStringField(requestParams, "mode") !== "form") return;
+	const requestedSchema = isJsonObject(requestParams?.requestedSchema) ? requestParams.requestedSchema : EMPTY_OBJECT_SCHEMA;
+	if (readNonBlankStringField(requestedSchema, "type") !== "object" || !isJsonObject(requestedSchema.properties)) return;
+	const meta = isJsonObject(requestParams?.["_meta"]) ? requestParams["_meta"] : {};
+	const title = sanitizeDisplayText(readNonBlankStringField(requestParams, "message") ?? "") || COMPUTER_USE_APPROVAL_TITLE;
+	return {
+		title,
+		description: buildApprovalDescription({
+			title,
+			meta,
+			requestedSchema,
+			serverName: sanitizeOptionalDisplayText(serverName)
+		}),
+		requestedSchema,
+		meta
+	};
+}
+function buildApprovalDescription(params) {
+	const connectorName = sanitizeOptionalDisplayText(readNonBlankStringField(params.meta, MCP_TOOL_APPROVAL_CONNECTOR_NAME_KEY));
+	const toolTitle = sanitizeOptionalDisplayText(readNonBlankStringField(params.meta, MCP_TOOL_APPROVAL_TOOL_TITLE_KEY));
+	const toolDescription = sanitizeOptionalDisplayText(readNonBlankStringField(params.meta, MCP_TOOL_APPROVAL_TOOL_DESCRIPTION_KEY));
+	const summaryLines = [
+		connectorName && `App: ${connectorName}`,
+		toolTitle && `Tool: ${toolTitle}`,
+		params.serverName && `MCP server: ${params.serverName}`,
+		toolDescription
+	].filter((line) => Boolean(line));
+	const paramLines = readDisplayParamLines(params.meta);
+	const propertyLines = readPropertyDescriptionLines(params.requestedSchema);
+	return [
+		params.title,
+		summaryLines.join("\n"),
+		paramLines.length > 0 ? ["Parameters:", ...paramLines].join("\n") : "",
+		propertyLines.length > 0 ? ["Fields:", ...propertyLines].join("\n") : ""
+	].filter(Boolean).join("\n\n");
+}
+function readPropertyDescriptionLines(requestedSchema) {
+	const properties = isJsonObject(requestedSchema.properties) ? requestedSchema.properties : {};
+	return Object.entries(properties).map(([name, value]) => {
+		const schema = isJsonObject(value) ? value : void 0;
+		if (!schema) return;
+		const propTitle = sanitizeDisplayText(readNonBlankStringField(schema, "title") ?? "") || sanitizeDisplayText(name) || "field";
+		const description = sanitizeOptionalDisplayText(readNonBlankStringField(schema, "description"));
+		return description ? `- ${propTitle}: ${description}` : `- ${propTitle}`;
+	}).filter((line) => Boolean(line));
+}
+function readDisplayParamLines(meta) {
+	const displayParams = meta[MCP_TOOL_APPROVAL_TOOL_PARAMS_DISPLAY_KEY];
+	if (!Array.isArray(displayParams)) return [];
+	const lines = displayParams.slice(0, MAX_DISPLAY_PARAM_ENTRIES).map((entry) => {
+		const param = isJsonObject(entry) ? entry : void 0;
+		if (!param) return;
+		const name = sanitizeOptionalDisplayText(readNonBlankStringField(param, "display_name")) ?? sanitizeOptionalDisplayText(readNonBlankStringField(param, "name"));
+		if (!name) return;
+		return `- ${name}: ${formatDisplayParamValue(param.value)}`;
+	}).filter((line) => Boolean(line));
+	const remaining = displayParams.length - MAX_DISPLAY_PARAM_ENTRIES;
+	return remaining > 0 ? [...lines, `- Additional parameters: ${remaining} more`] : lines;
+}
+function formatDisplayParamValue(value) {
+	return truncateCodexApprovalDisplayText(sanitizeDisplayText(typeof value === "string" ? value : formatDisplayJsonValue(value ?? null)), MAX_DISPLAY_PARAM_VALUE_LENGTH);
+}
+function formatDisplayJsonValue(value, depth = MAX_DISPLAY_VALUE_DEPTH) {
+	if (value === null) return "null";
+	if (typeof value === "string") return JSON.stringify(truncateCodexApprovalDisplayText(sanitizeDisplayText(value), 80));
+	if (typeof value === "number" || typeof value === "boolean") return String(value);
+	if (Array.isArray(value)) {
+		if (depth <= 0) return "[truncated]";
+		const parts = [];
+		const limit = Math.min(value.length, MAX_DISPLAY_VALUE_ARRAY_ITEMS);
+		for (let i = 0; i < limit; i += 1) parts.push(formatDisplayJsonValue(value[i] ?? null, depth - 1));
+		if (value.length > MAX_DISPLAY_VALUE_ARRAY_ITEMS) parts.push("...");
+		return `[${parts.join(",")}]`;
+	}
+	if (typeof value === "object") {
+		if (depth <= 0) return "{truncated}";
+		const parts = [];
+		let count = 0;
+		let truncated = false;
+		for (const key in value) {
+			if (!Object.hasOwn(value, key)) continue;
+			if (count >= MAX_DISPLAY_VALUE_OBJECT_KEYS) {
+				truncated = true;
+				break;
+			}
+			const safeKey = truncateCodexApprovalDisplayText(sanitizeDisplayText(key), 80);
+			parts.push(`${JSON.stringify(safeKey)}:${formatDisplayJsonValue(value[key] ?? null, depth - 1)}`);
+			count += 1;
+		}
+		if (truncated) parts.push("...");
+		return `{${parts.join(",")}}`;
+	}
+	return "null";
+}
+function sanitizeOptionalDisplayText(value) {
+	return (value === void 0 ? "" : sanitizeDisplayText(value)) || void 0;
+}
+function sanitizeDisplayText(value) {
+	const scanned = sliceUtf16Safe(value, 0, DISPLAY_TEXT_SCAN_MAX_LENGTH);
+	const clipped = value.length > DISPLAY_TEXT_SCAN_MAX_LENGTH;
+	const sanitized = sanitizeCodexApprovalVisibleText(scanned, { stripDanglingTerminalSequence: true });
+	const escaped = sanitized ? formatCodexDisplayText(sanitized) : "";
+	return clipped && escaped ? `${escaped}...` : escaped;
+}
+async function requestPluginApprovalOutcome(params) {
+	try {
+		const requestResult = await requestPluginApproval({
+			hostCapabilities: params.paramsForRun.hostCapabilities,
+			title: params.title,
+			description: params.description,
+			severity: "warning",
+			toolName: "codex_mcp_tool_approval",
+			allowedDecisions: params.allowedDecisions
+		});
+		const approvalId = requestResult?.id;
+		if (!approvalId) return "unavailable";
+		return mapExecDecisionToOutcome(approvalRequestExplicitlyUnavailable(requestResult) ? null : await waitForPluginApprovalDecision({
+			hostCapabilities: params.paramsForRun.hostCapabilities,
+			approvalId,
+			signal: params.signal
+		}));
+	} catch {
+		return params.signal?.aborted ? "cancelled" : "denied";
+	}
 }
-function permissionHostRisks(value) {
-	const normalized = value.trim().toLowerCase();
-	const risks = [];
-	if (normalized.includes("*")) {
-		risks.push("wildcard hosts");
-		if (isPrivateNetworkHostPattern(normalized)) risks.push("private-network wildcards");
+function buildElicitationResponse(approvalPrompt, outcome) {
+	const { requestedSchema, meta } = approvalPrompt;
+	if (outcome === "cancelled") return {
+		action: "cancel",
+		content: null,
+		_meta: null
+	};
+	if (outcome === "denied" || outcome === "unavailable") return {
+		action: "decline",
+		content: null,
+		_meta: null
+	};
+	const content = buildAcceptedContent(approvalPrompt, outcome);
+	if (!content && !hasNoSchemaProperties(requestedSchema)) {
+		embeddedAgentLog.warn("codex MCP approval elicitation approved without a mappable response", {
+			approvalKind: meta[MCP_TOOL_APPROVAL_KIND_KEY],
+			fields: Object.keys(requestedSchema.properties ?? {}),
+			outcome
+		});
+		return declineElicitationResponse();
 	}
-	return risks;
+	return {
+		action: "accept",
+		content: content ?? null,
+		_meta: buildAcceptedMeta(meta, outcome, approvalPrompt.persistHintsMode ?? "legacy")
+	};
 }
-function permissionPathRisks(value) {
-	const normalized = sanitizePermissionScalar(value);
-	const risks = [];
-	if (normalized === "/" || normalized === "\\" || /^[A-Za-z]:[\\/]*$/.test(normalized)) risks.push("filesystem root");
-	return risks;
+function buildAcceptedContent(approvalPrompt, outcome) {
+	const { requestedSchema, meta } = approvalPrompt;
+	const properties = isJsonObject(requestedSchema.properties) ? requestedSchema.properties : void 0;
+	if (!properties) return;
+	const required = Array.isArray(requestedSchema.required) ? new Set(requestedSchema.required.filter((entry) => typeof entry === "string")) : /* @__PURE__ */ new Set();
+	const content = {};
+	let sawApprovalField = false;
+	for (const [name, value] of Object.entries(properties)) {
+		const schema = isJsonObject(value) ? value : void 0;
+		if (!schema) continue;
+		const property = {
+			name,
+			schema,
+			required: required.has(name)
+		};
+		const next = readApprovalFieldValue(property, outcome) ?? readPersistFieldValue(property, meta, outcome, approvalPrompt.persistHintsMode ?? "legacy") ?? readFallbackFieldValue(property, outcome);
+		if (next === void 0) {
+			if (isApprovalField(property)) sawApprovalField = true;
+			if (property.required) return;
+			continue;
+		}
+		if (isApprovalField(property)) sawApprovalField = true;
+		content[name] = next;
+	}
+	return sawApprovalField ? content : void 0;
 }
-function isPrivateNetworkHostPattern(value) {
-	const wildcardStripped = value.toLowerCase().replace(/^\*\./, "");
-	if (wildcardStripped === "localhost" || wildcardStripped === "local" || wildcardStripped === "internal" || wildcardStripped === "lan" || wildcardStripped === "home" || wildcardStripped === "corp" || wildcardStripped === "private" || wildcardStripped.endsWith(".local") || wildcardStripped.endsWith(".internal") || wildcardStripped.endsWith(".lan") || wildcardStripped.endsWith(".home") || wildcardStripped.endsWith(".corp") || wildcardStripped.endsWith(".private")) return true;
-	if (wildcardStripped.startsWith("10.") || wildcardStripped.startsWith("127.") || wildcardStripped.startsWith("192.168.") || wildcardStripped.startsWith("169.254.")) return true;
-	return /^172\.(1[6-9]|2\d|3[0-1])\./.test(wildcardStripped);
+function readApprovalFieldValue(property, outcome) {
+	if (!isApprovalField(property)) return;
+	if (readNonBlankStringField(property.schema, "type") === "boolean") return true;
+	const options = readEnumOptions(property.schema);
+	if (options.length === 0) return;
+	const sessionChoice = options.find((option) => isSessionApprovalOption(option));
+	const acceptChoice = options.find((option) => isPositiveApprovalOption(option));
+	if (outcome === "approved-session") return sessionChoice?.value ?? acceptChoice?.value;
+	return acceptChoice?.value ?? sessionChoice?.value;
 }
-function hasAvailableDecision(requestParams, decision) {
-	const available = requestParams?.availableDecisions;
-	if (!Array.isArray(available)) return true;
-	return available.includes(decision);
+function readPersistFieldValue(property, meta, outcome, persistHintsMode) {
+	if (!isPersistField(property) || outcome !== "approved-session") return;
+	const persistHints = readPersistHints(meta, persistHintsMode);
+	const options = readEnumOptions(property.schema);
+	if (options.length === 0) return;
+	const preferred = choosePersistHint(persistHints);
+	if (preferred) return options.find((option) => option.value === preferred || option.label === preferred)?.value;
+	if (persistHintsMode === "explicit") return chooseAlwaysPersistOptionValue(options);
 }
-function findAvailableCommandAmendmentDecision(requestParams) {
-	const available = requestParams?.availableDecisions;
-	if (!Array.isArray(available)) return;
-	return available.find((entry) => isJsonObject(entry) && (isJsonObject(entry.acceptWithExecpolicyAmendment) || isJsonObject(entry.applyNetworkPolicyAmendment)));
+function readFallbackFieldValue(property, outcome) {
+	if (outcome === "approved-once" && isPersistField(property)) return;
+	return property.schema.default;
 }
-function commandRejectionDecision(requestParams, preferred) {
-	const available = requestParams?.availableDecisions;
-	if (!Array.isArray(available)) return preferred;
-	if (available.includes(preferred)) return preferred;
-	const alternate = preferred === "decline" ? "cancel" : "decline";
-	if (available.includes(alternate)) return alternate;
-	return preferred;
+function isApprovalField(property) {
+	const haystack = propertyText(property).toLowerCase();
+	return /\b(approve|approval|allow|accept|decision)\b/.test(haystack);
 }
-function approvalResolutionMessage(outcome) {
-	if (outcome === "approved-session") return "Codex app-server approval granted for the session.";
-	if (outcome === "approved-once") return "Codex app-server approval granted for this turn.";
-	if (outcome === "cancelled") return "Codex app-server approval cancelled.";
-	if (outcome === "unavailable") return "Codex app-server approval unavailable.";
-	return "Codex app-server approval denied.";
+function isPersistField(property) {
+	const haystack = propertyText(property).toLowerCase();
+	return /\b(persist|session|always|scope)\b/.test(haystack);
 }
-function approvalScopeForOutcome(outcome) {
-	return outcome === "approved-session" ? "session" : "turn";
+function propertyText(property) {
+	return [
+		property.name,
+		readNonBlankStringField(property.schema, "title"),
+		readNonBlankStringField(property.schema, "description")
+	].filter(Boolean).join(" ");
 }
-function approvalEventScope(method, outcome) {
-	return method === "item/permissions/requestApproval" ? { scope: approvalScopeForOutcome(outcome) } : {};
+function readPersistHints(meta, mode = "legacy") {
+	const raw = meta.persist;
+	if (typeof raw === "string") return [raw];
+	if (Array.isArray(raw)) return raw.filter((entry) => typeof entry === "string");
+	return mode === "legacy" ? ["session", "always"] : [];
 }
-function approvalKindForMethod(method) {
-	if (method.includes("commandExecution") || method.includes("execCommand")) return "exec";
-	if (method.includes("fileChange") || method.includes("Patch") || method.includes("permissions")) return "plugin";
-	return "unknown";
+function buildAcceptedMeta(meta, outcome, persistHintsMode) {
+	if (outcome !== "approved-session") return null;
+	const persist = choosePersistHint(readPersistHints(meta, persistHintsMode));
+	return persist ? { persist } : null;
 }
-function emitApprovalEvent(params, data) {
-	params.onAgentEvent?.({
-		stream: "approval",
-		data
-	});
+function choosePersistHint(persistHints) {
+	if (persistHints.includes("always")) return "always";
+	if (persistHints.includes("session")) return "session";
 }
-function readDisplayCommandPreview(record) {
-	const actionCommand = readCommandActionsPreview(record);
-	if (actionCommand) return actionCommand;
-	return readCommandPreview(record);
+function chooseAlwaysPersistOptionValue(options) {
+	return options.find((option) => optionMatchesPersist(option, "always"))?.value;
 }
-function readPolicyCommand(record) {
-	const command = record?.command;
-	if (typeof command === "string") return command;
-	if (Array.isArray(command) && command.every((part) => typeof part === "string")) return command.join(" ");
-	const actionCommands = readCommandActions(record);
-	if (actionCommands.length > 0) return actionCommands.join(" && ");
+function optionMatchesPersist(option, persist) {
+	return option.value.toLowerCase() === persist || option.label.toLowerCase() === persist;
 }
-function readCommandActions(record) {
-	const actions = record?.commandActions;
-	if (!Array.isArray(actions)) return [];
-	return actions.map((action) => isJsonObject(action) ? readString(action, "command") : void 0).filter((command) => Boolean(command));
+function hasNoSchemaProperties(requestedSchema) {
+	const properties = isJsonObject(requestedSchema.properties) ? requestedSchema.properties : {};
+	return Object.keys(properties).length === 0;
 }
-function readCommandActionsPreview(record) {
-	let source;
-	for (const command of readCommandActions(record)) {
-		source = appendPreviewPart(source, command, " && ");
-		if (source.clipped) break;
+function readEnumOptions(schema) {
+	if (Array.isArray(schema.enum)) {
+		const values = schema.enum.filter((entry) => typeof entry === "string");
+		const labels = Array.isArray(schema.enumNames) ? schema.enumNames.filter((entry) => typeof entry === "string") : [];
+		return values.map((value, index) => ({
+			value,
+			label: labels[index] ?? value
+		}));
 	}
-	return source;
+	if (Array.isArray(schema.oneOf)) return schema.oneOf.map((entry) => {
+		const option = isJsonObject(entry) ? entry : void 0;
+		const value = readNonBlankStringField(option, "const");
+		if (!value) return;
+		return {
+			value,
+			label: readNonBlankStringField(option, "title") ?? value
+		};
+	}).filter((entry) => Boolean(entry));
+	return [];
 }
-function readCommandPreview(record) {
-	const command = record?.command;
-	if (typeof command === "string") return previewSource(command);
-	if (!Array.isArray(command)) return;
-	let source;
-	for (const part of command) {
-		if (typeof part !== "string") return;
-		source = appendPreviewPart(source, part, " ");
-		if (source.clipped) break;
-	}
-	return source;
+function isPositiveApprovalOption(option) {
+	const haystack = `${option.value} ${option.label}`.toLowerCase();
+	return /\b(allow|approve|accept|yes|continue|proceed|true)\b/.test(haystack);
 }
-function readStringPreview(record, key) {
-	const value = readString(record, key);
-	return value === void 0 ? void 0 : previewSource(value);
+function isSessionApprovalOption(option) {
+	const haystack = `${option.value} ${option.label}`.toLowerCase();
+	return /\b(session|always|persistent)\b/.test(haystack) && /\b(allow|approve|accept)\b/.test(haystack);
 }
-function readString(record, key) {
+function readNonBlankStringField(record, key) {
 	const value = record?.[key];
-	return typeof value === "string" ? value : void 0;
-}
-function truncate(value, maxLength) {
-	return value.length <= maxLength ? value : `${truncateUtf16Safe(value, maxLength - 3)}...`;
-}
-function previewSource(value) {
-	return {
-		value: sliceUtf16Safe(value, 0, APPROVAL_PREVIEW_SCAN_MAX_LENGTH),
-		clipped: value.length > APPROVAL_PREVIEW_SCAN_MAX_LENGTH
-	};
-}
-function appendPreviewPart(source, part, separator) {
-	const value = `${source?.value ? `${source.value}${separator}` : ""}${part}`;
-	const clipped = source?.clipped === true || value.length > APPROVAL_PREVIEW_SCAN_MAX_LENGTH;
-	return {
-		value: sliceUtf16Safe(value, 0, APPROVAL_PREVIEW_SCAN_MAX_LENGTH),
-		clipped
-	};
-}
-function sanitizeApprovalPreview(source, maxLength) {
-	if (!source || !source.value) return { omitted: false };
-	const sanitized = sanitizeVisibleScalar(source.value.replace(DANGLING_TERMINAL_SEQUENCE_SUFFIX_RE, ""));
-	if (!sanitized) return { omitted: true };
-	return {
-		text: formatCodexDisplayText(truncate(sanitized, maxLength)),
-		omitted: source.clipped
-	};
-}
-function sanitizeVisibleScalar(value) {
-	return value.replace(ANSI_OSC_SEQUENCE_RE, "").replace(ANSI_CONTROL_SEQUENCE_RE, "").replace(INVISIBLE_FORMATTING_CONTROL_RE, " ").replace(CONTROL_CHARACTER_RE, " ").replace(/\s+/g, " ").trim();
-}
-function formatApprovalPreviewSubject(text, omitted) {
-	return omitted ? `${text} ${APPROVAL_PREVIEW_OMITTED}` : text;
+	return typeof value === "string" && value.trim() ? value : void 0;
 }
-function joinDescriptionLinesWithinLimit(lines, maxLength) {
-	let description = "";
-	for (const line of lines) {
-		const prefix = description ? "\n" : "";
-		const next = `${description}${prefix}${line}`;
-		if (next.length <= maxLength) {
-			description = next;
-			continue;
-		}
-		const remaining = maxLength - description.length - prefix.length;
-		if (remaining < 3) break;
-		description += `${prefix}${truncate(line, remaining)}`;
-		break;
+function readFirstString$1(record, keys) {
+	for (const key of keys) {
+		const value = readNonBlankStringField(record, key);
+		if (value) return value;
 	}
-	return description;
-}
-function formatErrorMessage$1(error) {
-	return error instanceof Error ? error.message : String(error);
 }
 //#endregion
 //#region extensions/codex/src/app-server/dynamic-tools.ts
@@ -3670,6 +5038,16 @@ function hasExplicitNonSourceMessageRoute(args, hookContext, messagingTarget) {
 	if (targetValues.some((value) => !routeTokenMatchesSource(value, hookContext))) return true;
 	return false;
 }
+function normalizeAcceptedSessionSpawn(result) {
+	const details = asOptionalRecord(asOptionalRecord(result)?.details);
+	if (!details || details.status !== "accepted") return null;
+	const runId = normalizeOptionalString(details.runId);
+	const childSessionKey = normalizeOptionalString(details.childSessionKey);
+	return runId && childSessionKey ? {
+		runId,
+		childSessionKey
+	} : null;
+}
 /** Namespace attached to OpenClaw-owned dynamic tools exposed to Codex. */
 const CODEX_OPENCLAW_DYNAMIC_TOOL_NAMESPACE = "openclaw";
 const ALWAYS_DIRECT_DYNAMIC_TOOL_NAMES = /* @__PURE__ */ new Set([
@@ -3694,14 +5072,6 @@ const EXPLICIT_MESSAGE_REPLY_KEYS = [
 	"replyToId",
 	"replyToIdFull"
 ];
-const DEFAULT_CODEX_DYNAMIC_TOOL_RESULT_MAX_CHARS = 16e3;
-const LARGE_CONTEXT_CODEX_DYNAMIC_TOOL_RESULT_MAX_CHARS = 32e3;
-const XL_CONTEXT_CODEX_DYNAMIC_TOOL_RESULT_MAX_CHARS = 64e3;
-function resolveCodexDynamicToolResultMaxChars(contextWindowTokens) {
-	if (typeof contextWindowTokens !== "number" || !Number.isFinite(contextWindowTokens) || contextWindowTokens <= 0) return DEFAULT_CODEX_DYNAMIC_TOOL_RESULT_MAX_CHARS;
-	const tokens = Math.floor(contextWindowTokens);
-	return Math.min(tokens >= 2e5 ? XL_CONTEXT_CODEX_DYNAMIC_TOOL_RESULT_MAX_CHARS : tokens >= 1e5 ? LARGE_CONTEXT_CODEX_DYNAMIC_TOOL_RESULT_MAX_CHARS : DEFAULT_CODEX_DYNAMIC_TOOL_RESULT_MAX_CHARS, Math.max(1, Math.floor(tokens * .3) * 4));
-}
 function computerFrameImageIdentity(content) {
 	if (!Array.isArray(content)) return;
 	const images = content.filter((block) => block.type === "image");
@@ -3720,20 +5090,16 @@ function invalidateComputerFrame(contextEpoch) {
 */
 function createCodexDynamicToolBridge(params) {
 	const toolResultHookContext = toToolResultHookContext(params.hookContext);
-	const toolResultMaxChars = resolveCodexDynamicToolResultMaxChars(params.hookContext?.contextWindowTokens);
-	const availableProjection = projectCodexDynamicTools(params.tools);
+	const contextWindowTokens = params.hookContext?.contextWindowTokens;
+	const toolResultMaxChars = typeof contextWindowTokens === "number" && Number.isFinite(contextWindowTokens) && contextWindowTokens > 0 ? Math.max(1, resolveLiveToolResultMaxChars({ contextWindowTokens })) : DEFAULT_MAX_LIVE_TOOL_RESULT_CHARS;
+	const availableProjection = projectCodexExecutableDynamicToolSurface(params.tools, params.hookContext);
 	const registeredProjection = params.registeredTools ? projectCodexDynamicTools(params.registeredTools) : availableProjection;
-	const wrappedAvailableProjection = wrapProjectedCodexDynamicTools(availableProjection.tools, params.hookContext);
-	const availableTools = wrappedAvailableProjection.tools;
-	const quarantinedAvailableToolNames = new Set([...availableProjection.quarantinedTools, ...wrappedAvailableProjection.quarantinedTools].map((tool) => tool.tool));
+	const availableTools = availableProjection.tools;
+	const quarantinedAvailableToolNames = new Set(availableProjection.quarantinedTools.map((tool) => tool.tool));
 	const registeredSpecTools = (params.registeredTools ? registeredProjection.tools : availableTools).filter((entry) => !quarantinedAvailableToolNames.has(entry.name));
 	const toolMap = new Map(availableTools.map((entry) => [entry.name, entry]));
 	const registeredToolNames = new Set(registeredSpecTools.map((entry) => entry.name));
-	const quarantinedTools = dedupeQuarantinedDynamicTools([
-		...availableProjection.quarantinedTools,
-		...registeredProjection.quarantinedTools,
-		...wrappedAvailableProjection.quarantinedTools
-	]);
+	const quarantinedTools = dedupeQuarantinedDynamicTools([...availableProjection.quarantinedTools, ...registeredProjection.quarantinedTools]);
 	warnQuarantinedDynamicTools(quarantinedTools);
 	emitQuarantinedDynamicToolDiagnostics(quarantinedTools, params.hookContext);
 	const telemetry = {
@@ -3745,6 +5111,7 @@ function createCodexDynamicToolBridge(params) {
 		messagingToolSourceReplyPayloads: [],
 		toolMediaUrls: [],
 		toolAudioAsVoice: false,
+		acceptedSessionSpawns: [],
 		quarantinedTools
 	};
 	const middlewareRunner = createAgentToolResultMiddlewareRunner({
@@ -3761,6 +5128,7 @@ function createCodexDynamicToolBridge(params) {
 	const directToolNames = /* @__PURE__ */ new Set([...ALWAYS_DIRECT_DYNAMIC_TOOL_NAMES, ...params.directToolNames ?? []]);
 	let readRemoteWorkspaceFile;
 	return {
+		availableTools: availableTools.map((entry) => entry.tool),
 		availableSpecs: createCodexDynamicToolSpecs({
 			entries: availableTools,
 			loading: params.loading ?? "searchable",
@@ -3785,7 +5153,7 @@ function createCodexDynamicToolBridge(params) {
 		handleToolCall: async (call, options) => {
 			const toolEntry = toolMap.get(call.tool);
 			if (!toolEntry) {
-				const executedArguments = jsonObjectToRecord(call.arguments);
+				const executedArguments = asNonArrayRecord(call.arguments);
 				const message = registeredToolNames.has(call.tool) ? `OpenClaw tool is not available for this turn: ${call.tool}` : `Unknown OpenClaw tool: ${call.tool}`;
 				finalizeToolTerminalPresentation({
 					toolCallId: call.callId,
@@ -3803,7 +5171,7 @@ function createCodexDynamicToolBridge(params) {
 				});
 			}
 			const { tool, name: toolName } = toolEntry;
-			const args = jsonObjectToRecord(call.arguments);
+			const args = asNonArrayRecord(call.arguments);
 			const startedAt = Date.now();
 			const signal = composeAbortSignals(params.signal, options?.signal);
 			let didStartExecution = false;
@@ -3869,6 +5237,8 @@ function createCodexDynamicToolBridge(params) {
 					result: middlewareResult
 				});
 				const resultIsError = rawIsError || isToolResultError(result);
+				const acceptedSessionSpawn = toolName === "sessions_spawn" && !rawIsError ? normalizeAcceptedSessionSpawn(telemetryRawResult) : null;
+				if (acceptedSessionSpawn) telemetry.acceptedSessionSpawns.push(acceptedSessionSpawn);
 				const finalResultFailureKind = resolveToolResultFailureKind(result);
 				const resultFailureKind = rawResultFailureKind ?? finalResultFailureKind;
 				const observerResult = rawResultFailureKind && finalResultFailureKind !== rawResultFailureKind ? {
@@ -3932,10 +5302,9 @@ function createCodexDynamicToolBridge(params) {
 					isError: resultIsError
 				}) && (replyReceiptMatchesCurrentMessage(rawResult, params.hookContext) || replyReceiptMatchesCurrentMessage(result, params.hookContext));
 				const toolConfirmedSourceReply = params.hookContext?.sourceReplyDeliveryMode === "message_tool_only" && toolName === "message" && !resultIsError && (rawResult.terminate === true || result.terminate === true);
-				const hasExplicitFinalControl = typeof executedArgs.final === "boolean";
 				const confirmedSourceReply = params.hookContext?.sourceReplyDeliveryMode === "message_tool_only" && toolName === "message" && (toolConfirmedSourceReply || deliveredSourceReply || receiptConfirmedSourceReply);
-				const sourceReplyFinal = confirmedSourceReply ? hasExplicitFinalControl ? executedArgs.final === true : void 0 : void 0;
-				const sourceReplyRecord = collectToolTelemetry({
+				const sourceReplyFinal = confirmedSourceReply ? executedArgs.final !== false : void 0;
+				collectToolTelemetry({
 					toolName,
 					args: executedArgs,
 					result,
@@ -3945,13 +5314,9 @@ function createCodexDynamicToolBridge(params) {
 					messagingTarget: confirmedMessagingTarget,
 					sourceReplyFinal
 				});
-				if (confirmedSourceReply && sourceReplyRecord) recordCodexSourceReplyDeliveryIntent(telemetry, {
-					record: sourceReplyRecord,
-					final: sourceReplyFinal
-				});
 				if (deliveredSourceReply || receiptConfirmedSourceReply || toolConfirmedSourceReply) telemetry.didDeliverSourceReplyViaMessageTool = true;
-				const defersInferredSourceReplyTermination = confirmedSourceReply && executedArgs.final !== true;
-				withDynamicToolTermination(response, (rawResult.terminate === true || result.terminate === true) && !defersInferredSourceReplyTermination || isToolResultYield(rawResult) || isToolResultYield(result) || confirmedSourceReply && executedArgs.final === true);
+				const continuesSourceReplyProgress = confirmedSourceReply && sourceReplyFinal === false;
+				withDynamicToolTermination(response, (rawResult.terminate === true || result.terminate === true) && !continuesSourceReplyProgress || isToolResultYield(rawResult) || isToolResultYield(result) || confirmedSourceReply && sourceReplyFinal === true);
 				const asyncStarted = isAsyncStartedToolResult(rawResult) || isAsyncStartedToolResult(result);
 				withDynamicToolAsyncStarted(response, asyncStarted);
 				const replaySafe = executionPrevented || !asyncStarted && isReplaySafeToolInstance(toolEntry.tool) && isReplaySafeToolCall(toolName, executedArgs);
@@ -4015,6 +5380,22 @@ function createCodexDynamicToolBridge(params) {
 		}
 	};
 }
+function projectCodexExecutableDynamicToolSurface(tools, hookContext) {
+	const projected = projectCodexDynamicTools(tools);
+	const wrapped = wrapProjectedCodexDynamicTools(projected.tools, hookContext);
+	return {
+		tools: wrapped.tools,
+		quarantinedTools: dedupeQuarantinedDynamicTools([...projected.quarantinedTools, ...wrapped.quarantinedTools])
+	};
+}
+/** Applies the exact schema and hook-wrapper projection used by the executable Codex bridge. */
+function projectCodexExecutableDynamicTools(params) {
+	const projected = projectCodexExecutableDynamicToolSurface(params.tools, params.hookContext);
+	return {
+		availableTools: projected.tools.map((entry) => entry.tool),
+		quarantinedTools: projected.quarantinedTools
+	};
+}
 function notifyAgentToolResult(observer, toolName, result, isError) {
 	try {
 		observer?.({
@@ -4396,15 +5777,16 @@ function withDynamicToolAsyncStarted(response, asyncStarted) {
 	return response;
 }
 function normalizeToolResultMaxChars(maxChars) {
-	return typeof maxChars === "number" && Number.isFinite(maxChars) && maxChars > 0 ? Math.floor(maxChars) : DEFAULT_CODEX_DYNAMIC_TOOL_RESULT_MAX_CHARS;
+	return typeof maxChars === "number" && Number.isFinite(maxChars) && maxChars > 0 ? Math.floor(maxChars) : DEFAULT_MAX_LIVE_TOOL_RESULT_CHARS;
 }
-function convertToolContents(content, toolResultMaxChars = DEFAULT_CODEX_DYNAMIC_TOOL_RESULT_MAX_CHARS) {
+function convertToolContents(content, toolResultMaxChars = DEFAULT_MAX_LIVE_TOOL_RESULT_CHARS) {
 	const maxChars = normalizeToolResultMaxChars(toolResultMaxChars);
 	const totalTextChars = content.reduce((total, item) => total + (item.type === "text" ? item.text.length : 0), 0);
-	if (totalTextChars <= maxChars) return content.flatMap(convertToolContent);
-	const noticeText = `...(OpenClaw truncated dynamic tool result: original ${totalTextChars} chars, showing ${maxChars}; rerun with narrower args.)`;
+	if (content.reduce((total, item) => total + (item.type === "text" ? estimateToolResultTextChars(item.text) : 0), 0) <= maxChars) return content.flatMap(convertToolContent);
+	const noticeText = `...(OpenClaw truncated dynamic tool result: original ${totalTextChars} chars, weighted budget ${maxChars}; rerun with narrower args.)`;
 	const notice = `\n${noticeText}`;
-	let remainingTextBudget = Math.max(0, maxChars - notice.length);
+	const noticeChars = estimateToolResultTextChars(notice);
+	let remainingTextBudget = Math.max(0, maxChars - noticeChars);
 	let appendedNotice = false;
 	const output = [];
 	for (const item of content) {
@@ -4413,19 +5795,17 @@ function convertToolContents(content, toolResultMaxChars = DEFAULT_CODEX_DYNAMIC
 			continue;
 		}
 		if (appendedNotice) continue;
-		if (notice.length >= maxChars) {
+		if (noticeChars >= maxChars) {
 			output.push({
 				type: "inputText",
-				text: truncateUtf16Safe(noticeText, maxChars)
+				text: sliceToolResultTextToBudget(noticeText, maxChars)
 			});
 			appendedNotice = true;
 			continue;
 		}
-		const sliceLength = Math.min(item.text.length, remainingTextBudget);
-		remainingTextBudget -= sliceLength;
-		const shouldAppendNotice = remainingTextBudget <= 0;
-		const text = truncateUtf16Safe(item.text, sliceLength);
-		if (shouldAppendNotice) {
+		const text = sliceToolResultTextToBudget(item.text, remainingTextBudget);
+		remainingTextBudget -= estimateToolResultTextChars(text);
+		if (remainingTextBudget <= 0 || text.length < item.text.length) {
 			output.push({
 				type: "inputText",
 				text: `${text.trimEnd()}${notice}`
@@ -4438,7 +5818,7 @@ function convertToolContents(content, toolResultMaxChars = DEFAULT_CODEX_DYNAMIC
 	}
 	if (!appendedNotice) output.push({
 		type: "inputText",
-		text: truncateUtf16Safe(noticeText, maxChars)
+		text: sliceToolResultTextToBudget(noticeText, maxChars)
 	});
 	return output;
 }
@@ -4457,10 +5837,6 @@ function convertToolContent(content) {
 		imageUrl
 	}];
 }
-function jsonObjectToRecord(value) {
-	if (!value || typeof value !== "object" || Array.isArray(value)) return {};
-	return value;
-}
 function readFirstString(record, keys) {
 	for (const key of keys) {
 		const value = record[key];
@@ -4517,4 +5893,4 @@ function isCronAddAction(args) {
 	return typeof action === "string" && action.trim().toLowerCase() === "add";
 }
 //#endregion
-export { shouldClearTerminalPresentationForNativeItem as $, createCodexNativeHookRelay as A, resolveTerminalDynamicToolBatchAction as B, filterToolsForVisionInputs as C, CODEX_NATIVE_HOOK_RELAY_TTL_GRACE_MS as D, CODEX_NATIVE_HOOK_RELAY_EVENTS as E, handleDynamicToolCallWithTimeout as F, resolveCodexToolAbortTerminalReason as G, shouldReleaseTurnAfterTerminalDynamicTool as H, hasPendingDynamicToolTerminalDiagnostic as I, isSideEffectingNativeToolItem as J, isMutatingNativeToolItem as K, isDynamicToolTerminalDiagnosticEvent as L, resolveCodexNativeHookRelayEvents as M, resolveCodexNativeHookRelayTtlMs as N, buildCodexNativeHookRelayConfig as O, scheduleCodexNativeHookRelayUnregister as P, itemTitle as Q, isMatchingDynamicToolTerminalDiagnostic as R, shouldWarnCodexDynamicToolBuildStageSummary as S, CodexNativeToolLifecycleProjector as T, toCodexDynamicToolProgressResponse as U, shouldBlockTerminalReleaseForNonTerminalDynamicToolResult as V, toCodexDynamicToolProtocolResponse as W, itemName as X, itemKind as Y, itemStatus as Z, resolveCodexExternalSandboxPolicyForOpenClawSandbox as _, emitDynamicToolStartedDiagnostic as a, shouldEnableCodexAppServerNativeToolSurface as b, resolveCodexProviderWebSearchSupportForClient as c, buildDynamicTools as d, shouldRecordNativeToolTranscript as et, createCodexDynamicToolBuildStageTracker as f, resolveCodexAppServerHookChannelId as g, resolveCodexAppServerExecutionCwd as h, emitDynamicToolErrorDiagnostic as i, emitCodexNativePreToolUseFailureDiagnostic as j, buildCodexNativeHookRelayDisabledConfig as k, buildCodexHookRequester as l, formatCodexDynamicToolBuildStageSummary as m, handleCodexAppServerApprovalRequest as n, unknownItemStatus as nt, emitDynamicToolTerminalDiagnostic as o, disableCodexPluginThreadConfig as p, isNonSuccessItemStatus as q, handleCodexAppServerElicitationRequest as r, resolveCodexProviderWebSearchSupport as s, createCodexDynamicToolBridge as t, shouldSynthesizeToolProgressForItem as tt, settleCodexSourceReplyFinality as u, resolveCodexMessageToolProvider as v, readBoundedCodexRemoteWorkspaceFile as w, shouldRequireCodexSandboxExecServerEnvironment as x, resolveCodexSandboxEnvironmentSelection as y, resolveDynamicToolCallTimeoutMs as z };
+export { buildCodexNativeHookRelayDisabledConfig as A, resolveDynamicToolCallTimeoutMs as B, shouldWarnCodexDynamicToolBuildStageSummary as C, CODEX_NATIVE_HOOK_RELAY_EVENTS as D, CodexNativeToolLifecycleProjector as E, scheduleCodexNativeHookRelayUnregister as F, toCodexDynamicToolProtocolResponse as G, shouldBlockTerminalReleaseForNonTerminalDynamicToolResult as H, handleDynamicToolCallWithTimeout as I, resolveCodexToolAbortTerminalReason as K, hasPendingDynamicToolTerminalDiagnostic as L, emitCodexNativePreToolUseFailureDiagnostic as M, resolveCodexNativeHookRelayEvents as N, CODEX_NATIVE_HOOK_RELAY_TTL_GRACE_MS as O, resolveCodexNativeHookRelayTtlMs as P, isDynamicToolTerminalDiagnosticEvent as R, shouldRequireCodexSandboxExecServerEnvironment as S, readBoundedCodexRemoteWorkspaceFile as T, shouldReleaseTurnAfterTerminalDynamicTool as U, resolveTerminalDynamicToolBatchAction as V, toCodexDynamicToolProgressResponse as W, resolveCodexAppServerHookChannelId as _, emitDynamicToolStartedDiagnostic as a, resolveCodexSandboxEnvironmentSelection as b, resolveCodexProviderWebSearchSupport as c, releaseCodexSandboxExecServerEnvironment as d, buildDynamicTools as f, resolveCodexAppServerExecutionCwd as g, formatCodexDynamicToolBuildStageSummary as h, emitDynamicToolErrorDiagnostic as i, createCodexNativeHookRelay as j, buildCodexNativeHookRelayConfig as k, resolveCodexProviderWebSearchSupportForClient as l, disableCodexPluginThreadConfig as m, projectCodexExecutableDynamicTools as n, emitDynamicToolTerminalDiagnostic as o, createCodexDynamicToolBuildStageTracker as p, handleCodexAppServerElicitationRequest as r, handleCodexAppServerApprovalRequest as s, createCodexDynamicToolBridge as t, ensureCodexSandboxExecServerEnvironment as u, resolveCodexExternalSandboxPolicyForOpenClawSandbox as v, filterToolsForVisionInputs as w, shouldEnableCodexAppServerNativeToolSurface as x, resolveCodexMessageToolProvider as y, isMatchingDynamicToolTerminalDiagnostic as z };