@openclaw/codex 2026.7.2-beta.7 → 2026.8.1-beta.3

package/dist/{thread-lifecycle-DF53ogiA.js → thread-lifecycle-DKdrnTMX.js}

@@ -1,223 +1,33 @@
-import { D as resolveCodexAppServerClientInstanceId, O as consumeCodexAppServerLiveThread, S as isCodexAppServerConnectionClosedError, T as isCodexAppServerPrewriteRequestCancellationError, U as flattenCodexDynamicToolFunctions, W as isJsonObject, n as clearSharedCodexAppServerClientIfCurrentAndUnclaimed, p as retireSharedCodexAppServerClientIfCurrent, s as isCodexAppServerStartSelectionChangedError, t as clearSharedCodexAppServerClientIfCurrent, v as CodexAppServerRpcError, y as getCodexAppServerClientInstanceId } from "./shared-client-DTbvH-XV.js";
-import { M as CODEX_PLUGINS_MARKETPLACE_NAME, N as CODEX_PLUGINS_WORKSPACE_MARKETPLACE_NAME, a as hashCodexAppServerBindingFingerprint, c as reclaimCurrentCodexSessionGeneration, d as sessionBindingIdentity, i as createCodexSessionGenerationSupersededError, k as resolveCodexPluginsPolicy, m as codexSandboxPolicyForTurn, n as assertCodexBindingMayBeReplaced, o as isCodexAppServerNativeAuthProfile, s as normalizeCodexAppServerBindingModelProvider } from "./session-binding-BXpo9ymA.js";
-import { _ as assertCodexThreadStartResponse, a as projectBoundedCodexThreadHistory, g as assertCodexThreadResumeResponse, h as assertCodexThreadForkResponse } from "./transcript-mirror-DzsdNCf5.js";
-import { a as serializeCodexAppInventoryError, i as defaultCodexAppInventoryCache, t as buildCodexAppServerConnectionFingerprint } from "./plugin-app-cache-key-DztPafOA.js";
+import { _ as CODEX_PLUGINS_MARKETPLACE_NAME, g as resolveCodexPluginsPolicy, n as codexSandboxPolicyForTurn, v as CODEX_PLUGINS_WORKSPACE_MARKETPLACE_NAME } from "./config-CpNeo5AE.js";
+import { B as CodexAppServerRpcError, M as isCodexAppServerConnectionClosedError, R as resolveCodexAppServerClientInstanceId, U as consumeCodexAppServerLiveThread, d as retainSharedCodexAppServerClientByInstanceId, k as getCodexAppServerClientInstanceId, lt as flattenCodexDynamicToolFunctions, pt as resolveCodexAppServerLocalHomeDir, s as isCodexAppServerStartSelectionChangedError, ut as isJsonObject } from "./shared-client-Dw-rzii0.js";
+import { a as hashCodexAppServerBindingFingerprint, c as reclaimCurrentCodexSessionGeneration, d as sessionBindingIdentity, i as createCodexSessionGenerationSupersededError, n as assertCodexBindingMayBeReplaced, o as isCodexAppServerNativeAuthProfile, s as normalizeCodexAppServerBindingModelProvider } from "./session-binding-BTrLf9Qm.js";
+import { a as closeCodexStartupClientBestEffort, c as isCodexAppServerUnsafeSubscriptionError, d as unsubscribeCodexThreadBestEffort, n as CODEX_APP_SERVER_UNSUBSCRIBE_TIMEOUT_MS, r as CodexAppServerUnsafeSubscriptionError } from "./attempt-client-cleanup-URjUlCHg.js";
+import { a as assertCodexThreadStartResponse, r as assertCodexThreadForkResponse } from "./protocol-validators-VAVyEnDp.js";
+import { o as defaultCodexAppInventoryCache, s as serializeCodexAppInventoryError, t as buildCodexAppServerConnectionFingerprint } from "./plugin-app-cache-key-DMNQ8Zi8.js";
 import { t as isIncognitoSessionKey } from "./incognito-session-ET_ufDH-.js";
+import { n as codexCatalogHomeId } from "./session-catalog-home-id-BNwAJ9D7.js";
+import { t as resumeCodexAppServerThread } from "./thread-resume-CdJk2Ehf.js";
+import { u as projectBoundedCodexThreadHistory } from "./transcript-mirror-BU0_LKAL.js";
+import { r as sanitizeInlineImageDataUrl, t as invalidInlineImageText } from "./image-payload-sanitizer-CnfoUPCE.js";
+import { asOptionalRecord, isRecord, normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
 import fs from "node:fs/promises";
 import path from "node:path";
-import { SKILL_WORKSHOP_TOOL_NAME, buildSkillWorkshopPromptSection, embeddedAgentLog, formatErrorMessage, isActiveHarnessContextEngine, isHostScopedAgentToolActive } from "openclaw/plugin-sdk/agent-harness-runtime";
+import { SKILL_WORKSHOP_TOOL_NAME, TRANSCRIPT_CREDENTIAL_SAFETY_PROMPT, buildDelegationGuidanceSection, buildHarnessVisibleReplyGuidance, buildSkillWorkshopPromptSection, embeddedAgentLog, formatErrorMessage, isActiveHarnessContextEngine, isHostScopedAgentToolActive, resolveMainSessionDelegationMode } from "openclaw/plugin-sdk/agent-harness-runtime";
 import * as crypto$1 from "node:crypto";
-import crypto from "node:crypto";
+import crypto, { createHash } from "node:crypto";
 import os from "node:os";
-import { isRecord } from "openclaw/plugin-sdk/string-coerce-runtime";
+import { resolveAgentDir as resolveAgentDir$1, resolveSessionAgentIds as resolveSessionAgentIds$1 } from "openclaw/plugin-sdk/agent-runtime";
+import { z } from "zod";
+import { coerceErrorMessage } from "openclaw/plugin-sdk/error-runtime";
 import { sliceUtf16Safe, truncateUtf16Safe } from "openclaw/plugin-sdk/text-utility-runtime";
 import { redactSensitiveFieldValue, redactToolPayloadText } from "openclaw/plugin-sdk/logging-core";
+import { isPathInside } from "openclaw/plugin-sdk/file-access-runtime";
 import { resolveRequiredHomeDir, resolveStateDir } from "openclaw/plugin-sdk/state-paths";
 import { listRegisteredPluginAgentPromptGuidance } from "openclaw/plugin-sdk/plugin-runtime";
+import { buildHostnameAllowlistPolicyFromSuffixAllowlist } from "openclaw/plugin-sdk/ssrf-policy";
 import { buildCodexUserMcpServersThreadConfigPatchForRuntime } from "openclaw/plugin-sdk/codex-mcp-projection";
 import { isDiagnosticFlagEnabled } from "openclaw/plugin-sdk/diagnostic-runtime";
 import { GPT5_HEARTBEAT_PROMPT_OVERLAY } from "openclaw/plugin-sdk/provider-model-shared";
-import { INLINE_IMAGE_DATA_URL_PREFIX, sanitizeInlineImageDataUrl } from "openclaw/plugin-sdk/inline-image-data-url-runtime";
-//#region extensions/codex/src/app-server/attempt-client-cleanup.ts
-/**
-* Best-effort cleanup helpers for Codex app-server startup attempts and turns.
-*/
-/** Timeout for best-effort app-server turn interruption during cleanup. */
-const CODEX_APP_SERVER_INTERRUPT_TIMEOUT_MS = 5e3;
-/** Timeout for best-effort thread unsubscribe during cleanup. */
-const CODEX_APP_SERVER_UNSUBSCRIBE_TIMEOUT_MS = 5e3;
-/** Raised when a thread subscription may be live on a client OpenClaw no longer controls. */
-var CodexAppServerUnsafeSubscriptionError = class extends Error {
-	constructor(message, options) {
-		super(message, options);
-		this.name = "CodexAppServerUnsafeSubscriptionError";
-	}
-};
-function isCodexAppServerUnsafeSubscriptionError(error) {
-	return error instanceof CodexAppServerUnsafeSubscriptionError;
-}
-/** Asserts Codex resumed the exact thread this attempt subscribed to. */
-function assertCodexThreadResumeSubscription(requestedThreadId, returnedThreadId) {
-	if (returnedThreadId !== requestedThreadId) throw new CodexAppServerUnsafeSubscriptionError(`Codex thread/resume returned ${returnedThreadId} for ${requestedThreadId}`);
-}
-async function closeClientAndWaitIfAvailable(client) {
-	const closeable = client;
-	if (typeof closeable.closeAndWait === "function") {
-		await closeable.closeAndWait();
-		return;
-	}
-	closeable.close?.();
-}
-async function closeCodexStartupClientBestEffort(client) {
-	if (!client) return;
-	const unclaimedSharedClient = clearSharedCodexAppServerClientIfCurrentAndUnclaimed(client);
-	if (unclaimedSharedClient.closed) {
-		await closeClientAndWaitIfAvailable(client);
-		return;
-	}
-	if (unclaimedSharedClient.found) {
-		if (retireSharedCodexAppServerClientIfCurrent(client)?.closed) await closeClientAndWaitIfAvailable(client);
-		return;
-	}
-	const retiredSharedClient = retireSharedCodexAppServerClientIfCurrent(client);
-	if (retiredSharedClient) {
-		if (retiredSharedClient.closed) await closeClientAndWaitIfAvailable(client);
-		return;
-	}
-	if (clearSharedCodexAppServerClientIfCurrent(client)) {
-		await closeClientAndWaitIfAvailable(client);
-		return;
-	}
-	await closeClientAndWaitIfAvailable(client);
-}
-/** Sends a turn interrupt without blocking abort cleanup on app-server errors. */
-function interruptCodexTurnBestEffort(client, params) {
-	interruptCodexTurnAndWaitBestEffort(client, params);
-}
-/** Sends a bounded turn interrupt and waits for Codex to confirm terminal abort handling. */
-async function interruptCodexTurnAndWaitBestEffort(client, params) {
-	const requestOptions = params.timeoutMs && Number.isFinite(params.timeoutMs) && params.timeoutMs > 0 ? { timeoutMs: params.timeoutMs } : void 0;
-	const requestParams = {
-		threadId: params.threadId,
-		turnId: params.turnId
-	};
-	try {
-		await (requestOptions ? client.request("turn/interrupt", requestParams, requestOptions) : client.request("turn/interrupt", requestParams));
-	} catch (error) {
-		embeddedAgentLog.debug("codex app-server turn interrupt failed during abort", { error });
-	}
-}
-/** Unsubscribes from a thread while swallowing cleanup-only failures. */
-async function unsubscribeCodexThreadBestEffort(client, params) {
-	try {
-		await client.request("thread/unsubscribe", { threadId: params.threadId }, { timeoutMs: params.timeoutMs });
-		return true;
-	} catch (error) {
-		embeddedAgentLog.debug("codex app-server thread unsubscribe cleanup failed", {
-			threadId: params.threadId,
-			error
-		});
-		return false;
-	}
-}
-/**
-* Retires the shared client after a timed-out turn so later runs do not reuse a
-* potentially wedged app-server connection.
-*/
-async function retireCodexAppServerClientAfterTimedOutTurn(client, params) {
-	const retiredSharedClient = retireSharedCodexAppServerClientIfCurrent(client, { failActiveLeases: params.suspectPhysicalClient });
-	const detachedSharedClient = Boolean(retiredSharedClient);
-	if (!(params.suspectPhysicalClient && (retiredSharedClient?.closed ?? false))) {
-		interruptCodexTurnBestEffort(client, {
-			threadId: params.threadId,
-			turnId: params.turnId,
-			timeoutMs: CODEX_APP_SERVER_INTERRUPT_TIMEOUT_MS
-		});
-		await unsubscribeCodexThreadBestEffort(client, {
-			threadId: params.threadId,
-			timeoutMs: CODEX_APP_SERVER_UNSUBSCRIBE_TIMEOUT_MS
-		});
-	}
-	let closedClient = retiredSharedClient?.closed ?? false;
-	if (!detachedSharedClient) {
-		const close = client.close;
-		if (typeof close === "function") try {
-			close.call(client);
-			closedClient = true;
-		} catch (error) {
-			embeddedAgentLog.debug("codex app-server client close failed during timeout cleanup", {
-				threadId: params.threadId,
-				turnId: params.turnId,
-				error
-			});
-		}
-	}
-	embeddedAgentLog.warn("codex app-server client retired after timed-out turn", {
-		threadId: params.threadId,
-		turnId: params.turnId,
-		reason: params.reason,
-		detachedSharedClient,
-		closedClient,
-		activeSharedClientLeases: retiredSharedClient?.activeLeases ?? 0
-	});
-}
-//#endregion
-//#region extensions/codex/src/app-server/event-projector-values.ts
-function readString(record, key) {
-	const value = record[key];
-	return typeof value === "string" ? value : void 0;
-}
-function normalizeNonEmptyString(value) {
-	if (typeof value !== "string") return;
-	return value.trim() || void 0;
-}
-function readNonEmptyString(record, key) {
-	return normalizeNonEmptyString(record[key]);
-}
-function readNonEmptyStringArray(record, key) {
-	const value = record[key];
-	if (!Array.isArray(value)) return [];
-	const entries = [];
-	for (const entry of value) {
-		const normalized = normalizeNonEmptyString(entry);
-		if (normalized) entries.push(normalized);
-	}
-	return entries;
-}
-function readNullableString(record, key) {
-	const value = record[key];
-	if (value === null) return null;
-	return typeof value === "string" ? value : void 0;
-}
-function readNumber(record, key) {
-	const value = record[key];
-	return typeof value === "number" && Number.isFinite(value) ? value : void 0;
-}
-function readNonNegativeInteger(record, key) {
-	const value = readNumber(record, key);
-	return value !== void 0 && Number.isInteger(value) && value >= 0 ? value : void 0;
-}
-function readCodexErrorNotificationMessage(record) {
-	const error = record.error;
-	return isJsonObject(error) ? readString(error, "message") : void 0;
-}
-function readHookOutputEntries(value) {
-	if (!Array.isArray(value)) return [];
-	return value.flatMap((entry) => {
-		if (!isJsonObject(entry)) return [];
-		const text = readString(entry, "text");
-		if (!text) return [];
-		const kind = readString(entry, "kind");
-		return [{
-			...kind ? { kind } : {},
-			text
-		}];
-	});
-}
-function splitPlanText(text) {
-	return text.split(/\r?\n/).map((line) => line.trim().replace(/^[-*]\s+/, "")).filter((line) => line.length > 0);
-}
-function extractRawAssistantText(item) {
-	return (Array.isArray(item.content) ? item.content : []).flatMap((entry) => {
-		if (!isJsonObject(entry)) return [];
-		const type = readString(entry, "type");
-		if (type !== "output_text" && type !== "text") return [];
-		const value = readString(entry, "text");
-		return value ? [value] : [];
-	}).join("").trim() || void 0;
-}
-function readItemString(item, key) {
-	const value = item[key];
-	return typeof value === "string" ? value : void 0;
-}
-function readItem(value) {
-	if (!isJsonObject(value)) return;
-	const type = typeof value.type === "string" ? value.type : void 0;
-	const id = typeof value.id === "string" ? value.id : void 0;
-	if (!type || !id) return;
-	return value;
-}
-//#endregion
 //#region extensions/codex/src/app-server/plugin-inventory.ts
 /**
 * Reads Codex plugin marketplace state and app inventory to decide which
@@ -241,7 +51,7 @@ async function readCodexPluginInventory(params) {
 		...params,
 		policy
 	});
-	let curatedCatalog;
+	const pluginCatalogs = /* @__PURE__ */ new Map();
 	const diagnostics = [];
 	const records = [];
 	if (appInventory?.state === "missing") diagnostics.push({
@@ -255,13 +65,19 @@ async function readCodexPluginInventory(params) {
 	for (const pluginPolicy of policy.pluginPolicies) {
 		if (!pluginPolicy.enabled && !policy.allowAllPlugins) continue;
 		let listed = installedPlugins;
-		let resolvedPlugin = pluginPolicy.marketplaceName === "workspace-directory" ? findWorkspaceMarketplacePlugin(listed, pluginPolicy.pluginName) : findOpenAiCuratedMarketplacePlugin(listed, pluginPolicy.pluginName);
-		if (!resolvedPlugin && pluginPolicy.enabled && pluginPolicy.marketplaceName === "openai-curated") {
-			curatedCatalog ??= listCodexPluginMetadata(params);
-			listed = await curatedCatalog;
-			resolvedPlugin = findOpenAiCuratedMarketplacePlugin(listed, pluginPolicy.pluginName);
+		let resolvedPlugin = findConfiguredMarketplacePlugin(listed, pluginPolicy);
+		if (!resolvedPlugin && pluginPolicy.enabled && pluginPolicy.marketplaceName !== "workspace-directory") {
+			const requestParams = buildPluginCatalogRequestParams(params, pluginPolicy.marketplaceName);
+			const catalogKey = JSON.stringify([requestParams, pluginMetadataCatalogScope(pluginPolicy.marketplaceName)]);
+			let catalog = pluginCatalogs.get(catalogKey);
+			if (!catalog) {
+				catalog = listCodexPluginMetadata(params, pluginPolicy.marketplaceName);
+				pluginCatalogs.set(catalogKey, catalog);
+			}
+			listed = await catalog;
+			resolvedPlugin = findConfiguredMarketplacePlugin(listed, pluginPolicy);
 		}
-		if (!(pluginPolicy.marketplaceName === "workspace-directory" ? listed.marketplaces.some((entry) => entry.name === "workspace-directory") : listed.marketplaces.some(isOpenAiCuratedMarketplace))) {
+		if (!listed.marketplaces.some((marketplace) => marketplaceMatchesConfiguredName(marketplace, pluginPolicy.marketplaceName))) {
 			diagnostics.push({
 				code: "marketplace_missing",
 				plugin: pluginPolicy,
@@ -278,6 +94,15 @@ async function readCodexPluginInventory(params) {
 			continue;
 		}
 		const { summary } = resolvedPlugin;
+		const unavailableByMarketplacePolicy = summary.availability === "DISABLED_BY_ADMIN" || summary.installPolicy === "NOT_AVAILABLE";
+		if (unavailableByMarketplacePolicy) {
+			diagnostics.push({
+				code: "plugin_disabled",
+				plugin: pluginPolicy,
+				message: `${pluginPolicy.pluginName} is unavailable in ${pluginPolicy.marketplaceName}.`
+			});
+			if (!summary.installed) continue;
+		}
 		const detail = await readPluginDetail(params, marketplaceRef(resolvedPlugin.marketplace, pluginPolicy.marketplaceName), pluginPolicy, summary, diagnostics);
 		const ownedAppIds = detail?.apps.map((app) => app.id).filter(Boolean).toSorted() ?? [];
 		const appOwnership = resolveAppOwnership({
@@ -304,7 +129,7 @@ async function readCodexPluginInventory(params) {
 			policy: pluginPolicy,
 			summary,
 			...detail ? { detail } : {},
-			activationRequired: pluginPolicy.enabled && (!summary.installed || !summary.enabled),
+			activationRequired: pluginPolicy.enabled && (unavailableByMarketplacePolicy || !summary.installed || !summary.enabled),
 			authRequired: apps.some((app) => app.needsAuth || !app.accessible),
 			appOwnership,
 			ownedAppIds,
@@ -318,11 +143,14 @@ async function readCodexPluginInventory(params) {
 		...appInventory ? { appInventory } : {}
 	};
 }
-/** Finds one plugin summary in the OpenAI curated marketplace response. */
-function findOpenAiCuratedPluginSummary(listed, pluginName) {
-	const resolved = findOpenAiCuratedMarketplacePlugin(listed, pluginName);
+/** Finds a configured plugin only in its authorized marketplace identity. */
+function findCodexMarketplacePluginSummary(listed, marketplaceName, pluginName) {
+	const resolved = findConfiguredMarketplacePlugin(listed, {
+		marketplaceName,
+		pluginName
+	});
 	return resolved ? {
-		marketplace: marketplaceRef(resolved.marketplace, CODEX_PLUGINS_MARKETPLACE_NAME),
+		marketplace: marketplaceRef(resolved.marketplace, marketplaceName),
 		summary: resolved.summary
 	} : void 0;
 }
@@ -343,15 +171,16 @@ function resolveRecoverableCodexPluginConfigKeys(params) {
 		configCwd: params.configCwd
 	})).map((pluginPolicy) => pluginPolicy.configKey).toSorted();
 }
-async function listCodexPluginMetadata(params) {
-	const requestParams = {};
+async function listCodexPluginMetadata(params, marketplaceName) {
+	const requestParams = buildPluginCatalogRequestParams(params, marketplaceName);
 	if (!params.metadataCache || !params.appCacheKey) return await params.request("plugin/list", requestParams);
 	return (await params.metadataCache.load({
 		appCacheKey: params.appCacheKey,
 		queryKind: "curated-global",
 		requestParams,
+		catalogScope: pluginMetadataCatalogScope(marketplaceName),
 		request: async (method, listedParams) => await params.request(method, listedParams),
-		cacheable: (response) => response.marketplaces.some((marketplace) => isOpenAiCuratedMarketplace(marketplace))
+		cacheable: (response) => response.marketplaces.some((marketplace) => marketplaceMatchesConfiguredName(marketplace, marketplaceName))
 	})).response;
 }
 async function readInstalledCodexPluginMetadata(params) {
@@ -364,17 +193,26 @@ async function readInstalledCodexPluginMetadata(params) {
 		request: async (method, installedParams) => await params.request(method, installedParams),
 		cacheable: (response) => params.policy.pluginPolicies.every((pluginPolicy) => {
 			if (!pluginPolicy.enabled && !params.policy.allowAllPlugins) return true;
-			return pluginPolicy.marketplaceName === "workspace-directory" ? findWorkspaceMarketplacePlugin(response, pluginPolicy.pluginName) !== void 0 : findOpenAiCuratedMarketplacePlugin(response, pluginPolicy.pluginName) !== void 0;
+			return Boolean(findConfiguredMarketplacePlugin(response, pluginPolicy));
 		})
 	})).response;
 }
 function isSettledMissingPluginPolicy(params) {
 	const queryKind = params.pluginPolicy.marketplaceName === "workspace-directory" ? "installed" : "curated-global";
-	const requestParams = queryKind === "installed" && params.configCwd ? { cwds: [params.configCwd] } : {};
-	const listed = params.metadataCache.read(params.appCacheKey, queryKind, requestParams)?.response;
+	const requestParams = queryKind === "installed" ? params.configCwd ? { cwds: [params.configCwd] } : {} : buildPluginCatalogRequestParams(params, params.pluginPolicy.marketplaceName);
+	const listed = params.metadataCache.read(params.appCacheKey, queryKind, requestParams, queryKind === "curated-global" ? pluginMetadataCatalogScope(params.pluginPolicy.marketplaceName) : void 0)?.response;
 	if (!listed) return false;
-	if (queryKind === "installed") return !findWorkspaceMarketplacePlugin(listed, params.pluginPolicy.pluginName);
-	return !findOpenAiCuratedMarketplacePlugin(listed, params.pluginPolicy.pluginName);
+	return !findConfiguredMarketplacePlugin(listed, params.pluginPolicy);
+}
+function pluginMetadataCatalogScope(marketplaceName) {
+	return isOpenAiCuratedMarketplaceName(marketplaceName) ? void 0 : marketplaceName;
+}
+function buildPluginCatalogRequestParams(params, marketplaceName) {
+	const marketplaceKinds = marketplaceName === "created-by-me-remote" ? ["created-by-me-remote"] : marketplaceName.startsWith("workspace-shared-with-me") ? ["shared-with-me"] : void 0;
+	return {
+		...params.configCwd ? { cwds: [params.configCwd] } : {},
+		...marketplaceKinds ? { marketplaceKinds: [...marketplaceKinds] } : {}
+	};
 }
 function readCachedAppInventory(params) {
 	if (!params.appCache || !params.appCacheKey) return;
@@ -442,18 +280,25 @@ function resolveOwnedApps(params) {
 	}).toSorted((left, right) => left.id.localeCompare(right.id));
 }
 function findPluginSummary(marketplace, pluginName) {
-	return marketplace.plugins.find((plugin) => plugin.name === pluginName || plugin.id === pluginName || plugin.id === `${pluginName}@${marketplace.name}` || pluginNameFromPluginId(plugin.id, marketplace.name) === pluginName);
+	const exact = marketplace.plugins.find((plugin) => plugin.id === pluginName || plugin.id === `${pluginName}@${marketplace.name}`);
+	if (exact) return exact;
+	const matches = marketplace.plugins.filter((plugin) => plugin.name === pluginName || pluginNameFromPluginId(plugin.id, marketplace.name) === pluginName);
+	return matches.length === 1 ? matches[0] : void 0;
 }
-function findOpenAiCuratedMarketplacePlugin(listed, pluginName) {
+function findConfiguredMarketplacePlugin(listed, plugin) {
+	if (plugin.marketplaceName === "workspace-directory") return findWorkspaceMarketplacePlugin(listed, plugin.pluginName);
 	for (const marketplace of listed.marketplaces) {
-		if (!isOpenAiCuratedMarketplace(marketplace)) continue;
-		const summary = findPluginSummary(marketplace, pluginName);
+		if (!marketplaceMatchesConfiguredName(marketplace, plugin.marketplaceName)) continue;
+		const summary = findPluginSummary(marketplace, plugin.pluginName);
 		if (summary) return {
 			marketplace,
 			summary
 		};
 	}
 }
+function marketplaceMatchesConfiguredName(marketplace, configuredMarketplaceName) {
+	return isOpenAiCuratedMarketplaceName(configuredMarketplaceName) ? isOpenAiCuratedMarketplace(marketplace) : marketplace.name === configuredMarketplaceName;
+}
 function findWorkspaceMarketplacePlugin(listed, pluginName) {
 	const marketplace = listed.marketplaces.find((entry) => entry.name === CODEX_PLUGINS_WORKSPACE_MARKETPLACE_NAME);
 	const summary = marketplace?.plugins.find((plugin) => plugin.id === pluginName);
@@ -477,20 +322,33 @@ function marketplaceRef(marketplace, name) {
 }
 /** True for any supported OpenAI curated marketplace wire name, matching Codex's own curated predicate. */
 function isOpenAiCuratedMarketplace(marketplace) {
-	return marketplace.name === "openai-curated" || marketplace.name === CODEX_PLUGINS_REMOTE_MARKETPLACE_NAME || marketplace.name === CODEX_PLUGINS_API_MARKETPLACE_NAME;
+	return isOpenAiCuratedMarketplaceName(marketplace.name);
+}
+/** True for all Codex wire aliases of the same OpenAI-curated catalog. */
+function isOpenAiCuratedMarketplaceName(marketplaceName) {
+	return marketplaceName === "openai-curated" || marketplaceName === CODEX_PLUGINS_REMOTE_MARKETPLACE_NAME || marketplaceName === CODEX_PLUGINS_API_MARKETPLACE_NAME;
 }
 //#endregion
 //#region extensions/codex/src/app-server/plugin-activation.ts
-/** Activates a curated plugin or rejects a workspace plugin that is not already active. */
+/**
+* Activates legacy curated Codex plugins while requiring owner-managed
+* installation for every other marketplace.
+*/
+/** Activates legacy curated plugins without granting install authority to other marketplaces. */
 async function ensureCodexPluginActivation(params) {
 	if (params.identity.marketplaceName === "workspace-directory") return activationFailure(params.identity, "disabled", { message: "workspace-directory plugins must be installed and enabled outside OpenClaw before use." });
+	if (!isOpenAiCuratedMarketplaceName(params.identity.marketplaceName)) {
+		const target = params.identity.pluginName.endsWith(`@${params.identity.marketplaceName}`) ? params.identity.pluginName : `${params.identity.pluginName}@${params.identity.marketplaceName}`;
+		return activationFailure(params.identity, "disabled", { message: `${params.identity.marketplaceName} plugins must be installed and enabled by an owner before use. Run /codex plugins install ${target}.` });
+	}
 	const listed = await listCuratedCodexPluginMetadata(params);
-	const resolved = findOpenAiCuratedPluginSummary(listed, params.identity.pluginName);
+	const resolved = findCodexMarketplacePluginSummary(listed, params.identity.marketplaceName, params.identity.pluginName);
 	if (!resolved) {
-		if (!listed.marketplaces.some(isOpenAiCuratedMarketplace)) return activationFailure(params.identity, "marketplace_missing", { message: `Codex marketplace ${CODEX_PLUGINS_MARKETPLACE_NAME} was not found.` });
+		if (!listed.marketplaces.some((marketplace) => isOpenAiCuratedMarketplace(marketplace))) return activationFailure(params.identity, "marketplace_missing", { message: `Codex marketplace ${CODEX_PLUGINS_MARKETPLACE_NAME} was not found.` });
 		return activationFailure(params.identity, "plugin_missing", { message: `${params.identity.pluginName} was not found in ${CODEX_PLUGINS_MARKETPLACE_NAME}.` });
 	}
 	if (resolved.marketplace.remoteMarketplaceName && !resolved.summary.remotePluginId) return activationFailure(params.identity, "plugin_missing", { message: `${params.identity.pluginName} detail unavailable: Codex did not return a remote plugin id.` });
+	if (resolved.summary.availability === "DISABLED_BY_ADMIN" || resolved.summary.installPolicy === "NOT_AVAILABLE") return activationFailure(params.identity, "disabled", { message: `${params.identity.pluginName} was disabled or made unavailable by its marketplace administrator.` });
 	if (resolved.summary.installed && resolved.summary.enabled && !params.installEvenIfActive) return {
 		identity: params.identity,
 		ok: true,
@@ -499,7 +357,21 @@ async function ensureCodexPluginActivation(params) {
 		marketplace: resolved.marketplace,
 		diagnostics: []
 	};
-	const installResponse = await params.request("plugin/install", pluginReadParams(resolved.marketplace, resolved.marketplace.remoteMarketplaceName && resolved.summary.remotePluginId ? resolved.summary.remotePluginId : params.identity.pluginName));
+	const remotePluginId = resolved.marketplace.remoteMarketplaceName ? resolved.summary.remotePluginId : void 0;
+	let installResponse;
+	try {
+		installResponse = await params.request("plugin/install", pluginReadParams(resolved.marketplace, remotePluginId ?? params.identity.pluginName));
+	} catch (error) {
+		if (!(error instanceof CodexAppServerRpcError) || error.code !== -32600 || !remotePluginId || error.message !== `remote plugin ${remotePluginId} is disabled by admin` && error.message !== `remote plugin ${remotePluginId} is not available for install`) throw error;
+		return {
+			identity: params.identity,
+			ok: false,
+			reason: "install_failed",
+			installAttempted: true,
+			marketplace: resolved.marketplace,
+			diagnostics: [{ message: `Codex plugin install failed: ${coerceErrorMessage(error)}` }]
+		};
+	}
 	if (params.metadataCache && params.appCacheKey) params.metadataCache.invalidate(params.appCacheKey);
 	const refreshDiagnostics = [];
 	let refreshFailed = false;
@@ -508,6 +380,7 @@ async function ensureCodexPluginActivation(params) {
 			request: params.request,
 			appCache: params.appCache,
 			appCacheKey: params.appCacheKey,
+			configCwd: params.configCwd,
 			metadataCache: params.metadataCache,
 			deferAppInventoryRefresh: params.deferAppInventoryRefresh,
 			targetAppIds: params.targetAppIds
@@ -515,7 +388,7 @@ async function ensureCodexPluginActivation(params) {
 		refreshDiagnostics.push(...refreshResult.diagnostics);
 	} catch (error) {
 		refreshFailed = true;
-		refreshDiagnostics.push({ message: `Codex plugin runtime refresh failed after install: ${error instanceof Error ? error.message : String(error)}` });
+		refreshDiagnostics.push({ message: `Codex plugin runtime refresh failed after install: ${coerceErrorMessage(error)}` });
 	}
 	const authRequired = installResponse.appsNeedingAuth.length > 0;
 	return {
@@ -533,13 +406,13 @@ async function refreshCodexPluginRuntimeState(params) {
 	const diagnostics = [];
 	await listCuratedCodexPluginMetadata(params, { forceRefetch: true });
 	await params.request("skills/list", {
-		cwds: [],
+		cwds: params.configCwd ? [params.configCwd] : [],
 		forceReload: true
 	});
 	try {
-		await params.request("hooks/list", { cwds: [] });
+		await params.request("hooks/list", { cwds: params.configCwd ? [params.configCwd] : [] });
 	} catch (error) {
-		diagnostics.push({ message: `Codex hooks refresh skipped: ${error instanceof Error ? error.message : String(error)}` });
+		diagnostics.push({ message: `Codex hooks refresh skipped: ${coerceErrorMessage(error)}` });
 	}
 	await params.request("config/mcpServer/reload", void 0);
 	if (params.appCache && params.appCacheKey) {
@@ -554,13 +427,16 @@ async function refreshCodexPluginRuntimeState(params) {
 				targetAppIds: params.targetAppIds
 			});
 		} catch (error) {
-			diagnostics.push({ message: `Codex app inventory refresh skipped: ${error instanceof Error ? error.message : String(error)}` });
+			diagnostics.push({ message: `Codex app inventory refresh skipped: ${coerceErrorMessage(error)}` });
 		}
 	}
 	return { diagnostics };
 }
 async function listCuratedCodexPluginMetadata(params, options = {}) {
-	const requestParams = options.forceRefetch ? { forceRefetch: true } : {};
+	const requestParams = {
+		...params.configCwd ? { cwds: [params.configCwd] } : {},
+		...options.forceRefetch ? { forceRefetch: true } : {}
+	};
 	if (!params.metadataCache || !params.appCacheKey) return await params.request("plugin/list", requestParams);
 	return (await params.metadataCache.load({
 		appCacheKey: params.appCacheKey,
@@ -792,6 +668,7 @@ async function buildCodexPluginThreadConfig(params) {
 			request: params.request,
 			appCache,
 			appCacheKey: params.appCacheKey,
+			configCwd: params.configCwd,
 			metadataCache: params.metadataCache,
 			deferAppInventoryRefresh: true,
 			targetAppIds: record.ownedAppIds
@@ -867,7 +744,12 @@ async function buildCodexPluginThreadConfig(params) {
 		inventory,
 		accountApps: accountAppsResult.apps
 	});
-	const unresolvedDisabledPluginOwnership = policy.allowAllPlugins ? policy.pluginPolicies.find((pluginPolicy) => !pluginPolicy.enabled && !inventory.records.some((record) => record.policy.configKey === pluginPolicy.configKey && record.detail)) : void 0;
+	const unresolvedDisabledPluginOwnership = policy.allowAllPlugins ? policy.pluginPolicies.find((pluginPolicy) => {
+		const record = inventory.records.find((candidate) => candidate.policy.configKey === pluginPolicy.configKey);
+		const disabledByMarketplacePolicy = record?.summary.availability === "DISABLED_BY_ADMIN" || record?.summary.installPolicy === "NOT_AVAILABLE";
+		const unresolvedPluginIdentity = !record && inventory.diagnostics.some((diagnostic) => diagnostic.plugin?.configKey === pluginPolicy.configKey && (diagnostic.code === "plugin_disabled" || diagnostic.code === "plugin_missing" || diagnostic.code === "marketplace_missing"));
+		return (!pluginPolicy.enabled || disabledByMarketplacePolicy || unresolvedPluginIdentity) && !record?.detail;
+	}) : void 0;
 	if (unresolvedDisabledPluginOwnership) diagnostics.push({
 		code: "account_app_ownership_unavailable",
 		plugin: unresolvedDisabledPluginOwnership,
@@ -907,6 +789,7 @@ async function buildCodexPluginThreadConfig(params) {
 				marketplaceName: record.policy.marketplaceName,
 				pluginName: record.policy.pluginName,
 				allowDestructiveActions: record.policy.allowDestructiveActions,
+				allowOpenWorld: true,
 				destructiveApprovalMode: record.policy.destructiveApprovalMode,
 				mcpServerNames: [...record.detail?.mcpServers ?? []].toSorted()
 			};
@@ -938,6 +821,7 @@ async function buildCodexPluginThreadConfig(params) {
 			source: "account",
 			appName: app.name,
 			allowDestructiveActions: policy.allowDestructiveActions,
+			allowOpenWorld: true,
 			destructiveApprovalMode: policy.destructiveApprovalMode,
 			mcpServerNames: []
 		};
@@ -1017,7 +901,7 @@ function buildCodexPluginAppsConfigPatchFromPolicyContext(policyContext) {
 	for (const [appId, policy] of Object.entries(policyContext.apps).toSorted(([left], [right]) => left.localeCompare(right))) apps[appId] = {
 		enabled: true,
 		destructive_enabled: policy.allowDestructiveActions,
-		open_world_enabled: true,
+		open_world_enabled: policy.allowOpenWorld !== false,
 		default_tools_approval_mode: "auto",
 		...policy.destructiveApprovalMode === "ask" ? { approvals_reviewer: "user" } : {}
 	};
@@ -1110,13 +994,10 @@ function mergeJsonObjects(left, right) {
 	const merged = { ...left };
 	for (const [key, value] of Object.entries(right)) {
 		const existing = merged[key];
-		merged[key] = isPlainJsonObject(existing) && isPlainJsonObject(value) ? mergeJsonObjects(existing, value) : value;
+		merged[key] = isJsonObject(existing) && isJsonObject(value) ? mergeJsonObjects(existing, value) : value;
 	}
 	return merged;
 }
-function isPlainJsonObject(value) {
-	return Boolean(value && typeof value === "object" && !Array.isArray(value));
-}
 function fingerprintJson(value) {
 	return crypto.createHash("sha256").update(stableStringify(value)).digest("hex");
 }
@@ -1142,15 +1023,18 @@ const CODEX_TURN_START_TEXT_INPUT_MAX_CHARS = 1 << 20;
 const DEFAULT_CODEX_PROJECTION_RESERVE_TOKENS = 2e4;
 const MIN_PROMPT_BUDGET_RATIO = .5;
 const MIN_PROMPT_BUDGET_TOKENS = 8e3;
+function neutralizeCodexExplicitMentionSigils(text) {
+	return text.replace(/\$(?=[A-Za-z0-9_:-])/gu, "＄").replace(/\[@(?=[A-Za-z0-9_:-]+\]\()/gu, "[＠");
+}
 /** Projects assembled OpenClaw context-engine messages into Codex prompt inputs. */
 function projectContextEngineAssemblyForCodex(params) {
 	const prompt = params.prompt.trim();
 	const contextMessages = dropDuplicateTrailingPrompt(params.assembledMessages, prompt);
 	const maxRenderedContextChars = normalizeRenderedContextMaxChars(params.maxRenderedContextChars);
-	const renderedContext = renderMessagesForCodexContext(contextMessages, {
+	const renderedContext = neutralizeCodexExplicitMentionSigils(renderMessagesForCodexContext(contextMessages, {
 		maxTextPartChars: resolveTextPartMaxChars(maxRenderedContextChars),
 		toolPayloadMode: params.toolPayloadMode ?? "elide"
-	});
+	}));
 	const boundedContext = renderedContext ? truncateOlderContext(renderedContext, maxRenderedContextChars) : void 0;
 	const promptPrefix = boundedContext ? [
 		CONTEXT_HEADER,
@@ -1185,6 +1069,32 @@ function resolveCodexContextEngineProjectionMaxChars(params) {
 function resolveCodexContextEngineProjectionReserveTokens() {
 	return DEFAULT_CODEX_PROJECTION_RESERVE_TOKENS;
 }
+const CONTINUITY_PROJECTION_RESERVE_RATIO = .5;
+const CONTINUITY_EMPIRICAL_CHARS_PER_TOKEN = 3;
+const CONTINUITY_MIN_CHARS_PER_TOKEN = .5;
+const CONTINUITY_MAX_CHARS_PER_TOKEN = CONTINUITY_EMPIRICAL_CHARS_PER_TOKEN;
+const CONTINUITY_CALIBRATION_MIN_PROMPT_CHARS = 5e4;
+/** Builds a calibration sample from a completed turn, or undefined if unusable. */
+function buildCodexContinuityCalibration(params) {
+	if (!Number.isFinite(params.promptChars) || !Number.isFinite(params.inputTokens) || params.promptChars < CONTINUITY_CALIBRATION_MIN_PROMPT_CHARS || params.inputTokens <= 0) return;
+	return {
+		promptChars: Math.floor(params.promptChars),
+		inputTokens: Math.floor(params.inputTokens)
+	};
+}
+function resolveContinuityCharsPerToken(calibration) {
+	if (!calibration || !Number.isFinite(calibration.promptChars) || !Number.isFinite(calibration.inputTokens) || calibration.promptChars < CONTINUITY_CALIBRATION_MIN_PROMPT_CHARS || calibration.inputTokens <= 0) return CONTINUITY_EMPIRICAL_CHARS_PER_TOKEN;
+	return Math.min(CONTINUITY_MAX_CHARS_PER_TOKEN, Math.max(CONTINUITY_MIN_CHARS_PER_TOKEN, calibration.promptChars / calibration.inputTokens));
+}
+/** Resolves rendered context size for no-engine continuity projections. */
+function resolveCodexContinuityProjectionMaxChars(params) {
+	const contextTokenBudget = typeof params.contextTokenBudget === "number" && Number.isFinite(params.contextTokenBudget) ? Math.floor(params.contextTokenBudget) : void 0;
+	if (!contextTokenBudget || contextTokenBudget <= 0) return DEFAULT_RENDERED_CONTEXT_CHARS;
+	return normalizeRenderedContextMaxChars(resolveProjectionPromptBudgetTokens({
+		contextTokenBudget,
+		reserveTokens: Math.max(DEFAULT_CODEX_PROJECTION_RESERVE_TOKENS, Math.floor(contextTokenBudget * CONTINUITY_PROJECTION_RESERVE_RATIO))
+	}) * resolveContinuityCharsPerToken(params.calibration));
+}
 /** Fits projected context prompts under Codex app-server turn/start text limits. */
 function fitCodexProjectedContextForTurnStart(params) {
 	const maxChars = typeof params.maxChars === "number" && Number.isFinite(params.maxChars) ? Math.max(0, Math.floor(params.maxChars)) : CODEX_TURN_START_TEXT_INPUT_MAX_CHARS;
@@ -1414,18 +1324,171 @@ function areContextEngineProjectionBindingsCompatible(previous, next) {
 	return previous?.schemaVersion === next.schemaVersion && previous.mode === next.mode && previous.epoch === next.epoch && previous.fingerprint === next.fingerprint;
 }
 function resolveContextEngineCitationsMode(config) {
-	const rootConfig = isUnknownRecord(config) ? config : void 0;
-	const citations = (isUnknownRecord(rootConfig?.memory) ? rootConfig.memory : void 0)?.citations;
+	const rootConfig = isRecord(config) ? config : void 0;
+	const citations = (isRecord(rootConfig?.memory) ? rootConfig.memory : void 0)?.citations;
 	return isJsonConfigValue(citations) ? citations : void 0;
 }
-function isUnknownRecord(value) {
-	return Boolean(value && typeof value === "object" && !Array.isArray(value));
-}
 function isJsonConfigValue(value) {
 	if (value === null || typeof value === "string" || typeof value === "boolean") return true;
 	if (typeof value === "number") return Number.isFinite(value);
 	if (Array.isArray(value)) return value.every(isJsonConfigValue);
-	return isUnknownRecord(value) && Object.values(value).every(isJsonConfigValue);
+	return isRecord(value) && Object.values(value).every(isJsonConfigValue);
+}
+//#endregion
+//#region extensions/codex/src/app-server/dynamic-tool-profile.ts
+/** Tool names owned by Codex app-server and normally excluded from OpenClaw dynamic tools. */
+const CODEX_APP_SERVER_OWNED_DYNAMIC_TOOL_EXCLUDES = [
+	"read",
+	"write",
+	"edit",
+	"apply_patch",
+	"exec",
+	"process",
+	"update_plan",
+	"tool_call",
+	"tool_describe",
+	"tool_search",
+	"tool_search_code"
+];
+const CODEX_NATIVE_GOAL_TOOL_EXCLUDES = [
+	"get_goal",
+	"create_goal",
+	"update_goal"
+];
+const CODEX_APP_SERVER_OWNED_REPLACEABLE_TOOL_EXCLUDES = /* @__PURE__ */ new Set([
+	"read",
+	"write",
+	"edit",
+	"apply_patch",
+	...CODEX_NATIVE_GOAL_TOOL_EXCLUDES
+]);
+const CODEX_APP_SERVER_OWNED_SHELL_TOOL_EXCLUDES = /* @__PURE__ */ new Set(["exec", "process"]);
+const DYNAMIC_TOOL_NAME_ALIASES = {
+	bash: "exec",
+	"apply-patch": "apply_patch"
+};
+/** Normalizes OpenClaw/Codex tool names before filtering and allowlist checks. */
+function normalizeCodexDynamicToolName(name) {
+	const normalized = name.trim().toLowerCase();
+	return DYNAMIC_TOOL_NAME_ALIASES[normalized] ?? normalized;
+}
+/** True only for the host-scoped OpenClaw run's exact tool contract. */
+function isSystemAgentOnlyCodexDynamicToolAllowlist(toolsAllow) {
+	return toolsAllow?.length === 1 && normalizeCodexDynamicToolName(toolsAllow[0] ?? "") === "openclaw";
+}
+/** True when a private source reply may use the message delivery tool only. */
+function isMessageOnlyCodexSourceReply(params) {
+	return params.sourceReplyDeliveryMode === "message_tool_only" && params.toolsAllow?.length === 1 && normalizeCodexDynamicToolName(params.toolsAllow[0] ?? "") === "message";
+}
+/** Returns true for private QA runs that force the Codex runtime profile. */
+function isForcedPrivateQaCodexRuntime(env = process.env) {
+	return env.OPENCLAW_BUILD_PRIVATE_QA === "1" && env.OPENCLAW_QA_FORCE_RUNTIME?.trim().toLowerCase() === "codex";
+}
+/** Resolves whether dynamic tools load directly or through Codex tool search. */
+function resolveCodexDynamicToolsLoading(config, env = process.env) {
+	return isForcedPrivateQaCodexRuntime(env) ? "direct" : config.codexDynamicToolsLoading ?? "searchable";
+}
+function normalizeCodexModelId(modelId) {
+	const normalized = modelId?.trim().toLowerCase();
+	if (!normalized) return "";
+	return normalized.includes("/") ? normalized.split("/").at(-1) : normalized;
+}
+/** Returns true when model behavior requires direct dynamic-tool registration. */
+function shouldUseDirectCodexDynamicToolsForModel(modelId) {
+	return shouldDisableCodexToolSearchForModel(modelId);
+}
+/** Returns true for models whose tool-search path is unsupported or inefficient. */
+function shouldDisableCodexToolSearchForModel(modelId) {
+	return normalizeCodexModelId(modelId) === "gpt-5.4-nano";
+}
+/** Resolves dynamic-tool loading after applying model-specific restrictions. */
+function resolveCodexDynamicToolsLoadingForModel(config, modelId, env = process.env) {
+	const loading = resolveCodexDynamicToolsLoading(config, env);
+	return loading === "searchable" && shouldUseDirectCodexDynamicToolsForModel(modelId) ? "direct" : loading;
+}
+/** Resolves dynamic-tool loading for the app-server connection that will execute the turn. */
+function resolveCodexDynamicToolsLoadingForRuntime(config, modelId, options = {}, env = process.env) {
+	const loading = resolveCodexDynamicToolsLoadingForModel(config, modelId, env);
+	return loading === "searchable" && options.connectionClass === "remote" ? "direct" : loading;
+}
+/** Filters OpenClaw tools that Codex owns natively or config explicitly excludes. */
+function filterCodexDynamicTools(tools, config, env = process.env) {
+	return filterCodexDynamicToolsWithOptions(tools, config, env, {
+		preserveOpenClawReplacements: false,
+		preserveOpenClawShell: false
+	});
+}
+/** Keeps OpenClaw coding tools that replace a disabled Codex native surface. */
+function filterCodexDynamicToolsForDisabledNativeSurface(tools, config, options, env = process.env) {
+	return filterCodexDynamicToolsWithOptions(tools, config, env, {
+		preserveOpenClawReplacements: true,
+		preserveOpenClawShell: options.preserveShell
+	});
+}
+function filterCodexDynamicToolsWithOptions(tools, config, env, options) {
+	const excludes = /* @__PURE__ */ new Set();
+	if (!options.preserveOpenClawReplacements) for (const name of CODEX_NATIVE_GOAL_TOOL_EXCLUDES) excludes.add(name);
+	if (isForcedPrivateQaCodexRuntime(env)) excludes.add("apply_patch");
+	else for (const name of CODEX_APP_SERVER_OWNED_DYNAMIC_TOOL_EXCLUDES) {
+		if (options.preserveOpenClawReplacements && CODEX_APP_SERVER_OWNED_REPLACEABLE_TOOL_EXCLUDES.has(name)) continue;
+		if (options.preserveOpenClawShell && CODEX_APP_SERVER_OWNED_SHELL_TOOL_EXCLUDES.has(name)) continue;
+		excludes.add(name);
+	}
+	for (const name of config.codexDynamicToolsExclude ?? []) {
+		const trimmed = normalizeCodexDynamicToolName(name);
+		if (trimmed) excludes.add(trimmed);
+	}
+	return excludes.size === 0 ? tools : tools.filter((tool) => !excludes.has(normalizeCodexDynamicToolName(tool.name)));
+}
+//#endregion
+//#region extensions/codex/src/app-server/thread-binding-policy.ts
+function shouldRotateCodexAppServerBindingForRuntime(params) {
+	if (!params.current) return false;
+	if (params.binding === params.current) return false;
+	return params.connectionClass === "remote" || Boolean(params.binding);
+}
+function resolveCodexGpt56MultiAgentVersion(modelRef) {
+	let modelId = modelRef?.trim().toLowerCase();
+	if (!modelId) return;
+	const slashIndex = modelId.indexOf("/");
+	if (slashIndex > 0) {
+		const provider = modelId.slice(0, slashIndex);
+		if (provider !== "openai" && provider !== "codex") return;
+		modelId = modelId.slice(slashIndex + 1);
+	}
+	if (modelId === "gpt-5.6-sol" || modelId === "gpt-5.6-terra") return "v2";
+	return modelId === "gpt-5.6-luna" ? "v1" : void 0;
+}
+function shouldRotateCodexGpt56MultiAgentBinding(params) {
+	const bindingVersion = resolveCodexGpt56MultiAgentVersion(params.bindingModel);
+	const requestedVersion = resolveCodexGpt56MultiAgentVersion(params.requestedModel);
+	return Boolean(bindingVersion && requestedVersion && bindingVersion !== requestedVersion);
+}
+function isTransientWebSearchRestriction(params) {
+	if (params.nativeProviderWebSearchSupport === "unknown") return true;
+	if (params.params.config?.tools?.web?.search?.enabled === false) return false;
+	if (params.params.disableTools === true) return true;
+	const persistentWebSearchRestriction = params.webSearchAllowed === false && params.persistentWebSearchAllowed === false;
+	if (params.nativeCodeModeEnabled === false && !persistentWebSearchRestriction) return true;
+	if (params.webSearchAllowed !== false) return false;
+	if (params.persistentWebSearchAllowed !== void 0) return params.persistentWebSearchAllowed;
+	if (params.params.toolsAllow === void 0) return false;
+	return !params.params.toolsAllow.some((name) => {
+		const normalized = normalizeCodexDynamicToolName(name);
+		return normalized === "*" || normalized === "web_search";
+	});
+}
+function shouldRecheckRecoverablePluginBinding(params) {
+	if (!params.pluginThreadConfig?.enabled) return false;
+	if (!params.binding.pluginAppsFingerprint || !params.binding.pluginAppsInputFingerprint || params.binding.pluginAppsInputFingerprint !== params.pluginThreadConfig.inputFingerprint) return false;
+	const policyContext = params.binding.pluginAppPolicyContext;
+	if (!policyContext) return false;
+	const enabledPluginConfigKeys = params.pluginThreadConfig.enabledPluginConfigKeys ?? [];
+	const recoverablePluginConfigKeys = params.pluginThreadConfig.recoverablePluginConfigKeys ?? enabledPluginConfigKeys;
+	const recoverablePluginConfigKeySet = new Set(recoverablePluginConfigKeys);
+	const bindingContainsSettledPlugin = enabledPluginConfigKeys.filter((configKey) => !recoverablePluginConfigKeySet.has(configKey)).some((configKey) => (policyContext.pluginAppIds[configKey]?.length ?? 0) > 0 || Object.values(policyContext.apps).some((app) => app.source !== "account" && app.configKey === configKey));
+	const accountAppRecoveryEnabled = params.pluginThreadConfig.accountAppRecoveryEnabled ?? enabledPluginConfigKeys.length === 0;
+	return bindingContainsSettledPlugin || accountAppRecoveryEnabled && Object.keys(policyContext.apps).length === 0 || recoverablePluginConfigKeys.length > 0;
 }
 //#endregion
 //#region extensions/codex/src/app-server/thread-fingerprints.ts
@@ -1469,21 +1532,15 @@ function fingerprintUserMcpServersAuthorizationHeader(value) {
 function fingerprintJsonObject(value) {
 	return JSON.stringify(stabilizeJsonValue(value));
 }
-/** Hash every resume-visible setting without retaining config, credentials, or instructions. */
+/** Hash thread-creation identity; settings already applied by turn/start must not restart Codex. */
 function fingerprintCodexThreadConfig(request, authProfileId, dynamicToolsFingerprint) {
 	return hashCodexAppServerBindingFingerprint(fingerprintJsonObject({
 		authProfileId: authProfileId ?? null,
 		dynamicToolsFingerprint: dynamicToolsFingerprint ?? null,
-		model: request.model ?? null,
-		requestedModel: request.requestedModel === void 0 ? request.model ?? null : request.requestedModel,
+		nativeMultiAgentVersion: resolveCodexGpt56MultiAgentVersion(typeof request.requestedModel === "string" ? request.requestedModel : typeof request.model === "string" ? request.model : void 0) ?? null,
 		modelProvider: request.modelProvider ?? null,
 		requestedModelProvider: request.requestedModelProvider === void 0 ? request.modelProvider ?? null : request.requestedModelProvider,
-		approvalPolicy: request.approvalPolicy ?? null,
-		approvalsReviewer: request.approvalsReviewer ?? null,
-		sandbox: request.sandbox ?? null,
 		permissions: request.permissions ?? null,
-		personality: request.personality ?? null,
-		serviceTier: request.serviceTier === void 0 ? "<omitted>" : request.serviceTier,
 		baseInstructions: request.baseInstructions ?? null,
 		developerInstructions: request.developerInstructions ?? null,
 		config: request.config ?? {}
@@ -1493,17 +1550,7 @@ function fingerprintEnvironmentSelection(environments) {
 	return environments ? JSON.stringify(environments.map(stabilizeJsonValue)) : void 0;
 }
 function fingerprintDynamicToolSpec(tool) {
-	return stabilizeDynamicToolFingerprintValue(tool);
-}
-function stabilizeDynamicToolFingerprintValue(value) {
-	if (Array.isArray(value)) return value.map(stabilizeDynamicToolFingerprintValue);
-	if (!isJsonObject(value)) return value;
-	const stable = {};
-	for (const [key, child] of Object.entries(value).toSorted(([left], [right]) => left.localeCompare(right))) {
-		if (key === "description") continue;
-		stable[key] = stabilizeDynamicToolFingerprintValue(child);
-	}
-	return stable;
+	return stabilizeJsonValue(tool);
 }
 function stabilizeJsonValue(value) {
 	if (Array.isArray(value)) return value.map(stabilizeJsonValue);
@@ -1545,10 +1592,6 @@ const nativeSkillIsolationByClient = /* @__PURE__ */ new WeakMap();
 function isMissingPathError(error) {
 	return error.code === "ENOENT";
 }
-function isPathWithin(root, candidate) {
-	const relative = path.relative(path.resolve(root), path.resolve(candidate));
-	return relative === "" || !path.isAbsolute(relative) && !relative.startsWith(`..${path.sep}`) && relative !== "..";
-}
 async function canonicalizeExistingPath(candidate) {
 	try {
 		return await fs.realpath(candidate);
@@ -1574,12 +1617,12 @@ async function collectPersonalSkillRealPaths(homes, codexHome) {
 		const realDefaultCodexHome = await canonicalizeExistingPath(defaultCodexHome);
 		roots.push({
 			dir: path.join(defaultCodexHome, "skills"),
-			onlyEscapedStateTargets: isPathWithin(realStateDir, realDefaultCodexHome)
+			onlyEscapedStateTargets: isPathInside(realStateDir, realDefaultCodexHome)
 		});
 	}
 	const configuredCodexHome = codexHome?.trim() || process.env.CODEX_HOME?.trim();
 	if (configuredCodexHome) {
-		const stateOwned = isPathWithin(realStateDir, await canonicalizeExistingPath(configuredCodexHome));
+		const stateOwned = isPathInside(realStateDir, await canonicalizeExistingPath(configuredCodexHome));
 		roots.push({
 			dir: path.join(configuredCodexHome, "skills"),
 			onlyEscapedStateTargets: stateOwned
@@ -1597,7 +1640,7 @@ async function collectPersonalSkillRealPaths(homes, codexHome) {
 	const recordSkillFile = async (filePath, onlyEscapedStateTargets) => {
 		try {
 			const skillRealPath = await fs.realpath(filePath);
-			if (!onlyEscapedStateTargets || !isPathWithin(realStateDir, skillRealPath)) skillPaths.add(skillRealPath);
+			if (!onlyEscapedStateTargets || !isPathInside(realStateDir, skillRealPath)) skillPaths.add(skillRealPath);
 		} catch (error) {
 			if (!isMissingPathError(error)) complete = false;
 		}
@@ -1714,171 +1757,33 @@ async function resolveUncachedCodexNativeSkillIsolation(params) {
 	if (await usesDefaultStateDir()) return;
 	const response = await params.client.request("skills/list", {
 		cwds: [params.cwd],
-		forceReload: true
-	}, { signal: params.signal });
-	const homes = [params.home?.trim() || process.env.HOME?.trim() || process.env.USERPROFILE?.trim() || os.homedir()];
-	if (process.platform === "win32") homes.push(params.userProfile?.trim() || os.homedir());
-	const personalSkills = await collectPersonalSkillRealPaths([...new Set(homes.map((home) => path.resolve(home)))], params.codexHome);
-	return { disabledUserSkillPaths: [...personalSkills.complete ? personalSkills.skillPaths : /* @__PURE__ */ new Set([...personalSkills.skillPaths, ...response.data.flatMap((entry) => entry.skills.filter((skill) => skill.scope === "user").map((skill) => skill.path))])].toSorted((left, right) => left.localeCompare(right)) };
-}
-/** Applies path-exact session rules after caller config so isolated user skills stay disabled. */
-function applyCodexNativeSkillIsolation(config, isolation) {
-	if (!isolation) return config;
-	const existingRules = config?.["skills.config"];
-	if (existingRules !== void 0 && !Array.isArray(existingRules)) throw new Error("Codex thread skills.config must be an array");
-	const disabledRules = isolation.disabledUserSkillPaths.map((skillPath) => ({
-		path: skillPath,
-		enabled: false
-	}));
-	return {
-		...config,
-		"skills.include_instructions": false,
-		"skills.config": [...existingRules ?? [], ...disabledRules]
-	};
-}
-//#endregion
-//#region extensions/codex/src/app-server/dynamic-tool-profile.ts
-/** Tool names owned by Codex app-server and normally excluded from OpenClaw dynamic tools. */
-const CODEX_APP_SERVER_OWNED_DYNAMIC_TOOL_EXCLUDES = [
-	"read",
-	"write",
-	"edit",
-	"apply_patch",
-	"exec",
-	"process",
-	"update_plan",
-	"tool_call",
-	"tool_describe",
-	"tool_search",
-	"tool_search_code"
-];
-const CODEX_NATIVE_GOAL_TOOL_EXCLUDES = [
-	"get_goal",
-	"create_goal",
-	"update_goal"
-];
-const CODEX_APP_SERVER_OWNED_SHELL_TOOL_EXCLUDES = /* @__PURE__ */ new Set(["exec", "process"]);
-const DYNAMIC_TOOL_NAME_ALIASES = {
-	bash: "exec",
-	"apply-patch": "apply_patch"
-};
-/** Normalizes OpenClaw/Codex tool names before filtering and allowlist checks. */
-function normalizeCodexDynamicToolName(name) {
-	const normalized = name.trim().toLowerCase();
-	return DYNAMIC_TOOL_NAME_ALIASES[normalized] ?? normalized;
-}
-/** True only for the host-scoped OpenClaw run's exact tool contract. */
-function isSystemAgentOnlyCodexDynamicToolAllowlist(toolsAllow) {
-	return toolsAllow?.length === 1 && normalizeCodexDynamicToolName(toolsAllow[0] ?? "") === "openclaw";
-}
-/** Returns true for private QA runs that force the Codex runtime profile. */
-function isForcedPrivateQaCodexRuntime(env = process.env) {
-	return env.OPENCLAW_BUILD_PRIVATE_QA === "1" && env.OPENCLAW_QA_FORCE_RUNTIME?.trim().toLowerCase() === "codex";
-}
-/** Resolves whether dynamic tools load directly or through Codex tool search. */
-function resolveCodexDynamicToolsLoading(config, env = process.env) {
-	return isForcedPrivateQaCodexRuntime(env) ? "direct" : config.codexDynamicToolsLoading ?? "searchable";
-}
-function normalizeCodexModelId(modelId) {
-	const normalized = modelId?.trim().toLowerCase();
-	if (!normalized) return "";
-	return normalized.includes("/") ? normalized.split("/").at(-1) : normalized;
-}
-/** Returns true when model behavior requires direct dynamic-tool registration. */
-function shouldUseDirectCodexDynamicToolsForModel(modelId) {
-	return shouldDisableCodexToolSearchForModel(modelId);
-}
-/** Returns true for models whose tool-search path is unsupported or inefficient. */
-function shouldDisableCodexToolSearchForModel(modelId) {
-	return normalizeCodexModelId(modelId) === "gpt-5.4-nano";
-}
-/** Resolves dynamic-tool loading after applying model-specific restrictions. */
-function resolveCodexDynamicToolsLoadingForModel(config, modelId, env = process.env) {
-	const loading = resolveCodexDynamicToolsLoading(config, env);
-	return loading === "searchable" && shouldUseDirectCodexDynamicToolsForModel(modelId) ? "direct" : loading;
-}
-/** Resolves dynamic-tool loading for the app-server connection that will execute the turn. */
-function resolveCodexDynamicToolsLoadingForRuntime(config, modelId, options = {}, env = process.env) {
-	const loading = resolveCodexDynamicToolsLoadingForModel(config, modelId, env);
-	return loading === "searchable" && options.connectionClass === "remote" ? "direct" : loading;
-}
-/** Filters OpenClaw tools that Codex owns natively or config explicitly excludes. */
-function filterCodexDynamicTools(tools, config, env = process.env) {
-	return filterCodexDynamicToolsWithOptions(tools, config, env, { preserveOpenClawShell: false });
-}
-/** Keeps exec/process only when Codex cannot advertise an environment-backed native shell. */
-function filterCodexDynamicToolsWithOpenClawShell(tools, config, env = process.env) {
-	return filterCodexDynamicToolsWithOptions(tools, config, env, { preserveOpenClawShell: true });
-}
-function filterCodexDynamicToolsWithOptions(tools, config, env, options) {
-	const excludes = /* @__PURE__ */ new Set();
-	for (const name of CODEX_NATIVE_GOAL_TOOL_EXCLUDES) excludes.add(name);
-	if (isForcedPrivateQaCodexRuntime(env)) excludes.add("apply_patch");
-	else for (const name of CODEX_APP_SERVER_OWNED_DYNAMIC_TOOL_EXCLUDES) {
-		if (options.preserveOpenClawShell && CODEX_APP_SERVER_OWNED_SHELL_TOOL_EXCLUDES.has(name)) continue;
-		excludes.add(name);
-	}
-	for (const name of config.codexDynamicToolsExclude ?? []) {
-		const trimmed = normalizeCodexDynamicToolName(name);
-		if (trimmed) excludes.add(trimmed);
-	}
-	return excludes.size === 0 ? tools : tools.filter((tool) => !excludes.has(normalizeCodexDynamicToolName(tool.name)));
-}
-//#endregion
-//#region extensions/codex/src/app-server/thread-binding-policy.ts
-function shouldRotateCodexAppServerBindingForRuntime(params) {
-	if (!params.current) return false;
-	if (params.binding === params.current) return false;
-	return params.connectionClass === "remote" || Boolean(params.binding);
-}
-function resolveCodexGpt56MultiAgentVersion(modelRef) {
-	let modelId = modelRef?.trim().toLowerCase();
-	if (!modelId) return;
-	const slashIndex = modelId.indexOf("/");
-	if (slashIndex > 0) {
-		const provider = modelId.slice(0, slashIndex);
-		if (provider !== "openai" && provider !== "codex") return;
-		modelId = modelId.slice(slashIndex + 1);
-	}
-	if (modelId === "gpt-5.6-sol" || modelId === "gpt-5.6-terra") return "v2";
-	return modelId === "gpt-5.6-luna" ? "v1" : void 0;
-}
-function shouldRotateCodexGpt56MultiAgentBinding(params) {
-	const bindingVersion = resolveCodexGpt56MultiAgentVersion(params.bindingModel);
-	const requestedVersion = resolveCodexGpt56MultiAgentVersion(params.requestedModel);
-	return Boolean(bindingVersion && requestedVersion && bindingVersion !== requestedVersion);
-}
-function isTransientWebSearchRestriction(params) {
-	if (params.nativeProviderWebSearchSupport === "unknown") return true;
-	if (params.params.config?.tools?.web?.search?.enabled === false) return false;
-	if (params.params.disableTools === true) return true;
-	const persistentWebSearchRestriction = params.webSearchAllowed === false && params.persistentWebSearchAllowed === false;
-	if (params.nativeCodeModeEnabled === false && !persistentWebSearchRestriction) return true;
-	if (params.webSearchAllowed !== false) return false;
-	if (params.persistentWebSearchAllowed !== void 0) return params.persistentWebSearchAllowed;
-	if (params.params.toolsAllow === void 0) return false;
-	return !params.params.toolsAllow.some((name) => {
-		const normalized = normalizeCodexDynamicToolName(name);
-		return normalized === "*" || normalized === "web_search";
-	});
-}
-function shouldRecheckRecoverablePluginBinding(params) {
-	if (!params.pluginThreadConfig?.enabled) return false;
-	if (!params.binding.pluginAppsFingerprint || !params.binding.pluginAppsInputFingerprint || params.binding.pluginAppsInputFingerprint !== params.pluginThreadConfig.inputFingerprint) return false;
-	const policyContext = params.binding.pluginAppPolicyContext;
-	if (!policyContext) return false;
-	const enabledPluginConfigKeys = params.pluginThreadConfig.enabledPluginConfigKeys ?? [];
-	const recoverablePluginConfigKeys = params.pluginThreadConfig.recoverablePluginConfigKeys ?? enabledPluginConfigKeys;
-	const recoverablePluginConfigKeySet = new Set(recoverablePluginConfigKeys);
-	const bindingContainsSettledPlugin = enabledPluginConfigKeys.filter((configKey) => !recoverablePluginConfigKeySet.has(configKey)).some((configKey) => (policyContext.pluginAppIds[configKey]?.length ?? 0) > 0 || Object.values(policyContext.apps).some((app) => app.source !== "account" && app.configKey === configKey));
-	const accountAppRecoveryEnabled = params.pluginThreadConfig.accountAppRecoveryEnabled ?? enabledPluginConfigKeys.length === 0;
-	return bindingContainsSettledPlugin || accountAppRecoveryEnabled && Object.keys(policyContext.apps).length === 0 || recoverablePluginConfigKeys.length > 0;
+		forceReload: true
+	}, { signal: params.signal });
+	const homes = [params.home?.trim() || process.env.HOME?.trim() || process.env.USERPROFILE?.trim() || os.homedir()];
+	if (process.platform === "win32") homes.push(params.userProfile?.trim() || os.homedir());
+	const personalSkills = await collectPersonalSkillRealPaths([...new Set(homes.map((home) => path.resolve(home)))], params.codexHome);
+	return { disabledUserSkillPaths: [...personalSkills.complete ? personalSkills.skillPaths : /* @__PURE__ */ new Set([...personalSkills.skillPaths, ...response.data.flatMap((entry) => entry.skills.filter((skill) => skill.scope === "user").map((skill) => skill.path))])].toSorted((left, right) => left.localeCompare(right)) };
+}
+/** Applies path-exact session rules after caller config so isolated user skills stay disabled. */
+function applyCodexNativeSkillIsolation(config, isolation) {
+	if (!isolation) return config;
+	const existingRules = config?.["skills.config"];
+	if (existingRules !== void 0 && !Array.isArray(existingRules)) throw new Error("Codex thread skills.config must be an array");
+	const disabledRules = isolation.disabledUserSkillPaths.map((skillPath) => ({
+		path: skillPath,
+		enabled: false
+	}));
+	return {
+		...config,
+		"skills.include_instructions": false,
+		"skills.config": [...existingRules ?? [], ...disabledRules]
+	};
 }
 //#endregion
 //#region extensions/codex/src/app-server/thread-lifecycle-errors.ts
 var CodexThreadStartRequestError = class extends Error {
 	constructor(cause) {
-		super(formatErrorMessage(cause), { cause });
+		super(`thread/start: ${formatErrorMessage(cause)}`, { cause });
 		this.name = "CodexThreadStartRequestError";
 	}
 };
@@ -1888,10 +1793,10 @@ var CodexThreadBindingConflictError = class extends Error {
 		this.name = "CodexThreadBindingConflictError";
 	}
 };
-var CodexRingZeroAttestationError = class extends Error {
+var CodexRestrictedToolSurfaceAttestationError = class extends Error {
 	constructor(cause) {
-		super("Codex ring-zero MCP attestation failed", { cause });
-		this.name = "CodexRingZeroAttestationError";
+		super("Codex restricted-tool-surface MCP attestation failed", { cause });
+		this.name = "CodexRestrictedToolSurfaceAttestationError";
 	}
 };
 var CodexThreadBindingConflictAfterCleanupError = class extends CodexThreadBindingConflictError {};
@@ -1902,6 +1807,64 @@ var CodexAdoptedThreadActiveError = class extends Error {
 	}
 };
 //#endregion
+//#region extensions/codex/src/app-server/managed-thread-store.ts
+const CODEX_MANAGED_THREAD_NAMESPACE = "app-server-managed-threads";
+const CODEX_MANAGED_THREAD_MAX_ENTRIES = 2e4;
+const managedThreadSchema = z.object({
+	version: z.literal(1),
+	kind: z.literal("managed-thread"),
+	sourceHomeId: z.string().min(1),
+	threadId: z.string().min(1),
+	rolloutPath: z.string().min(1).optional()
+});
+async function markStartedCodexManagedThread(store, params) {
+	if (!store) return;
+	try {
+		await store.mark({
+			sourceHomeId: params.sourceHomeId,
+			threadId: params.threadId,
+			...params.rolloutPath ? { rolloutPath: params.rolloutPath } : {}
+		});
+	} catch (error) {
+		embeddedAgentLog.warn("failed to record Codex managed thread ownership", { error });
+	}
+}
+function managedThreadStoreKey(sourceHomeId, threadId) {
+	return `sha256:${createHash("sha256").update("openclaw:codex-managed-thread:v1\0").update(sourceHomeId).update("\0").update(threadId).digest("hex")}`;
+}
+/** Durable ownership index for Codex threads created by OpenClaw. */
+function createCodexManagedThreadStore(state) {
+	return {
+		async mark(params) {
+			try {
+				const value = managedThreadSchema.parse({
+					version: 1,
+					kind: "managed-thread",
+					sourceHomeId: params.sourceHomeId.trim(),
+					threadId: params.threadId.trim(),
+					...params.rolloutPath?.trim() ? { rolloutPath: params.rolloutPath.trim() } : {}
+				});
+				state.registerIfAbsent(managedThreadStoreKey(value.sourceHomeId, value.threadId), value);
+				return true;
+			} catch (error) {
+				embeddedAgentLog.warn("failed to record Codex managed thread ownership", { error });
+				return false;
+			}
+		},
+		async snapshot() {
+			const byHome = /* @__PURE__ */ new Map();
+			for (const entry of state.entries()) {
+				const parsed = managedThreadSchema.safeParse(entry.value);
+				if (!parsed.success) continue;
+				const ids = byHome.get(parsed.data.sourceHomeId) ?? /* @__PURE__ */ new Set();
+				ids.add(parsed.data.threadId);
+				byHome.set(parsed.data.sourceHomeId, ids);
+			}
+			return byHome;
+		}
+	};
+}
+//#endregion
 //#region extensions/codex/src/app-server/plugin-thread-attestation.ts
 /**
 * Confirms admitted plugin and account apps against their actual Codex thread before
@@ -1957,6 +1920,50 @@ async function discardUnattestedCodexPluginThread(params) {
 	}
 }
 //#endregion
+//#region extensions/codex/src/app-server/thread-lifecycle-result.ts
+/** Materializes the public lifecycle result after a fresh thread is durably committed. */
+function buildStartedCodexThreadBinding(input) {
+	const { context, params, response, startParams } = input;
+	return {
+		threadId: response.thread.id,
+		...input.clientId ? { clientId: input.clientId } : {},
+		cwd: params.cwd,
+		...input.rolloutPath ? { rolloutPath: input.rolloutPath } : {},
+		authProfileId: params.params.authProfileId,
+		agentWorkspaceDeveloperInstructions: params.agentWorkspaceDeveloperInstructions,
+		model: response.model ?? startParams.model ?? params.params.modelId,
+		modelProvider: response.modelProvider ?? input.startModelProvider ?? input.modelProvider,
+		dynamicToolsFingerprint: context.dynamicToolsFingerprint,
+		dynamicToolsContainDeferred: context.dynamicToolsContainDeferred,
+		nativeSkillIsolationFingerprint: context.nativeSkillIsolationFingerprint,
+		userMcpServersFingerprint: context.userMcpServersFingerprint,
+		mcpServersFingerprint: input.nextMcpServersFingerprint,
+		configuredMcpOwnershipVersion: params.configuredMcpOwnershipVersion,
+		ringZeroConfigFingerprint: context.ringZeroConfigFingerprint,
+		ringZeroClientInstanceId: context.ringZeroClientInstanceId,
+		networkProxyProfileName: params.appServer.networkProxy?.profileName,
+		networkProxyConfigFingerprint: context.networkProxyConfigFingerprint,
+		nativeHookRelayGeneration: input.finalConfigPatch.nativeHookRelayGeneration,
+		appServerRuntimeFingerprint: params.appServerRuntimeFingerprint,
+		pluginAppsFingerprint: input.pluginThreadConfig?.fingerprint,
+		pluginAppsInputFingerprint: input.pluginThreadConfig?.inputFingerprint,
+		pluginAppPolicyContext: input.pluginThreadConfig?.policyContext,
+		contextEngine: context.contextEngineBinding,
+		environmentSelectionFingerprint: context.environmentSelectionFingerprint,
+		...!context.preserveExistingBinding ? { liveThreadConfigFingerprint: fingerprintCodexThreadConfig({
+			...startParams,
+			model: response.model ?? startParams.model ?? null,
+			requestedModel: startParams.model ?? null,
+			modelProvider: input.bindingModelProvider ?? null,
+			requestedModelProvider: startParams.modelProvider ?? input.bindingModelProvider ?? null
+		}, params.params.authProfileId, context.dynamicToolsFingerprint) } : {},
+		lifecycle: {
+			action: "started",
+			...context.rotatedContextEngineBinding ? { rotatedContextEngineBinding: true } : {}
+		}
+	};
+}
+//#endregion
 //#region extensions/codex/src/app-server/reasoning-effort.ts
 const CODEX_REASONING_EFFORTS = [
 	"minimal",
@@ -1967,30 +1974,13 @@ const CODEX_REASONING_EFFORTS = [
 	"max",
 	"ultra"
 ];
-const GPT_56_MAX_REASONING_EFFORTS = [
-	"low",
-	"medium",
-	"high",
-	"xhigh",
-	"max"
-];
-const GPT_56_ULTRA_REASONING_EFFORTS = [...GPT_56_MAX_REASONING_EFFORTS, "ultra"];
-const GPT_5_PRO_REASONING_EFFORTS = [
+const LEGACY_PRO_REASONING_EFFORTS = [
 	"medium",
 	"high",
 	"xhigh"
 ];
-const GPT_56_ULTRA_MODEL_IDS = /* @__PURE__ */ new Set(["gpt-5.6-sol", "gpt-5.6-terra"]);
-const GPT_56_MAX_MODEL_IDS = /* @__PURE__ */ new Set([...GPT_56_ULTRA_MODEL_IDS, "gpt-5.6-luna"]);
-const MODERN_CODEX_MODEL_IDS = /* @__PURE__ */ new Set([
-	...GPT_56_MAX_MODEL_IDS,
-	"gpt-5.5",
-	"gpt-5.5-pro",
-	"gpt-5.4",
-	"gpt-5.4-pro",
-	"gpt-5.4-mini",
-	"gpt-5.3-codex-spark"
-]);
+const LEGACY_PRO_MODEL_ID_RE = /^gpt-5\.[45]-pro$/u;
+const MODERN_GPT_5_MODEL_ID_RE = /^gpt-5\.(?:[3-9]|[1-9]\d)(?:$|-)/u;
 function normalizeCodexReasoningEfforts(efforts) {
 	if (!efforts) return [];
 	const supported = new Set(efforts.map((effort) => effort.trim().toLowerCase()));
@@ -2010,24 +2000,21 @@ function resolveSupportedReasoningEffort(params) {
 	const requestedRank = CODEX_REASONING_EFFORTS.indexOf(params.requested);
 	return fallbackEfforts.find((effort) => CODEX_REASONING_EFFORTS.indexOf(effort) >= requestedRank) ?? fallbackEfforts.at(-1);
 }
-function resolveFallbackReasoningEfforts(modelId) {
-	const normalized = modelId.trim().toLowerCase();
-	if (GPT_56_ULTRA_MODEL_IDS.has(normalized)) return GPT_56_ULTRA_REASONING_EFFORTS;
-	if (normalized === "gpt-5.6-luna") return GPT_56_MAX_REASONING_EFFORTS;
-	if (normalized === "gpt-5.5-pro" || normalized === "gpt-5.4-pro") return GPT_5_PRO_REASONING_EFFORTS;
-}
-/** Resolve a turn effort from app-server metadata, with exact-name offline fallbacks. */
+/** Resolve a turn effort from the selected model's provider-owned metadata. */
 function resolveCodexAppServerReasoningEffort(params) {
 	if (params.thinkLevel === "off" || params.thinkLevel === "adaptive") return null;
-	const supportedReasoningEfforts = params.supportedReasoningEfforts ?? resolveFallbackReasoningEfforts(params.modelId);
-	if (supportedReasoningEfforts) return resolveSupportedReasoningEffort({
+	if (params.supportedReasoningEfforts) return resolveSupportedReasoningEffort({
 		requested: params.thinkLevel,
-		supportedReasoningEfforts
+		supportedReasoningEfforts: params.supportedReasoningEfforts
+	}) ?? null;
+	const modelId = params.modelId.trim().toLowerCase();
+	if (LEGACY_PRO_MODEL_ID_RE.test(modelId)) return resolveSupportedReasoningEffort({
+		requested: params.thinkLevel,
+		supportedReasoningEfforts: LEGACY_PRO_REASONING_EFFORTS
 	}) ?? null;
-	const normalizedModelId = params.modelId.trim().toLowerCase();
-	if (params.thinkLevel === "minimal") return MODERN_CODEX_MODEL_IDS.has(normalizedModelId) ? "low" : "minimal";
-	if (params.thinkLevel === "low" || params.thinkLevel === "medium" || params.thinkLevel === "high" || params.thinkLevel === "xhigh") return params.thinkLevel;
-	return params.thinkLevel === "max" && GPT_56_MAX_MODEL_IDS.has(normalizedModelId) ? "max" : null;
+	if (params.thinkLevel === "minimal" && MODERN_GPT_5_MODEL_ID_RE.test(modelId)) return "low";
+	if (params.thinkLevel === "minimal" || params.thinkLevel === "low" || params.thinkLevel === "medium" || params.thinkLevel === "high" || params.thinkLevel === "xhigh") return params.thinkLevel;
+	return null;
 }
 //#endregion
 //#region extensions/codex/src/app-server/thread-model-selection.ts
@@ -2105,11 +2092,21 @@ function resolveReasoningEffort(thinkLevel, modelId, supportedReasoningEfforts)
 	});
 }
 //#endregion
+//#region extensions/codex/src/app-server/project-doc-thread-config.ts
+const CODEX_NATIVE_PROJECT_DOC_MAX_BYTES = 128 * 1024;
+function buildCodexProjectDocThreadConfig(config) {
+	const defaults = { project_doc_max_bytes: CODEX_NATIVE_PROJECT_DOC_MAX_BYTES };
+	return mergeCodexThreadConfigs(defaults, config) ?? defaults;
+}
+//#endregion
 //#region extensions/codex/src/app-server/thread-prompt.ts
 function buildDeveloperInstructions(params, options = {}) {
 	const deferredToolNames = /* @__PURE__ */ new Set();
 	let hasSkillWorkshop = false;
+	let hasSessionsSpawn = false;
 	let hasSessionsYield = false;
+	let hasSubagentsList = false;
+	let hasSessionsSend = false;
 	let hasSeenDirectNamespace = false;
 	let messageToolAvailable = options.dynamicTools ? false : params.disableMessageTool !== true;
 	for (const spec of options.dynamicTools ?? []) {
@@ -2119,7 +2116,10 @@ function buildDeveloperInstructions(params, options = {}) {
 			const name = tool.name.trim();
 			if (tool.deferLoading === true && name) deferredToolNames.add(name);
 			hasSkillWorkshop ||= name === SKILL_WORKSHOP_TOOL_NAME;
+			hasSessionsSpawn ||= name === "sessions_spawn";
 			hasSessionsYield ||= isDirectNamespace && name === "sessions_yield";
+			hasSubagentsList ||= name === "subagents";
+			hasSessionsSend ||= name === "sessions_send";
 			messageToolAvailable ||= name === "message";
 		}
 	}
@@ -2127,21 +2127,71 @@ function buildDeveloperInstructions(params, options = {}) {
 		surface: "codex_app_server",
 		includeLegacyGlobalGuidance: false
 	}).join("\n");
+	const delegationGuidanceAvailable = params.disableTools !== true && params.delegationCapability !== "report_only" && !isMessageOnlyCodexSourceReply(params);
+	const nativeDelegationAvailable = delegationGuidanceAvailable && !isSystemAgentOnlyCodexDynamicToolAllowlist(params.toolsAllow) && !shouldDisableCodexToolSearchForModel(params.modelId);
+	const deferredToolDiscoveryGuidance = deferredToolNames.size > 0 || nativeDelegationAvailable ? "Deferred tools may be absent from the direct tool list. Use `tool_search` when directly callable. On code-mode-only models, use `exec` instead: filter `ALL_TOOLS` by name and description, then call the matching entry through `tools`." : void 0;
 	return [
 		"You are a personal agent running inside OpenClaw. OpenClaw has dynamic tools for OpenClaw-owned messaging, cron, sessions, media, gateway, and nodes.",
-		deferredToolNames.size > 0 ? `Deferred searchable OpenClaw dynamic tools available: ${[...deferredToolNames].toSorted((left, right) => left.localeCompare(right)).join(", ")}. Use \`tool_search\` to load exact callable specs before use.` : void 0,
+		deferredToolNames.size > 0 ? `Deferred searchable OpenClaw dynamic tools available: ${[...deferredToolNames].toSorted((left, right) => left.localeCompare(right)).join(", ")}.` : void 0,
+		deferredToolDiscoveryGuidance,
 		hasSkillWorkshop ? buildSkillWorkshopPromptSection().join("\n") : void 0,
-		"Use Codex native `spawn_agent` for Codex subagents. `spawn_agent` and the other native collaboration tools may be deferred: when `spawn_agent` is not directly listed, load it with `tool_search` before spawning. Use OpenClaw `sessions_spawn` only for OpenClaw or ACP delegation, never as a substitute for `spawn_agent`.",
-		hasSessionsYield ? "When a native child's result belongs in a later turn, end the current turn with `openclaw_direct.sessions_yield`; the completion arrives as the next model-visible input. Use native `wait_agent` only for an intentional same-turn wait when the immediate next step is blocked on the child. Never loop-poll for native child completion." : void 0,
-		buildVisibleReplyInstruction(params, messageToolAvailable),
+		nativeDelegationAvailable ? `Use Codex native \`spawn_agent\` for Codex subagents. \`spawn_agent\` and the other native collaboration tools may be deferred.${hasSessionsSpawn ? " Use OpenClaw `sessions_spawn` only for OpenClaw or ACP delegation, never as a substitute for `spawn_agent` on internal legwork." : ""}` : void 0,
+		hasSessionsYield && nativeDelegationAvailable ? "When a native child's result belongs in a later turn, end the current turn with `openclaw_direct.sessions_yield`; the completion arrives as the next model-visible input. Use native `wait_agent` only for an intentional same-turn wait when the immediate next step is blocked on the child. Never loop-poll for native child completion." : void 0,
+		delegationGuidanceAvailable ? buildDelegationGuidanceSection({
+			mode: resolveMainSessionDelegationMode({
+				config: params.config,
+				agentId: params.agentId,
+				sessionKey: params.sessionKey
+			}),
+			isMinimal: params.promptMode === "minimal" || params.promptMode === "none",
+			hiddenDelegationTool: nativeDelegationAvailable ? "native `spawn_agent`" : hasSessionsSpawn ? "`sessions_spawn`" : "",
+			hasVisibleSessionSpawn: hasSessionsSpawn,
+			hasSessionsYield,
+			hasSubagentsList,
+			hasSessionsSend
+		}).join("\n") : void 0,
+		buildHarnessVisibleReplyGuidance({
+			sourceReplyDeliveryMode: params.sourceReplyDeliveryMode,
+			messageToolAvailable
+		}),
+		TRANSCRIPT_CREDENTIAL_SAFETY_PROMPT,
 		nativeCommandGuidance,
 		params.extraSystemPrompt
 	].filter((section) => typeof section === "string" && section.trim()).join("\n\n");
 }
-function buildVisibleReplyInstruction(params, messageToolAvailable) {
-	if (params.sourceReplyDeliveryMode === "message_tool_only" && messageToolAvailable) return "Visible source replies are not automatically delivered for this run. Use `message(action=send)` for user-visible source-channel output. For progress, set `final=false`. When the message is the completed reply to the current source conversation, set `final=true`; OpenClaw stops after confirming delivery. If `final` is omitted, OpenClaw continues and resolves the latest omitted source reply only when the turn ends successfully. Do not repeat visible message content in your final answer.";
-	if (messageToolAvailable) return "For the current source conversation, reply normally in your final assistant message; OpenClaw will deliver it through the active source conversation. Use `message` only for explicit out-of-band sends, media/file sends, or sends to a different target.";
-	return "For the current source conversation, reply normally in your final assistant message; OpenClaw will deliver it through the active source conversation.";
+//#endregion
+//#region extensions/codex/src/app-server/thread-shell-environment.ts
+/** Applies host-selected values and any required login-shell restriction last. */
+function applyCodexManagedShellEnvironment(config, environment, disableLoginShell = false) {
+	if (!environment || Object.keys(environment).length === 0) return disableLoginShell ? {
+		...config,
+		allow_login_shell: false
+	} : config;
+	const current = isJsonObject(config.shell_environment_policy) ? config.shell_environment_policy : {};
+	const currentSet = isJsonObject(current.set) ? current.set : {};
+	const names = Object.keys(environment).toSorted();
+	const includeOnly = Array.isArray(current.include_only) ? current.include_only.filter((entry) => typeof entry === "string") : [];
+	const filters = isJsonObject(current.filters) ? current.filters : void 0;
+	const hasIncludeFilter = filters && Object.values(filters).includes("include");
+	const managedConfig = {
+		...config,
+		shell_environment_policy: {
+			...current,
+			experimental_use_profile: false,
+			set: {
+				...currentSet,
+				...environment
+			},
+			...filters ? hasIncludeFilter ? { filters: {
+				...filters,
+				...Object.fromEntries(names.map((name) => [name, "include"]))
+			} } : {} : includeOnly.length > 0 ? { include_only: [.../* @__PURE__ */ new Set([...includeOnly, ...names])] } : {}
+		}
+	};
+	return disableLoginShell ? {
+		...managedConfig,
+		allow_login_shell: false
+	} : managedConfig;
 }
 //#endregion
 //#region extensions/codex/src/app-server/web-search.ts
@@ -2149,16 +2199,13 @@ const CODEX_NATIVE_WEB_SEARCH_DISABLED_CONFIG = {
 	"features.standalone_web_search": false,
 	web_search: "disabled"
 };
-function normalizeOptionalString$1(value) {
-	return typeof value === "string" ? value.trim() || void 0 : void 0;
-}
 function normalizeUniqueStrings(value) {
 	if (!Array.isArray(value)) return;
-	const normalized = [...new Set(value.map(normalizeOptionalString$1).filter((entry) => Boolean(entry)))];
+	const normalized = [...new Set(value.map(normalizeOptionalString).filter((entry) => Boolean(entry)))];
 	return normalized.length > 0 ? normalized : void 0;
 }
 function hasManagedSearchProvider(config) {
-	return normalizeOptionalString$1(config?.tools?.web?.search?.provider) !== void 0;
+	return normalizeOptionalString(config?.tools?.web?.search?.provider) !== void 0;
 }
 function hasNativeDomainRestrictions(config) {
 	return normalizeUniqueStrings(config?.tools?.web?.search?.openaiCodex?.allowedDomains) !== void 0;
@@ -2173,10 +2220,10 @@ function buildCodexNativeWebSearchThreadConfig(config) {
 	if (allowedDomains) threadConfig["tools.web_search.allowed_domains"] = allowedDomains;
 	if (nativeConfig?.contextSize) threadConfig["tools.web_search.context_size"] = nativeConfig.contextSize;
 	const location = nativeConfig?.userLocation;
-	const country = normalizeOptionalString$1(location?.country);
-	const region = normalizeOptionalString$1(location?.region);
-	const city = normalizeOptionalString$1(location?.city);
-	const timezone = normalizeOptionalString$1(location?.timezone);
+	const country = normalizeOptionalString(location?.country);
+	const region = normalizeOptionalString(location?.region);
+	const city = normalizeOptionalString(location?.city);
+	const timezone = normalizeOptionalString(location?.timezone);
 	if (country) threadConfig["tools.web_search.location.country"] = country;
 	if (region) threadConfig["tools.web_search.location.region"] = region;
 	if (city) threadConfig["tools.web_search.location.city"] = city;
@@ -2207,7 +2254,8 @@ function resolveCodexWebSearchPlan(params) {
 	return {
 		kind: "native-hosted",
 		suppressManagedWebSearch: true,
-		threadConfig: buildCodexNativeWebSearchThreadConfig(params.config)
+		threadConfig: buildCodexNativeWebSearchThreadConfig(params.config),
+		webFetchHostnameAllowlist: buildHostnameAllowlistPolicyFromSuffixAllowlist(nativeConfig?.allowedDomains)?.hostnameAllowlist
 	};
 }
 const CODEX_CODE_MODE_THREAD_CONFIG = {
@@ -2216,32 +2264,56 @@ const CODEX_CODE_MODE_THREAD_CONFIG = {
 	"features.apply_patch_streaming_events": true
 };
 const CODEX_GOAL_CONTINUATION_DISABLED_THREAD_CONFIG = { "features.goals": false };
+const CODEX_NATIVE_UPDATE_PLAN_DISABLED_THREAD_CONFIG = { "tools.update_plan.enabled": false };
 const CODEX_CODE_MODE_DISABLED_THREAD_CONFIG = {
 	"features.code_mode": false,
 	"features.code_mode_only": false
 };
-const CODEX_LIGHTWEIGHT_CONTEXT_THREAD_CONFIG = { project_doc_max_bytes: 0 };
+const CODEX_NO_PROJECT_DOCS_CONFIG = { project_doc_max_bytes: 0 };
 const CODEX_TOOL_SEARCH_UNSUPPORTED_THREAD_CONFIG = { "features.multi_agent": false };
 const CODEX_DELEGATION_DISABLED_THREAD_CONFIG = {
+	"agents.enabled": false,
 	"features.multi_agent": false,
 	"features.multi_agent_v2": false
 };
+const CODEX_RING_ZERO_RESTRICTED_FEATURES = /* @__PURE__ */ new Set([
+	"apps",
+	"artifact",
+	"browser_use",
+	"browser_use_external",
+	"browser_use_full_cdp_access",
+	"chronicle",
+	"code_mode",
+	"code_mode_only",
+	"computer_use",
+	"current_time_reminder",
+	"default_mode_request_user_input",
+	"deferred_executor",
+	"goals",
+	"hooks",
+	"image_generation",
+	"memories",
+	"multi_agent",
+	"multi_agent_v2",
+	"plugins",
+	"request_permissions_tool",
+	"skill_search",
+	"shell_tool",
+	"standalone_web_search",
+	"token_budget",
+	"unified_exec",
+	"view_image",
+	"web_search_cached",
+	"web_search_request",
+	"workspace_dependencies"
+]);
 const CODEX_RING_ZERO_THREAD_CONFIG = {
-	"features.apps": false,
-	"features.current_time_reminder": false,
-	"features.deferred_executor": false,
-	"features.enable_fanout": false,
-	"features.goals": false,
-	"features.hooks": false,
-	"features.image_generation": false,
-	"features.memories": false,
-	"features.multi_agent": false,
-	"features.multi_agent_v2": false,
-	"features.plugins": false,
-	"features.standalone_web_search": false,
-	"features.token_budget": false,
+	...CODEX_DELEGATION_DISABLED_THREAD_CONFIG,
+	...Object.fromEntries([...CODEX_RING_ZERO_RESTRICTED_FEATURES].map((feature) => [`features.${feature}`, false])),
 	"orchestrator.mcp.enabled": false,
 	"orchestrator.skills.enabled": false,
+	"skills.bundled.enabled": false,
+	"skills.include_instructions": false,
 	"tools.experimental_request_user_input.enabled": false,
 	hooks: {
 		PreToolUse: [],
@@ -2255,28 +2327,19 @@ const CODEX_RING_ZERO_THREAD_CONFIG = {
 		SubagentStop: [],
 		Stop: []
 	},
-	project_doc_max_bytes: 0,
 	notify: [],
 	web_search: "disabled"
 };
-const CODEX_RING_ZERO_RESTRICTED_FEATURES = /* @__PURE__ */ new Set([
-	"apps",
-	"code_mode",
-	"code_mode_only",
-	"current_time_reminder",
-	"deferred_executor",
-	"enable_fanout",
-	"goals",
-	"hooks",
-	"image_generation",
-	"memories",
-	"multi_agent",
-	"multi_agent_v2",
-	"plugins",
-	"standalone_web_search",
-	"token_budget"
+const CODEX_RING_ZERO_RESTRICTED_FEATURE_ALIASES = /* @__PURE__ */ new Map([
+	["connectors", "apps"],
+	["imagegenext", "image_generation"],
+	["collab", "multi_agent"],
+	["memory_tool", "memories"],
+	["telepathy", "chronicle"],
+	["codex_hooks", "hooks"]
 ]);
 const CODEX_RING_ZERO_OVERRIDABLE_LAYER_TYPES = /* @__PURE__ */ new Set([
+	"packagedDefaults",
 	"mdm",
 	"system",
 	"enterpriseManaged",
@@ -2305,6 +2368,7 @@ function buildThreadStartParams(params, options) {
 		model: modelSelection.model,
 		...modelSelection.modelProvider ? { modelProvider: modelSelection.modelProvider } : {},
 		cwd: options.cwd,
+		...options.appServer.sessionRoot ? { runtimeWorkspaceRoots: [options.appServer.sessionRoot] } : {},
 		approvalPolicy: options.appServer.approvalPolicy,
 		approvalsReviewer: resolveCodexThreadApprovalsReviewer(options.appServer, options.config),
 		...codexThreadSandboxOrPermissions(options.appServer),
@@ -2320,7 +2384,9 @@ function buildThreadStartParams(params, options) {
 			webSearchAllowed: options.webSearchAllowed,
 			appServer: options.appServer,
 			hostSystemAgentActive: options.hostSystemAgentActive,
-			ringZeroInheritedMcpServerNames: options.ringZeroInheritedMcpServerNames
+			restrictedToolSurfaceInheritedMcpServerNames: options.restrictedToolSurfaceInheritedMcpServerNames,
+			shellEnvironment: options.shellEnvironment,
+			disableLoginShell: options.disableLoginShell
 		}),
 		...resolveCodexThreadEnvironmentSelection(options),
 		developerInstructions: options.developerInstructions ?? buildDeveloperInstructions(params, { dynamicTools: options.dynamicTools }),
@@ -2346,6 +2412,8 @@ function buildThreadResumeParams(params, options) {
 	});
 	return {
 		threadId: options.threadId,
+		...options.cwd ? { cwd: options.cwd } : {},
+		...options.appServer.sessionRoot ? { runtimeWorkspaceRoots: [options.appServer.sessionRoot] } : {},
 		excludeTurns: true,
 		initialTurnsPage: {
 			limit: 1,
@@ -2369,29 +2437,38 @@ function buildThreadResumeParams(params, options) {
 			webSearchAllowed: options.webSearchAllowed,
 			appServer: options.appServer,
 			hostSystemAgentActive: options.hostSystemAgentActive,
-			ringZeroInheritedMcpServerNames: options.ringZeroInheritedMcpServerNames
+			restrictedToolSurfaceInheritedMcpServerNames: options.restrictedToolSurfaceInheritedMcpServerNames,
+			shellEnvironment: options.shellEnvironment,
+			disableLoginShell: options.disableLoginShell
 		}),
 		developerInstructions: options.developerInstructions ?? buildDeveloperInstructions(params, { dynamicTools: options.dynamicTools })
 	};
 }
 function buildCodexRuntimeThreadConfig(config, options = {}) {
+	const configured = buildCodexProjectDocThreadConfig(config);
 	const codeModeConfig = {
 		...CODEX_CODE_MODE_THREAD_CONFIG,
 		"features.code_mode_only": options.nativeCodeModeOnlyEnabled === true
 	};
 	if (options.nativeCodeModeEnabled === false) {
-		const disabledConfig = mergeCodexThreadConfigs(config, CODEX_CODE_MODE_DISABLED_THREAD_CONFIG, CODEX_GOAL_CONTINUATION_DISABLED_THREAD_CONFIG) ?? { ...CODEX_CODE_MODE_DISABLED_THREAD_CONFIG };
+		const disabledConfig = mergeCodexThreadConfigs(configured, CODEX_CODE_MODE_DISABLED_THREAD_CONFIG, CODEX_GOAL_CONTINUATION_DISABLED_THREAD_CONFIG, CODEX_NATIVE_UPDATE_PLAN_DISABLED_THREAD_CONFIG) ?? {
+			...CODEX_CODE_MODE_DISABLED_THREAD_CONFIG,
+			...CODEX_GOAL_CONTINUATION_DISABLED_THREAD_CONFIG,
+			...CODEX_NATIVE_UPDATE_PLAN_DISABLED_THREAD_CONFIG
+		};
 		delete disabledConfig["features.apply_patch_streaming_events"];
 		return disabledConfig;
 	}
-	if (options.nativeCodeModeOnlyEnabled === true) return ensureDirectOnlyToolNamespaces(mergeCodexThreadConfigs(codeModeConfig, config, CODEX_GOAL_CONTINUATION_DISABLED_THREAD_CONFIG, { "features.code_mode_only": true }) ?? {
+	if (options.nativeCodeModeOnlyEnabled === true) return ensureDirectOnlyToolNamespaces(mergeCodexThreadConfigs(codeModeConfig, configured, CODEX_GOAL_CONTINUATION_DISABLED_THREAD_CONFIG, CODEX_NATIVE_UPDATE_PLAN_DISABLED_THREAD_CONFIG, { "features.code_mode_only": true }) ?? {
 		...codeModeConfig,
 		...CODEX_GOAL_CONTINUATION_DISABLED_THREAD_CONFIG,
+		...CODEX_NATIVE_UPDATE_PLAN_DISABLED_THREAD_CONFIG,
 		"features.code_mode_only": true
 	}, options.directOnlyToolNamespaces);
-	return ensureDirectOnlyToolNamespaces(mergeCodexThreadConfigs(codeModeConfig, config, CODEX_GOAL_CONTINUATION_DISABLED_THREAD_CONFIG) ?? {
+	return ensureDirectOnlyToolNamespaces(mergeCodexThreadConfigs(codeModeConfig, configured, CODEX_GOAL_CONTINUATION_DISABLED_THREAD_CONFIG, CODEX_NATIVE_UPDATE_PLAN_DISABLED_THREAD_CONFIG) ?? {
 		...codeModeConfig,
-		...CODEX_GOAL_CONTINUATION_DISABLED_THREAD_CONFIG
+		...CODEX_GOAL_CONTINUATION_DISABLED_THREAD_CONFIG,
+		...CODEX_NATIVE_UPDATE_PLAN_DISABLED_THREAD_CONFIG
 	}, options.directOnlyToolNamespaces);
 }
 function ensureDirectOnlyToolNamespaces(config, requiredNamespaces) {
@@ -2408,9 +2485,16 @@ function resolveDirectOnlyToolNamespaces(dynamicTools) {
 }
 function buildCodexRuntimeThreadConfigForRun(params, config, options = {}) {
 	const ringZeroActive = (options.hostSystemAgentActive ?? isHostScopedAgentToolActive("openclaw")) && isSystemAgentOnlyCodexDynamicToolAllowlist(params.toolsAllow);
+	const messageOnlySourceReply = isMessageOnlyCodexSourceReply(params);
+	const restrictedToolSurface = ringZeroActive || messageOnlySourceReply || params.pluginHarnessToolPolicyRestricted === true;
+	const restrictedTurnDisablesProjectDocs = ringZeroActive || messageOnlySourceReply || params.pluginHarnessToolPolicyRestricted && params.disableTools;
 	const configMcpServers = config?.mcp_servers;
-	if (ringZeroActive && configMcpServers !== void 0 && !isJsonObject(configMcpServers)) throw new Error("Codex ring-zero received invalid thread mcp_servers config");
-	const ringZeroMcpServerNames = [...options.ringZeroInheritedMcpServerNames ?? [], ...isJsonObject(configMcpServers) ? Object.keys(configMcpServers) : []];
+	if (restrictedToolSurface && configMcpServers !== void 0 && !isJsonObject(configMcpServers)) throw new Error("Codex restricted tool surface received invalid thread mcp_servers config");
+	const restrictedToolSurfaceMcpServerNames = [...options.restrictedToolSurfaceInheritedMcpServerNames ?? [], ...isJsonObject(configMcpServers) ? Object.keys(configMcpServers) : []];
+	const restrictedRunConfig = restrictedToolSurface && isJsonObject(configMcpServers) ? {
+		...config,
+		mcp_servers: {}
+	} : config;
 	const webSearchConfig = resolveCodexWebSearchPlan({
 		config: params.config,
 		disableTools: params.disableTools,
@@ -2418,16 +2502,20 @@ function buildCodexRuntimeThreadConfigForRun(params, config, options = {}) {
 		nativeProviderWebSearchSupport: options.nativeProviderWebSearchSupport,
 		webSearchAllowed: options.webSearchAllowed
 	}).threadConfig;
-	const baseConfig = buildCodexRuntimeThreadConfig(mergeCodexThreadConfigs(config, webSearchConfig), options);
-	const runtimeConfig = mergeCodexThreadConfigs(baseConfig, options.appServer?.networkProxy?.configPatch, shouldDisableCodexToolSearchForModel(params.modelId) ? CODEX_TOOL_SEARCH_UNSUPPORTED_THREAD_CONFIG : void 0, params.delegationCapability === "report_only" ? CODEX_DELEGATION_DISABLED_THREAD_CONFIG : void 0, buildCodexRingZeroThreadConfigPatch(params, options.hostSystemAgentActive, ringZeroMcpServerNames)) ?? baseConfig;
-	if (params.bootstrapContextMode !== "lightweight") return runtimeConfig;
-	return mergeCodexThreadConfigs(runtimeConfig, CODEX_LIGHTWEIGHT_CONTEXT_THREAD_CONFIG) ?? {
-		...runtimeConfig,
-		...CODEX_LIGHTWEIGHT_CONTEXT_THREAD_CONFIG
-	};
+	const baseConfig = buildCodexRuntimeThreadConfig(mergeCodexThreadConfigs(restrictedRunConfig, webSearchConfig), options);
+	return applyCodexManagedShellEnvironment({
+		...mergeCodexThreadConfigs(baseConfig, options.appServer?.networkProxy?.configPatch, params.pluginHarnessToolPolicySafeDeniedTools?.includes("image_generate") ? { "features.image_generation": false } : void 0, shouldDisableCodexToolSearchForModel(params.modelId) ? CODEX_TOOL_SEARCH_UNSUPPORTED_THREAD_CONFIG : void 0, params.delegationCapability === "report_only" ? CODEX_DELEGATION_DISABLED_THREAD_CONFIG : void 0, messageOnlySourceReply || params.pluginHarnessToolPolicyRestricted === true ? buildRestrictedToolConfigPatch(restrictedToolSurfaceMcpServerNames) : buildCodexRingZeroThreadConfigPatch(params, options.hostSystemAgentActive, restrictedToolSurfaceMcpServerNames), restrictedTurnDisablesProjectDocs ? CODEX_NO_PROJECT_DOCS_CONFIG : void 0, params.authoredContextTokenCap === void 0 ? void 0 : { model_context_window: params.authoredContextTokenCap }) ?? baseConfig,
+		...params.bootstrapContextMode === "lightweight" ? CODEX_NO_PROJECT_DOCS_CONFIG : {}
+	}, options.shellEnvironment, options.disableLoginShell);
 }
 function buildCodexRingZeroThreadConfigPatch(params, hostSystemAgentActive = isHostScopedAgentToolActive("openclaw"), inheritedMcpServerNames = []) {
 	if (!hostSystemAgentActive || !isSystemAgentOnlyCodexDynamicToolAllowlist(params.toolsAllow)) return;
+	return {
+		...buildRestrictedToolConfigPatch(inheritedMcpServerNames),
+		...CODEX_NO_PROJECT_DOCS_CONFIG
+	};
+}
+function buildRestrictedToolConfigPatch(inheritedMcpServerNames) {
 	const mcpServers = Object.fromEntries([...new Set(inheritedMcpServerNames)].toSorted().map((name) => [name, { enabled: false }]));
 	return {
 		...CODEX_RING_ZERO_THREAD_CONFIG,
@@ -2443,20 +2531,20 @@ async function readCodexInheritedMcpServerNames(client, cwd, signal) {
 	if (!Array.isArray(response.layers)) throw new Error("Codex config/read omitted effective config layers");
 	for (const layer of response.layers) {
 		if (!isJsonObject(layer) || !isJsonObject(layer.name) || typeof layer.name.type !== "string") throw new Error("Codex config/read returned invalid effective config layers");
-		if (layer.name.type === "legacyManagedConfigTomlFromFile" || layer.name.type === "legacyManagedConfigTomlFromMdm") throw new Error(`Codex ring-zero cannot override config layer ${layer.name.type}`);
-		if (!CODEX_RING_ZERO_OVERRIDABLE_LAYER_TYPES.has(layer.name.type)) throw new Error(`Codex ring-zero does not recognize config layer ${layer.name.type}`);
+		if (layer.name.type === "legacyManagedConfigTomlFromFile" || layer.name.type === "legacyManagedConfigTomlFromMdm") throw new Error(`Codex restricted tool surface cannot override config layer ${layer.name.type}`);
+		if (!CODEX_RING_ZERO_OVERRIDABLE_LAYER_TYPES.has(layer.name.type)) throw new Error(`Codex restricted tool surface does not recognize config layer ${layer.name.type}`);
 	}
 	const configuredServers = response.config.mcp_servers;
 	if (configuredServers === void 0) return [];
 	if (!isJsonObject(configuredServers)) throw new Error("Codex config/read returned invalid mcp_servers");
 	return Object.keys(configuredServers).toSorted();
 }
-async function assertCodexRingZeroHasNoManagedHooks(client, signal) {
+async function assertCodexManagedRequirementsDoNotOverrideToolPolicy(client, options, signal) {
 	const response = await client.request("configRequirements/read", void 0, { signal });
 	if (!isJsonObject(response) || !Object.hasOwn(response, "requirements")) throw new Error("Codex configRequirements/read returned an invalid response");
 	if (response.requirements === null) return;
 	if (!isJsonObject(response.requirements)) throw new Error("Codex configRequirements/read returned invalid requirements");
-	for (const key of [
+	if (options.restrictedToolSurface) for (const key of [
 		"hooks",
 		"managedHooks",
 		"managed_hooks"
@@ -2464,30 +2552,45 @@ async function assertCodexRingZeroHasNoManagedHooks(client, signal) {
 		const hooks = response.requirements[key];
 		if (hooks === void 0 || hooks === null) continue;
 		if (!isJsonObject(hooks)) throw new Error("Codex configRequirements/read returned invalid managed hooks");
-		if (hasNonEmptyJsonValue(hooks)) throw new Error("Codex ring-zero cannot override managed hooks");
+		if (hasNonEmptyJsonValue(hooks)) throw new Error("Codex restricted tool surface cannot override managed hooks");
 	}
+	const additionalDeniedFeatures = new Set(options.additionalDeniedFeatures);
 	for (const key of ["featureRequirements", "feature_requirements"]) {
 		const requirements = response.requirements[key];
 		if (requirements === void 0 || requirements === null) continue;
 		if (!isJsonObject(requirements)) throw new Error("Codex configRequirements/read returned invalid feature requirements");
 		for (const [feature, enabled] of Object.entries(requirements)) {
 			if (typeof enabled !== "boolean") throw new Error("Codex configRequirements/read returned invalid feature requirements");
-			if (enabled && CODEX_RING_ZERO_RESTRICTED_FEATURES.has(feature)) throw new Error(`Codex ring-zero cannot override required feature ${feature}`);
+			const canonicalFeature = CODEX_RING_ZERO_RESTRICTED_FEATURE_ALIASES.get(feature) ?? feature;
+			const deniedByToolPolicy = options.restrictedToolSurface && CODEX_RING_ZERO_RESTRICTED_FEATURES.has(canonicalFeature) || additionalDeniedFeatures.has(canonicalFeature);
+			if (enabled && deniedByToolPolicy) throw new Error(`Codex tool policy cannot override required feature ${feature}`);
 		}
 	}
 }
-async function attestCodexRingZeroThreadHasNoMcpServers(client, threadId, signal) {
+async function attestCodexRestrictedToolSurfaceMcpServersDisabled(client, threadId, threadConfig, signal) {
+	const configuredServers = threadConfig?.mcp_servers;
+	if (configuredServers !== void 0 && !isJsonObject(configuredServers)) throw new Error("Codex restricted-tool-surface thread config has invalid mcp_servers");
+	const expectedDisabledServerNames = /* @__PURE__ */ new Set();
+	for (const [name, serverConfig] of Object.entries(configuredServers ?? {})) {
+		if (!isJsonObject(serverConfig) || serverConfig.enabled !== false) throw new Error(`Codex restricted-tool-surface MCP server ${name} is not disabled`);
+		expectedDisabledServerNames.add(name);
+	}
 	const response = await client.request("mcpServerStatus/list", {
 		threadId,
-		limit: 1,
 		detail: "toolsAndAuthOnly"
 	}, { signal });
-	if (!isJsonObject(response) || !Array.isArray(response.data)) throw new Error("Codex mcpServerStatus/list returned an invalid ring-zero attestation");
-	if (response.data.length > 0) {
-		const first = response.data[0];
-		const serverName = isJsonObject(first) && typeof first.name === "string" ? first.name : "unknown";
-		throw new Error(`Codex ring-zero MCP attestation found server ${serverName}`);
+	if (!isJsonObject(response) || !Array.isArray(response.data)) throw new Error("Codex mcpServerStatus/list returned an invalid restricted-tool-surface attestation");
+	const observedDisabledServerNames = /* @__PURE__ */ new Set();
+	for (const status of response.data) {
+		if (!isJsonObject(status) || typeof status.name !== "string" || !isJsonObject(status.tools)) throw new Error("Codex mcpServerStatus/list returned an invalid restricted-tool-surface server");
+		if (!expectedDisabledServerNames.has(status.name)) throw new Error(`Codex restricted-tool-surface MCP attestation found unexpected server ${status.name}`);
+		if (observedDisabledServerNames.has(status.name)) throw new Error(`Codex restricted-tool-surface MCP attestation returned duplicate server ${status.name}`);
+		observedDisabledServerNames.add(status.name);
+		if (!Object.hasOwn(status, "serverInfo")) throw new Error(`Codex restricted-tool-surface MCP attestation returned malformed server ${status.name}`);
+		if (status.serverInfo !== null) throw new Error(`Codex restricted-tool-surface MCP attestation found active server ${status.name}`);
+		if (Object.keys(status.tools).length > 0) throw new Error(`Codex restricted-tool-surface MCP attestation found tools for server ${status.name}`);
 	}
+	for (const expectedName of expectedDisabledServerNames) if (!observedDisabledServerNames.has(expectedName)) throw new Error(`Codex restricted-tool-surface MCP attestation is missing server ${expectedName}`);
 	if (response.nextCursor !== void 0 && response.nextCursor !== null) throw new Error("Codex mcpServerStatus/list returned an invalid empty-page cursor");
 }
 function hasNonEmptyJsonValue(value) {
@@ -2509,40 +2612,23 @@ function resolveCodexThreadEnvironmentSelection(options) {
 	return {};
 }
 //#endregion
-//#region extensions/codex/src/app-server/thread-resume.ts
-/** Owns Codex thread/resume subscription safety. */
-/** Resumes one thread and retires the physical client when acceptance is indeterminate. */
-async function resumeCodexAppServerThread(params) {
-	const threadId = params.request.threadId;
-	let response;
-	try {
-		response = assertCodexThreadResumeResponse(await params.client.request("thread/resume", params.request, {
-			...params.timeoutMs !== void 0 ? { timeoutMs: params.timeoutMs } : {},
-			...params.signal ? { signal: params.signal } : {}
-		}));
-		assertCodexThreadResumeSubscription(threadId, response.thread.id);
-	} catch (error) {
-		if (isCodexAppServerStartSelectionChangedError(error) || isCodexAppServerPrewriteRequestCancellationError(error)) throw error;
-		if (error instanceof CodexAppServerRpcError) throw error;
-		try {
-			await params.abandonClient();
-		} catch (abandonError) {
-			throw new CodexAppServerUnsafeSubscriptionError(`Codex thread/resume client could not be retired for ${threadId}`, { cause: abandonError });
-		}
-		if (error instanceof CodexAppServerUnsafeSubscriptionError) throw error;
-		throw new CodexAppServerUnsafeSubscriptionError(error instanceof Error ? error.message : `Codex thread/resume outcome is indeterminate for ${threadId}`, { cause: error });
-	}
-	return response;
-}
-//#endregion
 //#region extensions/codex/src/app-server/thread-lifecycle-io.ts
+function resolveManagedThreadSourceHomeId(params) {
+	const agentId = resolveSessionAgentIds$1({
+		config: params.params.config,
+		sessionKey: params.params.sessionKey,
+		agentId: params.agentId ?? params.params.agentId
+	}).sessionAgentId;
+	const agentDir = params.agentDir ?? params.params.agentDir ?? resolveAgentDir$1(params.params.config ?? {}, agentId);
+	return codexCatalogHomeId(resolveCodexAppServerLocalHomeDir(params.appServer.start, agentDir));
+}
 function resolveCodexThreadRolloutPath(thread) {
 	const rolloutPath = thread.path?.trim();
 	if (!rolloutPath || !path.isAbsolute(rolloutPath) || path.extname(rolloutPath) !== ".jsonl" || !path.basename(rolloutPath).includes(thread.id)) return;
 	return rolloutPath;
 }
 async function resumeExistingCodexThread(params, context) {
-	const { binding: resumeBinding, bindingIdentity, startModelSelection, startModelProvider, userMcpServersConfigPatch, dynamicToolsFingerprint, dynamicToolsContainDeferred, webSearchThreadConfigFingerprint, nativeSkillIsolationFingerprint, userMcpServersFingerprint, ringZeroConfigFingerprint, ringZeroClientInstanceId, networkProxyConfigFingerprint, contextEngineBinding, environmentSelectionFingerprint, hostSystemAgentActive, ringZeroActive, ringZeroInheritedMcpServerNames, nativeSkillIsolation, lifecycleTiming, normalizeBindingModelProvider, throwIfAborted, clearCurrentBinding } = context;
+	const { binding: resumeBinding, bindingIdentity, startModelSelection, startModelProvider, userMcpServersConfigPatch, dynamicToolsFingerprint, dynamicToolsContainDeferred, webSearchThreadConfigFingerprint, nativeSkillIsolationFingerprint, userMcpServersFingerprint, ringZeroConfigFingerprint, ringZeroClientInstanceId, networkProxyConfigFingerprint, contextEngineBinding, environmentSelectionFingerprint, hostSystemAgentActive, ringZeroActive, restrictedToolSurface, restrictedToolSurfaceInheritedMcpServerNames, nativeSkillIsolation, lifecycleTiming, normalizeBindingModelProvider, throwIfAborted, clearCurrentBinding } = context;
 	let resumeReservation;
 	try {
 		const authProfileId = resumeBinding.connectionScope === "supervision" ? void 0 : params.params.authProfileId ?? resumeBinding.authProfileId;
@@ -2553,10 +2639,11 @@ async function resumeExistingCodexThread(params, context) {
 			configPatch: params.finalConfigPatch,
 			nativeHookRelayGeneration: params.nativeHookRelayGeneration
 		};
-		const pluginAppsConfigPatch = params.pluginThreadConfig?.enabled && resumeBinding.pluginAppPolicyContext ? buildCodexPluginAppsConfigPatchFromPolicyContext(resumeBinding.pluginAppPolicyContext) : void 0;
+		const pluginAppsConfigPatch = context.prebuiltPluginThreadConfig?.configPatch ?? (params.pluginThreadConfig?.enabled && resumeBinding.pluginAppPolicyContext ? buildCodexPluginAppsConfigPatchFromPolicyContext(resumeBinding.pluginAppPolicyContext) : void 0);
 		const resumeConfig = applyCodexNativeSkillIsolation(mergeCodexThreadConfigs(params.config, userMcpServersConfigPatch, pluginAppsConfigPatch, finalConfigPatch.configPatch), nativeSkillIsolation);
 		const resumeParams = lifecycleTiming.measureSync("thread-resume-params", () => buildThreadResumeParams(params.params, {
 			threadId: resumeBinding.threadId,
+			cwd: params.cwd,
 			authProfileId,
 			model: startModelSelection.model,
 			modelProvider: startModelProvider,
@@ -2570,7 +2657,9 @@ async function resumeExistingCodexThread(params, context) {
 			nativeCodeModeOnlyEnabled: params.nativeCodeModeOnlyEnabled,
 			webSearchAllowed: params.webSearchAllowed,
 			hostSystemAgentActive,
-			ringZeroInheritedMcpServerNames
+			restrictedToolSurfaceInheritedMcpServerNames,
+			shellEnvironment: params.shellEnvironment,
+			disableLoginShell: params.disableLoginShell
 		}));
 		const requestModelProvider = typeof resumeParams.modelProvider === "string" && resumeParams.modelProvider.trim() ? resumeParams.modelProvider : void 0;
 		throwIfAborted();
@@ -2589,16 +2678,17 @@ async function resumeExistingCodexThread(params, context) {
 			request: resumeParams,
 			signal: params.signal
 		}));
-		if (ringZeroActive) try {
-			await lifecycleTiming.measure("ring-zero-mcp-attestation", () => attestCodexRingZeroThreadHasNoMcpServers(params.client, response.thread.id, params.signal));
+		if (ringZeroActive || isMessageOnlyCodexSourceReply(params.params) || params.params.pluginHarnessToolPolicyRestricted === true) try {
+			await lifecycleTiming.measure("restricted-tool-surface-mcp-attestation", () => attestCodexRestrictedToolSurfaceMcpServersDisabled(params.client, response.thread.id, resumeParams.config, params.signal));
 		} catch (error) {
 			await (params.abandonClient ?? (() => closeCodexStartupClientBestEffort(params.client)))();
-			throw new CodexRingZeroAttestationError(error);
+			throw new CodexRestrictedToolSurfaceAttestationError(error);
 		}
 		throwIfAborted();
 		const boundAuthProfileId = authProfileId;
 		const nextMcpServersFingerprint = params.mcpServersFingerprintEvaluated === true ? params.mcpServersFingerprint : resumeBinding.mcpServersFingerprint;
 		const resumePatch = {
+			clientId: resolveCodexAppServerClientInstanceId(params.client),
 			cwd: params.cwd,
 			rolloutPath: resolveCodexThreadRolloutPath(response.thread) ?? resumeBinding.rolloutPath,
 			authProfileId: boundAuthProfileId,
@@ -2611,15 +2701,17 @@ async function resumeExistingCodexThread(params, context) {
 			nativeSkillIsolationFingerprint,
 			userMcpServersFingerprint,
 			mcpServersFingerprint: nextMcpServersFingerprint,
+			configuredMcpOwnershipVersion: params.configuredMcpOwnershipVersion,
 			ringZeroConfigFingerprint,
 			ringZeroClientInstanceId,
+			nativeToolPolicyRestricted: restrictedToolSurface ? true : void 0,
 			networkProxyProfileName: params.appServer.networkProxy?.profileName,
 			networkProxyConfigFingerprint,
 			nativeHookRelayGeneration: finalConfigPatch.nativeHookRelayGeneration ?? resumeBinding.nativeHookRelayGeneration,
 			appServerRuntimeFingerprint: resumeBinding.connectionScope === "supervision" ? buildCodexAppServerConnectionFingerprint(params.appServer, params.params.agentDir) : params.appServerRuntimeFingerprint,
-			pluginAppsFingerprint: resumeBinding.pluginAppsFingerprint,
-			pluginAppsInputFingerprint: resumeBinding.pluginAppsInputFingerprint,
-			pluginAppPolicyContext: resumeBinding.pluginAppPolicyContext,
+			pluginAppsFingerprint: context.prebuiltPluginThreadConfig?.fingerprint ?? resumeBinding.pluginAppsFingerprint,
+			pluginAppsInputFingerprint: context.prebuiltPluginThreadConfig?.inputFingerprint ?? resumeBinding.pluginAppsInputFingerprint,
+			pluginAppPolicyContext: context.prebuiltPluginThreadConfig?.policyContext ?? resumeBinding.pluginAppPolicyContext,
 			contextEngine: contextEngineBinding,
 			environmentSelectionFingerprint
 		};
@@ -2665,8 +2757,8 @@ async function resumeExistingCodexThread(params, context) {
 	} catch (error) {
 		resumeReservation?.release();
 		if (isCodexAppServerStartSelectionChangedError(error)) throw error;
-		if (error instanceof CodexRingZeroAttestationError) {
-			await clearCurrentBinding("retiring a failed ring-zero thread attestation");
+		if (error instanceof CodexRestrictedToolSurfaceAttestationError) {
+			await clearCurrentBinding("retiring a failed restricted-tool-surface attestation");
 			throw error;
 		}
 		if (error instanceof CodexAdoptedThreadActiveError) throw error;
@@ -2683,7 +2775,7 @@ async function resumeExistingCodexThread(params, context) {
 }
 async function startFreshCodexThread(params, context) {
 	const clientId = resolveCodexAppServerClientInstanceId(params.client);
-	const { bindingIdentity, startModelSelection, startModelProvider, userMcpServersConfigPatch, dynamicToolsFingerprint, dynamicToolsContainDeferred, webSearchThreadConfigFingerprint, nativeSkillIsolationFingerprint, userMcpServersFingerprint, ringZeroConfigFingerprint, ringZeroClientInstanceId, networkProxyConfigFingerprint, contextEngineBinding, environmentSelectionFingerprint, hostSystemAgentActive, ringZeroActive, ringZeroInheritedMcpServerNames, nativeSkillIsolation, lifecycleTiming, normalizeBindingModelProvider, throwIfAborted, prebuiltPluginThreadConfig, preserveExistingBinding, rotatedContextEngineBinding } = context;
+	const { bindingIdentity, startModelSelection, startModelProvider, userMcpServersConfigPatch, dynamicToolsFingerprint, dynamicToolsContainDeferred, webSearchThreadConfigFingerprint, nativeSkillIsolationFingerprint, userMcpServersFingerprint, ringZeroConfigFingerprint, ringZeroClientInstanceId, networkProxyConfigFingerprint, contextEngineBinding, environmentSelectionFingerprint, hostSystemAgentActive, ringZeroActive, restrictedToolSurface, restrictedToolSurfaceInheritedMcpServerNames, nativeSkillIsolation, lifecycleTiming, normalizeBindingModelProvider, throwIfAborted, prebuiltPluginThreadConfig, preserveExistingBinding, rotatedContextEngineBinding, replacementPredecessor } = context;
 	const pluginThreadConfig = params.pluginThreadConfig?.enabled ? prebuiltPluginThreadConfig ?? await lifecycleTiming.measure("plugin-config-build", () => params.pluginThreadConfig?.build()) : void 0;
 	const finalConfigPatch = params.buildFinalConfigPatch?.({ action: "start" }) ?? {
 		configPatch: params.finalConfigPatch,
@@ -2704,7 +2796,9 @@ async function startFreshCodexThread(params, context) {
 		model: startModelSelection.model,
 		modelProvider: startModelProvider,
 		hostSystemAgentActive,
-		ringZeroInheritedMcpServerNames
+		restrictedToolSurfaceInheritedMcpServerNames,
+		shellEnvironment: params.shellEnvironment,
+		disableLoginShell: params.disableLoginShell
 	}));
 	const requestModelProvider = typeof startParams.modelProvider === "string" && startParams.modelProvider.trim() ? startParams.modelProvider : void 0;
 	const response = assertCodexThreadStartResponse(await lifecycleTiming.measure("thread-start-request", async () => {
@@ -2735,13 +2829,27 @@ async function startFreshCodexThread(params, context) {
 		throw error;
 	}
 	const rolloutPath = resolveCodexThreadRolloutPath(response.thread);
-	if (ringZeroActive) try {
-		await lifecycleTiming.measure("ring-zero-mcp-attestation", () => attestCodexRingZeroThreadHasNoMcpServers(params.client, response.thread.id, params.signal));
+	if (ringZeroActive || isMessageOnlyCodexSourceReply(params.params) || params.params.pluginHarnessToolPolicyRestricted === true) try {
+		await lifecycleTiming.measure("restricted-tool-surface-mcp-attestation", () => attestCodexRestrictedToolSurfaceMcpServersDisabled(params.client, response.thread.id, startParams.config, params.signal));
 	} catch (error) {
 		await (params.abandonClient ?? (() => closeCodexStartupClientBestEffort(params.client)))();
 		throw error;
 	}
-	throwIfAborted();
+	try {
+		throwIfAborted();
+	} catch (error) {
+		if (replacementPredecessor) {
+			if (!await discardUnattestedCodexPluginThread({
+				client: params.client,
+				threadId: response.thread.id,
+				ephemeral: startParams.ephemeral === true
+			})) {
+				await (params.abandonClient ?? (() => closeCodexStartupClientBestEffort(params.client)))();
+				throw new CodexAppServerUnsafeSubscriptionError("Codex successor cleanup failed after an aborted binding replacement", { cause: error });
+			}
+		}
+		throw error;
+	}
 	const modelProvider = resolveCodexAppServerModelProvider({
 		provider: params.params.provider,
 		authProfileId: params.params.authProfileId,
@@ -2752,36 +2860,70 @@ async function startFreshCodexThread(params, context) {
 	const bindingModelProvider = normalizeBindingModelProvider(params.params.authProfileId, response.modelProvider ?? requestModelProvider ?? startModelProvider ?? modelProvider);
 	const nextMcpServersFingerprint = params.mcpServersFingerprintEvaluated === true ? params.mcpServersFingerprint : void 0;
 	if (!preserveExistingBinding) {
-		if (!await lifecycleTiming.measure("thread-start-write-binding", () => params.bindingStore.mutate(bindingIdentity, {
-			kind: "set",
-			if: { kind: "absent" },
-			binding: {
+		const nextBinding = {
+			threadId: response.thread.id,
+			...clientId ? { clientId } : {},
+			cwd: params.cwd,
+			...rolloutPath ? { rolloutPath } : {},
+			authProfileId: params.params.authProfileId,
+			agentWorkspaceDeveloperInstructions: params.agentWorkspaceDeveloperInstructions,
+			model: response.model ?? startParams.model ?? params.params.modelId,
+			modelProvider: bindingModelProvider,
+			dynamicToolsFingerprint,
+			dynamicToolsContainDeferred,
+			webSearchThreadConfigFingerprint,
+			nativeSkillIsolationFingerprint,
+			userMcpServersFingerprint,
+			mcpServersFingerprint: nextMcpServersFingerprint,
+			configuredMcpOwnershipVersion: params.configuredMcpOwnershipVersion,
+			ringZeroConfigFingerprint,
+			ringZeroClientInstanceId,
+			nativeToolPolicyRestricted: restrictedToolSurface ? true : void 0,
+			networkProxyProfileName: params.appServer.networkProxy?.profileName,
+			networkProxyConfigFingerprint,
+			nativeHookRelayGeneration: finalConfigPatch.nativeHookRelayGeneration,
+			appServerRuntimeFingerprint: params.appServerRuntimeFingerprint,
+			pluginAppsFingerprint: pluginThreadConfig?.fingerprint,
+			pluginAppsInputFingerprint: pluginThreadConfig?.inputFingerprint,
+			pluginAppPolicyContext: pluginThreadConfig?.policyContext,
+			contextEngine: contextEngineBinding,
+			environmentSelectionFingerprint
+		};
+		const cleanupUncommittedSuccessor = async (cause) => {
+			if (!await discardUnattestedCodexPluginThread({
+				client: params.client,
 				threadId: response.thread.id,
-				...clientId ? { clientId } : {},
-				cwd: params.cwd,
-				...rolloutPath ? { rolloutPath } : {},
-				authProfileId: params.params.authProfileId,
-				model: response.model ?? startParams.model ?? params.params.modelId,
-				modelProvider: bindingModelProvider,
-				dynamicToolsFingerprint,
-				dynamicToolsContainDeferred,
-				webSearchThreadConfigFingerprint,
-				nativeSkillIsolationFingerprint,
-				userMcpServersFingerprint,
-				mcpServersFingerprint: nextMcpServersFingerprint,
-				ringZeroConfigFingerprint,
-				ringZeroClientInstanceId,
-				networkProxyProfileName: params.appServer.networkProxy?.profileName,
-				networkProxyConfigFingerprint,
-				nativeHookRelayGeneration: finalConfigPatch.nativeHookRelayGeneration,
-				appServerRuntimeFingerprint: params.appServerRuntimeFingerprint,
-				pluginAppsFingerprint: pluginThreadConfig?.fingerprint,
-				pluginAppsInputFingerprint: pluginThreadConfig?.inputFingerprint,
-				pluginAppPolicyContext: pluginThreadConfig?.policyContext,
-				contextEngine: contextEngineBinding,
-				environmentSelectionFingerprint
+				ephemeral: startParams.ephemeral === true
+			})) {
+				await (params.abandonClient ?? (() => closeCodexStartupClientBestEffort(params.client)))();
+				throw new CodexAppServerUnsafeSubscriptionError("Codex successor cleanup failed after a binding replacement conflict", cause === void 0 ? void 0 : { cause });
 			}
-		}))) throw new CodexThreadBindingConflictError(response.thread.id, "committing a fresh thread");
+		};
+		const managedSourceHomeId = resolveManagedThreadSourceHomeId(params);
+		await lifecycleTiming.measure("thread-start-mark-managed", () => markStartedCodexManagedThread(params.bindingStore.managedThreads, {
+			sourceHomeId: managedSourceHomeId,
+			threadId: response.thread.id,
+			...rolloutPath ? { rolloutPath } : {}
+		}));
+		let committed;
+		try {
+			committed = await lifecycleTiming.measure("thread-start-write-binding", () => params.bindingStore.mutate(bindingIdentity, replacementPredecessor ? {
+				kind: "replace-thread",
+				expectedThreadId: replacementPredecessor.threadId,
+				binding: nextBinding
+			} : {
+				kind: "set",
+				if: { kind: "absent" },
+				binding: nextBinding
+			}));
+		} catch (error) {
+			if (replacementPredecessor) await cleanupUncommittedSuccessor(error);
+			throw error;
+		}
+		if (!committed) {
+			if (replacementPredecessor) await cleanupUncommittedSuccessor();
+			throw new CodexThreadBindingConflictError(replacementPredecessor?.threadId ?? response.thread.id, "committing a fresh thread");
+		}
 		if (contextEngineBinding) embeddedAgentLog.info("codex app-server wrote context-engine thread binding", {
 			sessionId: params.params.sessionId,
 			sessionKey: params.params.sessionKey,
@@ -2800,42 +2942,20 @@ async function startFreshCodexThread(params, context) {
 		threadId: response.thread.id,
 		action: rotatedContextEngineBinding ? "rotated" : "started"
 	});
-	return {
-		threadId: response.thread.id,
-		...clientId ? { clientId } : {},
-		cwd: params.cwd,
-		...rolloutPath ? { rolloutPath } : {},
-		authProfileId: params.params.authProfileId,
-		model: response.model ?? startParams.model ?? params.params.modelId,
-		modelProvider: response.modelProvider ?? requestModelProvider ?? startModelProvider ?? modelProvider,
-		dynamicToolsFingerprint,
-		dynamicToolsContainDeferred,
-		nativeSkillIsolationFingerprint,
-		userMcpServersFingerprint,
-		mcpServersFingerprint: nextMcpServersFingerprint,
-		ringZeroConfigFingerprint,
-		ringZeroClientInstanceId,
-		networkProxyProfileName: params.appServer.networkProxy?.profileName,
-		networkProxyConfigFingerprint,
-		nativeHookRelayGeneration: finalConfigPatch.nativeHookRelayGeneration,
-		appServerRuntimeFingerprint: params.appServerRuntimeFingerprint,
-		pluginAppsFingerprint: pluginThreadConfig?.fingerprint,
-		pluginAppsInputFingerprint: pluginThreadConfig?.inputFingerprint,
-		pluginAppPolicyContext: pluginThreadConfig?.policyContext,
-		contextEngine: contextEngineBinding,
-		environmentSelectionFingerprint,
-		...!preserveExistingBinding ? { liveThreadConfigFingerprint: fingerprintCodexThreadConfig({
-			...startParams,
-			model: response.model ?? startParams.model ?? null,
-			requestedModel: startParams.model ?? null,
-			modelProvider: bindingModelProvider ?? null,
-			requestedModelProvider: startParams.modelProvider ?? bindingModelProvider ?? null
-		}, params.params.authProfileId, dynamicToolsFingerprint) } : {},
-		lifecycle: {
-			action: "started",
-			...rotatedContextEngineBinding ? { rotatedContextEngineBinding } : {}
-		}
-	};
+	return buildStartedCodexThreadBinding({
+		bindingModelProvider,
+		clientId,
+		context,
+		finalConfigPatch,
+		nextMcpServersFingerprint,
+		params,
+		pluginThreadConfig,
+		response,
+		rolloutPath,
+		startModelProvider: requestModelProvider ?? startModelProvider,
+		startParams,
+		modelProvider
+	});
 }
 //#endregion
 //#region extensions/codex/src/app-server/profiler-flag.ts
@@ -2979,13 +3099,19 @@ async function prepareCodexThreadLifecyclePreflight(params) {
 	const environmentSelectionFingerprint = fingerprintEnvironmentSelection(params.environmentSelection);
 	const hostSystemAgentActive = params.hostSystemAgentActive ?? isHostScopedAgentToolActive("openclaw");
 	const ringZeroActive = hostSystemAgentActive && isSystemAgentOnlyCodexDynamicToolAllowlist(params.params.toolsAllow);
-	if (ringZeroActive && params.nativeCodeModeEnabled !== false) throw new Error("Codex ring-zero requires native code mode to be disabled");
-	const ringZeroInheritedMcpServerNames = ringZeroActive ? await lifecycleTiming.measure("ring-zero-mcp-config-read", () => readCodexInheritedMcpServerNames(params.client, params.cwd, params.signal)) : [];
-	if (ringZeroActive) await lifecycleTiming.measure("ring-zero-config-requirements-read", () => assertCodexRingZeroHasNoManagedHooks(params.client, params.signal));
+	const messageOnlySourceReply = isMessageOnlyCodexSourceReply(params.params);
+	const restrictedToolSurface = ringZeroActive || messageOnlySourceReply || params.params.pluginHarnessToolPolicyRestricted === true;
+	const imageGenerationDenied = params.params.pluginHarnessToolPolicySafeDeniedTools?.includes("image_generate") === true;
+	if (restrictedToolSurface && params.nativeCodeModeEnabled !== false) throw new Error("Codex restricted tool surfaces require native code mode to be disabled");
+	const restrictedToolSurfaceInheritedMcpServerNames = restrictedToolSurface ? await lifecycleTiming.measure("restricted-tool-surface-mcp-config-read", () => readCodexInheritedMcpServerNames(params.client, params.cwd, params.signal)) : [];
+	if (restrictedToolSurface || imageGenerationDenied) await lifecycleTiming.measure("tool-policy-config-requirements-read", () => assertCodexManagedRequirementsDoNotOverrideToolPolicy(params.client, {
+		restrictedToolSurface,
+		additionalDeniedFeatures: imageGenerationDenied ? ["image_generation"] : void 0
+	}, params.signal));
 	const ringZeroConfigFingerprint = ringZeroActive ? fingerprintJsonObject({
 		version: 1,
 		baseInstructions: "",
-		config: buildCodexRingZeroThreadConfigPatch(params.params, true, ringZeroInheritedMcpServerNames)
+		config: buildCodexRingZeroThreadConfigPatch(params.params, true, restrictedToolSurfaceInheritedMcpServerNames)
 	}) : void 0;
 	return {
 		contextEngineBinding,
@@ -3002,7 +3128,8 @@ async function prepareCodexThreadLifecyclePreflight(params) {
 		ringZeroActive,
 		ringZeroClientInstanceId: ringZeroActive ? getCodexAppServerClientInstanceId(params.client) : void 0,
 		ringZeroConfigFingerprint,
-		ringZeroInheritedMcpServerNames,
+		restrictedToolSurface,
+		restrictedToolSurfaceInheritedMcpServerNames,
 		userMcpServersConfigPatch,
 		userMcpServersFingerprint,
 		webSearchThreadConfigFingerprint
@@ -3034,8 +3161,8 @@ async function releaseCodexRetainedLiveThread(options) {
 }
 /** Reuses one safely owned, fully matching subscription on its original client. */
 async function tryReuseCodexLiveThread(options) {
-	const { params, binding, bindingIdentity, clientId, contextEngineBinding, dynamicToolsFingerprint, hostSystemAgentActive, lifecycleTiming, nativeSkillIsolation, releaseConsumedThread, ringZeroActive, ringZeroInheritedMcpServerNames, startModelProvider, startModelSelection, throwIfAborted, userMcpServersConfigPatch } = options;
-	if (!binding.clientId || binding.clientId !== clientId || binding.preserveNativeModel === true || binding.connectionScope === "supervision" || ringZeroActive || contextEngineBinding) return {};
+	const { params, binding, bindingIdentity, clientId, dynamicToolsFingerprint, environmentSelectionFingerprint, hostSystemAgentActive, lifecycleTiming, nativeSkillIsolation, releaseConsumedThread, ringZeroActive, restrictedToolSurfaceInheritedMcpServerNames, startModelProvider, startModelSelection, throwIfAborted, userMcpServersConfigPatch } = options;
+	if (!binding.clientId || binding.clientId !== clientId || binding.preserveNativeModel === true || binding.connectionScope === "supervision" || ringZeroActive) return {};
 	const prebuiltFinalConfigPatch = params.buildFinalConfigPatch?.({
 		action: "resume",
 		binding
@@ -3048,6 +3175,7 @@ async function tryReuseCodexLiveThread(options) {
 	const resumeConfig = mergeCodexThreadConfigs(params.config, userMcpServersConfigPatch, pluginAppsConfigPatch, prebuiltFinalConfigPatch.configPatch);
 	const resumeParams = lifecycleTiming.measureSync("warm-thread-resume-params", () => buildThreadResumeParams(params.params, {
 		threadId: binding.threadId,
+		cwd: params.cwd,
 		authProfileId: resumeAuthProfileId,
 		model: startModelSelection.model,
 		modelProvider: startModelProvider,
@@ -3061,7 +3189,9 @@ async function tryReuseCodexLiveThread(options) {
 		nativeCodeModeOnlyEnabled: params.nativeCodeModeOnlyEnabled,
 		webSearchAllowed: params.webSearchAllowed,
 		hostSystemAgentActive,
-		ringZeroInheritedMcpServerNames
+		restrictedToolSurfaceInheritedMcpServerNames,
+		shellEnvironment: params.shellEnvironment,
+		disableLoginShell: params.disableLoginShell
 	}));
 	const liveThreadConfigFingerprint = fingerprintCodexThreadConfig({
 		...resumeParams,
@@ -3070,13 +3200,24 @@ async function tryReuseCodexLiveThread(options) {
 		modelProvider: binding.modelProvider ?? resumeParams.modelProvider ?? null,
 		requestedModelProvider: resumeParams.modelProvider ?? binding.modelProvider ?? null
 	}, resumeAuthProfileId, dynamicToolsFingerprint);
-	if (!await consumeCodexAppServerLiveThread(params.client, binding.threadId, liveThreadConfigFingerprint)) return { prebuiltFinalConfigPatch };
+	const retainedThread = await consumeCodexAppServerLiveThread(params.client, binding.threadId, liveThreadConfigFingerprint);
+	if (!retainedThread) {
+		const incompatibleOwnership = await consumeCodexAppServerLiveThread(params.client, binding.threadId);
+		if (incompatibleOwnership) await incompatibleOwnership.release(binding.threadId);
+		return { prebuiltFinalConfigPatch };
+	}
 	try {
 		const nativeHookRelayGeneration = prebuiltFinalConfigPatch.nativeHookRelayGeneration ?? binding.nativeHookRelayGeneration;
+		const model = startModelSelection.model;
 		if (!await lifecycleTiming.measure("warm-thread-write-binding", () => params.bindingStore.mutate(bindingIdentity, {
 			kind: "patch",
 			threadId: binding.threadId,
-			patch: { nativeHookRelayGeneration }
+			patch: {
+				cwd: params.cwd,
+				model,
+				nativeHookRelayGeneration,
+				environmentSelectionFingerprint
+			}
 		}))) throw new CodexThreadBindingConflictError(binding.threadId, "committing a reused thread");
 		throwIfAborted();
 		lifecycleTiming.mark("thread-ready");
@@ -3090,8 +3231,13 @@ async function tryReuseCodexLiveThread(options) {
 		return {
 			binding: {
 				...binding,
+				cwd: params.cwd,
+				model,
 				nativeHookRelayGeneration,
+				environmentSelectionFingerprint,
 				liveThreadConfigFingerprint,
+				liveThreadOwnership: retainedThread,
+				...retainedThread.serviceTier && resumeParams.serviceTier === void 0 ? { clearInheritedServiceTier: true } : {},
 				lifecycle: { action: "resumed" }
 			},
 			prebuiltFinalConfigPatch
@@ -3143,6 +3289,7 @@ async function materializePendingSupervisionBranch(params) {
 		pending = await trackPendingSupervisionArtifacts(params, pending, [probeThreadId]);
 		params.throwIfAborted();
 		const probeResponse = assertCodexThreadForkResponse(rawProbeResponse);
+		if (params.restrictedToolSurface) await params.lifecycleTiming.measure("restricted-tool-surface-mcp-attestation", () => attestCodexRestrictedToolSurfaceMcpServersDisabled(params.client, probeThreadId, probeParams.config ?? void 0, params.signal));
 		const nativeModel = requireNonBlankSupervisionValue(probeResponse.model, "native model");
 		const nativeModelProvider = requireNativeSupervisionModelProvider({
 			responseModelProvider: probeResponse.modelProvider,
@@ -3163,7 +3310,11 @@ async function materializePendingSupervisionBranch(params) {
 			webSearchAllowed: params.webSearchAllowed,
 			environmentSelection: params.environmentSelection,
 			model: nativeModel,
-			modelProvider: nativeModelProvider
+			modelProvider: nativeModelProvider,
+			hostSystemAgentActive: params.hostSystemAgentActive,
+			restrictedToolSurfaceInheritedMcpServerNames: params.restrictedToolSurfaceInheritedMcpServerNames,
+			shellEnvironment: params.shellEnvironment,
+			disableLoginShell: params.disableLoginShell
 		});
 		assertExactSupervisionModelSelection(startParams, {
 			model: nativeModel,
@@ -3191,6 +3342,7 @@ async function materializePendingSupervisionBranch(params) {
 			modelProvider: nativeModelProvider,
 			operation: "thread/start response"
 		});
+		if (params.restrictedToolSurface) await params.lifecycleTiming.measure("restricted-tool-surface-mcp-attestation", () => attestCodexRestrictedToolSurfaceMcpServersDisabled(params.client, finalThreadId, startParams.config, params.signal));
 		if (params.provisionalAppIds?.length) try {
 			await params.lifecycleTiming.measure("plugin-app-attestation", () => attestCodexPluginThreadApps({
 				client: params.client,
@@ -3316,7 +3468,11 @@ function buildPendingSupervisionProbeForkParams(params, pending) {
 		nativeProviderWebSearchSupport: params.nativeProviderWebSearchSupport,
 		nativeCodeModeOnlyEnabled: params.nativeCodeModeOnlyEnabled,
 		webSearchAllowed: params.webSearchAllowed,
-		appServer: params.appServer
+		appServer: params.appServer,
+		hostSystemAgentActive: params.hostSystemAgentActive,
+		restrictedToolSurfaceInheritedMcpServerNames: params.restrictedToolSurfaceInheritedMcpServerNames,
+		shellEnvironment: params.shellEnvironment,
+		disableLoginShell: params.disableLoginShell
 	});
 	return {
 		threadId: pending.sourceThreadId,
@@ -3453,9 +3609,11 @@ async function startOrResumeThread(params) {
 		config: params.params.config
 	});
 	return await params.bindingStore.withLease(bindingIdentity, async () => {
-		const { contextEngineBinding, dynamicToolsContainDeferred, dynamicToolsFingerprint, environmentSelectionFingerprint, hostSystemAgentActive, legacyDynamicToolsFingerprint, legacyUserMcpServersFingerprint, lifecycleTiming, nativeSkillIsolation, nativeSkillIsolationFingerprint, networkProxyConfigFingerprint, ringZeroActive, ringZeroClientInstanceId, ringZeroConfigFingerprint, ringZeroInheritedMcpServerNames, userMcpServersConfigPatch, userMcpServersFingerprint, webSearchThreadConfigFingerprint } = await prepareCodexThreadLifecyclePreflight(params);
+		const { contextEngineBinding, dynamicToolsContainDeferred, dynamicToolsFingerprint, environmentSelectionFingerprint, hostSystemAgentActive, legacyDynamicToolsFingerprint, legacyUserMcpServersFingerprint, lifecycleTiming, nativeSkillIsolation, nativeSkillIsolationFingerprint, networkProxyConfigFingerprint, ringZeroActive, ringZeroClientInstanceId, ringZeroConfigFingerprint, restrictedToolSurface, restrictedToolSurfaceInheritedMcpServerNames, userMcpServersConfigPatch, userMcpServersFingerprint, webSearchThreadConfigFingerprint } = await prepareCodexThreadLifecyclePreflight(params);
 		let binding = await lifecycleTiming.measure("read-binding", () => params.bindingStore.read(bindingIdentity));
+		let replacementPredecessor;
 		const initialBoundThreadId = binding?.threadId;
+		const initialBoundClientId = binding?.clientId;
 		const normalizeBindingModelProvider = (authProfileId, modelProvider) => normalizeCodexAppServerBindingModelProvider({
 			authProfileId,
 			modelProvider,
@@ -3464,12 +3622,28 @@ async function startOrResumeThread(params) {
 			config: params.params.config
 		});
 		const throwIfAborted = () => throwIfCodexThreadLifecycleAborted(params.signal);
-		const releaseRetainedThread = (threadId) => releaseCodexRetainedLiveThread({
-			client: params.client,
-			abandonClient: params.abandonClient,
-			lifecycleTiming,
-			threadId
-		});
+		const releaseRetainedThread = async (threadId, ownerClientId = initialBoundClientId) => {
+			if (ownerClientId && ownerClientId !== clientId) {
+				const previousClient = retainSharedCodexAppServerClientByInstanceId(ownerClientId);
+				if (!previousClient) return;
+				try {
+					await releaseCodexRetainedLiveThread({
+						client: previousClient.client,
+						lifecycleTiming,
+						threadId
+					});
+				} finally {
+					previousClient.release();
+				}
+				return;
+			}
+			await releaseCodexRetainedLiveThread({
+				client: params.client,
+				abandonClient: params.abandonClient,
+				lifecycleTiming,
+				threadId
+			});
+		};
 		if (!binding && bindingIdentity.kind === "session" && bindingIdentity.sessionKey) {
 			if (!await lifecycleTiming.measure("reclaim-binding-generation", () => reclaimCurrentCodexSessionGeneration({
 				bindingStore: params.bindingStore,
@@ -3502,6 +3676,11 @@ async function startOrResumeThread(params) {
 				nativeProviderWebSearchSupport: params.nativeProviderWebSearchSupport,
 				nativeCodeModeOnlyEnabled: params.nativeCodeModeOnlyEnabled,
 				webSearchAllowed: params.webSearchAllowed,
+				hostSystemAgentActive,
+				restrictedToolSurface,
+				restrictedToolSurfaceInheritedMcpServerNames,
+				shellEnvironment: params.shellEnvironment,
+				disableLoginShell: params.disableLoginShell,
 				environmentSelection: params.environmentSelection,
 				provisionalAppIds: pluginThreadConfig?.provisionalAppIds,
 				signal: params.signal,
@@ -3512,6 +3691,7 @@ async function startOrResumeThread(params) {
 					cwd: params.cwd,
 					...clientId ? { clientId } : {},
 					authProfileId: void 0,
+					agentWorkspaceDeveloperInstructions: params.agentWorkspaceDeveloperInstructions,
 					preserveNativeModel: true,
 					dynamicToolsFingerprint,
 					dynamicToolsContainDeferred,
@@ -3519,6 +3699,7 @@ async function startOrResumeThread(params) {
 					nativeSkillIsolationFingerprint,
 					userMcpServersFingerprint,
 					mcpServersFingerprint: params.mcpServersFingerprintEvaluated === true ? params.mcpServersFingerprint : pendingBinding.mcpServersFingerprint,
+					configuredMcpOwnershipVersion: params.configuredMcpOwnershipVersion,
 					networkProxyProfileName: params.appServer.networkProxy?.profileName,
 					networkProxyConfigFingerprint,
 					nativeHookRelayGeneration: finalConfigPatch.nativeHookRelayGeneration,
@@ -3542,6 +3723,7 @@ async function startOrResumeThread(params) {
 			})) throw new CodexThreadBindingConflictError(current.threadId, operation);
 			binding = void 0;
 		};
+		if (binding?.threadId && !restrictedToolSurface && binding.nativeToolPolicyRestricted === true) await clearCurrentBinding("rotating a host-policy-restricted thread binding");
 		if (binding?.threadId && binding.nativeSkillIsolationFingerprint !== nativeSkillIsolationFingerprint) {
 			embeddedAgentLog.debug("codex app-server native skill isolation changed; starting a new thread", { threadId: binding.threadId });
 			await clearCurrentBinding("rotating stale native skill isolation");
@@ -3576,7 +3758,7 @@ async function startOrResumeThread(params) {
 		}
 		const startModelSelection = resolveCodexAppServerThreadModelSelection({
 			provider: params.params.provider,
-			model: params.params.modelId,
+			model: params.runtimeModelId ?? params.params.modelId,
 			binding,
 			authProfileId: params.params.authProfileId,
 			authProfileStore: params.params.authProfileStore,
@@ -3594,6 +3776,14 @@ async function startOrResumeThread(params) {
 		const transientWebSearchRestriction = isTransientWebSearchRestriction(params);
 		const explicitTransientWebSearchRestriction = params.webSearchAllowed === false && params.persistentWebSearchAllowed !== false && transientWebSearchRestriction;
 		const unknownProviderWebSearchSupport = params.nativeProviderWebSearchSupport === "unknown";
+		if (binding?.threadId && (params.configuredMcpOwnershipVersion === 1 && (binding.configuredMcpOwnershipVersion !== 1 || binding.dynamicToolsFingerprint === void 0 || binding.mcpServersFingerprint !== void 0 || binding.userMcpServersFingerprint !== void 0) || params.configuredMcpOwnershipVersion !== 1 && binding.configuredMcpOwnershipVersion === 1) && binding?.threadId) {
+			const predecessorBinding = binding;
+			assertCodexBindingMayBeReplaced(predecessorBinding, "changing configured MCP ownership");
+			embeddedAgentLog.debug("codex app-server configured MCP ownership changed; starting a new thread", { threadId: predecessorBinding.threadId });
+			replacementPredecessor = predecessorBinding;
+			binding = void 0;
+			preserveExistingBinding = false;
+		}
 		if (binding?.threadId && params.mcpServersFingerprintEvaluated === true && binding.mcpServersFingerprint !== params.mcpServersFingerprint) {
 			assertCodexBindingMayBeReplaced(binding, "changing MCP configuration");
 			if (!ringZeroActive && (transientNativeToolRestriction || webSearchBindingChanged && (explicitTransientWebSearchRestriction || unknownProviderWebSearchSupport))) {
@@ -3609,7 +3799,7 @@ async function startOrResumeThread(params) {
 		if (binding?.threadId && webSearchBindingChanged && !deferLegacyWebSearchRotationToTransientNativeSurface) {
 			assertCodexBindingMayBeReplaced(binding, "changing web-search configuration");
 			if (!ringZeroActive && transientWebSearchRestriction) {
-				embeddedAgentLog.debug("codex app-server web search restricted for turn; starting transient thread", { threadId: binding.threadId });
+				embeddedAgentLog.debug("codex app-server tool surface restricted for turn; starting transient thread", { threadId: binding.threadId });
 				preserveExistingBinding = true;
 			} else {
 				embeddedAgentLog.debug("codex app-server web search config changed; starting a new thread", { threadId: binding.threadId });
@@ -3655,11 +3845,6 @@ async function startOrResumeThread(params) {
 			await clearCurrentBinding("rotating a stale thread binding");
 			binding = void 0;
 		}
-		if (binding?.threadId && binding.environmentSelectionFingerprint !== environmentSelectionFingerprint) {
-			embeddedAgentLog.debug("codex app-server environment selection changed; starting a new thread", { threadId: binding.threadId });
-			await clearCurrentBinding("rotating a stale thread binding");
-			binding = void 0;
-		}
 		if (binding?.threadId && (binding.networkProxyConfigFingerprint !== networkProxyConfigFingerprint || binding.networkProxyProfileName !== params.appServer.networkProxy?.profileName)) {
 			embeddedAgentLog.debug("codex app-server network proxy config changed; starting a new thread", { threadId: binding.threadId });
 			await clearCurrentBinding("rotating a stale thread binding");
@@ -3673,13 +3858,15 @@ async function startOrResumeThread(params) {
 				currentInputFingerprint: params.pluginThreadConfig?.inputFingerprint,
 				hasBindingPolicyContext: Boolean(binding.pluginAppPolicyContext)
 			});
-			if (!pluginBindingStale && shouldRecheckRecoverablePluginBinding({
+			if (!pluginBindingStale && (params.pluginThreadConfig?.requiresCurrentPolicyCheck || shouldRecheckRecoverablePluginBinding({
 				binding,
 				pluginThreadConfig: params.pluginThreadConfig
-			})) try {
-				prebuiltPluginThreadConfig = await lifecycleTiming.measure("plugin-config-recovery", () => params.pluginThreadConfig?.build());
+			}))) try {
+				const bindingThreadId = binding.threadId;
+				prebuiltPluginThreadConfig = await lifecycleTiming.measure("plugin-config-recovery", () => params.pluginThreadConfig?.build({ threadId: bindingThreadId }));
 				pluginBindingStale = prebuiltPluginThreadConfig?.fingerprint !== binding.pluginAppsFingerprint;
 			} catch (error) {
+				if (params.pluginThreadConfig?.requiresCurrentPolicyCheck) throw error;
 				embeddedAgentLog.warn("codex app-server plugin app config recovery check failed", {
 					error,
 					threadId: binding.threadId
@@ -3737,8 +3924,8 @@ async function startOrResumeThread(params) {
 				binding,
 				bindingIdentity,
 				clientId,
-				contextEngineBinding,
 				dynamicToolsFingerprint,
+				environmentSelectionFingerprint,
 				hostSystemAgentActive,
 				lifecycleTiming,
 				nativeSkillIsolation,
@@ -3750,7 +3937,7 @@ async function startOrResumeThread(params) {
 					cause
 				}),
 				ringZeroActive,
-				ringZeroInheritedMcpServerNames,
+				restrictedToolSurfaceInheritedMcpServerNames,
 				startModelProvider,
 				startModelSelection,
 				throwIfAborted,
@@ -3776,18 +3963,20 @@ async function startOrResumeThread(params) {
 				environmentSelectionFingerprint,
 				hostSystemAgentActive,
 				ringZeroActive,
-				ringZeroInheritedMcpServerNames,
+				restrictedToolSurface,
+				restrictedToolSurfaceInheritedMcpServerNames,
 				nativeSkillIsolation,
 				lifecycleTiming,
 				normalizeBindingModelProvider,
 				throwIfAborted,
 				clearCurrentBinding,
-				prebuiltFinalConfigPatch: warmReuse.prebuiltFinalConfigPatch
+				prebuiltFinalConfigPatch: warmReuse.prebuiltFinalConfigPatch,
+				prebuiltPluginThreadConfig
 			});
 			if (resumed) return resumed;
 		}
-		if (initialBoundThreadId) await releaseRetainedThread(initialBoundThreadId);
-		return await startFreshCodexThread(params, {
+		if (initialBoundThreadId && !preserveExistingBinding && !replacementPredecessor) await releaseRetainedThread(initialBoundThreadId);
+		const started = await startFreshCodexThread(params, {
 			bindingIdentity,
 			startModelSelection,
 			startModelProvider,
@@ -3804,85 +3993,27 @@ async function startOrResumeThread(params) {
 			environmentSelectionFingerprint,
 			hostSystemAgentActive,
 			ringZeroActive,
-			ringZeroInheritedMcpServerNames,
+			restrictedToolSurface,
+			restrictedToolSurfaceInheritedMcpServerNames,
 			nativeSkillIsolation,
 			lifecycleTiming,
 			normalizeBindingModelProvider,
 			throwIfAborted,
 			prebuiltPluginThreadConfig,
 			preserveExistingBinding,
-			rotatedContextEngineBinding
+			rotatedContextEngineBinding,
+			replacementPredecessor
 		});
+		if (replacementPredecessor) await releaseRetainedThread(replacementPredecessor.threadId, replacementPredecessor.clientId);
+		return started;
 	});
 }
 //#endregion
-//#region extensions/codex/src/app-server/image-payload-sanitizer.ts
-/**
-* Sanitizes inline image payloads mirrored through Codex history so invalid
-* base64 data becomes readable text instead of poisoning replayed transcripts.
-*/
-const IMAGE_OMITTED_TEXT = "omitted image payload: invalid inline image data";
-/** Validates and normalizes an inline image data URL for Codex history payloads. */
-function sanitizeInlineImageDataUrl$1(imageUrl) {
-	return sanitizeInlineImageDataUrl(imageUrl);
-}
-/** Builds the replacement text inserted when an inline image payload is invalid. */
-function invalidInlineImageText(label) {
-	return `[${label}] ${IMAGE_OMITTED_TEXT}`;
-}
-function sanitizeImageContentRecord(record, label) {
-	if (record.type === "image" && typeof record.data === "string") {
-		const mimeType = typeof record.mimeType === "string" ? record.mimeType : "image/png";
-		const imageUrl = sanitizeInlineImageDataUrl$1(`data:${mimeType};base64,${record.data}`);
-		if (!imageUrl) return {
-			type: "text",
-			text: invalidInlineImageText(label)
-		};
-		const commaIndex = imageUrl.indexOf(",");
-		const mime = imageUrl.slice(INLINE_IMAGE_DATA_URL_PREFIX.length, commaIndex).split(";")[0] ?? mimeType;
-		return {
-			...record,
-			mimeType: mime,
-			data: imageUrl.slice(commaIndex + 1)
-		};
-	}
-	if (record.type === "inputImage" && typeof record.imageUrl === "string") {
-		const imageUrl = sanitizeInlineImageDataUrl$1(record.imageUrl);
-		return imageUrl ? {
-			...record,
-			imageUrl
-		} : {
-			type: "inputText",
-			text: invalidInlineImageText(label)
-		};
-	}
-	if (record.type === "input_image" && typeof record.image_url === "string") {
-		const imageUrl = sanitizeInlineImageDataUrl$1(record.image_url);
-		return imageUrl ? {
-			...record,
-			image_url: imageUrl
-		} : {
-			type: "input_text",
-			text: invalidInlineImageText(label)
-		};
-	}
-}
-/** Recursively sanitizes all Codex history image shapes while preserving unknown structure. */
-function sanitizeCodexHistoryImagePayloads(value, label) {
-	if (Array.isArray(value)) return value.map((entry) => sanitizeCodexHistoryImagePayloads(entry, label));
-	if (!isRecord(value)) return value;
-	const imageRecord = sanitizeImageContentRecord(value, label);
-	if (imageRecord) return imageRecord;
-	const next = {};
-	for (const [key, child] of Object.entries(value)) next[key] = sanitizeCodexHistoryImagePayloads(child, label);
-	return next;
-}
-//#endregion
 //#region extensions/codex/src/app-server/user-input.ts
 /** Builds ordered Codex user input for both new turns and same-turn steering. */
 function buildCodexUserInput(text, images) {
 	const imageInputs = (images ?? []).map((image) => {
-		const imageUrl = sanitizeInlineImageDataUrl$1(`data:${image.mimeType};base64,${image.data}`);
+		const imageUrl = sanitizeInlineImageDataUrl(`data:${image.mimeType};base64,${image.data}`);
 		return imageUrl ? {
 			type: "image",
 			url: imageUrl
@@ -3900,6 +4031,27 @@ function buildCodexUserInput(text, images) {
 }
 //#endregion
 //#region extensions/codex/src/app-server/turn-params.ts
+const CODEX_CURRENT_SENDER_FIELD_MAX_CHARS = 256;
+function buildCodexCurrentSenderContextValue(params) {
+	const metadata = asOptionalRecord(asOptionalRecord(params.userTurnTranscriptRecorder?.message)?.["__openclaw"]);
+	const recorded = [
+		normalizeOptionalString(metadata?.["senderId"]),
+		normalizeOptionalString(metadata?.["senderName"]),
+		normalizeOptionalString(metadata?.["senderUsername"])
+	];
+	const [id, name, username] = recorded.some(Boolean) ? recorded : [
+		normalizeOptionalString(params.senderId),
+		normalizeOptionalString(params.senderName),
+		normalizeOptionalString(params.senderUsername)
+	];
+	if (!id && !name && !username) return;
+	const bound = (value) => truncateUtf16Safe(value, CODEX_CURRENT_SENDER_FIELD_MAX_CHARS);
+	return JSON.stringify({ sender: {
+		...id ? { id: bound(id) } : {},
+		...name ? { name: bound(name) } : {},
+		...username ? { username: bound(username) } : {}
+	} });
+}
 function buildTurnStartParams(params, options) {
 	const modelSelection = options.preserveNativeTurnSettings ? void 0 : resolveCodexAppServerRequestModelSelection({
 		model: options.model ?? params.modelId,
@@ -3910,18 +4062,25 @@ function buildTurnStartParams(params, options) {
 		config: params.config
 	});
 	const useThreadPermissionProfile = options.appServer.networkProxy && !options.sandboxPolicy;
+	const currentSenderContext = params.trigger === "user" ? buildCodexCurrentSenderContextValue(params) : void 0;
+	const additionalContext = currentSenderContext ? { openclaw_current_sender: {
+		kind: "untrusted",
+		value: currentSenderContext
+	} } : void 0;
 	return {
 		threadId: options.threadId,
-		input: buildCodexUserInput(options.promptText ?? params.prompt, params.images),
+		input: [...buildCodexUserInput(options.promptText ?? params.prompt, params.images), ...options.explicitSkillInputs ?? []],
+		...additionalContext ? { additionalContext } : {},
 		cwd: options.cwd,
+		...options.appServer.sessionRoot ? { runtimeWorkspaceRoots: [options.appServer.sessionRoot] } : {},
 		approvalPolicy: options.appServer.approvalPolicy,
 		approvalsReviewer: options.appServer.approvalsReviewer,
-		...useThreadPermissionProfile ? {} : { sandboxPolicy: options.sandboxPolicy ?? codexSandboxPolicyForTurn(options.appServer.sandbox, options.cwd, options.appServer.start?.args) },
+		...useThreadPermissionProfile ? {} : { sandboxPolicy: options.sandboxPolicy ?? codexSandboxPolicyForTurn(options.appServer.sandbox, options.appServer.sessionRoot ?? options.cwd, options.appServer.start?.args) },
 		...modelSelection ? {
 			model: modelSelection.model,
 			personality: CODEX_NATIVE_PERSONALITY_NONE
 		} : {},
-		...options.appServer.serviceTier !== void 0 ? { serviceTier: options.appServer.serviceTier } : {},
+		...options.appServer.serviceTier !== void 0 ? { serviceTier: options.appServer.serviceTier } : options.clearInheritedServiceTier ? { serviceTier: null } : {},
 		...modelSelection ? { effort: resolveReasoningEffort(params.thinkLevel, modelSelection.model, readCodexSupportedReasoningEfforts(params.model?.compat)) } : {},
 		...options.environmentSelection ? { environments: options.environmentSelection } : {},
 		...modelSelection ? { collaborationMode: buildTurnCollaborationMode(params, {
@@ -3946,7 +4105,7 @@ function buildTurnCollaborationMode(params, options = {}) {
 function buildTurnScopedCollaborationInstructions(params, options = {}) {
 	const contextInstructions = joinPresentSections(options.turnScopedDeveloperInstructions, options.memoryCollaborationInstructions, options.skillsCollaborationInstructions);
 	if (params.trigger === "cron") return joinPresentSections(buildCronCollaborationInstructions(), contextInstructions);
-	if (params.trigger === "heartbeat" && params.bootstrapContextRunKind !== "commitment-only") return joinPresentSections(buildHeartbeatCollaborationInstructions(), contextInstructions);
+	if (params.trigger === "heartbeat") return joinPresentSections(buildHeartbeatCollaborationInstructions(), contextInstructions);
 	if (contextInstructions?.trim()) return joinPresentSections(buildDefaultCollaborationInstructions(), contextInstructions);
 	return null;
 }
@@ -3984,4 +4143,4 @@ function joinPresentSections(...sections) {
 	return sections.filter((section) => Boolean(section?.trim())).join("\n\n");
 }
 //#endregion
-export { readCodexErrorNotificationMessage as $, resolveCodexDynamicToolsLoading as A, resolveCodexContextEngineProjectionReserveTokens as B, resolveReasoningEffort as C, isForcedPrivateQaCodexRuntime as D, filterCodexDynamicToolsWithOpenClawShell as E, buildContextEngineBinding as F, mergeCodexThreadConfigs as G, buildCodexPluginThreadConfig as H, isContextEngineBindingCompatible as I, isOpenAiCuratedMarketplace as J, shouldBuildCodexPluginThreadConfig as K, fitCodexProjectedContextForTurnStart as L, areCodexDynamicToolFingerprintsCompatible as M, codexDynamicToolsFingerprint as N, isSystemAgentOnlyCodexDynamicToolAllowlist as O, codexLegacyDynamicToolsFingerprint as P, normalizeNonEmptyString as Q, projectContextEngineAssemblyForCodex as R, resolveCodexBindingModelProviderFallback as S, filterCodexDynamicTools as T, buildCodexPluginThreadConfigInputFingerprint as U, buildCodexPluginAppsConfigPatchFromPolicyContext as V, buildCodexPluginThreadConfigTimeoutFallback as W, resolveRecoverableCodexPluginConfigKeys as X, pluginReadParams as Y, extractRawAssistantText as Z, buildDeveloperInstructions as _, unsubscribeCodexThreadBestEffort as _t, sanitizeCodexHistoryImagePayloads as a, readNonNegativeInteger as at, resolveCodexAppServerRequestModelSelection as b, isCodexAppServerProfilerEnabled as c, readString as ct, attestCodexRingZeroThreadHasNoMcpServers as d, CODEX_APP_SERVER_UNSUBSCRIBE_TIMEOUT_MS as dt, readHookOutputEntries as et, buildCodexRingZeroThreadConfigPatch as f, CodexAppServerUnsafeSubscriptionError as ft, resolveCodexWebSearchPlan as g, retireCodexAppServerClientAfterTimedOutTurn as gt, buildCodexNativeWebSearchThreadConfig as h, interruptCodexTurnBestEffort as ht, invalidInlineImageText as i, readNonEmptyStringArray as it, resolveCodexDynamicToolsLoadingForRuntime as j, normalizeCodexDynamicToolName as k, resumeCodexAppServerThread as l, splitPlanText as lt, readCodexInheritedMcpServerNames as m, interruptCodexTurnAndWaitBestEffort as mt, buildTurnStartParams as n, readItemString as nt, sanitizeInlineImageDataUrl$1 as o, readNullableString as ot, buildCodexRuntimeThreadConfig as p, closeCodexStartupClientBestEffort as pt, ensureCodexPluginActivation as q, buildCodexUserInput as r, readNonEmptyString as rt, startOrResumeThread as s, readNumber as st, buildTurnCollaborationMode as t, readItem as tt, assertCodexRingZeroHasNoManagedHooks as u, CODEX_APP_SERVER_INTERRUPT_TIMEOUT_MS as ut, CODEX_NATIVE_PERSONALITY_NONE as v, readCodexSupportedReasoningEfforts as w, resolveCodexAppServerThreadModelSelection as x, resolveCodexAppServerModelProvider as y, resolveCodexContextEngineProjectionMaxChars as z };
+export { ensureCodexPluginActivation as $, isForcedPrivateQaCodexRuntime as A, neutralizeCodexExplicitMentionSigils as B, CODEX_MANAGED_THREAD_NAMESPACE as C, codexLegacyDynamicToolsFingerprint as D, codexDynamicToolsFingerprint as E, resolveCodexDynamicToolsLoadingForRuntime as F, buildCodexPluginAppsConfigPatchFromPolicyContext as G, resolveCodexContextEngineProjectionMaxChars as H, buildContextEngineBinding as I, buildCodexPluginThreadConfigTimeoutFallback as J, buildCodexPluginThreadConfig as K, isContextEngineBindingCompatible as L, isSystemAgentOnlyCodexDynamicToolAllowlist as M, normalizeCodexDynamicToolName as N, filterCodexDynamicTools as O, resolveCodexDynamicToolsLoading as P, shouldBuildCodexPluginThreadConfig as Q, buildCodexContinuityCalibration as R, CODEX_MANAGED_THREAD_MAX_ENTRIES as S, areCodexDynamicToolFingerprintsCompatible as T, resolveCodexContextEngineProjectionReserveTokens as U, projectContextEngineAssemblyForCodex as V, resolveCodexContinuityProjectionMaxChars as W, buildPluginAppPolicyContext as X, buildDisabledAppsConfigPatch as Y, mergeCodexThreadConfigs as Z, resolveCodexAppServerRequestModelSelection as _, isCodexAppServerProfilerEnabled as a, resolveReasoningEffort as b, buildCodexRingZeroThreadConfigPatch as c, buildCodexNativeWebSearchThreadConfig as d, refreshCodexPluginRuntimeState as et, resolveCodexWebSearchPlan as f, resolveCodexAppServerModelProvider as g, CODEX_NATIVE_PERSONALITY_NONE as h, startOrResumeThread as i, resolveRecoverableCodexPluginConfigKeys as it, isMessageOnlyCodexSourceReply as j, filterCodexDynamicToolsForDisabledNativeSurface as k, buildCodexRuntimeThreadConfig as l, buildCodexProjectDocThreadConfig as m, buildTurnStartParams as n, isOpenAiCuratedMarketplaceName as nt, assertCodexManagedRequirementsDoNotOverrideToolPolicy as o, buildDeveloperInstructions as p, buildCodexPluginThreadConfigInputFingerprint as q, buildCodexUserInput as r, pluginReadParams as rt, attestCodexRestrictedToolSurfaceMcpServersDisabled as s, buildTurnCollaborationMode as t, isOpenAiCuratedMarketplace as tt, readCodexInheritedMcpServerNames as u, resolveCodexAppServerThreadModelSelection as v, createCodexManagedThreadStore as w, readCodexSupportedReasoningEfforts as x, resolveCodexBindingModelProviderFallback as y, fitCodexProjectedContextForTurnStart as z };