@openclaw/codex 2026.8.1-beta.2 → 2026.8.1-beta.3

package/dist/{thread-lifecycle-Bu1BTDXr.js → thread-lifecycle-DKdrnTMX.js}

@@ -1,24 +1,30 @@
-import { D as CODEX_PLUGINS_MARKETPLACE_NAME, E as resolveCodexPluginsPolicy, O as CODEX_PLUGINS_WORKSPACE_MARKETPLACE_NAME, a as hashCodexAppServerBindingFingerprint, c as reclaimCurrentCodexSessionGeneration, d as sessionBindingIdentity, i as createCodexSessionGenerationSupersededError, m as codexSandboxPolicyForTurn, n as assertCodexBindingMayBeReplaced, o as isCodexAppServerNativeAuthProfile, s as normalizeCodexAppServerBindingModelProvider } from "./session-binding-DPxIvMgE.js";
-import { M as isCodexAppServerConnectionClosedError, R as resolveCodexAppServerClientInstanceId, V as consumeCodexAppServerLiveThread, ct as isJsonObject, d as retainSharedCodexAppServerClientByInstanceId, k as getCodexAppServerClientInstanceId, s as isCodexAppServerStartSelectionChangedError, st as flattenCodexDynamicToolFunctions, z as CodexAppServerRpcError } from "./shared-client-kIBbGjk4.js";
-import { a as closeCodexStartupClientBestEffort, c as isCodexAppServerUnsafeSubscriptionError, d as unsubscribeCodexThreadBestEffort, n as CODEX_APP_SERVER_UNSUBSCRIBE_TIMEOUT_MS, r as CodexAppServerUnsafeSubscriptionError } from "./attempt-client-cleanup-DMLXUfa8.js";
-import { a as assertCodexThreadStartResponse, r as assertCodexThreadForkResponse } from "./protocol-validators-B4F7L8Rf.js";
-import { a as serializeCodexAppInventoryError, i as defaultCodexAppInventoryCache, t as buildCodexAppServerConnectionFingerprint } from "./plugin-app-cache-key-C3H2CVp6.js";
+import { _ as CODEX_PLUGINS_MARKETPLACE_NAME, g as resolveCodexPluginsPolicy, n as codexSandboxPolicyForTurn, v as CODEX_PLUGINS_WORKSPACE_MARKETPLACE_NAME } from "./config-CpNeo5AE.js";
+import { B as CodexAppServerRpcError, M as isCodexAppServerConnectionClosedError, R as resolveCodexAppServerClientInstanceId, U as consumeCodexAppServerLiveThread, d as retainSharedCodexAppServerClientByInstanceId, k as getCodexAppServerClientInstanceId, lt as flattenCodexDynamicToolFunctions, pt as resolveCodexAppServerLocalHomeDir, s as isCodexAppServerStartSelectionChangedError, ut as isJsonObject } from "./shared-client-Dw-rzii0.js";
+import { a as hashCodexAppServerBindingFingerprint, c as reclaimCurrentCodexSessionGeneration, d as sessionBindingIdentity, i as createCodexSessionGenerationSupersededError, n as assertCodexBindingMayBeReplaced, o as isCodexAppServerNativeAuthProfile, s as normalizeCodexAppServerBindingModelProvider } from "./session-binding-BTrLf9Qm.js";
+import { a as closeCodexStartupClientBestEffort, c as isCodexAppServerUnsafeSubscriptionError, d as unsubscribeCodexThreadBestEffort, n as CODEX_APP_SERVER_UNSUBSCRIBE_TIMEOUT_MS, r as CodexAppServerUnsafeSubscriptionError } from "./attempt-client-cleanup-URjUlCHg.js";
+import { a as assertCodexThreadStartResponse, r as assertCodexThreadForkResponse } from "./protocol-validators-VAVyEnDp.js";
+import { o as defaultCodexAppInventoryCache, s as serializeCodexAppInventoryError, t as buildCodexAppServerConnectionFingerprint } from "./plugin-app-cache-key-DMNQ8Zi8.js";
 import { t as isIncognitoSessionKey } from "./incognito-session-ET_ufDH-.js";
-import { t as resumeCodexAppServerThread } from "./thread-resume-CPrJNQVM.js";
-import { u as projectBoundedCodexThreadHistory } from "./transcript-mirror-B9gGgnJS.js";
+import { n as codexCatalogHomeId } from "./session-catalog-home-id-BNwAJ9D7.js";
+import { t as resumeCodexAppServerThread } from "./thread-resume-CdJk2Ehf.js";
+import { u as projectBoundedCodexThreadHistory } from "./transcript-mirror-BU0_LKAL.js";
 import { r as sanitizeInlineImageDataUrl, t as invalidInlineImageText } from "./image-payload-sanitizer-CnfoUPCE.js";
 import { asOptionalRecord, isRecord, normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
 import fs from "node:fs/promises";
 import path from "node:path";
-import { SKILL_WORKSHOP_TOOL_NAME, TRANSCRIPT_CREDENTIAL_SAFETY_PROMPT, buildSkillWorkshopPromptSection, embeddedAgentLog, formatErrorMessage, isActiveHarnessContextEngine, isHostScopedAgentToolActive } from "openclaw/plugin-sdk/agent-harness-runtime";
+import { SKILL_WORKSHOP_TOOL_NAME, TRANSCRIPT_CREDENTIAL_SAFETY_PROMPT, buildDelegationGuidanceSection, buildHarnessVisibleReplyGuidance, buildSkillWorkshopPromptSection, embeddedAgentLog, formatErrorMessage, isActiveHarnessContextEngine, isHostScopedAgentToolActive, resolveMainSessionDelegationMode } from "openclaw/plugin-sdk/agent-harness-runtime";
 import * as crypto$1 from "node:crypto";
-import crypto from "node:crypto";
+import crypto, { createHash } from "node:crypto";
 import os from "node:os";
+import { resolveAgentDir as resolveAgentDir$1, resolveSessionAgentIds as resolveSessionAgentIds$1 } from "openclaw/plugin-sdk/agent-runtime";
+import { z } from "zod";
 import { coerceErrorMessage } from "openclaw/plugin-sdk/error-runtime";
 import { sliceUtf16Safe, truncateUtf16Safe } from "openclaw/plugin-sdk/text-utility-runtime";
 import { redactSensitiveFieldValue, redactToolPayloadText } from "openclaw/plugin-sdk/logging-core";
+import { isPathInside } from "openclaw/plugin-sdk/file-access-runtime";
 import { resolveRequiredHomeDir, resolveStateDir } from "openclaw/plugin-sdk/state-paths";
 import { listRegisteredPluginAgentPromptGuidance } from "openclaw/plugin-sdk/plugin-runtime";
+import { buildHostnameAllowlistPolicyFromSuffixAllowlist } from "openclaw/plugin-sdk/ssrf-policy";
 import { buildCodexUserMcpServersThreadConfigPatchForRuntime } from "openclaw/plugin-sdk/codex-mcp-projection";
 import { isDiagnosticFlagEnabled } from "openclaw/plugin-sdk/diagnostic-runtime";
 import { GPT5_HEARTBEAT_PROMPT_OVERLAY } from "openclaw/plugin-sdk/provider-model-shared";
@@ -1063,6 +1069,32 @@ function resolveCodexContextEngineProjectionMaxChars(params) {
 function resolveCodexContextEngineProjectionReserveTokens() {
 	return DEFAULT_CODEX_PROJECTION_RESERVE_TOKENS;
 }
+const CONTINUITY_PROJECTION_RESERVE_RATIO = .5;
+const CONTINUITY_EMPIRICAL_CHARS_PER_TOKEN = 3;
+const CONTINUITY_MIN_CHARS_PER_TOKEN = .5;
+const CONTINUITY_MAX_CHARS_PER_TOKEN = CONTINUITY_EMPIRICAL_CHARS_PER_TOKEN;
+const CONTINUITY_CALIBRATION_MIN_PROMPT_CHARS = 5e4;
+/** Builds a calibration sample from a completed turn, or undefined if unusable. */
+function buildCodexContinuityCalibration(params) {
+	if (!Number.isFinite(params.promptChars) || !Number.isFinite(params.inputTokens) || params.promptChars < CONTINUITY_CALIBRATION_MIN_PROMPT_CHARS || params.inputTokens <= 0) return;
+	return {
+		promptChars: Math.floor(params.promptChars),
+		inputTokens: Math.floor(params.inputTokens)
+	};
+}
+function resolveContinuityCharsPerToken(calibration) {
+	if (!calibration || !Number.isFinite(calibration.promptChars) || !Number.isFinite(calibration.inputTokens) || calibration.promptChars < CONTINUITY_CALIBRATION_MIN_PROMPT_CHARS || calibration.inputTokens <= 0) return CONTINUITY_EMPIRICAL_CHARS_PER_TOKEN;
+	return Math.min(CONTINUITY_MAX_CHARS_PER_TOKEN, Math.max(CONTINUITY_MIN_CHARS_PER_TOKEN, calibration.promptChars / calibration.inputTokens));
+}
+/** Resolves rendered context size for no-engine continuity projections. */
+function resolveCodexContinuityProjectionMaxChars(params) {
+	const contextTokenBudget = typeof params.contextTokenBudget === "number" && Number.isFinite(params.contextTokenBudget) ? Math.floor(params.contextTokenBudget) : void 0;
+	if (!contextTokenBudget || contextTokenBudget <= 0) return DEFAULT_RENDERED_CONTEXT_CHARS;
+	return normalizeRenderedContextMaxChars(resolveProjectionPromptBudgetTokens({
+		contextTokenBudget,
+		reserveTokens: Math.max(DEFAULT_CODEX_PROJECTION_RESERVE_TOKENS, Math.floor(contextTokenBudget * CONTINUITY_PROJECTION_RESERVE_RATIO))
+	}) * resolveContinuityCharsPerToken(params.calibration));
+}
 /** Fits projected context prompts under Codex app-server turn/start text limits. */
 function fitCodexProjectedContextForTurnStart(params) {
 	const maxChars = typeof params.maxChars === "number" && Number.isFinite(params.maxChars) ? Math.max(0, Math.floor(params.maxChars)) : CODEX_TURN_START_TEXT_INPUT_MAX_CHARS;
@@ -1328,7 +1360,6 @@ const CODEX_APP_SERVER_OWNED_REPLACEABLE_TOOL_EXCLUDES = /* @__PURE__ */ new Set
 	"write",
 	"edit",
 	"apply_patch",
-	"update_plan",
 	...CODEX_NATIVE_GOAL_TOOL_EXCLUDES
 ]);
 const CODEX_APP_SERVER_OWNED_SHELL_TOOL_EXCLUDES = /* @__PURE__ */ new Set(["exec", "process"]);
@@ -1561,10 +1592,6 @@ const nativeSkillIsolationByClient = /* @__PURE__ */ new WeakMap();
 function isMissingPathError(error) {
 	return error.code === "ENOENT";
 }
-function isPathWithin(root, candidate) {
-	const relative = path.relative(path.resolve(root), path.resolve(candidate));
-	return relative === "" || !path.isAbsolute(relative) && !relative.startsWith(`..${path.sep}`) && relative !== "..";
-}
 async function canonicalizeExistingPath(candidate) {
 	try {
 		return await fs.realpath(candidate);
@@ -1590,12 +1617,12 @@ async function collectPersonalSkillRealPaths(homes, codexHome) {
 		const realDefaultCodexHome = await canonicalizeExistingPath(defaultCodexHome);
 		roots.push({
 			dir: path.join(defaultCodexHome, "skills"),
-			onlyEscapedStateTargets: isPathWithin(realStateDir, realDefaultCodexHome)
+			onlyEscapedStateTargets: isPathInside(realStateDir, realDefaultCodexHome)
 		});
 	}
 	const configuredCodexHome = codexHome?.trim() || process.env.CODEX_HOME?.trim();
 	if (configuredCodexHome) {
-		const stateOwned = isPathWithin(realStateDir, await canonicalizeExistingPath(configuredCodexHome));
+		const stateOwned = isPathInside(realStateDir, await canonicalizeExistingPath(configuredCodexHome));
 		roots.push({
 			dir: path.join(configuredCodexHome, "skills"),
 			onlyEscapedStateTargets: stateOwned
@@ -1613,7 +1640,7 @@ async function collectPersonalSkillRealPaths(homes, codexHome) {
 	const recordSkillFile = async (filePath, onlyEscapedStateTargets) => {
 		try {
 			const skillRealPath = await fs.realpath(filePath);
-			if (!onlyEscapedStateTargets || !isPathWithin(realStateDir, skillRealPath)) skillPaths.add(skillRealPath);
+			if (!onlyEscapedStateTargets || !isPathInside(realStateDir, skillRealPath)) skillPaths.add(skillRealPath);
 		} catch (error) {
 			if (!isMissingPathError(error)) complete = false;
 		}
@@ -1756,7 +1783,7 @@ function applyCodexNativeSkillIsolation(config, isolation) {
 //#region extensions/codex/src/app-server/thread-lifecycle-errors.ts
 var CodexThreadStartRequestError = class extends Error {
 	constructor(cause) {
-		super(formatErrorMessage(cause), { cause });
+		super(`thread/start: ${formatErrorMessage(cause)}`, { cause });
 		this.name = "CodexThreadStartRequestError";
 	}
 };
@@ -1780,6 +1807,64 @@ var CodexAdoptedThreadActiveError = class extends Error {
 	}
 };
 //#endregion
+//#region extensions/codex/src/app-server/managed-thread-store.ts
+const CODEX_MANAGED_THREAD_NAMESPACE = "app-server-managed-threads";
+const CODEX_MANAGED_THREAD_MAX_ENTRIES = 2e4;
+const managedThreadSchema = z.object({
+	version: z.literal(1),
+	kind: z.literal("managed-thread"),
+	sourceHomeId: z.string().min(1),
+	threadId: z.string().min(1),
+	rolloutPath: z.string().min(1).optional()
+});
+async function markStartedCodexManagedThread(store, params) {
+	if (!store) return;
+	try {
+		await store.mark({
+			sourceHomeId: params.sourceHomeId,
+			threadId: params.threadId,
+			...params.rolloutPath ? { rolloutPath: params.rolloutPath } : {}
+		});
+	} catch (error) {
+		embeddedAgentLog.warn("failed to record Codex managed thread ownership", { error });
+	}
+}
+function managedThreadStoreKey(sourceHomeId, threadId) {
+	return `sha256:${createHash("sha256").update("openclaw:codex-managed-thread:v1\0").update(sourceHomeId).update("\0").update(threadId).digest("hex")}`;
+}
+/** Durable ownership index for Codex threads created by OpenClaw. */
+function createCodexManagedThreadStore(state) {
+	return {
+		async mark(params) {
+			try {
+				const value = managedThreadSchema.parse({
+					version: 1,
+					kind: "managed-thread",
+					sourceHomeId: params.sourceHomeId.trim(),
+					threadId: params.threadId.trim(),
+					...params.rolloutPath?.trim() ? { rolloutPath: params.rolloutPath.trim() } : {}
+				});
+				state.registerIfAbsent(managedThreadStoreKey(value.sourceHomeId, value.threadId), value);
+				return true;
+			} catch (error) {
+				embeddedAgentLog.warn("failed to record Codex managed thread ownership", { error });
+				return false;
+			}
+		},
+		async snapshot() {
+			const byHome = /* @__PURE__ */ new Map();
+			for (const entry of state.entries()) {
+				const parsed = managedThreadSchema.safeParse(entry.value);
+				if (!parsed.success) continue;
+				const ids = byHome.get(parsed.data.sourceHomeId) ?? /* @__PURE__ */ new Set();
+				ids.add(parsed.data.threadId);
+				byHome.set(parsed.data.sourceHomeId, ids);
+			}
+			return byHome;
+		}
+	};
+}
+//#endregion
 //#region extensions/codex/src/app-server/plugin-thread-attestation.ts
 /**
 * Confirms admitted plugin and account apps against their actual Codex thread before
@@ -1835,6 +1920,50 @@ async function discardUnattestedCodexPluginThread(params) {
 	}
 }
 //#endregion
+//#region extensions/codex/src/app-server/thread-lifecycle-result.ts
+/** Materializes the public lifecycle result after a fresh thread is durably committed. */
+function buildStartedCodexThreadBinding(input) {
+	const { context, params, response, startParams } = input;
+	return {
+		threadId: response.thread.id,
+		...input.clientId ? { clientId: input.clientId } : {},
+		cwd: params.cwd,
+		...input.rolloutPath ? { rolloutPath: input.rolloutPath } : {},
+		authProfileId: params.params.authProfileId,
+		agentWorkspaceDeveloperInstructions: params.agentWorkspaceDeveloperInstructions,
+		model: response.model ?? startParams.model ?? params.params.modelId,
+		modelProvider: response.modelProvider ?? input.startModelProvider ?? input.modelProvider,
+		dynamicToolsFingerprint: context.dynamicToolsFingerprint,
+		dynamicToolsContainDeferred: context.dynamicToolsContainDeferred,
+		nativeSkillIsolationFingerprint: context.nativeSkillIsolationFingerprint,
+		userMcpServersFingerprint: context.userMcpServersFingerprint,
+		mcpServersFingerprint: input.nextMcpServersFingerprint,
+		configuredMcpOwnershipVersion: params.configuredMcpOwnershipVersion,
+		ringZeroConfigFingerprint: context.ringZeroConfigFingerprint,
+		ringZeroClientInstanceId: context.ringZeroClientInstanceId,
+		networkProxyProfileName: params.appServer.networkProxy?.profileName,
+		networkProxyConfigFingerprint: context.networkProxyConfigFingerprint,
+		nativeHookRelayGeneration: input.finalConfigPatch.nativeHookRelayGeneration,
+		appServerRuntimeFingerprint: params.appServerRuntimeFingerprint,
+		pluginAppsFingerprint: input.pluginThreadConfig?.fingerprint,
+		pluginAppsInputFingerprint: input.pluginThreadConfig?.inputFingerprint,
+		pluginAppPolicyContext: input.pluginThreadConfig?.policyContext,
+		contextEngine: context.contextEngineBinding,
+		environmentSelectionFingerprint: context.environmentSelectionFingerprint,
+		...!context.preserveExistingBinding ? { liveThreadConfigFingerprint: fingerprintCodexThreadConfig({
+			...startParams,
+			model: response.model ?? startParams.model ?? null,
+			requestedModel: startParams.model ?? null,
+			modelProvider: input.bindingModelProvider ?? null,
+			requestedModelProvider: startParams.modelProvider ?? input.bindingModelProvider ?? null
+		}, params.params.authProfileId, context.dynamicToolsFingerprint) } : {},
+		lifecycle: {
+			action: "started",
+			...context.rotatedContextEngineBinding ? { rotatedContextEngineBinding: true } : {}
+		}
+	};
+}
+//#endregion
 //#region extensions/codex/src/app-server/reasoning-effort.ts
 const CODEX_REASONING_EFFORTS = [
 	"minimal",
@@ -1963,12 +2092,21 @@ function resolveReasoningEffort(thinkLevel, modelId, supportedReasoningEfforts)
 	});
 }
 //#endregion
+//#region extensions/codex/src/app-server/project-doc-thread-config.ts
+const CODEX_NATIVE_PROJECT_DOC_MAX_BYTES = 128 * 1024;
+function buildCodexProjectDocThreadConfig(config) {
+	const defaults = { project_doc_max_bytes: CODEX_NATIVE_PROJECT_DOC_MAX_BYTES };
+	return mergeCodexThreadConfigs(defaults, config) ?? defaults;
+}
+//#endregion
 //#region extensions/codex/src/app-server/thread-prompt.ts
 function buildDeveloperInstructions(params, options = {}) {
 	const deferredToolNames = /* @__PURE__ */ new Set();
 	let hasSkillWorkshop = false;
 	let hasSessionsSpawn = false;
 	let hasSessionsYield = false;
+	let hasSubagentsList = false;
+	let hasSessionsSend = false;
 	let hasSeenDirectNamespace = false;
 	let messageToolAvailable = options.dynamicTools ? false : params.disableMessageTool !== true;
 	for (const spec of options.dynamicTools ?? []) {
@@ -1980,6 +2118,8 @@ function buildDeveloperInstructions(params, options = {}) {
 			hasSkillWorkshop ||= name === SKILL_WORKSHOP_TOOL_NAME;
 			hasSessionsSpawn ||= name === "sessions_spawn";
 			hasSessionsYield ||= isDirectNamespace && name === "sessions_yield";
+			hasSubagentsList ||= name === "subagents";
+			hasSessionsSend ||= name === "sessions_send";
 			messageToolAvailable ||= name === "message";
 		}
 	}
@@ -1987,25 +2127,71 @@ function buildDeveloperInstructions(params, options = {}) {
 		surface: "codex_app_server",
 		includeLegacyGlobalGuidance: false
 	}).join("\n");
-	const nativeDelegationAvailable = params.disableTools !== true && params.delegationCapability !== "report_only" && !isMessageOnlyCodexSourceReply(params) && !isSystemAgentOnlyCodexDynamicToolAllowlist(params.toolsAllow) && !shouldDisableCodexToolSearchForModel(params.modelId);
+	const delegationGuidanceAvailable = params.disableTools !== true && params.delegationCapability !== "report_only" && !isMessageOnlyCodexSourceReply(params);
+	const nativeDelegationAvailable = delegationGuidanceAvailable && !isSystemAgentOnlyCodexDynamicToolAllowlist(params.toolsAllow) && !shouldDisableCodexToolSearchForModel(params.modelId);
 	const deferredToolDiscoveryGuidance = deferredToolNames.size > 0 || nativeDelegationAvailable ? "Deferred tools may be absent from the direct tool list. Use `tool_search` when directly callable. On code-mode-only models, use `exec` instead: filter `ALL_TOOLS` by name and description, then call the matching entry through `tools`." : void 0;
 	return [
 		"You are a personal agent running inside OpenClaw. OpenClaw has dynamic tools for OpenClaw-owned messaging, cron, sessions, media, gateway, and nodes.",
 		deferredToolNames.size > 0 ? `Deferred searchable OpenClaw dynamic tools available: ${[...deferredToolNames].toSorted((left, right) => left.localeCompare(right)).join(", ")}.` : void 0,
 		deferredToolDiscoveryGuidance,
 		hasSkillWorkshop ? buildSkillWorkshopPromptSection().join("\n") : void 0,
-		nativeDelegationAvailable ? `Use Codex native \`spawn_agent\` for Codex subagents. \`spawn_agent\` and the other native collaboration tools may be deferred.${hasSessionsSpawn ? " Use OpenClaw `sessions_spawn` only for OpenClaw or ACP delegation, never as a substitute for `spawn_agent`." : ""}` : void 0,
+		nativeDelegationAvailable ? `Use Codex native \`spawn_agent\` for Codex subagents. \`spawn_agent\` and the other native collaboration tools may be deferred.${hasSessionsSpawn ? " Use OpenClaw `sessions_spawn` only for OpenClaw or ACP delegation, never as a substitute for `spawn_agent` on internal legwork." : ""}` : void 0,
 		hasSessionsYield && nativeDelegationAvailable ? "When a native child's result belongs in a later turn, end the current turn with `openclaw_direct.sessions_yield`; the completion arrives as the next model-visible input. Use native `wait_agent` only for an intentional same-turn wait when the immediate next step is blocked on the child. Never loop-poll for native child completion." : void 0,
-		buildVisibleReplyInstruction(params, messageToolAvailable),
+		delegationGuidanceAvailable ? buildDelegationGuidanceSection({
+			mode: resolveMainSessionDelegationMode({
+				config: params.config,
+				agentId: params.agentId,
+				sessionKey: params.sessionKey
+			}),
+			isMinimal: params.promptMode === "minimal" || params.promptMode === "none",
+			hiddenDelegationTool: nativeDelegationAvailable ? "native `spawn_agent`" : hasSessionsSpawn ? "`sessions_spawn`" : "",
+			hasVisibleSessionSpawn: hasSessionsSpawn,
+			hasSessionsYield,
+			hasSubagentsList,
+			hasSessionsSend
+		}).join("\n") : void 0,
+		buildHarnessVisibleReplyGuidance({
+			sourceReplyDeliveryMode: params.sourceReplyDeliveryMode,
+			messageToolAvailable
+		}),
 		TRANSCRIPT_CREDENTIAL_SAFETY_PROMPT,
 		nativeCommandGuidance,
 		params.extraSystemPrompt
 	].filter((section) => typeof section === "string" && section.trim()).join("\n\n");
 }
-function buildVisibleReplyInstruction(params, messageToolAvailable) {
-	if (params.sourceReplyDeliveryMode === "message_tool_only" && messageToolAvailable) return "Visible source replies are not automatically delivered for this run. Use `message(action=send)` for user-visible source-channel output. For progress, set `final=false`. Set `final=true`, or omit it, for the completed reply to the current source conversation; OpenClaw stops after confirming delivery. Do not repeat visible message content in your final answer.";
-	if (messageToolAvailable) return "For the current source conversation, reply normally in your final assistant message; OpenClaw will deliver it through the active source conversation. Use `message` for supported non-text actions in the current conversation, such as reacting to its current message. Reserve other `message` actions for explicit out-of-band sends or media/file delivery. Reactions are not delivered automatically.";
-	return "For the current source conversation, reply normally in your final assistant message; OpenClaw will deliver it through the active source conversation.";
+//#endregion
+//#region extensions/codex/src/app-server/thread-shell-environment.ts
+/** Applies host-selected values and any required login-shell restriction last. */
+function applyCodexManagedShellEnvironment(config, environment, disableLoginShell = false) {
+	if (!environment || Object.keys(environment).length === 0) return disableLoginShell ? {
+		...config,
+		allow_login_shell: false
+	} : config;
+	const current = isJsonObject(config.shell_environment_policy) ? config.shell_environment_policy : {};
+	const currentSet = isJsonObject(current.set) ? current.set : {};
+	const names = Object.keys(environment).toSorted();
+	const includeOnly = Array.isArray(current.include_only) ? current.include_only.filter((entry) => typeof entry === "string") : [];
+	const filters = isJsonObject(current.filters) ? current.filters : void 0;
+	const hasIncludeFilter = filters && Object.values(filters).includes("include");
+	const managedConfig = {
+		...config,
+		shell_environment_policy: {
+			...current,
+			experimental_use_profile: false,
+			set: {
+				...currentSet,
+				...environment
+			},
+			...filters ? hasIncludeFilter ? { filters: {
+				...filters,
+				...Object.fromEntries(names.map((name) => [name, "include"]))
+			} } : {} : includeOnly.length > 0 ? { include_only: [.../* @__PURE__ */ new Set([...includeOnly, ...names])] } : {}
+		}
+	};
+	return disableLoginShell ? {
+		...managedConfig,
+		allow_login_shell: false
+	} : managedConfig;
 }
 //#endregion
 //#region extensions/codex/src/app-server/web-search.ts
@@ -2068,7 +2254,8 @@ function resolveCodexWebSearchPlan(params) {
 	return {
 		kind: "native-hosted",
 		suppressManagedWebSearch: true,
-		threadConfig: buildCodexNativeWebSearchThreadConfig(params.config)
+		threadConfig: buildCodexNativeWebSearchThreadConfig(params.config),
+		webFetchHostnameAllowlist: buildHostnameAllowlistPolicyFromSuffixAllowlist(nativeConfig?.allowedDomains)?.hostnameAllowlist
 	};
 }
 const CODEX_CODE_MODE_THREAD_CONFIG = {
@@ -2077,11 +2264,12 @@ const CODEX_CODE_MODE_THREAD_CONFIG = {
 	"features.apply_patch_streaming_events": true
 };
 const CODEX_GOAL_CONTINUATION_DISABLED_THREAD_CONFIG = { "features.goals": false };
+const CODEX_NATIVE_UPDATE_PLAN_DISABLED_THREAD_CONFIG = { "tools.update_plan.enabled": false };
 const CODEX_CODE_MODE_DISABLED_THREAD_CONFIG = {
 	"features.code_mode": false,
 	"features.code_mode_only": false
 };
-const CODEX_LIGHTWEIGHT_CONTEXT_THREAD_CONFIG = { project_doc_max_bytes: 0 };
+const CODEX_NO_PROJECT_DOCS_CONFIG = { project_doc_max_bytes: 0 };
 const CODEX_TOOL_SEARCH_UNSUPPORTED_THREAD_CONFIG = { "features.multi_agent": false };
 const CODEX_DELEGATION_DISABLED_THREAD_CONFIG = {
 	"agents.enabled": false,
@@ -2127,7 +2315,6 @@ const CODEX_RING_ZERO_THREAD_CONFIG = {
 	"skills.bundled.enabled": false,
 	"skills.include_instructions": false,
 	"tools.experimental_request_user_input.enabled": false,
-	"tools.update_plan.enabled": false,
 	hooks: {
 		PreToolUse: [],
 		PermissionRequest: [],
@@ -2140,7 +2327,6 @@ const CODEX_RING_ZERO_THREAD_CONFIG = {
 		SubagentStop: [],
 		Stop: []
 	},
-	project_doc_max_bytes: 0,
 	notify: [],
 	web_search: "disabled"
 };
@@ -2153,6 +2339,7 @@ const CODEX_RING_ZERO_RESTRICTED_FEATURE_ALIASES = /* @__PURE__ */ new Map([
 	["codex_hooks", "hooks"]
 ]);
 const CODEX_RING_ZERO_OVERRIDABLE_LAYER_TYPES = /* @__PURE__ */ new Set([
+	"packagedDefaults",
 	"mdm",
 	"system",
 	"enterpriseManaged",
@@ -2181,6 +2368,7 @@ function buildThreadStartParams(params, options) {
 		model: modelSelection.model,
 		...modelSelection.modelProvider ? { modelProvider: modelSelection.modelProvider } : {},
 		cwd: options.cwd,
+		...options.appServer.sessionRoot ? { runtimeWorkspaceRoots: [options.appServer.sessionRoot] } : {},
 		approvalPolicy: options.appServer.approvalPolicy,
 		approvalsReviewer: resolveCodexThreadApprovalsReviewer(options.appServer, options.config),
 		...codexThreadSandboxOrPermissions(options.appServer),
@@ -2196,7 +2384,9 @@ function buildThreadStartParams(params, options) {
 			webSearchAllowed: options.webSearchAllowed,
 			appServer: options.appServer,
 			hostSystemAgentActive: options.hostSystemAgentActive,
-			restrictedToolSurfaceInheritedMcpServerNames: options.restrictedToolSurfaceInheritedMcpServerNames
+			restrictedToolSurfaceInheritedMcpServerNames: options.restrictedToolSurfaceInheritedMcpServerNames,
+			shellEnvironment: options.shellEnvironment,
+			disableLoginShell: options.disableLoginShell
 		}),
 		...resolveCodexThreadEnvironmentSelection(options),
 		developerInstructions: options.developerInstructions ?? buildDeveloperInstructions(params, { dynamicTools: options.dynamicTools }),
@@ -2222,6 +2412,8 @@ function buildThreadResumeParams(params, options) {
 	});
 	return {
 		threadId: options.threadId,
+		...options.cwd ? { cwd: options.cwd } : {},
+		...options.appServer.sessionRoot ? { runtimeWorkspaceRoots: [options.appServer.sessionRoot] } : {},
 		excludeTurns: true,
 		initialTurnsPage: {
 			limit: 1,
@@ -2245,29 +2437,38 @@ function buildThreadResumeParams(params, options) {
 			webSearchAllowed: options.webSearchAllowed,
 			appServer: options.appServer,
 			hostSystemAgentActive: options.hostSystemAgentActive,
-			restrictedToolSurfaceInheritedMcpServerNames: options.restrictedToolSurfaceInheritedMcpServerNames
+			restrictedToolSurfaceInheritedMcpServerNames: options.restrictedToolSurfaceInheritedMcpServerNames,
+			shellEnvironment: options.shellEnvironment,
+			disableLoginShell: options.disableLoginShell
 		}),
 		developerInstructions: options.developerInstructions ?? buildDeveloperInstructions(params, { dynamicTools: options.dynamicTools })
 	};
 }
 function buildCodexRuntimeThreadConfig(config, options = {}) {
+	const configured = buildCodexProjectDocThreadConfig(config);
 	const codeModeConfig = {
 		...CODEX_CODE_MODE_THREAD_CONFIG,
 		"features.code_mode_only": options.nativeCodeModeOnlyEnabled === true
 	};
 	if (options.nativeCodeModeEnabled === false) {
-		const disabledConfig = mergeCodexThreadConfigs(config, CODEX_CODE_MODE_DISABLED_THREAD_CONFIG, CODEX_GOAL_CONTINUATION_DISABLED_THREAD_CONFIG) ?? { ...CODEX_CODE_MODE_DISABLED_THREAD_CONFIG };
+		const disabledConfig = mergeCodexThreadConfigs(configured, CODEX_CODE_MODE_DISABLED_THREAD_CONFIG, CODEX_GOAL_CONTINUATION_DISABLED_THREAD_CONFIG, CODEX_NATIVE_UPDATE_PLAN_DISABLED_THREAD_CONFIG) ?? {
+			...CODEX_CODE_MODE_DISABLED_THREAD_CONFIG,
+			...CODEX_GOAL_CONTINUATION_DISABLED_THREAD_CONFIG,
+			...CODEX_NATIVE_UPDATE_PLAN_DISABLED_THREAD_CONFIG
+		};
 		delete disabledConfig["features.apply_patch_streaming_events"];
 		return disabledConfig;
 	}
-	if (options.nativeCodeModeOnlyEnabled === true) return ensureDirectOnlyToolNamespaces(mergeCodexThreadConfigs(codeModeConfig, config, CODEX_GOAL_CONTINUATION_DISABLED_THREAD_CONFIG, { "features.code_mode_only": true }) ?? {
+	if (options.nativeCodeModeOnlyEnabled === true) return ensureDirectOnlyToolNamespaces(mergeCodexThreadConfigs(codeModeConfig, configured, CODEX_GOAL_CONTINUATION_DISABLED_THREAD_CONFIG, CODEX_NATIVE_UPDATE_PLAN_DISABLED_THREAD_CONFIG, { "features.code_mode_only": true }) ?? {
 		...codeModeConfig,
 		...CODEX_GOAL_CONTINUATION_DISABLED_THREAD_CONFIG,
+		...CODEX_NATIVE_UPDATE_PLAN_DISABLED_THREAD_CONFIG,
 		"features.code_mode_only": true
 	}, options.directOnlyToolNamespaces);
-	return ensureDirectOnlyToolNamespaces(mergeCodexThreadConfigs(codeModeConfig, config, CODEX_GOAL_CONTINUATION_DISABLED_THREAD_CONFIG) ?? {
+	return ensureDirectOnlyToolNamespaces(mergeCodexThreadConfigs(codeModeConfig, configured, CODEX_GOAL_CONTINUATION_DISABLED_THREAD_CONFIG, CODEX_NATIVE_UPDATE_PLAN_DISABLED_THREAD_CONFIG) ?? {
 		...codeModeConfig,
-		...CODEX_GOAL_CONTINUATION_DISABLED_THREAD_CONFIG
+		...CODEX_GOAL_CONTINUATION_DISABLED_THREAD_CONFIG,
+		...CODEX_NATIVE_UPDATE_PLAN_DISABLED_THREAD_CONFIG
 	}, options.directOnlyToolNamespaces);
 }
 function ensureDirectOnlyToolNamespaces(config, requiredNamespaces) {
@@ -2286,6 +2487,7 @@ function buildCodexRuntimeThreadConfigForRun(params, config, options = {}) {
 	const ringZeroActive = (options.hostSystemAgentActive ?? isHostScopedAgentToolActive("openclaw")) && isSystemAgentOnlyCodexDynamicToolAllowlist(params.toolsAllow);
 	const messageOnlySourceReply = isMessageOnlyCodexSourceReply(params);
 	const restrictedToolSurface = ringZeroActive || messageOnlySourceReply || params.pluginHarnessToolPolicyRestricted === true;
+	const restrictedTurnDisablesProjectDocs = ringZeroActive || messageOnlySourceReply || params.pluginHarnessToolPolicyRestricted && params.disableTools;
 	const configMcpServers = config?.mcp_servers;
 	if (restrictedToolSurface && configMcpServers !== void 0 && !isJsonObject(configMcpServers)) throw new Error("Codex restricted tool surface received invalid thread mcp_servers config");
 	const restrictedToolSurfaceMcpServerNames = [...options.restrictedToolSurfaceInheritedMcpServerNames ?? [], ...isJsonObject(configMcpServers) ? Object.keys(configMcpServers) : []];
@@ -2301,18 +2503,19 @@ function buildCodexRuntimeThreadConfigForRun(params, config, options = {}) {
 		webSearchAllowed: options.webSearchAllowed
 	}).threadConfig;
 	const baseConfig = buildCodexRuntimeThreadConfig(mergeCodexThreadConfigs(restrictedRunConfig, webSearchConfig), options);
-	const runtimeConfig = mergeCodexThreadConfigs(baseConfig, options.appServer?.networkProxy?.configPatch, shouldDisableCodexToolSearchForModel(params.modelId) ? CODEX_TOOL_SEARCH_UNSUPPORTED_THREAD_CONFIG : void 0, params.delegationCapability === "report_only" ? CODEX_DELEGATION_DISABLED_THREAD_CONFIG : void 0, messageOnlySourceReply || params.pluginHarnessToolPolicyRestricted === true ? buildCodexRestrictedToolThreadConfigPatch(restrictedToolSurfaceMcpServerNames) : buildCodexRingZeroThreadConfigPatch(params, options.hostSystemAgentActive, restrictedToolSurfaceMcpServerNames)) ?? baseConfig;
-	if (params.bootstrapContextMode !== "lightweight") return runtimeConfig;
-	return mergeCodexThreadConfigs(runtimeConfig, CODEX_LIGHTWEIGHT_CONTEXT_THREAD_CONFIG) ?? {
-		...runtimeConfig,
-		...CODEX_LIGHTWEIGHT_CONTEXT_THREAD_CONFIG
-	};
+	return applyCodexManagedShellEnvironment({
+		...mergeCodexThreadConfigs(baseConfig, options.appServer?.networkProxy?.configPatch, params.pluginHarnessToolPolicySafeDeniedTools?.includes("image_generate") ? { "features.image_generation": false } : void 0, shouldDisableCodexToolSearchForModel(params.modelId) ? CODEX_TOOL_SEARCH_UNSUPPORTED_THREAD_CONFIG : void 0, params.delegationCapability === "report_only" ? CODEX_DELEGATION_DISABLED_THREAD_CONFIG : void 0, messageOnlySourceReply || params.pluginHarnessToolPolicyRestricted === true ? buildRestrictedToolConfigPatch(restrictedToolSurfaceMcpServerNames) : buildCodexRingZeroThreadConfigPatch(params, options.hostSystemAgentActive, restrictedToolSurfaceMcpServerNames), restrictedTurnDisablesProjectDocs ? CODEX_NO_PROJECT_DOCS_CONFIG : void 0, params.authoredContextTokenCap === void 0 ? void 0 : { model_context_window: params.authoredContextTokenCap }) ?? baseConfig,
+		...params.bootstrapContextMode === "lightweight" ? CODEX_NO_PROJECT_DOCS_CONFIG : {}
+	}, options.shellEnvironment, options.disableLoginShell);
 }
 function buildCodexRingZeroThreadConfigPatch(params, hostSystemAgentActive = isHostScopedAgentToolActive("openclaw"), inheritedMcpServerNames = []) {
 	if (!hostSystemAgentActive || !isSystemAgentOnlyCodexDynamicToolAllowlist(params.toolsAllow)) return;
-	return buildCodexRestrictedToolThreadConfigPatch(inheritedMcpServerNames);
+	return {
+		...buildRestrictedToolConfigPatch(inheritedMcpServerNames),
+		...CODEX_NO_PROJECT_DOCS_CONFIG
+	};
 }
-function buildCodexRestrictedToolThreadConfigPatch(inheritedMcpServerNames) {
+function buildRestrictedToolConfigPatch(inheritedMcpServerNames) {
 	const mcpServers = Object.fromEntries([...new Set(inheritedMcpServerNames)].toSorted().map((name) => [name, { enabled: false }]));
 	return {
 		...CODEX_RING_ZERO_THREAD_CONFIG,
@@ -2336,12 +2539,12 @@ async function readCodexInheritedMcpServerNames(client, cwd, signal) {
 	if (!isJsonObject(configuredServers)) throw new Error("Codex config/read returned invalid mcp_servers");
 	return Object.keys(configuredServers).toSorted();
 }
-async function assertCodexRestrictedToolSurfaceHasNoManagedHooks(client, signal) {
+async function assertCodexManagedRequirementsDoNotOverrideToolPolicy(client, options, signal) {
 	const response = await client.request("configRequirements/read", void 0, { signal });
 	if (!isJsonObject(response) || !Object.hasOwn(response, "requirements")) throw new Error("Codex configRequirements/read returned an invalid response");
 	if (response.requirements === null) return;
 	if (!isJsonObject(response.requirements)) throw new Error("Codex configRequirements/read returned invalid requirements");
-	for (const key of [
+	if (options.restrictedToolSurface) for (const key of [
 		"hooks",
 		"managedHooks",
 		"managed_hooks"
@@ -2351,6 +2554,7 @@ async function assertCodexRestrictedToolSurfaceHasNoManagedHooks(client, signal)
 		if (!isJsonObject(hooks)) throw new Error("Codex configRequirements/read returned invalid managed hooks");
 		if (hasNonEmptyJsonValue(hooks)) throw new Error("Codex restricted tool surface cannot override managed hooks");
 	}
+	const additionalDeniedFeatures = new Set(options.additionalDeniedFeatures);
 	for (const key of ["featureRequirements", "feature_requirements"]) {
 		const requirements = response.requirements[key];
 		if (requirements === void 0 || requirements === null) continue;
@@ -2358,7 +2562,8 @@ async function assertCodexRestrictedToolSurfaceHasNoManagedHooks(client, signal)
 		for (const [feature, enabled] of Object.entries(requirements)) {
 			if (typeof enabled !== "boolean") throw new Error("Codex configRequirements/read returned invalid feature requirements");
 			const canonicalFeature = CODEX_RING_ZERO_RESTRICTED_FEATURE_ALIASES.get(feature) ?? feature;
-			if (enabled && CODEX_RING_ZERO_RESTRICTED_FEATURES.has(canonicalFeature)) throw new Error(`Codex restricted tool surface cannot override required feature ${feature}`);
+			const deniedByToolPolicy = options.restrictedToolSurface && CODEX_RING_ZERO_RESTRICTED_FEATURES.has(canonicalFeature) || additionalDeniedFeatures.has(canonicalFeature);
+			if (enabled && deniedByToolPolicy) throw new Error(`Codex tool policy cannot override required feature ${feature}`);
 		}
 	}
 }
@@ -2408,6 +2613,15 @@ function resolveCodexThreadEnvironmentSelection(options) {
 }
 //#endregion
 //#region extensions/codex/src/app-server/thread-lifecycle-io.ts
+function resolveManagedThreadSourceHomeId(params) {
+	const agentId = resolveSessionAgentIds$1({
+		config: params.params.config,
+		sessionKey: params.params.sessionKey,
+		agentId: params.agentId ?? params.params.agentId
+	}).sessionAgentId;
+	const agentDir = params.agentDir ?? params.params.agentDir ?? resolveAgentDir$1(params.params.config ?? {}, agentId);
+	return codexCatalogHomeId(resolveCodexAppServerLocalHomeDir(params.appServer.start, agentDir));
+}
 function resolveCodexThreadRolloutPath(thread) {
 	const rolloutPath = thread.path?.trim();
 	if (!rolloutPath || !path.isAbsolute(rolloutPath) || path.extname(rolloutPath) !== ".jsonl" || !path.basename(rolloutPath).includes(thread.id)) return;
@@ -2429,6 +2643,7 @@ async function resumeExistingCodexThread(params, context) {
 		const resumeConfig = applyCodexNativeSkillIsolation(mergeCodexThreadConfigs(params.config, userMcpServersConfigPatch, pluginAppsConfigPatch, finalConfigPatch.configPatch), nativeSkillIsolation);
 		const resumeParams = lifecycleTiming.measureSync("thread-resume-params", () => buildThreadResumeParams(params.params, {
 			threadId: resumeBinding.threadId,
+			cwd: params.cwd,
 			authProfileId,
 			model: startModelSelection.model,
 			modelProvider: startModelProvider,
@@ -2442,7 +2657,9 @@ async function resumeExistingCodexThread(params, context) {
 			nativeCodeModeOnlyEnabled: params.nativeCodeModeOnlyEnabled,
 			webSearchAllowed: params.webSearchAllowed,
 			hostSystemAgentActive,
-			restrictedToolSurfaceInheritedMcpServerNames
+			restrictedToolSurfaceInheritedMcpServerNames,
+			shellEnvironment: params.shellEnvironment,
+			disableLoginShell: params.disableLoginShell
 		}));
 		const requestModelProvider = typeof resumeParams.modelProvider === "string" && resumeParams.modelProvider.trim() ? resumeParams.modelProvider : void 0;
 		throwIfAborted();
@@ -2579,7 +2796,9 @@ async function startFreshCodexThread(params, context) {
 		model: startModelSelection.model,
 		modelProvider: startModelProvider,
 		hostSystemAgentActive,
-		restrictedToolSurfaceInheritedMcpServerNames
+		restrictedToolSurfaceInheritedMcpServerNames,
+		shellEnvironment: params.shellEnvironment,
+		disableLoginShell: params.disableLoginShell
 	}));
 	const requestModelProvider = typeof startParams.modelProvider === "string" && startParams.modelProvider.trim() ? startParams.modelProvider : void 0;
 	const response = assertCodexThreadStartResponse(await lifecycleTiming.measure("thread-start-request", async () => {
@@ -2647,6 +2866,7 @@ async function startFreshCodexThread(params, context) {
 			cwd: params.cwd,
 			...rolloutPath ? { rolloutPath } : {},
 			authProfileId: params.params.authProfileId,
+			agentWorkspaceDeveloperInstructions: params.agentWorkspaceDeveloperInstructions,
 			model: response.model ?? startParams.model ?? params.params.modelId,
 			modelProvider: bindingModelProvider,
 			dynamicToolsFingerprint,
@@ -2679,6 +2899,12 @@ async function startFreshCodexThread(params, context) {
 				throw new CodexAppServerUnsafeSubscriptionError("Codex successor cleanup failed after a binding replacement conflict", cause === void 0 ? void 0 : { cause });
 			}
 		};
+		const managedSourceHomeId = resolveManagedThreadSourceHomeId(params);
+		await lifecycleTiming.measure("thread-start-mark-managed", () => markStartedCodexManagedThread(params.bindingStore.managedThreads, {
+			sourceHomeId: managedSourceHomeId,
+			threadId: response.thread.id,
+			...rolloutPath ? { rolloutPath } : {}
+		}));
 		let committed;
 		try {
 			committed = await lifecycleTiming.measure("thread-start-write-binding", () => params.bindingStore.mutate(bindingIdentity, replacementPredecessor ? {
@@ -2716,43 +2942,20 @@ async function startFreshCodexThread(params, context) {
 		threadId: response.thread.id,
 		action: rotatedContextEngineBinding ? "rotated" : "started"
 	});
-	return {
-		threadId: response.thread.id,
-		...clientId ? { clientId } : {},
-		cwd: params.cwd,
-		...rolloutPath ? { rolloutPath } : {},
-		authProfileId: params.params.authProfileId,
-		model: response.model ?? startParams.model ?? params.params.modelId,
-		modelProvider: response.modelProvider ?? requestModelProvider ?? startModelProvider ?? modelProvider,
-		dynamicToolsFingerprint,
-		dynamicToolsContainDeferred,
-		nativeSkillIsolationFingerprint,
-		userMcpServersFingerprint,
-		mcpServersFingerprint: nextMcpServersFingerprint,
-		configuredMcpOwnershipVersion: params.configuredMcpOwnershipVersion,
-		ringZeroConfigFingerprint,
-		ringZeroClientInstanceId,
-		networkProxyProfileName: params.appServer.networkProxy?.profileName,
-		networkProxyConfigFingerprint,
-		nativeHookRelayGeneration: finalConfigPatch.nativeHookRelayGeneration,
-		appServerRuntimeFingerprint: params.appServerRuntimeFingerprint,
-		pluginAppsFingerprint: pluginThreadConfig?.fingerprint,
-		pluginAppsInputFingerprint: pluginThreadConfig?.inputFingerprint,
-		pluginAppPolicyContext: pluginThreadConfig?.policyContext,
-		contextEngine: contextEngineBinding,
-		environmentSelectionFingerprint,
-		...!preserveExistingBinding ? { liveThreadConfigFingerprint: fingerprintCodexThreadConfig({
-			...startParams,
-			model: response.model ?? startParams.model ?? null,
-			requestedModel: startParams.model ?? null,
-			modelProvider: bindingModelProvider ?? null,
-			requestedModelProvider: startParams.modelProvider ?? bindingModelProvider ?? null
-		}, params.params.authProfileId, dynamicToolsFingerprint) } : {},
-		lifecycle: {
-			action: "started",
-			...rotatedContextEngineBinding ? { rotatedContextEngineBinding } : {}
-		}
-	};
+	return buildStartedCodexThreadBinding({
+		bindingModelProvider,
+		clientId,
+		context,
+		finalConfigPatch,
+		nextMcpServersFingerprint,
+		params,
+		pluginThreadConfig,
+		response,
+		rolloutPath,
+		startModelProvider: requestModelProvider ?? startModelProvider,
+		startParams,
+		modelProvider
+	});
 }
 //#endregion
 //#region extensions/codex/src/app-server/profiler-flag.ts
@@ -2898,9 +3101,13 @@ async function prepareCodexThreadLifecyclePreflight(params) {
 	const ringZeroActive = hostSystemAgentActive && isSystemAgentOnlyCodexDynamicToolAllowlist(params.params.toolsAllow);
 	const messageOnlySourceReply = isMessageOnlyCodexSourceReply(params.params);
 	const restrictedToolSurface = ringZeroActive || messageOnlySourceReply || params.params.pluginHarnessToolPolicyRestricted === true;
+	const imageGenerationDenied = params.params.pluginHarnessToolPolicySafeDeniedTools?.includes("image_generate") === true;
 	if (restrictedToolSurface && params.nativeCodeModeEnabled !== false) throw new Error("Codex restricted tool surfaces require native code mode to be disabled");
 	const restrictedToolSurfaceInheritedMcpServerNames = restrictedToolSurface ? await lifecycleTiming.measure("restricted-tool-surface-mcp-config-read", () => readCodexInheritedMcpServerNames(params.client, params.cwd, params.signal)) : [];
-	if (restrictedToolSurface) await lifecycleTiming.measure("restricted-tool-surface-config-requirements-read", () => assertCodexRestrictedToolSurfaceHasNoManagedHooks(params.client, params.signal));
+	if (restrictedToolSurface || imageGenerationDenied) await lifecycleTiming.measure("tool-policy-config-requirements-read", () => assertCodexManagedRequirementsDoNotOverrideToolPolicy(params.client, {
+		restrictedToolSurface,
+		additionalDeniedFeatures: imageGenerationDenied ? ["image_generation"] : void 0
+	}, params.signal));
 	const ringZeroConfigFingerprint = ringZeroActive ? fingerprintJsonObject({
 		version: 1,
 		baseInstructions: "",
@@ -2968,6 +3175,7 @@ async function tryReuseCodexLiveThread(options) {
 	const resumeConfig = mergeCodexThreadConfigs(params.config, userMcpServersConfigPatch, pluginAppsConfigPatch, prebuiltFinalConfigPatch.configPatch);
 	const resumeParams = lifecycleTiming.measureSync("warm-thread-resume-params", () => buildThreadResumeParams(params.params, {
 		threadId: binding.threadId,
+		cwd: params.cwd,
 		authProfileId: resumeAuthProfileId,
 		model: startModelSelection.model,
 		modelProvider: startModelProvider,
@@ -2981,7 +3189,9 @@ async function tryReuseCodexLiveThread(options) {
 		nativeCodeModeOnlyEnabled: params.nativeCodeModeOnlyEnabled,
 		webSearchAllowed: params.webSearchAllowed,
 		hostSystemAgentActive,
-		restrictedToolSurfaceInheritedMcpServerNames
+		restrictedToolSurfaceInheritedMcpServerNames,
+		shellEnvironment: params.shellEnvironment,
+		disableLoginShell: params.disableLoginShell
 	}));
 	const liveThreadConfigFingerprint = fingerprintCodexThreadConfig({
 		...resumeParams,
@@ -3102,7 +3312,9 @@ async function materializePendingSupervisionBranch(params) {
 			model: nativeModel,
 			modelProvider: nativeModelProvider,
 			hostSystemAgentActive: params.hostSystemAgentActive,
-			restrictedToolSurfaceInheritedMcpServerNames: params.restrictedToolSurfaceInheritedMcpServerNames
+			restrictedToolSurfaceInheritedMcpServerNames: params.restrictedToolSurfaceInheritedMcpServerNames,
+			shellEnvironment: params.shellEnvironment,
+			disableLoginShell: params.disableLoginShell
 		});
 		assertExactSupervisionModelSelection(startParams, {
 			model: nativeModel,
@@ -3258,7 +3470,9 @@ function buildPendingSupervisionProbeForkParams(params, pending) {
 		webSearchAllowed: params.webSearchAllowed,
 		appServer: params.appServer,
 		hostSystemAgentActive: params.hostSystemAgentActive,
-		restrictedToolSurfaceInheritedMcpServerNames: params.restrictedToolSurfaceInheritedMcpServerNames
+		restrictedToolSurfaceInheritedMcpServerNames: params.restrictedToolSurfaceInheritedMcpServerNames,
+		shellEnvironment: params.shellEnvironment,
+		disableLoginShell: params.disableLoginShell
 	});
 	return {
 		threadId: pending.sourceThreadId,
@@ -3465,6 +3679,8 @@ async function startOrResumeThread(params) {
 				hostSystemAgentActive,
 				restrictedToolSurface,
 				restrictedToolSurfaceInheritedMcpServerNames,
+				shellEnvironment: params.shellEnvironment,
+				disableLoginShell: params.disableLoginShell,
 				environmentSelection: params.environmentSelection,
 				provisionalAppIds: pluginThreadConfig?.provisionalAppIds,
 				signal: params.signal,
@@ -3475,6 +3691,7 @@ async function startOrResumeThread(params) {
 					cwd: params.cwd,
 					...clientId ? { clientId } : {},
 					authProfileId: void 0,
+					agentWorkspaceDeveloperInstructions: params.agentWorkspaceDeveloperInstructions,
 					preserveNativeModel: true,
 					dynamicToolsFingerprint,
 					dynamicToolsContainDeferred,
@@ -3541,7 +3758,7 @@ async function startOrResumeThread(params) {
 		}
 		const startModelSelection = resolveCodexAppServerThreadModelSelection({
 			provider: params.params.provider,
-			model: params.params.modelId,
+			model: params.runtimeModelId ?? params.params.modelId,
 			binding,
 			authProfileId: params.params.authProfileId,
 			authProfileStore: params.params.authProfileStore,
@@ -3855,9 +4072,10 @@ function buildTurnStartParams(params, options) {
 		input: [...buildCodexUserInput(options.promptText ?? params.prompt, params.images), ...options.explicitSkillInputs ?? []],
 		...additionalContext ? { additionalContext } : {},
 		cwd: options.cwd,
+		...options.appServer.sessionRoot ? { runtimeWorkspaceRoots: [options.appServer.sessionRoot] } : {},
 		approvalPolicy: options.appServer.approvalPolicy,
 		approvalsReviewer: options.appServer.approvalsReviewer,
-		...useThreadPermissionProfile ? {} : { sandboxPolicy: options.sandboxPolicy ?? codexSandboxPolicyForTurn(options.appServer.sandbox, options.cwd, options.appServer.start?.args) },
+		...useThreadPermissionProfile ? {} : { sandboxPolicy: options.sandboxPolicy ?? codexSandboxPolicyForTurn(options.appServer.sandbox, options.appServer.sessionRoot ?? options.cwd, options.appServer.start?.args) },
 		...modelSelection ? {
 			model: modelSelection.model,
 			personality: CODEX_NATIVE_PERSONALITY_NONE
@@ -3925,4 +4143,4 @@ function joinPresentSections(...sections) {
 	return sections.filter((section) => Boolean(section?.trim())).join("\n\n");
 }
 //#endregion
-export { resolveCodexDynamicToolsLoadingForRuntime as A, buildCodexPluginThreadConfigInputFingerprint as B, codexLegacyDynamicToolsFingerprint as C, isSystemAgentOnlyCodexDynamicToolAllowlist as D, isForcedPrivateQaCodexRuntime as E, projectContextEngineAssemblyForCodex as F, shouldBuildCodexPluginThreadConfig as G, buildDisabledAppsConfigPatch as H, resolveCodexContextEngineProjectionMaxChars as I, isOpenAiCuratedMarketplace as J, ensureCodexPluginActivation as K, resolveCodexContextEngineProjectionReserveTokens as L, isContextEngineBindingCompatible as M, fitCodexProjectedContextForTurnStart as N, normalizeCodexDynamicToolName as O, neutralizeCodexExplicitMentionSigils as P, buildCodexPluginAppsConfigPatchFromPolicyContext as R, codexDynamicToolsFingerprint as S, filterCodexDynamicToolsForDisabledNativeSurface as T, buildPluginAppPolicyContext as U, buildCodexPluginThreadConfigTimeoutFallback as V, mergeCodexThreadConfigs as W, pluginReadParams as X, isOpenAiCuratedMarketplaceName as Y, resolveRecoverableCodexPluginConfigKeys as Z, resolveCodexAppServerThreadModelSelection as _, isCodexAppServerProfilerEnabled as a, readCodexSupportedReasoningEfforts as b, buildCodexRingZeroThreadConfigPatch as c, buildCodexNativeWebSearchThreadConfig as d, resolveCodexWebSearchPlan as f, resolveCodexAppServerRequestModelSelection as g, resolveCodexAppServerModelProvider as h, startOrResumeThread as i, buildContextEngineBinding as j, resolveCodexDynamicToolsLoading as k, buildCodexRuntimeThreadConfig as l, CODEX_NATIVE_PERSONALITY_NONE as m, buildTurnStartParams as n, assertCodexRestrictedToolSurfaceHasNoManagedHooks as o, buildDeveloperInstructions as p, refreshCodexPluginRuntimeState as q, buildCodexUserInput as r, attestCodexRestrictedToolSurfaceMcpServersDisabled as s, buildTurnCollaborationMode as t, readCodexInheritedMcpServerNames as u, resolveCodexBindingModelProviderFallback as v, filterCodexDynamicTools as w, areCodexDynamicToolFingerprintsCompatible as x, resolveReasoningEffort as y, buildCodexPluginThreadConfig as z };
+export { ensureCodexPluginActivation as $, isForcedPrivateQaCodexRuntime as A, neutralizeCodexExplicitMentionSigils as B, CODEX_MANAGED_THREAD_NAMESPACE as C, codexLegacyDynamicToolsFingerprint as D, codexDynamicToolsFingerprint as E, resolveCodexDynamicToolsLoadingForRuntime as F, buildCodexPluginAppsConfigPatchFromPolicyContext as G, resolveCodexContextEngineProjectionMaxChars as H, buildContextEngineBinding as I, buildCodexPluginThreadConfigTimeoutFallback as J, buildCodexPluginThreadConfig as K, isContextEngineBindingCompatible as L, isSystemAgentOnlyCodexDynamicToolAllowlist as M, normalizeCodexDynamicToolName as N, filterCodexDynamicTools as O, resolveCodexDynamicToolsLoading as P, shouldBuildCodexPluginThreadConfig as Q, buildCodexContinuityCalibration as R, CODEX_MANAGED_THREAD_MAX_ENTRIES as S, areCodexDynamicToolFingerprintsCompatible as T, resolveCodexContextEngineProjectionReserveTokens as U, projectContextEngineAssemblyForCodex as V, resolveCodexContinuityProjectionMaxChars as W, buildPluginAppPolicyContext as X, buildDisabledAppsConfigPatch as Y, mergeCodexThreadConfigs as Z, resolveCodexAppServerRequestModelSelection as _, isCodexAppServerProfilerEnabled as a, resolveReasoningEffort as b, buildCodexRingZeroThreadConfigPatch as c, buildCodexNativeWebSearchThreadConfig as d, refreshCodexPluginRuntimeState as et, resolveCodexWebSearchPlan as f, resolveCodexAppServerModelProvider as g, CODEX_NATIVE_PERSONALITY_NONE as h, startOrResumeThread as i, resolveRecoverableCodexPluginConfigKeys as it, isMessageOnlyCodexSourceReply as j, filterCodexDynamicToolsForDisabledNativeSurface as k, buildCodexRuntimeThreadConfig as l, buildCodexProjectDocThreadConfig as m, buildTurnStartParams as n, isOpenAiCuratedMarketplaceName as nt, assertCodexManagedRequirementsDoNotOverrideToolPolicy as o, buildDeveloperInstructions as p, buildCodexPluginThreadConfigInputFingerprint as q, buildCodexUserInput as r, pluginReadParams as rt, attestCodexRestrictedToolSurfaceMcpServersDisabled as s, buildTurnCollaborationMode as t, isOpenAiCuratedMarketplace as tt, readCodexInheritedMcpServerNames as u, resolveCodexAppServerThreadModelSelection as v, createCodexManagedThreadStore as w, readCodexSupportedReasoningEfforts as x, resolveCodexBindingModelProviderFallback as y, fitCodexProjectedContextForTurnStart as z };