@openclaw/codex 2026.8.1-beta.2 → 2026.8.1-beta.3

package/dist/{dynamic-tools-BVdyWkUD.js → dynamic-tools-fJZhl4CE.js}

@@ -1,45 +1,48 @@
-import { C as isCodexRemoteExecPlacementSandbox, T as readCodexPluginConfig } from "./session-binding-DPxIvMgE.js";
-import { S as resolveCodexGatewayTimeoutWithGraceMs, ct as isJsonObject, l as releaseLeasedSharedCodexAppServerClient, ot as CODEX_OPENCLAW_DIRECT_DYNAMIC_TOOL_NAMESPACE } from "./shared-client-kIBbGjk4.js";
-import { E as itemStatus, F as readItem, b as auditNativeToolUnfinishedStatus, h as isCodexNotificationForTurn, v as auditNativeToolName, y as auditNativeToolTerminalStatus } from "./attempt-client-cleanup-DMLXUfa8.js";
-import { l as readCodexTurn } from "./protocol-validators-B4F7L8Rf.js";
-import { D as isSystemAgentOnlyCodexDynamicToolAllowlist, E as isForcedPrivateQaCodexRuntime, O as normalizeCodexDynamicToolName, T as filterCodexDynamicToolsForDisabledNativeSurface, f as resolveCodexWebSearchPlan, w as filterCodexDynamicTools } from "./thread-lifecycle-Bu1BTDXr.js";
+import { h as readCodexPluginConfig, p as isCodexRemoteExecPlacementSandbox } from "./config-CpNeo5AE.js";
+import { V as createCodexElicitationResponse, ct as CODEX_OPENCLAW_DIRECT_DYNAMIC_TOOL_NAMESPACE, l as releaseLeasedSharedCodexAppServerClient, ut as isJsonObject } from "./shared-client-Dw-rzii0.js";
+import { E as itemStatus, F as readItem, b as auditNativeToolUnfinishedStatus, h as isCodexNotificationForTurn, v as auditNativeToolName, y as auditNativeToolTerminalStatus } from "./attempt-client-cleanup-URjUlCHg.js";
+import { l as readCodexTurn } from "./protocol-validators-VAVyEnDp.js";
+import { A as isForcedPrivateQaCodexRuntime, M as isSystemAgentOnlyCodexDynamicToolAllowlist, N as normalizeCodexDynamicToolName, O as filterCodexDynamicTools, f as resolveCodexWebSearchPlan, k as filterCodexDynamicToolsForDisabledNativeSurface } from "./thread-lifecycle-DKdrnTMX.js";
 import { r as sanitizeInlineImageDataUrl, t as invalidInlineImageText } from "./image-payload-sanitizer-CnfoUPCE.js";
-import { r as formatCodexDisplayText } from "./command-formatters-B1AEz8ZA.js";
-import { a as resolveCodexNodeExecToolOverrides, i as resolveCodexNativeExecutionPolicy } from "./sandbox-guard-Cmwc9eIk.js";
+import { r as formatCodexDisplayText } from "./command-formatters-D0nZ3qtd.js";
+import { a as resolveCodexNodeExecToolOverrides, i as resolveCodexNativeExecutionPolicy } from "./sandbox-guard-C1qEeZ5C.js";
+import { a as sanitizeCodexApprovalVisibleText, c as waitForPluginApprovalDecision, i as requestPluginApproval, n as codexApprovalTimeoutText, o as stripDanglingCodexApprovalTerminalSequence, r as mapExecDecisionToOutcome, s as truncateCodexApprovalDisplayText, t as approvalRequestExplicitlyUnavailable } from "./plugin-approval-roundtrip-C75Yiiwc.js";
 import { asNonArrayRecord, asOptionalRecord, isRecord, normalizeOptionalString, normalizeTrimmedStringList, readStringField } from "openclaw/plugin-sdk/string-coerce-runtime";
+import { validateJsonSchemaValue } from "openclaw/plugin-sdk/json-schema-runtime";
 import path, { posix } from "node:path";
 import { createDeferred } from "openclaw/plugin-sdk/extension-shared";
 import { addTimerTimeoutGraceMs, asDateTimestampMs, finiteSecondsToTimerSafeMilliseconds, parseStrictNonNegativeInteger } from "openclaw/plugin-sdk/number-runtime";
-import { HEARTBEAT_RESPONSE_TOOL_NAME, buildAgentHookContextChannelFields, buildEmbeddedAttemptToolRunContext, consumeAdjustedParamsForToolCall, consumePreExecutionBlockedToolCall, createAgentToolResultMiddlewareRunner, createCodexAppServerToolResultExtensionRunner, embeddedAgentLog, extractMessagingToolSend, extractMessagingToolSendResult, extractToolResultMediaArtifact, filterProviderNormalizableTools, filterToolResultMediaUrls, finalizeToolTerminalPresentation, formatApprovalDisplayPath, formatToolExecutionErrorMessage, getBeforeToolCallFailureDisposition, getChannelAgentToolMeta, getPluginToolMeta, hasNativeHookRelayInvocation, invokeNativeHookRelay, isDeliveredMessageToolOnlySourceReplyResult, isDeliveredMessagingToolResult, isHostScopedAgentToolActive, isMessagingTool, isMessagingToolSendAction, isReplaySafeToolCall, isSubagentSessionKey, isToolResultError, isToolWrappedWithBeforeToolCallHook, normalizeAgentRuntimeTools, normalizeHeartbeatToolResponse, projectRuntimeToolInputSchema, resolveAttemptSpawnWorkspaceDir, resolveModelAuthMode, resolveNativeHookRelayDeferredToolApproval, resolveToolExecutionErrorKind, resolveToolResultFailureKind, runAgentHarnessAfterToolCallHook, sanitizeToolResult, setBeforeToolCallDiagnosticsEnabled, supportsModelTools, wrapToolWithBeforeToolCallHook } from "openclaw/plugin-sdk/agent-harness-runtime";
+import { HEARTBEAT_RESPONSE_TOOL_NAME, buildAgentHookContextChannelFields, buildEmbeddedAttemptToolRunContext, consumeAdjustedParamsForToolCall, consumePreExecutionBlockedToolCall, createAgentToolResultMiddlewareRunner, createCodexAppServerToolResultExtensionRunner, embeddedAgentLog, extractMessagingToolSend, extractMessagingToolSendResult, extractToolResultMediaArtifact, filterProviderNormalizableTools, filterToolResultMediaUrls, finalizeToolTerminalPresentation, formatApprovalDisplayPath, formatToolExecutionErrorMessage, getBeforeToolCallFailureDisposition, getChannelAgentToolMeta, getPluginToolMeta, getPluginToolSideEffectOwnerKey, hasNativeHookRelayInvocation, invokeNativeHookRelay, isDeliveredMessageToolOnlySourceReplyResult, isDeliveredMessagingToolResult, isHostScopedAgentToolActive, isMessagingTool, isMessagingToolSendAction, isReplaySafeToolCall, isSubagentSessionKey, isToolResultError, isToolWrappedWithBeforeToolCallHook, normalizeAgentRuntimeTools, normalizeHeartbeatToolResponse, projectRuntimeToolInputSchema, resolveAttemptSpawnWorkspaceDir, resolveModelAuthMode, resolveNativeHookRelayDeferredToolApproval, resolveToolExecutionErrorKind, resolveToolResultFailureKind, runAgentHarnessAfterToolCallHook, sanitizeToolResult, setBeforeToolCallDiagnosticsEnabled, supportsModelTools, wrapToolWithBeforeToolCallHook } from "openclaw/plugin-sdk/agent-harness-runtime";
 import { createHash, randomUUID } from "node:crypto";
 import { resolveAgentDir as resolveAgentDir$1 } from "openclaw/plugin-sdk/agent-runtime";
+import { killProcessTree } from "openclaw/plugin-sdk/process-runtime";
+import { formatErrorMessage as formatErrorMessage$1, redactSensitiveText } from "openclaw/plugin-sdk/security-runtime";
 import { SsrFBlockedError, isBlockedHostnameOrIp } from "openclaw/plugin-sdk/ssrf-runtime";
 import { spawn } from "node:child_process";
-import { coerceErrorMessage, isApprovalNotFoundError, toErrorObject } from "openclaw/plugin-sdk/error-runtime";
+import { coerceErrorMessage } from "openclaw/plugin-sdk/error-runtime";
 import { DEFAULT_MAX_LIVE_TOOL_RESULT_CHARS, estimateToolResultTextChars, resolveLiveToolResultMaxChars, sliceToolResultTextToBudget, sliceUtf16Safe, truncateUtf16Safe } from "openclaw/plugin-sdk/text-utility-runtime";
 import { once } from "node:events";
 import { isIP } from "node:net";
 import { WebSocketServer } from "ws";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { expectDefined } from "openclaw/plugin-sdk/expect-runtime";
+import { redactToolPayloadText } from "openclaw/plugin-sdk/logging-core";
+import { isPathStrictlyInside, root } from "openclaw/plugin-sdk/file-access-runtime";
 import { runWithCronCreatorAuthorityCapabilityResolver } from "openclaw/plugin-sdk/codex-mcp-projection";
 import { emitTrustedDiagnosticEvent, hasPendingInternalDiagnosticEvent } from "openclaw/plugin-sdk/diagnostic-runtime";
-import { isToolAllowed, sanitizeEnvVars } from "openclaw/plugin-sdk/sandbox";
+import { buildRemoteCommand, isToolAllowed, sanitizeEnvVars } from "openclaw/plugin-sdk/sandbox";
 import { saveMediaBuffer } from "openclaw/plugin-sdk/media-store";
 import { registerRetainedNativeHookRelayForBundledRuntime } from "openclaw/plugin-sdk/native-hook-relay-runtime";
-import { root } from "openclaw/plugin-sdk/file-access-runtime";
 import { getMediaDir } from "openclaw/plugin-sdk/media-runtime";
 import { normalizeOpenAIToolSchemas } from "openclaw/plugin-sdk/provider-tools";
 //#region extensions/codex/src/app-server/dynamic-tool-response-state.ts
 /** Retains the host-owned app preview without adding it to Codex's response payload. */
 function withDynamicToolTranscriptDetails(response, details) {
-	if (!details || typeof details !== "object" || Array.isArray(details)) return response;
-	const mcpAppPreview = details.mcpAppPreview;
-	if (!mcpAppPreview || typeof mcpAppPreview !== "object" || Array.isArray(mcpAppPreview)) return response;
+	if (details === void 0) return response;
 	Object.defineProperty(response, "transcriptDetails", {
 		configurable: true,
 		enumerable: false,
-		value: { mcpAppPreview }
+		value: details
 	});
 	return response;
 }
@@ -228,12 +231,14 @@ async function handleDynamicToolCallWithTimeout(params) {
 	const conservativeRaceResponses = /* @__PURE__ */ new WeakSet();
 	const finalizeTerminal = (response) => {
 		const executionSnapshot = params.toolBridge.consumeToolExecutionSnapshot?.(params.call.callId);
+		const ownerKey = params.toolBridge.sideEffectOwnerKeyForTool?.(params.call.tool);
 		const observedExecutionStarted = executionSnapshot?.executionStarted ?? (conservativeRaceResponses.has(response) ? void 0 : response.executionStarted);
 		const terminalResolution = params.observeToolTerminal?.({
 			toolCallId: params.call.callId,
 			toolName: params.call.tool,
 			arguments: response.executedArguments ?? executionSnapshot?.executedArguments ?? params.call.arguments,
 			...params.toolMeta ? { meta: params.toolMeta } : {},
+			...ownerKey ? { ownerMutation: { ownerKey } } : {},
 			...observedExecutionStarted !== void 0 ? { executionStarted: observedExecutionStarted } : {},
 			outcome: response.success ? "success" : "failure",
 			...!response.success ? { failure: { error: readDynamicToolResponseText(response) } } : {}
@@ -358,13 +363,15 @@ function toCodexDynamicToolProtocolResponse(response) {
 }
 /** Adds async-started progress details when a tool result continues out of band. */
 function toCodexDynamicToolProgressResponse(response, protocolResponse) {
-	const transcriptDetails = response.transcriptDetails;
-	if (response.asyncStarted !== true && transcriptDetails === void 0) return protocolResponse;
+	const transcriptDetails = isJsonObject(response.transcriptDetails) ? response.transcriptDetails : void 0;
+	const mcpAppPreview = isJsonObject(transcriptDetails?.mcpAppPreview) ? transcriptDetails.mcpAppPreview : void 0;
+	const progressDetails = mcpAppPreview ? { mcpAppPreview } : void 0;
+	if (response.asyncStarted !== true && progressDetails === void 0) return protocolResponse;
 	return {
 		...protocolResponse,
-		...transcriptDetails ? { details: transcriptDetails } : {},
+		...progressDetails ? { details: progressDetails } : {},
 		...response.asyncStarted === true ? { details: {
-			...transcriptDetails,
+			...progressDetails,
 			async: true,
 			status: "started"
 		} } : {}
@@ -440,7 +447,7 @@ function readConfiguredDynamicToolTimeoutMs(toolName, config) {
 		if (!imageModel || typeof imageModel !== "object") return CODEX_DYNAMIC_IMAGE_GENERATION_TOOL_TIMEOUT_MS;
 		return readPositiveFiniteTimeoutMs(imageModel.timeoutMs) ?? CODEX_DYNAMIC_IMAGE_GENERATION_TOOL_TIMEOUT_MS;
 	}
-	if (toolName === "image") {
+	if (toolName === "view_image") {
 		const candidates = (config?.tools?.media?.models ?? []).filter((entry) => !entry.capabilities || entry.capabilities.includes("image"));
 		const capabilityTimeoutMs = readTimeoutSecondsAsMs(config?.tools?.media?.image?.timeoutSeconds);
 		return Math.max(capabilityTimeoutMs ?? CODEX_DYNAMIC_IMAGE_TOOL_TIMEOUT_MS, ...candidates.map((entry) => readTimeoutSecondsAsMs(entry.timeoutSeconds) ?? capabilityTimeoutMs ?? CODEX_DYNAMIC_IMAGE_TOOL_TIMEOUT_MS));
@@ -641,6 +648,7 @@ function createCodexNativeHookRelay(params) {
 		authorizeRetentionAfterSuccessfulYield: () => {
 			successfulYieldRetentionAuthorized = true;
 		},
+		hasClaimedDirectChild: () => directChildClaims.size > 0,
 		rejectPendingDirectChild: (threadIdInput, reason) => {
 			const threadId = threadIdInput.trim();
 			const pending = threadId ? pendingDirectChildAdmissions.get(threadId) : void 0;
@@ -716,15 +724,14 @@ function buildCodexNativeHookRelayConfig(params) {
 		const codexEvent = CODEX_HOOK_EVENT_BY_NATIVE_EVENT[event];
 		const selected = selectedEvents.has(event);
 		const shouldRelay = params.relay.shouldRelayEvent(event);
-		const selectedNoopPreToolUse = selected && event === "pre_tool_use" && !shouldRelay && params.loopDetectionPreToolUseRelay;
-		if (!selected || !shouldRelay && !selectedNoopPreToolUse) {
+		if (!selected || !shouldRelay) {
 			if (selected || params.clearOmittedEvents) config[`hooks.${codexEvent}`] = [];
 			if (params.clearOmittedEvents) for (const sourcePath of CODEX_SESSION_FLAGS_HOOK_SOURCE_PATHS) hookState[`${sourcePath}:${CODEX_HOOK_KEY_LABEL_BY_NATIVE_EVENT[event]}:0:0`] = { enabled: false };
 			continue;
 		}
 		const timeout = normalizeHookTimeoutSec(params.hookTimeoutSec);
 		const command = params.relay.commandForEvent(event, { timeoutMs: resolveCodexNativeHookRelayCommandTimeoutMs(timeout) });
-		const matcher = selectedNoopPreToolUse ? void 0 : buildCodexNativeToolMatcher(params.relay.toolMatcherForEvent(event));
+		const matcher = buildCodexNativeToolMatcher(params.relay.toolMatcherForEvent(event));
 		config[`hooks.${codexEvent}`] = [{
 			...matcher ? { matcher } : {},
 			hooks: [{
@@ -1198,7 +1205,7 @@ async function prepareCodexRemoteWorkspaceMessageMedia(params) {
 	let attachmentEntries = 0;
 	const mapMediaPath = (value) => {
 		if (typeof value !== "string") return value;
-		if (isGatewayManagedMediaPath(value, gatewayMediaRoot)) {
+		if (path.isAbsolute(value) && isPathStrictlyInside(gatewayMediaRoot, value)) {
 			attachmentEntries += 1;
 			gatewayManagedPaths.add(value);
 			return value;
@@ -1281,11 +1288,6 @@ async function prepareCodexRemoteWorkspaceMessageMedia(params) {
 	}
 	return mapMessageMediaValues(mappedArgs, (value) => stagedPaths.get(value) ?? value);
 }
-function isGatewayManagedMediaPath(value, mediaRoot) {
-	if (!path.isAbsolute(value)) return false;
-	const relativePath = path.relative(mediaRoot, value);
-	return Boolean(relativePath && relativePath !== ".." && !relativePath.startsWith(`..${path.sep}`) && !path.isAbsolute(relativePath));
-}
 async function assertGatewayManagedMediaPath(value, mediaRoot) {
 	const opened = await (await root(mediaRoot, { symlinks: "reject" })).open(path.relative(mediaRoot, value), { symlinks: "reject" });
 	try {
@@ -1322,57 +1324,80 @@ const dynamicToolBuildState = {};
 //#endregion
 //#region extensions/codex/src/app-server/shell-dynamic-tools.ts
 const CODEX_NODE_EXEC_DYNAMIC_TOOL_NAME = "node_exec";
-const CODEX_NODE_PROCESS_DYNAMIC_TOOL_NAME = "node_process";
-const CODEX_NODE_EXEC_POLICY_PARAMETER_NAMES = /* @__PURE__ */ new Set([
+const CODEX_GATEWAY_EXEC_DYNAMIC_TOOL_NAME = "gateway_exec";
+const CODEX_GATEWAY_PROCESS_DYNAMIC_TOOL_NAME = "gateway_process";
+const CODEX_EXEC_POLICY_PARAMETER_NAMES = /* @__PURE__ */ new Set([
 	"host",
 	"security",
 	"ask"
 ]);
+const CODEX_NODE_EXEC_PARAMETER_NAMES = /* @__PURE__ */ new Set([
+	"command",
+	"workdir",
+	"env",
+	"timeoutSeconds",
+	"node"
+]);
+const PROCESS_FOLLOWUP_TEXT = "Use process (list/poll/log/write/send-keys/submit/paste/kill/clear/remove) for follow-up.";
 /** Returns true when plugin config explicitly removes any named dynamic tool. */
 function isCodexDynamicToolExcluded(config, names) {
 	const normalizedNames = new Set(names.map((name) => normalizeCodexDynamicToolName(name)));
 	return (config.codexDynamicToolsExclude ?? []).some((name) => normalizedNames.has(normalizeCodexDynamicToolName(name)));
 }
-function createNodeExecDynamicTool(execTool, configuredNode) {
-	const pinnedNode = configuredNode?.trim();
+function createExecAliasDynamicTool(execTool, params) {
+	const pinnedNode = params.host === "node" ? params.node?.trim() : void 0;
+	const nodeAlias = params.host === "node";
+	const gatewayProcessAliasAvailable = params.host === "gateway" && params.processAliasAvailable;
+	const name = nodeAlias ? CODEX_NODE_EXEC_DYNAMIC_TOOL_NAME : CODEX_GATEWAY_EXEC_DYNAMIC_TOOL_NAME;
+	const description = nodeAlias ? pinnedNode ? "Run a shell command to completion on the OpenClaw configured remote node for this session. This tool always uses OpenClaw host=node internally and follows the existing node exec approval and allowlist policy. Remote-node background follow-up is unavailable. Use Codex's native shell for local app-server work." : "Run a shell command to completion on an OpenClaw remote node. Select the node by name or id when multiple nodes are available. This tool always uses OpenClaw host=node internally and follows the existing node exec approval and allowlist policy. Remote-node background follow-up is unavailable. Use Codex's native shell for local app-server work." : "Run a shell command through OpenClaw on the Gateway host for OpenClaw-managed Gateway environment access, including Secret Store agent-readable environment values and protected egress sentinels. Native Codex shell remains preferred for ordinary local work. This tool always uses OpenClaw host=gateway internally and follows Gateway exec approval and allowlist policy.";
+	const followupText = nodeAlias ? "Remote-node background follow-up is unavailable. Wait for the command to complete." : gatewayProcessAliasAvailable ? "Use gateway_process (list/poll/log/write/send-keys/submit/paste/kill/clear/remove) for follow-up." : "Background session follow-up is unavailable because gateway_process is not exposed. Rerun without background=true and set yieldMs high enough to wait for completion.";
 	return {
 		...execTool,
-		name: CODEX_NODE_EXEC_DYNAMIC_TOOL_NAME,
-		description: pinnedNode ? "Run a shell command on the OpenClaw configured remote node for this session. This tool always uses OpenClaw host=node internally and follows the existing node exec approval and allowlist policy. Use node_process for follow-up on backgrounded node_exec sessions. Use Codex's native shell for local app-server work." : "Run a shell command on an OpenClaw remote node. Select the node by name or id when multiple nodes are available. This tool always uses OpenClaw host=node internally and follows the existing node exec approval and allowlist policy. Use node_process for follow-up on backgrounded node_exec sessions. Use Codex's native shell for local app-server work.",
-		parameters: hideNodeExecDynamicToolParameters(execTool.parameters, { hideNode: Boolean(pinnedNode) }),
+		name,
+		description,
+		parameters: hideExecDynamicToolParameters(execTool.parameters, !nodeAlias || Boolean(pinnedNode), nodeAlias),
 		execute: async (toolCallId, args, signal, onUpdate) => {
-			const result = await execTool.execute(toolCallId, pinNodeExecDynamicToolArgs(args, pinnedNode), signal, onUpdate);
+			const result = await execTool.execute(toolCallId, pinExecDynamicToolArgs(args, params.host, pinnedNode), signal, onUpdate);
 			return {
 				...result,
-				content: result.content.map((item) => item.type === "text" ? Object.assign({}, item, { text: item.text.replace("Use process (list/poll/log/write/send-keys/submit/paste/kill/clear/remove) for follow-up.", "Use node_process (list/poll/log/write/send-keys/submit/paste/kill/clear/remove) for follow-up.") }) : item)
+				content: result.content.map((item) => item.type === "text" ? Object.assign({}, item, { text: item.text.replace(PROCESS_FOLLOWUP_TEXT, followupText) }) : item)
 			};
 		}
 	};
 }
-function createNodeProcessDynamicTool(processTool) {
+function createGatewayProcessAliasDynamicTool(processTool) {
 	return {
 		...processTool,
-		name: CODEX_NODE_PROCESS_DYNAMIC_TOOL_NAME,
-		description: "Manage node_exec sessions that were started on OpenClaw remote nodes: list, poll, log, write, send-keys, submit, paste, kill, clear, or remove. Use only for node_exec follow-up; use Codex's native shell session handling for local app-server work."
+		name: CODEX_GATEWAY_PROCESS_DYNAMIC_TOOL_NAME,
+		description: "Manage background shell sessions in the existing per-session OpenClaw process scope: list, poll, log, write, send-keys, submit, paste, kill, clear, or remove. Use for gateway_exec follow-up; use native Codex shell session handling for ordinary local work."
 	};
 }
-function pinNodeExecDynamicToolArgs(args, configuredNode) {
-	const { host: _host, security: _security, ask: _ask, node: requestedNode, ...rest } = args && typeof args === "object" && !Array.isArray(args) ? args : {};
+function pinExecDynamicToolArgs(args, host, configuredNode) {
+	const { host: _host, security: _security, ask: _ask, node: requestedNode, ...rest } = normalizeExecDynamicToolArgs(args);
+	if (host === "gateway") return {
+		...rest,
+		host
+	};
+	const nodeArgs = Object.fromEntries(Object.entries(rest).filter(([name]) => CODEX_NODE_EXEC_PARAMETER_NAMES.has(name)));
 	const node = configuredNode ?? (typeof requestedNode === "string" ? requestedNode.trim() : "");
 	return {
-		...rest,
-		host: "node",
+		...nodeArgs,
+		host,
 		...node ? { node } : {}
 	};
 }
-function hideNodeExecDynamicToolParameters(parameters, options) {
+function normalizeExecDynamicToolArgs(args) {
+	return args && typeof args === "object" && !Array.isArray(args) ? args : {};
+}
+function hideExecDynamicToolParameters(parameters, hideNode, nodeOnly) {
 	if (!parameters || typeof parameters !== "object" || Array.isArray(parameters)) return parameters;
 	const schema = parameters;
 	const rawProperties = schema.properties;
 	if (!rawProperties || typeof rawProperties !== "object" || Array.isArray(rawProperties)) return parameters;
-	const nextProperties = Object.fromEntries(Object.entries(rawProperties).filter(([name]) => !CODEX_NODE_EXEC_POLICY_PARAMETER_NAMES.has(normalizeCodexDynamicToolName(name)) && !(options.hideNode && normalizeCodexDynamicToolName(name) === "node")));
+	const includeParameter = (name) => nodeOnly ? CODEX_NODE_EXEC_PARAMETER_NAMES.has(name) && !(hideNode && name === "node") : !CODEX_EXEC_POLICY_PARAMETER_NAMES.has(normalizeCodexDynamicToolName(name)) && !(hideNode && normalizeCodexDynamicToolName(name) === "node");
+	const nextProperties = Object.fromEntries(Object.entries(rawProperties).filter(([name]) => includeParameter(name)));
 	const rawRequired = schema.required;
-	const nextRequired = Array.isArray(rawRequired) ? rawRequired.filter((name) => typeof name !== "string" || !CODEX_NODE_EXEC_POLICY_PARAMETER_NAMES.has(normalizeCodexDynamicToolName(name)) && !(options.hideNode && normalizeCodexDynamicToolName(name) === "node")) : rawRequired;
+	const nextRequired = Array.isArray(rawRequired) ? rawRequired.filter((name) => typeof name !== "string" || includeParameter(name)) : rawRequired;
 	return {
 		...schema,
 		properties: nextProperties,
@@ -1382,13 +1407,12 @@ function hideNodeExecDynamicToolParameters(parameters, options) {
 //#endregion
 //#region extensions/codex/src/app-server/vision-tools.ts
 /**
-* Filters Codex dynamic tools for turns that already contain image inputs so
-* models with native vision do not get redundant image-inspection tools.
+* Codex's enabled native surface includes its stable view_image loader. Keep
+* OpenClaw's view_image tool only when that surface or model vision is unavailable.
 */
-/** Removes the image tool when the model can directly consume inbound images. */
-function filterToolsForVisionInputs(tools, params) {
-	if (!params.modelHasVision || !params.hasInboundImages) return tools;
-	return tools.filter((tool) => tool.name !== "image");
+function filterCodexVisionTools(tools, params) {
+	if (!params.modelHasVision || !params.nativeImageInspectionEnabled) return tools;
+	return tools.filter((tool) => tool.name !== "view_image");
 }
 //#endregion
 //#region extensions/codex/src/app-server/dynamic-tool-build.ts
@@ -1406,6 +1430,18 @@ const CODEX_NATIVE_SANDBOX_TOOL_REQUIREMENTS = [
 	"apply_patch"
 ];
 const CODEX_MEMORY_FLUSH_DYNAMIC_TOOL_ALLOW = /* @__PURE__ */ new Set(["read", "write"]);
+/** Keeps paired-device filesystem and process ownership on its native exec-server. */
+function resolveCodexNodePlacementToolConstructionPlan(sandbox, nativeToolSurfaceEnabled) {
+	if (!isCodexRemoteExecPlacementSandbox(sandbox) || sandbox?.backendId !== "node" || !("placementNodeId" in sandbox) || typeof sandbox.placementNodeId !== "string" || !sandbox.placementNodeId) return;
+	if (!nativeToolSurfaceEnabled) throw new Error("Codex paired-device remote execution requires its native exec-server tool surface; adjust the session tool policy and start a fresh attempt.");
+	return {
+		includeBaseCodingTools: false,
+		includeShellTools: false,
+		includeChannelTools: true,
+		includeOpenClawTools: true,
+		includePluginTools: true
+	};
+}
 function preserveRingZeroSystemAgentTool(allTools, filteredTools) {
 	const openclaw = allTools.find((tool) => tool.name === "openclaw" && tool.catalogMode === "direct-only");
 	if (!openclaw) return filteredTools;
@@ -1497,101 +1533,123 @@ async function buildDynamicTools(input) {
 	const injectedOpenClawCodingToolsFactory = dynamicToolBuildState.openClawCodingToolsFactory;
 	let agentHarnessModule;
 	const loadAgentHarnessModule = async () => agentHarnessModule ??= await import("openclaw/plugin-sdk/agent-harness");
-	const createOpenClawCodingTools = injectedOpenClawCodingToolsFactory ?? (await loadAgentHarnessModule()).createOpenClawCodingTools;
 	toolBuildStages.mark("load-agent-harness-tools");
 	const sessionKeys = resolveOpenClawCodingToolsSessionKeys(params, input.sandboxSessionKey);
 	const nativeExecutionPolicy = resolveCodexNativeExecutionPolicyForDynamicTools(input);
-	const buildOpenClawCodingTools = () => params.hostCapabilities.bindToolSurface(createOpenClawCodingTools({
-		agentId: input.sessionAgentId,
-		...buildEmbeddedAttemptToolRunContext(params),
-		exec: {
-			...params.execOverrides,
-			...resolveCodexNodeExecToolOverrides(nativeExecutionPolicy),
-			config: params.config,
-			elevated: params.bashElevated
-		},
-		sandbox: input.sandbox,
-		messageProvider: resolveCodexMessageToolProvider(params),
-		toolPolicyMessageProvider: params.messageProvider ?? params.messageChannel,
-		clientCaps: params.clientCaps,
-		chatType: params.chatType,
-		agentAccountId: params.agentAccountId,
-		messageTo: params.messageTo,
-		messageThreadId: params.messageThreadId,
-		nativeChannelId: params.chatId,
-		messageActionTurnCapability: params.messageActionTurnCapability,
-		groupId: params.groupId,
-		groupChannel: params.groupChannel,
-		groupSpace: params.groupSpace,
-		spawnedBy: params.spawnedBy,
-		senderId: params.senderId,
-		senderName: params.senderName,
-		senderUsername: params.senderUsername,
-		senderE164: params.senderE164,
-		senderIsOwner: params.senderIsOwner,
-		inputProvenance: params.inputProvenance,
-		trustedInternalHandoff: params.trustedInternalHandoff,
-		scheduledToolPolicy: params.scheduledToolPolicy,
-		allowGatewaySubagentBinding: params.allowGatewaySubagentBinding || isForcedPrivateQaCodexRuntime(),
-		...sessionKeys,
-		sessionId: params.sessionId,
-		runId: params.runId,
-		approvalReviewerDeviceId: params.approvalReviewerDeviceId,
-		agentDir,
-		cwd: input.effectiveCwd ?? input.effectiveWorkspace,
-		workspaceDir: input.effectiveWorkspace,
-		spawnWorkspaceDir: input.effectiveCwd && input.effectiveCwd !== input.effectiveWorkspace ? input.resolvedWorkspace : resolveAttemptSpawnWorkspaceDir({
-			sandbox: input.sandbox,
-			resolvedWorkspace: input.resolvedWorkspace
-		}),
+	const webSearchPlan = resolveCodexWebSearchPlan({
 		config: params.config,
-		authProfileStore: params.toolAuthProfileStore ?? params.authProfileStore,
-		abortSignal: input.runAbortController.signal,
-		emitBeforeToolCallDiagnostics: false,
-		modelProvider: params.model.provider,
-		modelId: params.modelId,
-		modelCompat: params.model.compat && typeof params.model.compat === "object" ? params.model.compat : void 0,
-		modelApi: params.model.api,
-		modelContextWindowTokens: params.model.contextWindow,
-		delegationCapability: params.delegationCapability,
-		modelAuthMode: resolveModelAuthMode(params.model.provider, params.config, params.toolAuthProfileStore ?? params.authProfileStore, { workspaceDir: input.effectiveWorkspace }),
-		suppressManagedWebSearch: false,
-		currentChannelId: params.currentChannelId,
-		currentMessagingTarget: params.currentMessagingTarget,
-		hookChannelId: resolveCodexAppServerHookChannelId(params, input.sandboxSessionKey),
-		currentThreadTs: params.currentThreadTs,
-		currentMessageId: params.currentMessageId,
-		replyToMode: params.replyToMode,
-		hasRepliedRef: params.hasRepliedRef,
-		modelHasVision,
-		computerContextEpoch: input.computerContextEpoch,
-		requireExplicitMessageTarget: params.requireExplicitMessageTarget ?? isSubagentSessionKey(params.sessionKey),
-		sourceReplyDeliveryMode: params.sourceReplyDeliveryMode,
-		taskSuggestionDeliveryMode: params.taskSuggestionDeliveryMode,
-		disableMessageTool: input.ignoreDisableMessageTool ? false : params.disableMessageTool,
-		forceMessageTool: shouldForceMessageTool(messagePolicyParams),
-		enableHeartbeatTool: params.trigger === "heartbeat" || input.forceHeartbeatTool === true,
-		forceHeartbeatTool: params.trigger === "heartbeat" || input.forceHeartbeatTool === true,
-		onYield: (message) => {
-			input.onYieldDetected();
-			input.onCodexAppServerEvent?.({
-				stream: "codex_app_server.tool",
-				data: {
-					name: "sessions_yield",
-					message
-				}
-			});
-		},
-		recordToolPrepStage: (name) => {
-			toolBuildStages.mark(name);
-		},
-		onToolOutcome: params.onToolOutcome,
-		isTurnTainted: params.isTurnTainted,
-		allocateToolOutcomeOrdinal: params.allocateToolOutcomeOrdinal,
-		cronCreatorToolAllowlistRef: input.cronCreatorToolAllowlistRef,
-		cronCreatorToolAllowlistCaptureRef: input.cronCreatorToolAllowlistCaptureRef,
-		cronCreatorAuthorityUnavailableReason: input.cronCreatorAuthorityUnavailableReason
-	}), { cwd: input.effectiveCwd ?? input.effectiveWorkspace });
+		disableTools: params.disableTools,
+		nativeToolSurfaceEnabled: input.nativeToolSurfaceEnabled,
+		nativeProviderWebSearchSupport: input.nativeProviderWebSearchSupport
+	});
+	const webFetchHostnameAllowlistRef = {};
+	const buildOpenClawCodingTools = () => {
+		const toolConstructionPlan = resolveCodexNodePlacementToolConstructionPlan(input.sandbox, input.nativeToolSurfaceEnabled);
+		const options = {
+			agentId: input.sessionAgentId,
+			...buildEmbeddedAttemptToolRunContext(params),
+			exec: {
+				...params.execOverrides,
+				...resolveCodexNodeExecToolOverrides(nativeExecutionPolicy),
+				config: params.config,
+				elevated: params.bashElevated
+			},
+			sessionPermissionPolicy: params.permissionMode && params.sessionRoot ? {
+				mode: params.permissionMode,
+				root: params.sessionRoot
+			} : void 0,
+			sandbox: input.sandbox,
+			...toolConstructionPlan ? { toolConstructionPlan } : {},
+			messageProvider: resolveCodexMessageToolProvider(params),
+			toolPolicyMessageProvider: params.messageProvider ?? params.messageChannel,
+			clientCaps: params.clientCaps,
+			chatType: params.chatType,
+			agentAccountId: params.agentAccountId,
+			messageTo: params.messageTo,
+			messageThreadId: params.messageThreadId,
+			nativeChannelId: params.chatId,
+			messageActionTurnCapability: params.messageActionTurnCapability,
+			groupId: params.groupId,
+			groupChannel: params.groupChannel,
+			groupSpace: params.groupSpace,
+			spawnedBy: params.spawnedBy,
+			senderId: params.senderId,
+			senderName: params.senderName,
+			senderUsername: params.senderUsername,
+			senderE164: params.senderE164,
+			senderIsOwner: params.senderIsOwner,
+			inputProvenance: params.inputProvenance,
+			trustedInternalHandoff: params.trustedInternalHandoff,
+			scheduledToolPolicy: params.scheduledToolPolicy,
+			allowGatewaySubagentBinding: params.allowGatewaySubagentBinding || isForcedPrivateQaCodexRuntime(),
+			...sessionKeys,
+			sessionId: params.sessionId,
+			runId: params.runId,
+			approvalReviewerDeviceId: params.approvalReviewerDeviceId,
+			agentDir,
+			preparedModelRuntime: params.preparedModelRuntime,
+			cwd: input.effectiveCwd ?? input.effectiveWorkspace,
+			workspaceDir: input.effectiveWorkspace,
+			spawnWorkspaceDir: input.effectiveCwd && input.effectiveCwd !== input.effectiveWorkspace ? input.resolvedWorkspace : resolveAttemptSpawnWorkspaceDir({
+				sandbox: input.sandbox,
+				resolvedWorkspace: input.resolvedWorkspace
+			}),
+			config: params.config,
+			authProfileStore: params.toolAuthProfileStore ?? params.authProfileStore,
+			abortSignal: input.runAbortController.signal,
+			emitBeforeToolCallDiagnostics: false,
+			modelProvider: params.model.provider,
+			modelId: params.modelId,
+			modelCompat: params.model.compat && typeof params.model.compat === "object" ? params.model.compat : void 0,
+			modelApi: params.model.api,
+			modelContextWindowTokens: params.model.contextWindow,
+			delegationCapability: params.delegationCapability,
+			modelAuthMode: resolveModelAuthMode(params.model.provider, params.config, params.toolAuthProfileStore ?? params.authProfileStore, { workspaceDir: input.effectiveWorkspace }),
+			suppressManagedWebSearch: false,
+			webFetchHostnameAllowlistRef,
+			currentChannelId: params.currentChannelId,
+			currentMessagingTarget: params.currentMessagingTarget,
+			hookChannelId: resolveCodexAppServerHookChannelId(params, input.sandboxSessionKey),
+			currentThreadTs: params.currentThreadTs,
+			currentMessageId: params.currentMessageId,
+			replyToMode: params.replyToMode,
+			hasRepliedRef: params.hasRepliedRef,
+			modelHasVision,
+			computerContextEpoch: input.computerContextEpoch,
+			requireExplicitMessageTarget: params.requireExplicitMessageTarget ?? isSubagentSessionKey(params.sessionKey),
+			sourceReplyDeliveryMode: params.sourceReplyDeliveryMode,
+			taskSuggestionDeliveryMode: params.taskSuggestionDeliveryMode,
+			disableMessageTool: input.ignoreDisableMessageTool ? false : params.disableMessageTool,
+			forceMessageTool: shouldForceMessageTool(messagePolicyParams),
+			enableHeartbeatTool: params.trigger === "heartbeat" || input.forceHeartbeatTool === true,
+			forceHeartbeatTool: params.trigger === "heartbeat" || input.forceHeartbeatTool === true,
+			onYield: (message, acknowledgment) => {
+				input.onYieldDetected(acknowledgment);
+				input.onCodexAppServerEvent?.({
+					stream: "codex_app_server.tool",
+					data: {
+						name: "sessions_yield",
+						message
+					}
+				});
+			},
+			claimYieldCompletion: input.claimYieldCompletion,
+			recordToolPrepStage: (name) => {
+				toolBuildStages.mark(name);
+			},
+			onToolOutcome: params.onToolOutcome,
+			isTurnTainted: params.isTurnTainted,
+			allocateToolOutcomeOrdinal: params.allocateToolOutcomeOrdinal,
+			cronCreatorToolAllowlistRef: input.cronCreatorToolAllowlistRef,
+			cronCreatorToolAllowlistCaptureRef: input.cronCreatorToolAllowlistCaptureRef,
+			cronCreatorAuthorityUnavailableReason: input.cronCreatorAuthorityUnavailableReason
+		};
+		const bindingOptions = { cwd: input.effectiveCwd ?? input.effectiveWorkspace };
+		if (injectedOpenClawCodingToolsFactory) return params.hostCapabilities.bindToolSurface(injectedOpenClawCodingToolsFactory(options), bindingOptions);
+		const createToolSurface = params.hostCapabilities.createToolSurface;
+		if (!createToolSurface) throw new Error("Codex tool construction requires a current host capability");
+		return createToolSurface(options, bindingOptions);
+	};
 	const allTools = input.resolveCronCreatorToolAuthority ? runWithCronCreatorAuthorityCapabilityResolver({
 		capability: params.cronCreatorAuthorityCapability,
 		runId: params.runId,
@@ -1602,20 +1660,14 @@ async function buildDynamicTools(input) {
 	const preNormalizationDiagnostics = [];
 	const readableAllToolProjection = filterProviderNormalizableTools(allTools);
 	preNormalizationDiagnostics.push(...readableAllToolProjection.diagnostics);
-	const webSearchPlan = resolveCodexWebSearchPlan({
-		config: params.config,
-		disableTools: params.disableTools,
-		nativeToolSurfaceEnabled: input.nativeToolSurfaceEnabled,
-		nativeProviderWebSearchSupport: input.nativeProviderWebSearchSupport
-	});
 	const readableAllTools = [...readableAllToolProjection.tools];
 	const normallyProfiledTools = input.nativeToolSurfaceEnabled === false ? filterCodexDynamicToolsForDisabledNativeSurface(readableAllTools, input.pluginConfig, { preserveShell: shouldKeepOpenClawShellDynamicTools(input, nativeExecutionPolicy) }) : filterCodexDynamicTools(readableAllTools, input.pluginConfig);
 	const profileFilteredTools = (input.isHostScopedToolActive?.("openclaw") ?? isHostScopedAgentToolActive("openclaw")) && isSystemAgentOnlyCodexDynamicToolAllowlist(params.toolsAllow) ? preserveRingZeroSystemAgentTool(readableAllTools, normallyProfiledTools) : normallyProfiledTools;
-	const codexFilteredTools = addNodeShellDynamicToolsIfNeeded(addSandboxShellDynamicToolsIfAvailable(isCodexMemoryFlushRun(params) ? filterCodexMemoryFlushDynamicTools(readableAllTools) : profileFilteredTools, readableAllTools, input), readableAllTools, input, nativeExecutionPolicy);
+	const codexFilteredTools = addNodeShellDynamicToolsIfNeeded(addGatewayShellDynamicToolsIfAvailable(addSandboxShellDynamicToolsIfAvailable(isCodexMemoryFlushRun(params) ? filterCodexMemoryFlushDynamicTools(readableAllTools) : profileFilteredTools, readableAllTools, input), readableAllTools, input, nativeExecutionPolicy), readableAllTools, input, nativeExecutionPolicy);
 	toolBuildStages.mark("codex-filtering");
-	const visionFilteredTools = filterToolsForVisionInputs(codexFilteredTools, {
+	const visionFilteredTools = filterCodexVisionTools(codexFilteredTools, {
 		modelHasVision,
-		hasInboundImages: (params.images?.length ?? 0) > 0
+		nativeImageInspectionEnabled: input.nativeToolSurfaceEnabled === true
 	});
 	toolBuildStages.mark("vision-filtering");
 	const webSearchPresent = visionFilteredTools.some((tool) => tool.name === "web_search");
@@ -1662,7 +1714,9 @@ async function buildDynamicTools(input) {
 		onPreNormalizationSchemaDiagnostics: (diagnostics) => preNormalizationDiagnostics.push(...diagnostics)
 	});
 	toolBuildStages.mark("runtime-normalization");
-	input.onWebSearchPolicyResolved?.(normalizedTools.some((tool) => tool.name === "web_search"));
+	const webSearchAllowed = normalizedTools.some((tool) => tool.name === "web_search");
+	webFetchHostnameAllowlistRef.value = webSearchAllowed ? webSearchPlan.webFetchHostnameAllowlist : void 0;
+	input.onWebSearchPolicyResolved?.(webSearchAllowed);
 	const exposedTools = webSearchPlan.suppressManagedWebSearch ? normalizedTools.filter((tool) => tool.name !== "web_search") : normalizedTools;
 	if (preNormalizationDiagnostics.length > 0) embeddedAgentLog.warn(`codex app-server quarantined ${preNormalizationDiagnostics.length} unsupported runtime tool schema${preNormalizationDiagnostics.length === 1 ? "" : "s"} before dynamic tool registration`, {
 		runId: params.runId,
@@ -1695,6 +1749,23 @@ async function buildDynamicTools(input) {
 	}
 	return exposedTools;
 }
+/** Keeps the OpenClaw Gateway execution path available beside Codex native shell. */
+function addGatewayShellDynamicToolsIfAvailable(filteredTools, allTools, input, executionPolicy) {
+	if (isCodexMemoryFlushRun(input.params) || input.nativeToolSurfaceEnabled !== true || input.sandbox?.enabled === true || !executionPolicy.nativeToolSurfaceAllowed || executionPolicy.effectiveExecHost !== "gateway") return filteredTools;
+	const execTool = allTools.find((tool) => normalizeCodexDynamicToolName(tool.name) === "exec");
+	const processTool = allTools.find((tool) => normalizeCodexDynamicToolName(tool.name) === "process");
+	const existingNames = new Set(filteredTools.map((tool) => normalizeCodexDynamicToolName(tool.name)));
+	const execExcluded = isCodexDynamicToolExcluded(input.pluginConfig, ["exec", CODEX_GATEWAY_EXEC_DYNAMIC_TOOL_NAME]);
+	if (!execTool || execExcluded || existingNames.has("gateway_exec")) return filteredTools;
+	const processExcluded = isCodexDynamicToolExcluded(input.pluginConfig, ["process", CODEX_GATEWAY_PROCESS_DYNAMIC_TOOL_NAME]);
+	const processAliasAvailable = Boolean(processTool && !processExcluded && !existingNames.has("gateway_process"));
+	const toolsToAppend = [createExecAliasDynamicTool(execTool, {
+		host: "gateway",
+		processAliasAvailable
+	})];
+	if (processAliasAvailable && processTool) toolsToAppend.push(createGatewayProcessAliasDynamicTool(processTool));
+	return [...filteredTools, ...toolsToAppend];
+}
 /** Preserves delivery-critical tools when a narrow allowlist would otherwise hide them. */
 function includeForcedCodexDynamicToolAllow(toolsAllow, params) {
 	if (toolsAllow === void 0 || hasWildcardCodexToolsAllow(toolsAllow)) return toolsAllow;
@@ -1710,6 +1781,11 @@ function shouldEnableCodexAppServerNativeToolSurface(params, sandbox, options =
 	if (params.pluginHarnessToolPolicyRestricted === true) return false;
 	if (isCodexMemoryFlushRun(params)) return false;
 	if (params.disableTools) return false;
+	if (isCodexNativeExecutionBlockedByNodeExecHost(params, {
+		agentId: options.agentId,
+		runtimeSessionKey: options.runtimeSessionKey,
+		sandbox
+	})) return false;
 	const toolsAllow = includeForcedCodexDynamicToolAllow(params.toolsAllow, params);
 	if (toolsAllow === void 0) return canCodexAppServerNativeToolSurfaceHonorSandbox(sandbox, options);
 	return hasWildcardCodexToolsAllow(toolsAllow) && canCodexAppServerNativeToolSurfaceHonorSandbox(sandbox, options);
@@ -1731,7 +1807,7 @@ function resolveCodexRuntimePolicySessionKey(params, runtimeSessionKey) {
 }
 function canCodexAppServerNativeToolSurfaceHonorSandbox(sandbox, options = {}) {
 	if (!sandbox?.enabled) return true;
-	if (options.sandboxExecServerEnabled === true && sandbox.backend && canSandboxToolPolicyExposeCodexNativeToolSurface(sandbox)) return true;
+	if (options.sandboxExecServerEnabled === true && (sandbox.backend || isCodexRemoteExecPlacementSandbox(sandbox)) && canSandboxToolPolicyExposeCodexNativeToolSurface(sandbox)) return true;
 	return false;
 }
 function canSandboxToolPolicyExposeCodexNativeToolSurface(sandbox) {
@@ -1807,7 +1883,7 @@ function addSandboxShellDynamicToolsIfAvailable(filteredTools, allTools, input)
 	const sandboxProcessTool = {
 		...processTool,
 		name: "sandbox_process",
-		description: "Manage sandbox_exec sessions that were started through OpenClaw's configured sandbox backend for this session: list, poll, log, write, send-keys, submit, paste, kill, clear, or remove. Use only for sandbox_exec follow-up; use Codex's native shell session handling only when no OpenClaw sandbox is active and native Code Mode is available."
+		description: "Manage background shell sessions through OpenClaw's configured sandbox backend for this session: list, poll, log, write, send-keys, submit, paste, kill, clear, or remove. Use only for sandbox follow-up; use Codex's native shell session handling only when no OpenClaw sandbox is active and native Code Mode is available."
 	};
 	return [
 		...filteredTools,
@@ -1839,12 +1915,12 @@ function addNodeShellDynamicToolsIfNeeded(filteredTools, allTools, input, nodePo
 	const nodeExecAvailableFromAuto = nodePolicy.requestedExecHost === "auto" && nodePolicy.effectiveExecHost === "gateway";
 	if (!nodeExecIsDefault && !nodeExecAvailableFromAuto) return filteredTools;
 	const execTool = allTools.find((tool) => normalizeCodexDynamicToolName(tool.name) === "exec");
-	const processTool = allTools.find((tool) => normalizeCodexDynamicToolName(tool.name) === "process");
-	if (!execTool || !processTool) return filteredTools;
-	const toolsToAppend = [];
-	if (!isCodexDynamicToolExcluded(input.pluginConfig, ["exec", "node_exec"]) && !filteredTools.some((tool) => normalizeCodexDynamicToolName(tool.name) === "node_exec")) toolsToAppend.push(createNodeExecDynamicTool(execTool, nodePolicy.node));
-	if (!isCodexDynamicToolExcluded(input.pluginConfig, ["process", "node_process"]) && !filteredTools.some((tool) => normalizeCodexDynamicToolName(tool.name) === "node_process")) toolsToAppend.push(createNodeProcessDynamicTool(processTool));
-	return toolsToAppend.length > 0 ? [...filteredTools, ...toolsToAppend] : filteredTools;
+	if (!execTool) return filteredTools;
+	if (!isCodexDynamicToolExcluded(input.pluginConfig, ["exec", "node_exec"]) && !filteredTools.some((tool) => normalizeCodexDynamicToolName(tool.name) === "node_exec")) return [...filteredTools, createExecAliasDynamicTool(execTool, {
+		host: "node",
+		node: nodePolicy.node
+	})];
+	return filteredTools;
 }
 function shouldKeepOpenClawShellDynamicTools(input, nodePolicy) {
 	return !isCodexMemoryFlushRun(input.params) && input.nativeToolSurfaceEnabled === false && input.sandbox?.enabled !== true && nodePolicy.effectiveExecHost !== "node";
@@ -1868,7 +1944,7 @@ function filterCodexDynamicToolsForAllowlist(tools, toolsAllow) {
 	const allowSet = new Set(toolsAllow.map((name) => normalizeCodexDynamicToolName(name)).filter(Boolean));
 	return tools.filter((tool) => {
 		const normalized = normalizeCodexDynamicToolName(tool.name);
-		return allowSet.has(normalized) || normalized === "sandbox_exec" && allowSet.has("exec") || normalized === "sandbox_process" && (allowSet.has("exec") || allowSet.has("process")) || normalized === "node_exec" && allowSet.has("exec") || normalized === "node_process" && (allowSet.has("exec") || allowSet.has("process"));
+		return allowSet.has(normalized) || normalized === "sandbox_exec" && allowSet.has("exec") || normalized === "sandbox_process" && (allowSet.has("exec") || allowSet.has("process")) || normalized === "gateway_exec" && allowSet.has("exec") || normalized === "gateway_process" && (allowSet.has("exec") || allowSet.has("process")) || normalized === "node_exec" && allowSet.has("exec");
 	});
 }
 /** Detects the wildcard allowlist marker after Codex tool-name normalization. */
@@ -1880,9 +1956,317 @@ function shouldForceMessageTool(params) {
 	return params.disableMessageTool !== true && params.sourceReplyDeliveryMode === "message_tool_only";
 }
 //#endregion
+//#region extensions/codex/src/app-server/sandbox-exec-server-node-relay.ts
+const CODEX_NODE_EXEC_SERVER_MAX_MESSAGE_BYTES$1 = 64 * 1024 * 1024;
+const CODEX_NODE_EXEC_SERVER_MAX_FAILURE_DETAIL_CHARS = 240;
+const CODEX_NODE_HTTP_CREDENTIAL_BODY_MAX_BYTES = 1024 * 1024;
+const CODEX_NODE_HTTP_CREDENTIAL_SCAN_MAX_FIELDS = 256;
+const CODEX_NODE_HTTP_CREDENTIAL_SCAN_MAX_DEPTH = 8;
+const CODEX_NODE_HTTP_CREDENTIAL_HEADER_NAMES = /* @__PURE__ */ new Set([
+	"authorization",
+	"proxy-authorization",
+	"cookie",
+	"set-cookie",
+	"x-api-key",
+	"api-key",
+	"apikey",
+	"x-auth-token",
+	"auth-token",
+	"x-access-token",
+	"access-token",
+	"x-secret-key",
+	"secret-key",
+	"x-goog-api-key",
+	"x-vault-token",
+	"x-api-token"
+]);
+const CODEX_NODE_HTTP_CREDENTIAL_HEADER_NAME_PATTERN = /(?:^|[-_])(?:auth(?:orization|entication)?|token|secret|api[-_]?key|apikey|key|password|passwd|pwd|passphrase|passcode|credentials?|session|jwt|assertion|verifier|sig(?:nature)?|hmac|bearer|ticket|challenge|proof|dpop|otp|totp|pin|mfa)(?:[-_]|$)/iu;
+const CODEX_NODE_HTTP_CREDENTIAL_FIELD_NAME_PATTERN = /^(?:(?:[a-z\d]+_)*(?:token|secret|password|passwd|pwd|passphrase|passcode|credentials?|authorization|api_?key|private_key|secret_key|secret_access_key|jwt|assertion|verifier|signature|hmac|bearer|ticket|(?:oauth|consumer|auth|access)_key|otp|totp|pin)|(?:device|authorization|auth|verification|mfa)_code|session(?:_id)?|jsessionid|saml(?:_?response|_?assertion)?|auth|jwt|code|sig|signature|hmac|key|pass)$/u;
+const nodeExecServerTextDecoder = new TextDecoder("utf-8", { fatal: true });
+/** Produces the bounded, redacted terminal failure shared by pending and claimed node leases. */
+function createCodexNodeExecServerDisconnectError(reason, cause) {
+	const detail = cause === void 0 ? "" : `: ${truncateUtf16Safe(redactSensitiveText(formatErrorMessage$1(cause), { mode: "tools" }), CODEX_NODE_EXEC_SERVER_MAX_FAILURE_DETAIL_CHARS)}`;
+	return /* @__PURE__ */ new Error(`Codex paired execution device disconnected; start a fresh attempt. (${reason}${detail})`);
+}
+/** Relays one authorized, single-use Codex exec-server channel without interpreting its protocol. */
+async function startCodexNodeExecServerRelay(params) {
+	const { channel } = params.lease;
+	const { socket } = params;
+	let closed = false;
+	const { promise: finished, resolve: finish } = createDeferred();
+	let unsubscribe = () => {};
+	const closeBoth = (code = 1001, reason = "execution channel closed") => {
+		if (closed) return;
+		closed = true;
+		unsubscribe();
+		params.lease.closeRelay = void 0;
+		params.lease.onChannelClosed = void 0;
+		if (!params.lease.closed) {
+			params.lease.closed = true;
+			channel.close();
+		}
+		if (socket.readyState === socket.OPEN || socket.readyState === socket.CONNECTING) socket.close(code, reason);
+		finish();
+	};
+	params.lease.closeRelay = closeBoth;
+	const failUnexpectedly = (code, reason, cause) => {
+		if (!closed && !params.lease.closed) params.lease.onDisconnected?.(createCodexNodeExecServerDisconnectError(reason, cause));
+		closeBoth(code, reason);
+	};
+	params.lease.onChannelClosed = ({ failed, error }) => failUnexpectedly(failed ? 1011 : 1001, failed ? "execution device failed" : "execution device disconnected", error);
+	socket.once("close", () => failUnexpectedly(1001, "execution socket closed"));
+	socket.once("error", () => failUnexpectedly(1011, "execution socket failed"));
+	let toNode = Promise.resolve();
+	socket.on("message", (data) => {
+		if (closed) return;
+		socket.pause();
+		toNode = toNode.then(async () => {
+			const frame = normalizeCodexExecServerFrame(data);
+			const request = validateCodexExecServerMessage(frame);
+			const rejection = rejectCredentialedCodexNodeHttpRequest(request);
+			if (rejection) await sendCodexExecServerFrame(socket, rejection);
+			else await channel.send(sanitizeCodexExecServerRequest(frame, request));
+			if (!closed) socket.resume();
+		}).catch((error) => {
+			failUnexpectedly(error instanceof RangeError ? 1009 : 1007, "invalid execution message");
+		});
+	});
+	unsubscribe = channel.onMessage(async (message) => {
+		if (closed) return;
+		try {
+			const frame = normalizeCodexExecServerFrame(message);
+			validateCodexExecServerMessage(frame);
+			await sendCodexExecServerFrame(socket, frame);
+		} catch (error) {
+			failUnexpectedly(error instanceof RangeError ? 1009 : 1007, "invalid device message");
+		}
+	});
+	await finished;
+}
+function sendCodexExecServerFrame(socket, frame) {
+	return new Promise((resolve, reject) => {
+		socket.send(frame, { binary: false }, (error) => {
+			if (error) {
+				reject(error);
+				return;
+			}
+			resolve();
+		});
+	});
+}
+function normalizeCodexExecServerFrame(data) {
+	const frame = Array.isArray(data) ? Buffer.concat(data) : Buffer.isBuffer(data) ? data : data instanceof Uint8Array ? Buffer.from(data.buffer, data.byteOffset, data.byteLength) : Buffer.from(data);
+	if (frame.length > CODEX_NODE_EXEC_SERVER_MAX_MESSAGE_BYTES$1) throw new RangeError("Codex exec-server message exceeds its 64 MiB limit.");
+	if (frame.includes(10) || frame.includes(13)) throw new Error("Codex exec-server messages must occupy exactly one stdio line.");
+	return frame;
+}
+function validateCodexExecServerMessage(frame) {
+	const parsed = JSON.parse(nodeExecServerTextDecoder.decode(frame));
+	if (!isRecord(parsed)) throw new Error("Codex exec-server message must be a JSON object.");
+	return parsed;
+}
+function rejectCredentialedCodexNodeHttpRequest(request) {
+	if (request.method !== "http/request") return;
+	if (!isRecord(request.params)) throw new Error("Codex http/request params must be an object.");
+	const headers = request.params.headers ?? [];
+	if (!Array.isArray(headers)) throw new Error("Codex http/request headers must be an array.");
+	if (headers.length > CODEX_NODE_HTTP_CREDENTIAL_SCAN_MAX_FIELDS) return createCredentialedCodexNodeHttpRejection(request);
+	let credentialBearing = false;
+	let contentType;
+	for (const header of headers) {
+		if (!isRecord(header) || typeof header.name !== "string" || typeof header.value !== "string") throw new Error("Codex http/request headers must contain string names and values.");
+		const name = header.name.trim().toLowerCase();
+		if (CODEX_NODE_HTTP_CREDENTIAL_HEADER_NAMES.has(name) || CODEX_NODE_HTTP_CREDENTIAL_HEADER_NAME_PATTERN.test(name) || hasSensitiveCodexNodeText(header.value)) credentialBearing = true;
+		if (name === "content-type") {
+			const declared = header.value.split(";", 1)[0]?.trim().toLowerCase();
+			credentialBearing ||= Boolean(contentType && contentType !== declared);
+			contentType = declared;
+		}
+	}
+	if (!credentialBearing && typeof request.params.url === "string") credentialBearing = hasCredentialedCodexNodeHttpUrl(request.params.url);
+	if (!credentialBearing && request.params.bodyBase64 != null) credentialBearing = hasCredentialedCodexNodeHttpBody(request.params.bodyBase64, contentType);
+	return credentialBearing ? createCredentialedCodexNodeHttpRejection(request) : void 0;
+}
+function hasCredentialedCodexNodeHttpUrl(value) {
+	let url;
+	try {
+		url = new URL(value);
+	} catch {
+		throw new Error("Codex http/request URL must be valid.");
+	}
+	if (url.username || url.password || hasSensitiveCodexNodeText(value)) return true;
+	let fields = 0;
+	const hasCredentialedParameter = (name, parameterValue) => ++fields > CODEX_NODE_HTTP_CREDENTIAL_SCAN_MAX_FIELDS || isCodexNodeCredentialField(name) || hasSensitiveCodexNodeText(parameterValue);
+	for (const parameters of [url.searchParams, new URLSearchParams(url.hash.slice(1))]) for (const [name, parameterValue] of parameters) if (hasCredentialedParameter(name, parameterValue)) return true;
+	for (const initial of [
+		url.pathname,
+		url.hash.slice(1),
+		...url.searchParams.values()
+	]) {
+		let component = initial;
+		for (let depth = 0; depth <= CODEX_NODE_HTTP_CREDENTIAL_SCAN_MAX_DEPTH; depth += 1) {
+			for (const nestedQuery of component.split(/[?#]/u).slice(1)) for (const [name, parameterValue] of new URLSearchParams(nestedQuery)) if (hasCredentialedParameter(name, parameterValue)) return true;
+			for (const segment of component.split("/")) for (const parameter of segment.split(";").slice(1)) {
+				const separator = parameter.indexOf("=");
+				if (hasCredentialedParameter(separator < 0 ? parameter : parameter.slice(0, separator), separator < 0 ? "" : parameter.slice(separator + 1))) return true;
+			}
+			if (!/%[\da-f]{2}/iu.test(component)) break;
+			if (depth === CODEX_NODE_HTTP_CREDENTIAL_SCAN_MAX_DEPTH) return true;
+			try {
+				component = decodeURIComponent(component);
+			} catch {
+				return true;
+			}
+		}
+	}
+	return false;
+}
+function hasCredentialedCodexNodeHttpBody(value, contentType) {
+	if (typeof value !== "string") throw new Error("Codex http/request bodyBase64 must be a string.");
+	const declaredText = contentType === "text/plain";
+	if (!declaredText && value.length > Math.ceil(CODEX_NODE_HTTP_CREDENTIAL_BODY_MAX_BYTES / 3) * 4) return true;
+	let body;
+	try {
+		const decoded = Buffer.from(value, "base64");
+		if (!declaredText && decoded.length > CODEX_NODE_HTTP_CREDENTIAL_BODY_MAX_BYTES || decoded.toString("base64") !== value) return true;
+		body = nodeExecServerTextDecoder.decode(decoded);
+	} catch {
+		return true;
+	}
+	if (!body) return false;
+	if (hasSensitiveCodexNodeText(body)) return true;
+	const declaredJson = contentType === "application/json" || contentType?.endsWith("+json") === true;
+	const declaredForm = contentType === "application/x-www-form-urlencoded";
+	if (contentType && !declaredJson && !declaredForm && !declaredText) return true;
+	const trimmed = body.trimStart();
+	if (trimmed.startsWith("<")) return true;
+	if (declaredJson || trimmed.startsWith("{") || trimmed.startsWith("[")) try {
+		if (hasCredentialedCodexNodeRawJsonStrings(body)) return true;
+		return hasCredentialedCodexNodeJsonFields(JSON.parse(body));
+	} catch {
+		if (!declaredText) return true;
+	}
+	if (!declaredForm && !body.includes("=")) return !declaredText;
+	let fields = 0;
+	for (const [name, parameterValue] of new URLSearchParams(body)) if (++fields > CODEX_NODE_HTTP_CREDENTIAL_SCAN_MAX_FIELDS || isCodexNodeCredentialField(name) || hasSensitiveCodexNodeText(parameterValue)) return true;
+	return false;
+}
+function hasCredentialedCodexNodeRawJsonStrings(body) {
+	const tokens = body.matchAll(/("(?:\\.|[^"\\])*")(\s*:)?/gu);
+	let fields = 0;
+	for (const match of tokens) {
+		const value = JSON.parse(match[1]);
+		if (++fields > CODEX_NODE_HTTP_CREDENTIAL_SCAN_MAX_FIELDS || typeof value !== "string" || hasSensitiveCodexNodeText(value) || match[2] !== void 0 && isCodexNodeCredentialField(value)) return true;
+	}
+	return false;
+}
+function hasCredentialedCodexNodeJsonFields(value) {
+	const pending = [{
+		value,
+		depth: 0
+	}];
+	let fields = 0;
+	while (pending.length > 0) {
+		const current = pending.pop();
+		if (typeof current?.value === "string" && hasSensitiveCodexNodeText(current.value)) return true;
+		if (!current || !Array.isArray(current.value) && !isRecord(current.value)) continue;
+		if (current.depth >= CODEX_NODE_HTTP_CREDENTIAL_SCAN_MAX_DEPTH) return true;
+		const entries = Array.isArray(current.value) ? current.value.map((entry) => [void 0, entry]) : Object.entries(current.value);
+		for (const [name, nested] of entries) {
+			if (++fields > CODEX_NODE_HTTP_CREDENTIAL_SCAN_MAX_FIELDS || typeof name === "string" && isCodexNodeCredentialField(name)) return true;
+			pending.push({
+				value: nested,
+				depth: current.depth + 1
+			});
+		}
+	}
+	return false;
+}
+function hasSensitiveCodexNodeText(value) {
+	let decoded = value;
+	for (let depth = 0; depth <= CODEX_NODE_HTTP_CREDENTIAL_SCAN_MAX_DEPTH; depth += 1) {
+		if (redactToolPayloadText(decoded) !== decoded) return true;
+		if (!/%[\da-f]{2}/iu.test(decoded)) return false;
+		try {
+			decoded = decodeURIComponent(decoded);
+		} catch {
+			return true;
+		}
+	}
+	return true;
+}
+function isCodexNodeCredentialField(value) {
+	let decoded = value;
+	for (let depth = 0; depth < CODEX_NODE_HTTP_CREDENTIAL_SCAN_MAX_DEPTH; depth += 1) {
+		let next;
+		try {
+			next = decodeURIComponent(decoded);
+		} catch {
+			return true;
+		}
+		if (next === decoded) break;
+		decoded = next;
+	}
+	const normalized = decoded.replace(/[\p{C}\p{Z}\u115F\u1160\u3164\uFFA0+]/gu, "").replace(/([a-z\d])([A-Z])/gu, "$1_$2").replaceAll("-", "_").toLowerCase();
+	return normalized.length > CODEX_NODE_HTTP_CREDENTIAL_SCAN_MAX_FIELDS || normalized.split(/[.[\]]+/u).some((component) => CODEX_NODE_HTTP_CREDENTIAL_FIELD_NAME_PATTERN.test(component));
+}
+function createCredentialedCodexNodeHttpRejection(request) {
+	if (typeof request.id !== "string" && typeof request.id !== "number") throw new Error("Codex http/request must have a JSON-RPC request id.");
+	return Buffer.from(JSON.stringify({
+		jsonrpc: "2.0",
+		id: request.id,
+		error: {
+			code: -32602,
+			message: "Authenticated remote HTTP is unavailable on paired devices; run on Gateway or use an intentionally credential-free endpoint."
+		}
+	}));
+}
+function sanitizeCodexExecServerRequest(frame, request) {
+	if (request.method !== "process/start") return frame;
+	if (!isRecord(request.params)) throw new Error("Codex process/start params must be an object.");
+	sanitizeCodexExecServerEnvironment(request.params, "env");
+	if (request.params.envPolicy !== void 0) {
+		if (!isRecord(request.params.envPolicy)) throw new Error("Codex process/start envPolicy must be an object.");
+		sanitizeCodexExecServerEnvironment(request.params.envPolicy, "set");
+	}
+	return normalizeCodexExecServerFrame(Buffer.from(JSON.stringify(request)));
+}
+function sanitizeCodexExecServerEnvironment(record, key) {
+	const environment = record[key];
+	if (environment === void 0) return;
+	if (!isRecord(environment)) throw new Error(`Codex process/start ${key} must be an object.`);
+	const values = {};
+	for (const [name, value] of Object.entries(environment)) {
+		if (typeof value !== "string") throw new Error(`Codex process/start ${key} values must be strings.`);
+		try {
+			const url = new URL(value);
+			if (url.username || url.password) continue;
+		} catch {}
+		values[name] = value;
+	}
+	record[key] = sanitizeEnvVars(values).allowed;
+}
+//#endregion
 //#region extensions/codex/src/app-server/sandbox-exec-server-registry.ts
 const sandboxExecServerRegistry = {
 	servers: /* @__PURE__ */ new Map(),
+	async close(server) {
+		if (server.closed) return;
+		server.closed = true;
+		if ("node" in server) {
+			for (const lease of server.node.leases.values()) if (!lease.closed) {
+				lease.closed = true;
+				lease.channel.close();
+			}
+			server.node.leases.clear();
+		}
+		for (const client of server.server.clients) client.close(1001, "shutdown");
+		await new Promise((resolve) => {
+			server.server.close(() => resolve());
+		});
+		const failures = (await Promise.allSettled([...server.cleanupTasks, ...[...server.children].map(async (child) => await child.terminate())])).flatMap((result) => result.status === "rejected" ? [result.reason] : []);
+		if (failures.length > 0) throw new AggregateError(failures, "Codex sandbox exec-server child cleanup failed");
+	},
 	async closeAll() {
 		const servers = await Promise.allSettled(this.servers.values());
 		this.servers.clear();
@@ -1890,12 +2274,7 @@ const sandboxExecServerRegistry = {
 			if (entry.status !== "fulfilled") return;
 			const server = entry.value;
 			server.refCount = 0;
-			if (server.closed) return;
-			server.closed = true;
-			for (const client of server.server.clients) client.close(1001, "shutdown");
-			await new Promise((resolve) => {
-				server.server.close(() => resolve());
-			});
+			await this.close(server);
 		}));
 	}
 };
@@ -1912,9 +2291,8 @@ var JsonRpcProtocolError = class extends Error {
 		this.code = code;
 	}
 };
-/** Parses raw WebSocket data into a JSON-RPC request object. */
-function parseRequest(data) {
-	const text = (Array.isArray(data) ? Buffer.concat(data) : Buffer.isBuffer(data) ? data : Buffer.from(data)).toString("utf8");
+/** Parses a normalized JSON message into a JSON-RPC request object. */
+function parseRequest(text) {
 	return requireObject(JSON.parse(text), "JSON-RPC request");
 }
 /** Validates that a JSON value is a non-array object. */
@@ -1954,24 +2332,24 @@ function readHttpHeaders(value) {
 		};
 	});
 }
-/** Sends a JSON-RPC success response over the WebSocket. */
-function sendResult(socket, id, result) {
-	socket.send(JSON.stringify({
+/** Sends a JSON-RPC success response through the connection message sink. */
+function sendResult(send, id, result) {
+	send({
 		jsonrpc: "2.0",
 		id,
-		result: result === void 0 ? {} : result
-	}));
+		result
+	});
 }
-/** Sends a JSON-RPC error response over the WebSocket. */
-function sendError(socket, id, code, message) {
-	socket.send(JSON.stringify({
+/** Sends a JSON-RPC error response through the connection message sink. */
+function sendError(send, id, code, message) {
+	send({
 		jsonrpc: "2.0",
 		id: id ?? null,
 		error: {
 			code,
 			message
 		}
-	}));
+	});
 }
 //#endregion
 //#region extensions/codex/src/app-server/sandbox-exec-server/path-uri.ts
@@ -2216,20 +2594,6 @@ function joinSandboxChildPath(parent, child) {
 	return parent.endsWith("/") ? `${parent}${child}` : `${parent}/${child}`;
 }
 //#endregion
-//#region extensions/codex/src/app-server/sandbox-exec-server/runtime.ts
-/** Returns the configured sandbox backend or fails the current JSON-RPC request. */
-function requireBackend(execServer) {
-	const backend = execServer.sandbox.backend;
-	if (!backend) throw new Error("OpenClaw sandbox backend is unavailable.");
-	return backend;
-}
-/** Returns the configured filesystem bridge or fails the current JSON-RPC request. */
-function requireFsBridge(execServer) {
-	const fsBridge = execServer.sandbox.fsBridge;
-	if (!fsBridge) throw new Error("Sandbox filesystem bridge is unavailable.");
-	return fsBridge;
-}
-//#endregion
 //#region extensions/codex/src/app-server/sandbox-exec-server/filesystem.ts
 /**
 * Implements filesystem JSON-RPC handlers for the Codex sandbox exec-server
@@ -2252,7 +2616,7 @@ async function openFile(execServer, handles, params) {
 		path: filePath,
 		access: "read"
 	}]);
-	const fsBridge = requireFsBridge(execServer);
+	const fsBridge = execServer.fsBridge;
 	const handle = {
 		abortController: new AbortController(),
 		closeRequested: false,
@@ -2339,7 +2703,7 @@ async function readFile(execServer, params) {
 		path: filePath,
 		access: "read"
 	}]);
-	const fsBridge = requireFsBridge(execServer);
+	const fsBridge = execServer.fsBridge;
 	const stat = await fsBridge.stat({ filePath });
 	if (!stat) throw new JsonRpcProtocolError(JSON_RPC_NOT_FOUND, "file not found");
 	assertSandboxFileReadWithinLimit(stat);
@@ -2356,7 +2720,7 @@ async function writeFile(execServer, params) {
 		path: filePath,
 		access: "write"
 	}]);
-	const fsBridge = requireFsBridge(execServer);
+	const fsBridge = execServer.fsBridge;
 	if ((await fsBridge.stat({ filePath: posix.dirname(filePath) }))?.type !== "directory") throw new JsonRpcProtocolError(JSON_RPC_NOT_FOUND, "parent directory not found");
 	await fsBridge.writeFile({
 		filePath,
@@ -2372,7 +2736,7 @@ async function createDirectory(execServer, params) {
 		path: filePath,
 		access: "write"
 	}]);
-	const fsBridge = requireFsBridge(execServer);
+	const fsBridge = execServer.fsBridge;
 	if (record.recursive === false) {
 		const parentPath = posix.dirname(filePath);
 		if ((await fsBridge.stat({ filePath: parentPath }))?.type !== "directory") throw new JsonRpcProtocolError(JSON_RPC_NOT_FOUND, "parent directory not found");
@@ -2387,7 +2751,7 @@ async function getMetadata(execServer, params) {
 		path: filePath,
 		access: "read"
 	}]);
-	const stat = await requireFsBridge(execServer).stat({ filePath });
+	const stat = await execServer.fsBridge.stat({ filePath });
 	if (!stat) throw new JsonRpcProtocolError(JSON_RPC_NOT_FOUND, "file not found");
 	return metadataResponse(stat);
 }
@@ -2401,11 +2765,9 @@ async function listDirectoryEntries(execServer, filePath, fsSandboxPolicy) {
 		path: filePath,
 		access: "read"
 	}]);
-	const fsBridge = requireFsBridge(execServer);
-	const backend = requireBackend(execServer);
-	const resolved = fsBridge.resolvePath({ filePath });
+	const resolved = execServer.fsBridge.resolvePath({ filePath });
 	if (!resolved) throw new Error(`Cannot resolve sandbox path: ${filePath}`);
-	const result = await backend.runShellCommand({
+	const result = await execServer.backend.runShellCommand({
 		script: "find \"$1\" -mindepth 1 -maxdepth 1 -exec sh -c 'for path do name=${path##*/}; if [ -L \"$path\" ]; then kind=o; elif [ -d \"$path\" ]; then kind=d; elif [ -f \"$path\" ]; then kind=f; else kind=o; fi; printf \"%s\\t%s\\n\" \"$kind\" \"$name\"; done' sh {} +",
 		args: [resolved.containerPath],
 		allowFailure: true
@@ -2433,7 +2795,7 @@ async function removePath(execServer, params) {
 		access: "write"
 	}]);
 	if (record.recursive !== false) assertNoReadOnlyDescendant(fsSandboxPolicy, filePath, "remove");
-	await requireFsBridge(execServer).remove({
+	await execServer.fsBridge.remove({
 		filePath,
 		recursive: record.recursive !== false,
 		force: record.force !== false
@@ -2460,8 +2822,7 @@ async function copyPath(execServer, params) {
 	});
 }
 async function copySandboxPath(execServer, params) {
-	const fsBridge = execServer.sandbox.fsBridge;
-	if (!fsBridge) throw new Error("Sandbox filesystem bridge is unavailable.");
+	const fsBridge = execServer.fsBridge;
 	assertResolvedFsSandboxAccess(params.fsSandboxPolicy, [{
 		path: params.sourcePath,
 		access: "read"
@@ -2519,6 +2880,126 @@ function metadataResponse(stat) {
 	};
 }
 //#endregion
+//#region extensions/codex/src/app-server/sandbox-exec-server/sandbox-child.ts
+/** Owns one sandbox subprocess tree through close, reaping, and backend finalization. */
+const SANDBOX_CHILD_TERM_GRACE_MS = 1e3;
+const SANDBOX_CHILD_REAP_TIMEOUT_MS = 4500;
+const SANDBOX_EXEC_MARKER = "CODEX_SANDBOX_EXEC_ID";
+async function spawnSandboxChild(params) {
+	const [command, ...args] = params.argv;
+	const finalize = async (status, exitCode) => await params.finalizeExec?.({
+		status,
+		exitCode,
+		timedOut: false,
+		token: params.finalizeToken
+	});
+	if (!command) {
+		await finalize("failed", null).catch(params.onFinalizeError);
+		throw new Error("OpenClaw sandbox exec spec did not provide a command.");
+	}
+	let child;
+	try {
+		child = spawn(command, args, {
+			detached: process.platform !== "win32",
+			env: params.env,
+			stdio: [
+				"pipe",
+				"pipe",
+				"pipe"
+			]
+		});
+	} catch (error) {
+		await finalize("failed", null).catch(params.onFinalizeError);
+		throw error;
+	}
+	let outcome;
+	const closed = new Promise((resolve) => {
+		child.once("close", (code, signal) => resolve(outcome = {
+			exitCode: code ?? 1,
+			signal
+		}));
+	});
+	let finalizePromise;
+	let terminationCleanup;
+	let terminationError;
+	const settled = closed.then(async (result) => {
+		await terminationCleanup;
+		child.stdin.destroy();
+		await (finalizePromise ??= finalize(params.finalizeStatus(result), result.exitCode));
+		return result;
+	});
+	settled.catch(params.onFinalizeError);
+	let terminationPromise;
+	const owner = {
+		process: child,
+		settled,
+		terminate: () => terminationPromise ??= (async () => {
+			child.stdin.destroy();
+			terminationCleanup = params.terminateRemote?.().catch((error) => {
+				terminationError = error instanceof Error ? error : new Error(String(error));
+			});
+			await terminationCleanup;
+			if (!outcome) {
+				if (child.pid) killProcessTree(child.pid, {
+					detached: process.platform !== "win32",
+					graceMs: SANDBOX_CHILD_TERM_GRACE_MS
+				});
+				else child.kill("SIGTERM");
+				if (!await Promise.race([closed.then(() => true), delay(SANDBOX_CHILD_REAP_TIMEOUT_MS).then(() => false)])) throw new Error(`Sandbox child process tree ${child.pid ?? "unknown"} survived SIGKILL; tear down the sandbox environment and inspect the surviving process tree before retrying.`);
+			}
+			const result = await settled;
+			if (terminationError) throw terminationError;
+			return result;
+		})()
+	};
+	params.owners.add(owner);
+	settled.then(() => params.owners.delete(owner), () => params.owners.delete(owner));
+	return owner;
+}
+function prepareSandboxChildExec(backend, env) {
+	const marker = randomUUID();
+	return {
+		env: {
+			...env,
+			[SANDBOX_EXEC_MARKER]: marker
+		},
+		terminate: async () => {
+			const result = await backend.runShellCommand({
+				script: SANDBOX_REMOTE_TERMINATE_SCRIPT,
+				args: [`${SANDBOX_EXEC_MARKER}=${marker}`],
+				allowFailure: true,
+				signal: AbortSignal.timeout(SANDBOX_CHILD_REAP_TIMEOUT_MS)
+			});
+			if (result.code !== 0) {
+				const detail = result.stderr.toString("utf8").trim() || result.stdout.toString("utf8").trim();
+				throw new Error(detail || `Sandbox process tree cleanup failed with code ${result.code}; tear down the sandbox environment and inspect surviving processes before retrying.`);
+			}
+		}
+	};
+}
+const SANDBOX_REMOTE_TERMINATE_SCRIPT = String.raw`
+find_owned_pids() {
+  for env_file in /proc/[0-9]*/environ; do
+    if [ -r "$env_file" ] && tr '\0' '\n' < "$env_file" 2>/dev/null | grep -Fqx "$1"; then
+      basename "$(dirname "$env_file")"
+    fi
+  done
+}
+owned="$(find_owned_pids "$1")"
+[ -z "$owned" ] || kill -TERM $owned 2>/dev/null || true
+sleep 1
+owned="$(find_owned_pids "$1")"
+[ -z "$owned" ] || kill -KILL $owned 2>/dev/null || true
+sleep 1
+owned="$(find_owned_pids "$1")"
+[ -z "$owned" ] || { echo "Sandbox process IDs survived SIGKILL: $owned" >&2; exit 1; }
+`.trim();
+function delay(ms) {
+	return new Promise((resolve) => {
+		setTimeout(resolve, ms).unref?.();
+	});
+}
+//#endregion
 //#region extensions/codex/src/app-server/sandbox-exec-server/http.ts
 /**
 * Implements sandboxed HTTP requests for Codex native tools by routing network
@@ -2527,7 +3008,7 @@ function metadataResponse(stat) {
 /** Maximum JSON-line size accepted from the streaming HTTP helper process. */
 const SANDBOX_HTTP_STREAM_LINE_MAX_CHARS = 256 * 1024;
 /** Handles one sandbox HTTP JSON-RPC request, optionally streaming response body deltas. */
-async function httpRequest(execServer, socket, params) {
+async function httpRequest(execServer, notifications, params) {
 	const record = requireObject(params, "http/request params");
 	const requestId = requireString(record.requestId, "requestId");
 	const url = requireString(record.url, "url");
@@ -2540,7 +3021,7 @@ async function httpRequest(execServer, socket, params) {
 		timeoutMs: typeof record.timeoutMs === "number" && record.timeoutMs > 0 ? Math.floor(record.timeoutMs) : void 0,
 		streamResponse: record.streamResponse === true
 	};
-	if (request.streamResponse) return await runStreamingSandboxHttpRequest(execServer, socket, requestId, request);
+	if (request.streamResponse) return await runStreamingSandboxHttpRequest(execServer, notifications, requestId, request);
 	return await runSandboxHttpRequest(execServer, {
 		...request,
 		streamResponse: false
@@ -2557,7 +3038,7 @@ function assertSandboxHttpRequestTargetAllowed(url) {
 	if (isBlockedHostnameOrIp(parsed.hostname)) throw new SsrFBlockedError(`Blocked hostname or private/internal IP in sandbox http/request: ${parsed.hostname}`);
 }
 async function runSandboxHttpRequest(execServer, params) {
-	const result = await requireBackend(execServer).runShellCommand({
+	const result = await execServer.backend.runShellCommand({
 		script: SANDBOX_HTTP_REQUEST_SCRIPT,
 		stdin: JSON.stringify(params),
 		allowFailure: true
@@ -2574,44 +3055,40 @@ async function runSandboxHttpRequest(execServer, params) {
 		bodyBase64: typeof parsed.bodyBase64 === "string" ? parsed.bodyBase64 : ""
 	};
 }
-async function runStreamingSandboxHttpRequest(execServer, socket, requestId, params) {
-	const backend = requireBackend(execServer);
+async function runStreamingSandboxHttpRequest(execServer, notifications, requestId, params) {
+	const backend = execServer.backend;
+	const remoteExec = prepareSandboxChildExec(backend, {});
 	const execSpec = await backend.buildExecSpec({
 		command: SANDBOX_HTTP_REQUEST_SCRIPT,
 		workdir: execServer.sandbox.containerWorkdir,
-		env: {},
+		env: remoteExec.env,
 		usePty: false
 	});
-	let child;
-	try {
-		const [command, ...args] = execSpec.argv;
-		if (!command) throw new Error("OpenClaw sandbox HTTP exec spec did not provide a command.");
-		child = spawn(command, args, {
-			env: execSpec.env,
-			stdio: [
-				"pipe",
-				"pipe",
-				"pipe"
-			]
+	const lifecycle = { failed: false };
+	const owner = await spawnSandboxChild({
+		argv: execSpec.argv,
+		env: execSpec.env,
+		finalizeExec: backend.finalizeExec,
+		finalizeToken: execSpec.finalizeToken,
+		finalizeStatus: (outcome) => lifecycle.failed || outcome.exitCode !== 0 ? "failed" : "completed",
+		onFinalizeError: (error) => {
+			embeddedAgentLog.warn("codex sandbox http/request finalize failed", { error });
+		},
+		owners: execServer.children,
+		terminateRemote: remoteExec.terminate
+	});
+	const child = owner.process;
+	const abortOnSessionClose = () => {
+		lifecycle.failed = true;
+		owner.terminate().catch((error) => {
+			embeddedAgentLog.warn("codex sandbox http/request cleanup failed", { error });
 		});
-	} catch (error) {
-		try {
-			await backend.finalizeExec?.({
-				status: "failed",
-				exitCode: null,
-				timedOut: false,
-				token: execSpec.finalizeToken
-			});
-		} catch (finalizeError) {
-			embeddedAgentLog.warn("codex sandbox http/request finalize after start failure failed", { error: finalizeError });
-		}
-		throw error;
-	}
-	const abortOnSocketClose = () => child.kill("SIGTERM");
-	socket.once("close", abortOnSocketClose);
+	};
+	notifications.signal.addEventListener("abort", abortOnSessionClose, { once: true });
 	child.once("close", () => {
-		socket.off("close", abortOnSocketClose);
+		notifications.signal.removeEventListener("abort", abortOnSessionClose);
 	});
+	if (notifications.signal.aborted) abortOnSessionClose();
 	child.stdin.on("error", (error) => {
 		if (error.code === "EPIPE" || error.code === "ERR_STREAM_DESTROYED") return;
 		embeddedAgentLog.warn("codex sandbox http/request stdin write failed", { error });
@@ -2619,10 +3096,10 @@ async function runStreamingSandboxHttpRequest(execServer, socket, requestId, par
 	child.stdin.end(JSON.stringify(params));
 	return await readStreamingSandboxHttpResponse({
 		child,
-		execSpec,
-		finalizeExec: backend.finalizeExec,
+		lifecycle,
+		owner,
 		requestId,
-		socket
+		notifications
 	});
 }
 function readStreamingSandboxHttpResponse(params) {
@@ -2633,22 +3110,15 @@ function readStreamingSandboxHttpResponse(params) {
 		let lastBodySeq = 0;
 		let stdoutBuffer = "";
 		let stderr = "";
-		const finalize = async (status, exitCode) => {
-			await params.finalizeExec?.({
-				status,
-				exitCode,
-				timedOut: false,
-				token: params.execSpec.finalizeToken
-			});
-		};
-		const fail = (message, exitCode) => {
+		const fail = (message, _exitCode) => {
 			if (failed) return;
 			failed = true;
-			finalize("failed", exitCode).catch((error) => {
-				embeddedAgentLog.warn("codex sandbox http/request finalize failed", { error });
+			params.lifecycle.failed = true;
+			params.owner.terminate().catch((error) => {
+				embeddedAgentLog.warn("codex sandbox http/request cleanup failed", { error });
 			});
 			if (headerResolved) {
-				sendHttpBodyDelta(params.socket, {
+				if (params.notifications.isOpen()) params.notifications.send("http/request/bodyDelta", {
 					requestId: params.requestId,
 					seq: lastBodySeq + 1,
 					deltaBase64: "",
@@ -2679,7 +3149,7 @@ function readStreamingSandboxHttpResponse(params) {
 					} else if (type === "bodyDelta") {
 						const seq = requireNumber(message.seq, "http body sequence");
 						lastBodySeq = Math.max(lastBodySeq, seq);
-						sendHttpBodyDelta(params.socket, {
+						if (params.notifications.isOpen()) params.notifications.send("http/request/bodyDelta", {
 							requestId: params.requestId,
 							seq,
 							deltaBase64: typeof message.deltaBase64 === "string" ? message.deltaBase64 : "",
@@ -2692,10 +3162,7 @@ function readStreamingSandboxHttpResponse(params) {
 				}
 				newline = stdoutBuffer.indexOf("\n");
 			}
-			if (stdoutBuffer.length > SANDBOX_HTTP_STREAM_LINE_MAX_CHARS) {
-				params.child.kill("SIGKILL");
-				fail(`sandbox http/request produced an unterminated stdout line longer than ${SANDBOX_HTTP_STREAM_LINE_MAX_CHARS} characters`, null);
-			}
+			if (stdoutBuffer.length > SANDBOX_HTTP_STREAM_LINE_MAX_CHARS) fail(`sandbox http/request produced an unterminated stdout line longer than ${SANDBOX_HTTP_STREAM_LINE_MAX_CHARS} characters`, null);
 		});
 		params.child.stderr.setEncoding("utf8");
 		params.child.stderr.on("data", (chunk) => {
@@ -2703,6 +3170,7 @@ function readStreamingSandboxHttpResponse(params) {
 		});
 		params.child.once("error", (error) => {
 			childFailure ??= error.message;
+			params.lifecycle.failed = true;
 		});
 		params.child.once("close", (code) => {
 			const exitCode = code ?? 1;
@@ -2712,10 +3180,10 @@ function readStreamingSandboxHttpResponse(params) {
 				return;
 			}
 			if (exitCode === 0) {
-				finalize("completed", exitCode).catch((error) => {
-					embeddedAgentLog.warn("codex sandbox http/request finalize failed", { error });
-				});
-				if (!headerResolved) reject(/* @__PURE__ */ new Error("sandbox http/request exited before returning headers"));
+				if (!headerResolved) {
+					params.lifecycle.failed = true;
+					reject(/* @__PURE__ */ new Error("sandbox http/request exited before returning headers"));
+				}
 				return;
 			}
 			fail(stderr.trim() || `sandbox http/request failed with code ${exitCode}`, exitCode);
@@ -2921,20 +3389,6 @@ if __name__ == "__main__":
 PY
 python3 "$tmp"
 `.trim();
-function sendHttpBodyDelta(socket, params) {
-	if (socket.readyState !== 1) return;
-	socket.send(JSON.stringify({
-		jsonrpc: "2.0",
-		method: "http/request/bodyDelta",
-		params: {
-			requestId: params.requestId,
-			seq: params.seq,
-			deltaBase64: params.deltaBase64,
-			done: params.done,
-			error: params.error ?? null
-		}
-	}));
-}
 //#endregion
 //#region extensions/codex/src/app-server/sandbox-exec-server/processes.ts
 /**
@@ -2945,7 +3399,7 @@ const ENV_KEY_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
 const RETAINED_PROCESS_OUTPUT_BYTES = 1024 * 1024;
 const CLOSED_PROCESS_EVICTION_MS = 6e4;
 /** Starts a sandbox-backed process and registers it in the connection-local process table. */
-async function startProcess(execServer, processes, socket, params) {
+async function startProcess(execServer, processes, notify, params) {
 	const record = requireObject(params, "process/start params");
 	const processId = requireString(record.processId, "processId");
 	if (processes.has(processId)) throw new Error(`process already exists: ${processId}`);
@@ -2964,17 +3418,10 @@ async function startProcess(execServer, processes, socket, params) {
 		failure: null,
 		tty: record.tty === true,
 		pipeStdin: record.pipeStdin === true,
-		abortController: new AbortController(),
+		terminationRequested: false,
 		child: null,
-		finalized: false,
 		waiters: [],
-		emitNotification: (method, notificationParams) => {
-			if (socket.readyState === 1) socket.send(JSON.stringify({
-				jsonrpc: "2.0",
-				method,
-				params: notificationParams
-			}));
-		},
+		emitNotification: notify,
 		evictProcess: () => {
 			if (managed.evictionTimer) return;
 			managed.evictionTimer = setTimeout(() => {
@@ -2984,12 +3431,14 @@ async function startProcess(execServer, processes, socket, params) {
 		}
 	};
 	processes.set(processId, managed);
+	const startPromise = runProcess(execServer, managed, {
+		argv,
+		cwd,
+		env
+	});
+	managed.startPromise = startPromise;
 	try {
-		await runProcess(execServer, managed, {
-			argv,
-			cwd,
-			env
-		});
+		await startPromise;
 	} catch (error) {
 		processes.delete(processId);
 		managed.failure = coerceErrorMessage(error);
@@ -2998,47 +3447,49 @@ async function startProcess(execServer, processes, socket, params) {
 		managed.closed = true;
 		notifyProcessWaiters(managed);
 		throw error;
+	} finally {
+		if (managed.startPromise === startPromise) managed.startPromise = void 0;
 	}
 	return { processId };
 }
 async function runProcess(execServer, managed, params) {
-	const backend = execServer.sandbox.backend;
-	if (!backend) throw new Error("OpenClaw sandbox backend is unavailable.");
+	const backend = execServer.backend;
 	throwIfProcessStartCancelled(managed);
+	const remoteExec = prepareSandboxChildExec(backend, params.env);
 	const execSpec = await backend.buildExecSpec({
-		command: shellCommandFromArgv(params.argv),
+		command: buildRemoteCommand(params.argv),
 		workdir: params.cwd,
-		env: params.env,
+		env: remoteExec.env,
 		usePty: false
 	});
-	managed.finalizeToken = execSpec.finalizeToken;
-	managed.finalizeExec = backend.finalizeExec;
-	let child;
-	try {
-		if (managed.abortController.signal.aborted) throw new Error("process start cancelled");
-		const [command, ...args] = execSpec.argv;
-		if (!command) throw new Error("OpenClaw sandbox exec spec did not provide a command.");
-		child = spawn(command, args, {
-			env: execSpec.env,
-			stdio: [
-				"pipe",
-				"pipe",
-				"pipe"
-			]
+	if (managed.terminationRequested) {
+		await backend.finalizeExec?.({
+			status: "failed",
+			exitCode: null,
+			timedOut: false,
+			token: execSpec.finalizeToken
 		});
-	} catch (error) {
-		managed.failure = coerceErrorMessage(error);
-		await finalizeProcess(managed).catch((finalizeError) => {
-			embeddedAgentLog.warn("codex sandbox exec-server finalize after start failure failed", {
+		throw new Error("process start cancelled");
+	}
+	const owner = await spawnSandboxChild({
+		argv: execSpec.argv,
+		env: execSpec.env,
+		finalizeExec: backend.finalizeExec,
+		finalizeToken: execSpec.finalizeToken,
+		finalizeStatus: () => managed.failure ? "failed" : "completed",
+		onFinalizeError: (error) => {
+			const message = coerceErrorMessage(error);
+			managed.failure ??= message;
+			embeddedAgentLog.warn("codex sandbox exec-server finalize failed", {
 				processId: managed.processId,
-				error: coerceErrorMessage(finalizeError)
+				error: message
 			});
-		});
-		throw error;
-	}
-	managed.child = child;
-	const abortListener = () => child.kill("SIGTERM");
-	managed.abortController.signal.addEventListener("abort", abortListener, { once: true });
+		},
+		owners: execServer.children,
+		terminateRemote: remoteExec.terminate
+	});
+	managed.child = owner;
+	const child = owner.process;
 	child.stdout.on("data", (chunk) => appendProcessChunk(managed, managed.tty ? "pty" : "stdout", chunk));
 	child.stderr.on("data", (chunk) => appendProcessChunk(managed, "stderr", chunk));
 	child.once("error", (error) => {
@@ -3046,13 +3497,12 @@ async function runProcess(execServer, managed, params) {
 		notifyProcessWaiters(managed);
 	});
 	child.once("close", (code) => {
-		managed.abortController.signal.removeEventListener("abort", abortListener);
 		emitProcessClosed(managed, code ?? 1);
 	});
 	if (!managed.tty && !managed.pipeStdin) child.stdin.end();
 }
 function throwIfProcessStartCancelled(managed) {
-	if (managed.abortController.signal.aborted) throw new Error("process start cancelled");
+	if (managed.terminationRequested) throw new Error("process start cancelled");
 }
 function appendProcessChunk(managed, stream, data) {
 	if (data.length === 0) return;
@@ -3098,28 +3548,9 @@ function emitProcessClosed(managed, exitCode) {
 			seq: closeSeq
 		});
 	}
-	finalizeProcess(managed).catch((error) => {
-		const message = coerceErrorMessage(error);
-		managed.failure ??= message;
-		embeddedAgentLog.warn("codex sandbox exec-server finalize failed", {
-			processId: managed.processId,
-			error: message
-		});
-	});
 	managed.evictProcess();
 	notifyProcessWaiters(managed);
 }
-async function finalizeProcess(managed) {
-	if (managed.finalized) return;
-	managed.finalized = true;
-	managed.child?.stdin.destroy();
-	await managed.finalizeExec?.({
-		status: managed.failure ? "failed" : "completed",
-		exitCode: managed.exitCode,
-		timedOut: false,
-		token: managed.finalizeToken
-	});
-}
 function limitProcessChunks(chunks, maxBytes) {
 	if (!maxBytes) return chunks;
 	const retained = [];
@@ -3158,19 +3589,20 @@ function writeProcess(processes, params) {
 	const managed = processes.get(processId);
 	if (!managed) return { status: "unknownProcess" };
 	const chunk = Buffer.from(requireString(record.chunk, "chunk"), "base64");
-	if (!managed.tty && !managed.pipeStdin || managed.closed || !managed.child?.stdin.writable) return { status: "stdinClosed" };
-	managed.child.stdin.write(chunk);
+	if (!managed.tty && !managed.pipeStdin || managed.closed || !managed.child?.process.stdin.writable) return { status: "stdinClosed" };
+	managed.child.process.stdin.write(chunk);
 	return { status: "accepted" };
 }
 /** Requests process termination and reports whether it was running at call time. */
-function terminateProcess(processes, params) {
+async function terminateProcess(processes, params) {
 	const processId = requireString(requireObject(params, "process/terminate params").processId, "processId");
 	const managed = processes.get(processId);
 	if (!managed) return { running: false };
 	const running = !managed.exited;
-	managed.abortController.abort();
-	managed.child?.kill("SIGTERM");
-	if (running && !managed.child) emitProcessClosed(managed, null);
+	managed.terminationRequested = true;
+	await managed.startPromise?.catch(() => void 0);
+	if (managed.child) await managed.child.terminate();
+	else if (running && !managed.closed) emitProcessClosed(managed, null);
 	return { running };
 }
 function waitForProcessUpdate(managed, waitMs) {
@@ -3192,12 +3624,6 @@ function notifyProcessWaiters(managed) {
 function hasChunksAtOrAfter(managed, afterSeq) {
 	return managed.chunks.some((chunk) => chunk.seq > afterSeq);
 }
-function shellCommandFromArgv(argv) {
-	return argv.map(shellEscape).join(" ");
-}
-function shellEscape(value) {
-	return `'${value.replaceAll("'", `'"'"'`)}'`;
-}
 function requireProcess(processes, processId) {
 	const managed = processes.get(processId);
 	if (!managed) throw new Error(`unknown process: ${processId}`);
@@ -3241,47 +3667,148 @@ function readStringList(value) {
 	return Array.isArray(value) ? value.filter((entry) => typeof entry === "string") : [];
 }
 //#endregion
+//#region extensions/codex/src/app-server/sandbox-exec-server/session.ts
+/** Owns the JSON-RPC protocol and resources of one sandbox execution connection. */
+/** Connection-local execution state; closing it never enables session resumption. */
+var CodexSandboxExecSession = class {
+	constructor(execServer, transport) {
+		this.execServer = execServer;
+		this.transport = transport;
+		this.processes = /* @__PURE__ */ new Map();
+		this.fileReads = /* @__PURE__ */ new Map();
+		this.closeController = new AbortController();
+		this.notifications = {
+			isOpen: transport.isOpen,
+			signal: this.closeController.signal,
+			send: (method, params) => {
+				if (transport.isOpen()) transport.send({
+					jsonrpc: "2.0",
+					method,
+					params
+				});
+			}
+		};
+	}
+	async handleRequest(request) {
+		const method = request.method;
+		if (!method) {
+			sendError(this.transport.send, request.id, -32600, "Invalid Request");
+			return;
+		}
+		if (request.id === void 0) {
+			if (method !== "initialized") sendError(this.transport.send, -1, -32600, `Unexpected notification: ${method}`);
+			return;
+		}
+		try {
+			const result = await this.dispatchRequest(method, request.params);
+			sendResult(this.transport.send, request.id, result);
+		} catch (error) {
+			sendError(this.transport.send, request.id, error instanceof JsonRpcProtocolError ? error.code : -32603, error instanceof Error ? error.message : String(error));
+		}
+	}
+	close() {
+		if (!this.cleanup) {
+			this.closeController.abort();
+			closeAllFileReads(this.fileReads);
+			this.cleanup = Promise.all([...this.processes.keys()].map(async (processId) => terminateProcess(this.processes, { processId }))).then(() => void 0);
+		}
+		return this.cleanup;
+	}
+	async dispatchRequest(method, params) {
+		switch (method) {
+			case "initialize": return { sessionId: randomUUID() };
+			case "environment/info": return {
+				shell: {
+					name: "sh",
+					path: "/bin/sh"
+				},
+				cwd: pathToFileURL(this.execServer.sandbox.containerWorkdir, { windows: false }).href,
+				capabilities: { networkProxyLaunch: false }
+			};
+			case "environment/status": return { status: "ready" };
+			case "process/start": return startProcess(this.execServer, this.processes, this.notifications.send, params);
+			case "process/read": return await readProcess(this.processes, params);
+			case "process/write": return writeProcess(this.processes, params);
+			case "process/terminate": return await terminateProcess(this.processes, params);
+			case "fs/open": return await openFile(this.execServer, this.fileReads, params);
+			case "fs/readBlock": return readFileBlock(this.fileReads, params);
+			case "fs/close": return closeFile(this.fileReads, params);
+			case "fs/readFile": return await readFile(this.execServer, params);
+			case "fs/writeFile":
+				await writeFile(this.execServer, params);
+				return {};
+			case "fs/createDirectory":
+				await createDirectory(this.execServer, params);
+				return {};
+			case "fs/getMetadata": return await getMetadata(this.execServer, params);
+			case "fs/readDirectory": return await readDirectory(this.execServer, params);
+			case "fs/remove":
+				await removePath(this.execServer, params);
+				return {};
+			case "fs/copy":
+				await copyPath(this.execServer, params);
+				return {};
+			case "http/request": return await httpRequest(this.execServer, this.notifications, params);
+			default: throw new JsonRpcProtocolError(JSON_RPC_METHOD_NOT_FOUND, `Unsupported OpenClaw sandbox exec-server method: ${method}`);
+		}
+	}
+};
+//#endregion
 //#region extensions/codex/src/app-server/sandbox-exec-server.ts
 /**
 * Hosts the local OpenClaw sandbox exec-server that Codex app-server native
 * execution can register as an external environment.
 */
 const CODEX_SANDBOX_EXEC_SERVER_MAX_INBOUND_MESSAGE_BYTES = 100 * 1024 * 1024;
+const CODEX_NODE_EXEC_SERVER_MAX_MESSAGE_BYTES = 64 * 1024 * 1024;
+const codexNodeExecServerLeases = /* @__PURE__ */ new WeakMap();
 /** Starts or reuses a sandbox exec-server and registers it with Codex app-server. */
 async function ensureCodexSandboxExecServerEnvironment(params) {
-	if (!params.sandbox?.enabled || !params.sandbox.backend) return;
+	if (!params.sandbox?.enabled) return;
+	const placementNodeId = readCodexPlacementNodeId(params.sandbox);
+	if (!params.sandbox.backend && !placementNodeId) return;
+	if (placementNodeId && !params.runtime) throw new Error("Codex paired-device execution requires its active plugin runtime.");
 	if (!canExposeLocalExecServerToAppServer(params.appServerStartOptions)) throw new Error("OpenClaw Codex exec-server uses a local loopback URL and cannot be registered with a remote Codex app-server.");
-	const execServer = await acquireOpenClawExecServer(params.sandbox);
+	const { server: execServer, nodeLease } = await acquireOpenClawExecServer({
+		sandbox: params.sandbox,
+		runtime: params.runtime,
+		signal: params.signal,
+		onExecutionDisconnect: params.onExecutionDisconnect
+	});
+	const environmentId = nodeLease ? `openclaw-node-${nodeLease.id}` : execServer.environmentId;
 	try {
+		const execServerUrl = nodeLease ? `${execServer.url}?lease=${nodeLease.id}` : execServer.url;
 		await params.client.request("environment/add", {
-			environmentId: execServer.environmentId,
-			execServerUrl: execServer.url
+			environmentId,
+			execServerUrl
 		}, {
 			timeoutMs: params.timeoutMs,
 			signal: params.signal
 		});
 	} catch (error) {
+		if (nodeLease && "node" in execServer) closeCodexNodeExecServerLease(execServer, nodeLease);
 		await releaseOpenClawExecServer(execServer);
-		if (isEnvironmentAddUnsupported(error)) {
-			embeddedAgentLog.warn("codex app-server does not support remote environments yet", { environmentId: execServer.environmentId });
-			return;
-		}
 		throw error;
 	}
-	return {
-		environmentId: execServer.environmentId,
+	const environment = {
+		environmentId,
 		cwd: params.sandbox.containerWorkdir
 	};
+	if (nodeLease) codexNodeExecServerLeases.set(environment, nodeLease);
+	return environment;
 }
 /** Releases the sandbox exec-server lease associated with a sandbox runtime. */
-async function releaseCodexSandboxExecServerEnvironment(sandbox) {
+async function releaseCodexSandboxExecServerEnvironment(sandbox, environment) {
 	if (!sandbox?.enabled) return;
 	const server = await sandboxExecServerRegistry.servers.get(sandbox.runtimeId)?.catch(() => void 0);
-	if (server) await releaseOpenClawExecServer(server);
-}
-function isEnvironmentAddUnsupported(error) {
-	if (!(error instanceof Error)) return false;
-	return error.message.includes("environment/add") && (error.message.includes("unknown variant") || error.message.includes("Method not found"));
+	if (server) {
+		const nodeLease = environment && codexNodeExecServerLeases.get(environment);
+		if (nodeLease && "node" in server) {
+			codexNodeExecServerLeases.delete(environment);
+			closeCodexNodeExecServerLease(server, nodeLease);
+		}
+		await releaseOpenClawExecServer(server);
+	}
 }
 function canExposeLocalExecServerToAppServer(startOptions) {
 	if (!startOptions || startOptions.transport !== "websocket") return true;
@@ -3295,14 +3822,60 @@ function canExposeLocalExecServerToAppServer(startOptions) {
 		return false;
 	}
 }
-async function acquireOpenClawExecServer(sandbox) {
+async function acquireOpenClawExecServer(params) {
+	const { sandbox, runtime, signal, onExecutionDisconnect } = params;
 	const key = sandbox.runtimeId;
 	while (true) {
 		const promise = sandboxExecServerRegistry.servers.get(key) ?? startAndRememberOpenClawExecServer(sandbox);
 		const server = await promise;
 		if (!server.closed && sandboxExecServerRegistry.servers.get(key) === promise) {
 			server.refCount += 1;
-			return server;
+			if (!("node" in server)) return { server };
+			if (!runtime || !signal) {
+				await releaseOpenClawExecServer(server);
+				throw new Error("Codex paired-device execution requires an active runtime and attempt.");
+			}
+			try {
+				const placementIdentity = readCodexPlacementWorkspaceIdentity(sandbox);
+				const channel = await runtime.nodes.openDuplex({
+					nodeId: server.node.id,
+					command: "codex.exec-server.stdio.v1",
+					params: {
+						cwd: sandbox.containerWorkdir,
+						...placementIdentity
+					},
+					sessionKey: sandbox.sessionKey,
+					timeoutMs: 0,
+					maxMessageBytes: CODEX_NODE_EXEC_SERVER_MAX_MESSAGE_BYTES,
+					maxOutstandingDeliveryBytes: 69206016,
+					signal
+				});
+				if (signal.aborted || server.closed || sandboxExecServerRegistry.servers.get(key) !== promise) {
+					channel.close();
+					throw new Error("Codex paired-device execution retired before its channel was ready.");
+				}
+				const nodeLease = {
+					id: randomUUID(),
+					channel,
+					claimed: false,
+					closed: false,
+					onDisconnected: onExecutionDisconnect
+				};
+				server.node.leases.set(nodeLease.id, nodeLease);
+				channel.closed.then(() => handleClosedCodexNodeExecServerLease(server, nodeLease, { failed: false }), (error) => handleClosedCodexNodeExecServerLease(server, nodeLease, {
+					failed: true,
+					error
+				})).catch((error) => {
+					embeddedAgentLog.warn("codex paired-device exec-server lease cleanup failed", { error: error instanceof Error ? error.message : String(error) });
+				});
+				return {
+					server,
+					nodeLease
+				};
+			} catch (error) {
+				await releaseOpenClawExecServer(server);
+				throw error;
+			}
 		}
 	}
 }
@@ -3316,24 +3889,54 @@ function startAndRememberOpenClawExecServer(sandbox) {
 	return created;
 }
 async function startOpenClawExecServer(sandbox) {
+	const backend = sandbox.backend;
+	const fsBridge = sandbox.fsBridge;
+	const placementNodeId = readCodexPlacementNodeId(sandbox);
+	let connection;
+	if (placementNodeId) connection = {
+		kind: "node",
+		id: placementNodeId
+	};
+	else {
+		if (!backend) throw new Error("OpenClaw sandbox backend is unavailable.");
+		if (!fsBridge) throw new Error("Sandbox filesystem bridge is unavailable.");
+		connection = {
+			kind: "sandbox",
+			backend,
+			fsBridge
+		};
+	}
 	const server = new WebSocketServer({
 		host: "127.0.0.1",
 		port: 0,
-		maxPayload: CODEX_SANDBOX_EXEC_SERVER_MAX_INBOUND_MESSAGE_BYTES
+		maxPayload: connection.kind === "node" ? CODEX_NODE_EXEC_SERVER_MAX_MESSAGE_BYTES : CODEX_SANDBOX_EXEC_SERVER_MAX_INBOUND_MESSAGE_BYTES
 	});
 	await once(server, "listening");
 	const address = server.address();
 	if (!address || typeof address === "string") throw new Error("OpenClaw Codex exec-server did not bind to a TCP port.");
 	const environmentId = buildEnvironmentId(sandbox);
 	const authPath = `/openclaw-${randomUUID()}`;
-	const execServer = {
+	const common = {
 		authPath,
 		closed: false,
 		environmentId,
 		refCount: 0,
 		url: `ws://127.0.0.1:${address.port}${authPath}`,
 		sandbox,
-		server
+		server,
+		children: /* @__PURE__ */ new Set(),
+		cleanupTasks: /* @__PURE__ */ new Set()
+	};
+	const execServer = connection.kind === "node" ? {
+		...common,
+		node: {
+			id: connection.id,
+			leases: /* @__PURE__ */ new Map()
+		}
+	} : {
+		...common,
+		backend: connection.backend,
+		fsBridge: connection.fsBridge
 	};
 	server.on("connection", (socket, request) => {
 		socket.on("error", handleExecServerSocketError);
@@ -3341,6 +3944,10 @@ async function startOpenClawExecServer(sandbox) {
 			socket.close(1008, "unauthorized");
 			return;
 		}
+		if ("node" in execServer) {
+			handleNodeConnection(execServer, socket, request);
+			return;
+		}
 		handleConnection(execServer, socket);
 	});
 	embeddedAgentLog.info("codex sandbox exec-server started", {
@@ -3357,15 +3964,7 @@ async function releaseOpenClawExecServer(execServer) {
 	const current = await sandboxExecServerRegistry.servers.get(execServer.sandbox.runtimeId)?.catch(() => void 0);
 	if (execServer.refCount > 0 || execServer.closed) return;
 	if (current === execServer) sandboxExecServerRegistry.servers.delete(execServer.sandbox.runtimeId);
-	await closeOpenClawExecServer(execServer);
-}
-async function closeOpenClawExecServer(execServer) {
-	if (execServer.closed) return;
-	execServer.closed = true;
-	for (const client of execServer.server.clients) client.close(1001, "shutdown");
-	await new Promise((resolve) => {
-		execServer.server.close(() => resolve());
-	});
+	await sandboxExecServerRegistry.close(execServer);
 }
 function buildEnvironmentId(sandbox) {
 	return `openclaw-sandbox-${createHash("sha256").update(sandbox.runtimeId).digest("hex").slice(0, 16)}`;
@@ -3373,80 +3972,82 @@ function buildEnvironmentId(sandbox) {
 function isAuthorizedExecServerRequest(execServer, request) {
 	return new URL(request.url ?? "", "ws://127.0.0.1").pathname === execServer.authPath;
 }
+function readCodexPlacementNodeId(sandbox) {
+	if (!("placementExecutionMode" in sandbox) || sandbox.placementExecutionMode !== "remote-exec" || !("placementNodeId" in sandbox) || typeof sandbox.placementNodeId !== "string" || !sandbox.placementNodeId) return;
+	return sandbox.placementNodeId;
+}
+function readCodexPlacementWorkspaceIdentity(sandbox) {
+	if (!("placementEnvironmentId" in sandbox) || typeof sandbox.placementEnvironmentId !== "string" || !sandbox.placementEnvironmentId || sandbox.placementEnvironmentId.trim() !== sandbox.placementEnvironmentId || !("placementSessionId" in sandbox) || typeof sandbox.placementSessionId !== "string" || !sandbox.placementSessionId || sandbox.placementSessionId.trim() !== sandbox.placementSessionId || !("placementOwnerEpoch" in sandbox) || typeof sandbox.placementOwnerEpoch !== "number" || !Number.isSafeInteger(sandbox.placementOwnerEpoch) || sandbox.placementOwnerEpoch < 1 || !sandbox.sessionKey || sandbox.sessionKey.trim() !== sandbox.sessionKey) throw new Error("Codex paired-device execution requires its exact placement workspace identity.");
+	return {
+		environmentId: sandbox.placementEnvironmentId,
+		sessionId: sandbox.placementSessionId,
+		ownerEpoch: sandbox.placementOwnerEpoch,
+		sessionKey: sandbox.sessionKey
+	};
+}
+function handleNodeConnection(execServer, socket, request) {
+	const leaseId = new URL(request.url ?? "", "ws://127.0.0.1").searchParams.get("lease");
+	const lease = leaseId ? execServer.node.leases.get(leaseId) : void 0;
+	if (!lease || lease.claimed || lease.closed) {
+		socket.close(1008, "execution channel unavailable");
+		return;
+	}
+	lease.claimed = true;
+	const cleanup = startCodexNodeExecServerRelay({
+		lease,
+		socket
+	});
+	execServer.cleanupTasks.add(cleanup);
+	cleanup.then(() => execServer.cleanupTasks.delete(cleanup), (error) => {
+		execServer.cleanupTasks.delete(cleanup);
+		embeddedAgentLog.warn("codex paired-device exec-server relay failed", { error: error instanceof Error ? error.message : String(error) });
+	});
+}
+function closeCodexNodeExecServerLease(execServer, lease) {
+	execServer.node.leases.delete(lease.id);
+	if (!lease.closed) {
+		lease.closed = true;
+		lease.closeRelay?.();
+		lease.channel.close();
+	}
+}
+function handleClosedCodexNodeExecServerLease(execServer, lease, result) {
+	if (lease.closed) return;
+	if (lease.onChannelClosed) {
+		lease.onChannelClosed(result);
+		return;
+	}
+	try {
+		lease.onDisconnected?.(createCodexNodeExecServerDisconnectError(result.failed ? "execution device failed" : "execution device disconnected", result.error));
+	} finally {
+		closeCodexNodeExecServerLease(execServer, lease);
+	}
+}
 function handleConnection(execServer, socket) {
-	const processes = /* @__PURE__ */ new Map();
-	const fileReads = /* @__PURE__ */ new Map();
+	const session = new CodexSandboxExecSession(execServer, {
+		isOpen: () => socket.readyState === socket.OPEN,
+		send: (message) => socket.send(JSON.stringify(message))
+	});
 	socket.on("message", (data) => {
-		handleMessage(execServer, processes, fileReads, socket, data).catch((error) => {
+		handleMessage(session, data).catch((error) => {
 			embeddedAgentLog.warn("codex sandbox exec-server message failed", { error });
 		});
 	});
 	socket.on("close", () => {
-		closeAllFileReads(fileReads);
-		for (const process of processes.values()) process.abortController.abort();
+		const cleanup = session.close();
+		execServer.cleanupTasks.add(cleanup);
+		cleanup.then(() => execServer.cleanupTasks.delete(cleanup), (error) => {
+			execServer.cleanupTasks.delete(cleanup);
+			embeddedAgentLog.warn("codex sandbox exec-server socket cleanup failed", { error: error instanceof Error ? error.message : String(error) });
+		});
 	});
 }
 function handleExecServerSocketError(error) {
 	embeddedAgentLog.debug("codex sandbox exec-server websocket failed", { error });
 }
-async function handleMessage(execServer, processes, fileReads, socket, data) {
-	const request = parseRequest(data);
-	if (!request.method) {
-		sendError(socket, request.id, -32600, "Invalid Request");
-		return;
-	}
-	const method = request.method;
-	if (request.id === void 0) {
-		if (method !== "initialized") sendError(socket, -1, -32600, `Unexpected notification: ${method}`);
-		return;
-	}
-	try {
-		const result = await dispatchRequest(execServer, processes, fileReads, socket, {
-			...request,
-			method
-		});
-		sendResult(socket, request.id, result);
-	} catch (error) {
-		sendError(socket, request.id, error instanceof JsonRpcProtocolError ? error.code : -32603, error instanceof Error ? error.message : String(error));
-	}
-}
-async function dispatchRequest(execServer, processes, fileReads, socket, request) {
-	switch (request.method) {
-		case "initialize": return { sessionId: randomUUID() };
-		case "environment/info": return {
-			shell: {
-				name: "sh",
-				path: "/bin/sh"
-			},
-			cwd: pathToFileURL(execServer.sandbox.containerWorkdir, { windows: false }).href,
-			capabilities: { networkProxyLaunch: false }
-		};
-		case "environment/status": return { status: "ready" };
-		case "process/start": return startProcess(execServer, processes, socket, request.params);
-		case "process/read": return await readProcess(processes, request.params);
-		case "process/write": return writeProcess(processes, request.params);
-		case "process/terminate": return terminateProcess(processes, request.params);
-		case "fs/open": return await openFile(execServer, fileReads, request.params);
-		case "fs/readBlock": return readFileBlock(fileReads, request.params);
-		case "fs/close": return closeFile(fileReads, request.params);
-		case "fs/readFile": return await readFile(execServer, request.params);
-		case "fs/writeFile":
-			await writeFile(execServer, request.params);
-			return {};
-		case "fs/createDirectory":
-			await createDirectory(execServer, request.params);
-			return {};
-		case "fs/getMetadata": return await getMetadata(execServer, request.params);
-		case "fs/readDirectory": return await readDirectory(execServer, request.params);
-		case "fs/remove":
-			await removePath(execServer, request.params);
-			return {};
-		case "fs/copy":
-			await copyPath(execServer, request.params);
-			return {};
-		case "http/request": return await httpRequest(execServer, socket, request.params);
-		default: throw new JsonRpcProtocolError(JSON_RPC_METHOD_NOT_FOUND, `Unsupported OpenClaw sandbox exec-server method: ${request.method}`);
-	}
+async function handleMessage(session, data) {
+	const buffer = Array.isArray(data) ? Buffer.concat(data) : Buffer.isBuffer(data) ? data : Buffer.from(data);
+	await session.handleRequest(parseRequest(buffer.toString("utf8")));
 }
 //#endregion
 //#region extensions/codex/src/app-server/provider-capabilities.ts
@@ -3495,87 +4096,6 @@ async function resolveCodexProviderWebSearchSupport(params) {
 	}
 }
 //#endregion
-//#region extensions/codex/src/app-server/plugin-approval-roundtrip.ts
-const DEFAULT_CODEX_APPROVAL_TIMEOUT_MS = 12e4;
-const MAX_PLUGIN_APPROVAL_TITLE_LENGTH = 80;
-const MAX_PLUGIN_APPROVAL_DESCRIPTION_LENGTH = 256;
-const ANSI_OSC_SEQUENCE_RE = new RegExp(String.raw`(?:\u001b]|\u009d)[^\u001b\u009c\u0007]*(?:\u0007|\u001b\\|\u009c)`, "g");
-const ANSI_CONTROL_SEQUENCE_RE = new RegExp(String.raw`(?:\u001b\[[0-?]*[ -/]*[@-~]|\u009b[0-?]*[ -/]*[@-~]|\u001b[@-Z\\-_])`, "g");
-const CONTROL_CHARACTER_RE = new RegExp(String.raw`[\u0000-\u001f\u007f-\u009f]+`, "g");
-const INVISIBLE_FORMATTING_CONTROL_RE = new RegExp(String.raw`[\u00ad\u034f\u061c\u200b-\u200f\u202a-\u202e\u2060-\u206f\ufeff\ufe00-\ufe0f\u{e0100}-\u{e01ef}]`, "gu");
-const DANGLING_TERMINAL_SEQUENCE_SUFFIX_RE = new RegExp(String.raw`(?:\u001b\][^\u001b\u009c\u0007]*|\u009d[^\u001b\u009c\u0007]*|\u001b\[[0-?]*[ -/]*|\u009b[0-?]*[ -/]*|\u001b)$`);
-/** Starts a two-phase plugin approval request through the OpenClaw gateway. */
-async function requestPluginApproval(params) {
-	const timeoutMs = DEFAULT_CODEX_APPROVAL_TIMEOUT_MS;
-	return params.hostCapabilities.requestApproval({
-		title: truncateCodexApprovalDisplayText(params.title, MAX_PLUGIN_APPROVAL_TITLE_LENGTH),
-		description: truncateCodexApprovalDisplayText(params.description, MAX_PLUGIN_APPROVAL_DESCRIPTION_LENGTH),
-		severity: params.severity,
-		toolName: params.toolName,
-		toolCallId: params.toolCallId,
-		timeoutMs,
-		transportTimeoutMs: resolveCodexGatewayTimeoutWithGraceMs(timeoutMs),
-		...params.allowedDecisions ? { allowedDecisions: params.allowedDecisions } : {}
-	});
-}
-/** Detects the gateway's explicit null-decision marker for unavailable approvals. */
-function approvalRequestExplicitlyUnavailable(result) {
-	if (result === null || result === void 0 || typeof result !== "object") return false;
-	let descriptor;
-	try {
-		descriptor = Object.getOwnPropertyDescriptor(result, "decision");
-	} catch {
-		return false;
-	}
-	return descriptor !== void 0 && "value" in descriptor && descriptor.value === null;
-}
-/** Waits for the gateway's final approval decision, respecting turn aborts. */
-async function waitForPluginApprovalDecision(params) {
-	const timeoutMs = DEFAULT_CODEX_APPROVAL_TIMEOUT_MS;
-	const waitPromise = params.hostCapabilities.waitForApproval({
-		approvalId: params.approvalId,
-		timeoutMs,
-		transportTimeoutMs: resolveCodexGatewayTimeoutWithGraceMs(timeoutMs),
-		signal: params.signal
-	}).catch((error) => {
-		if (isApprovalNotFoundError(error)) return null;
-		throw error;
-	});
-	const bindDecision = (result) => result;
-	if (!params.signal) return bindDecision(await waitPromise);
-	let onAbort;
-	const abortPromise = new Promise((_, reject) => {
-		if (params.signal.aborted) {
-			reject(toErrorObject(params.signal.reason, "Non-Error rejection"));
-			return;
-		}
-		onAbort = () => reject(toErrorObject(params.signal.reason, "Non-Error rejection"));
-		params.signal.addEventListener("abort", onAbort, { once: true });
-	});
-	try {
-		return bindDecision(await Promise.race([waitPromise, abortPromise]));
-	} finally {
-		if (onAbort) params.signal.removeEventListener("abort", onAbort);
-	}
-}
-/** Converts a gateway exec approval decision into the app-server approval outcome enum. */
-function mapExecDecisionToOutcome(decision) {
-	if (decision === "allow-once") return "approved-once";
-	if (decision === "allow-always") return "approved-session";
-	if (decision === null || decision === void 0) return "unavailable";
-	return "denied";
-}
-function truncateCodexApprovalDisplayText(value, maxLength) {
-	return value.length <= maxLength ? value : `${truncateUtf16Safe(value, maxLength - 3)}...`;
-}
-function stripDanglingCodexApprovalTerminalSequence(value) {
-	return value.replace(DANGLING_TERMINAL_SEQUENCE_SUFFIX_RE, "");
-}
-function sanitizeCodexApprovalVisibleText(value, options = {}) {
-	const terminalSafe = value.replace(ANSI_OSC_SEQUENCE_RE, "").replace(ANSI_CONTROL_SEQUENCE_RE, "");
-	return (options.stripDanglingTerminalSequence ? stripDanglingCodexApprovalTerminalSequence(terminalSafe) : terminalSafe).replace(INVISIBLE_FORMATTING_CONTROL_RE, " ").replace(CONTROL_CHARACTER_RE, " ").replace(/\s+/g, " ").trim();
-}
-//#endregion
 //#region extensions/codex/src/app-server/approval-bridge.ts
 /**
 * Bridges Codex app-server approval requests into OpenClaw policy hooks and
@@ -3600,19 +4120,55 @@ async function handleCodexAppServerApprovalRequest(params) {
 		requestParams,
 		paramsForRun: params.paramsForRun
 	});
-	const resolvePolicyApproval = (outcome, message = approvalResolutionMessage(outcome)) => {
+	if (params.signal?.aborted) {
+		recordNativeToolFailureDisposition(params, context, "cancelled");
+		return buildApprovalResponse(params.method, context.requestParams, "cancelled");
+	}
+	let revalidateMutableFileApproval;
+	let mutableFileApprovalRequiresOneShot = false;
+	const resolvePolicyApproval = async (outcome, message = approvalResolutionMessage(outcome), approvalId) => {
+		let resolvedOutcome = outcome;
+		let resolvedMessage = message;
+		if (outcome !== "denied" && revalidateMutableFileApproval) {
+			const binding = await revalidateMutableFileApproval();
+			if (!binding.ok) {
+				resolvedOutcome = "denied";
+				resolvedMessage = binding.message;
+			}
+		}
+		if (resolvedOutcome === "approved-session" && mutableFileApprovalRequiresOneShot) {
+			resolvedOutcome = "approved-once";
+			resolvedMessage = "Codex app-server approval granted for this byte-bound command only.";
+		}
 		emitApprovalEvent(params.paramsForRun, {
 			phase: "resolved",
 			kind: context.kind,
-			status: outcome === "denied" ? "denied" : "approved",
+			status: resolvedOutcome === "denied" ? "denied" : "approved",
 			title: context.title,
+			...approvalId ? {
+				approvalId,
+				approvalSlug: approvalId
+			} : {},
 			...context.eventDetails,
-			...approvalEventScope(params.method, outcome),
-			message
+			...approvalEventScope(params.method, resolvedOutcome),
+			message: resolvedMessage
 		});
-		return buildApprovalResponse(params.method, context.requestParams, outcome);
+		return buildApprovalResponse(params.method, context.requestParams, resolvedOutcome);
 	};
 	try {
+		if (params.method === "item/commandExecution/requestApproval") {
+			const command = readPolicyCommand(requestParams);
+			const cwd = readStringField(requestParams, "cwd") ?? params.paramsForRun.workspaceDir;
+			const prepareMutableFileApproval = params.paramsForRun.hostCapabilities.prepareMutableFileApproval;
+			if (!prepareMutableFileApproval) return await resolvePolicyApproval("denied", "SYSTEM_RUN_DENIED: mutable file approval binding is unavailable");
+			const prepared = await prepareMutableFileApproval({
+				command: command ?? "",
+				cwd
+			});
+			if (!prepared.ok) return await resolvePolicyApproval("denied", prepared.message);
+			mutableFileApprovalRequiresOneShot = prepared.requiresOneShot;
+			revalidateMutableFileApproval = prepared.revalidate;
+		}
 		const policyOutcome = await runOpenClawToolPolicyForApprovalRequest({
 			method: params.method,
 			requestParams,
@@ -3624,19 +4180,22 @@ async function handleCodexAppServerApprovalRequest(params) {
 		});
 		if (policyOutcome?.outcome === "denied") {
 			recordNativeToolFailureDisposition(params, context, policyOutcome.failureDisposition);
-			return resolvePolicyApproval("denied", policyOutcome.reason);
+			return await resolvePolicyApproval("denied", policyOutcome.reason);
 		}
-		if (policyOutcome?.outcome === "approved-once" || policyOutcome?.outcome === "approved-session") return resolvePolicyApproval(policyOutcome.outcome);
-		const canAutoApproveConcreteToolCall = CONCRETE_TOOL_AUTO_APPROVAL_METHODS.has(params.method);
-		if (canAutoApproveConcreteToolCall && params.autoApproveOpenClawToolPolicy === true && policyOutcome?.outcome === "allowed") return resolvePolicyApproval("approved-once", "Codex app-server approval accepted by OpenClaw tool policy.");
-		if (canAutoApproveConcreteToolCall && params.autoApprove === true) return resolvePolicyApproval("approved-session", "Codex app-server approval auto-approved by runtime policy.");
+		if (policyOutcome?.outcome === "approved-once" || policyOutcome?.outcome === "approved-session") return await resolvePolicyApproval(policyOutcome.outcome);
+		if (CONCRETE_TOOL_AUTO_APPROVAL_METHODS.has(params.method) && params.autoApprove === true) return await resolvePolicyApproval("approved-session", "Codex app-server approval auto-approved by runtime policy.");
 		const requestResult = await requestPluginApproval({
 			hostCapabilities: params.paramsForRun.hostCapabilities,
 			title: context.title,
 			description: context.description,
 			severity: context.severity,
 			toolName: context.toolName,
-			toolCallId: context.approvalId
+			toolCallId: context.approvalId,
+			allowedDecisions: nativeApprovalAllowedDecisions({
+				method: params.method,
+				requestParams,
+				requiresOneShot: mutableFileApprovalRequiresOneShot
+			})
 		});
 		const approvalId = requestResult?.id;
 		if (!approvalId) {
@@ -3662,16 +4221,17 @@ async function handleCodexAppServerApprovalRequest(params) {
 			...context.eventDetails,
 			message: "Codex app-server approval requested."
 		});
-		const requestUnavailable = approvalRequestExplicitlyUnavailable(requestResult);
-		const decision = requestUnavailable ? null : await waitForPluginApprovalDecision({
+		const approvalResult = approvalRequestExplicitlyUnavailable(requestResult) ? void 0 : await waitForPluginApprovalDecision({
 			approvalId,
 			signal: params.signal,
 			hostCapabilities: params.paramsForRun.hostCapabilities
 		});
-		const approvalExpired = !requestUnavailable && decision === null;
-		const outcome = params.signal?.aborted ? "cancelled" : mapExecDecisionToOutcome(decision);
-		if (outcome === "cancelled") recordNativeToolFailureDisposition(params, context, params.signal?.aborted ? resolveCodexToolAbortTerminalReason(params.signal) : "cancelled");
-		else if (outcome === "unavailable") recordNativeToolFailureDisposition(params, context, approvalExpired ? "timed_out" : "failed");
+		const approvalTimedOut = !params.signal?.aborted && approvalResult?.terminalReason === "timeout";
+		const outcome = params.signal?.aborted ? "cancelled" : mapExecDecisionToOutcome(approvalResult?.decision);
+		if (approvalTimedOut) recordNativeToolFailureDisposition(params, context, "timed_out", context.approvalKind);
+		else if (outcome === "cancelled") recordNativeToolFailureDisposition(params, context, params.signal?.aborted ? resolveCodexToolAbortTerminalReason(params.signal) : "cancelled");
+		else if (outcome === "unavailable") recordNativeToolFailureDisposition(params, context, "failed");
+		if (outcome === "approved-once" || outcome === "approved-session") return await resolvePolicyApproval(outcome, approvalResolutionMessage(outcome), approvalId);
 		emitApprovalEvent(params.paramsForRun, {
 			phase: "resolved",
 			kind: context.kind,
@@ -3681,7 +4241,7 @@ async function handleCodexAppServerApprovalRequest(params) {
 			approvalSlug: approvalId,
 			...context.eventDetails,
 			...approvalEventScope(params.method, outcome),
-			message: approvalResolutionMessage(outcome)
+			message: approvalTimedOut ? codexApprovalTimeoutText(context.approvalKind) : approvalResolutionMessage(outcome)
 		});
 		return buildApprovalResponse(params.method, context.requestParams, outcome);
 	} catch (error) {
@@ -3699,10 +4259,11 @@ async function handleCodexAppServerApprovalRequest(params) {
 		return buildApprovalResponse(params.method, context.requestParams, cancelled ? "cancelled" : "denied");
 	}
 }
-function recordNativeToolFailureDisposition(params, context, disposition) {
+function recordNativeToolFailureDisposition(params, context, disposition, approvalKind) {
 	if (!context.itemId || !disposition) return;
 	try {
-		params.onNativeToolFailureDisposition?.(context.itemId, params.signal?.aborted ? resolveCodexToolAbortTerminalReason(params.signal) : disposition);
+		const resolvedDisposition = params.signal?.aborted ? resolveCodexToolAbortTerminalReason(params.signal) : disposition;
+		params.onNativeToolFailureDisposition?.(context.itemId, resolvedDisposition, ...resolvedDisposition === "timed_out" && approvalKind ? [approvalKind] : []);
 	} catch {}
 }
 /** Converts an OpenClaw approval outcome into the app-server method response. */
@@ -3719,7 +4280,10 @@ function buildApprovalResponse(method, requestParams, outcome) {
 			scope: "turn"
 		};
 	}
-	return unsupportedApprovalResponse();
+	return {
+		decision: "decline",
+		reason: "OpenClaw codex app-server bridge does not grant native approvals yet."
+	};
 }
 function matchesCurrentTurn(requestParams, threadId, turnId) {
 	if (!requestParams) return false;
@@ -3735,18 +4299,16 @@ function buildApprovalContext(params) {
 	const reasonPreview = sanitizeApprovalPreview(readStringPreview(params.requestParams, "reason"), 180);
 	const command = commandPreview.text;
 	const reason = reasonPreview.text;
-	const kind = approvalKindForMethod(params.method);
+	const approvalKind = params.method.includes("commandExecution") ? "command" : params.method.includes("fileChange") ? "file-change" : params.method.includes("permissions") ? "permissions" : "other";
+	const kind = approvalKind === "command" ? "exec" : approvalKind === "other" ? "unknown" : "plugin";
 	const permissionLines = params.method === "item/permissions/requestApproval" ? describeRequestedPermissions(params.requestParams) : [];
 	const title = kind === "exec" ? "Codex app-server command approval" : params.method === "item/permissions/requestApproval" ? "Codex app-server permission approval" : kind === "plugin" ? "Codex app-server file approval" : "Codex app-server approval";
 	const subject = permissionLines[0] ?? (command ? `Command: ${formatApprovalPreviewSubject(command, commandPreview.omitted)}` : commandPreview.omitted ? `Command: ${APPROVAL_PREVIEW_OMITTED}` : reason ? `Reason: ${formatApprovalPreviewSubject(reason, reasonPreview.omitted)}` : reasonPreview.omitted ? `Reason: ${APPROVAL_PREVIEW_OMITTED}` : `Request method: ${params.method}`);
 	return {
+		approvalKind,
 		kind,
 		title,
-		description: permissionLines.length > 0 ? joinDescriptionLinesWithinLimit(permissionLines, PERMISSION_DESCRIPTION_MAX_LENGTH) : [
-			subject,
-			...commandDetailLines,
-			params.paramsForRun.sessionKey && `Session: ${params.paramsForRun.sessionKey}`
-		].filter(Boolean).join("\n"),
+		description: permissionLines.length > 0 ? joinDescriptionLinesWithinLimit(permissionLines, PERMISSION_DESCRIPTION_MAX_LENGTH) : [subject, ...commandDetailLines].join("\n"),
 		severity: kind === "exec" ? "warning" : "info",
 		toolName: kind === "exec" ? "codex_command_approval" : params.method === "item/permissions/requestApproval" ? "codex_permission_approval" : "codex_file_approval",
 		itemId,
@@ -3960,14 +4522,27 @@ function stableJsonText(value) {
 	}
 }
 function commandApprovalDecision(requestParams, outcome) {
-	if (outcome === "cancelled") return commandRejectionDecision(requestParams, "cancel");
-	if (outcome === "denied" || outcome === "unavailable") return commandRejectionDecision(requestParams, "decline");
-	if (outcome === "approved-session") {
-		if (hasAvailableDecision(requestParams, "acceptForSession")) return "acceptForSession";
-		const amendmentDecision = findAvailableCommandAmendmentDecision(requestParams);
-		if (amendmentDecision) return amendmentDecision;
-	}
-	return hasAvailableDecision(requestParams, "accept") ? "accept" : commandRejectionDecision(requestParams, "decline");
+	if (outcome === "cancelled") return "cancel";
+	if (outcome === "denied" || outcome === "unavailable") return "decline";
+	const capabilities = commandApprovalCapabilities(requestParams);
+	if (outcome === "approved-session" && capabilities.sessionDecision !== void 0) return capabilities.sessionDecision;
+	return capabilities.once ? "accept" : "decline";
+}
+function nativeApprovalAllowedDecisions(params) {
+	if (params.method === "item/fileChange/requestApproval") return [
+		"allow-once",
+		"allow-always",
+		"deny"
+	];
+	if (params.method !== "item/commandExecution/requestApproval") return;
+	const available = params.requestParams?.availableDecisions;
+	if (!Array.isArray(available)) return;
+	const capabilities = commandApprovalCapabilities(params.requestParams);
+	const decisions = [];
+	if (capabilities.once) decisions.push("allow-once");
+	if (!params.requiresOneShot && capabilities.sessionDecision !== void 0) decisions.push("allow-always");
+	decisions.push("deny");
+	return decisions;
 }
 function fileChangeApprovalDecision(outcome) {
 	if (outcome === "cancelled") return "cancel";
@@ -3981,12 +4556,6 @@ function requestedPermissions(requestParams) {
 	if (isJsonObject(permissions.fileSystem)) granted.fileSystem = permissions.fileSystem;
 	return granted;
 }
-function unsupportedApprovalResponse() {
-	return {
-		decision: "decline",
-		reason: "OpenClaw codex app-server bridge does not grant native approvals yet."
-	};
-}
 function describeRequestedPermissions(requestParams) {
 	return describePermissionProfile(requestedPermissions(requestParams), "Permissions");
 }
@@ -4154,43 +4723,38 @@ function isPrivateNetworkHostPattern(value) {
 	if (wildcardStripped.startsWith("10.") || wildcardStripped.startsWith("127.") || wildcardStripped.startsWith("192.168.") || wildcardStripped.startsWith("169.254.")) return true;
 	return /^172\.(1[6-9]|2\d|3[0-1])\./.test(wildcardStripped);
 }
-function hasAvailableDecision(requestParams, decision) {
+function commandApprovalCapabilities(requestParams) {
 	const available = requestParams?.availableDecisions;
-	if (!Array.isArray(available)) return true;
-	return available.includes(decision);
+	if (!Array.isArray(available)) return {
+		once: true,
+		sessionDecision: "acceptForSession"
+	};
+	return {
+		once: available.includes("accept"),
+		...available.includes("acceptForSession") ? { sessionDecision: "acceptForSession" } : { sessionDecision: findAvailableCommandAmendmentDecision(requestParams) }
+	};
 }
 function findAvailableCommandAmendmentDecision(requestParams) {
 	const available = requestParams?.availableDecisions;
 	if (!Array.isArray(available)) return;
 	return available.find((entry) => isJsonObject(entry) && (isJsonObject(entry.acceptWithExecpolicyAmendment) || isJsonObject(entry.applyNetworkPolicyAmendment)));
 }
-function commandRejectionDecision(requestParams, preferred) {
-	const available = requestParams?.availableDecisions;
-	if (!Array.isArray(available)) return preferred;
-	if (available.includes(preferred)) return preferred;
-	const alternate = preferred === "decline" ? "cancel" : "decline";
-	if (available.includes(alternate)) return alternate;
-	return preferred;
-}
 function approvalResolutionMessage(outcome) {
-	if (outcome === "approved-session") return "Codex app-server approval granted for the session.";
-	if (outcome === "approved-once") return "Codex app-server approval granted for this turn.";
-	if (outcome === "cancelled") return "Codex app-server approval cancelled.";
-	if (outcome === "unavailable") return "Codex app-server approval unavailable.";
-	return "Codex app-server approval denied.";
+	return {
+		"approved-session": "Codex app-server approval granted for the session.",
+		"approved-once": "Codex app-server approval granted for this turn.",
+		cancelled: "Codex app-server approval cancelled.",
+		unavailable: "Codex app-server approval unavailable.",
+		denied: "Codex app-server approval denied."
+	}[outcome];
 }
 function approvalEventScope(method, outcome) {
 	return method === "item/permissions/requestApproval" ? { scope: outcome === "approved-session" ? "session" : "turn" } : {};
 }
-function approvalKindForMethod(method) {
-	if (method.includes("commandExecution") || method.includes("execCommand")) return "exec";
-	if (method.includes("fileChange") || method.includes("Patch") || method.includes("permissions")) return "plugin";
-	return "unknown";
-}
 function emitApprovalEvent(params, data) {
 	params.onAgentEvent?.({
 		stream: "approval",
-		data
+		data: { ...data }
 	});
 }
 function readDisplayCommandPreview(record) {
@@ -4389,11 +4953,11 @@ const MAX_DISPLAY_VALUE_ARRAY_ITEMS = 8;
 const MAX_DISPLAY_VALUE_OBJECT_KEYS = 8;
 const MAX_DISPLAY_VALUE_DEPTH = 3;
 const DISPLAY_TEXT_SCAN_MAX_LENGTH = 4096;
-async function handleCodexAppServerElicitationRequest(params) {
+async function routeCodexAppServerElicitationRequest(params) {
 	const requestParams = isJsonObject(params.requestParams) ? params.requestParams : void 0;
-	if (!requestParams || readNonBlankStringField(requestParams, "threadId") !== params.threadId) return;
+	if (!requestParams || readNonBlankStringField(requestParams, "threadId") !== params.threadId) return { kind: "not-mine" };
 	const requestTurnId = requestParams.turnId;
-	if (requestTurnId !== null && requestTurnId !== void 0 && requestTurnId !== params.turnId) return;
+	if (requestTurnId !== null && requestTurnId !== void 0 && requestTurnId !== params.turnId) return { kind: "not-mine" };
 	const pluginResolution = resolvePluginElicitation({
 		requestParams,
 		pluginAppPolicyContext: params.pluginAppPolicyContext
@@ -4401,32 +4965,38 @@ async function handleCodexAppServerElicitationRequest(params) {
 	if (pluginResolution.kind !== "not_plugin") {
 		if (params.paramsForRun.trigger === "cron" && params.paramsForRun.scheduledRuntimeAuthority) {
 			logPluginElicitationDecline("scheduled_authority_non_interactive", requestParams);
-			return declineElicitationResponse();
+			return handled(createCodexElicitationResponse("decline"));
 		}
 		if (pluginResolution.kind === "decline") {
 			logPluginElicitationDecline(pluginResolution.reason, requestParams);
-			return declineElicitationResponse();
+			return handled(createCodexElicitationResponse("decline"));
 		}
 		if (requestTurnId !== params.turnId) {
 			logPluginElicitationDecline("missing_active_turn", requestParams);
-			return declineElicitationResponse();
+			return handled(createCodexElicitationResponse("decline"));
 		}
-		return await buildPluginPolicyElicitationResponse({
+		return handled(await buildPluginPolicyElicitationResponse({
 			entry: pluginResolution.entry,
 			requestParams,
 			paramsForRun: params.paramsForRun,
 			signal: params.signal
-		});
+		}));
 	}
 	const approvalPrompt = readComputerUseApprovalElicitation(requestParams, params.computerUseMcpServerName) ?? readBridgeableApprovalElicitation(requestParams);
-	if (!approvalPrompt) return;
-	return buildElicitationResponse(approvalPrompt, await requestPluginApprovalOutcome({
+	if (!approvalPrompt) return (isJsonObject(requestParams["_meta"]) ? requestParams["_meta"] : void 0)?.[MCP_TOOL_APPROVAL_KIND_KEY] === MCP_TOOL_APPROVAL_KIND || params.computerUseMcpServerName !== void 0 && readNonBlankStringField(requestParams, "serverName") === params.computerUseMcpServerName ? handled(createCodexElicitationResponse("decline")) : { kind: "not-mine" };
+	return handled(buildElicitationResponse(approvalPrompt, await requestPluginApprovalOutcome({
 		paramsForRun: params.paramsForRun,
 		title: approvalPrompt.title,
 		description: approvalPrompt.description,
 		allowedDecisions: approvalPrompt.allowedDecisions,
 		signal: params.signal
-	}));
+	})));
+}
+function handled(response) {
+	return {
+		kind: "handled",
+		response
+	};
 }
 function resolvePluginElicitation(params) {
 	const requestParams = params.requestParams;
@@ -4527,26 +5097,27 @@ async function buildPluginPolicyElicitationResponse(params) {
 	const mode = resolvePluginDestructiveApprovalMode(params.entry);
 	if (mode === "deny") {
 		logPluginElicitationDecline("destructive_actions_disabled", params.requestParams);
-		return declineElicitationResponse();
+		return createCodexElicitationResponse("decline");
 	}
 	const approvalPrompt = readPluginApprovalElicitation(params.entry, params.requestParams);
 	if (!approvalPrompt) {
 		logPluginElicitationDecline("unsupported_schema", params.requestParams);
-		return declineElicitationResponse();
+		return createCodexElicitationResponse("decline");
 	}
 	const response = buildElicitationResponse(approvalPrompt, "approved-once");
-	if (isJsonObject(response) && response.action === "accept") {
+	if (response.action === "accept") {
 		if (mode === "allow") return response;
-		return buildElicitationResponse(approvalPrompt, oneShotPluginPolicyApprovalOutcome(mode, await requestPluginApprovalOutcome({
+		const outcome = await requestPluginApprovalOutcome({
 			paramsForRun: params.paramsForRun,
 			title: approvalPrompt.title,
 			description: approvalPrompt.description,
 			allowedDecisions: allowedPluginPolicyApprovalDecisions(mode, approvalPrompt),
 			signal: params.signal
-		})));
+		});
+		return buildElicitationResponse(approvalPrompt, mode === "ask" && outcome === "approved-session" ? "approved-once" : outcome);
 	}
 	logPluginElicitationDecline("unmappable_schema", params.requestParams);
-	return declineElicitationResponse();
+	return createCodexElicitationResponse("decline");
 }
 function resolvePluginDestructiveApprovalMode(entry) {
 	return entry.destructiveApprovalMode ?? (entry.allowDestructiveActions ? "allow" : "deny");
@@ -4556,9 +5127,6 @@ function allowedPluginPolicyApprovalDecisions(mode, approvalPrompt) {
 	if (mode !== "ask") return allowedDecisions;
 	return allowedDecisions.filter((decision) => decision !== "allow-always");
 }
-function oneShotPluginPolicyApprovalOutcome(mode, outcome) {
-	return mode === "ask" && outcome === "approved-session" ? "approved-once" : outcome;
-}
 function readPluginApprovalElicitation(entry, requestParams) {
 	if (readNonBlankStringField(requestParams, "mode") !== "form" || !isJsonObject(requestParams.requestedSchema)) return;
 	const requestedSchema = requestParams.requestedSchema;
@@ -4602,13 +5170,6 @@ function canMapPersistentApproval(requestedSchema, meta) {
 		}) && chooseAlwaysPersistOptionValue(readEnumOptions(schema)) !== void 0;
 	});
 }
-function declineElicitationResponse() {
-	return {
-		action: "decline",
-		content: null,
-		_meta: null
-	};
-}
 function logPluginElicitationDecline(reason, requestParams) {
 	embeddedAgentLog.debug("codex plugin elicitation declined", {
 		reason,
@@ -4751,27 +5312,23 @@ async function requestPluginApprovalOutcome(params) {
 		});
 		const approvalId = requestResult?.id;
 		if (!approvalId) return "unavailable";
-		return mapExecDecisionToOutcome(approvalRequestExplicitlyUnavailable(requestResult) ? null : await waitForPluginApprovalDecision({
+		const approvalResult = approvalRequestExplicitlyUnavailable(requestResult) ? void 0 : await waitForPluginApprovalDecision({
 			hostCapabilities: params.paramsForRun.hostCapabilities,
 			approvalId,
 			signal: params.signal
-		}));
+		});
+		if (params.signal?.aborted) return "cancelled";
+		if (approvalResult?.terminalReason === "timeout") return "timed-out";
+		return mapExecDecisionToOutcome(approvalResult?.decision);
 	} catch {
 		return params.signal?.aborted ? "cancelled" : "denied";
 	}
 }
 function buildElicitationResponse(approvalPrompt, outcome) {
 	const { requestedSchema, meta } = approvalPrompt;
-	if (outcome === "cancelled") return {
-		action: "cancel",
-		content: null,
-		_meta: null
-	};
-	if (outcome === "denied" || outcome === "unavailable") return {
-		action: "decline",
-		content: null,
-		_meta: null
-	};
+	if (outcome === "cancelled") return createCodexElicitationResponse("cancel");
+	if (outcome === "timed-out") return createCodexElicitationResponse("decline", null, { message: codexApprovalTimeoutText("other") });
+	if (outcome === "denied" || outcome === "unavailable") return createCodexElicitationResponse("decline");
 	const content = buildAcceptedContent(approvalPrompt, outcome);
 	if (!content && !hasNoSchemaProperties(requestedSchema)) {
 		embeddedAgentLog.warn("codex MCP approval elicitation approved without a mappable response", {
@@ -4779,13 +5336,9 @@ function buildElicitationResponse(approvalPrompt, outcome) {
 			fields: Object.keys(requestedSchema.properties ?? {}),
 			outcome
 		});
-		return declineElicitationResponse();
+		return createCodexElicitationResponse("decline");
 	}
-	return {
-		action: "accept",
-		content: content ?? null,
-		_meta: buildAcceptedMeta(meta, outcome, approvalPrompt.persistHintsMode ?? "legacy")
-	};
+	return createCodexElicitationResponse("accept", content ?? null, buildAcceptedMeta(meta, outcome, approvalPrompt.persistHintsMode ?? "legacy"));
 }
 function buildAcceptedContent(approvalPrompt, outcome) {
 	const { requestedSchema, meta } = approvalPrompt;
@@ -4920,6 +5473,36 @@ function readFirstString$1(record, keys) {
 * Bridges OpenClaw runtime tools into Codex app-server dynamic tool specs and
 * tool-call responses.
 */
+const INTERNAL_TOOL_EXECUTION_VALIDATION = Symbol.for("openclaw.internalToolExecutionValidation");
+const MAX_CODEX_DYNAMIC_TOOL_VALIDATION_ERRORS = 4;
+const MAX_CODEX_DYNAMIC_TOOL_VALIDATION_ERROR_CHARS = 160;
+const CODEX_DYNAMIC_TOOL_VALIDATION_TRUNCATED_SUFFIX = " [detail truncated]";
+function shouldValidateCodexDynamicToolInput(tool) {
+	return getPluginToolMeta(tool)?.mcp?.operation !== "tool";
+}
+function assertCodexDynamicToolInputMatchesSchema(params) {
+	const validation = validateJsonSchemaValue({
+		schema: params.schema,
+		cacheKey: `codex-dynamic-tool-input:${params.toolName}:${JSON.stringify(params.schema)}`,
+		value: params.value
+	});
+	if (validation.ok) return;
+	const visibleErrors = validation.errors.slice(0, MAX_CODEX_DYNAMIC_TOOL_VALIDATION_ERRORS);
+	const details = visibleErrors.map((error) => {
+		if (error.text.length <= MAX_CODEX_DYNAMIC_TOOL_VALIDATION_ERROR_CHARS) return error.text;
+		return `${error.text.slice(0, MAX_CODEX_DYNAMIC_TOOL_VALIDATION_ERROR_CHARS - 19)}${CODEX_DYNAMIC_TOOL_VALIDATION_TRUNCATED_SUFFIX}`;
+	}).join("; ");
+	const omitted = validation.errors.length - visibleErrors.length;
+	const omittedSuffix = omitted > 0 ? `; ${omitted} more violation(s) omitted` : "";
+	throw new Error(`Invalid arguments for tool "${params.toolName}": ${details}${omittedSuffix}.`);
+}
+function createCodexDynamicToolValidationControl(params) {
+	return {
+		[INTERNAL_TOOL_EXECUTION_VALIDATION]: true,
+		toolCallId: params.toolCallId,
+		validate: params.validate
+	};
+}
 function applyCurrentMessageProvider(toolName, args, currentProvider) {
 	const hasProvider = typeof args.provider === "string" && args.provider.trim().length > 0 ? true : typeof args.channel === "string" && args.channel.trim().length > 0;
 	const provider = currentProvider?.trim();
@@ -5050,6 +5633,8 @@ function normalizeAcceptedSessionSpawn(result) {
 }
 /** Namespace attached to OpenClaw-owned dynamic tools exposed to Codex. */
 const CODEX_OPENCLAW_DYNAMIC_TOOL_NAMESPACE = "openclaw";
+const CODEX_DYNAMIC_TOOL_NAME_MAX_CHARS = 128;
+const CODEX_DYNAMIC_TOOL_NAME_PATTERN = /^[a-zA-Z0-9_-]+$/u;
 const ALWAYS_DIRECT_DYNAMIC_TOOL_NAMES = /* @__PURE__ */ new Set([
 	"agents_list",
 	"sessions_spawn",
@@ -5100,7 +5685,11 @@ function createCodexDynamicToolBridge(params) {
 	const toolMap = new Map(availableTools.map((entry) => [entry.name, entry]));
 	const registeredToolNames = new Set(registeredSpecTools.map((entry) => entry.name));
 	const quarantinedTools = dedupeQuarantinedDynamicTools([...availableProjection.quarantinedTools, ...registeredProjection.quarantinedTools]);
-	warnQuarantinedDynamicTools(quarantinedTools);
+	warnQuarantinedDynamicTools({
+		tools: quarantinedTools,
+		availableToolCount: availableTools.length,
+		registeredToolCount: registeredSpecTools.length
+	});
 	emitQuarantinedDynamicToolDiagnostics(quarantinedTools, params.hookContext);
 	const telemetry = {
 		didSendViaMessagingTool: false,
@@ -5140,6 +5729,10 @@ function createCodexDynamicToolBridge(params) {
 			directToolNames
 		}),
 		resultContentSourceForTool: (toolName) => toolMap.get(toolName)?.tool.resultContentSource,
+		sideEffectOwnerKeyForTool: (toolName) => {
+			const tool = toolMap.get(toolName)?.tool;
+			return tool ? getPluginToolSideEffectOwnerKey(tool) : void 0;
+		},
 		telemetry,
 		setRemoteWorkspaceFileReader: (reader) => {
 			readRemoteWorkspaceFile = reader;
@@ -5171,7 +5764,8 @@ function createCodexDynamicToolBridge(params) {
 				});
 			}
 			const { tool, name: toolName } = toolEntry;
-			const args = asNonArrayRecord(call.arguments);
+			const rawArguments = call.arguments;
+			const args = asNonArrayRecord(rawArguments);
 			const startedAt = Date.now();
 			const signal = composeAbortSignals(params.signal, options?.signal);
 			let didStartExecution = false;
@@ -5194,7 +5788,8 @@ function createCodexDynamicToolBridge(params) {
 				};
 			};
 			try {
-				const toolArgs = tool.prepareArguments ? tool.prepareArguments(args) : args;
+				const prepare = tool.prepareArguments;
+				const toolArgs = prepare ? Reflect.apply(prepare, tool, [rawArguments]) : args;
 				const preparedArgs = toolName === "message" && isRecord(toolArgs) ? await prepareCodexRemoteWorkspaceMessageMedia({
 					args: toolArgs,
 					localWorkspaceRoot: params.hookContext?.workspaceDir,
@@ -5214,7 +5809,20 @@ function createCodexDynamicToolBridge(params) {
 					hasRepliedRef: params.hookContext?.hasRepliedRef ? { value: params.hookContext.hasRepliedRef.value } : void 0
 				};
 				didDispatchExecution = true;
-				const rawResult = await tool.execute(call.callId, preparedArgs, signal);
+				const executionArgs = [
+					call.callId,
+					preparedArgs,
+					signal
+				];
+				if (shouldValidateCodexDynamicToolInput(tool)) executionArgs.push(createCodexDynamicToolValidationControl({
+					toolCallId: call.callId,
+					validate: (value) => assertCodexDynamicToolInputMatchesSchema({
+						toolName,
+						schema: toolEntry.inputSchema,
+						value
+					})
+				}));
+				const rawResult = await Reflect.apply(tool.execute, tool, executionArgs);
 				captureExecutionBoundary();
 				const telemetryRawResult = sanitizeToolResult(rawResult);
 				const rawIsError = isToolResultError(rawResult);
@@ -5282,7 +5890,7 @@ function createCodexDynamicToolBridge(params) {
 					contentItems,
 					success: !resultIsError
 				}, terminalType);
-				withDynamicToolTranscriptDetails(response, result.details);
+				withDynamicToolTranscriptDetails(response, asOptionalRecord(sanitizeToolResult(result))?.details);
 				withDiagnosticFailureDisposition(response, resultFailureKind);
 				const blocksSourceReplyTermination = hasExplicitNonSourceMessageRoute(executedArgs, params.hookContext, confirmedMessagingTarget);
 				const deliveredSourceReply = isDeliveredMessageToolOnlySourceReplyResult({
@@ -5533,6 +6141,13 @@ function projectCodexDynamicTools(tools) {
 			});
 			continue;
 		}
+		if (!isRecord(projection.schema)) {
+			quarantinedTools.push({
+				tool: descriptor.name,
+				violations: [`${descriptor.name}.inputSchema must be a JSON object schema`]
+			});
+			continue;
+		}
 		projectedTools.push({
 			tool,
 			name: descriptor.name,
@@ -5557,6 +6172,20 @@ function readCodexDynamicToolDescriptor(tool, toolIndex) {
 				violations: [`${fallbackName}.name must be a non-empty string`]
 			}
 		};
+		const trimmedName = rawName.trim();
+		let nameViolation;
+		if (!trimmedName) nameViolation = `${rawName}.name must not be empty`;
+		else if (trimmedName !== rawName) nameViolation = `${rawName}.name must not have leading or trailing whitespace`;
+		else if (!CODEX_DYNAMIC_TOOL_NAME_PATTERN.test(rawName)) nameViolation = `${rawName}.name must match ^[a-zA-Z0-9_-]+$`;
+		else if (rawName.length > CODEX_DYNAMIC_TOOL_NAME_MAX_CHARS) nameViolation = `${rawName}.name must be at most ${CODEX_DYNAMIC_TOOL_NAME_MAX_CHARS} characters`;
+		else if (rawName === "mcp" || rawName.startsWith("mcp__")) nameViolation = `${rawName}.name is reserved by Codex app-server`;
+		if (nameViolation) return {
+			ok: false,
+			diagnostic: {
+				tool: rawName,
+				violations: [nameViolation]
+			}
+		};
 		name = rawName;
 	} catch {
 		return {
@@ -5598,14 +6227,18 @@ function readCodexDynamicToolDescriptor(tool, toolIndex) {
 		parameters
 	};
 }
-function warnQuarantinedDynamicTools(tools) {
-	if (tools.length === 0) return;
+function warnQuarantinedDynamicTools(params) {
+	if (params.tools.length === 0) return;
 	const unique = /* @__PURE__ */ new Map();
-	for (const tool of tools) unique.set(tool.tool, tool.violations);
-	embeddedAgentLog.warn(`codex app-server quarantined ${unique.size} dynamic ${unique.size === 1 ? "tool" : "tools"} with unsupported input schemas: ${[...unique.keys()].join(", ")}`, { tools: [...unique.entries()].map(([tool, violations]) => ({
-		tool,
-		violations
-	})) });
+	for (const tool of params.tools) unique.set(tool.tool, tool.violations);
+	embeddedAgentLog.warn(`codex app-server quarantined ${unique.size} unsupported dynamic tool ${unique.size === 1 ? "definition" : "definitions"}: ${[...unique.keys()].join(", ")}; retained ${params.availableToolCount} available and ${params.registeredToolCount} registered tools`, {
+		tools: [...unique.entries()].map(([tool, violations]) => ({
+			tool,
+			violations
+		})),
+		availableToolCount: params.availableToolCount,
+		registeredToolCount: params.registeredToolCount
+	});
 }
 function emitQuarantinedDynamicToolDiagnostics(tools, ctx) {
 	for (const tool of tools) emitTrustedDiagnosticEvent({
@@ -5893,4 +6526,4 @@ function isCronAddAction(args) {
 	return typeof action === "string" && action.trim().toLowerCase() === "add";
 }
 //#endregion
-export { buildCodexNativeHookRelayDisabledConfig as A, resolveDynamicToolCallTimeoutMs as B, shouldWarnCodexDynamicToolBuildStageSummary as C, CODEX_NATIVE_HOOK_RELAY_EVENTS as D, CodexNativeToolLifecycleProjector as E, scheduleCodexNativeHookRelayUnregister as F, toCodexDynamicToolProtocolResponse as G, shouldBlockTerminalReleaseForNonTerminalDynamicToolResult as H, handleDynamicToolCallWithTimeout as I, resolveCodexToolAbortTerminalReason as K, hasPendingDynamicToolTerminalDiagnostic as L, emitCodexNativePreToolUseFailureDiagnostic as M, resolveCodexNativeHookRelayEvents as N, CODEX_NATIVE_HOOK_RELAY_TTL_GRACE_MS as O, resolveCodexNativeHookRelayTtlMs as P, isDynamicToolTerminalDiagnosticEvent as R, shouldRequireCodexSandboxExecServerEnvironment as S, readBoundedCodexRemoteWorkspaceFile as T, shouldReleaseTurnAfterTerminalDynamicTool as U, resolveTerminalDynamicToolBatchAction as V, toCodexDynamicToolProgressResponse as W, resolveCodexAppServerHookChannelId as _, emitDynamicToolStartedDiagnostic as a, resolveCodexSandboxEnvironmentSelection as b, resolveCodexProviderWebSearchSupport as c, releaseCodexSandboxExecServerEnvironment as d, buildDynamicTools as f, resolveCodexAppServerExecutionCwd as g, formatCodexDynamicToolBuildStageSummary as h, emitDynamicToolErrorDiagnostic as i, createCodexNativeHookRelay as j, buildCodexNativeHookRelayConfig as k, resolveCodexProviderWebSearchSupportForClient as l, disableCodexPluginThreadConfig as m, projectCodexExecutableDynamicTools as n, emitDynamicToolTerminalDiagnostic as o, createCodexDynamicToolBuildStageTracker as p, handleCodexAppServerElicitationRequest as r, handleCodexAppServerApprovalRequest as s, createCodexDynamicToolBridge as t, ensureCodexSandboxExecServerEnvironment as u, resolveCodexExternalSandboxPolicyForOpenClawSandbox as v, filterToolsForVisionInputs as w, shouldEnableCodexAppServerNativeToolSurface as x, resolveCodexMessageToolProvider as y, isMatchingDynamicToolTerminalDiagnostic as z };
+export { buildCodexNativeHookRelayConfig as A, isMatchingDynamicToolTerminalDiagnostic as B, shouldRequireCodexSandboxExecServerEnvironment as C, CodexNativeToolLifecycleProjector as D, readBoundedCodexRemoteWorkspaceFile as E, resolveCodexNativeHookRelayTtlMs as F, toCodexDynamicToolProgressResponse as G, resolveTerminalDynamicToolBatchAction as H, scheduleCodexNativeHookRelayUnregister as I, toCodexDynamicToolProtocolResponse as K, handleDynamicToolCallWithTimeout as L, createCodexNativeHookRelay as M, emitCodexNativePreToolUseFailureDiagnostic as N, CODEX_NATIVE_HOOK_RELAY_EVENTS as O, resolveCodexNativeHookRelayEvents as P, hasPendingDynamicToolTerminalDiagnostic as R, shouldEnableCodexAppServerNativeToolSurface as S, filterCodexVisionTools as T, shouldBlockTerminalReleaseForNonTerminalDynamicToolResult as U, resolveDynamicToolCallTimeoutMs as V, shouldReleaseTurnAfterTerminalDynamicTool as W, resolveCodexAppServerHookChannelId as _, emitDynamicToolStartedDiagnostic as a, resolveCodexNodePlacementToolConstructionPlan as b, resolveCodexProviderWebSearchSupport as c, releaseCodexSandboxExecServerEnvironment as d, buildDynamicTools as f, resolveCodexAppServerExecutionCwd as g, formatCodexDynamicToolBuildStageSummary as h, emitDynamicToolErrorDiagnostic as i, buildCodexNativeHookRelayDisabledConfig as j, CODEX_NATIVE_HOOK_RELAY_TTL_GRACE_MS as k, resolveCodexProviderWebSearchSupportForClient as l, disableCodexPluginThreadConfig as m, projectCodexExecutableDynamicTools as n, emitDynamicToolTerminalDiagnostic as o, createCodexDynamicToolBuildStageTracker as p, resolveCodexToolAbortTerminalReason as q, routeCodexAppServerElicitationRequest as r, handleCodexAppServerApprovalRequest as s, createCodexDynamicToolBridge as t, ensureCodexSandboxExecServerEnvironment as u, resolveCodexExternalSandboxPolicyForOpenClawSandbox as v, shouldWarnCodexDynamicToolBuildStageSummary as w, resolveCodexSandboxEnvironmentSelection as x, resolveCodexMessageToolProvider as y, isDynamicToolTerminalDiagnosticEvent as z };