@openclaw/codex 2026.8.1-beta.2 → 2026.8.1

package/dist/{thread-lifecycle-Bu1BTDXr.js → thread-lifecycle-Ss-uwnC4.js}

@@ -1,27 +1,38 @@
-import { D as CODEX_PLUGINS_MARKETPLACE_NAME, E as resolveCodexPluginsPolicy, O as CODEX_PLUGINS_WORKSPACE_MARKETPLACE_NAME, a as hashCodexAppServerBindingFingerprint, c as reclaimCurrentCodexSessionGeneration, d as sessionBindingIdentity, i as createCodexSessionGenerationSupersededError, m as codexSandboxPolicyForTurn, n as assertCodexBindingMayBeReplaced, o as isCodexAppServerNativeAuthProfile, s as normalizeCodexAppServerBindingModelProvider } from "./session-binding-DPxIvMgE.js";
-import { M as isCodexAppServerConnectionClosedError, R as resolveCodexAppServerClientInstanceId, V as consumeCodexAppServerLiveThread, ct as isJsonObject, d as retainSharedCodexAppServerClientByInstanceId, k as getCodexAppServerClientInstanceId, s as isCodexAppServerStartSelectionChangedError, st as flattenCodexDynamicToolFunctions, z as CodexAppServerRpcError } from "./shared-client-kIBbGjk4.js";
-import { a as closeCodexStartupClientBestEffort, c as isCodexAppServerUnsafeSubscriptionError, d as unsubscribeCodexThreadBestEffort, n as CODEX_APP_SERVER_UNSUBSCRIBE_TIMEOUT_MS, r as CodexAppServerUnsafeSubscriptionError } from "./attempt-client-cleanup-DMLXUfa8.js";
-import { a as assertCodexThreadStartResponse, r as assertCodexThreadForkResponse } from "./protocol-validators-B4F7L8Rf.js";
-import { a as serializeCodexAppInventoryError, i as defaultCodexAppInventoryCache, t as buildCodexAppServerConnectionFingerprint } from "./plugin-app-cache-key-C3H2CVp6.js";
-import { t as isIncognitoSessionKey } from "./incognito-session-ET_ufDH-.js";
-import { t as resumeCodexAppServerThread } from "./thread-resume-CPrJNQVM.js";
-import { u as projectBoundedCodexThreadHistory } from "./transcript-mirror-B9gGgnJS.js";
+import { E as resolveCodexPluginsPolicy, F as resolveCodexAppServerLocalHomeDir, M as CODEX_PLUGINS_WORKSPACE_MARKETPLACE_NAME, P as resolveCodexAppServerHomeDir, f as assertCodexModelBackedReviewerEffectiveConfig, j as CODEX_PLUGINS_MARKETPLACE_NAME, n as codexSandboxPolicyForTurn } from "./config-Cxw3Cl3k.js";
+import { $ as CodexAppServerRpcError, D as CodexThreadStartRequestError, E as CodexThreadBindingConflictError, H as getCodexAppServerClientInstanceId, Ht as isJsonObject, J as isCodexAppServerOverloadError, Q as resolveCodexAppServerClientInstanceId, St as releaseCodexAppServerLiveThread, T as CodexRestrictedToolSurfaceAttestationError, Vt as flattenCodexDynamicToolFunctions, _ as retainSharedCodexAppServerClientByInstanceId, bt as isCodexAppServerLiveThreadClaimed, dt as resolveCodexToolAbortTerminalReason, gt as consumeCodexAppServerLiveThread, n as captureExclusiveSharedCodexAppServerClient, w as CodexAdoptedThreadActiveError, wt as unsubscribeCodexAppServerLiveThread } from "./shared-client-kNkljY-R.js";
+import { a as hashCodexAppServerBindingFingerprint, c as reclaimCurrentCodexSessionGeneration, d as sessionBindingIdentity, i as createCodexSessionGenerationSupersededError, n as assertCodexBindingMayBeReplaced, o as isCodexAppServerNativeAuthProfile, s as normalizeCodexAppServerBindingModelProvider } from "./session-binding-q2WSTVmC.js";
+import { a as assertCodexThreadForkResponse, r as assertCodexThreadAcceptsDirectInput, s as assertCodexThreadStartResponse, t as CodexThreadDirectInputError } from "./protocol-validators-Bg5rpNxk.js";
+import { a as closeCodexStartupClientBestEffort, c as isCodexAppServerUnsafeSubscriptionError, f as unsubscribeCodexThreadBestEffort, n as CODEX_APP_SERVER_UNSUBSCRIBE_TIMEOUT_MS, r as CodexAppServerUnsafeSubscriptionError } from "./attempt-client-cleanup-CVPvp9dL.js";
+import { c as serializeCodexAppInventoryError, n as buildCodexAppServerConnectionFingerprint, s as defaultCodexAppInventoryCache, t as resumeCodexAppServerThread } from "./thread-resume-DF54hagX.js";
+import { c as withExclusiveCodexAppServerThread, l as isIncognitoSessionKey } from "./thread-ownership-CeYBqg_4.js";
+import { i as readCodexSessionMeta, n as codexCatalogHomeId } from "./session-catalog-home-id-DAKUrm3C.js";
+import { d as projectBoundedCodexThreadHistory } from "./transcript-mirror-CkEQIna-.js";
 import { r as sanitizeInlineImageDataUrl, t as invalidInlineImageText } from "./image-payload-sanitizer-CnfoUPCE.js";
 import { asOptionalRecord, isRecord, normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
 import fs from "node:fs/promises";
 import path from "node:path";
-import { SKILL_WORKSHOP_TOOL_NAME, TRANSCRIPT_CREDENTIAL_SAFETY_PROMPT, buildSkillWorkshopPromptSection, embeddedAgentLog, formatErrorMessage, isActiveHarnessContextEngine, isHostScopedAgentToolActive } from "openclaw/plugin-sdk/agent-harness-runtime";
+import { createDeferred } from "openclaw/plugin-sdk/extension-shared";
+import { addTimerTimeoutGraceMs, finiteSecondsToTimerSafeMilliseconds } from "openclaw/plugin-sdk/number-runtime";
+import { SKILL_WORKSHOP_TOOL_NAME, buildCredentialSafetyPrompt, buildDelegationGuidanceSection, buildHarnessVisibleReplyGuidance, buildSkillWorkshopPromptSection, embeddedAgentLog, formatErrorMessage, isActiveHarnessContextEngine, isHostScopedAgentToolActive, resolveMainSessionDelegationMode } from "openclaw/plugin-sdk/agent-harness-runtime";
 import * as crypto$1 from "node:crypto";
-import crypto from "node:crypto";
+import crypto, { createHash } from "node:crypto";
 import os from "node:os";
+import { isDeepStrictEqual } from "node:util";
+import { resolveAgentDir as resolveAgentDir$1 } from "openclaw/plugin-sdk/agent-runtime";
+import { resolveSessionAgentIdsStrict } from "openclaw/plugin-sdk/agent-scope-runtime";
+import { z } from "zod";
 import { coerceErrorMessage } from "openclaw/plugin-sdk/error-runtime";
 import { sliceUtf16Safe, truncateUtf16Safe } from "openclaw/plugin-sdk/text-utility-runtime";
+import { emitTrustedDiagnosticEvent } from "openclaw/plugin-sdk/diagnostic-runtime";
+import { expectDefined } from "openclaw/plugin-sdk/expect-runtime";
 import { redactSensitiveFieldValue, redactToolPayloadText } from "openclaw/plugin-sdk/logging-core";
+import { isPathInside } from "openclaw/plugin-sdk/file-access-runtime";
 import { resolveRequiredHomeDir, resolveStateDir } from "openclaw/plugin-sdk/state-paths";
 import { listRegisteredPluginAgentPromptGuidance } from "openclaw/plugin-sdk/plugin-runtime";
-import { buildCodexUserMcpServersThreadConfigPatchForRuntime } from "openclaw/plugin-sdk/codex-mcp-projection";
-import { isDiagnosticFlagEnabled } from "openclaw/plugin-sdk/diagnostic-runtime";
-import { GPT5_HEARTBEAT_PROMPT_OVERLAY } from "openclaw/plugin-sdk/provider-model-shared";
+import { buildHostnameAllowlistPolicyFromSuffixAllowlist } from "openclaw/plugin-sdk/ssrf-policy";
+import { buildCodexUserMcpServersThreadConfigPatchForRun } from "openclaw/plugin-sdk/codex-mcp-projection";
+import { registerRetainedNativeHookRelayForBundledRuntime } from "openclaw/plugin-sdk/native-hook-relay-runtime";
+import { isDiagnosticFlagEnabled } from "openclaw/plugin-sdk/diagnostic-flags";
 //#region extensions/codex/src/app-server/plugin-inventory.ts
 /**
 * Reads Codex plugin marketplace state and app inventory to decide which
@@ -264,15 +275,39 @@ function resolveOwnedApps(params) {
 			enabled: false,
 			needsAuth: true
 		};
-		return {
+		return Object.assign({
 			id: app.id,
 			name: app.name,
 			accessible: info.isAccessible,
 			enabled: info.isEnabled,
 			needsAuth: !info.isAccessible
-		};
+		}, resolveOwnedAppReadOnlyToolConfigKeys(info));
 	}).toSorted((left, right) => left.id.localeCompare(right.id));
 }
+/** Returns the config keys that Codex metadata proves belong to read-only tools. */
+function resolveOwnedAppReadOnlyToolConfigKeys(app) {
+	const appName = app.name.trim();
+	const appNameLower = appName.toLowerCase();
+	const tools = app.toolSummaries ?? [];
+	const writableToolConfigKeys = new Set(tools.filter((tool) => !tool.isReadOnly).flatMap((tool) => resolveAppToolConfigKeys({
+		appName,
+		appNameLower,
+		tool
+	})));
+	const keys = tools.filter((tool) => tool.isReadOnly).flatMap((tool) => resolveAppToolConfigKeys({
+		appName,
+		appNameLower,
+		tool
+	})).filter((key) => !writableToolConfigKeys.has(key));
+	return keys.length > 0 ? { readOnlyToolConfigKeys: Array.from(new Set(keys)).toSorted() } : {};
+}
+function resolveAppToolConfigKeys(params) {
+	const keys = [params.tool.name];
+	if (params.tool.title) keys.push(params.tool.title);
+	if (params.appName) keys.push(`${params.appName}_${params.tool.name}`);
+	if (params.appNameLower && params.appNameLower !== params.appName) keys.push(`${params.appNameLower}_${params.tool.name}`);
+	return keys;
+}
 function findPluginSummary(marketplace, pluginName) {
 	const exact = marketplace.plugins.find((plugin) => plugin.id === pluginName || plugin.id === `${pluginName}@${marketplace.name}`);
 	if (exact) return exact;
@@ -451,12 +486,21 @@ function activationFailure(identity, reason, diagnostic, extraDiagnostics = [])
 }
 //#endregion
 //#region extensions/codex/src/app-server/plugin-thread-app-admission.ts
+function resolveCodexPluginThreadAppCacheKey(params) {
+	return params.threadId ? `${params.appCacheKey}:thread:${encodeURIComponent(params.threadId)}` : params.appCacheKey;
+}
+function createCodexPluginThreadAppInventoryRequest(params) {
+	return async (method, requestParams) => await params.request(method, (method === "app/installed" || method === "app/read") && params.threadId ? {
+		...requestParams,
+		threadId: params.threadId
+	} : requestParams);
+}
 async function refreshCodexPluginAppInventory(params, appCache, options = {}) {
 	if (!params.appCacheKey) return;
-	const request = async (method, requestParams) => await params.request(method, requestParams);
+	const request = createCodexPluginThreadAppInventoryRequest(params);
 	try {
 		return await appCache.refreshNow({
-			key: params.appCacheKey,
+			key: resolveCodexPluginThreadAppCacheKey(params),
 			request,
 			nowMs: params.nowMs,
 			forceRefetch: options.forceRefetch,
@@ -493,9 +537,9 @@ function normalizeCodexPluginOwnerName(name) {
 	return name.trim().toLowerCase().replace(/[^a-z0-9]+/g, "");
 }
 async function readCodexThreadAdmissibleAccountApps(params, appCache) {
-	const request = async (method, requestParams) => await params.request(method, requestParams);
+	const request = createCodexPluginThreadAppInventoryRequest(params);
 	const cachedInventory = appCache.read({
-		key: params.appCacheKey,
+		key: resolveCodexPluginThreadAppCacheKey(params),
 		request,
 		nowMs: params.nowMs,
 		suppressRefresh: true
@@ -521,7 +565,8 @@ function toCodexPluginOwnedAccountApp(app) {
 		name: app.name,
 		accessible: app.isAccessible,
 		enabled: app.isEnabled,
-		needsAuth: !app.isAccessible
+		needsAuth: !app.isAccessible,
+		...resolveOwnedAppReadOnlyToolConfigKeys(app)
 	};
 }
 function resolveCodexThreadConfigAppsForRecord(params) {
@@ -610,6 +655,11 @@ function buildCodexPluginThreadConfigTimeoutFallback(params) {
 /** Builds the Codex apps config patch and policy context for a native thread. */
 async function buildCodexPluginThreadConfig(params) {
 	const appCache = params.appCache ?? defaultCodexAppInventoryCache;
+	const threadAppCacheKey = resolveCodexPluginThreadAppCacheKey(params);
+	const threadRequest = (method, requestParams) => params.request(method, (method === "app/installed" || method === "app/read") && params.threadId && isJsonObject(requestParams) ? {
+		...requestParams,
+		threadId: params.threadId
+	} : requestParams);
 	let inputFingerprint = buildCodexPluginThreadConfigInputFingerprint({
 		pluginConfig: params.pluginConfig,
 		appCacheKey: params.appCacheKey
@@ -623,9 +673,9 @@ async function buildCodexPluginThreadConfig(params) {
 	let inventory = policy.pluginPolicies.length > 0 ? await readCodexPluginInventory({
 		pluginConfig: params.pluginConfig,
 		policy,
-		request: params.request,
+		request: threadRequest,
 		appCache,
-		appCacheKey: params.appCacheKey,
+		appCacheKey: threadAppCacheKey,
 		configCwd: params.configCwd,
 		metadataCache: params.metadataCache,
 		nowMs: params.nowMs,
@@ -641,9 +691,9 @@ async function buildCodexPluginThreadConfig(params) {
 		inventory = await readCodexPluginInventory({
 			pluginConfig: params.pluginConfig,
 			policy,
-			request: params.request,
+			request: threadRequest,
 			appCache,
-			appCacheKey: params.appCacheKey,
+			appCacheKey: threadAppCacheKey,
 			configCwd: params.configCwd,
 			metadataCache: params.metadataCache,
 			nowMs: params.nowMs
@@ -659,9 +709,9 @@ async function buildCodexPluginThreadConfig(params) {
 		if (!record.activationRequired) continue;
 		const activation = await ensureCodexPluginActivation({
 			identity: record.policy,
-			request: params.request,
+			request: threadRequest,
 			appCache,
-			appCacheKey: params.appCacheKey,
+			appCacheKey: threadAppCacheKey,
 			configCwd: params.configCwd,
 			metadataCache: params.metadataCache,
 			deferAppInventoryRefresh: true,
@@ -685,9 +735,9 @@ async function buildCodexPluginThreadConfig(params) {
 		inventory = await readCodexPluginInventory({
 			pluginConfig: params.pluginConfig,
 			policy,
-			request: params.request,
+			request: threadRequest,
 			appCache,
-			appCacheKey: params.appCacheKey,
+			appCacheKey: threadAppCacheKey,
 			configCwd: params.configCwd,
 			metadataCache: params.metadataCache,
 			nowMs: params.nowMs
@@ -706,9 +756,9 @@ async function buildCodexPluginThreadConfig(params) {
 		inventory = await readCodexPluginInventory({
 			pluginConfig: params.pluginConfig,
 			policy,
-			request: params.request,
+			request: threadRequest,
 			appCache,
-			appCacheKey: params.appCacheKey,
+			appCacheKey: threadAppCacheKey,
 			configCwd: params.configCwd,
 			metadataCache: params.metadataCache,
 			nowMs: params.nowMs
@@ -946,7 +996,7 @@ function readPersistedAppToolApprovalOverrideNames(config, app) {
 	const appConfig = isJsonObject(appsRoot) ? appsRoot[app.id] : void 0;
 	const tools = isJsonObject(appConfig) ? appConfig.tools : void 0;
 	if (!isJsonObject(tools)) return [];
-	return Object.entries(tools).filter(([, value]) => hasPersistedToolApprovalOverride(value)).map(([toolName]) => toolName).toSorted();
+	return Object.entries(tools).filter(([toolName]) => !app.readOnlyToolConfigKeys?.includes(toolName)).filter(([, value]) => hasPersistedToolApprovalOverride(value)).map(([toolName]) => toolName).toSorted();
 }
 function hasPersistedToolApprovalOverride(value) {
 	return isJsonObject(value) && value.approval_mode !== void 0;
@@ -1063,6 +1113,32 @@ function resolveCodexContextEngineProjectionMaxChars(params) {
 function resolveCodexContextEngineProjectionReserveTokens() {
 	return DEFAULT_CODEX_PROJECTION_RESERVE_TOKENS;
 }
+const CONTINUITY_PROJECTION_RESERVE_RATIO = .5;
+const CONTINUITY_EMPIRICAL_CHARS_PER_TOKEN = 3;
+const CONTINUITY_MIN_CHARS_PER_TOKEN = .5;
+const CONTINUITY_MAX_CHARS_PER_TOKEN = CONTINUITY_EMPIRICAL_CHARS_PER_TOKEN;
+const CONTINUITY_CALIBRATION_MIN_PROMPT_CHARS = 5e4;
+/** Builds a calibration sample from a completed turn, or undefined if unusable. */
+function buildCodexContinuityCalibration(params) {
+	if (!Number.isFinite(params.promptChars) || !Number.isFinite(params.inputTokens) || params.promptChars < CONTINUITY_CALIBRATION_MIN_PROMPT_CHARS || params.inputTokens <= 0) return;
+	return {
+		promptChars: Math.floor(params.promptChars),
+		inputTokens: Math.floor(params.inputTokens)
+	};
+}
+function resolveContinuityCharsPerToken(calibration) {
+	if (!calibration || !Number.isFinite(calibration.promptChars) || !Number.isFinite(calibration.inputTokens) || calibration.promptChars < CONTINUITY_CALIBRATION_MIN_PROMPT_CHARS || calibration.inputTokens <= 0) return CONTINUITY_EMPIRICAL_CHARS_PER_TOKEN;
+	return Math.min(CONTINUITY_MAX_CHARS_PER_TOKEN, Math.max(CONTINUITY_MIN_CHARS_PER_TOKEN, calibration.promptChars / calibration.inputTokens));
+}
+/** Resolves rendered context size for no-engine continuity projections. */
+function resolveCodexContinuityProjectionMaxChars(params) {
+	const contextTokenBudget = typeof params.contextTokenBudget === "number" && Number.isFinite(params.contextTokenBudget) ? Math.floor(params.contextTokenBudget) : void 0;
+	if (!contextTokenBudget || contextTokenBudget <= 0) return DEFAULT_RENDERED_CONTEXT_CHARS;
+	return normalizeRenderedContextMaxChars(resolveProjectionPromptBudgetTokens({
+		contextTokenBudget,
+		reserveTokens: Math.max(DEFAULT_CODEX_PROJECTION_RESERVE_TOKENS, Math.floor(contextTokenBudget * CONTINUITY_PROJECTION_RESERVE_RATIO))
+	}) * resolveContinuityCharsPerToken(params.calibration));
+}
 /** Fits projected context prompts under Codex app-server turn/start text limits. */
 function fitCodexProjectedContextForTurnStart(params) {
 	const maxChars = typeof params.maxChars === "number" && Number.isFinite(params.maxChars) ? Math.max(0, Math.floor(params.maxChars)) : CODEX_TURN_START_TEXT_INPUT_MAX_CHARS;
@@ -1328,7 +1404,6 @@ const CODEX_APP_SERVER_OWNED_REPLACEABLE_TOOL_EXCLUDES = /* @__PURE__ */ new Set
 	"write",
 	"edit",
 	"apply_patch",
-	"update_plan",
 	...CODEX_NATIVE_GOAL_TOOL_EXCLUDES
 ]);
 const CODEX_APP_SERVER_OWNED_SHELL_TOOL_EXCLUDES = /* @__PURE__ */ new Set(["exec", "process"]);
@@ -1561,10 +1636,6 @@ const nativeSkillIsolationByClient = /* @__PURE__ */ new WeakMap();
 function isMissingPathError(error) {
 	return error.code === "ENOENT";
 }
-function isPathWithin(root, candidate) {
-	const relative = path.relative(path.resolve(root), path.resolve(candidate));
-	return relative === "" || !path.isAbsolute(relative) && !relative.startsWith(`..${path.sep}`) && relative !== "..";
-}
 async function canonicalizeExistingPath(candidate) {
 	try {
 		return await fs.realpath(candidate);
@@ -1590,12 +1661,12 @@ async function collectPersonalSkillRealPaths(homes, codexHome) {
 		const realDefaultCodexHome = await canonicalizeExistingPath(defaultCodexHome);
 		roots.push({
 			dir: path.join(defaultCodexHome, "skills"),
-			onlyEscapedStateTargets: isPathWithin(realStateDir, realDefaultCodexHome)
+			onlyEscapedStateTargets: isPathInside(realStateDir, realDefaultCodexHome)
 		});
 	}
 	const configuredCodexHome = codexHome?.trim() || process.env.CODEX_HOME?.trim();
 	if (configuredCodexHome) {
-		const stateOwned = isPathWithin(realStateDir, await canonicalizeExistingPath(configuredCodexHome));
+		const stateOwned = isPathInside(realStateDir, await canonicalizeExistingPath(configuredCodexHome));
 		roots.push({
 			dir: path.join(configuredCodexHome, "skills"),
 			onlyEscapedStateTargets: stateOwned
@@ -1613,7 +1684,7 @@ async function collectPersonalSkillRealPaths(homes, codexHome) {
 	const recordSkillFile = async (filePath, onlyEscapedStateTargets) => {
 		try {
 			const skillRealPath = await fs.realpath(filePath);
-			if (!onlyEscapedStateTargets || !isPathWithin(realStateDir, skillRealPath)) skillPaths.add(skillRealPath);
+			if (!onlyEscapedStateTargets || !isPathInside(realStateDir, skillRealPath)) skillPaths.add(skillRealPath);
 		} catch (error) {
 			if (!isMissingPathError(error)) complete = false;
 		}
@@ -1753,32 +1824,63 @@ function applyCodexNativeSkillIsolation(config, isolation) {
 	};
 }
 //#endregion
-//#region extensions/codex/src/app-server/thread-lifecycle-errors.ts
-var CodexThreadStartRequestError = class extends Error {
-	constructor(cause) {
-		super(formatErrorMessage(cause), { cause });
-		this.name = "CodexThreadStartRequestError";
-	}
-};
-var CodexThreadBindingConflictError = class extends Error {
-	constructor(threadId, operation) {
-		super(`Codex thread binding changed while ${operation}: ${threadId}`);
-		this.name = "CodexThreadBindingConflictError";
-	}
-};
-var CodexRestrictedToolSurfaceAttestationError = class extends Error {
-	constructor(cause) {
-		super("Codex restricted-tool-surface MCP attestation failed", { cause });
-		this.name = "CodexRestrictedToolSurfaceAttestationError";
-	}
-};
-var CodexThreadBindingConflictAfterCleanupError = class extends CodexThreadBindingConflictError {};
-var CodexAdoptedThreadActiveError = class extends Error {
-	constructor() {
-		super("Codex session became active in another runner; wait for it to finish before continuing");
-		this.name = "CodexAdoptedThreadActiveError";
+//#region extensions/codex/src/app-server/managed-thread-store.ts
+const CODEX_MANAGED_THREAD_NAMESPACE = "app-server-managed-threads";
+const CODEX_MANAGED_THREAD_MAX_ENTRIES = 2e4;
+const managedThreadSchema = z.object({
+	version: z.literal(1),
+	kind: z.literal("managed-thread"),
+	sourceHomeId: z.string().min(1),
+	threadId: z.string().min(1),
+	rolloutPath: z.string().min(1).optional()
+});
+async function markStartedCodexManagedThread(store, params) {
+	if (!store) return;
+	try {
+		await store.mark({
+			sourceHomeId: params.sourceHomeId,
+			threadId: params.threadId,
+			...params.rolloutPath ? { rolloutPath: params.rolloutPath } : {}
+		});
+	} catch (error) {
+		embeddedAgentLog.warn("failed to record Codex managed thread ownership", { error });
 	}
-};
+}
+function managedThreadStoreKey(sourceHomeId, threadId) {
+	return `sha256:${createHash("sha256").update("openclaw:codex-managed-thread:v1\0").update(sourceHomeId).update("\0").update(threadId).digest("hex")}`;
+}
+/** Durable ownership index for Codex threads created by OpenClaw. */
+function createCodexManagedThreadStore(state) {
+	return {
+		async mark(params) {
+			try {
+				const value = managedThreadSchema.parse({
+					version: 1,
+					kind: "managed-thread",
+					sourceHomeId: params.sourceHomeId.trim(),
+					threadId: params.threadId.trim(),
+					...params.rolloutPath?.trim() ? { rolloutPath: params.rolloutPath.trim() } : {}
+				});
+				state.registerIfAbsent(managedThreadStoreKey(value.sourceHomeId, value.threadId), value);
+				return true;
+			} catch (error) {
+				embeddedAgentLog.warn("failed to record Codex managed thread ownership", { error });
+				return false;
+			}
+		},
+		async snapshot() {
+			const byHome = /* @__PURE__ */ new Map();
+			for (const entry of state.entries()) {
+				const parsed = managedThreadSchema.safeParse(entry.value);
+				if (!parsed.success) continue;
+				const ids = byHome.get(parsed.data.sourceHomeId) ?? /* @__PURE__ */ new Set();
+				ids.add(parsed.data.threadId);
+				byHome.set(parsed.data.sourceHomeId, ids);
+			}
+			return byHome;
+		}
+	};
+}
 //#endregion
 //#region extensions/codex/src/app-server/plugin-thread-attestation.ts
 /**
@@ -1835,6 +1937,50 @@ async function discardUnattestedCodexPluginThread(params) {
 	}
 }
 //#endregion
+//#region extensions/codex/src/app-server/thread-lifecycle-result.ts
+/** Materializes the public lifecycle result after a fresh thread is durably committed. */
+function buildStartedCodexThreadBinding(input) {
+	const { context, params, response, startParams } = input;
+	return {
+		threadId: response.thread.id,
+		...input.clientId ? { clientId: input.clientId } : {},
+		cwd: params.cwd,
+		...input.rolloutPath ? { rolloutPath: input.rolloutPath } : {},
+		authProfileId: params.params.authProfileId,
+		agentWorkspaceDeveloperInstructions: params.agentWorkspaceDeveloperInstructions,
+		model: response.model ?? startParams.model ?? params.params.modelId,
+		modelProvider: response.modelProvider ?? input.startModelProvider ?? input.modelProvider,
+		dynamicToolsFingerprint: context.dynamicToolsFingerprint,
+		dynamicToolsContainDeferred: context.dynamicToolsContainDeferred,
+		nativeSkillIsolationFingerprint: context.nativeSkillIsolationFingerprint,
+		userMcpServersFingerprint: context.userMcpServersFingerprint,
+		mcpServersFingerprint: input.nextMcpServersFingerprint,
+		configuredMcpOwnershipVersion: params.configuredMcpOwnershipVersion,
+		ringZeroConfigFingerprint: context.ringZeroConfigFingerprint,
+		ringZeroClientInstanceId: context.ringZeroClientInstanceId,
+		networkProxyProfileName: params.appServer.networkProxy?.profileName,
+		networkProxyConfigFingerprint: context.networkProxyConfigFingerprint,
+		nativeHookRelayGeneration: input.finalConfigPatch.nativeHookRelayGeneration,
+		appServerRuntimeFingerprint: params.appServerRuntimeFingerprint,
+		pluginAppsFingerprint: input.pluginThreadConfig?.fingerprint,
+		pluginAppsInputFingerprint: input.pluginThreadConfig?.inputFingerprint,
+		pluginAppPolicyContext: input.pluginThreadConfig?.policyContext,
+		contextEngine: context.contextEngineBinding,
+		environmentSelectionFingerprint: context.environmentSelectionFingerprint,
+		...!context.preserveExistingBinding ? { liveThreadConfigFingerprint: fingerprintCodexThreadConfig({
+			...startParams,
+			model: response.model ?? startParams.model ?? null,
+			requestedModel: startParams.model ?? null,
+			modelProvider: input.bindingModelProvider ?? null,
+			requestedModelProvider: startParams.modelProvider ?? input.bindingModelProvider ?? null
+		}, params.params.authProfileId, context.dynamicToolsFingerprint) } : {},
+		lifecycle: {
+			action: "started",
+			...context.rotatedContextEngineBinding ? { rotatedContextEngineBinding: true } : {}
+		}
+	};
+}
+//#endregion
 //#region extensions/codex/src/app-server/reasoning-effort.ts
 const CODEX_REASONING_EFFORTS = [
 	"minimal",
@@ -1852,11 +1998,6 @@ const LEGACY_PRO_REASONING_EFFORTS = [
 ];
 const LEGACY_PRO_MODEL_ID_RE = /^gpt-5\.[45]-pro$/u;
 const MODERN_GPT_5_MODEL_ID_RE = /^gpt-5\.(?:[3-9]|[1-9]\d)(?:$|-)/u;
-function normalizeCodexReasoningEfforts(efforts) {
-	if (!efforts) return [];
-	const supported = new Set(efforts.map((effort) => effort.trim().toLowerCase()));
-	return CODEX_REASONING_EFFORTS.filter((effort) => supported.has(effort));
-}
 /** Read reasoning metadata after the Codex app-server route has been selected. */
 function readCodexSupportedReasoningEfforts(compat) {
 	if (!compat || typeof compat !== "object" || Array.isArray(compat)) return;
@@ -1865,7 +2006,8 @@ function readCodexSupportedReasoningEfforts(compat) {
 	return efforts.filter((effort) => typeof effort === "string");
 }
 function resolveSupportedReasoningEffort(params) {
-	const supported = normalizeCodexReasoningEfforts(params.supportedReasoningEfforts);
+	const declared = new Set(params.supportedReasoningEfforts.map((effort) => effort.trim().toLowerCase()));
+	const supported = CODEX_REASONING_EFFORTS.filter((effort) => declared.has(effort));
 	if (supported.includes(params.requested)) return params.requested;
 	const fallbackEfforts = params.requested === "ultra" ? supported : supported.filter((effort) => effort !== "ultra");
 	const requestedRank = CODEX_REASONING_EFFORTS.indexOf(params.requested);
@@ -1873,7 +2015,8 @@ function resolveSupportedReasoningEffort(params) {
 }
 /** Resolve a turn effort from the selected model's provider-owned metadata. */
 function resolveCodexAppServerReasoningEffort(params) {
-	if (params.thinkLevel === "off" || params.thinkLevel === "adaptive") return null;
+	if (params.thinkLevel === "off") return params.supportedReasoningEfforts?.includes("none") ? "none" : null;
+	if (params.thinkLevel === "adaptive") return null;
 	if (params.supportedReasoningEfforts) return resolveSupportedReasoningEffort({
 		requested: params.thinkLevel,
 		supportedReasoningEfforts: params.supportedReasoningEfforts
@@ -1963,12 +2106,22 @@ function resolveReasoningEffort(thinkLevel, modelId, supportedReasoningEfforts)
 	});
 }
 //#endregion
+//#region extensions/codex/src/app-server/project-doc-thread-config.ts
+const CODEX_NATIVE_PROJECT_DOC_MAX_BYTES = 128 * 1024;
+function buildCodexProjectDocThreadConfig(config) {
+	const defaults = { project_doc_max_bytes: CODEX_NATIVE_PROJECT_DOC_MAX_BYTES };
+	return mergeCodexThreadConfigs(defaults, config) ?? defaults;
+}
+//#endregion
 //#region extensions/codex/src/app-server/thread-prompt.ts
 function buildDeveloperInstructions(params, options = {}) {
 	const deferredToolNames = /* @__PURE__ */ new Set();
+	let secretsToolName;
 	let hasSkillWorkshop = false;
 	let hasSessionsSpawn = false;
 	let hasSessionsYield = false;
+	let hasSubagentsList = false;
+	let hasSessionsSend = false;
 	let hasSeenDirectNamespace = false;
 	let messageToolAvailable = options.dynamicTools ? false : params.disableMessageTool !== true;
 	for (const spec of options.dynamicTools ?? []) {
@@ -1977,9 +2130,12 @@ function buildDeveloperInstructions(params, options = {}) {
 		for (const tool of spec.type === "namespace" ? spec.tools : [spec]) {
 			const name = tool.name.trim();
 			if (tool.deferLoading === true && name) deferredToolNames.add(name);
+			if (name === "secrets" && params.disableTools !== true) secretsToolName ??= spec.type === "namespace" ? `${spec.name}.${name}` : name;
 			hasSkillWorkshop ||= name === SKILL_WORKSHOP_TOOL_NAME;
 			hasSessionsSpawn ||= name === "sessions_spawn";
 			hasSessionsYield ||= isDirectNamespace && name === "sessions_yield";
+			hasSubagentsList ||= name === "subagents";
+			hasSessionsSend ||= name === "sessions_send";
 			messageToolAvailable ||= name === "message";
 		}
 	}
@@ -1987,25 +2143,71 @@ function buildDeveloperInstructions(params, options = {}) {
 		surface: "codex_app_server",
 		includeLegacyGlobalGuidance: false
 	}).join("\n");
-	const nativeDelegationAvailable = params.disableTools !== true && params.delegationCapability !== "report_only" && !isMessageOnlyCodexSourceReply(params) && !isSystemAgentOnlyCodexDynamicToolAllowlist(params.toolsAllow) && !shouldDisableCodexToolSearchForModel(params.modelId);
+	const delegationGuidanceAvailable = params.disableTools !== true && params.delegationCapability !== "report_only" && !isMessageOnlyCodexSourceReply(params);
+	const nativeDelegationAvailable = delegationGuidanceAvailable && !isSystemAgentOnlyCodexDynamicToolAllowlist(params.toolsAllow) && !shouldDisableCodexToolSearchForModel(params.modelId);
 	const deferredToolDiscoveryGuidance = deferredToolNames.size > 0 || nativeDelegationAvailable ? "Deferred tools may be absent from the direct tool list. Use `tool_search` when directly callable. On code-mode-only models, use `exec` instead: filter `ALL_TOOLS` by name and description, then call the matching entry through `tools`." : void 0;
 	return [
 		"You are a personal agent running inside OpenClaw. OpenClaw has dynamic tools for OpenClaw-owned messaging, cron, sessions, media, gateway, and nodes.",
 		deferredToolNames.size > 0 ? `Deferred searchable OpenClaw dynamic tools available: ${[...deferredToolNames].toSorted((left, right) => left.localeCompare(right)).join(", ")}.` : void 0,
 		deferredToolDiscoveryGuidance,
 		hasSkillWorkshop ? buildSkillWorkshopPromptSection().join("\n") : void 0,
-		nativeDelegationAvailable ? `Use Codex native \`spawn_agent\` for Codex subagents. \`spawn_agent\` and the other native collaboration tools may be deferred.${hasSessionsSpawn ? " Use OpenClaw `sessions_spawn` only for OpenClaw or ACP delegation, never as a substitute for `spawn_agent`." : ""}` : void 0,
+		nativeDelegationAvailable ? `Use Codex native \`spawn_agent\` for Codex subagents. \`spawn_agent\` and the other native collaboration tools may be deferred.${hasSessionsSpawn ? " Use OpenClaw `sessions_spawn` only for OpenClaw or ACP delegation, never as a substitute for `spawn_agent` on internal legwork." : ""}` : void 0,
 		hasSessionsYield && nativeDelegationAvailable ? "When a native child's result belongs in a later turn, end the current turn with `openclaw_direct.sessions_yield`; the completion arrives as the next model-visible input. Use native `wait_agent` only for an intentional same-turn wait when the immediate next step is blocked on the child. Never loop-poll for native child completion." : void 0,
-		buildVisibleReplyInstruction(params, messageToolAvailable),
-		TRANSCRIPT_CREDENTIAL_SAFETY_PROMPT,
+		delegationGuidanceAvailable ? buildDelegationGuidanceSection({
+			mode: resolveMainSessionDelegationMode({
+				config: params.config,
+				agentId: params.agentId,
+				sessionKey: params.sessionKey
+			}),
+			isMinimal: params.promptMode === "minimal" || params.promptMode === "none",
+			hiddenDelegationTool: nativeDelegationAvailable ? "native `spawn_agent`" : hasSessionsSpawn ? "`sessions_spawn`" : "",
+			hasVisibleSessionSpawn: hasSessionsSpawn,
+			hasSessionsYield,
+			hasSubagentsList,
+			hasSessionsSend
+		}).join("\n") : void 0,
+		buildHarnessVisibleReplyGuidance({
+			sourceReplyDeliveryMode: params.sourceReplyDeliveryMode,
+			messageToolAvailable
+		}),
+		buildCredentialSafetyPrompt(secretsToolName),
 		nativeCommandGuidance,
 		params.extraSystemPrompt
 	].filter((section) => typeof section === "string" && section.trim()).join("\n\n");
 }
-function buildVisibleReplyInstruction(params, messageToolAvailable) {
-	if (params.sourceReplyDeliveryMode === "message_tool_only" && messageToolAvailable) return "Visible source replies are not automatically delivered for this run. Use `message(action=send)` for user-visible source-channel output. For progress, set `final=false`. Set `final=true`, or omit it, for the completed reply to the current source conversation; OpenClaw stops after confirming delivery. Do not repeat visible message content in your final answer.";
-	if (messageToolAvailable) return "For the current source conversation, reply normally in your final assistant message; OpenClaw will deliver it through the active source conversation. Use `message` for supported non-text actions in the current conversation, such as reacting to its current message. Reserve other `message` actions for explicit out-of-band sends or media/file delivery. Reactions are not delivered automatically.";
-	return "For the current source conversation, reply normally in your final assistant message; OpenClaw will deliver it through the active source conversation.";
+//#endregion
+//#region extensions/codex/src/app-server/thread-shell-environment.ts
+/** Applies host-selected values and any required login-shell restriction last. */
+function applyCodexManagedShellEnvironment(config, environment, disableLoginShell = false) {
+	if (!environment || Object.keys(environment).length === 0) return disableLoginShell ? {
+		...config,
+		allow_login_shell: false
+	} : config;
+	const current = isJsonObject(config.shell_environment_policy) ? config.shell_environment_policy : {};
+	const currentSet = isJsonObject(current.set) ? current.set : {};
+	const names = Object.keys(environment).toSorted();
+	const includeOnly = Array.isArray(current.include_only) ? current.include_only.filter((entry) => typeof entry === "string") : [];
+	const filters = isJsonObject(current.filters) ? current.filters : void 0;
+	const hasIncludeFilter = filters && Object.values(filters).includes("include");
+	const managedConfig = {
+		...config,
+		shell_environment_policy: {
+			...current,
+			experimental_use_profile: false,
+			set: {
+				...currentSet,
+				...environment
+			},
+			...filters ? hasIncludeFilter ? { filters: {
+				...filters,
+				...Object.fromEntries(names.map((name) => [name, "include"]))
+			} } : {} : includeOnly.length > 0 ? { include_only: [.../* @__PURE__ */ new Set([...includeOnly, ...names])] } : {}
+		}
+	};
+	return disableLoginShell ? {
+		...managedConfig,
+		allow_login_shell: false
+	} : managedConfig;
 }
 //#endregion
 //#region extensions/codex/src/app-server/web-search.ts
@@ -2068,20 +2270,23 @@ function resolveCodexWebSearchPlan(params) {
 	return {
 		kind: "native-hosted",
 		suppressManagedWebSearch: true,
-		threadConfig: buildCodexNativeWebSearchThreadConfig(params.config)
+		threadConfig: buildCodexNativeWebSearchThreadConfig(params.config),
+		webFetchHostnameAllowlist: buildHostnameAllowlistPolicyFromSuffixAllowlist(nativeConfig?.allowedDomains)?.hostnameAllowlist
 	};
 }
 const CODEX_CODE_MODE_THREAD_CONFIG = {
 	"features.code_mode": true,
 	"features.code_mode_only": false,
-	"features.apply_patch_streaming_events": true
+	"features.apply_patch_streaming_events": true,
+	suppress_unstable_features_warning: true
 };
 const CODEX_GOAL_CONTINUATION_DISABLED_THREAD_CONFIG = { "features.goals": false };
+const CODEX_NATIVE_UPDATE_PLAN_DISABLED_THREAD_CONFIG = { "tools.update_plan.enabled": false };
 const CODEX_CODE_MODE_DISABLED_THREAD_CONFIG = {
 	"features.code_mode": false,
 	"features.code_mode_only": false
 };
-const CODEX_LIGHTWEIGHT_CONTEXT_THREAD_CONFIG = { project_doc_max_bytes: 0 };
+const CODEX_NO_PROJECT_DOCS_CONFIG = { project_doc_max_bytes: 0 };
 const CODEX_TOOL_SEARCH_UNSUPPORTED_THREAD_CONFIG = { "features.multi_agent": false };
 const CODEX_DELEGATION_DISABLED_THREAD_CONFIG = {
 	"agents.enabled": false,
@@ -2127,7 +2332,6 @@ const CODEX_RING_ZERO_THREAD_CONFIG = {
 	"skills.bundled.enabled": false,
 	"skills.include_instructions": false,
 	"tools.experimental_request_user_input.enabled": false,
-	"tools.update_plan.enabled": false,
 	hooks: {
 		PreToolUse: [],
 		PermissionRequest: [],
@@ -2140,7 +2344,6 @@ const CODEX_RING_ZERO_THREAD_CONFIG = {
 		SubagentStop: [],
 		Stop: []
 	},
-	project_doc_max_bytes: 0,
 	notify: [],
 	web_search: "disabled"
 };
@@ -2153,6 +2356,7 @@ const CODEX_RING_ZERO_RESTRICTED_FEATURE_ALIASES = /* @__PURE__ */ new Map([
 	["codex_hooks", "hooks"]
 ]);
 const CODEX_RING_ZERO_OVERRIDABLE_LAYER_TYPES = /* @__PURE__ */ new Set([
+	"packagedDefaults",
 	"mdm",
 	"system",
 	"enterpriseManaged",
@@ -2181,6 +2385,7 @@ function buildThreadStartParams(params, options) {
 		model: modelSelection.model,
 		...modelSelection.modelProvider ? { modelProvider: modelSelection.modelProvider } : {},
 		cwd: options.cwd,
+		...options.appServer.sessionRoot ? { runtimeWorkspaceRoots: [options.appServer.sessionRoot] } : {},
 		approvalPolicy: options.appServer.approvalPolicy,
 		approvalsReviewer: resolveCodexThreadApprovalsReviewer(options.appServer, options.config),
 		...codexThreadSandboxOrPermissions(options.appServer),
@@ -2196,7 +2401,9 @@ function buildThreadStartParams(params, options) {
 			webSearchAllowed: options.webSearchAllowed,
 			appServer: options.appServer,
 			hostSystemAgentActive: options.hostSystemAgentActive,
-			restrictedToolSurfaceInheritedMcpServerNames: options.restrictedToolSurfaceInheritedMcpServerNames
+			restrictedToolSurfaceInheritedMcpServerNames: options.restrictedToolSurfaceInheritedMcpServerNames,
+			shellEnvironment: options.shellEnvironment,
+			disableLoginShell: options.disableLoginShell
 		}),
 		...resolveCodexThreadEnvironmentSelection(options),
 		developerInstructions: options.developerInstructions ?? buildDeveloperInstructions(params, { dynamicTools: options.dynamicTools }),
@@ -2222,6 +2429,8 @@ function buildThreadResumeParams(params, options) {
 	});
 	return {
 		threadId: options.threadId,
+		...options.cwd ? { cwd: options.cwd } : {},
+		...options.appServer.sessionRoot ? { runtimeWorkspaceRoots: [options.appServer.sessionRoot] } : {},
 		excludeTurns: true,
 		initialTurnsPage: {
 			limit: 1,
@@ -2245,38 +2454,38 @@ function buildThreadResumeParams(params, options) {
 			webSearchAllowed: options.webSearchAllowed,
 			appServer: options.appServer,
 			hostSystemAgentActive: options.hostSystemAgentActive,
-			restrictedToolSurfaceInheritedMcpServerNames: options.restrictedToolSurfaceInheritedMcpServerNames
+			restrictedToolSurfaceInheritedMcpServerNames: options.restrictedToolSurfaceInheritedMcpServerNames,
+			shellEnvironment: options.shellEnvironment,
+			disableLoginShell: options.disableLoginShell
 		}),
 		developerInstructions: options.developerInstructions ?? buildDeveloperInstructions(params, { dynamicTools: options.dynamicTools })
 	};
 }
 function buildCodexRuntimeThreadConfig(config, options = {}) {
+	const configured = buildCodexProjectDocThreadConfig(config);
 	const codeModeConfig = {
 		...CODEX_CODE_MODE_THREAD_CONFIG,
 		"features.code_mode_only": options.nativeCodeModeOnlyEnabled === true
 	};
 	if (options.nativeCodeModeEnabled === false) {
-		const disabledConfig = mergeCodexThreadConfigs(config, CODEX_CODE_MODE_DISABLED_THREAD_CONFIG, CODEX_GOAL_CONTINUATION_DISABLED_THREAD_CONFIG) ?? { ...CODEX_CODE_MODE_DISABLED_THREAD_CONFIG };
+		const disabledConfig = expectDefined(mergeCodexThreadConfigs(configured, CODEX_CODE_MODE_DISABLED_THREAD_CONFIG, CODEX_GOAL_CONTINUATION_DISABLED_THREAD_CONFIG, CODEX_NATIVE_UPDATE_PLAN_DISABLED_THREAD_CONFIG), "Codex disabled code mode config");
 		delete disabledConfig["features.apply_patch_streaming_events"];
 		return disabledConfig;
 	}
-	if (options.nativeCodeModeOnlyEnabled === true) return ensureDirectOnlyToolNamespaces(mergeCodexThreadConfigs(codeModeConfig, config, CODEX_GOAL_CONTINUATION_DISABLED_THREAD_CONFIG, { "features.code_mode_only": true }) ?? {
-		...codeModeConfig,
-		...CODEX_GOAL_CONTINUATION_DISABLED_THREAD_CONFIG,
-		"features.code_mode_only": true
-	}, options.directOnlyToolNamespaces);
-	return ensureDirectOnlyToolNamespaces(mergeCodexThreadConfigs(codeModeConfig, config, CODEX_GOAL_CONTINUATION_DISABLED_THREAD_CONFIG) ?? {
-		...codeModeConfig,
-		...CODEX_GOAL_CONTINUATION_DISABLED_THREAD_CONFIG
-	}, options.directOnlyToolNamespaces);
+	if (options.nativeCodeModeOnlyEnabled === true) return ensureDirectOnlyToolNamespaces(expectDefined(mergeCodexThreadConfigs(codeModeConfig, configured, CODEX_GOAL_CONTINUATION_DISABLED_THREAD_CONFIG, CODEX_NATIVE_UPDATE_PLAN_DISABLED_THREAD_CONFIG, { "features.code_mode_only": true }), "Codex code mode only config"), options.directOnlyToolNamespaces);
+	return ensureDirectOnlyToolNamespaces(expectDefined(mergeCodexThreadConfigs(codeModeConfig, configured, CODEX_GOAL_CONTINUATION_DISABLED_THREAD_CONFIG, CODEX_NATIVE_UPDATE_PLAN_DISABLED_THREAD_CONFIG), "Codex code mode config"), options.directOnlyToolNamespaces);
 }
 function ensureDirectOnlyToolNamespaces(config, requiredNamespaces) {
 	if (!requiredNamespaces?.length) return config;
-	const configured = config["code_mode.direct_only_tool_namespaces"];
-	const namespaces = Array.isArray(configured) ? configured.filter((entry) => typeof entry === "string" && entry.length > 0) : [];
+	const feature = expectDefined(config["features.code_mode"], "Codex code mode config");
+	const configured = isJsonObject(feature) ? feature : { enabled: feature };
+	const namespaces = Array.isArray(configured.direct_only_tool_namespaces) ? configured.direct_only_tool_namespaces.filter((entry) => typeof entry === "string" && entry.length > 0) : [];
 	return {
 		...config,
-		"code_mode.direct_only_tool_namespaces": [.../* @__PURE__ */ new Set([...namespaces, ...requiredNamespaces])]
+		"features.code_mode": {
+			...configured,
+			direct_only_tool_namespaces: [.../* @__PURE__ */ new Set([...namespaces, ...requiredNamespaces])]
+		}
 	};
 }
 function resolveDirectOnlyToolNamespaces(dynamicTools) {
@@ -2286,13 +2495,10 @@ function buildCodexRuntimeThreadConfigForRun(params, config, options = {}) {
 	const ringZeroActive = (options.hostSystemAgentActive ?? isHostScopedAgentToolActive("openclaw")) && isSystemAgentOnlyCodexDynamicToolAllowlist(params.toolsAllow);
 	const messageOnlySourceReply = isMessageOnlyCodexSourceReply(params);
 	const restrictedToolSurface = ringZeroActive || messageOnlySourceReply || params.pluginHarnessToolPolicyRestricted === true;
+	const restrictedTurnDisablesProjectDocs = ringZeroActive || messageOnlySourceReply || params.pluginHarnessToolPolicyRestricted && params.disableTools;
 	const configMcpServers = config?.mcp_servers;
 	if (restrictedToolSurface && configMcpServers !== void 0 && !isJsonObject(configMcpServers)) throw new Error("Codex restricted tool surface received invalid thread mcp_servers config");
 	const restrictedToolSurfaceMcpServerNames = [...options.restrictedToolSurfaceInheritedMcpServerNames ?? [], ...isJsonObject(configMcpServers) ? Object.keys(configMcpServers) : []];
-	const restrictedRunConfig = restrictedToolSurface && isJsonObject(configMcpServers) ? {
-		...config,
-		mcp_servers: {}
-	} : config;
 	const webSearchConfig = resolveCodexWebSearchPlan({
 		config: params.config,
 		disableTools: params.disableTools,
@@ -2300,19 +2506,20 @@ function buildCodexRuntimeThreadConfigForRun(params, config, options = {}) {
 		nativeProviderWebSearchSupport: options.nativeProviderWebSearchSupport,
 		webSearchAllowed: options.webSearchAllowed
 	}).threadConfig;
-	const baseConfig = buildCodexRuntimeThreadConfig(mergeCodexThreadConfigs(restrictedRunConfig, webSearchConfig), options);
-	const runtimeConfig = mergeCodexThreadConfigs(baseConfig, options.appServer?.networkProxy?.configPatch, shouldDisableCodexToolSearchForModel(params.modelId) ? CODEX_TOOL_SEARCH_UNSUPPORTED_THREAD_CONFIG : void 0, params.delegationCapability === "report_only" ? CODEX_DELEGATION_DISABLED_THREAD_CONFIG : void 0, messageOnlySourceReply || params.pluginHarnessToolPolicyRestricted === true ? buildCodexRestrictedToolThreadConfigPatch(restrictedToolSurfaceMcpServerNames) : buildCodexRingZeroThreadConfigPatch(params, options.hostSystemAgentActive, restrictedToolSurfaceMcpServerNames)) ?? baseConfig;
-	if (params.bootstrapContextMode !== "lightweight") return runtimeConfig;
-	return mergeCodexThreadConfigs(runtimeConfig, CODEX_LIGHTWEIGHT_CONTEXT_THREAD_CONFIG) ?? {
-		...runtimeConfig,
-		...CODEX_LIGHTWEIGHT_CONTEXT_THREAD_CONFIG
-	};
+	const baseConfig = buildCodexRuntimeThreadConfig(mergeCodexThreadConfigs(config, webSearchConfig), options);
+	return applyCodexManagedShellEnvironment({
+		...mergeCodexThreadConfigs(baseConfig, options.appServer?.networkProxy?.configPatch, params.pluginHarnessToolPolicySafeDeniedTools?.includes("image_generate") ? { "features.image_generation": false } : void 0, shouldDisableCodexToolSearchForModel(params.modelId) ? CODEX_TOOL_SEARCH_UNSUPPORTED_THREAD_CONFIG : void 0, params.delegationCapability === "report_only" ? CODEX_DELEGATION_DISABLED_THREAD_CONFIG : void 0, messageOnlySourceReply || params.pluginHarnessToolPolicyRestricted === true ? buildRestrictedToolConfigPatch(restrictedToolSurfaceMcpServerNames) : buildCodexRingZeroThreadConfigPatch(params, options.hostSystemAgentActive, restrictedToolSurfaceMcpServerNames), restrictedTurnDisablesProjectDocs ? CODEX_NO_PROJECT_DOCS_CONFIG : void 0, params.authoredContextTokenCap === void 0 ? void 0 : { model_context_window: params.authoredContextTokenCap }) ?? baseConfig,
+		...params.bootstrapContextMode === "lightweight" ? CODEX_NO_PROJECT_DOCS_CONFIG : {}
+	}, options.shellEnvironment, options.disableLoginShell);
 }
 function buildCodexRingZeroThreadConfigPatch(params, hostSystemAgentActive = isHostScopedAgentToolActive("openclaw"), inheritedMcpServerNames = []) {
 	if (!hostSystemAgentActive || !isSystemAgentOnlyCodexDynamicToolAllowlist(params.toolsAllow)) return;
-	return buildCodexRestrictedToolThreadConfigPatch(inheritedMcpServerNames);
+	return {
+		...buildRestrictedToolConfigPatch(inheritedMcpServerNames),
+		...CODEX_NO_PROJECT_DOCS_CONFIG
+	};
 }
-function buildCodexRestrictedToolThreadConfigPatch(inheritedMcpServerNames) {
+function buildRestrictedToolConfigPatch(inheritedMcpServerNames) {
 	const mcpServers = Object.fromEntries([...new Set(inheritedMcpServerNames)].toSorted().map((name) => [name, { enabled: false }]));
 	return {
 		...CODEX_RING_ZERO_THREAD_CONFIG,
@@ -2336,12 +2543,12 @@ async function readCodexInheritedMcpServerNames(client, cwd, signal) {
 	if (!isJsonObject(configuredServers)) throw new Error("Codex config/read returned invalid mcp_servers");
 	return Object.keys(configuredServers).toSorted();
 }
-async function assertCodexRestrictedToolSurfaceHasNoManagedHooks(client, signal) {
+async function assertCodexManagedRequirementsDoNotOverrideToolPolicy(client, options, signal) {
 	const response = await client.request("configRequirements/read", void 0, { signal });
 	if (!isJsonObject(response) || !Object.hasOwn(response, "requirements")) throw new Error("Codex configRequirements/read returned an invalid response");
 	if (response.requirements === null) return;
 	if (!isJsonObject(response.requirements)) throw new Error("Codex configRequirements/read returned invalid requirements");
-	for (const key of [
+	if (options.restrictedToolSurface) for (const key of [
 		"hooks",
 		"managedHooks",
 		"managed_hooks"
@@ -2351,6 +2558,7 @@ async function assertCodexRestrictedToolSurfaceHasNoManagedHooks(client, signal)
 		if (!isJsonObject(hooks)) throw new Error("Codex configRequirements/read returned invalid managed hooks");
 		if (hasNonEmptyJsonValue(hooks)) throw new Error("Codex restricted tool surface cannot override managed hooks");
 	}
+	const additionalDeniedFeatures = new Set(options.additionalDeniedFeatures);
 	for (const key of ["featureRequirements", "feature_requirements"]) {
 		const requirements = response.requirements[key];
 		if (requirements === void 0 || requirements === null) continue;
@@ -2358,7 +2566,8 @@ async function assertCodexRestrictedToolSurfaceHasNoManagedHooks(client, signal)
 		for (const [feature, enabled] of Object.entries(requirements)) {
 			if (typeof enabled !== "boolean") throw new Error("Codex configRequirements/read returned invalid feature requirements");
 			const canonicalFeature = CODEX_RING_ZERO_RESTRICTED_FEATURE_ALIASES.get(feature) ?? feature;
-			if (enabled && CODEX_RING_ZERO_RESTRICTED_FEATURES.has(canonicalFeature)) throw new Error(`Codex restricted tool surface cannot override required feature ${feature}`);
+			const deniedByToolPolicy = options.restrictedToolSurface && CODEX_RING_ZERO_RESTRICTED_FEATURES.has(canonicalFeature) || additionalDeniedFeatures.has(canonicalFeature);
+			if (enabled && deniedByToolPolicy) throw new Error(`Codex tool policy cannot override required feature ${feature}`);
 		}
 	}
 }
@@ -2408,6 +2617,14 @@ function resolveCodexThreadEnvironmentSelection(options) {
 }
 //#endregion
 //#region extensions/codex/src/app-server/thread-lifecycle-io.ts
+function resolveCodexThreadAgentDir(params) {
+	const agentId = resolveSessionAgentIdsStrict({
+		config: params.params.config,
+		sessionKey: params.params.sessionKey,
+		agentId: params.agentId ?? params.params.agentId
+	}).sessionAgentId;
+	return params.agentDir ?? params.params.agentDir ?? resolveAgentDir$1(params.params.config ?? {}, agentId);
+}
 function resolveCodexThreadRolloutPath(thread) {
 	const rolloutPath = thread.path?.trim();
 	if (!rolloutPath || !path.isAbsolute(rolloutPath) || path.extname(rolloutPath) !== ".jsonl" || !path.basename(rolloutPath).includes(thread.id)) return;
@@ -2416,6 +2633,8 @@ function resolveCodexThreadRolloutPath(thread) {
 async function resumeExistingCodexThread(params, context) {
 	const { binding: resumeBinding, bindingIdentity, startModelSelection, startModelProvider, userMcpServersConfigPatch, dynamicToolsFingerprint, dynamicToolsContainDeferred, webSearchThreadConfigFingerprint, nativeSkillIsolationFingerprint, userMcpServersFingerprint, ringZeroConfigFingerprint, ringZeroClientInstanceId, networkProxyConfigFingerprint, contextEngineBinding, environmentSelectionFingerprint, hostSystemAgentActive, ringZeroActive, restrictedToolSurface, restrictedToolSurfaceInheritedMcpServerNames, nativeSkillIsolation, lifecycleTiming, normalizeBindingModelProvider, throwIfAborted, clearCurrentBinding } = context;
 	let resumeReservation;
+	let resumeResponseAccepted = false;
+	const abandonClient = params.abandonClient ?? (() => closeCodexStartupClientBestEffort(params.client));
 	try {
 		const authProfileId = resumeBinding.connectionScope === "supervision" ? void 0 : params.params.authProfileId ?? resumeBinding.authProfileId;
 		const finalConfigPatch = context.prebuiltFinalConfigPatch ?? params.buildFinalConfigPatch?.({
@@ -2429,6 +2648,7 @@ async function resumeExistingCodexThread(params, context) {
 		const resumeConfig = applyCodexNativeSkillIsolation(mergeCodexThreadConfigs(params.config, userMcpServersConfigPatch, pluginAppsConfigPatch, finalConfigPatch.configPatch), nativeSkillIsolation);
 		const resumeParams = lifecycleTiming.measureSync("thread-resume-params", () => buildThreadResumeParams(params.params, {
 			threadId: resumeBinding.threadId,
+			cwd: params.cwd,
 			authProfileId,
 			model: startModelSelection.model,
 			modelProvider: startModelProvider,
@@ -2442,29 +2662,35 @@ async function resumeExistingCodexThread(params, context) {
 			nativeCodeModeOnlyEnabled: params.nativeCodeModeOnlyEnabled,
 			webSearchAllowed: params.webSearchAllowed,
 			hostSystemAgentActive,
-			restrictedToolSurfaceInheritedMcpServerNames
+			restrictedToolSurfaceInheritedMcpServerNames,
+			shellEnvironment: params.shellEnvironment,
+			disableLoginShell: params.disableLoginShell
 		}));
 		const requestModelProvider = typeof resumeParams.modelProvider === "string" && resumeParams.modelProvider.trim() ? resumeParams.modelProvider : void 0;
 		throwIfAborted();
-		if (resumeBinding.preserveNativeModel === true) {
-			const current = await lifecycleTiming.measure("thread-read-adoption-status", () => params.client.request("thread/read", {
-				threadId: resumeBinding.threadId,
-				includeTurns: false
-			}, { signal: params.signal }));
-			throwIfAborted();
-			if (current.thread.status?.type === "active") throw new CodexAdoptedThreadActiveError();
-		}
 		resumeReservation = params.reserveResumeThread?.(resumeBinding.threadId);
 		const response = await lifecycleTiming.measure("thread-resume-request", () => resumeCodexAppServerThread({
 			client: params.client,
-			abandonClient: params.abandonClient ?? (() => closeCodexStartupClientBestEffort(params.client)),
+			abandonClient,
 			request: resumeParams,
-			signal: params.signal
+			signal: params.signal,
+			assertCurrent: context.assertResumeOwnership,
+			isPrewriteOwnershipError: (error) => error instanceof CodexAdoptedThreadActiveError
 		}));
+		resumeResponseAccepted = true;
+		assertCodexThreadAcceptsDirectInput(response.thread);
+		context.assertResumeConfiguration?.();
+		if (resumeBinding.pendingResumeConfiguration) await attestCodexPluginThreadApps({
+			client: params.client,
+			threadId: response.thread.id,
+			appIds: context.prebuiltPluginThreadConfig?.provisionalAppIds ?? [],
+			signal: params.signal
+		});
 		if (ringZeroActive || isMessageOnlyCodexSourceReply(params.params) || params.params.pluginHarnessToolPolicyRestricted === true) try {
 			await lifecycleTiming.measure("restricted-tool-surface-mcp-attestation", () => attestCodexRestrictedToolSurfaceMcpServersDisabled(params.client, response.thread.id, resumeParams.config, params.signal));
 		} catch (error) {
-			await (params.abandonClient ?? (() => closeCodexStartupClientBestEffort(params.client)))();
+			context.assertResumeOwnership?.();
+			await abandonClient();
 			throw new CodexRestrictedToolSurfaceAttestationError(error);
 		}
 		throwIfAborted();
@@ -2472,6 +2698,7 @@ async function resumeExistingCodexThread(params, context) {
 		const nextMcpServersFingerprint = params.mcpServersFingerprintEvaluated === true ? params.mcpServersFingerprint : resumeBinding.mcpServersFingerprint;
 		const resumePatch = {
 			clientId: resolveCodexAppServerClientInstanceId(params.client),
+			pendingResumeConfiguration: void 0,
 			cwd: params.cwd,
 			rolloutPath: resolveCodexThreadRolloutPath(response.thread) ?? resumeBinding.rolloutPath,
 			authProfileId: boundAuthProfileId,
@@ -2502,7 +2729,7 @@ async function resumeExistingCodexThread(params, context) {
 			kind: "patch",
 			threadId: resumeBinding.threadId,
 			patch: resumePatch
-		}))) throw new CodexThreadBindingConflictError(resumeBinding.threadId, "committing a resumed thread");
+		}, context.assertResumeConfiguration))) throw new CodexThreadBindingConflictError(resumeBinding.threadId, "committing a resumed thread");
 		if (contextEngineBinding) embeddedAgentLog.info("codex app-server wrote context-engine thread binding", {
 			sessionId: params.params.sessionId,
 			sessionKey: params.params.sessionKey,
@@ -2539,19 +2766,26 @@ async function resumeExistingCodexThread(params, context) {
 		};
 	} catch (error) {
 		resumeReservation?.release();
-		if (isCodexAppServerStartSelectionChangedError(error)) throw error;
+		if (!resumeResponseAccepted && (!(error instanceof CodexAppServerRpcError) || isCodexAppServerOverloadError(error))) throw error;
 		if (error instanceof CodexRestrictedToolSurfaceAttestationError) {
-			await clearCurrentBinding("retiring a failed restricted-tool-surface attestation");
+			if (!resumeBinding.pendingResumeConfiguration) await clearCurrentBinding("retiring a failed restricted-tool-surface attestation");
 			throw error;
 		}
-		if (error instanceof CodexAdoptedThreadActiveError) throw error;
-		if (isCodexAppServerUnsafeSubscriptionError(error)) throw error;
-		const resumeRejected = error instanceof CodexAppServerRpcError;
-		if (!await unsubscribeCodexThreadBestEffort(params.client, {
-			threadId: resumeBinding.threadId,
-			timeoutMs: 5e3
-		}) && !resumeRejected && !isCodexAppServerConnectionClosedError(error) && !params.signal?.aborted) throw new CodexAppServerUnsafeSubscriptionError("Codex thread/resume subscription cleanup failed", { cause: error });
-		if (isCodexAppServerConnectionClosedError(error) || params.signal?.aborted) throw error;
+		if (resumeResponseAccepted) {
+			if (!await unsubscribeCodexThreadBestEffort(params.client, {
+				threadId: resumeBinding.threadId,
+				timeoutMs: 5e3,
+				assertCurrent: context.assertResumeOwnership
+			}).catch(() => false)) {
+				try {
+					await abandonClient();
+				} catch (abandonError) {
+					throw new CodexAppServerUnsafeSubscriptionError("Codex thread/resume client could not be retired", { cause: abandonError });
+				}
+				throw new CodexAppServerUnsafeSubscriptionError("Codex thread/resume subscription cleanup failed", { cause: error });
+			}
+		}
+		if (resumeBinding.pendingResumeConfiguration || error instanceof CodexThreadDirectInputError || params.signal?.aborted) throw error;
 		embeddedAgentLog.warn("codex app-server thread resume failed; starting a new thread", { error });
 		await clearCurrentBinding("rotating a stale thread binding");
 	}
@@ -2579,7 +2813,9 @@ async function startFreshCodexThread(params, context) {
 		model: startModelSelection.model,
 		modelProvider: startModelProvider,
 		hostSystemAgentActive,
-		restrictedToolSurfaceInheritedMcpServerNames
+		restrictedToolSurfaceInheritedMcpServerNames,
+		shellEnvironment: params.shellEnvironment,
+		disableLoginShell: params.disableLoginShell
 	}));
 	const requestModelProvider = typeof startParams.modelProvider === "string" && startParams.modelProvider.trim() ? startParams.modelProvider : void 0;
 	const response = assertCodexThreadStartResponse(await lifecycleTiming.measure("thread-start-request", async () => {
@@ -2647,6 +2883,7 @@ async function startFreshCodexThread(params, context) {
 			cwd: params.cwd,
 			...rolloutPath ? { rolloutPath } : {},
 			authProfileId: params.params.authProfileId,
+			agentWorkspaceDeveloperInstructions: params.agentWorkspaceDeveloperInstructions,
 			model: response.model ?? startParams.model ?? params.params.modelId,
 			modelProvider: bindingModelProvider,
 			dynamicToolsFingerprint,
@@ -2679,6 +2916,12 @@ async function startFreshCodexThread(params, context) {
 				throw new CodexAppServerUnsafeSubscriptionError("Codex successor cleanup failed after a binding replacement conflict", cause === void 0 ? void 0 : { cause });
 			}
 		};
+		const managedSourceHomeId = codexCatalogHomeId(resolveCodexAppServerLocalHomeDir(params.appServer.start, resolveCodexThreadAgentDir(params)));
+		await lifecycleTiming.measure("thread-start-mark-managed", () => markStartedCodexManagedThread(params.bindingStore.managedThreads, {
+			sourceHomeId: managedSourceHomeId,
+			threadId: response.thread.id,
+			...rolloutPath ? { rolloutPath } : {}
+		}));
 		let committed;
 		try {
 			committed = await lifecycleTiming.measure("thread-start-write-binding", () => params.bindingStore.mutate(bindingIdentity, replacementPredecessor ? {
@@ -2716,241 +2959,54 @@ async function startFreshCodexThread(params, context) {
 		threadId: response.thread.id,
 		action: rotatedContextEngineBinding ? "rotated" : "started"
 	});
-	return {
-		threadId: response.thread.id,
-		...clientId ? { clientId } : {},
-		cwd: params.cwd,
-		...rolloutPath ? { rolloutPath } : {},
-		authProfileId: params.params.authProfileId,
-		model: response.model ?? startParams.model ?? params.params.modelId,
-		modelProvider: response.modelProvider ?? requestModelProvider ?? startModelProvider ?? modelProvider,
-		dynamicToolsFingerprint,
-		dynamicToolsContainDeferred,
-		nativeSkillIsolationFingerprint,
-		userMcpServersFingerprint,
-		mcpServersFingerprint: nextMcpServersFingerprint,
-		configuredMcpOwnershipVersion: params.configuredMcpOwnershipVersion,
-		ringZeroConfigFingerprint,
-		ringZeroClientInstanceId,
-		networkProxyProfileName: params.appServer.networkProxy?.profileName,
-		networkProxyConfigFingerprint,
-		nativeHookRelayGeneration: finalConfigPatch.nativeHookRelayGeneration,
-		appServerRuntimeFingerprint: params.appServerRuntimeFingerprint,
-		pluginAppsFingerprint: pluginThreadConfig?.fingerprint,
-		pluginAppsInputFingerprint: pluginThreadConfig?.inputFingerprint,
-		pluginAppPolicyContext: pluginThreadConfig?.policyContext,
-		contextEngine: contextEngineBinding,
-		environmentSelectionFingerprint,
-		...!preserveExistingBinding ? { liveThreadConfigFingerprint: fingerprintCodexThreadConfig({
-			...startParams,
-			model: response.model ?? startParams.model ?? null,
-			requestedModel: startParams.model ?? null,
-			modelProvider: bindingModelProvider ?? null,
-			requestedModelProvider: startParams.modelProvider ?? bindingModelProvider ?? null
-		}, params.params.authProfileId, dynamicToolsFingerprint) } : {},
-		lifecycle: {
-			action: "started",
-			...rotatedContextEngineBinding ? { rotatedContextEngineBinding } : {}
-		}
-	};
+	return buildStartedCodexThreadBinding({
+		bindingModelProvider,
+		clientId,
+		context,
+		finalConfigPatch,
+		nextMcpServersFingerprint,
+		params,
+		pluginThreadConfig,
+		response,
+		rolloutPath,
+		startModelProvider: requestModelProvider ?? startModelProvider,
+		startParams,
+		modelProvider
+	});
 }
 //#endregion
-//#region extensions/codex/src/app-server/profiler-flag.ts
-const PROFILER_FLAGS = ["profiler", "codex.profiler"];
-/** Checks the generic and Codex-specific profiler diagnostic flags. */
-function isCodexAppServerProfilerEnabled(config, env = process.env) {
-	return PROFILER_FLAGS.some((flag) => isDiagnosticFlagEnabled(flag, config, env));
+//#region extensions/codex/src/app-server/thread-lifecycle-warm.ts
+/** Preserves the caller's abort reason across thread ownership transitions. */
+function throwIfCodexThreadLifecycleAborted(signal) {
+	if (!signal?.aborted) return;
+	const reason = signal.reason;
+	if (reason instanceof Error) throw reason;
+	const error = new Error(typeof reason === "string" && reason.length > 0 ? reason : "codex app-server thread lifecycle aborted");
+	error.name = "AbortError";
+	throw error;
 }
-//#endregion
-//#region extensions/codex/src/app-server/thread-lifecycle-timing.ts
-const CODEX_THREAD_LIFECYCLE_TIMING_WARN_TOTAL_MS = 1e3;
-const CODEX_THREAD_LIFECYCLE_TIMING_WARN_STAGE_MS = 500;
-function shouldWarnCodexThreadLifecycleTimingSummary(summary, options = {}) {
-	const totalThresholdMs = options.totalThresholdMs ?? CODEX_THREAD_LIFECYCLE_TIMING_WARN_TOTAL_MS;
-	const stageThresholdMs = options.stageThresholdMs ?? CODEX_THREAD_LIFECYCLE_TIMING_WARN_STAGE_MS;
-	return summary.totalMs >= totalThresholdMs || summary.spans.some((span) => span.durationMs >= stageThresholdMs);
+/** Releases consumed subscription ownership or retires an unsafe client. */
+async function releaseCodexConsumedLiveThread(options) {
+	if (await options.lifecycleTiming.measure("retained-thread-unsubscribe", () => unsubscribeCodexThreadBestEffort(options.client, {
+		threadId: options.threadId,
+		timeoutMs: 5e3,
+		assertCurrent: options.assertCurrent
+	}))) return;
+	return await abandonCodexLiveThreadRelease(options, options.cause);
 }
-function formatCodexThreadLifecycleTimingSummary(params) {
-	const spans = params.summary.spans.length > 0 ? params.summary.spans.map((span) => `${span.name}:${span.durationMs}ms@${span.elapsedMs}ms`).join(",") : "none";
-	return `[trace:codex-app-server] thread lifecycle: runId=${params.runId} sessionId=${params.sessionId} sessionKey=${params.sessionKey ?? "unknown"} action=${params.action} totalMs=${params.summary.totalMs} stages=${spans}`;
+async function abandonCodexLiveThreadRelease(options, cause) {
+	options.assertCurrent?.();
+	await (options.abandonClient ?? (() => closeCodexStartupClientBestEffort(options.client)))();
+	throw new CodexAppServerUnsafeSubscriptionError(`Codex retained thread subscription could not be released: ${options.threadId}`, cause !== void 0 ? { cause } : void 0);
 }
-function createCodexThreadLifecycleTimingTracker(options = {}) {
-	const log = options.log ?? embeddedAgentLog;
-	if (!options.enabled && log.isEnabled?.("trace") !== true) return {
-		async measure(_name, run) {
-			return await run();
-		},
-		measureSync(_name, run) {
-			return run();
-		},
-		mark() {},
-		logSummary() {}
-	};
-	const now = options.now ?? Date.now;
-	const startedAt = now();
-	let didLog = false;
-	const spans = [];
-	const toMs = (value) => Math.max(0, Math.round(value));
-	const record = (name, spanStartedAt) => {
-		const currentAt = now();
-		spans.push({
-			name,
-			durationMs: toMs(currentAt - spanStartedAt),
-			elapsedMs: toMs(currentAt - startedAt)
-		});
-	};
-	const snapshot = () => ({
-		totalMs: toMs(now() - startedAt),
-		spans: spans.slice()
-	});
-	return {
-		async measure(name, run) {
-			const spanStartedAt = now();
-			try {
-				return await run();
-			} finally {
-				record(name, spanStartedAt);
-			}
-		},
-		measureSync(name, run) {
-			const spanStartedAt = now();
-			try {
-				return run();
-			} finally {
-				record(name, spanStartedAt);
-			}
-		},
-		mark(name) {
-			record(name, now());
-		},
-		logSummary(params) {
-			if (didLog) return;
-			const summary = snapshot();
-			const shouldWarn = shouldWarnCodexThreadLifecycleTimingSummary(summary, options);
-			if (!shouldWarn && !log.isEnabled?.("trace")) return;
-			didLog = true;
-			const message = formatCodexThreadLifecycleTimingSummary({
-				runId: params.runId,
-				sessionId: params.sessionId,
-				sessionKey: params.sessionKey,
-				action: params.action,
-				summary
-			});
-			const meta = {
-				runId: params.runId,
-				sessionId: params.sessionId,
-				sessionKey: params.sessionKey,
-				action: params.action,
-				threadId: params.threadId,
-				totalMs: summary.totalMs,
-				spans: summary.spans
-			};
-			if (shouldWarn) log.warn(message, meta);
-			else log.trace(message, meta);
-		}
-	};
-}
-//#endregion
-//#region extensions/codex/src/app-server/thread-lifecycle-preflight.ts
-async function prepareCodexThreadLifecyclePreflight(params) {
-	const lifecycleTiming = createCodexThreadLifecycleTimingTracker({
-		...params.timing,
-		enabled: params.timing?.enabled ?? isCodexAppServerProfilerEnabled(params.params.config)
-	});
-	const legacyDynamicToolsFingerprint = lifecycleTiming.measureSync("legacy-dynamic-tools-fingerprint", () => codexLegacyDynamicToolsFingerprint(params.dynamicTools));
-	const dynamicToolsFingerprint = lifecycleTiming.measureSync("dynamic-tools-fingerprint", () => hashCodexAppServerBindingFingerprint(legacyDynamicToolsFingerprint));
-	const dynamicToolsContainDeferred = flattenCodexDynamicToolFunctions(params.dynamicTools).some((tool) => tool.deferLoading === true);
-	const webSearchThreadConfigFingerprint = fingerprintJsonObject(lifecycleTiming.measureSync("web-search-plan", () => resolveCodexWebSearchPlan({
-		config: params.params.config,
-		disableTools: params.params.disableTools,
-		nativeToolSurfaceEnabled: params.nativeCodeModeEnabled,
-		nativeProviderWebSearchSupport: params.nativeProviderWebSearchSupport,
-		webSearchAllowed: params.webSearchAllowed
-	})).threadConfig);
-	const networkProxyConfigFingerprint = params.appServer.networkProxy?.configFingerprint;
-	const contextEngineBinding = lifecycleTiming.measureSync("context-engine-binding", () => buildContextEngineBinding(params.params, params.contextEngineProjection));
-	const userMcpServersConfigPatch = params.userMcpServersEnabled === false ? void 0 : await buildCodexUserMcpServersThreadConfigPatchForRuntime(params.params.config, {
-		agentId: params.agentId ?? params.params.agentId,
-		agentDir: params.params.agentDir,
-		allowLiteralOAuthProjection: params.appServer.connectionClass !== "remote",
-		toolOverrides: params.params.toolOverrides,
-		onServerUnavailable: (serverName, error) => embeddedAgentLog.warn("skipping unavailable MCP OAuth server", {
-			serverName,
-			error: formatErrorMessage(error)
-		})
-	});
-	const nativeSkillIsolation = await lifecycleTiming.measure("native-skill-isolation", () => resolveCodexNativeSkillIsolation({
-		client: params.client,
-		codexHome: params.appServer.start.env?.CODEX_HOME,
-		cwd: params.cwd,
-		home: params.appServer.start.env?.HOME,
-		signal: params.signal,
-		userProfile: params.appServer.start.env?.USERPROFILE
-	}));
-	const nativeSkillIsolationFingerprint = nativeSkillIsolation ? fingerprintJsonObject({
-		version: 1,
-		disabledUserSkillPaths: nativeSkillIsolation.disabledUserSkillPaths
-	}) : void 0;
-	const legacyUserMcpServersFingerprint = legacyFingerprintUserMcpServersConfigPatch(userMcpServersConfigPatch);
-	const userMcpServersFingerprint = fingerprintUserMcpServersConfigPatch(userMcpServersConfigPatch);
-	const environmentSelectionFingerprint = fingerprintEnvironmentSelection(params.environmentSelection);
-	const hostSystemAgentActive = params.hostSystemAgentActive ?? isHostScopedAgentToolActive("openclaw");
-	const ringZeroActive = hostSystemAgentActive && isSystemAgentOnlyCodexDynamicToolAllowlist(params.params.toolsAllow);
-	const messageOnlySourceReply = isMessageOnlyCodexSourceReply(params.params);
-	const restrictedToolSurface = ringZeroActive || messageOnlySourceReply || params.params.pluginHarnessToolPolicyRestricted === true;
-	if (restrictedToolSurface && params.nativeCodeModeEnabled !== false) throw new Error("Codex restricted tool surfaces require native code mode to be disabled");
-	const restrictedToolSurfaceInheritedMcpServerNames = restrictedToolSurface ? await lifecycleTiming.measure("restricted-tool-surface-mcp-config-read", () => readCodexInheritedMcpServerNames(params.client, params.cwd, params.signal)) : [];
-	if (restrictedToolSurface) await lifecycleTiming.measure("restricted-tool-surface-config-requirements-read", () => assertCodexRestrictedToolSurfaceHasNoManagedHooks(params.client, params.signal));
-	const ringZeroConfigFingerprint = ringZeroActive ? fingerprintJsonObject({
-		version: 1,
-		baseInstructions: "",
-		config: buildCodexRingZeroThreadConfigPatch(params.params, true, restrictedToolSurfaceInheritedMcpServerNames)
-	}) : void 0;
-	return {
-		contextEngineBinding,
-		dynamicToolsContainDeferred,
-		dynamicToolsFingerprint,
-		environmentSelectionFingerprint,
-		hostSystemAgentActive,
-		legacyDynamicToolsFingerprint,
-		legacyUserMcpServersFingerprint,
-		lifecycleTiming,
-		nativeSkillIsolation,
-		nativeSkillIsolationFingerprint,
-		networkProxyConfigFingerprint,
-		ringZeroActive,
-		ringZeroClientInstanceId: ringZeroActive ? getCodexAppServerClientInstanceId(params.client) : void 0,
-		ringZeroConfigFingerprint,
-		restrictedToolSurface,
-		restrictedToolSurfaceInheritedMcpServerNames,
-		userMcpServersConfigPatch,
-		userMcpServersFingerprint,
-		webSearchThreadConfigFingerprint
-	};
-}
-//#endregion
-//#region extensions/codex/src/app-server/thread-lifecycle-warm.ts
-/** Preserves the caller's abort reason across thread ownership transitions. */
-function throwIfCodexThreadLifecycleAborted(signal) {
-	if (!signal?.aborted) return;
-	const reason = signal.reason;
-	if (reason instanceof Error) throw reason;
-	const error = new Error(typeof reason === "string" && reason.length > 0 ? reason : "codex app-server thread lifecycle aborted");
-	error.name = "AbortError";
-	throw error;
-}
-/** Releases consumed subscription ownership or retires an unsafe client. */
-async function releaseCodexConsumedLiveThread(options) {
-	if (await options.lifecycleTiming.measure("retained-thread-unsubscribe", () => unsubscribeCodexThreadBestEffort(options.client, {
-		threadId: options.threadId,
-		timeoutMs: 5e3
-	}))) return;
-	await (options.abandonClient ?? (() => closeCodexStartupClientBestEffort(options.client)))();
-	throw new CodexAppServerUnsafeSubscriptionError(`Codex retained thread subscription could not be released: ${options.threadId}`, options.cause !== void 0 ? { cause: options.cause } : void 0);
-}
-/** Transfers retained-slot ownership before unconditionally releasing it. */
-async function releaseCodexRetainedLiveThread(options) {
-	if (await consumeCodexAppServerLiveThread(options.client, options.threadId)) await releaseCodexConsumedLiveThread(options);
+/** Releases through the retained owner, preserving its guarded callback and rollback. */
+async function releaseCodexRetainedLiveThread(options) {
+	try {
+		return await options.lifecycleTiming.measure("retained-thread-unsubscribe", () => releaseCodexAppServerLiveThread(options.client, options.threadId, options.assertCurrent));
+	} catch (error) {
+		if (isCodexAppServerUnsafeSubscriptionError(error)) throw error;
+		return await abandonCodexLiveThreadRelease(options, error);
+	}
 }
 /** Reuses one safely owned, fully matching subscription on its original client. */
 async function tryReuseCodexLiveThread(options) {
@@ -2968,6 +3024,7 @@ async function tryReuseCodexLiveThread(options) {
 	const resumeConfig = mergeCodexThreadConfigs(params.config, userMcpServersConfigPatch, pluginAppsConfigPatch, prebuiltFinalConfigPatch.configPatch);
 	const resumeParams = lifecycleTiming.measureSync("warm-thread-resume-params", () => buildThreadResumeParams(params.params, {
 		threadId: binding.threadId,
+		cwd: params.cwd,
 		authProfileId: resumeAuthProfileId,
 		model: startModelSelection.model,
 		modelProvider: startModelProvider,
@@ -2981,7 +3038,9 @@ async function tryReuseCodexLiveThread(options) {
 		nativeCodeModeOnlyEnabled: params.nativeCodeModeOnlyEnabled,
 		webSearchAllowed: params.webSearchAllowed,
 		hostSystemAgentActive,
-		restrictedToolSurfaceInheritedMcpServerNames
+		restrictedToolSurfaceInheritedMcpServerNames,
+		shellEnvironment: params.shellEnvironment,
+		disableLoginShell: params.disableLoginShell
 	}));
 	const liveThreadConfigFingerprint = fingerprintCodexThreadConfig({
 		...resumeParams,
@@ -3038,6 +3097,667 @@ async function tryReuseCodexLiveThread(options) {
 	}
 }
 //#endregion
+//#region extensions/codex/src/app-server/thread-lifecycle-adoption.ts
+/** Passive refusal must precede releasing or acquiring any native subscription. */
+async function assertAdoptedCodexThreadResumeAllowed(params, threadId, context) {
+	const { thread } = await context.lifecycleTiming.measure("thread-read-adoption-status", () => params.client.request("thread/read", {
+		threadId,
+		includeTurns: false
+	}, { signal: params.signal }));
+	context.throwIfAborted();
+	assertCodexThreadAcceptsDirectInput(thread);
+	if (thread.status?.type === "active") throw new CodexAdoptedThreadActiveError();
+}
+/** Preserve attach's native-queue-before-binding-lease order when consuming pending intent. */
+async function withCodexThreadLifecycleBinding(params, run) {
+	const identity = sessionBindingIdentity({
+		sessionId: params.params.sessionId,
+		sessionKey: params.params.sessionKey,
+		agentId: params.agentId ?? params.params.agentId,
+		config: params.params.config
+	});
+	const snapshot = await params.bindingStore.read(identity);
+	const pendingThreadId = snapshot?.pendingResumeConfiguration ? snapshot.threadId : void 0;
+	const runWithLease = () => params.bindingStore.withLease(identity, async () => {
+		const binding = await params.bindingStore.read(identity);
+		if (pendingThreadId && (binding?.threadId !== pendingThreadId || !binding.pendingResumeConfiguration)) throw new CodexThreadBindingConflictError(pendingThreadId, "acquiring a pending resume configuration");
+		if (!pendingThreadId && binding?.pendingResumeConfiguration) throw new CodexThreadBindingConflictError(binding.threadId, "acquiring a pending resume configuration");
+		return await run(identity, binding);
+	});
+	return pendingThreadId ? await withExclusiveCodexAppServerThread({
+		bindingStore: params.bindingStore,
+		identity,
+		threadId: pendingThreadId,
+		run: runWithLease
+	}) : await runWithLease();
+}
+/** Completes manual attachment only under the native queue and exact binding lease. */
+async function resumePendingCodexThread(params, context) {
+	const { binding, contextEngineBinding, lifecycleTiming, restrictedToolSurface } = context;
+	if (isIncognitoSessionKey(params.params.sessionKey) || context.transientRestriction || !restrictedToolSurface && binding.nativeToolPolicyRestricted === true || (contextEngineBinding ? !isContextEngineBindingCompatible(binding.contextEngine, contextEngineBinding) : binding.contextEngine !== void 0) || shouldRotateCodexGpt56MultiAgentBinding({
+		bindingModel: binding.model,
+		requestedModel: params.params.modelId
+	})) throw new Error(`Cannot configure resumed Codex thread ${binding.threadId} under a transient or incompatible session policy. The thread is preserved; retry from its normal session or use /new for the current policy.`);
+	const prebuiltPluginThreadConfig = params.pluginThreadConfig?.enabled ? await lifecycleTiming.measure("plugin-config-build", () => params.pluginThreadConfig?.build()) : void 0;
+	const clientId = resolveCodexAppServerClientInstanceId(params.client);
+	const configuration = await preparePendingCodexThreadResume(params, binding, context.dynamicToolsFingerprint, async (assertCurrent) => {
+		const released = await context.releaseRetainedThread(binding.threadId, assertCurrent);
+		assertCurrent();
+		if (!released || binding.clientId && binding.clientId !== clientId) await releaseCodexConsumedLiveThread({
+			client: params.client,
+			abandonClient: params.abandonClient,
+			lifecycleTiming,
+			threadId: binding.threadId,
+			assertCurrent
+		});
+	});
+	try {
+		const resumed = await resumeExistingCodexThread(params, {
+			...context,
+			prebuiltPluginThreadConfig,
+			assertResumeConfiguration: configuration.assertConfigured,
+			assertResumeOwnership: configuration.assertCurrent
+		});
+		if (!resumed) throw new Error(`Codex did not configure resumed thread ${binding.threadId}.`);
+		return resumed;
+	} finally {
+		configuration.dispose();
+	}
+}
+/** Manual attachment is intent, never evidence that loaded native overrides took effect. */
+async function preparePendingCodexThreadResume(params, binding, dynamicToolsFingerprint, releaseSubscription) {
+	const fail = (reason) => /* @__PURE__ */ new Error(`Cannot configure resumed Codex thread ${binding.threadId}: ${reason}. The thread is preserved; continue it in native Codex or use /new for the current OpenClaw tools.`);
+	const agentDir = resolveCodexThreadAgentDir(params);
+	const localHome = resolveCodexAppServerLocalHomeDir(params.appServer.start, agentDir);
+	if (params.appServer.start.transport !== "stdio" || params.appServer.start.homeScope === "user" || path.resolve(localHome) !== resolveCodexAppServerHomeDir(agentDir) || binding.connectionScope === "supervision" || binding.preserveNativeModel === true) throw fail("configuration adoption requires an OpenClaw-owned local Codex home");
+	if (isCodexAppServerLiveThreadClaimed(params.client, binding.threadId)) throw fail("the thread is claimed by active work; stop that run before resuming");
+	const assertCurrent = captureExclusiveSharedCodexAppServerClient(params.client);
+	const { thread } = await params.client.request("thread/read", {
+		threadId: binding.threadId,
+		includeTurns: false
+	}, { signal: params.signal });
+	assertCurrent();
+	const statusType = thread.status?.type;
+	if (thread.id !== binding.threadId || statusType !== "idle" && statusType !== "notLoaded") throw fail("the native thread is not idle; wait for its current run to finish");
+	assertCodexThreadAcceptsDirectInput(thread);
+	let unloaded = statusType === "notLoaded";
+	const dispose = params.client.addNotificationHandler((notification) => {
+		if (notification.method === "thread/status/changed" && isJsonObject(notification.params) && notification.params.threadId === binding.threadId && isJsonObject(notification.params.status) && notification.params.status.type === "notLoaded") unloaded = true;
+	});
+	try {
+		const rolloutPath = thread.path ?? binding.rolloutPath;
+		const metadata = rolloutPath ? await readCodexSessionMeta(path.join(localHome, "sessions"), rolloutPath, binding.threadId) : void 0;
+		if (!metadata) throw fail("its native tool catalog could not be read from the selected Codex home");
+		const recordedTools = metadata.dynamic_tools ?? [];
+		if (!Array.isArray(recordedTools) || codexDynamicToolsFingerprint(recordedTools) !== dynamicToolsFingerprint) throw fail("its immutable native tool catalog does not match the current OpenClaw tools");
+		assertCurrent();
+		await releaseSubscription(assertCurrent);
+		assertCurrent();
+		return {
+			assertConfigured: () => {
+				assertCurrent();
+				if (!unloaded) throw fail("Codex did not confirm unloading its previous configuration");
+			},
+			assertCurrent,
+			dispose
+		};
+	} catch (error) {
+		dispose();
+		throw error;
+	}
+}
+//#endregion
+//#region extensions/codex/src/app-server/native-hook-relay-state.ts
+const pending = /* @__PURE__ */ new Set();
+/** Owns delayed hook-relay cleanup across runtime scheduling and test teardown. */
+const nativeHookRelayUnregisterQueue = {
+	add(entry) {
+		pending.add(entry);
+	},
+	delete(entry) {
+		return pending.delete(entry);
+	},
+	flush() {
+		while (pending.size > 0) {
+			const entry = pending.values().next().value;
+			if (!entry) return;
+			clearTimeout(entry.timeout);
+			entry.unregister();
+		}
+	},
+	clear() {
+		for (const entry of pending) clearTimeout(entry.timeout);
+		pending.clear();
+	}
+};
+//#endregion
+//#region extensions/codex/src/app-server/native-hook-relay.ts
+/**
+* Bridges Codex native hook callbacks into OpenClaw's native hook relay so
+* app-server tool events can still run OpenClaw policy and diagnostics.
+*/
+/** Codex hook events that can be registered through OpenClaw's native relay. */
+const CODEX_NATIVE_HOOK_RELAY_EVENTS = [
+	"pre_tool_use",
+	"post_tool_use",
+	"permission_request",
+	"before_agent_finalize"
+];
+const CODEX_NATIVE_HOOK_RELAY_EVENTS_WITH_APP_SERVER_APPROVALS = CODEX_NATIVE_HOOK_RELAY_EVENTS.filter((event) => event !== "permission_request");
+const CODEX_NATIVE_HOOK_RELAY_MIN_TTL_MS = 30 * 6e4;
+/** Extra relay lifetime after the expected turn budget, preventing late hook drops. */
+const CODEX_NATIVE_HOOK_RELAY_TTL_GRACE_MS = 5 * 6e4;
+const CODEX_NATIVE_HOOK_RELAY_COMMAND_MIN_PARENT_MARGIN_MS = 250;
+const CODEX_NATIVE_HOOK_RELAY_COMMAND_MAX_PARENT_MARGIN_MS = 1e3;
+const CODEX_NATIVE_HOOK_RELAY_DEFAULT_TIMEOUT_SEC = 10;
+const CODEX_NATIVE_HOOK_RELAY_UNREGISTER_GRACE_MS = 1e4;
+const CODEX_NATIVE_HOOK_RELAY_UNREGISTER_EXTRA_GRACE_MS = 5e3;
+const MAX_PENDING_DIRECT_CHILD_ADMISSIONS = 32;
+const nativeHookPolicyByClient = /* @__PURE__ */ new WeakMap();
+const CODEX_HOOK_MATCHER_NAMES_BY_TOOL_ID = {
+	exec: [
+		"Bash",
+		"exec",
+		"exec_command"
+	],
+	apply_patch: [
+		"apply_patch",
+		"Write",
+		"Edit"
+	],
+	spawn_agent: ["spawn_agent", "Agent"]
+};
+/** Enterprise managed-only policy silently drops the session-layer hooks that enforce OpenClaw. */
+async function assertCodexNativeHookRelayAllowed(client, signal) {
+	let attestation = nativeHookPolicyByClient.get(client);
+	if (!attestation) {
+		attestation = client.request("configRequirements/read", void 0, { signal }).then((response) => {
+			if (!isJsonObject(response) || !Object.hasOwn(response, "requirements")) throw new Error("Codex configRequirements/read returned an invalid hook policy response");
+			const requirements = response.requirements;
+			if (requirements === null) return;
+			if (!isJsonObject(requirements)) throw new Error("Codex configRequirements/read returned invalid hook policy requirements");
+			const managedOnly = requirements.allowManagedHooksOnly;
+			if (managedOnly !== void 0 && managedOnly !== null && typeof managedOnly !== "boolean") throw new Error("Codex configRequirements/read returned invalid managed-only hook policy");
+			if (managedOnly === true) throw new Error("Codex managed-only hooks disable the OpenClaw native hook relay; refusing unenforced execution");
+		});
+		nativeHookPolicyByClient.set(client, attestation);
+		attestation.catch(() => {
+			if (nativeHookPolicyByClient.get(client) === attestation) nativeHookPolicyByClient.delete(client);
+		});
+	}
+	await attestation;
+}
+/** Defers relay unregister so late native hook subprocesses can still resolve. */
+function scheduleCodexNativeHookRelayUnregister(params) {
+	let pending;
+	const unregister = () => {
+		if (!pending) return;
+		const current = pending;
+		pending = void 0;
+		if (!nativeHookRelayUnregisterQueue.delete(current)) return;
+		params.relay.unregister();
+	};
+	const timeout = setTimeout(unregister, resolveCodexNativeHookRelayUnregisterGraceMs(params.hookTimeoutSec));
+	pending = {
+		timeout,
+		unregister
+	};
+	nativeHookRelayUnregisterQueue.add(pending);
+	timeout.unref();
+}
+/** Computes the delayed unregister window from Codex's hook timeout. */
+function resolveCodexNativeHookRelayUnregisterGraceMs(hookTimeoutSec) {
+	const hookTimeoutMs = finiteSecondsToTimerSafeMilliseconds(normalizeHookTimeoutSec(hookTimeoutSec)) ?? 0;
+	return Math.max(CODEX_NATIVE_HOOK_RELAY_UNREGISTER_GRACE_MS, addTimerTimeoutGraceMs(hookTimeoutMs, CODEX_NATIVE_HOOK_RELAY_UNREGISTER_EXTRA_GRACE_MS) ?? 0);
+}
+/** Records a native pre-tool failure that Codex does not project as a tool item. */
+function emitCodexNativePreToolUseFailureDiagnostic(params) {
+	emitTrustedDiagnosticEvent({
+		type: "tool.execution.error",
+		...params.agentId ? { agentId: params.agentId } : {},
+		sessionId: params.sessionId,
+		...params.sessionKey ? { sessionKey: params.sessionKey } : {},
+		runId: params.runId,
+		toolName: params.failure.toolName,
+		toolCallId: params.failure.toolCallId,
+		durationMs: params.failure.durationMs,
+		errorCategory: "before_tool_call",
+		terminalReason: params.terminalReason ?? (params.signal?.aborted ? resolveCodexToolAbortTerminalReason(params.signal) : params.failure.disposition),
+		...params.sourceTimestampMs !== void 0 ? { sourceTimestampMs: params.sourceTimestampMs } : {}
+	});
+}
+/** Registers an OpenClaw native hook relay for a Codex app-server turn. */
+function createCodexNativeHookRelay(params) {
+	if (params.options?.enabled === false) return;
+	const directChildClaims = /* @__PURE__ */ new Map();
+	const pendingDirectChildAdmissions = /* @__PURE__ */ new Map();
+	let foregroundClosed = false;
+	let successfulYieldRetentionAuthorized = false;
+	const assertClaim = (threadId, claim) => () => directChildClaims.get(threadId) === claim;
+	const rejectPendingAdmissions = (reason) => {
+		for (const pending of pendingDirectChildAdmissions.values()) pending.reject(new Error(reason));
+		pendingDirectChildAdmissions.clear();
+	};
+	const relay = registerRetainedNativeHookRelayForBundledRuntime({
+		provider: "codex",
+		relayId: buildCodexNativeHookRelayId({
+			agentId: params.agentId,
+			sessionId: params.sessionId,
+			sessionKey: params.sessionKey
+		}),
+		...params.generation ? { generation: params.generation } : {},
+		...params.generationMismatchGraceMs ? { generationMismatchGraceMs: params.generationMismatchGraceMs } : {},
+		...params.agentId ? { agentId: params.agentId } : {},
+		sessionId: params.sessionId,
+		...params.sessionKey ? { sessionKey: params.sessionKey } : {},
+		...params.config ? { config: params.config } : {},
+		runId: params.runId,
+		...params.channelId ? { channelId: params.channelId } : {},
+		...params.requester ? { requester: params.requester } : {},
+		...params.approvalContext ? { approvalContext: params.approvalContext } : {},
+		allowedEvents: params.events,
+		preToolUseLoopDetection: params.loopDetectionPreToolUseRelay,
+		ttlMs: resolveCodexNativeHookRelayTtlMs({
+			explicitTtlMs: params.options?.ttlMs,
+			attemptTimeoutMs: params.attemptTimeoutMs,
+			startupTimeoutMs: params.startupTimeoutMs,
+			turnStartTimeoutMs: params.turnStartTimeoutMs
+		}),
+		signal: params.signal,
+		runBeforeToolCall: params.hostCapabilities.runBeforeToolCall,
+		assertActive: params.hostCapabilities.assertActive,
+		retention: {
+			readClaim: readCodexNativeChildThreadId,
+			shouldRetainAfterForegroundClose: () => successfulYieldRetentionAuthorized && directChildClaims.size > 0,
+			allowPreToolUse: (childThreadId) => directChildClaims.has(childThreadId),
+			awaitForegroundAdmission: (childThreadId) => {
+				if (foregroundClosed) return Promise.reject(/* @__PURE__ */ new Error("native hook relay foreground admission unavailable"));
+				const existingClaim = directChildClaims.get(childThreadId);
+				if (existingClaim) return Promise.resolve(assertClaim(childThreadId, existingClaim));
+				const existingPending = pendingDirectChildAdmissions.get(childThreadId);
+				if (existingPending) return existingPending.promise.then((claim) => assertClaim(childThreadId, claim));
+				if (pendingDirectChildAdmissions.size >= MAX_PENDING_DIRECT_CHILD_ADMISSIONS) return Promise.reject(/* @__PURE__ */ new Error("native hook relay foreground admission capacity reached"));
+				const { promise, resolve, reject } = createDeferred();
+				pendingDirectChildAdmissions.set(childThreadId, {
+					promise,
+					resolve,
+					reject
+				});
+				return promise.then((claim) => assertClaim(childThreadId, claim));
+			},
+			onDispose: () => {
+				foregroundClosed = true;
+				rejectPendingAdmissions("native hook relay registration closed");
+			}
+		},
+		onPreToolUseFailure: params.onPreToolUseFailure,
+		command: {
+			nice: 10,
+			timeoutMs: params.options?.gatewayTimeoutMs
+		}
+	});
+	const unregister = () => {
+		foregroundClosed = true;
+		rejectPendingAdmissions("native hook relay foreground closed");
+		relay.unregister();
+	};
+	return {
+		...relay,
+		unregister,
+		authorizeRetentionAfterSuccessfulYield: () => {
+			successfulYieldRetentionAuthorized = true;
+		},
+		hasClaimedDirectChild: () => directChildClaims.size > 0,
+		rejectPendingDirectChild: (threadIdInput, reason) => {
+			const threadId = threadIdInput.trim();
+			const pending = threadId ? pendingDirectChildAdmissions.get(threadId) : void 0;
+			if (!pending) return;
+			pendingDirectChildAdmissions.delete(threadId);
+			pending.reject(new Error(reason));
+		},
+		claimDirectChild: (threadIdInput) => {
+			const threadId = threadIdInput.trim();
+			if (!threadId) return () => void 0;
+			if (directChildClaims.get(threadId)) return () => void 0;
+			const claim = Symbol(threadId);
+			directChildClaims.set(threadId, claim);
+			const pending = pendingDirectChildAdmissions.get(threadId);
+			pendingDirectChildAdmissions.delete(threadId);
+			pending?.resolve(claim);
+			let released = false;
+			return () => {
+				if (released) return;
+				released = true;
+				if (directChildClaims.get(threadId) !== claim) return;
+				directChildClaims.delete(threadId);
+				if (foregroundClosed && directChildClaims.size === 0) relay.unregister();
+			};
+		}
+	};
+}
+function readCodexNativeChildThreadId(rawPayload) {
+	if (!isJsonObject(rawPayload) || typeof rawPayload.agent_id !== "string") return;
+	return rawPayload.agent_id.trim() || void 0;
+}
+/** Selects the native hook events Codex should install for the current approval mode. */
+function resolveCodexNativeHookRelayEvents(params) {
+	if (params.configuredEvents?.length) return params.configuredEvents;
+	return params.appServer.approvalPolicy === "never" ? CODEX_NATIVE_HOOK_RELAY_EVENTS : CODEX_NATIVE_HOOK_RELAY_EVENTS_WITH_APP_SERVER_APPROVALS;
+}
+/** Derives the native hook relay TTL from the turn budget unless explicitly configured. */
+function resolveCodexNativeHookRelayTtlMs(params) {
+	if (params.explicitTtlMs !== void 0) return params.explicitTtlMs;
+	const relayBudgetMs = params.attemptTimeoutMs + params.startupTimeoutMs + params.turnStartTimeoutMs + CODEX_NATIVE_HOOK_RELAY_TTL_GRACE_MS;
+	return Math.max(CODEX_NATIVE_HOOK_RELAY_MIN_TTL_MS, Math.floor(relayBudgetMs));
+}
+/** Builds a stable relay id scoped to the agent and session identity. */
+function buildCodexNativeHookRelayId(params) {
+	const hash = createHash("sha256");
+	hash.update("openclaw:codex:native-hook-relay:v1");
+	hash.update("\0");
+	hash.update(params.agentId?.trim() || "");
+	hash.update("\0");
+	hash.update(params.sessionKey?.trim() || params.sessionId);
+	return `codex-${hash.digest("hex").slice(0, 40)}`;
+}
+const CODEX_HOOK_EVENT_BY_NATIVE_EVENT = {
+	pre_tool_use: "PreToolUse",
+	post_tool_use: "PostToolUse",
+	permission_request: "PermissionRequest",
+	before_agent_finalize: "Stop"
+};
+const CODEX_HOOK_KEY_LABEL_BY_NATIVE_EVENT = {
+	pre_tool_use: "pre_tool_use",
+	post_tool_use: "post_tool_use",
+	permission_request: "permission_request",
+	before_agent_finalize: "stop"
+};
+const CODEX_SESSION_FLAGS_HOOK_SOURCE_PATHS = ["/<session-flags>/config.toml", "<session-flags>/config.toml"];
+/** Builds the Codex config overlay that installs trusted command hooks for relay events. */
+function buildCodexNativeHookRelayConfig(params) {
+	const events = params.events?.length ? params.events : CODEX_NATIVE_HOOK_RELAY_EVENTS;
+	const selectedEvents = new Set(events);
+	const config = { "features.hooks": true };
+	const hookState = {};
+	for (const event of CODEX_NATIVE_HOOK_RELAY_EVENTS) {
+		const codexEvent = CODEX_HOOK_EVENT_BY_NATIVE_EVENT[event];
+		const selected = selectedEvents.has(event);
+		const shouldRelay = params.relay.shouldRelayEvent(event);
+		if (!selected || !shouldRelay) {
+			if (selected || params.clearOmittedEvents) config[`hooks.${codexEvent}`] = [];
+			if (params.clearOmittedEvents) for (const sourcePath of CODEX_SESSION_FLAGS_HOOK_SOURCE_PATHS) hookState[`${sourcePath}:${CODEX_HOOK_KEY_LABEL_BY_NATIVE_EVENT[event]}:0:0`] = { enabled: false };
+			continue;
+		}
+		const timeout = normalizeHookTimeoutSec(params.hookTimeoutSec);
+		const command = params.relay.commandForEvent(event, { timeoutMs: resolveCodexNativeHookRelayCommandTimeoutMs(timeout) });
+		const matcher = buildCodexNativeToolMatcher(params.relay.toolMatcherForEvent(event));
+		config[`hooks.${codexEvent}`] = [{
+			...matcher ? { matcher } : {},
+			hooks: [{
+				type: "command",
+				command,
+				timeout,
+				async: false,
+				statusMessage: "OpenClaw native hook relay"
+			}]
+		}];
+		const state = {
+			enabled: true,
+			trusted_hash: codexCommandHookTrustedHash({
+				event,
+				command,
+				matcher,
+				timeout,
+				statusMessage: "OpenClaw native hook relay"
+			})
+		};
+		for (const sourcePath of CODEX_SESSION_FLAGS_HOOK_SOURCE_PATHS) hookState[`${sourcePath}:${CODEX_HOOK_KEY_LABEL_BY_NATIVE_EVENT[event]}:0:0`] = state;
+	}
+	config["hooks.state"] = hookState;
+	return config;
+}
+/** Builds a Codex config overlay that disables native hooks and clears hook arrays. */
+function buildCodexNativeHookRelayDisabledConfig() {
+	return {
+		"features.hooks": false,
+		"hooks.PreToolUse": [],
+		"hooks.PostToolUse": [],
+		"hooks.PermissionRequest": [],
+		"hooks.Stop": []
+	};
+}
+function normalizeHookTimeoutSec(value) {
+	return typeof value === "number" && Number.isFinite(value) && value > 0 ? Math.ceil(value) : CODEX_NATIVE_HOOK_RELAY_DEFAULT_TIMEOUT_SEC;
+}
+function resolveCodexNativeHookRelayCommandTimeoutMs(hookTimeoutSec) {
+	const parentTimeoutMs = finiteSecondsToTimerSafeMilliseconds(normalizeHookTimeoutSec(hookTimeoutSec)) ?? 5e3;
+	const parentMarginMs = Math.min(CODEX_NATIVE_HOOK_RELAY_COMMAND_MAX_PARENT_MARGIN_MS, Math.max(CODEX_NATIVE_HOOK_RELAY_COMMAND_MIN_PARENT_MARGIN_MS, Math.floor(parentTimeoutMs / 5)));
+	return Math.max(1, parentTimeoutMs - parentMarginMs);
+}
+function buildCodexNativeToolMatcher(toolNames) {
+	if (toolNames === void 0) return;
+	if (toolNames.length === 0) throw new TypeError("Codex native hook matcher requires at least one tool name");
+	const nativeNames = /* @__PURE__ */ new Set();
+	let hasCustomToolName = false;
+	for (const toolName of toolNames) {
+		const canonicalToolName = toolName.trim();
+		if (!canonicalToolName || canonicalToolName === "*") throw new TypeError("Codex native hook matcher requires canonical OpenClaw tool ids");
+		const nativeAliases = CODEX_HOOK_MATCHER_NAMES_BY_TOOL_ID[canonicalToolName];
+		if (!nativeAliases) hasCustomToolName = true;
+		for (const nativeName of nativeAliases ?? [canonicalToolName]) nativeNames.add(nativeName);
+	}
+	const sortedNames = Array.from(nativeNames).toSorted();
+	if (!hasCustomToolName && sortedNames.every((toolName) => /^[A-Za-z0-9_]+$/.test(toolName))) return sortedNames.join("|");
+	return `(?i)^(?:${sortedNames.map((toolName) => toolName.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|")})$`;
+}
+function codexCommandHookTrustedHash(params) {
+	const identity = {
+		event_name: CODEX_HOOK_KEY_LABEL_BY_NATIVE_EVENT[params.event],
+		...params.matcher ? { matcher: params.matcher } : {},
+		hooks: [{
+			async: false,
+			command: params.command,
+			statusMessage: params.statusMessage,
+			timeout: params.timeout,
+			type: "command"
+		}]
+	};
+	return `sha256:${createHash("sha256").update(JSON.stringify(sortJsonValue(identity))).digest("hex")}`;
+}
+function sortJsonValue(value) {
+	if (!value || typeof value !== "object") return value;
+	if (Array.isArray(value)) return value.map(sortJsonValue);
+	const sorted = {};
+	for (const [key, entry] of Object.entries(value).toSorted(([left], [right]) => left.localeCompare(right))) sorted[key] = sortJsonValue(entry);
+	return sorted;
+}
+//#endregion
+//#region extensions/codex/src/app-server/profiler-flag.ts
+const PROFILER_FLAGS = ["profiler", "codex.profiler"];
+/** Checks the generic and Codex-specific profiler diagnostic flags. */
+function isCodexAppServerProfilerEnabled(config, env = process.env) {
+	return PROFILER_FLAGS.some((flag) => isDiagnosticFlagEnabled(flag, config, env));
+}
+//#endregion
+//#region extensions/codex/src/app-server/thread-lifecycle-timing.ts
+const CODEX_THREAD_LIFECYCLE_TIMING_WARN_TOTAL_MS = 1e3;
+const CODEX_THREAD_LIFECYCLE_TIMING_WARN_STAGE_MS = 500;
+function shouldWarnCodexThreadLifecycleTimingSummary(summary, options = {}) {
+	const totalThresholdMs = options.totalThresholdMs ?? CODEX_THREAD_LIFECYCLE_TIMING_WARN_TOTAL_MS;
+	const stageThresholdMs = options.stageThresholdMs ?? CODEX_THREAD_LIFECYCLE_TIMING_WARN_STAGE_MS;
+	return summary.totalMs >= totalThresholdMs || summary.spans.some((span) => span.durationMs >= stageThresholdMs);
+}
+function formatCodexThreadLifecycleTimingSummary(params) {
+	const spans = params.summary.spans.length > 0 ? params.summary.spans.map((span) => `${span.name}:${span.durationMs}ms@${span.elapsedMs}ms`).join(",") : "none";
+	return `[trace:codex-app-server] thread lifecycle: runId=${params.runId} sessionId=${params.sessionId} sessionKey=${params.sessionKey ?? "unknown"} action=${params.action} totalMs=${params.summary.totalMs} stages=${spans}`;
+}
+function createCodexThreadLifecycleTimingTracker(options = {}) {
+	const log = options.log ?? embeddedAgentLog;
+	if (!options.enabled && log.isEnabled?.("trace") !== true) return {
+		async measure(_name, run) {
+			return await run();
+		},
+		measureSync(_name, run) {
+			return run();
+		},
+		mark() {},
+		logSummary() {}
+	};
+	const now = options.now ?? Date.now;
+	const startedAt = now();
+	let didLog = false;
+	const spans = [];
+	const toMs = (value) => Math.max(0, Math.round(value));
+	const record = (name, spanStartedAt) => {
+		const currentAt = now();
+		spans.push({
+			name,
+			durationMs: toMs(currentAt - spanStartedAt),
+			elapsedMs: toMs(currentAt - startedAt)
+		});
+	};
+	const snapshot = () => ({
+		totalMs: toMs(now() - startedAt),
+		spans: spans.slice()
+	});
+	return {
+		async measure(name, run) {
+			const spanStartedAt = now();
+			try {
+				return await run();
+			} finally {
+				record(name, spanStartedAt);
+			}
+		},
+		measureSync(name, run) {
+			const spanStartedAt = now();
+			try {
+				return run();
+			} finally {
+				record(name, spanStartedAt);
+			}
+		},
+		mark(name) {
+			record(name, now());
+		},
+		logSummary(params) {
+			if (didLog) return;
+			const summary = snapshot();
+			const shouldWarn = shouldWarnCodexThreadLifecycleTimingSummary(summary, options);
+			if (!shouldWarn && !log.isEnabled?.("trace")) return;
+			didLog = true;
+			const message = formatCodexThreadLifecycleTimingSummary({
+				runId: params.runId,
+				sessionId: params.sessionId,
+				sessionKey: params.sessionKey,
+				action: params.action,
+				summary
+			});
+			const meta = {
+				runId: params.runId,
+				sessionId: params.sessionId,
+				sessionKey: params.sessionKey,
+				action: params.action,
+				threadId: params.threadId,
+				totalMs: summary.totalMs,
+				spans: summary.spans
+			};
+			if (shouldWarn) log.warn(message, meta);
+			else log.trace(message, meta);
+		}
+	};
+}
+//#endregion
+//#region extensions/codex/src/app-server/thread-lifecycle-preflight.ts
+async function prepareCodexThreadLifecyclePreflight(params) {
+	await assertCodexModelBackedReviewerEffectiveConfig({
+		client: params.client,
+		approvalsReviewer: params.appServer.approvalsReviewer,
+		cwd: params.cwd,
+		signal: params.signal
+	});
+	if (params.nativeHookRelayRequired) await assertCodexNativeHookRelayAllowed(params.client, params.signal);
+	const lifecycleTiming = createCodexThreadLifecycleTimingTracker({
+		...params.timing,
+		enabled: params.timing?.enabled ?? isCodexAppServerProfilerEnabled(params.params.config)
+	});
+	const legacyDynamicToolsFingerprint = lifecycleTiming.measureSync("legacy-dynamic-tools-fingerprint", () => codexLegacyDynamicToolsFingerprint(params.dynamicTools));
+	const dynamicToolsFingerprint = lifecycleTiming.measureSync("dynamic-tools-fingerprint", () => hashCodexAppServerBindingFingerprint(legacyDynamicToolsFingerprint));
+	const dynamicToolsContainDeferred = flattenCodexDynamicToolFunctions(params.dynamicTools).some((tool) => tool.deferLoading === true);
+	const webSearchThreadConfigFingerprint = fingerprintJsonObject(lifecycleTiming.measureSync("web-search-plan", () => resolveCodexWebSearchPlan({
+		config: params.params.config,
+		disableTools: params.params.disableTools,
+		nativeToolSurfaceEnabled: params.nativeCodeModeEnabled,
+		nativeProviderWebSearchSupport: params.nativeProviderWebSearchSupport,
+		webSearchAllowed: params.webSearchAllowed
+	})).threadConfig);
+	const networkProxyConfigFingerprint = params.appServer.networkProxy?.configFingerprint;
+	const contextEngineBinding = lifecycleTiming.measureSync("context-engine-binding", () => buildContextEngineBinding(params.params, params.contextEngineProjection));
+	const userMcpServersConfigPatch = params.userMcpServersEnabled === false ? void 0 : await buildCodexUserMcpServersThreadConfigPatchForRun({
+		run: params.params,
+		cwd: params.cwd,
+		agentId: params.agentId ?? params.params.agentId,
+		allowLiteralOAuthProjection: params.appServer.connectionClass !== "remote",
+		warn: (message) => embeddedAgentLog.warn(message),
+		onServerUnavailable: (serverName, error) => embeddedAgentLog.warn("skipping unavailable MCP OAuth server", {
+			serverName,
+			error: formatErrorMessage(error)
+		})
+	});
+	const nativeSkillIsolation = await lifecycleTiming.measure("native-skill-isolation", () => resolveCodexNativeSkillIsolation({
+		client: params.client,
+		codexHome: params.appServer.start.env?.CODEX_HOME,
+		cwd: params.cwd,
+		home: params.appServer.start.env?.HOME,
+		signal: params.signal,
+		userProfile: params.appServer.start.env?.USERPROFILE
+	}));
+	const nativeSkillIsolationFingerprint = nativeSkillIsolation ? fingerprintJsonObject({
+		version: 1,
+		disabledUserSkillPaths: nativeSkillIsolation.disabledUserSkillPaths
+	}) : void 0;
+	const legacyUserMcpServersFingerprint = legacyFingerprintUserMcpServersConfigPatch(userMcpServersConfigPatch);
+	const userMcpServersFingerprint = fingerprintUserMcpServersConfigPatch(userMcpServersConfigPatch);
+	const environmentSelectionFingerprint = fingerprintEnvironmentSelection(params.environmentSelection);
+	const hostSystemAgentActive = params.hostSystemAgentActive ?? isHostScopedAgentToolActive("openclaw");
+	const ringZeroActive = hostSystemAgentActive && isSystemAgentOnlyCodexDynamicToolAllowlist(params.params.toolsAllow);
+	const messageOnlySourceReply = isMessageOnlyCodexSourceReply(params.params);
+	const restrictedToolSurface = ringZeroActive || messageOnlySourceReply || params.params.pluginHarnessToolPolicyRestricted === true;
+	const imageGenerationDenied = params.params.pluginHarnessToolPolicySafeDeniedTools?.includes("image_generate") === true;
+	if (restrictedToolSurface && params.nativeCodeModeEnabled !== false) throw new Error("Codex restricted tool surfaces require native code mode to be disabled");
+	const restrictedToolSurfaceInheritedMcpServerNames = restrictedToolSurface ? await lifecycleTiming.measure("restricted-tool-surface-mcp-config-read", () => readCodexInheritedMcpServerNames(params.client, params.cwd, params.signal)) : [];
+	if (restrictedToolSurface || imageGenerationDenied) await lifecycleTiming.measure("tool-policy-config-requirements-read", () => assertCodexManagedRequirementsDoNotOverrideToolPolicy(params.client, {
+		restrictedToolSurface,
+		additionalDeniedFeatures: imageGenerationDenied ? ["image_generation"] : void 0
+	}, params.signal));
+	const ringZeroConfigFingerprint = ringZeroActive ? fingerprintJsonObject({
+		version: 1,
+		baseInstructions: "",
+		config: buildCodexRingZeroThreadConfigPatch(params.params, true, restrictedToolSurfaceInheritedMcpServerNames)
+	}) : void 0;
+	return {
+		contextEngineBinding,
+		dynamicToolsContainDeferred,
+		dynamicToolsFingerprint,
+		environmentSelectionFingerprint,
+		hostSystemAgentActive,
+		legacyDynamicToolsFingerprint,
+		legacyUserMcpServersFingerprint,
+		lifecycleTiming,
+		nativeSkillIsolation,
+		nativeSkillIsolationFingerprint,
+		networkProxyConfigFingerprint,
+		ringZeroActive,
+		ringZeroClientInstanceId: ringZeroActive ? getCodexAppServerClientInstanceId(params.client) : void 0,
+		ringZeroConfigFingerprint,
+		restrictedToolSurface,
+		restrictedToolSurfaceInheritedMcpServerNames,
+		userMcpServersConfigPatch,
+		userMcpServersFingerprint,
+		webSearchThreadConfigFingerprint
+	};
+}
+//#endregion
 //#region extensions/codex/src/app-server/thread-supervision.ts
 async function materializePendingSupervisionBranch(params) {
 	let pending = params.binding.pendingSupervisionBranch;
@@ -3061,6 +3781,32 @@ async function materializePendingSupervisionBranch(params) {
 	});
 	let bindingCommitted = false;
 	let provisionalCleanupSafe = true;
+	let cleanupExpected = pending;
+	const trackPendingSupervisionArtifacts = async (cleanupThreadIds) => {
+		const expected = pending;
+		pending = withPendingSupervisionCleanup(pending, cleanupThreadIds);
+		let updated;
+		try {
+			updated = await params.bindingStore.mutate(params.bindingIdentity, {
+				kind: "patch-pending-supervision-branch",
+				expected,
+				pending
+			});
+		} catch (error) {
+			try {
+				const current = await params.bindingStore.read(params.bindingIdentity);
+				if (matchesPendingSupervisionState(current, pending)) cleanupExpected = pending;
+				else if (matchesPendingSupervisionState(current, expected)) cleanupExpected = expected;
+				else throw new CodexThreadBindingConflictError(pending.sourceThreadId, "verifying supervised Codex cleanup tracking");
+			} catch (verificationError) {
+				provisionalCleanupSafe = false;
+				throw new CodexAppServerUnsafeSubscriptionError(`Codex supervised branch cleanup tracking could not be verified: ${cleanupThreadIds.join(", ")}`, { cause: new AggregateError([error, verificationError], void 0, { cause: error }) });
+			}
+			throw error;
+		}
+		cleanupExpected = updated ? pending : void 0;
+		if (!updated) throw new CodexThreadBindingConflictError(pending.sourceThreadId, "tracking supervised Codex branch cleanup");
+	};
 	try {
 		const probeParams = buildPendingSupervisionProbeForkParams(params, pending);
 		const rawProbeResponse = await params.lifecycleTiming.measure("supervision-model-probe-fork", async () => {
@@ -3076,10 +3822,17 @@ async function materializePendingSupervisionBranch(params) {
 			sourceThreadId: pending.sourceThreadId,
 			role: "model probe"
 		});
-		pending = await trackPendingSupervisionArtifacts(params, pending, [probeThreadId]);
+		let probeResponse;
+		try {
+			params.throwIfAborted();
+			probeResponse = assertCodexThreadForkResponse(rawProbeResponse);
+			if (params.restrictedToolSurface) await params.lifecycleTiming.measure("restricted-tool-surface-mcp-attestation", () => attestCodexRestrictedToolSurfaceMcpServersDisabled(params.client, probeThreadId, probeParams.config ?? void 0, params.signal));
+		} finally {
+			await unsubscribeCodexAppServerLiveThread(params.client, probeThreadId, CODEX_APP_SERVER_UNSUBSCRIBE_TIMEOUT_MS).catch((cause) => {
+				throw new CodexAppServerUnsafeSubscriptionError(`Codex model probe subscription could not be released: ${probeThreadId}`, { cause });
+			});
+		}
 		params.throwIfAborted();
-		const probeResponse = assertCodexThreadForkResponse(rawProbeResponse);
-		if (params.restrictedToolSurface) await params.lifecycleTiming.measure("restricted-tool-surface-mcp-attestation", () => attestCodexRestrictedToolSurfaceMcpServersDisabled(params.client, probeThreadId, probeParams.config ?? void 0, params.signal));
 		const nativeModel = requireNonBlankSupervisionValue(probeResponse.model, "native model");
 		const nativeModelProvider = requireNativeSupervisionModelProvider({
 			responseModelProvider: probeResponse.modelProvider,
@@ -3102,7 +3855,9 @@ async function materializePendingSupervisionBranch(params) {
 			model: nativeModel,
 			modelProvider: nativeModelProvider,
 			hostSystemAgentActive: params.hostSystemAgentActive,
-			restrictedToolSurfaceInheritedMcpServerNames: params.restrictedToolSurfaceInheritedMcpServerNames
+			restrictedToolSurfaceInheritedMcpServerNames: params.restrictedToolSurfaceInheritedMcpServerNames,
+			shellEnvironment: params.shellEnvironment,
+			disableLoginShell: params.disableLoginShell
 		});
 		assertExactSupervisionModelSelection(startParams, {
 			model: nativeModel,
@@ -3123,7 +3878,7 @@ async function materializePendingSupervisionBranch(params) {
 			otherThreadId: probeThreadId,
 			role: "canonical branch"
 		});
-		pending = await trackPendingSupervisionArtifacts(params, pending, [probeThreadId, finalThreadId]);
+		await trackPendingSupervisionArtifacts([finalThreadId]);
 		params.throwIfAborted();
 		assertExactSupervisionModelSelection(assertCodexThreadStartResponse(rawStartResponse), {
 			model: nativeModel,
@@ -3143,11 +3898,11 @@ async function materializePendingSupervisionBranch(params) {
 				client: params.client,
 				threadId: finalThreadId,
 				ephemeral: startParams.ephemeral === true
-			}) || !await archiveSupervisionArtifact(params.client, probeThreadId)) {
+			})) {
 				provisionalCleanupSafe = false;
 				throw new CodexAppServerUnsafeSubscriptionError("Codex supervised plugin app attestation cleanup failed", { cause: error });
 			}
-			pending = await trackPendingSupervisionArtifacts(params, pending, []);
+			await trackPendingSupervisionArtifacts([]);
 			throw error;
 		}
 		if (history.responseItems.length > 0) {
@@ -3157,8 +3912,6 @@ async function materializePendingSupervisionBranch(params) {
 			}, { signal: params.signal }));
 			params.throwIfAborted();
 		}
-		if (!await archiveSupervisionArtifact(params.client, probeThreadId)) throw new Error(`Failed to archive temporary Codex model probe: ${probeThreadId}`);
-		pending = await trackPendingSupervisionArtifacts(params, pending, [finalThreadId]);
 		const historyCoveredThrough = (/* @__PURE__ */ new Date()).toISOString();
 		const bindingModelProvider = params.normalizeBindingModelProvider(params.attempt.authProfileId, nativeModelProvider);
 		let committed = false;
@@ -3220,31 +3973,28 @@ async function materializePendingSupervisionBranch(params) {
 		};
 	} catch (error) {
 		if (bindingCommitted) throw error;
-		if (error instanceof CodexThreadBindingConflictAfterCleanupError) throw error;
 		if (!provisionalCleanupSafe) {
 			await params.abandonClient();
 			throw error;
 		}
 		const cleanup = await cleanPendingSupervisionArtifacts(params.client, pending);
+		const nextPending = withPendingSupervisionCleanup(pending, cleanup.remaining);
 		let cleanupStateError;
-		if (cleanup.remaining.length !== (pending.cleanupThreadIds?.length ?? 0)) {
-			const nextPending = withPendingSupervisionCleanup(pending, cleanup.remaining);
-			try {
-				if (await params.bindingStore.mutate(params.bindingIdentity, {
-					kind: "patch-pending-supervision-branch",
-					expected: pending,
-					pending: nextPending
-				})) pending = nextPending;
-			} catch (stateError) {
-				cleanupStateError = stateError;
-			}
+		if (cleanupExpected && !isDeepStrictEqual(cleanupExpected, nextPending)) try {
+			await params.bindingStore.mutate(params.bindingIdentity, {
+				kind: "patch-pending-supervision-branch",
+				expected: cleanupExpected,
+				pending: nextPending
+			});
+		} catch (stateError) {
+			cleanupStateError = stateError;
 		}
 		const unsafeCleanup = cleanup.remaining.length > 0 || isCodexAppServerUnsafeSubscriptionError(error);
 		if (unsafeCleanup) await params.abandonClient();
 		if (cleanupStateError) {
-			const cause = new AggregateError([error, cleanupStateError]);
+			const cause = new AggregateError([error, cleanupStateError], "Codex supervised branch cleanup state could not be recorded", { cause: error });
 			if (unsafeCleanup) throw new CodexAppServerUnsafeSubscriptionError("Codex supervised branch cleanup state could not be recorded", { cause });
-			throw new AggregateError([error, cleanupStateError], "Codex supervised branch cleanup state could not be recorded", { cause: error });
+			throw cause;
 		}
 		if (cleanup.remaining.length > 0) throw new CodexAppServerUnsafeSubscriptionError(`Codex supervised branch cleanup remains pending: ${cleanup.remaining.join(", ")}`, { cause: error });
 		throw error;
@@ -3258,7 +4008,9 @@ function buildPendingSupervisionProbeForkParams(params, pending) {
 		webSearchAllowed: params.webSearchAllowed,
 		appServer: params.appServer,
 		hostSystemAgentActive: params.hostSystemAgentActive,
-		restrictedToolSurfaceInheritedMcpServerNames: params.restrictedToolSurfaceInheritedMcpServerNames
+		restrictedToolSurfaceInheritedMcpServerNames: params.restrictedToolSurfaceInheritedMcpServerNames,
+		shellEnvironment: params.shellEnvironment,
+		disableLoginShell: params.disableLoginShell
 	});
 	return {
 		threadId: pending.sourceThreadId,
@@ -3270,7 +4022,7 @@ function buildPendingSupervisionProbeForkParams(params, pending) {
 		...params.appServer.serviceTier !== void 0 ? { serviceTier: params.appServer.serviceTier } : {},
 		config: runtimeConfig,
 		developerInstructions: params.developerInstructions ?? buildDeveloperInstructions(params.attempt, { dynamicTools: params.dynamicTools }),
-		ephemeral: isIncognitoSessionKey(params.attempt.sessionKey),
+		ephemeral: true,
 		threadSource: "appServer",
 		excludeTurns: true
 	};
@@ -3312,10 +4064,8 @@ function requireDistinctSupervisionThreadId(params) {
 	return threadId;
 }
 function readSupervisionResponseThreadId(value) {
-	if (!value || typeof value !== "object" || Array.isArray(value)) return;
-	const thread = value.thread;
-	if (!thread || typeof thread !== "object" || Array.isArray(thread)) return;
-	return thread.id;
+	const thread = isRecord(value) ? value.thread : void 0;
+	return isRecord(thread) ? thread.id : void 0;
 }
 async function recoverPendingSupervisionArtifacts(params, pending) {
 	if (!pending.cleanupThreadIds?.length) return pending;
@@ -3338,20 +4088,6 @@ async function recoverPendingSupervisionArtifacts(params, pending) {
 	})) throw new CodexThreadBindingConflictError(pending.sourceThreadId, "recovering a supervised Codex branch");
 	return next;
 }
-async function trackPendingSupervisionArtifacts(params, pending, cleanupThreadIds) {
-	const next = withPendingSupervisionCleanup(pending, cleanupThreadIds);
-	if (!await params.bindingStore.mutate(params.bindingIdentity, {
-		kind: "patch-pending-supervision-branch",
-		expected: pending,
-		pending: next
-	})) {
-		const cleanupFailed = [];
-		for (const threadId of cleanupThreadIds) if (!await archiveSupervisionArtifact(params.client, threadId)) cleanupFailed.push(threadId);
-		if (cleanupFailed.length > 0) throw new CodexAppServerUnsafeSubscriptionError(`Codex supervised branch CAS cleanup failed: ${cleanupFailed.join(", ")}`);
-		throw new CodexThreadBindingConflictAfterCleanupError(pending.sourceThreadId, "tracking supervised Codex branch cleanup");
-	}
-	return next;
-}
 function withPendingSupervisionCleanup(pending, cleanupThreadIds) {
 	return {
 		sourceThreadId: pending.sourceThreadId,
@@ -3388,15 +4124,10 @@ async function archiveSupervisionArtifact(client, threadId) {
 async function startOrResumeThread(params) {
 	const incognito = isIncognitoSessionKey(params.params.sessionKey);
 	const clientId = resolveCodexAppServerClientInstanceId(params.client);
-	const bindingIdentity = sessionBindingIdentity({
-		sessionId: params.params.sessionId,
-		sessionKey: params.params.sessionKey,
-		agentId: params.agentId ?? params.params.agentId,
-		config: params.params.config
-	});
-	return await params.bindingStore.withLease(bindingIdentity, async () => {
-		const { contextEngineBinding, dynamicToolsContainDeferred, dynamicToolsFingerprint, environmentSelectionFingerprint, hostSystemAgentActive, legacyDynamicToolsFingerprint, legacyUserMcpServersFingerprint, lifecycleTiming, nativeSkillIsolation, nativeSkillIsolationFingerprint, networkProxyConfigFingerprint, ringZeroActive, ringZeroClientInstanceId, ringZeroConfigFingerprint, restrictedToolSurface, restrictedToolSurfaceInheritedMcpServerNames, userMcpServersConfigPatch, userMcpServersFingerprint, webSearchThreadConfigFingerprint } = await prepareCodexThreadLifecyclePreflight(params);
-		let binding = await lifecycleTiming.measure("read-binding", () => params.bindingStore.read(bindingIdentity));
+	return await withCodexThreadLifecycleBinding(params, async (bindingIdentity, currentBinding) => {
+		let binding = currentBinding;
+		const preflight = await prepareCodexThreadLifecyclePreflight(params);
+		const { contextEngineBinding, dynamicToolsContainDeferred, dynamicToolsFingerprint, environmentSelectionFingerprint, hostSystemAgentActive, legacyDynamicToolsFingerprint, legacyUserMcpServersFingerprint, lifecycleTiming, nativeSkillIsolation, nativeSkillIsolationFingerprint, networkProxyConfigFingerprint, ringZeroActive, ringZeroClientInstanceId, ringZeroConfigFingerprint, restrictedToolSurface, restrictedToolSurfaceInheritedMcpServerNames, userMcpServersConfigPatch, userMcpServersFingerprint, webSearchThreadConfigFingerprint } = preflight;
 		let replacementPredecessor;
 		const initialBoundThreadId = binding?.threadId;
 		const initialBoundClientId = binding?.clientId;
@@ -3408,26 +4139,33 @@ async function startOrResumeThread(params) {
 			config: params.params.config
 		});
 		const throwIfAborted = () => throwIfCodexThreadLifecycleAborted(params.signal);
-		const releaseRetainedThread = async (threadId, ownerClientId = initialBoundClientId) => {
+		const releaseRetainedThread = async (threadId, ownerClientId = initialBoundClientId, assertCurrent) => {
 			if (ownerClientId && ownerClientId !== clientId) {
 				const previousClient = retainSharedCodexAppServerClientByInstanceId(ownerClientId);
-				if (!previousClient) return;
+				if (!previousClient) return false;
 				try {
-					await releaseCodexRetainedLiveThread({
+					const assertPrevious = assertCurrent ? captureExclusiveSharedCodexAppServerClient(previousClient.client) : void 0;
+					if (isCodexAppServerLiveThreadClaimed(previousClient.client, threadId)) throw new Error(`Codex thread ${threadId} is claimed by active work; stop it first.`);
+					return await releaseCodexRetainedLiveThread({
 						client: previousClient.client,
 						lifecycleTiming,
-						threadId
+						threadId,
+						assertCurrent: assertCurrent ? () => {
+							assertCurrent();
+							assertPrevious?.();
+						} : void 0
 					});
 				} finally {
 					previousClient.release();
 				}
-				return;
 			}
-			await releaseCodexRetainedLiveThread({
+			if (isCodexAppServerLiveThreadClaimed(params.client, threadId)) throw new Error(`Codex thread ${threadId} is claimed by active work; stop it first.`);
+			return await releaseCodexRetainedLiveThread({
 				client: params.client,
 				abandonClient: params.abandonClient,
 				lifecycleTiming,
-				threadId
+				threadId,
+				assertCurrent
 			});
 		};
 		if (!binding && bindingIdentity.kind === "session" && bindingIdentity.sessionKey) {
@@ -3465,6 +4203,8 @@ async function startOrResumeThread(params) {
 				hostSystemAgentActive,
 				restrictedToolSurface,
 				restrictedToolSurfaceInheritedMcpServerNames,
+				shellEnvironment: params.shellEnvironment,
+				disableLoginShell: params.disableLoginShell,
 				environmentSelection: params.environmentSelection,
 				provisionalAppIds: pluginThreadConfig?.provisionalAppIds,
 				signal: params.signal,
@@ -3475,6 +4215,7 @@ async function startOrResumeThread(params) {
 					cwd: params.cwd,
 					...clientId ? { clientId } : {},
 					authProfileId: void 0,
+					agentWorkspaceDeveloperInstructions: params.agentWorkspaceDeveloperInstructions,
 					preserveNativeModel: true,
 					dynamicToolsFingerprint,
 					dynamicToolsContainDeferred,
@@ -3506,6 +4247,36 @@ async function startOrResumeThread(params) {
 			})) throw new CodexThreadBindingConflictError(current.threadId, operation);
 			binding = void 0;
 		};
+		const resolveRequestContext = () => {
+			const startModelSelection = resolveCodexAppServerThreadModelSelection({
+				provider: params.params.provider,
+				model: params.runtimeModelId ?? params.params.modelId,
+				binding,
+				authProfileId: params.params.authProfileId,
+				authProfileStore: params.params.authProfileStore,
+				agentDir: params.params.agentDir,
+				config: params.params.config
+			});
+			return {
+				...preflight,
+				bindingIdentity,
+				startModelSelection,
+				startModelProvider: startModelSelection.modelProvider,
+				normalizeBindingModelProvider,
+				throwIfAborted
+			};
+		};
+		const transientDelegationRestriction = params.params.delegationCapability === "report_only";
+		const persistentWebSearchRestriction = params.webSearchAllowed === false && params.persistentWebSearchAllowed === false;
+		const transientNativeToolRestriction = params.nativeCodeModeEnabled === false && !persistentWebSearchRestriction;
+		const transientWebSearchRestriction = isTransientWebSearchRestriction(params);
+		if (binding?.pendingResumeConfiguration) return await resumePendingCodexThread(params, {
+			...resolveRequestContext(),
+			binding,
+			clearCurrentBinding,
+			releaseRetainedThread: (threadId, assertCurrent) => releaseRetainedThread(threadId, initialBoundClientId, assertCurrent),
+			transientRestriction: transientDelegationRestriction || transientNativeToolRestriction || transientWebSearchRestriction
+		});
 		if (binding?.threadId && !restrictedToolSurface && binding.nativeToolPolicyRestricted === true) await clearCurrentBinding("rotating a host-policy-restricted thread binding");
 		if (binding?.threadId && binding.nativeSkillIsolationFingerprint !== nativeSkillIsolationFingerprint) {
 			embeddedAgentLog.debug("codex app-server native skill isolation changed; starting a new thread", { threadId: binding.threadId });
@@ -3539,24 +4310,12 @@ async function startOrResumeThread(params) {
 			await clearCurrentBinding("rotating a GPT-5.6 multi-agent thread binding");
 			binding = void 0;
 		}
-		const startModelSelection = resolveCodexAppServerThreadModelSelection({
-			provider: params.params.provider,
-			model: params.params.modelId,
-			binding,
-			authProfileId: params.params.authProfileId,
-			authProfileStore: params.params.authProfileStore,
-			agentDir: params.params.agentDir,
-			config: params.params.config
-		});
-		const startModelProvider = startModelSelection.modelProvider;
-		const transientDelegationRestriction = params.params.delegationCapability === "report_only";
+		const requestContext = resolveRequestContext();
+		const { startModelSelection, startModelProvider } = requestContext;
 		let preserveExistingBinding = transientDelegationRestriction || !ringZeroActive && params.nativeProviderWebSearchSupport === "unknown" && !binding?.threadId;
 		let rotatedContextEngineBinding = false;
 		let prebuiltPluginThreadConfig;
 		const webSearchBindingChanged = binding?.threadId && binding.webSearchThreadConfigFingerprint !== webSearchThreadConfigFingerprint;
-		const persistentWebSearchRestriction = params.webSearchAllowed === false && params.persistentWebSearchAllowed === false;
-		const transientNativeToolRestriction = params.nativeCodeModeEnabled === false && !persistentWebSearchRestriction;
-		const transientWebSearchRestriction = isTransientWebSearchRestriction(params);
 		const explicitTransientWebSearchRestriction = params.webSearchAllowed === false && params.persistentWebSearchAllowed !== false && transientWebSearchRestriction;
 		const unknownProviderWebSearchSupport = params.nativeProviderWebSearchSupport === "unknown";
 		if (binding?.threadId && (params.configuredMcpOwnershipVersion === 1 && (binding.configuredMcpOwnershipVersion !== 1 || binding.dynamicToolsFingerprint === void 0 || binding.mcpServersFingerprint !== void 0 || binding.userMcpServersFingerprint !== void 0) || params.configuredMcpOwnershipVersion !== 1 && binding.configuredMcpOwnershipVersion === 1) && binding?.threadId) {
@@ -3727,31 +4486,11 @@ async function startOrResumeThread(params) {
 				userMcpServersConfigPatch
 			});
 			if (warmReuse.binding) return warmReuse.binding;
+			if (binding.preserveNativeModel === true) await assertAdoptedCodexThreadResumeAllowed(params, binding.threadId, requestContext);
 			await releaseRetainedThread(binding.threadId);
 			const resumed = await resumeExistingCodexThread(params, {
+				...requestContext,
 				binding,
-				bindingIdentity,
-				startModelSelection,
-				startModelProvider,
-				userMcpServersConfigPatch,
-				dynamicToolsFingerprint,
-				dynamicToolsContainDeferred,
-				webSearchThreadConfigFingerprint,
-				nativeSkillIsolationFingerprint,
-				userMcpServersFingerprint,
-				ringZeroConfigFingerprint,
-				ringZeroClientInstanceId,
-				networkProxyConfigFingerprint,
-				contextEngineBinding,
-				environmentSelectionFingerprint,
-				hostSystemAgentActive,
-				ringZeroActive,
-				restrictedToolSurface,
-				restrictedToolSurfaceInheritedMcpServerNames,
-				nativeSkillIsolation,
-				lifecycleTiming,
-				normalizeBindingModelProvider,
-				throwIfAborted,
 				clearCurrentBinding,
 				prebuiltFinalConfigPatch: warmReuse.prebuiltFinalConfigPatch,
 				prebuiltPluginThreadConfig
@@ -3760,28 +4499,7 @@ async function startOrResumeThread(params) {
 		}
 		if (initialBoundThreadId && !preserveExistingBinding && !replacementPredecessor) await releaseRetainedThread(initialBoundThreadId);
 		const started = await startFreshCodexThread(params, {
-			bindingIdentity,
-			startModelSelection,
-			startModelProvider,
-			userMcpServersConfigPatch,
-			dynamicToolsFingerprint,
-			dynamicToolsContainDeferred,
-			webSearchThreadConfigFingerprint,
-			nativeSkillIsolationFingerprint,
-			userMcpServersFingerprint,
-			ringZeroConfigFingerprint,
-			ringZeroClientInstanceId,
-			networkProxyConfigFingerprint,
-			contextEngineBinding,
-			environmentSelectionFingerprint,
-			hostSystemAgentActive,
-			ringZeroActive,
-			restrictedToolSurface,
-			restrictedToolSurfaceInheritedMcpServerNames,
-			nativeSkillIsolation,
-			lifecycleTiming,
-			normalizeBindingModelProvider,
-			throwIfAborted,
+			...requestContext,
 			prebuiltPluginThreadConfig,
 			preserveExistingBinding,
 			rotatedContextEngineBinding,
@@ -3855,9 +4573,10 @@ function buildTurnStartParams(params, options) {
 		input: [...buildCodexUserInput(options.promptText ?? params.prompt, params.images), ...options.explicitSkillInputs ?? []],
 		...additionalContext ? { additionalContext } : {},
 		cwd: options.cwd,
+		...options.appServer.sessionRoot ? { runtimeWorkspaceRoots: [options.appServer.sessionRoot] } : {},
 		approvalPolicy: options.appServer.approvalPolicy,
 		approvalsReviewer: options.appServer.approvalsReviewer,
-		...useThreadPermissionProfile ? {} : { sandboxPolicy: options.sandboxPolicy ?? codexSandboxPolicyForTurn(options.appServer.sandbox, options.cwd, options.appServer.start?.args) },
+		...useThreadPermissionProfile ? {} : { sandboxPolicy: options.sandboxPolicy ?? codexSandboxPolicyForTurn(options.appServer.sandbox, options.appServer.sessionRoot ?? options.cwd, options.appServer.start?.args) },
 		...modelSelection ? {
 			model: modelSelection.model,
 			personality: CODEX_NATIVE_PERSONALITY_NONE
@@ -3887,7 +4606,6 @@ function buildTurnCollaborationMode(params, options = {}) {
 function buildTurnScopedCollaborationInstructions(params, options = {}) {
 	const contextInstructions = joinPresentSections(options.turnScopedDeveloperInstructions, options.memoryCollaborationInstructions, options.skillsCollaborationInstructions);
 	if (params.trigger === "cron") return joinPresentSections(buildCronCollaborationInstructions(), contextInstructions);
-	if (params.trigger === "heartbeat") return joinPresentSections(buildHeartbeatCollaborationInstructions(), contextInstructions);
 	if (contextInstructions?.trim()) return joinPresentSections(buildDefaultCollaborationInstructions(), contextInstructions);
 	return null;
 }
@@ -3914,15 +4632,8 @@ function buildCronCollaborationInstructions() {
 		"Keep output concise and automation-oriented. Prefer the final command result or a short failure summary over status narration."
 	].join("\n\n");
 }
-function buildHeartbeatCollaborationInstructions() {
-	return [
-		"This is an OpenClaw heartbeat turn. Apply these instructions only to this heartbeat wake; ordinary chat turns should stay in Codex Default mode.",
-		"When you are ready to end the heartbeat, prefer the structured `heartbeat_respond` tool so OpenClaw can record the wake outcome and notification decision. If `heartbeat_respond` is not already available and `tool_search` is available, search for `heartbeat_respond`, load it, then call it. Use `notify=false` when nothing should visibly interrupt the user.",
-		GPT5_HEARTBEAT_PROMPT_OVERLAY
-	].join("\n\n");
-}
 function joinPresentSections(...sections) {
 	return sections.filter((section) => Boolean(section?.trim())).join("\n\n");
 }
 //#endregion
-export { resolveCodexDynamicToolsLoadingForRuntime as A, buildCodexPluginThreadConfigInputFingerprint as B, codexLegacyDynamicToolsFingerprint as C, isSystemAgentOnlyCodexDynamicToolAllowlist as D, isForcedPrivateQaCodexRuntime as E, projectContextEngineAssemblyForCodex as F, shouldBuildCodexPluginThreadConfig as G, buildDisabledAppsConfigPatch as H, resolveCodexContextEngineProjectionMaxChars as I, isOpenAiCuratedMarketplace as J, ensureCodexPluginActivation as K, resolveCodexContextEngineProjectionReserveTokens as L, isContextEngineBindingCompatible as M, fitCodexProjectedContextForTurnStart as N, normalizeCodexDynamicToolName as O, neutralizeCodexExplicitMentionSigils as P, buildCodexPluginAppsConfigPatchFromPolicyContext as R, codexDynamicToolsFingerprint as S, filterCodexDynamicToolsForDisabledNativeSurface as T, buildPluginAppPolicyContext as U, buildCodexPluginThreadConfigTimeoutFallback as V, mergeCodexThreadConfigs as W, pluginReadParams as X, isOpenAiCuratedMarketplaceName as Y, resolveRecoverableCodexPluginConfigKeys as Z, resolveCodexAppServerThreadModelSelection as _, isCodexAppServerProfilerEnabled as a, readCodexSupportedReasoningEfforts as b, buildCodexRingZeroThreadConfigPatch as c, buildCodexNativeWebSearchThreadConfig as d, resolveCodexWebSearchPlan as f, resolveCodexAppServerRequestModelSelection as g, resolveCodexAppServerModelProvider as h, startOrResumeThread as i, buildContextEngineBinding as j, resolveCodexDynamicToolsLoading as k, buildCodexRuntimeThreadConfig as l, CODEX_NATIVE_PERSONALITY_NONE as m, buildTurnStartParams as n, assertCodexRestrictedToolSurfaceHasNoManagedHooks as o, buildDeveloperInstructions as p, refreshCodexPluginRuntimeState as q, buildCodexUserInput as r, attestCodexRestrictedToolSurfaceMcpServersDisabled as s, buildTurnCollaborationMode as t, readCodexInheritedMcpServerNames as u, resolveCodexBindingModelProviderFallback as v, filterCodexDynamicTools as w, areCodexDynamicToolFingerprintsCompatible as x, resolveReasoningEffort as y, buildCodexPluginThreadConfig as z };
+export { resolveCodexContinuityProjectionMaxChars as $, readCodexSupportedReasoningEfforts as A, isMessageOnlyCodexSourceReply as B, buildCodexProjectDocThreadConfig as C, resolveCodexAppServerThreadModelSelection as D, resolveCodexAppServerRequestModelSelection as E, codexDynamicToolsFingerprint as F, buildContextEngineBinding as G, normalizeCodexDynamicToolName as H, codexLegacyDynamicToolsFingerprint as I, fitCodexProjectedContextForTurnStart as J, isContextEngineBindingCompatible as K, filterCodexDynamicTools as L, CODEX_MANAGED_THREAD_NAMESPACE as M, createCodexManagedThreadStore as N, resolveCodexBindingModelProviderFallback as O, areCodexDynamicToolFingerprintsCompatible as P, resolveCodexContextEngineProjectionReserveTokens as Q, filterCodexDynamicToolsForDisabledNativeSurface as R, buildDeveloperInstructions as S, resolveCodexAppServerModelProvider as T, resolveCodexDynamicToolsLoading as U, isSystemAgentOnlyCodexDynamicToolAllowlist as V, resolveCodexDynamicToolsLoadingForRuntime as W, projectContextEngineAssemblyForCodex as X, neutralizeCodexExplicitMentionSigils as Y, resolveCodexContextEngineProjectionMaxChars as Z, buildCodexRingZeroThreadConfigPatch as _, isCodexAppServerProfilerEnabled as a, buildPluginAppPolicyContext as at, buildCodexNativeWebSearchThreadConfig as b, buildCodexNativeHookRelayConfig as c, ensureCodexPluginActivation as ct, emitCodexNativePreToolUseFailureDiagnostic as d, isOpenAiCuratedMarketplaceName as dt, buildCodexPluginAppsConfigPatchFromPolicyContext as et, resolveCodexNativeHookRelayEvents as f, pluginReadParams as ft, attestCodexRestrictedToolSurfaceMcpServersDisabled as g, assertCodexManagedRequirementsDoNotOverrideToolPolicy as h, startOrResumeThread as i, buildDisabledAppsConfigPatch as it, CODEX_MANAGED_THREAD_MAX_ENTRIES as j, resolveReasoningEffort as k, buildCodexNativeHookRelayDisabledConfig as l, refreshCodexPluginRuntimeState as lt, scheduleCodexNativeHookRelayUnregister as m, buildTurnStartParams as n, buildCodexPluginThreadConfigInputFingerprint as nt, CODEX_NATIVE_HOOK_RELAY_EVENTS as o, mergeCodexThreadConfigs as ot, resolveCodexNativeHookRelayTtlMs as p, resolveRecoverableCodexPluginConfigKeys as pt, buildCodexContinuityCalibration as q, buildCodexUserInput as r, buildCodexPluginThreadConfigTimeoutFallback as rt, CODEX_NATIVE_HOOK_RELAY_TTL_GRACE_MS as s, shouldBuildCodexPluginThreadConfig as st, buildTurnCollaborationMode as t, buildCodexPluginThreadConfig as tt, createCodexNativeHookRelay as u, isOpenAiCuratedMarketplace as ut, buildCodexRuntimeThreadConfig as v, CODEX_NATIVE_PERSONALITY_NONE as w, resolveCodexWebSearchPlan as x, readCodexInheritedMcpServerNames as y, isForcedPrivateQaCodexRuntime as z };