@openclaw/codex 2026.8.1-beta.2 → 2026.8.1

package/dist/{dynamic-tools-BVdyWkUD.js → dynamic-tools-BFoUcRdx.js}

@@ -1,811 +1,39 @@
-import { C as isCodexRemoteExecPlacementSandbox, T as readCodexPluginConfig } from "./session-binding-DPxIvMgE.js";
-import { S as resolveCodexGatewayTimeoutWithGraceMs, ct as isJsonObject, l as releaseLeasedSharedCodexAppServerClient, ot as CODEX_OPENCLAW_DIRECT_DYNAMIC_TOOL_NAMESPACE } from "./shared-client-kIBbGjk4.js";
-import { E as itemStatus, F as readItem, b as auditNativeToolUnfinishedStatus, h as isCodexNotificationForTurn, v as auditNativeToolName, y as auditNativeToolTerminalStatus } from "./attempt-client-cleanup-DMLXUfa8.js";
-import { l as readCodexTurn } from "./protocol-validators-B4F7L8Rf.js";
-import { D as isSystemAgentOnlyCodexDynamicToolAllowlist, E as isForcedPrivateQaCodexRuntime, O as normalizeCodexDynamicToolName, T as filterCodexDynamicToolsForDisabledNativeSurface, f as resolveCodexWebSearchPlan, w as filterCodexDynamicTools } from "./thread-lifecycle-Bu1BTDXr.js";
+import { C as isCodexRemoteExecPlacementSandbox, T as readCodexPluginConfig } from "./config-Cxw3Cl3k.js";
+import { Bt as CODEX_OPENCLAW_DIRECT_DYNAMIC_TOOL_NAMESPACE, Ht as isJsonObject, dt as resolveCodexToolAbortTerminalReason, et as createCodexElicitationResponse, ft as createFailedDynamicToolResponse, h as releaseLeasedSharedCodexAppServerClient, mt as withDynamicToolTranscriptDetails, pt as withDynamicToolExecutionState } from "./shared-client-kNkljY-R.js";
+import { d as readCodexTurn } from "./protocol-validators-Bg5rpNxk.js";
+import { D as itemStatus, I as readItem, b as auditNativeToolTerminalStatus, g as isCodexNotificationForTurn, x as auditNativeToolUnfinishedStatus, y as auditNativeToolName } from "./attempt-client-cleanup-CVPvp9dL.js";
+import { H as normalizeCodexDynamicToolName, L as filterCodexDynamicTools, R as filterCodexDynamicToolsForDisabledNativeSurface, V as isSystemAgentOnlyCodexDynamicToolAllowlist, d as emitCodexNativePreToolUseFailureDiagnostic, x as resolveCodexWebSearchPlan, z as isForcedPrivateQaCodexRuntime } from "./thread-lifecycle-Ss-uwnC4.js";
+import { l as resolveCodexNativeExecutionPolicy, u as resolveCodexNodeExecToolOverrides } from "./request-CCm4LaED.js";
 import { r as sanitizeInlineImageDataUrl, t as invalidInlineImageText } from "./image-payload-sanitizer-CnfoUPCE.js";
-import { r as formatCodexDisplayText } from "./command-formatters-B1AEz8ZA.js";
-import { a as resolveCodexNodeExecToolOverrides, i as resolveCodexNativeExecutionPolicy } from "./sandbox-guard-Cmwc9eIk.js";
+import { r as formatCodexDisplayText } from "./command-formatters-C54Yg3eA.js";
+import { a as sanitizeCodexApprovalVisibleText, c as waitForPluginApprovalDecision, i as requestPluginApproval, n as codexApprovalTimeoutText, o as stripDanglingCodexApprovalTerminalSequence, r as mapExecDecisionToOutcome, s as truncateCodexApprovalDisplayText, t as approvalRequestExplicitlyUnavailable } from "./plugin-approval-roundtrip-D80UZiJ_.js";
 import { asNonArrayRecord, asOptionalRecord, isRecord, normalizeOptionalString, normalizeTrimmedStringList, readStringField } from "openclaw/plugin-sdk/string-coerce-runtime";
+import { validateJsonSchemaValue } from "openclaw/plugin-sdk/json-schema-runtime";
 import path, { posix } from "node:path";
 import { createDeferred } from "openclaw/plugin-sdk/extension-shared";
-import { addTimerTimeoutGraceMs, asDateTimestampMs, finiteSecondsToTimerSafeMilliseconds, parseStrictNonNegativeInteger } from "openclaw/plugin-sdk/number-runtime";
-import { HEARTBEAT_RESPONSE_TOOL_NAME, buildAgentHookContextChannelFields, buildEmbeddedAttemptToolRunContext, consumeAdjustedParamsForToolCall, consumePreExecutionBlockedToolCall, createAgentToolResultMiddlewareRunner, createCodexAppServerToolResultExtensionRunner, embeddedAgentLog, extractMessagingToolSend, extractMessagingToolSendResult, extractToolResultMediaArtifact, filterProviderNormalizableTools, filterToolResultMediaUrls, finalizeToolTerminalPresentation, formatApprovalDisplayPath, formatToolExecutionErrorMessage, getBeforeToolCallFailureDisposition, getChannelAgentToolMeta, getPluginToolMeta, hasNativeHookRelayInvocation, invokeNativeHookRelay, isDeliveredMessageToolOnlySourceReplyResult, isDeliveredMessagingToolResult, isHostScopedAgentToolActive, isMessagingTool, isMessagingToolSendAction, isReplaySafeToolCall, isSubagentSessionKey, isToolResultError, isToolWrappedWithBeforeToolCallHook, normalizeAgentRuntimeTools, normalizeHeartbeatToolResponse, projectRuntimeToolInputSchema, resolveAttemptSpawnWorkspaceDir, resolveModelAuthMode, resolveNativeHookRelayDeferredToolApproval, resolveToolExecutionErrorKind, resolveToolResultFailureKind, runAgentHarnessAfterToolCallHook, sanitizeToolResult, setBeforeToolCallDiagnosticsEnabled, supportsModelTools, wrapToolWithBeforeToolCallHook } from "openclaw/plugin-sdk/agent-harness-runtime";
+import { asDateTimestampMs } from "openclaw/plugin-sdk/number-runtime";
+import { HEARTBEAT_RESPONSE_TOOL_NAME, buildAgentHookContextChannelFields, buildEmbeddedAttemptToolRunContext, consumeAdjustedParamsForToolCall, consumePreExecutionBlockedToolCall, createAgentToolResultMiddlewareRunner, createCodexAppServerToolResultExtensionRunner, embeddedAgentLog, extractMessagingToolSend, extractMessagingToolSendResult, extractToolResultMediaArtifact, filterProviderNormalizableTools, filterToolResultMediaUrls, finalizeToolTerminalPresentation, formatApprovalDisplayPath, formatToolExecutionErrorMessage, getBeforeToolCallFailureDisposition, getChannelAgentToolMeta, getPluginToolMeta, getPluginToolSideEffectOwnerKey, hasNativeHookRelayInvocation, invokeNativeHookRelay, isDeliveredMessageToolOnlySourceReplyResult, isDeliveredMessagingToolResult, isHostScopedAgentToolActive, isMessagingTool, isMessagingToolSendAction, isReplaySafeToolCall, isSubagentSessionKey, isToolResultError, isToolWrappedWithBeforeToolCallHook, normalizeAgentRuntimeTools, normalizeHeartbeatToolResponse, projectRuntimeToolInputSchema, resolveAttemptSpawnWorkspaceDir, resolveModelAuthMode, resolveNativeHookRelayDeferredToolApproval, resolveToolExecutionErrorKind, resolveToolResultFailureKind, runAgentHarnessAfterToolCallHook, sanitizeToolResult, setBeforeToolCallDiagnosticsEnabled, supportsModelTools, wrapToolWithBeforeToolCallHook } from "openclaw/plugin-sdk/agent-harness-runtime";
 import { createHash, randomUUID } from "node:crypto";
 import { resolveAgentDir as resolveAgentDir$1 } from "openclaw/plugin-sdk/agent-runtime";
+import { formatErrorMessage as formatErrorMessage$1, redactSensitiveText } from "openclaw/plugin-sdk/security-runtime";
+import { killProcessTree } from "openclaw/plugin-sdk/process-runtime";
 import { SsrFBlockedError, isBlockedHostnameOrIp } from "openclaw/plugin-sdk/ssrf-runtime";
 import { spawn } from "node:child_process";
-import { coerceErrorMessage, isApprovalNotFoundError, toErrorObject } from "openclaw/plugin-sdk/error-runtime";
-import { DEFAULT_MAX_LIVE_TOOL_RESULT_CHARS, estimateToolResultTextChars, resolveLiveToolResultMaxChars, sliceToolResultTextToBudget, sliceUtf16Safe, truncateUtf16Safe } from "openclaw/plugin-sdk/text-utility-runtime";
 import { once } from "node:events";
+import { coerceErrorMessage } from "openclaw/plugin-sdk/error-runtime";
+import { DEFAULT_MAX_LIVE_TOOL_RESULT_CHARS, estimateToolResultTextChars, resolveLiveToolResultMaxChars, sliceToolResultTextToBudget, sliceUtf16Safe, truncateUtf16Safe } from "openclaw/plugin-sdk/text-utility-runtime";
+import { emitTrustedDiagnosticEvent } from "openclaw/plugin-sdk/diagnostic-runtime";
 import { isIP } from "node:net";
 import { WebSocketServer } from "ws";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { expectDefined } from "openclaw/plugin-sdk/expect-runtime";
-import { runWithCronCreatorAuthorityCapabilityResolver } from "openclaw/plugin-sdk/codex-mcp-projection";
-import { emitTrustedDiagnosticEvent, hasPendingInternalDiagnosticEvent } from "openclaw/plugin-sdk/diagnostic-runtime";
-import { isToolAllowed, sanitizeEnvVars } from "openclaw/plugin-sdk/sandbox";
+import { redactToolPayloadText } from "openclaw/plugin-sdk/logging-core";
+import { isPathStrictlyInside, root } from "openclaw/plugin-sdk/file-access-runtime";
+import { buildRemoteCommand, isToolAllowed, sanitizeEnvVars } from "openclaw/plugin-sdk/sandbox";
+import { pinExecToolTarget, resolveCodexScheduledToolProjectionFactory, runWithCronCreatorAuthorityCapabilityResolver } from "openclaw/plugin-sdk/codex-mcp-projection";
 import { saveMediaBuffer } from "openclaw/plugin-sdk/media-store";
-import { registerRetainedNativeHookRelayForBundledRuntime } from "openclaw/plugin-sdk/native-hook-relay-runtime";
-import { root } from "openclaw/plugin-sdk/file-access-runtime";
 import { getMediaDir } from "openclaw/plugin-sdk/media-runtime";
 import { normalizeOpenAIToolSchemas } from "openclaw/plugin-sdk/provider-tools";
-//#region extensions/codex/src/app-server/dynamic-tool-response-state.ts
-/** Retains the host-owned app preview without adding it to Codex's response payload. */
-function withDynamicToolTranscriptDetails(response, details) {
-	if (!details || typeof details !== "object" || Array.isArray(details)) return response;
-	const mcpAppPreview = details.mcpAppPreview;
-	if (!mcpAppPreview || typeof mcpAppPreview !== "object" || Array.isArray(mcpAppPreview)) return response;
-	Object.defineProperty(response, "transcriptDetails", {
-		configurable: true,
-		enumerable: false,
-		value: { mcpAppPreview }
-	});
-	return response;
-}
-function withDynamicToolTerminalResolution(response, terminalResolution) {
-	if (terminalResolution) {
-		Object.defineProperties(response, {
-			terminalResolution: {
-				configurable: true,
-				enumerable: false,
-				value: terminalResolution
-			},
-			executionStarted: {
-				configurable: true,
-				enumerable: false,
-				value: terminalResolution.executionStarted
-			},
-			...terminalResolution.executedArguments ? { executedArguments: {
-				configurable: true,
-				enumerable: false,
-				value: terminalResolution.executedArguments
-			} } : {}
-		});
-		withDynamicToolSideEffectEvidence(response, terminalResolution.sideEffectEvidence);
-	}
-	return response;
-}
-function withDynamicToolExecutionState(response, state) {
-	Object.defineProperties(response, {
-		executedArguments: {
-			configurable: true,
-			enumerable: false,
-			value: state.executedArguments
-		},
-		executionStarted: {
-			configurable: true,
-			enumerable: false,
-			value: state.executionStarted
-		}
-	});
-	return withDynamicToolSideEffectEvidence(response, state.sideEffectEvidence === true);
-}
-function withDynamicToolSideEffectEvidence(response, sideEffectEvidence) {
-	if (!sideEffectEvidence) {
-		delete response.sideEffectEvidence;
-		return response;
-	}
-	Object.defineProperty(response, "sideEffectEvidence", {
-		configurable: true,
-		enumerable: false,
-		value: true
-	});
-	return response;
-}
-function createFailedDynamicToolResponse(message, options) {
-	const response = {
-		contentItems: [{
-			type: "inputText",
-			text: message
-		}],
-		success: false
-	};
-	Object.defineProperties(response, {
-		diagnosticTerminalReason: {
-			configurable: true,
-			enumerable: false,
-			value: options?.terminalReason ?? "failed"
-		},
-		diagnosticTerminalType: {
-			configurable: true,
-			enumerable: false,
-			value: "error"
-		}
-	});
-	if (options?.executionStarted !== void 0) Object.defineProperty(response, "executionStarted", {
-		configurable: true,
-		enumerable: false,
-		value: options.executionStarted
-	});
-	if (options?.executedArguments !== void 0) Object.defineProperty(response, "executedArguments", {
-		configurable: true,
-		enumerable: false,
-		value: options.executedArguments
-	});
-	return withDynamicToolSideEffectEvidence(response, options?.sideEffectEvidence === true);
-}
-//#endregion
-//#region extensions/codex/src/app-server/tool-abort-terminal-reason.ts
-/** Leaf helper shared by native and dynamic tool diagnostics. */
-const CODEX_TIMEOUT_ABORT_REASONS = /* @__PURE__ */ new Set([
-	"codex_startup_timeout",
-	"turn_completion_idle_timeout",
-	"turn_progress_idle_timeout",
-	"turn_terminal_idle_timeout"
-]);
-/** Preserves timeout provenance when an enclosing run aborts an active tool. */
-function resolveCodexToolAbortTerminalReason(signal) {
-	try {
-		const reason = signal.reason;
-		if (typeof reason === "string") {
-			if (CODEX_TIMEOUT_ABORT_REASONS.has(reason)) return "timed_out";
-			return reason === "client_closed" ? "failed" : "cancelled";
-		}
-		if (reason && typeof reason === "object") {
-			const record = reason;
-			if (record.name === "TimeoutError" || record.reason === "timeout") return "timed_out";
-		}
-	} catch {
-		return "cancelled";
-	}
-	return "cancelled";
-}
-//#endregion
-//#region extensions/codex/src/app-server/dynamic-tool-execution.ts
-/**
-* Timeout, terminal-release, and diagnostic helpers for Codex dynamic tool
-* calls.
-*/
-/** Default timeout for Codex dynamic tool calls. */
-const CODEX_DYNAMIC_TOOL_TIMEOUT_MS = 9e4;
-/** Hard cap for per-call Codex dynamic tool timeout overrides. */
-const CODEX_DYNAMIC_TOOL_MAX_TIMEOUT_MS = 6e5;
-const CODEX_DYNAMIC_TOOL_TIMEOUT_SECONDS_GRACE_MS = 3e4;
-const CODEX_DYNAMIC_IMAGE_GENERATION_TOOL_TIMEOUT_MS = 12e4;
-const CODEX_DYNAMIC_COMPUTER_GATEWAY_TIMEOUT_MS = 3e4;
-const CODEX_DYNAMIC_COMPUTER_COMPLETION_GRACE_MS = 3e4;
-/** Timeout for image-understanding style dynamic tool calls. */
-const CODEX_DYNAMIC_IMAGE_TOOL_TIMEOUT_MS = 6e4;
-/** Timeout for message-delivery dynamic tool calls. */
-const CODEX_DYNAMIC_MESSAGE_TOOL_TIMEOUT_MS = 6e5;
-/** Outer default for collector waits: full swarm budget plus completion grace. */
-const CODEX_DYNAMIC_AGENTS_WAIT_TOOL_TIMEOUT_MS = 63e4;
-const LOG_FIELD_MAX_LENGTH = 160;
-function normalizeLogField(value) {
-	if (typeof value !== "string") return;
-	const normalized = value.replaceAll(String.fromCharCode(27), " ").replaceAll("\r", " ").replaceAll("\n", " ").replaceAll("	", " ").trim();
-	if (!normalized) return;
-	return normalized.length > LOG_FIELD_MAX_LENGTH ? `${truncateUtf16Safe(normalized, LOG_FIELD_MAX_LENGTH - 3)}...` : normalized;
-}
-function readNumericTimeoutMs(value) {
-	if (typeof value === "number" && Number.isFinite(value)) return Math.max(0, Math.floor(value));
-	if (typeof value === "string") {
-		const parsed = parseStrictNonNegativeInteger(value);
-		if (parsed !== void 0) return Math.max(0, Math.floor(parsed));
-	}
-}
-function formatDynamicToolTimeoutDetails(params) {
-	const tool = normalizeLogField(params.call.tool) ?? "unknown";
-	const baseMeta = {
-		tool: params.call.tool,
-		toolCallId: params.call.callId,
-		threadId: params.call.threadId,
-		turnId: params.call.turnId,
-		timeoutMs: params.timeoutMs,
-		timeoutKind: "codex_dynamic_tool_rpc"
-	};
-	if (tool !== "process" || !isJsonObject(params.call.arguments)) return {
-		responseMessage: `OpenClaw dynamic tool call timed out after ${params.timeoutMs}ms while running tool ${tool}.`,
-		consoleMessage: `codex dynamic tool timeout: tool=${tool} toolTimeoutMs=${params.timeoutMs}; per-tool-call watchdog, not session idle`,
-		meta: baseMeta
-	};
-	const action = normalizeLogField(params.call.arguments.action);
-	const sessionId = normalizeLogField(params.call.arguments.sessionId);
-	const requestedTimeoutMs = readNumericTimeoutMs(params.call.arguments.timeout);
-	const actionPart = action ? ` action=${action}` : "";
-	const sessionPart = sessionId ? ` sessionId=${sessionId}` : "";
-	const requestedPart = requestedTimeoutMs === void 0 ? "" : ` requestedWaitMs=${requestedTimeoutMs}`;
-	const retryHint = action === "poll" ? "; repeated lines usually mean process-poll retry churn, not model progress" : "";
-	const responseTarget = action || sessionId ? ` while waiting for process${actionPart}${sessionPart}` : " while waiting for the process tool";
-	return {
-		responseMessage: `OpenClaw dynamic tool call timed out after ${params.timeoutMs}ms${responseTarget}. This is a tool RPC timeout, not a session idle timeout.`,
-		consoleMessage: `codex process tool timeout:${actionPart}${sessionPart} toolTimeoutMs=${params.timeoutMs}${requestedPart}; per-tool-call watchdog, not session idle${retryHint}`,
-		meta: {
-			...baseMeta,
-			processAction: action,
-			processSessionId: sessionId,
-			processRequestedTimeoutMs: requestedTimeoutMs
-		}
-	};
-}
-/**
-* Runs a dynamic tool call with run-abort and per-call timeout handling,
-* returning a Codex protocol response instead of throwing.
-*/
-async function handleDynamicToolCallWithTimeout(params) {
-	let didNotifyAgentToolResult = false;
-	const conservativeRaceResponses = /* @__PURE__ */ new WeakSet();
-	const finalizeTerminal = (response) => {
-		const executionSnapshot = params.toolBridge.consumeToolExecutionSnapshot?.(params.call.callId);
-		const observedExecutionStarted = executionSnapshot?.executionStarted ?? (conservativeRaceResponses.has(response) ? void 0 : response.executionStarted);
-		const terminalResolution = params.observeToolTerminal?.({
-			toolCallId: params.call.callId,
-			toolName: params.call.tool,
-			arguments: response.executedArguments ?? executionSnapshot?.executedArguments ?? params.call.arguments,
-			...params.toolMeta ? { meta: params.toolMeta } : {},
-			...observedExecutionStarted !== void 0 ? { executionStarted: observedExecutionStarted } : {},
-			outcome: response.success ? "success" : "failure",
-			...!response.success ? { failure: { error: readDynamicToolResponseText(response) } } : {}
-		});
-		return withDynamicToolTerminalResolution(response, terminalResolution);
-	};
-	const createFailedAfterPossibleDispatch = (message, terminalReason) => {
-		const response = createFailedDynamicToolResponse(message, {
-			executionStarted: true,
-			sideEffectEvidence: true,
-			terminalReason
-		});
-		conservativeRaceResponses.add(response);
-		return response;
-	};
-	const notifyAgentToolResult = (event) => {
-		if (didNotifyAgentToolResult) return;
-		didNotifyAgentToolResult = true;
-		try {
-			params.onAgentToolResult?.(event);
-		} catch (error) {
-			embeddedAgentLog.warn(`onAgentToolResult handler failed: tool=${params.call.tool} error=${String(error)}`);
-		}
-	};
-	const notifyFailedToolResult = (message, terminalReason = "failed") => {
-		notifyAgentToolResult({
-			toolName: params.call.tool,
-			result: {
-				content: [{
-					type: "text",
-					text: message
-				}],
-				details: {
-					status: terminalReason,
-					error: message
-				}
-			},
-			isError: true
-		});
-	};
-	if (params.signal.aborted) {
-		const message = "OpenClaw dynamic tool call aborted before execution.";
-		const terminalReason = resolveCodexToolAbortTerminalReason(params.signal);
-		params.onFallbackSelected?.();
-		notifyFailedToolResult(message, terminalReason);
-		return finalizeTerminal(createFailedDynamicToolResponse(message, {
-			executionStarted: false,
-			terminalReason
-		}));
-	}
-	const controller = new AbortController();
-	let timeout;
-	let timedOut = false;
-	let resolveAbort;
-	const abortFromRun = () => {
-		const message = "OpenClaw dynamic tool call aborted.";
-		const terminalReason = resolveCodexToolAbortTerminalReason(params.signal);
-		params.onFallbackSelected?.();
-		controller.abort(params.signal.reason ?? /* @__PURE__ */ new Error(message));
-		notifyFailedToolResult(message, terminalReason);
-		resolveAbort?.(createFailedAfterPossibleDispatch(message, terminalReason));
-	};
-	const abortPromise = new Promise((resolve) => {
-		resolveAbort = resolve;
-	});
-	const timeoutPromise = new Promise((resolve) => {
-		const timeoutMs = clampDynamicToolTimeoutMs(params.timeoutMs);
-		timeout = setTimeout(() => {
-			timedOut = true;
-			const timeoutDetails = formatDynamicToolTimeoutDetails({
-				call: params.call,
-				timeoutMs
-			});
-			params.onFallbackSelected?.();
-			controller.abort(new Error(timeoutDetails.responseMessage));
-			params.onTimeout?.();
-			embeddedAgentLog.warn("codex dynamic tool call timed out", {
-				...timeoutDetails.meta,
-				consoleMessage: timeoutDetails.consoleMessage
-			});
-			notifyFailedToolResult(timeoutDetails.responseMessage, "timed_out");
-			resolve(createFailedAfterPossibleDispatch(timeoutDetails.responseMessage, "timed_out"));
-		}, timeoutMs);
-		timeout.unref?.();
-	});
-	try {
-		params.signal.addEventListener("abort", abortFromRun, { once: true });
-		if (params.signal.aborted) abortFromRun();
-		const response = await Promise.race([
-			params.toolBridge.handleToolCall(params.call, {
-				signal: controller.signal,
-				onAgentToolResult: notifyAgentToolResult,
-				toolCallOrdinal: params.toolCallOrdinal,
-				retainExecutionSnapshot: true
-			}),
-			abortPromise,
-			timeoutPromise
-		]);
-		if (!response.success && !didNotifyAgentToolResult) notifyFailedToolResult(readDynamicToolResponseText(response), response.diagnosticTerminalReason ?? "failed");
-		return finalizeTerminal(response);
-	} catch (error) {
-		const terminalReason = params.signal.aborted ? resolveCodexToolAbortTerminalReason(params.signal) : resolveToolExecutionErrorKind(error);
-		const message = formatToolExecutionErrorMessage(error, "OpenClaw dynamic tool call failed.");
-		notifyFailedToolResult(message, terminalReason);
-		return finalizeTerminal(createFailedAfterPossibleDispatch(message, terminalReason));
-	} finally {
-		if (timeout) clearTimeout(timeout);
-		params.signal.removeEventListener("abort", abortFromRun);
-		resolveAbort = void 0;
-		if (!timedOut && !controller.signal.aborted) controller.abort(/* @__PURE__ */ new Error("OpenClaw dynamic tool call finished."));
-	}
-}
-function readDynamicToolResponseText(response) {
-	return response.contentItems.flatMap((item) => item.type === "inputText" && typeof item.text === "string" ? [item.text] : []).join("\n").trim() || "OpenClaw dynamic tool call failed.";
-}
-/** Strips OpenClaw-only metadata before sending a dynamic tool response to Codex. */
-function toCodexDynamicToolProtocolResponse(response) {
-	return {
-		contentItems: response.contentItems,
-		success: response.success
-	};
-}
-/** Adds async-started progress details when a tool result continues out of band. */
-function toCodexDynamicToolProgressResponse(response, protocolResponse) {
-	const transcriptDetails = response.transcriptDetails;
-	if (response.asyncStarted !== true && transcriptDetails === void 0) return protocolResponse;
-	return {
-		...protocolResponse,
-		...transcriptDetails ? { details: transcriptDetails } : {},
-		...response.asyncStarted === true ? { details: {
-			...transcriptDetails,
-			async: true,
-			status: "started"
-		} } : {}
-	};
-}
-/** Decides whether a terminal dynamic tool response can release the Codex turn. */
-function shouldReleaseTurnAfterTerminalDynamicTool(state) {
-	return !state.completed && !state.aborted && state.responseSuccess && !state.currentTurnHadNonTerminalDynamicToolResult && state.activeAppServerTurnRequests === 0 && state.activeTurnItemIdsCount === 0 && state.pendingOpenClawDynamicToolCompletionIdsCount === 0;
-}
-/** Returns true when a non-async result should block terminal-release shortcuts. */
-function shouldBlockTerminalReleaseForNonTerminalDynamicToolResult(response) {
-	return response.asyncStarted !== true;
-}
-/** Resolves whether terminal diagnostic state should release, wait, or stay idle. */
-function resolveTerminalDynamicToolBatchAction(state) {
-	if (state.activeAppServerTurnRequests > 0 || state.activeTurnItemIdsCount > 0 || state.pendingOpenClawDynamicToolCompletionIdsCount > 0) return "wait";
-	if (state.currentTurnHadNonTerminalDynamicToolResult) return "clear-nonterminal-batch";
-	if (state.hasPendingTerminalDynamicToolRelease) return "release-pending-terminal";
-	return "idle";
-}
-/** Returns true for diagnostic events that terminate a dynamic tool call. */
-function isDynamicToolTerminalDiagnosticEvent(event) {
-	return event.type === "tool.execution.completed" || event.type === "tool.execution.error" || event.type === "tool.execution.blocked";
-}
-/** Matches terminal diagnostics to a specific dynamic tool call id/name. */
-function isMatchingDynamicToolTerminalDiagnostic(params) {
-	if (params.event.toolCallId !== params.call.callId || params.event.toolName !== params.call.tool) return false;
-	if (params.runId !== void 0) return params.event.runId === params.runId;
-	if (params.sessionId !== void 0) return params.event.sessionId === params.sessionId;
-	if (params.sessionKey !== void 0) return params.event.sessionKey === params.sessionKey;
-	return params.event.runId === void 0 && params.event.sessionId === void 0 && params.event.sessionKey === void 0;
-}
-/** Checks pending diagnostics for a terminal event matching a tool call. */
-function hasPendingDynamicToolTerminalDiagnostic(params) {
-	return hasPendingInternalDiagnosticEvent((event) => {
-		if (!isDynamicToolTerminalDiagnosticEvent(event)) return false;
-		return isMatchingDynamicToolTerminalDiagnostic({
-			event,
-			call: params.call,
-			runId: params.runId,
-			sessionId: params.sessionId,
-			sessionKey: params.sessionKey
-		});
-	});
-}
-/** Resolves per-tool timeout, applying media/message defaults and hard caps. */
-function resolveDynamicToolCallTimeoutMs(params) {
-	if (params.call.tool === "computer") return clampDynamicToolTimeoutMs(readComputerToolTimeoutMs(params.call.arguments));
-	if (params.call.tool === "message") return CODEX_DYNAMIC_MESSAGE_TOOL_TIMEOUT_MS;
-	if (params.call.tool === "agents_wait") {
-		const requestedMs = readDynamicToolCallTimeoutMs(params.call.arguments) ?? readConfiguredDynamicToolTimeoutMs(params.call.tool, params.config) ?? CODEX_DYNAMIC_AGENTS_WAIT_TOOL_TIMEOUT_MS;
-		return Math.max(1, Math.min(63e4, Math.floor(requestedMs)));
-	}
-	return clampDynamicToolTimeoutMs(readDynamicToolCallTimeoutMs(params.call.arguments) ?? readConfiguredDynamicToolTimeoutMs(params.call.tool, params.config) ?? CODEX_DYNAMIC_TOOL_TIMEOUT_MS);
-}
-function readComputerToolTimeoutMs(value) {
-	const args = isJsonObject(value) ? value : void 0;
-	const action = typeof args?.action === "string" ? args.action : void 0;
-	const gatewayTimeoutMs = readPositiveFiniteTimeoutMs(args?.timeoutMs) ?? CODEX_DYNAMIC_COMPUTER_GATEWAY_TIMEOUT_MS;
-	const gatewayCallCount = action === "screenshot" || action === "wait" ? 3 : 4;
-	return (action === "wait" || action === "hold_key" ? Math.max(0, Number(args?.duration) || 0) * 1e3 : 0) + gatewayCallCount * gatewayTimeoutMs + CODEX_DYNAMIC_COMPUTER_COMPLETION_GRACE_MS;
-}
-function readDynamicToolCallTimeoutMs(value) {
-	if (!isJsonObject(value)) return;
-	const timeoutMs = readPositiveFiniteTimeoutMs(value.timeoutMs);
-	if (timeoutMs !== void 0) return timeoutMs;
-	const timeoutSecondsMs = readDynamicToolTimeoutSecondsAsMs(value.timeoutSeconds);
-	return timeoutSecondsMs === void 0 ? void 0 : addTimerTimeoutGraceMs(timeoutSecondsMs, CODEX_DYNAMIC_TOOL_TIMEOUT_SECONDS_GRACE_MS);
-}
-function readConfiguredDynamicToolTimeoutMs(toolName, config) {
-	if (toolName === "image_generate") {
-		const imageModel = config?.agents?.defaults?.mediaModels?.image;
-		if (!imageModel || typeof imageModel !== "object") return CODEX_DYNAMIC_IMAGE_GENERATION_TOOL_TIMEOUT_MS;
-		return readPositiveFiniteTimeoutMs(imageModel.timeoutMs) ?? CODEX_DYNAMIC_IMAGE_GENERATION_TOOL_TIMEOUT_MS;
-	}
-	if (toolName === "image") {
-		const candidates = (config?.tools?.media?.models ?? []).filter((entry) => !entry.capabilities || entry.capabilities.includes("image"));
-		const capabilityTimeoutMs = readTimeoutSecondsAsMs(config?.tools?.media?.image?.timeoutSeconds);
-		return Math.max(capabilityTimeoutMs ?? CODEX_DYNAMIC_IMAGE_TOOL_TIMEOUT_MS, ...candidates.map((entry) => readTimeoutSecondsAsMs(entry.timeoutSeconds) ?? capabilityTimeoutMs ?? CODEX_DYNAMIC_IMAGE_TOOL_TIMEOUT_MS));
-	}
-	if (toolName === "message") return CODEX_DYNAMIC_MESSAGE_TOOL_TIMEOUT_MS;
-}
-function readTimeoutSecondsAsMs(value) {
-	const seconds = readPositiveFiniteTimeoutMs(value);
-	return seconds === void 0 ? void 0 : seconds * 1e3;
-}
-function readDynamicToolTimeoutSecondsAsMs(value) {
-	if (typeof value !== "number" || !Number.isFinite(value) || !Number.isInteger(value) || value <= 0) return;
-	return value * 1e3;
-}
-function readPositiveFiniteTimeoutMs(value) {
-	return typeof value === "number" && Number.isFinite(value) && value > 0 ? Math.floor(value) : void 0;
-}
-function clampDynamicToolTimeoutMs(timeoutMs) {
-	return Math.max(1, Math.min(CODEX_DYNAMIC_TOOL_MAX_TIMEOUT_MS, Math.floor(timeoutMs)));
-}
-//#endregion
-//#region extensions/codex/src/app-server/native-hook-relay-state.ts
-const pending = /* @__PURE__ */ new Set();
-/** Owns delayed hook-relay cleanup across runtime scheduling and test teardown. */
-const nativeHookRelayUnregisterQueue = {
-	add(entry) {
-		pending.add(entry);
-	},
-	delete(entry) {
-		return pending.delete(entry);
-	},
-	flush() {
-		while (pending.size > 0) {
-			const entry = pending.values().next().value;
-			if (!entry) return;
-			clearTimeout(entry.timeout);
-			entry.unregister();
-		}
-	},
-	clear() {
-		for (const entry of pending) clearTimeout(entry.timeout);
-		pending.clear();
-	}
-};
-//#endregion
-//#region extensions/codex/src/app-server/native-hook-relay.ts
-/**
-* Bridges Codex native hook callbacks into OpenClaw's native hook relay so
-* app-server tool events can still run OpenClaw policy and diagnostics.
-*/
-/** Codex hook events that can be registered through OpenClaw's native relay. */
-const CODEX_NATIVE_HOOK_RELAY_EVENTS = [
-	"pre_tool_use",
-	"post_tool_use",
-	"permission_request",
-	"before_agent_finalize"
-];
-const CODEX_NATIVE_HOOK_RELAY_EVENTS_WITH_APP_SERVER_APPROVALS = CODEX_NATIVE_HOOK_RELAY_EVENTS.filter((event) => event !== "permission_request");
-const CODEX_NATIVE_HOOK_RELAY_MIN_TTL_MS = 30 * 6e4;
-/** Extra relay lifetime after the expected turn budget, preventing late hook drops. */
-const CODEX_NATIVE_HOOK_RELAY_TTL_GRACE_MS = 5 * 6e4;
-const CODEX_NATIVE_HOOK_RELAY_COMMAND_MIN_PARENT_MARGIN_MS = 250;
-const CODEX_NATIVE_HOOK_RELAY_COMMAND_MAX_PARENT_MARGIN_MS = 1e3;
-const CODEX_NATIVE_HOOK_RELAY_DEFAULT_TIMEOUT_SEC = 10;
-const CODEX_NATIVE_HOOK_RELAY_UNREGISTER_GRACE_MS = 1e4;
-const CODEX_NATIVE_HOOK_RELAY_UNREGISTER_EXTRA_GRACE_MS = 5e3;
-const MAX_PENDING_DIRECT_CHILD_ADMISSIONS = 32;
-const CODEX_HOOK_MATCHER_NAMES_BY_TOOL_ID = {
-	exec: [
-		"Bash",
-		"exec",
-		"exec_command"
-	],
-	apply_patch: [
-		"apply_patch",
-		"Write",
-		"Edit"
-	],
-	spawn_agent: ["spawn_agent", "Agent"]
-};
-/** Defers relay unregister so late native hook subprocesses can still resolve. */
-function scheduleCodexNativeHookRelayUnregister(params) {
-	let pending;
-	const unregister = () => {
-		if (!pending) return;
-		const current = pending;
-		pending = void 0;
-		if (!nativeHookRelayUnregisterQueue.delete(current)) return;
-		params.relay.unregister();
-	};
-	const timeout = setTimeout(unregister, resolveCodexNativeHookRelayUnregisterGraceMs(params.hookTimeoutSec));
-	pending = {
-		timeout,
-		unregister
-	};
-	nativeHookRelayUnregisterQueue.add(pending);
-	timeout.unref();
-}
-/** Computes the delayed unregister window from Codex's hook timeout. */
-function resolveCodexNativeHookRelayUnregisterGraceMs(hookTimeoutSec) {
-	const hookTimeoutMs = finiteSecondsToTimerSafeMilliseconds(normalizeHookTimeoutSec(hookTimeoutSec)) ?? 0;
-	return Math.max(CODEX_NATIVE_HOOK_RELAY_UNREGISTER_GRACE_MS, addTimerTimeoutGraceMs(hookTimeoutMs, CODEX_NATIVE_HOOK_RELAY_UNREGISTER_EXTRA_GRACE_MS) ?? 0);
-}
-/** Records a native pre-tool failure that Codex does not project as a tool item. */
-function emitCodexNativePreToolUseFailureDiagnostic(params) {
-	emitTrustedDiagnosticEvent({
-		type: "tool.execution.error",
-		...params.agentId ? { agentId: params.agentId } : {},
-		sessionId: params.sessionId,
-		...params.sessionKey ? { sessionKey: params.sessionKey } : {},
-		runId: params.runId,
-		toolName: params.failure.toolName,
-		toolCallId: params.failure.toolCallId,
-		durationMs: params.failure.durationMs,
-		errorCategory: "before_tool_call",
-		terminalReason: params.terminalReason ?? (params.signal?.aborted ? resolveCodexToolAbortTerminalReason(params.signal) : params.failure.disposition),
-		...params.sourceTimestampMs !== void 0 ? { sourceTimestampMs: params.sourceTimestampMs } : {}
-	});
-}
-/** Registers an OpenClaw native hook relay for a Codex app-server turn. */
-function createCodexNativeHookRelay(params) {
-	if (params.options?.enabled === false) return;
-	const directChildClaims = /* @__PURE__ */ new Map();
-	const pendingDirectChildAdmissions = /* @__PURE__ */ new Map();
-	let foregroundClosed = false;
-	let successfulYieldRetentionAuthorized = false;
-	const assertClaim = (threadId, claim) => () => directChildClaims.get(threadId) === claim;
-	const rejectPendingAdmissions = (reason) => {
-		for (const pending of pendingDirectChildAdmissions.values()) pending.reject(new Error(reason));
-		pendingDirectChildAdmissions.clear();
-	};
-	const relay = registerRetainedNativeHookRelayForBundledRuntime({
-		provider: "codex",
-		relayId: buildCodexNativeHookRelayId({
-			agentId: params.agentId,
-			sessionId: params.sessionId,
-			sessionKey: params.sessionKey
-		}),
-		...params.generation ? { generation: params.generation } : {},
-		...params.generationMismatchGraceMs ? { generationMismatchGraceMs: params.generationMismatchGraceMs } : {},
-		...params.agentId ? { agentId: params.agentId } : {},
-		sessionId: params.sessionId,
-		...params.sessionKey ? { sessionKey: params.sessionKey } : {},
-		...params.config ? { config: params.config } : {},
-		runId: params.runId,
-		...params.channelId ? { channelId: params.channelId } : {},
-		...params.requester ? { requester: params.requester } : {},
-		...params.approvalContext ? { approvalContext: params.approvalContext } : {},
-		allowedEvents: params.events,
-		preToolUseLoopDetection: params.loopDetectionPreToolUseRelay,
-		ttlMs: resolveCodexNativeHookRelayTtlMs({
-			explicitTtlMs: params.options?.ttlMs,
-			attemptTimeoutMs: params.attemptTimeoutMs,
-			startupTimeoutMs: params.startupTimeoutMs,
-			turnStartTimeoutMs: params.turnStartTimeoutMs
-		}),
-		signal: params.signal,
-		runBeforeToolCall: params.hostCapabilities.runBeforeToolCall,
-		assertActive: params.hostCapabilities.assertActive,
-		retention: {
-			readClaim: readCodexNativeChildThreadId,
-			shouldRetainAfterForegroundClose: () => successfulYieldRetentionAuthorized && directChildClaims.size > 0,
-			allowPreToolUse: (childThreadId) => directChildClaims.has(childThreadId),
-			awaitForegroundAdmission: (childThreadId) => {
-				if (foregroundClosed) return Promise.reject(/* @__PURE__ */ new Error("native hook relay foreground admission unavailable"));
-				const existingClaim = directChildClaims.get(childThreadId);
-				if (existingClaim) return Promise.resolve(assertClaim(childThreadId, existingClaim));
-				const existingPending = pendingDirectChildAdmissions.get(childThreadId);
-				if (existingPending) return existingPending.promise.then((claim) => assertClaim(childThreadId, claim));
-				if (pendingDirectChildAdmissions.size >= MAX_PENDING_DIRECT_CHILD_ADMISSIONS) return Promise.reject(/* @__PURE__ */ new Error("native hook relay foreground admission capacity reached"));
-				const { promise, resolve, reject } = createDeferred();
-				pendingDirectChildAdmissions.set(childThreadId, {
-					promise,
-					resolve,
-					reject
-				});
-				return promise.then((claim) => assertClaim(childThreadId, claim));
-			},
-			onDispose: () => {
-				foregroundClosed = true;
-				rejectPendingAdmissions("native hook relay registration closed");
-			}
-		},
-		onPreToolUseFailure: params.onPreToolUseFailure,
-		command: {
-			nice: 10,
-			timeoutMs: params.options?.gatewayTimeoutMs
-		}
-	});
-	const unregister = () => {
-		foregroundClosed = true;
-		rejectPendingAdmissions("native hook relay foreground closed");
-		relay.unregister();
-	};
-	return {
-		...relay,
-		unregister,
-		authorizeRetentionAfterSuccessfulYield: () => {
-			successfulYieldRetentionAuthorized = true;
-		},
-		rejectPendingDirectChild: (threadIdInput, reason) => {
-			const threadId = threadIdInput.trim();
-			const pending = threadId ? pendingDirectChildAdmissions.get(threadId) : void 0;
-			if (!pending) return;
-			pendingDirectChildAdmissions.delete(threadId);
-			pending.reject(new Error(reason));
-		},
-		claimDirectChild: (threadIdInput) => {
-			const threadId = threadIdInput.trim();
-			if (!threadId) return () => void 0;
-			if (directChildClaims.get(threadId)) return () => void 0;
-			const claim = Symbol(threadId);
-			directChildClaims.set(threadId, claim);
-			const pending = pendingDirectChildAdmissions.get(threadId);
-			pendingDirectChildAdmissions.delete(threadId);
-			pending?.resolve(claim);
-			let released = false;
-			return () => {
-				if (released) return;
-				released = true;
-				if (directChildClaims.get(threadId) !== claim) return;
-				directChildClaims.delete(threadId);
-				if (foregroundClosed && directChildClaims.size === 0) relay.unregister();
-			};
-		}
-	};
-}
-function readCodexNativeChildThreadId(rawPayload) {
-	if (!isJsonObject(rawPayload) || typeof rawPayload.agent_id !== "string") return;
-	return rawPayload.agent_id.trim() || void 0;
-}
-/** Selects the native hook events Codex should install for the current approval mode. */
-function resolveCodexNativeHookRelayEvents(params) {
-	if (params.configuredEvents?.length) return params.configuredEvents;
-	return params.appServer.approvalPolicy === "never" ? CODEX_NATIVE_HOOK_RELAY_EVENTS : CODEX_NATIVE_HOOK_RELAY_EVENTS_WITH_APP_SERVER_APPROVALS;
-}
-/** Derives the native hook relay TTL from the turn budget unless explicitly configured. */
-function resolveCodexNativeHookRelayTtlMs(params) {
-	if (params.explicitTtlMs !== void 0) return params.explicitTtlMs;
-	const relayBudgetMs = params.attemptTimeoutMs + params.startupTimeoutMs + params.turnStartTimeoutMs + CODEX_NATIVE_HOOK_RELAY_TTL_GRACE_MS;
-	return Math.max(CODEX_NATIVE_HOOK_RELAY_MIN_TTL_MS, Math.floor(relayBudgetMs));
-}
-/** Builds a stable relay id scoped to the agent and session identity. */
-function buildCodexNativeHookRelayId(params) {
-	const hash = createHash("sha256");
-	hash.update("openclaw:codex:native-hook-relay:v1");
-	hash.update("\0");
-	hash.update(params.agentId?.trim() || "");
-	hash.update("\0");
-	hash.update(params.sessionKey?.trim() || params.sessionId);
-	return `codex-${hash.digest("hex").slice(0, 40)}`;
-}
-const CODEX_HOOK_EVENT_BY_NATIVE_EVENT = {
-	pre_tool_use: "PreToolUse",
-	post_tool_use: "PostToolUse",
-	permission_request: "PermissionRequest",
-	before_agent_finalize: "Stop"
-};
-const CODEX_HOOK_KEY_LABEL_BY_NATIVE_EVENT = {
-	pre_tool_use: "pre_tool_use",
-	post_tool_use: "post_tool_use",
-	permission_request: "permission_request",
-	before_agent_finalize: "stop"
-};
-const CODEX_SESSION_FLAGS_HOOK_SOURCE_PATHS = ["/<session-flags>/config.toml", "<session-flags>/config.toml"];
-/** Builds the Codex config overlay that installs trusted command hooks for relay events. */
-function buildCodexNativeHookRelayConfig(params) {
-	const events = params.events?.length ? params.events : CODEX_NATIVE_HOOK_RELAY_EVENTS;
-	const selectedEvents = new Set(events);
-	const config = { "features.hooks": true };
-	const hookState = {};
-	for (const event of CODEX_NATIVE_HOOK_RELAY_EVENTS) {
-		const codexEvent = CODEX_HOOK_EVENT_BY_NATIVE_EVENT[event];
-		const selected = selectedEvents.has(event);
-		const shouldRelay = params.relay.shouldRelayEvent(event);
-		const selectedNoopPreToolUse = selected && event === "pre_tool_use" && !shouldRelay && params.loopDetectionPreToolUseRelay;
-		if (!selected || !shouldRelay && !selectedNoopPreToolUse) {
-			if (selected || params.clearOmittedEvents) config[`hooks.${codexEvent}`] = [];
-			if (params.clearOmittedEvents) for (const sourcePath of CODEX_SESSION_FLAGS_HOOK_SOURCE_PATHS) hookState[`${sourcePath}:${CODEX_HOOK_KEY_LABEL_BY_NATIVE_EVENT[event]}:0:0`] = { enabled: false };
-			continue;
-		}
-		const timeout = normalizeHookTimeoutSec(params.hookTimeoutSec);
-		const command = params.relay.commandForEvent(event, { timeoutMs: resolveCodexNativeHookRelayCommandTimeoutMs(timeout) });
-		const matcher = selectedNoopPreToolUse ? void 0 : buildCodexNativeToolMatcher(params.relay.toolMatcherForEvent(event));
-		config[`hooks.${codexEvent}`] = [{
-			...matcher ? { matcher } : {},
-			hooks: [{
-				type: "command",
-				command,
-				timeout,
-				async: false,
-				statusMessage: "OpenClaw native hook relay"
-			}]
-		}];
-		const state = {
-			enabled: true,
-			trusted_hash: codexCommandHookTrustedHash({
-				event,
-				command,
-				matcher,
-				timeout,
-				statusMessage: "OpenClaw native hook relay"
-			})
-		};
-		for (const sourcePath of CODEX_SESSION_FLAGS_HOOK_SOURCE_PATHS) hookState[`${sourcePath}:${CODEX_HOOK_KEY_LABEL_BY_NATIVE_EVENT[event]}:0:0`] = state;
-	}
-	config["hooks.state"] = hookState;
-	return config;
-}
-/** Builds a Codex config overlay that disables native hooks and clears hook arrays. */
-function buildCodexNativeHookRelayDisabledConfig() {
-	return {
-		"features.hooks": false,
-		"hooks.PreToolUse": [],
-		"hooks.PostToolUse": [],
-		"hooks.PermissionRequest": [],
-		"hooks.Stop": []
-	};
-}
-function normalizeHookTimeoutSec(value) {
-	return typeof value === "number" && Number.isFinite(value) && value > 0 ? Math.ceil(value) : CODEX_NATIVE_HOOK_RELAY_DEFAULT_TIMEOUT_SEC;
-}
-function resolveCodexNativeHookRelayCommandTimeoutMs(hookTimeoutSec) {
-	const parentTimeoutMs = finiteSecondsToTimerSafeMilliseconds(normalizeHookTimeoutSec(hookTimeoutSec)) ?? 5e3;
-	const parentMarginMs = Math.min(CODEX_NATIVE_HOOK_RELAY_COMMAND_MAX_PARENT_MARGIN_MS, Math.max(CODEX_NATIVE_HOOK_RELAY_COMMAND_MIN_PARENT_MARGIN_MS, Math.floor(parentTimeoutMs / 5)));
-	return Math.max(1, parentTimeoutMs - parentMarginMs);
-}
-function buildCodexNativeToolMatcher(toolNames) {
-	if (toolNames === void 0) return;
-	if (toolNames.length === 0) throw new TypeError("Codex native hook matcher requires at least one tool name");
-	const nativeNames = /* @__PURE__ */ new Set();
-	let hasCustomToolName = false;
-	for (const toolName of toolNames) {
-		const canonicalToolName = toolName.trim();
-		if (!canonicalToolName || canonicalToolName === "*") throw new TypeError("Codex native hook matcher requires canonical OpenClaw tool ids");
-		const nativeAliases = CODEX_HOOK_MATCHER_NAMES_BY_TOOL_ID[canonicalToolName];
-		if (!nativeAliases) hasCustomToolName = true;
-		for (const nativeName of nativeAliases ?? [canonicalToolName]) nativeNames.add(nativeName);
-	}
-	const sortedNames = Array.from(nativeNames).toSorted();
-	if (!hasCustomToolName && sortedNames.every((toolName) => /^[A-Za-z0-9_]+$/.test(toolName))) return sortedNames.join("|");
-	return `(?i)^(?:${sortedNames.map((toolName) => toolName.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|")})$`;
-}
-function codexCommandHookTrustedHash(params) {
-	const identity = {
-		event_name: CODEX_HOOK_KEY_LABEL_BY_NATIVE_EVENT[params.event],
-		...params.matcher ? { matcher: params.matcher } : {},
-		hooks: [{
-			async: false,
-			command: params.command,
-			statusMessage: params.statusMessage,
-			timeout: params.timeout,
-			type: "command"
-		}]
-	};
-	return `sha256:${createHash("sha256").update(JSON.stringify(sortJsonValue(identity))).digest("hex")}`;
-}
-function sortJsonValue(value) {
-	if (!value || typeof value !== "object") return value;
-	if (Array.isArray(value)) return value.map(sortJsonValue);
-	const sorted = {};
-	for (const [key, entry] of Object.entries(value).toSorted(([left], [right]) => left.localeCompare(right))) sorted[key] = sortJsonValue(entry);
-	return sorted;
-}
-//#endregion
 //#region extensions/codex/src/app-server/event-projector-native-tool-lifecycle.ts
 /** Projects metadata-only lifecycle diagnostics for native tool items. */
 var CodexNativeToolLifecycleProjector = class {
@@ -1198,7 +426,7 @@ async function prepareCodexRemoteWorkspaceMessageMedia(params) {
 	let attachmentEntries = 0;
 	const mapMediaPath = (value) => {
 		if (typeof value !== "string") return value;
-		if (isGatewayManagedMediaPath(value, gatewayMediaRoot)) {
+		if (path.isAbsolute(value) && isPathStrictlyInside(gatewayMediaRoot, value)) {
 			attachmentEntries += 1;
 			gatewayManagedPaths.add(value);
 			return value;
@@ -1281,11 +509,6 @@ async function prepareCodexRemoteWorkspaceMessageMedia(params) {
 	}
 	return mapMessageMediaValues(mappedArgs, (value) => stagedPaths.get(value) ?? value);
 }
-function isGatewayManagedMediaPath(value, mediaRoot) {
-	if (!path.isAbsolute(value)) return false;
-	const relativePath = path.relative(mediaRoot, value);
-	return Boolean(relativePath && relativePath !== ".." && !relativePath.startsWith(`..${path.sep}`) && !path.isAbsolute(relativePath));
-}
 async function assertGatewayManagedMediaPath(value, mediaRoot) {
 	const opened = await (await root(mediaRoot, { symlinks: "reject" })).open(path.relative(mediaRoot, value), { symlinks: "reject" });
 	try {
@@ -1322,73 +545,59 @@ const dynamicToolBuildState = {};
 //#endregion
 //#region extensions/codex/src/app-server/shell-dynamic-tools.ts
 const CODEX_NODE_EXEC_DYNAMIC_TOOL_NAME = "node_exec";
-const CODEX_NODE_PROCESS_DYNAMIC_TOOL_NAME = "node_process";
-const CODEX_NODE_EXEC_POLICY_PARAMETER_NAMES = /* @__PURE__ */ new Set([
-	"host",
-	"security",
-	"ask"
-]);
+const CODEX_GATEWAY_EXEC_DYNAMIC_TOOL_NAME = "gateway_exec";
+const CODEX_GATEWAY_PROCESS_DYNAMIC_TOOL_NAME = "gateway_process";
+const PROCESS_FOLLOWUP_TEXT = "Use process (list/poll/log/write/send-keys/submit/paste/kill/clear/remove) for follow-up.";
 /** Returns true when plugin config explicitly removes any named dynamic tool. */
 function isCodexDynamicToolExcluded(config, names) {
 	const normalizedNames = new Set(names.map((name) => normalizeCodexDynamicToolName(name)));
 	return (config.codexDynamicToolsExclude ?? []).some((name) => normalizedNames.has(normalizeCodexDynamicToolName(name)));
 }
-function createNodeExecDynamicTool(execTool, configuredNode) {
-	const pinnedNode = configuredNode?.trim();
-	return {
-		...execTool,
-		name: CODEX_NODE_EXEC_DYNAMIC_TOOL_NAME,
-		description: pinnedNode ? "Run a shell command on the OpenClaw configured remote node for this session. This tool always uses OpenClaw host=node internally and follows the existing node exec approval and allowlist policy. Use node_process for follow-up on backgrounded node_exec sessions. Use Codex's native shell for local app-server work." : "Run a shell command on an OpenClaw remote node. Select the node by name or id when multiple nodes are available. This tool always uses OpenClaw host=node internally and follows the existing node exec approval and allowlist policy. Use node_process for follow-up on backgrounded node_exec sessions. Use Codex's native shell for local app-server work.",
-		parameters: hideNodeExecDynamicToolParameters(execTool.parameters, { hideNode: Boolean(pinnedNode) }),
-		execute: async (toolCallId, args, signal, onUpdate) => {
-			const result = await execTool.execute(toolCallId, pinNodeExecDynamicToolArgs(args, pinnedNode), signal, onUpdate);
-			return {
-				...result,
-				content: result.content.map((item) => item.type === "text" ? Object.assign({}, item, { text: item.text.replace("Use process (list/poll/log/write/send-keys/submit/paste/kill/clear/remove) for follow-up.", "Use node_process (list/poll/log/write/send-keys/submit/paste/kill/clear/remove) for follow-up.") }) : item)
-			};
-		}
+function createNodeExecAliasDynamicTool(execTool, node) {
+	const pinnedNode = node?.trim();
+	const pinnedTool = pinExecToolTarget(execTool, {
+		host: "node",
+		...pinnedNode ? { node: pinnedNode } : {}
+	});
+	const execute = async (toolCallId, args, signal, onUpdate) => {
+		const result = await pinnedTool.execute(toolCallId, args, signal, onUpdate);
+		return {
+			...result,
+			content: result.content.map((item) => item.type === "text" ? Object.assign({}, item, { text: item.text.replace(PROCESS_FOLLOWUP_TEXT, "Remote-node background follow-up is unavailable. Wait for the command to complete.") }) : item)
+		};
 	};
-}
-function createNodeProcessDynamicTool(processTool) {
 	return {
-		...processTool,
-		name: CODEX_NODE_PROCESS_DYNAMIC_TOOL_NAME,
-		description: "Manage node_exec sessions that were started on OpenClaw remote nodes: list, poll, log, write, send-keys, submit, paste, kill, clear, or remove. Use only for node_exec follow-up; use Codex's native shell session handling for local app-server work."
+		...pinnedTool,
+		name: CODEX_NODE_EXEC_DYNAMIC_TOOL_NAME,
+		description: pinnedNode ? "Run a shell command to completion on the OpenClaw configured remote node for this session. This tool always uses OpenClaw host=node internally and follows the existing node exec approval and allowlist policy. Remote-node background follow-up is unavailable. Use Codex's native shell for local app-server work." : "Run a shell command to completion on an OpenClaw remote node. Select the node by name or id when multiple nodes are available. This tool always uses OpenClaw host=node internally and follows the existing node exec approval and allowlist policy. Remote-node background follow-up is unavailable. Use Codex's native shell for local app-server work.",
+		execute
 	};
 }
-function pinNodeExecDynamicToolArgs(args, configuredNode) {
-	const { host: _host, security: _security, ask: _ask, node: requestedNode, ...rest } = args && typeof args === "object" && !Array.isArray(args) ? args : {};
-	const node = configuredNode ?? (typeof requestedNode === "string" ? requestedNode.trim() : "");
-	return {
-		...rest,
-		host: "node",
-		...node ? { node } : {}
-	};
+function createGatewayExecProjection(createProjection, execTool, params) {
+	return createProjection(execTool, {
+		kind: "exec",
+		name: CODEX_GATEWAY_EXEC_DYNAMIC_TOOL_NAME,
+		description: "Run a shell command through OpenClaw on the Gateway host for OpenClaw-managed Gateway environment access, including Secret Store agent-readable environment values and protected egress sentinels. Native Codex shell remains preferred for ordinary local work. This tool always uses OpenClaw host=gateway internally and follows Gateway exec approval and allowlist policy.",
+		followupText: params.processAliasAvailable ? "Use gateway_process (list/poll/log/write/send-keys/submit/paste/kill/clear/remove) for follow-up." : "Background session follow-up is unavailable because gateway_process is not exposed. Rerun without background=true and set yieldMs high enough to wait for completion.",
+		...params.ask ? { ask: params.ask } : {}
+	});
 }
-function hideNodeExecDynamicToolParameters(parameters, options) {
-	if (!parameters || typeof parameters !== "object" || Array.isArray(parameters)) return parameters;
-	const schema = parameters;
-	const rawProperties = schema.properties;
-	if (!rawProperties || typeof rawProperties !== "object" || Array.isArray(rawProperties)) return parameters;
-	const nextProperties = Object.fromEntries(Object.entries(rawProperties).filter(([name]) => !CODEX_NODE_EXEC_POLICY_PARAMETER_NAMES.has(normalizeCodexDynamicToolName(name)) && !(options.hideNode && normalizeCodexDynamicToolName(name) === "node")));
-	const rawRequired = schema.required;
-	const nextRequired = Array.isArray(rawRequired) ? rawRequired.filter((name) => typeof name !== "string" || !CODEX_NODE_EXEC_POLICY_PARAMETER_NAMES.has(normalizeCodexDynamicToolName(name)) && !(options.hideNode && normalizeCodexDynamicToolName(name) === "node")) : rawRequired;
-	return {
-		...schema,
-		properties: nextProperties,
-		...Array.isArray(rawRequired) ? { required: nextRequired } : {}
-	};
+function createGatewayProcessProjection(createProjection, processTool) {
+	return createProjection(processTool, {
+		kind: "process",
+		name: CODEX_GATEWAY_PROCESS_DYNAMIC_TOOL_NAME,
+		description: "Manage background shell sessions in the existing per-session OpenClaw process scope: list, poll, log, write, send-keys, submit, paste, kill, clear, or remove. Use for gateway_exec follow-up; use native Codex shell session handling for ordinary local work."
+	});
 }
 //#endregion
 //#region extensions/codex/src/app-server/vision-tools.ts
 /**
-* Filters Codex dynamic tools for turns that already contain image inputs so
-* models with native vision do not get redundant image-inspection tools.
+* Codex's enabled native surface includes its stable view_image loader. Keep
+* OpenClaw's view_image tool only when that surface or model vision is unavailable.
 */
-/** Removes the image tool when the model can directly consume inbound images. */
-function filterToolsForVisionInputs(tools, params) {
-	if (!params.modelHasVision || !params.hasInboundImages) return tools;
-	return tools.filter((tool) => tool.name !== "image");
+function filterCodexVisionTools(tools, params) {
+	if (!params.modelHasVision || !params.nativeImageInspectionEnabled) return tools;
+	return tools.filter((tool) => tool.name !== "view_image");
 }
 //#endregion
 //#region extensions/codex/src/app-server/dynamic-tool-build.ts
@@ -1406,6 +615,18 @@ const CODEX_NATIVE_SANDBOX_TOOL_REQUIREMENTS = [
 	"apply_patch"
 ];
 const CODEX_MEMORY_FLUSH_DYNAMIC_TOOL_ALLOW = /* @__PURE__ */ new Set(["read", "write"]);
+/** Keeps node filesystem and process ownership on its native exec-server. */
+function resolveCodexNodePlacementToolConstructionPlan(sandbox, nativeToolSurfaceEnabled) {
+	if (!isCodexRemoteExecPlacementSandbox(sandbox) || sandbox?.backendId !== "node" || !("placementNodeId" in sandbox) || typeof sandbox.placementNodeId !== "string" || !sandbox.placementNodeId) return;
+	if (!nativeToolSurfaceEnabled) throw new Error("Codex node execution requires its native exec-server tool surface; adjust the session tool policy and start a fresh attempt.");
+	return {
+		includeBaseCodingTools: false,
+		includeShellTools: false,
+		includeChannelTools: true,
+		includeOpenClawTools: true,
+		includePluginTools: true
+	};
+}
 function preserveRingZeroSystemAgentTool(allTools, filteredTools) {
 	const openclaw = allTools.find((tool) => tool.name === "openclaw" && tool.catalogMode === "direct-only");
 	if (!openclaw) return filteredTools;
@@ -1482,6 +703,10 @@ async function buildDynamicTools(input) {
 		...params,
 		disableMessageTool: false
 	} : params;
+	const toolRunContext = buildEmbeddedAttemptToolRunContext({
+		...params,
+		forceMessageTool: shouldForceMessageTool(messagePolicyParams)
+	});
 	if (params.disableTools) {
 		input.onWebSearchPolicyResolved?.(false);
 		return [];
@@ -1497,101 +722,126 @@ async function buildDynamicTools(input) {
 	const injectedOpenClawCodingToolsFactory = dynamicToolBuildState.openClawCodingToolsFactory;
 	let agentHarnessModule;
 	const loadAgentHarnessModule = async () => agentHarnessModule ??= await import("openclaw/plugin-sdk/agent-harness");
-	const createOpenClawCodingTools = injectedOpenClawCodingToolsFactory ?? (await loadAgentHarnessModule()).createOpenClawCodingTools;
 	toolBuildStages.mark("load-agent-harness-tools");
 	const sessionKeys = resolveOpenClawCodingToolsSessionKeys(params, input.sandboxSessionKey);
 	const nativeExecutionPolicy = resolveCodexNativeExecutionPolicyForDynamicTools(input);
-	const buildOpenClawCodingTools = () => params.hostCapabilities.bindToolSurface(createOpenClawCodingTools({
-		agentId: input.sessionAgentId,
-		...buildEmbeddedAttemptToolRunContext(params),
-		exec: {
-			...params.execOverrides,
-			...resolveCodexNodeExecToolOverrides(nativeExecutionPolicy),
-			config: params.config,
-			elevated: params.bashElevated
-		},
-		sandbox: input.sandbox,
-		messageProvider: resolveCodexMessageToolProvider(params),
-		toolPolicyMessageProvider: params.messageProvider ?? params.messageChannel,
-		clientCaps: params.clientCaps,
-		chatType: params.chatType,
-		agentAccountId: params.agentAccountId,
-		messageTo: params.messageTo,
-		messageThreadId: params.messageThreadId,
-		nativeChannelId: params.chatId,
-		messageActionTurnCapability: params.messageActionTurnCapability,
-		groupId: params.groupId,
-		groupChannel: params.groupChannel,
-		groupSpace: params.groupSpace,
-		spawnedBy: params.spawnedBy,
-		senderId: params.senderId,
-		senderName: params.senderName,
-		senderUsername: params.senderUsername,
-		senderE164: params.senderE164,
-		senderIsOwner: params.senderIsOwner,
-		inputProvenance: params.inputProvenance,
-		trustedInternalHandoff: params.trustedInternalHandoff,
-		scheduledToolPolicy: params.scheduledToolPolicy,
-		allowGatewaySubagentBinding: params.allowGatewaySubagentBinding || isForcedPrivateQaCodexRuntime(),
-		...sessionKeys,
-		sessionId: params.sessionId,
-		runId: params.runId,
-		approvalReviewerDeviceId: params.approvalReviewerDeviceId,
-		agentDir,
-		cwd: input.effectiveCwd ?? input.effectiveWorkspace,
-		workspaceDir: input.effectiveWorkspace,
-		spawnWorkspaceDir: input.effectiveCwd && input.effectiveCwd !== input.effectiveWorkspace ? input.resolvedWorkspace : resolveAttemptSpawnWorkspaceDir({
-			sandbox: input.sandbox,
-			resolvedWorkspace: input.resolvedWorkspace
-		}),
+	const webSearchPlan = resolveCodexWebSearchPlan({
 		config: params.config,
-		authProfileStore: params.toolAuthProfileStore ?? params.authProfileStore,
-		abortSignal: input.runAbortController.signal,
-		emitBeforeToolCallDiagnostics: false,
-		modelProvider: params.model.provider,
-		modelId: params.modelId,
-		modelCompat: params.model.compat && typeof params.model.compat === "object" ? params.model.compat : void 0,
-		modelApi: params.model.api,
-		modelContextWindowTokens: params.model.contextWindow,
-		delegationCapability: params.delegationCapability,
-		modelAuthMode: resolveModelAuthMode(params.model.provider, params.config, params.toolAuthProfileStore ?? params.authProfileStore, { workspaceDir: input.effectiveWorkspace }),
-		suppressManagedWebSearch: false,
-		currentChannelId: params.currentChannelId,
-		currentMessagingTarget: params.currentMessagingTarget,
-		hookChannelId: resolveCodexAppServerHookChannelId(params, input.sandboxSessionKey),
-		currentThreadTs: params.currentThreadTs,
-		currentMessageId: params.currentMessageId,
-		replyToMode: params.replyToMode,
-		hasRepliedRef: params.hasRepliedRef,
-		modelHasVision,
-		computerContextEpoch: input.computerContextEpoch,
-		requireExplicitMessageTarget: params.requireExplicitMessageTarget ?? isSubagentSessionKey(params.sessionKey),
-		sourceReplyDeliveryMode: params.sourceReplyDeliveryMode,
-		taskSuggestionDeliveryMode: params.taskSuggestionDeliveryMode,
-		disableMessageTool: input.ignoreDisableMessageTool ? false : params.disableMessageTool,
-		forceMessageTool: shouldForceMessageTool(messagePolicyParams),
-		enableHeartbeatTool: params.trigger === "heartbeat" || input.forceHeartbeatTool === true,
-		forceHeartbeatTool: params.trigger === "heartbeat" || input.forceHeartbeatTool === true,
-		onYield: (message) => {
-			input.onYieldDetected();
-			input.onCodexAppServerEvent?.({
-				stream: "codex_app_server.tool",
-				data: {
-					name: "sessions_yield",
-					message
-				}
-			});
-		},
-		recordToolPrepStage: (name) => {
-			toolBuildStages.mark(name);
-		},
-		onToolOutcome: params.onToolOutcome,
-		isTurnTainted: params.isTurnTainted,
-		allocateToolOutcomeOrdinal: params.allocateToolOutcomeOrdinal,
-		cronCreatorToolAllowlistRef: input.cronCreatorToolAllowlistRef,
-		cronCreatorToolAllowlistCaptureRef: input.cronCreatorToolAllowlistCaptureRef,
-		cronCreatorAuthorityUnavailableReason: input.cronCreatorAuthorityUnavailableReason
-	}), { cwd: input.effectiveCwd ?? input.effectiveWorkspace });
+		disableTools: params.disableTools,
+		nativeToolSurfaceEnabled: input.nativeToolSurfaceEnabled,
+		nativeProviderWebSearchSupport: input.nativeProviderWebSearchSupport
+	});
+	const webFetchHostnameAllowlistRef = {};
+	const buildOpenClawCodingTools = () => {
+		const toolConstructionPlan = resolveCodexNodePlacementToolConstructionPlan(input.sandbox, input.nativeToolSurfaceEnabled);
+		const options = {
+			agentId: input.sessionAgentId,
+			...toolRunContext,
+			exec: {
+				...params.execOverrides,
+				...input.sessionPermissionPolicy ? { mode: input.sessionPermissionPolicy.execMode } : {},
+				...resolveCodexNodeExecToolOverrides(nativeExecutionPolicy),
+				config: params.config,
+				elevated: params.bashElevated
+			},
+			sessionPermissionPolicy: input.sessionPermissionPolicy ? {
+				mode: input.sessionPermissionPolicy.mode,
+				root: input.sessionPermissionPolicy.root
+			} : void 0,
+			sandbox: input.sandbox,
+			...toolConstructionPlan ? { toolConstructionPlan } : {},
+			messageProvider: resolveCodexMessageToolProvider(params),
+			toolPolicyMessageProvider: params.messageProvider ?? params.messageChannel,
+			clientCaps: params.clientCaps,
+			chatType: params.chatType,
+			agentAccountId: params.agentAccountId,
+			messageTo: params.messageTo,
+			messageThreadId: params.messageThreadId,
+			nativeChannelId: params.chatId,
+			messageActionTurnCapability: params.messageActionTurnCapability,
+			groupId: params.groupId,
+			groupChannel: params.groupChannel,
+			groupSpace: params.groupSpace,
+			spawnedBy: params.spawnedBy,
+			senderId: params.senderId,
+			senderName: params.senderName,
+			senderUsername: params.senderUsername,
+			senderE164: params.senderE164,
+			senderIsOwner: params.senderIsOwner,
+			inputProvenance: params.inputProvenance,
+			trustedInternalHandoff: params.trustedInternalHandoff,
+			scheduledToolPolicy: params.scheduledToolPolicy,
+			allowGatewaySubagentBinding: params.allowGatewaySubagentBinding || isForcedPrivateQaCodexRuntime(),
+			...sessionKeys,
+			sessionId: params.sessionId,
+			runId: params.runId,
+			approvalReviewerDeviceId: params.approvalReviewerDeviceId,
+			agentDir,
+			preparedModelRuntime: params.preparedModelRuntime,
+			cwd: input.effectiveCwd ?? input.effectiveWorkspace,
+			workspaceDir: input.effectiveWorkspace,
+			spawnWorkspaceDir: input.effectiveCwd && input.effectiveCwd !== input.effectiveWorkspace ? input.resolvedWorkspace : resolveAttemptSpawnWorkspaceDir({
+				sandbox: input.sandbox,
+				resolvedWorkspace: input.resolvedWorkspace
+			}),
+			config: params.config,
+			githubPublicationAvailable: params.githubPublicationAvailable,
+			authProfileStore: params.toolAuthProfileStore ?? params.authProfileStore,
+			abortSignal: input.runAbortController.signal,
+			emitBeforeToolCallDiagnostics: false,
+			modelProvider: params.model.provider,
+			modelId: params.modelId,
+			modelCompat: params.model.compat && typeof params.model.compat === "object" ? params.model.compat : void 0,
+			modelApi: params.model.api,
+			modelContextWindowTokens: params.model.contextWindow,
+			delegationCapability: params.delegationCapability,
+			modelAuthMode: resolveModelAuthMode(params.model.provider, params.config, params.toolAuthProfileStore ?? params.authProfileStore, { workspaceDir: input.effectiveWorkspace }),
+			suppressManagedWebSearch: false,
+			webFetchHostnameAllowlistRef,
+			currentChannelId: params.currentChannelId,
+			currentMessagingTarget: params.currentMessagingTarget,
+			hookChannelId: resolveCodexAppServerHookChannelId(params, input.sandboxSessionKey),
+			currentThreadTs: params.currentThreadTs,
+			currentMessageId: params.currentMessageId,
+			replyToMode: params.replyToMode,
+			hasRepliedRef: params.hasRepliedRef,
+			modelHasVision,
+			computerContextEpoch: input.computerContextEpoch,
+			registerRunCleanup: input.registerRunCleanup,
+			requireExplicitMessageTarget: params.requireExplicitMessageTarget ?? isSubagentSessionKey(params.sessionKey),
+			sourceReplyDeliveryMode: params.sourceReplyDeliveryMode,
+			taskSuggestionDeliveryMode: params.taskSuggestionDeliveryMode,
+			disableMessageTool: input.ignoreDisableMessageTool ? false : params.disableMessageTool,
+			forceMessageTool: shouldForceMessageTool(messagePolicyParams),
+			enableHeartbeatTool: params.trigger === "heartbeat" || input.forceHeartbeatTool === true,
+			forceHeartbeatTool: params.trigger === "heartbeat" || input.forceHeartbeatTool === true,
+			onYield: (message, acknowledgment) => {
+				input.onYieldDetected(acknowledgment);
+				input.onCodexAppServerEvent?.({
+					stream: "codex_app_server.tool",
+					data: {
+						name: "sessions_yield",
+						message
+					}
+				});
+			},
+			claimYieldCompletion: input.claimYieldCompletion,
+			recordToolPrepStage: (name) => {
+				toolBuildStages.mark(name);
+			},
+			onToolOutcome: params.onToolOutcome,
+			isTurnTainted: params.isTurnTainted,
+			allocateToolOutcomeOrdinal: params.allocateToolOutcomeOrdinal,
+			cronCreatorToolAllowlistRef: input.cronCreatorToolAllowlistRef,
+			cronCreatorToolAllowlistCaptureRef: input.cronCreatorToolAllowlistCaptureRef,
+			cronCreatorAuthorityUnavailableReason: input.cronCreatorAuthorityUnavailableReason
+		};
+		const bindingOptions = { cwd: input.effectiveCwd ?? input.effectiveWorkspace };
+		if (injectedOpenClawCodingToolsFactory) return params.hostCapabilities.bindToolSurface(injectedOpenClawCodingToolsFactory(options), bindingOptions);
+		const createToolSurface = params.hostCapabilities.createToolSurface;
+		if (!createToolSurface) throw new Error("Codex tool construction requires a current host capability");
+		return createToolSurface(options, bindingOptions);
+	};
 	const allTools = input.resolveCronCreatorToolAuthority ? runWithCronCreatorAuthorityCapabilityResolver({
 		capability: params.cronCreatorAuthorityCapability,
 		runId: params.runId,
@@ -1602,20 +852,14 @@ async function buildDynamicTools(input) {
 	const preNormalizationDiagnostics = [];
 	const readableAllToolProjection = filterProviderNormalizableTools(allTools);
 	preNormalizationDiagnostics.push(...readableAllToolProjection.diagnostics);
-	const webSearchPlan = resolveCodexWebSearchPlan({
-		config: params.config,
-		disableTools: params.disableTools,
-		nativeToolSurfaceEnabled: input.nativeToolSurfaceEnabled,
-		nativeProviderWebSearchSupport: input.nativeProviderWebSearchSupport
-	});
 	const readableAllTools = [...readableAllToolProjection.tools];
 	const normallyProfiledTools = input.nativeToolSurfaceEnabled === false ? filterCodexDynamicToolsForDisabledNativeSurface(readableAllTools, input.pluginConfig, { preserveShell: shouldKeepOpenClawShellDynamicTools(input, nativeExecutionPolicy) }) : filterCodexDynamicTools(readableAllTools, input.pluginConfig);
 	const profileFilteredTools = (input.isHostScopedToolActive?.("openclaw") ?? isHostScopedAgentToolActive("openclaw")) && isSystemAgentOnlyCodexDynamicToolAllowlist(params.toolsAllow) ? preserveRingZeroSystemAgentTool(readableAllTools, normallyProfiledTools) : normallyProfiledTools;
-	const codexFilteredTools = addNodeShellDynamicToolsIfNeeded(addSandboxShellDynamicToolsIfAvailable(isCodexMemoryFlushRun(params) ? filterCodexMemoryFlushDynamicTools(readableAllTools) : profileFilteredTools, readableAllTools, input), readableAllTools, input, nativeExecutionPolicy);
+	const codexFilteredTools = addNodeShellDynamicToolsIfNeeded(addGatewayShellDynamicToolsIfAvailable(addSandboxShellDynamicToolsIfAvailable(isCodexMemoryFlushRun(params) ? filterCodexMemoryFlushDynamicTools(readableAllTools) : profileFilteredTools, readableAllTools, input), readableAllTools, input, nativeExecutionPolicy), readableAllTools, input, nativeExecutionPolicy);
 	toolBuildStages.mark("codex-filtering");
-	const visionFilteredTools = filterToolsForVisionInputs(codexFilteredTools, {
+	const visionFilteredTools = filterCodexVisionTools(codexFilteredTools, {
 		modelHasVision,
-		hasInboundImages: (params.images?.length ?? 0) > 0
+		nativeImageInspectionEnabled: input.nativeToolSurfaceEnabled === true
 	});
 	toolBuildStages.mark("vision-filtering");
 	const webSearchPresent = visionFilteredTools.some((tool) => tool.name === "web_search");
@@ -1646,7 +890,7 @@ async function buildDynamicTools(input) {
 	};
 	const transientWebSearchRestriction = !webSearchPolicy.allowed && webSearchPolicy.persistentAllowed || isCodexMemoryFlushRun(params);
 	input.onPersistentWebSearchPolicyResolved?.(webSearchPresent || persistentCodexWebSearchSurface && transientWebSearchRestriction && webSearchPolicy.persistentAllowed);
-	const filteredTools = filterCodexDynamicToolsForAllowlist(visionFilteredTools, includeForcedCodexDynamicToolAllow(params.toolsAllow, messagePolicyParams));
+	const filteredTools = filterCodexDynamicToolsForAllowlist(visionFilteredTools, toolRunContext.runtimeToolAllowlist);
 	toolBuildStages.mark("allowlist-filter");
 	const normalizedTools = normalizeAgentRuntimeTools({
 		runtimePlan: input.ignoreRuntimePlan ? void 0 : params.runtimePlan,
@@ -1662,7 +906,9 @@ async function buildDynamicTools(input) {
 		onPreNormalizationSchemaDiagnostics: (diagnostics) => preNormalizationDiagnostics.push(...diagnostics)
 	});
 	toolBuildStages.mark("runtime-normalization");
-	input.onWebSearchPolicyResolved?.(normalizedTools.some((tool) => tool.name === "web_search"));
+	const webSearchAllowed = normalizedTools.some((tool) => tool.name === "web_search");
+	webFetchHostnameAllowlistRef.value = webSearchAllowed ? webSearchPlan.webFetchHostnameAllowlist : void 0;
+	input.onWebSearchPolicyResolved?.(webSearchAllowed);
 	const exposedTools = webSearchPlan.suppressManagedWebSearch ? normalizedTools.filter((tool) => tool.name !== "web_search") : normalizedTools;
 	if (preNormalizationDiagnostics.length > 0) embeddedAgentLog.warn(`codex app-server quarantined ${preNormalizationDiagnostics.length} unsupported runtime tool schema${preNormalizationDiagnostics.length === 1 ? "" : "s"} before dynamic tool registration`, {
 		runId: params.runId,
@@ -1695,22 +941,36 @@ async function buildDynamicTools(input) {
 	}
 	return exposedTools;
 }
-/** Preserves delivery-critical tools when a narrow allowlist would otherwise hide them. */
-function includeForcedCodexDynamicToolAllow(toolsAllow, params) {
-	if (toolsAllow === void 0 || hasWildcardCodexToolsAllow(toolsAllow)) return toolsAllow;
-	const forcedToolNames = shouldForceMessageTool(params) ? ["message"] : [];
-	if (forcedToolNames.length === 0) return toolsAllow;
-	if (toolsAllow.length === 0) return forcedToolNames;
-	const normalized = new Set(toolsAllow.map((name) => normalizeCodexDynamicToolName(name)));
-	const missingToolNames = forcedToolNames.filter((toolName) => !normalized.has(normalizeCodexDynamicToolName(toolName)));
-	return missingToolNames.length === 0 ? toolsAllow : [...toolsAllow, ...missingToolNames];
+/** Keeps the OpenClaw Gateway execution path available beside Codex native shell. */
+function addGatewayShellDynamicToolsIfAvailable(filteredTools, allTools, input, executionPolicy) {
+	if (isCodexMemoryFlushRun(input.params) || input.nativeToolSurfaceEnabled !== true || input.sandbox?.enabled === true || !executionPolicy.nativeToolSurfaceAllowed || executionPolicy.effectiveExecHost !== "gateway") return filteredTools;
+	const execTool = allTools.find((tool) => normalizeCodexDynamicToolName(tool.name) === "exec");
+	const processTool = allTools.find((tool) => normalizeCodexDynamicToolName(tool.name) === "process");
+	const existingNames = new Set(filteredTools.map((tool) => normalizeCodexDynamicToolName(tool.name)));
+	const execExcluded = isCodexDynamicToolExcluded(input.pluginConfig, ["exec", CODEX_GATEWAY_EXEC_DYNAMIC_TOOL_NAME]);
+	if (!execTool || execExcluded || existingNames.has("gateway_exec")) return filteredTools;
+	const processExcluded = isCodexDynamicToolExcluded(input.pluginConfig, ["process", CODEX_GATEWAY_PROCESS_DYNAMIC_TOOL_NAME]);
+	const processAliasAvailable = Boolean(processTool && !processExcluded && !existingNames.has("gateway_process"));
+	const createProjection = resolveCodexScheduledToolProjectionFactory(input.params.hostCapabilities);
+	if (!createProjection) return filteredTools;
+	const toolsToAppend = [createGatewayExecProjection(createProjection, execTool, {
+		processAliasAvailable,
+		...input.sessionPermissionPolicy?.mode === "guarded" ? { ask: "always" } : {}
+	})];
+	if (processAliasAvailable && processTool) toolsToAppend.push(createGatewayProcessProjection(createProjection, processTool));
+	return [...filteredTools, ...toolsToAppend];
 }
 /** Decides whether Codex native code mode can own shell/file tools for this turn. */
 function shouldEnableCodexAppServerNativeToolSurface(params, sandbox, options = {}) {
 	if (params.pluginHarnessToolPolicyRestricted === true) return false;
 	if (isCodexMemoryFlushRun(params)) return false;
 	if (params.disableTools) return false;
-	const toolsAllow = includeForcedCodexDynamicToolAllow(params.toolsAllow, params);
+	if (isCodexNativeExecutionBlockedByNodeExecHost(params, {
+		agentId: options.agentId,
+		runtimeSessionKey: options.runtimeSessionKey,
+		sandbox
+	})) return false;
+	const toolsAllow = params.toolsAllow;
 	if (toolsAllow === void 0) return canCodexAppServerNativeToolSurfaceHonorSandbox(sandbox, options);
 	return hasWildcardCodexToolsAllow(toolsAllow) && canCodexAppServerNativeToolSurfaceHonorSandbox(sandbox, options);
 }
@@ -1731,7 +991,7 @@ function resolveCodexRuntimePolicySessionKey(params, runtimeSessionKey) {
 }
 function canCodexAppServerNativeToolSurfaceHonorSandbox(sandbox, options = {}) {
 	if (!sandbox?.enabled) return true;
-	if (options.sandboxExecServerEnabled === true && sandbox.backend && canSandboxToolPolicyExposeCodexNativeToolSurface(sandbox)) return true;
+	if (options.sandboxExecServerEnabled === true && (sandbox.backend || isCodexRemoteExecPlacementSandbox(sandbox)) && canSandboxToolPolicyExposeCodexNativeToolSurface(sandbox)) return true;
 	return false;
 }
 function canSandboxToolPolicyExposeCodexNativeToolSurface(sandbox) {
@@ -1807,7 +1067,7 @@ function addSandboxShellDynamicToolsIfAvailable(filteredTools, allTools, input)
 	const sandboxProcessTool = {
 		...processTool,
 		name: "sandbox_process",
-		description: "Manage sandbox_exec sessions that were started through OpenClaw's configured sandbox backend for this session: list, poll, log, write, send-keys, submit, paste, kill, clear, or remove. Use only for sandbox_exec follow-up; use Codex's native shell session handling only when no OpenClaw sandbox is active and native Code Mode is available."
+		description: "Manage background shell sessions through OpenClaw's configured sandbox backend for this session: list, poll, log, write, send-keys, submit, paste, kill, clear, or remove. Use only for sandbox follow-up; use Codex's native shell session handling only when no OpenClaw sandbox is active and native Code Mode is available."
 	};
 	return [
 		...filteredTools,
@@ -1839,12 +1099,9 @@ function addNodeShellDynamicToolsIfNeeded(filteredTools, allTools, input, nodePo
 	const nodeExecAvailableFromAuto = nodePolicy.requestedExecHost === "auto" && nodePolicy.effectiveExecHost === "gateway";
 	if (!nodeExecIsDefault && !nodeExecAvailableFromAuto) return filteredTools;
 	const execTool = allTools.find((tool) => normalizeCodexDynamicToolName(tool.name) === "exec");
-	const processTool = allTools.find((tool) => normalizeCodexDynamicToolName(tool.name) === "process");
-	if (!execTool || !processTool) return filteredTools;
-	const toolsToAppend = [];
-	if (!isCodexDynamicToolExcluded(input.pluginConfig, ["exec", "node_exec"]) && !filteredTools.some((tool) => normalizeCodexDynamicToolName(tool.name) === "node_exec")) toolsToAppend.push(createNodeExecDynamicTool(execTool, nodePolicy.node));
-	if (!isCodexDynamicToolExcluded(input.pluginConfig, ["process", "node_process"]) && !filteredTools.some((tool) => normalizeCodexDynamicToolName(tool.name) === "node_process")) toolsToAppend.push(createNodeProcessDynamicTool(processTool));
-	return toolsToAppend.length > 0 ? [...filteredTools, ...toolsToAppend] : filteredTools;
+	if (!execTool) return filteredTools;
+	if (!isCodexDynamicToolExcluded(input.pluginConfig, ["exec", "node_exec"]) && !filteredTools.some((tool) => normalizeCodexDynamicToolName(tool.name) === "node_exec")) return [...filteredTools, createNodeExecAliasDynamicTool(execTool, nodePolicy.node)];
+	return filteredTools;
 }
 function shouldKeepOpenClawShellDynamicTools(input, nodePolicy) {
 	return !isCodexMemoryFlushRun(input.params) && input.nativeToolSurfaceEnabled === false && input.sandbox?.enabled !== true && nodePolicy.effectiveExecHost !== "node";
@@ -1868,7 +1125,7 @@ function filterCodexDynamicToolsForAllowlist(tools, toolsAllow) {
 	const allowSet = new Set(toolsAllow.map((name) => normalizeCodexDynamicToolName(name)).filter(Boolean));
 	return tools.filter((tool) => {
 		const normalized = normalizeCodexDynamicToolName(tool.name);
-		return allowSet.has(normalized) || normalized === "sandbox_exec" && allowSet.has("exec") || normalized === "sandbox_process" && (allowSet.has("exec") || allowSet.has("process")) || normalized === "node_exec" && allowSet.has("exec") || normalized === "node_process" && (allowSet.has("exec") || allowSet.has("process"));
+		return allowSet.has(normalized) || normalized === "sandbox_exec" && allowSet.has("exec") || normalized === "sandbox_process" && (allowSet.has("exec") || allowSet.has("process")) || normalized === "gateway_exec" && allowSet.has("exec") || normalized === "gateway_process" && (allowSet.has("exec") || allowSet.has("process")) || normalized === "node_exec" && allowSet.has("exec");
 	});
 }
 /** Detects the wildcard allowlist marker after Codex tool-name normalization. */
@@ -1880,9 +1137,317 @@ function shouldForceMessageTool(params) {
 	return params.disableMessageTool !== true && params.sourceReplyDeliveryMode === "message_tool_only";
 }
 //#endregion
+//#region extensions/codex/src/app-server/sandbox-exec-server-node-relay.ts
+const CODEX_NODE_EXEC_SERVER_MAX_MESSAGE_BYTES$1 = 64 * 1024 * 1024;
+const CODEX_NODE_EXEC_SERVER_MAX_FAILURE_DETAIL_CHARS = 240;
+const CODEX_NODE_HTTP_CREDENTIAL_BODY_MAX_BYTES = 1024 * 1024;
+const CODEX_NODE_HTTP_CREDENTIAL_SCAN_MAX_FIELDS = 256;
+const CODEX_NODE_HTTP_CREDENTIAL_SCAN_MAX_DEPTH = 8;
+const CODEX_NODE_HTTP_CREDENTIAL_HEADER_NAMES = /* @__PURE__ */ new Set([
+	"authorization",
+	"proxy-authorization",
+	"cookie",
+	"set-cookie",
+	"x-api-key",
+	"api-key",
+	"apikey",
+	"x-auth-token",
+	"auth-token",
+	"x-access-token",
+	"access-token",
+	"x-secret-key",
+	"secret-key",
+	"x-goog-api-key",
+	"x-vault-token",
+	"x-api-token"
+]);
+const CODEX_NODE_HTTP_CREDENTIAL_HEADER_NAME_PATTERN = /(?:^|[-_])(?:auth(?:orization|entication)?|token|secret|api[-_]?key|apikey|key|password|passwd|pwd|passphrase|passcode|credentials?|session|jwt|assertion|verifier|sig(?:nature)?|hmac|bearer|ticket|challenge|proof|dpop|otp|totp|pin|mfa)(?:[-_]|$)/iu;
+const CODEX_NODE_HTTP_CREDENTIAL_FIELD_NAME_PATTERN = /^(?:(?:[a-z\d]+_)*(?:token|secret|password|passwd|pwd|passphrase|passcode|credentials?|authorization|api_?key|private_key|secret_key|secret_access_key|jwt|assertion|verifier|signature|hmac|bearer|ticket|(?:oauth|consumer|auth|access)_key|otp|totp|pin)|(?:device|authorization|auth|verification|mfa)_code|session(?:_id)?|jsessionid|saml(?:_?response|_?assertion)?|auth|jwt|code|sig|signature|hmac|key|pass)$/u;
+const nodeExecServerTextDecoder = new TextDecoder("utf-8", { fatal: true });
+/** Produces the bounded, redacted terminal failure shared by pending and claimed node leases. */
+function createCodexNodeExecServerDisconnectError(reason, cause) {
+	const detail = cause === void 0 ? "" : `: ${truncateUtf16Safe(redactSensitiveText(formatErrorMessage$1(cause), { mode: "tools" }), CODEX_NODE_EXEC_SERVER_MAX_FAILURE_DETAIL_CHARS)}`;
+	return /* @__PURE__ */ new Error(`Codex execution node disconnected; start a fresh attempt. (${reason}${detail})`);
+}
+/** Relays one authorized, single-use Codex exec-server channel without interpreting its protocol. */
+async function startCodexNodeExecServerRelay(params) {
+	const { channel } = params.lease;
+	const { socket } = params;
+	let closed = false;
+	const { promise: finished, resolve: finish } = createDeferred();
+	let unsubscribe = () => {};
+	const closeBoth = (code = 1001, reason = "execution channel closed") => {
+		if (closed) return;
+		closed = true;
+		unsubscribe();
+		params.lease.closeRelay = void 0;
+		params.lease.onChannelClosed = void 0;
+		if (!params.lease.closed) {
+			params.lease.closed = true;
+			channel.close();
+		}
+		if (socket.readyState === socket.OPEN || socket.readyState === socket.CONNECTING) socket.close(code, reason);
+		finish();
+	};
+	params.lease.closeRelay = closeBoth;
+	const failUnexpectedly = (code, reason, cause) => {
+		if (!closed && !params.lease.closed) params.lease.onDisconnected?.(createCodexNodeExecServerDisconnectError(reason, cause));
+		closeBoth(code, reason);
+	};
+	params.lease.onChannelClosed = ({ failed, error }) => failUnexpectedly(failed ? 1011 : 1001, failed ? "execution node failed" : "execution node disconnected", error);
+	socket.once("close", () => failUnexpectedly(1001, "execution socket closed"));
+	socket.once("error", () => failUnexpectedly(1011, "execution socket failed"));
+	let toNode = Promise.resolve();
+	socket.on("message", (data) => {
+		if (closed) return;
+		socket.pause();
+		toNode = toNode.then(async () => {
+			const frame = normalizeCodexExecServerFrame(data);
+			const request = validateCodexExecServerMessage(frame);
+			const rejection = rejectCredentialedCodexNodeHttpRequest(request);
+			if (rejection) await sendCodexExecServerFrame(socket, rejection);
+			else await channel.send(sanitizeCodexExecServerRequest(frame, request));
+			if (!closed) socket.resume();
+		}).catch((error) => {
+			failUnexpectedly(error instanceof RangeError ? 1009 : 1007, "invalid execution message");
+		});
+	});
+	unsubscribe = channel.onMessage(async (message) => {
+		if (closed) return;
+		try {
+			const frame = normalizeCodexExecServerFrame(message);
+			validateCodexExecServerMessage(frame);
+			await sendCodexExecServerFrame(socket, frame);
+		} catch (error) {
+			failUnexpectedly(error instanceof RangeError ? 1009 : 1007, "invalid device message");
+		}
+	});
+	await finished;
+}
+function sendCodexExecServerFrame(socket, frame) {
+	return new Promise((resolve, reject) => {
+		socket.send(frame, { binary: false }, (error) => {
+			if (error) {
+				reject(error);
+				return;
+			}
+			resolve();
+		});
+	});
+}
+function normalizeCodexExecServerFrame(data) {
+	const frame = Array.isArray(data) ? Buffer.concat(data) : Buffer.isBuffer(data) ? data : data instanceof Uint8Array ? Buffer.from(data.buffer, data.byteOffset, data.byteLength) : Buffer.from(data);
+	if (frame.length > CODEX_NODE_EXEC_SERVER_MAX_MESSAGE_BYTES$1) throw new RangeError("Codex exec-server message exceeds its 64 MiB limit.");
+	if (frame.includes(10) || frame.includes(13)) throw new Error("Codex exec-server messages must occupy exactly one stdio line.");
+	return frame;
+}
+function validateCodexExecServerMessage(frame) {
+	const parsed = JSON.parse(nodeExecServerTextDecoder.decode(frame));
+	if (!isRecord(parsed)) throw new Error("Codex exec-server message must be a JSON object.");
+	return parsed;
+}
+function rejectCredentialedCodexNodeHttpRequest(request) {
+	if (request.method !== "http/request") return;
+	if (!isRecord(request.params)) throw new Error("Codex http/request params must be an object.");
+	const headers = request.params.headers ?? [];
+	if (!Array.isArray(headers)) throw new Error("Codex http/request headers must be an array.");
+	if (headers.length > CODEX_NODE_HTTP_CREDENTIAL_SCAN_MAX_FIELDS) return createCredentialedCodexNodeHttpRejection(request);
+	let credentialBearing = false;
+	let contentType;
+	for (const header of headers) {
+		if (!isRecord(header) || typeof header.name !== "string" || typeof header.value !== "string") throw new Error("Codex http/request headers must contain string names and values.");
+		const name = header.name.trim().toLowerCase();
+		if (CODEX_NODE_HTTP_CREDENTIAL_HEADER_NAMES.has(name) || CODEX_NODE_HTTP_CREDENTIAL_HEADER_NAME_PATTERN.test(name) || hasSensitiveCodexNodeText(header.value)) credentialBearing = true;
+		if (name === "content-type") {
+			const declared = header.value.split(";", 1)[0]?.trim().toLowerCase();
+			credentialBearing ||= Boolean(contentType && contentType !== declared);
+			contentType = declared;
+		}
+	}
+	if (!credentialBearing && typeof request.params.url === "string") credentialBearing = hasCredentialedCodexNodeHttpUrl(request.params.url);
+	if (!credentialBearing && request.params.bodyBase64 != null) credentialBearing = hasCredentialedCodexNodeHttpBody(request.params.bodyBase64, contentType);
+	return credentialBearing ? createCredentialedCodexNodeHttpRejection(request) : void 0;
+}
+function hasCredentialedCodexNodeHttpUrl(value) {
+	let url;
+	try {
+		url = new URL(value);
+	} catch {
+		throw new Error("Codex http/request URL must be valid.");
+	}
+	if (url.username || url.password || hasSensitiveCodexNodeText(value)) return true;
+	let fields = 0;
+	const hasCredentialedParameter = (name, parameterValue) => ++fields > CODEX_NODE_HTTP_CREDENTIAL_SCAN_MAX_FIELDS || isCodexNodeCredentialField(name) || hasSensitiveCodexNodeText(parameterValue);
+	for (const parameters of [url.searchParams, new URLSearchParams(url.hash.slice(1))]) for (const [name, parameterValue] of parameters) if (hasCredentialedParameter(name, parameterValue)) return true;
+	for (const initial of [
+		url.pathname,
+		url.hash.slice(1),
+		...url.searchParams.values()
+	]) {
+		let component = initial;
+		for (let depth = 0; depth <= CODEX_NODE_HTTP_CREDENTIAL_SCAN_MAX_DEPTH; depth += 1) {
+			for (const nestedQuery of component.split(/[?#]/u).slice(1)) for (const [name, parameterValue] of new URLSearchParams(nestedQuery)) if (hasCredentialedParameter(name, parameterValue)) return true;
+			for (const segment of component.split("/")) for (const parameter of segment.split(";").slice(1)) {
+				const separator = parameter.indexOf("=");
+				if (hasCredentialedParameter(separator < 0 ? parameter : parameter.slice(0, separator), separator < 0 ? "" : parameter.slice(separator + 1))) return true;
+			}
+			if (!/%[\da-f]{2}/iu.test(component)) break;
+			if (depth === CODEX_NODE_HTTP_CREDENTIAL_SCAN_MAX_DEPTH) return true;
+			try {
+				component = decodeURIComponent(component);
+			} catch {
+				return true;
+			}
+		}
+	}
+	return false;
+}
+function hasCredentialedCodexNodeHttpBody(value, contentType) {
+	if (typeof value !== "string") throw new Error("Codex http/request bodyBase64 must be a string.");
+	const declaredText = contentType === "text/plain";
+	if (!declaredText && value.length > Math.ceil(CODEX_NODE_HTTP_CREDENTIAL_BODY_MAX_BYTES / 3) * 4) return true;
+	let body;
+	try {
+		const decoded = Buffer.from(value, "base64");
+		if (!declaredText && decoded.length > CODEX_NODE_HTTP_CREDENTIAL_BODY_MAX_BYTES || decoded.toString("base64") !== value) return true;
+		body = nodeExecServerTextDecoder.decode(decoded);
+	} catch {
+		return true;
+	}
+	if (!body) return false;
+	if (hasSensitiveCodexNodeText(body)) return true;
+	const declaredJson = contentType === "application/json" || contentType?.endsWith("+json") === true;
+	const declaredForm = contentType === "application/x-www-form-urlencoded";
+	if (contentType && !declaredJson && !declaredForm && !declaredText) return true;
+	const trimmed = body.trimStart();
+	if (trimmed.startsWith("<")) return true;
+	if (declaredJson || trimmed.startsWith("{") || trimmed.startsWith("[")) try {
+		if (hasCredentialedCodexNodeRawJsonStrings(body)) return true;
+		return hasCredentialedCodexNodeJsonFields(JSON.parse(body));
+	} catch {
+		if (!declaredText) return true;
+	}
+	if (!declaredForm && !body.includes("=")) return !declaredText;
+	let fields = 0;
+	for (const [name, parameterValue] of new URLSearchParams(body)) if (++fields > CODEX_NODE_HTTP_CREDENTIAL_SCAN_MAX_FIELDS || isCodexNodeCredentialField(name) || hasSensitiveCodexNodeText(parameterValue)) return true;
+	return false;
+}
+function hasCredentialedCodexNodeRawJsonStrings(body) {
+	const tokens = body.matchAll(/("(?:\\.|[^"\\])*")(\s*:)?/gu);
+	let fields = 0;
+	for (const match of tokens) {
+		const value = JSON.parse(match[1]);
+		if (++fields > CODEX_NODE_HTTP_CREDENTIAL_SCAN_MAX_FIELDS || typeof value !== "string" || hasSensitiveCodexNodeText(value) || match[2] !== void 0 && isCodexNodeCredentialField(value)) return true;
+	}
+	return false;
+}
+function hasCredentialedCodexNodeJsonFields(value) {
+	const pending = [{
+		value,
+		depth: 0
+	}];
+	let fields = 0;
+	while (pending.length > 0) {
+		const current = pending.pop();
+		if (typeof current?.value === "string" && hasSensitiveCodexNodeText(current.value)) return true;
+		if (!current || !Array.isArray(current.value) && !isRecord(current.value)) continue;
+		if (current.depth >= CODEX_NODE_HTTP_CREDENTIAL_SCAN_MAX_DEPTH) return true;
+		const entries = Array.isArray(current.value) ? current.value.map((entry) => [void 0, entry]) : Object.entries(current.value);
+		for (const [name, nested] of entries) {
+			if (++fields > CODEX_NODE_HTTP_CREDENTIAL_SCAN_MAX_FIELDS || typeof name === "string" && isCodexNodeCredentialField(name)) return true;
+			pending.push({
+				value: nested,
+				depth: current.depth + 1
+			});
+		}
+	}
+	return false;
+}
+function hasSensitiveCodexNodeText(value) {
+	let decoded = value;
+	for (let depth = 0; depth <= CODEX_NODE_HTTP_CREDENTIAL_SCAN_MAX_DEPTH; depth += 1) {
+		if (redactToolPayloadText(decoded) !== decoded) return true;
+		if (!/%[\da-f]{2}/iu.test(decoded)) return false;
+		try {
+			decoded = decodeURIComponent(decoded);
+		} catch {
+			return true;
+		}
+	}
+	return true;
+}
+function isCodexNodeCredentialField(value) {
+	let decoded = value;
+	for (let depth = 0; depth < CODEX_NODE_HTTP_CREDENTIAL_SCAN_MAX_DEPTH; depth += 1) {
+		let next;
+		try {
+			next = decodeURIComponent(decoded);
+		} catch {
+			return true;
+		}
+		if (next === decoded) break;
+		decoded = next;
+	}
+	const normalized = decoded.replace(/[\p{C}\p{Z}\u115F\u1160\u3164\uFFA0+]/gu, "").replace(/([a-z\d])([A-Z])/gu, "$1_$2").replaceAll("-", "_").toLowerCase();
+	return normalized.length > CODEX_NODE_HTTP_CREDENTIAL_SCAN_MAX_FIELDS || normalized.split(/[.[\]]+/u).some((component) => CODEX_NODE_HTTP_CREDENTIAL_FIELD_NAME_PATTERN.test(component));
+}
+function createCredentialedCodexNodeHttpRejection(request) {
+	if (typeof request.id !== "string" && typeof request.id !== "number") throw new Error("Codex http/request must have a JSON-RPC request id.");
+	return Buffer.from(JSON.stringify({
+		jsonrpc: "2.0",
+		id: request.id,
+		error: {
+			code: -32602,
+			message: "Authenticated remote HTTP is unavailable on execution nodes; run on Gateway or use an intentionally credential-free endpoint."
+		}
+	}));
+}
+function sanitizeCodexExecServerRequest(frame, request) {
+	if (request.method !== "process/start") return frame;
+	if (!isRecord(request.params)) throw new Error("Codex process/start params must be an object.");
+	sanitizeCodexExecServerEnvironment(request.params, "env");
+	if (request.params.envPolicy !== void 0) {
+		if (!isRecord(request.params.envPolicy)) throw new Error("Codex process/start envPolicy must be an object.");
+		sanitizeCodexExecServerEnvironment(request.params.envPolicy, "set");
+	}
+	return normalizeCodexExecServerFrame(Buffer.from(JSON.stringify(request)));
+}
+function sanitizeCodexExecServerEnvironment(record, key) {
+	const environment = record[key];
+	if (environment === void 0) return;
+	if (!isRecord(environment)) throw new Error(`Codex process/start ${key} must be an object.`);
+	const values = {};
+	for (const [name, value] of Object.entries(environment)) {
+		if (typeof value !== "string") throw new Error(`Codex process/start ${key} values must be strings.`);
+		try {
+			const url = new URL(value);
+			if (url.username || url.password) continue;
+		} catch {}
+		values[name] = value;
+	}
+	record[key] = sanitizeEnvVars(values).allowed;
+}
+//#endregion
 //#region extensions/codex/src/app-server/sandbox-exec-server-registry.ts
 const sandboxExecServerRegistry = {
 	servers: /* @__PURE__ */ new Map(),
+	async close(server) {
+		if (server.closed) return;
+		server.closed = true;
+		if ("node" in server) {
+			for (const lease of server.node.leases.values()) if (!lease.closed) {
+				lease.closed = true;
+				lease.channel.close();
+			}
+			server.node.leases.clear();
+		}
+		for (const client of server.server.clients) client.close(1001, "shutdown");
+		await new Promise((resolve) => {
+			server.server.close(() => resolve());
+		});
+		const failures = (await Promise.allSettled([...server.cleanupTasks, ...[...server.children].map(async (child) => await child.terminate())])).flatMap((result) => result.status === "rejected" ? [result.reason] : []);
+		if (failures.length > 0) throw new AggregateError(failures, "Codex sandbox exec-server child cleanup failed");
+	},
 	async closeAll() {
 		const servers = await Promise.allSettled(this.servers.values());
 		this.servers.clear();
@@ -1890,12 +1455,7 @@ const sandboxExecServerRegistry = {
 			if (entry.status !== "fulfilled") return;
 			const server = entry.value;
 			server.refCount = 0;
-			if (server.closed) return;
-			server.closed = true;
-			for (const client of server.server.clients) client.close(1001, "shutdown");
-			await new Promise((resolve) => {
-				server.server.close(() => resolve());
-			});
+			await this.close(server);
 		}));
 	}
 };
@@ -1912,9 +1472,8 @@ var JsonRpcProtocolError = class extends Error {
 		this.code = code;
 	}
 };
-/** Parses raw WebSocket data into a JSON-RPC request object. */
-function parseRequest(data) {
-	const text = (Array.isArray(data) ? Buffer.concat(data) : Buffer.isBuffer(data) ? data : Buffer.from(data)).toString("utf8");
+/** Parses a normalized JSON message into a JSON-RPC request object. */
+function parseRequest(text) {
 	return requireObject(JSON.parse(text), "JSON-RPC request");
 }
 /** Validates that a JSON value is a non-array object. */
@@ -1954,24 +1513,24 @@ function readHttpHeaders(value) {
 		};
 	});
 }
-/** Sends a JSON-RPC success response over the WebSocket. */
-function sendResult(socket, id, result) {
-	socket.send(JSON.stringify({
+/** Sends a JSON-RPC success response through the connection message sink. */
+function sendResult(send, id, result) {
+	send({
 		jsonrpc: "2.0",
 		id,
-		result: result === void 0 ? {} : result
-	}));
+		result
+	});
 }
-/** Sends a JSON-RPC error response over the WebSocket. */
-function sendError(socket, id, code, message) {
-	socket.send(JSON.stringify({
+/** Sends a JSON-RPC error response through the connection message sink. */
+function sendError(send, id, code, message) {
+	send({
 		jsonrpc: "2.0",
 		id: id ?? null,
 		error: {
 			code,
 			message
 		}
-	}));
+	});
 }
 //#endregion
 //#region extensions/codex/src/app-server/sandbox-exec-server/path-uri.ts
@@ -2216,20 +1775,6 @@ function joinSandboxChildPath(parent, child) {
 	return parent.endsWith("/") ? `${parent}${child}` : `${parent}/${child}`;
 }
 //#endregion
-//#region extensions/codex/src/app-server/sandbox-exec-server/runtime.ts
-/** Returns the configured sandbox backend or fails the current JSON-RPC request. */
-function requireBackend(execServer) {
-	const backend = execServer.sandbox.backend;
-	if (!backend) throw new Error("OpenClaw sandbox backend is unavailable.");
-	return backend;
-}
-/** Returns the configured filesystem bridge or fails the current JSON-RPC request. */
-function requireFsBridge(execServer) {
-	const fsBridge = execServer.sandbox.fsBridge;
-	if (!fsBridge) throw new Error("Sandbox filesystem bridge is unavailable.");
-	return fsBridge;
-}
-//#endregion
 //#region extensions/codex/src/app-server/sandbox-exec-server/filesystem.ts
 /**
 * Implements filesystem JSON-RPC handlers for the Codex sandbox exec-server
@@ -2252,7 +1797,7 @@ async function openFile(execServer, handles, params) {
 		path: filePath,
 		access: "read"
 	}]);
-	const fsBridge = requireFsBridge(execServer);
+	const fsBridge = execServer.fsBridge;
 	const handle = {
 		abortController: new AbortController(),
 		closeRequested: false,
@@ -2339,7 +1884,7 @@ async function readFile(execServer, params) {
 		path: filePath,
 		access: "read"
 	}]);
-	const fsBridge = requireFsBridge(execServer);
+	const fsBridge = execServer.fsBridge;
 	const stat = await fsBridge.stat({ filePath });
 	if (!stat) throw new JsonRpcProtocolError(JSON_RPC_NOT_FOUND, "file not found");
 	assertSandboxFileReadWithinLimit(stat);
@@ -2356,7 +1901,7 @@ async function writeFile(execServer, params) {
 		path: filePath,
 		access: "write"
 	}]);
-	const fsBridge = requireFsBridge(execServer);
+	const fsBridge = execServer.fsBridge;
 	if ((await fsBridge.stat({ filePath: posix.dirname(filePath) }))?.type !== "directory") throw new JsonRpcProtocolError(JSON_RPC_NOT_FOUND, "parent directory not found");
 	await fsBridge.writeFile({
 		filePath,
@@ -2372,7 +1917,7 @@ async function createDirectory(execServer, params) {
 		path: filePath,
 		access: "write"
 	}]);
-	const fsBridge = requireFsBridge(execServer);
+	const fsBridge = execServer.fsBridge;
 	if (record.recursive === false) {
 		const parentPath = posix.dirname(filePath);
 		if ((await fsBridge.stat({ filePath: parentPath }))?.type !== "directory") throw new JsonRpcProtocolError(JSON_RPC_NOT_FOUND, "parent directory not found");
@@ -2387,7 +1932,7 @@ async function getMetadata(execServer, params) {
 		path: filePath,
 		access: "read"
 	}]);
-	const stat = await requireFsBridge(execServer).stat({ filePath });
+	const stat = await execServer.fsBridge.stat({ filePath });
 	if (!stat) throw new JsonRpcProtocolError(JSON_RPC_NOT_FOUND, "file not found");
 	return metadataResponse(stat);
 }
@@ -2401,11 +1946,9 @@ async function listDirectoryEntries(execServer, filePath, fsSandboxPolicy) {
 		path: filePath,
 		access: "read"
 	}]);
-	const fsBridge = requireFsBridge(execServer);
-	const backend = requireBackend(execServer);
-	const resolved = fsBridge.resolvePath({ filePath });
+	const resolved = execServer.fsBridge.resolvePath({ filePath });
 	if (!resolved) throw new Error(`Cannot resolve sandbox path: ${filePath}`);
-	const result = await backend.runShellCommand({
+	const result = await execServer.backend.runShellCommand({
 		script: "find \"$1\" -mindepth 1 -maxdepth 1 -exec sh -c 'for path do name=${path##*/}; if [ -L \"$path\" ]; then kind=o; elif [ -d \"$path\" ]; then kind=d; elif [ -f \"$path\" ]; then kind=f; else kind=o; fi; printf \"%s\\t%s\\n\" \"$kind\" \"$name\"; done' sh {} +",
 		args: [resolved.containerPath],
 		allowFailure: true
@@ -2433,7 +1976,7 @@ async function removePath(execServer, params) {
 		access: "write"
 	}]);
 	if (record.recursive !== false) assertNoReadOnlyDescendant(fsSandboxPolicy, filePath, "remove");
-	await requireFsBridge(execServer).remove({
+	await execServer.fsBridge.remove({
 		filePath,
 		recursive: record.recursive !== false,
 		force: record.force !== false
@@ -2460,8 +2003,7 @@ async function copyPath(execServer, params) {
 	});
 }
 async function copySandboxPath(execServer, params) {
-	const fsBridge = execServer.sandbox.fsBridge;
-	if (!fsBridge) throw new Error("Sandbox filesystem bridge is unavailable.");
+	const fsBridge = execServer.fsBridge;
 	assertResolvedFsSandboxAccess(params.fsSandboxPolicy, [{
 		path: params.sourcePath,
 		access: "read"
@@ -2519,6 +2061,126 @@ function metadataResponse(stat) {
 	};
 }
 //#endregion
+//#region extensions/codex/src/app-server/sandbox-exec-server/sandbox-child.ts
+/** Owns one sandbox subprocess tree through close, reaping, and backend finalization. */
+const SANDBOX_CHILD_TERM_GRACE_MS = 1e3;
+const SANDBOX_CHILD_REAP_TIMEOUT_MS = 4500;
+const SANDBOX_EXEC_MARKER = "CODEX_SANDBOX_EXEC_ID";
+async function spawnSandboxChild(params) {
+	const [command, ...args] = params.argv;
+	const finalize = async (status, exitCode) => await params.finalizeExec?.({
+		status,
+		exitCode,
+		timedOut: false,
+		token: params.finalizeToken
+	});
+	if (!command) {
+		await finalize("failed", null).catch(params.onFinalizeError);
+		throw new Error("OpenClaw sandbox exec spec did not provide a command.");
+	}
+	let child;
+	try {
+		child = spawn(command, args, {
+			detached: process.platform !== "win32",
+			env: params.env,
+			stdio: [
+				"pipe",
+				"pipe",
+				"pipe"
+			]
+		});
+	} catch (error) {
+		await finalize("failed", null).catch(params.onFinalizeError);
+		throw error;
+	}
+	let outcome;
+	const closed = new Promise((resolve) => {
+		child.once("close", (code, signal) => resolve(outcome = {
+			exitCode: code ?? 1,
+			signal
+		}));
+	});
+	let finalizePromise;
+	let terminationCleanup;
+	let terminationError;
+	const settled = closed.then(async (result) => {
+		await terminationCleanup;
+		child.stdin.destroy();
+		await (finalizePromise ??= finalize(params.finalizeStatus(result), result.exitCode));
+		return result;
+	});
+	settled.catch(params.onFinalizeError);
+	let terminationPromise;
+	const owner = {
+		process: child,
+		settled,
+		terminate: () => terminationPromise ??= (async () => {
+			child.stdin.destroy();
+			terminationCleanup = params.terminateRemote?.().catch((error) => {
+				terminationError = error instanceof Error ? error : new Error(String(error));
+			});
+			await terminationCleanup;
+			if (!outcome) {
+				if (child.pid) killProcessTree(child.pid, {
+					detached: process.platform !== "win32",
+					graceMs: SANDBOX_CHILD_TERM_GRACE_MS
+				});
+				else child.kill("SIGTERM");
+				if (!await Promise.race([closed.then(() => true), delay(SANDBOX_CHILD_REAP_TIMEOUT_MS).then(() => false)])) throw new Error(`Sandbox child process tree ${child.pid ?? "unknown"} survived SIGKILL; tear down the sandbox environment and inspect the surviving process tree before retrying.`);
+			}
+			const result = await settled;
+			if (terminationError) throw terminationError;
+			return result;
+		})()
+	};
+	params.owners.add(owner);
+	settled.then(() => params.owners.delete(owner), () => params.owners.delete(owner));
+	return owner;
+}
+function prepareSandboxChildExec(backend, env) {
+	const marker = randomUUID();
+	return {
+		env: {
+			...env,
+			[SANDBOX_EXEC_MARKER]: marker
+		},
+		terminate: async () => {
+			const result = await backend.runShellCommand({
+				script: SANDBOX_REMOTE_TERMINATE_SCRIPT,
+				args: [`${SANDBOX_EXEC_MARKER}=${marker}`],
+				allowFailure: true,
+				signal: AbortSignal.timeout(SANDBOX_CHILD_REAP_TIMEOUT_MS)
+			});
+			if (result.code !== 0) {
+				const detail = result.stderr.toString("utf8").trim() || result.stdout.toString("utf8").trim();
+				throw new Error(detail || `Sandbox process tree cleanup failed with code ${result.code}; tear down the sandbox environment and inspect surviving processes before retrying.`);
+			}
+		}
+	};
+}
+const SANDBOX_REMOTE_TERMINATE_SCRIPT = String.raw`
+find_owned_pids() {
+  for env_file in /proc/[0-9]*/environ; do
+    if [ -r "$env_file" ] && tr '\0' '\n' < "$env_file" 2>/dev/null | grep -Fqx "$1"; then
+      basename "$(dirname "$env_file")"
+    fi
+  done
+}
+owned="$(find_owned_pids "$1")"
+[ -z "$owned" ] || kill -TERM $owned 2>/dev/null || true
+sleep 1
+owned="$(find_owned_pids "$1")"
+[ -z "$owned" ] || kill -KILL $owned 2>/dev/null || true
+sleep 1
+owned="$(find_owned_pids "$1")"
+[ -z "$owned" ] || { echo "Sandbox process IDs survived SIGKILL: $owned" >&2; exit 1; }
+`.trim();
+function delay(ms) {
+	return new Promise((resolve) => {
+		setTimeout(resolve, ms).unref?.();
+	});
+}
+//#endregion
 //#region extensions/codex/src/app-server/sandbox-exec-server/http.ts
 /**
 * Implements sandboxed HTTP requests for Codex native tools by routing network
@@ -2527,10 +2189,12 @@ function metadataResponse(stat) {
 /** Maximum JSON-line size accepted from the streaming HTTP helper process. */
 const SANDBOX_HTTP_STREAM_LINE_MAX_CHARS = 256 * 1024;
 /** Handles one sandbox HTTP JSON-RPC request, optionally streaming response body deltas. */
-async function httpRequest(execServer, socket, params) {
+async function httpRequest(execServer, notifications, params) {
 	const record = requireObject(params, "http/request params");
 	const requestId = requireString(record.requestId, "requestId");
 	const url = requireString(record.url, "url");
+	const redirectPolicy = record.redirectPolicy ?? "follow";
+	if (redirectPolicy !== "follow" && redirectPolicy !== "stop") throw new Error("http/request redirectPolicy must be follow or stop");
 	assertSandboxHttpRequestTargetAllowed(url);
 	const request = {
 		method: requireString(record.method, "method"),
@@ -2538,9 +2202,10 @@ async function httpRequest(execServer, socket, params) {
 		headers: readHttpHeaders(record.headers),
 		bodyBase64: typeof record.bodyBase64 === "string" ? record.bodyBase64 : void 0,
 		timeoutMs: typeof record.timeoutMs === "number" && record.timeoutMs > 0 ? Math.floor(record.timeoutMs) : void 0,
+		redirectPolicy,
 		streamResponse: record.streamResponse === true
 	};
-	if (request.streamResponse) return await runStreamingSandboxHttpRequest(execServer, socket, requestId, request);
+	if (request.streamResponse) return await runStreamingSandboxHttpRequest(execServer, notifications, requestId, request);
 	return await runSandboxHttpRequest(execServer, {
 		...request,
 		streamResponse: false
@@ -2557,7 +2222,7 @@ function assertSandboxHttpRequestTargetAllowed(url) {
 	if (isBlockedHostnameOrIp(parsed.hostname)) throw new SsrFBlockedError(`Blocked hostname or private/internal IP in sandbox http/request: ${parsed.hostname}`);
 }
 async function runSandboxHttpRequest(execServer, params) {
-	const result = await requireBackend(execServer).runShellCommand({
+	const result = await execServer.backend.runShellCommand({
 		script: SANDBOX_HTTP_REQUEST_SCRIPT,
 		stdin: JSON.stringify(params),
 		allowFailure: true
@@ -2574,44 +2239,40 @@ async function runSandboxHttpRequest(execServer, params) {
 		bodyBase64: typeof parsed.bodyBase64 === "string" ? parsed.bodyBase64 : ""
 	};
 }
-async function runStreamingSandboxHttpRequest(execServer, socket, requestId, params) {
-	const backend = requireBackend(execServer);
+async function runStreamingSandboxHttpRequest(execServer, notifications, requestId, params) {
+	const backend = execServer.backend;
+	const remoteExec = prepareSandboxChildExec(backend, {});
 	const execSpec = await backend.buildExecSpec({
 		command: SANDBOX_HTTP_REQUEST_SCRIPT,
 		workdir: execServer.sandbox.containerWorkdir,
-		env: {},
+		env: remoteExec.env,
 		usePty: false
 	});
-	let child;
-	try {
-		const [command, ...args] = execSpec.argv;
-		if (!command) throw new Error("OpenClaw sandbox HTTP exec spec did not provide a command.");
-		child = spawn(command, args, {
-			env: execSpec.env,
-			stdio: [
-				"pipe",
-				"pipe",
-				"pipe"
-			]
+	const lifecycle = { failed: false };
+	const owner = await spawnSandboxChild({
+		argv: execSpec.argv,
+		env: execSpec.env,
+		finalizeExec: backend.finalizeExec,
+		finalizeToken: execSpec.finalizeToken,
+		finalizeStatus: (outcome) => lifecycle.failed || outcome.exitCode !== 0 ? "failed" : "completed",
+		onFinalizeError: (error) => {
+			embeddedAgentLog.warn("codex sandbox http/request finalize failed", { error });
+		},
+		owners: execServer.children,
+		terminateRemote: remoteExec.terminate
+	});
+	const child = owner.process;
+	const abortOnSessionClose = () => {
+		lifecycle.failed = true;
+		owner.terminate().catch((error) => {
+			embeddedAgentLog.warn("codex sandbox http/request cleanup failed", { error });
 		});
-	} catch (error) {
-		try {
-			await backend.finalizeExec?.({
-				status: "failed",
-				exitCode: null,
-				timedOut: false,
-				token: execSpec.finalizeToken
-			});
-		} catch (finalizeError) {
-			embeddedAgentLog.warn("codex sandbox http/request finalize after start failure failed", { error: finalizeError });
-		}
-		throw error;
-	}
-	const abortOnSocketClose = () => child.kill("SIGTERM");
-	socket.once("close", abortOnSocketClose);
+	};
+	notifications.signal.addEventListener("abort", abortOnSessionClose, { once: true });
 	child.once("close", () => {
-		socket.off("close", abortOnSocketClose);
+		notifications.signal.removeEventListener("abort", abortOnSessionClose);
 	});
+	if (notifications.signal.aborted) abortOnSessionClose();
 	child.stdin.on("error", (error) => {
 		if (error.code === "EPIPE" || error.code === "ERR_STREAM_DESTROYED") return;
 		embeddedAgentLog.warn("codex sandbox http/request stdin write failed", { error });
@@ -2619,10 +2280,10 @@ async function runStreamingSandboxHttpRequest(execServer, socket, requestId, par
 	child.stdin.end(JSON.stringify(params));
 	return await readStreamingSandboxHttpResponse({
 		child,
-		execSpec,
-		finalizeExec: backend.finalizeExec,
+		lifecycle,
+		owner,
 		requestId,
-		socket
+		notifications
 	});
 }
 function readStreamingSandboxHttpResponse(params) {
@@ -2633,22 +2294,15 @@ function readStreamingSandboxHttpResponse(params) {
 		let lastBodySeq = 0;
 		let stdoutBuffer = "";
 		let stderr = "";
-		const finalize = async (status, exitCode) => {
-			await params.finalizeExec?.({
-				status,
-				exitCode,
-				timedOut: false,
-				token: params.execSpec.finalizeToken
-			});
-		};
-		const fail = (message, exitCode) => {
+		const fail = (message, _exitCode) => {
 			if (failed) return;
 			failed = true;
-			finalize("failed", exitCode).catch((error) => {
-				embeddedAgentLog.warn("codex sandbox http/request finalize failed", { error });
+			params.lifecycle.failed = true;
+			params.owner.terminate().catch((error) => {
+				embeddedAgentLog.warn("codex sandbox http/request cleanup failed", { error });
 			});
 			if (headerResolved) {
-				sendHttpBodyDelta(params.socket, {
+				if (params.notifications.isOpen()) params.notifications.send("http/request/bodyDelta", {
 					requestId: params.requestId,
 					seq: lastBodySeq + 1,
 					deltaBase64: "",
@@ -2679,7 +2333,7 @@ function readStreamingSandboxHttpResponse(params) {
 					} else if (type === "bodyDelta") {
 						const seq = requireNumber(message.seq, "http body sequence");
 						lastBodySeq = Math.max(lastBodySeq, seq);
-						sendHttpBodyDelta(params.socket, {
+						if (params.notifications.isOpen()) params.notifications.send("http/request/bodyDelta", {
 							requestId: params.requestId,
 							seq,
 							deltaBase64: typeof message.deltaBase64 === "string" ? message.deltaBase64 : "",
@@ -2692,10 +2346,7 @@ function readStreamingSandboxHttpResponse(params) {
 				}
 				newline = stdoutBuffer.indexOf("\n");
 			}
-			if (stdoutBuffer.length > SANDBOX_HTTP_STREAM_LINE_MAX_CHARS) {
-				params.child.kill("SIGKILL");
-				fail(`sandbox http/request produced an unterminated stdout line longer than ${SANDBOX_HTTP_STREAM_LINE_MAX_CHARS} characters`, null);
-			}
+			if (stdoutBuffer.length > SANDBOX_HTTP_STREAM_LINE_MAX_CHARS) fail(`sandbox http/request produced an unterminated stdout line longer than ${SANDBOX_HTTP_STREAM_LINE_MAX_CHARS} characters`, null);
 		});
 		params.child.stderr.setEncoding("utf8");
 		params.child.stderr.on("data", (chunk) => {
@@ -2703,6 +2354,7 @@ function readStreamingSandboxHttpResponse(params) {
 		});
 		params.child.once("error", (error) => {
 			childFailure ??= error.message;
+			params.lifecycle.failed = true;
 		});
 		params.child.once("close", (code) => {
 			const exitCode = code ?? 1;
@@ -2712,10 +2364,10 @@ function readStreamingSandboxHttpResponse(params) {
 				return;
 			}
 			if (exitCode === 0) {
-				finalize("completed", exitCode).catch((error) => {
-					embeddedAgentLog.warn("codex sandbox http/request finalize failed", { error });
-				});
-				if (!headerResolved) reject(/* @__PURE__ */ new Error("sandbox http/request exited before returning headers"));
+				if (!headerResolved) {
+					params.lifecycle.failed = true;
+					reject(/* @__PURE__ */ new Error("sandbox http/request exited before returning headers"));
+				}
 				return;
 			}
 			fail(stderr.trim() || `sandbox http/request failed with code ${exitCode}`, exitCode);
@@ -2847,9 +2499,40 @@ def assert_url_allowed(url):
     PINNED_ADDRESSES[hostname] = sorted(addresses)
 
 class GuardedRedirectHandler(urllib.request.HTTPRedirectHandler):
+    def __init__(self, redirect_policy):
+        self.redirect_policy = redirect_policy
+
     def redirect_request(self, req, fp, code, msg, headers, newurl):
+        if self.redirect_policy == "stop":
+            return None
         assert_url_allowed(newurl)
-        return super().redirect_request(req, fp, code, msg, headers, newurl)
+        method = req.get_method()
+        drop_body = code == 303 or (code in (301, 302) and method == "POST")
+        next_headers = dict(req.headers)
+        if drop_body:
+            if method != "HEAD":
+                method = "GET"
+            for name in ("content-type", "content-length", "content-encoding", "transfer-encoding"):
+                next_headers.pop(name.capitalize(), None)
+        redirected = urllib.request.Request(
+            newurl,
+            data=None if drop_body else req.data,
+            headers=next_headers,
+            method=method,
+            origin_req_host=req.origin_req_host,
+            unverifiable=True,
+        )
+        previous = urllib.parse.urlsplit(req.full_url)
+        target = urllib.parse.urlsplit(newurl)
+        previous_port = previous.port or (443 if previous.scheme == "https" else 80)
+        target_port = target.port or (443 if target.scheme == "https" else 80)
+        if (previous.scheme, previous.hostname, previous_port) != (
+            target.scheme, target.hostname, target_port
+        ):
+            # Match Codex's route-aware client: cross-origin hops never inherit secrets.
+            for name in ("authorization", "cookie", "proxy-authorization", "www-authenticate", "cookie2"):
+                redirected.remove_header(name.capitalize())
+        return redirected
 
 def pinned_getaddrinfo(original_getaddrinfo):
     def getaddrinfo(host, port, family=0, type=0, proto=0, flags=0):
@@ -2905,7 +2588,8 @@ def main():
     timeout = None
     if isinstance(timeout_ms, (int, float)) and timeout_ms > 0:
         timeout = timeout_ms / 1000
-    opener = urllib.request.build_opener(urllib.request.ProxyHandler({}), GuardedRedirectHandler)
+    redirect_handler = GuardedRedirectHandler(input_data.get("redirectPolicy", "follow"))
+    opener = urllib.request.build_opener(urllib.request.ProxyHandler({}), redirect_handler)
     original_getaddrinfo = socket.getaddrinfo
     socket.getaddrinfo = pinned_getaddrinfo(original_getaddrinfo)
     try:
@@ -2921,20 +2605,6 @@ if __name__ == "__main__":
 PY
 python3 "$tmp"
 `.trim();
-function sendHttpBodyDelta(socket, params) {
-	if (socket.readyState !== 1) return;
-	socket.send(JSON.stringify({
-		jsonrpc: "2.0",
-		method: "http/request/bodyDelta",
-		params: {
-			requestId: params.requestId,
-			seq: params.seq,
-			deltaBase64: params.deltaBase64,
-			done: params.done,
-			error: params.error ?? null
-		}
-	}));
-}
 //#endregion
 //#region extensions/codex/src/app-server/sandbox-exec-server/processes.ts
 /**
@@ -2945,13 +2615,14 @@ const ENV_KEY_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
 const RETAINED_PROCESS_OUTPUT_BYTES = 1024 * 1024;
 const CLOSED_PROCESS_EVICTION_MS = 6e4;
 /** Starts a sandbox-backed process and registers it in the connection-local process table. */
-async function startProcess(execServer, processes, socket, params) {
+async function startProcess(execServer, processes, notify, params) {
 	const record = requireObject(params, "process/start params");
 	const processId = requireString(record.processId, "processId");
 	if (processes.has(processId)) throw new Error(`process already exists: ${processId}`);
 	const argv = requireStringArray(record.argv, "argv");
 	const cwd = resolveExecServerPath(requireString(record.cwd, "cwd"), "process cwd");
 	rejectUnsupportedArg0(record.arg0);
+	assertSupportedProcessSandbox(execServer, record);
 	const env = readProcessEnv(record);
 	const managed = {
 		processId,
@@ -2964,17 +2635,10 @@ async function startProcess(execServer, processes, socket, params) {
 		failure: null,
 		tty: record.tty === true,
 		pipeStdin: record.pipeStdin === true,
-		abortController: new AbortController(),
+		terminationRequested: false,
 		child: null,
-		finalized: false,
 		waiters: [],
-		emitNotification: (method, notificationParams) => {
-			if (socket.readyState === 1) socket.send(JSON.stringify({
-				jsonrpc: "2.0",
-				method,
-				params: notificationParams
-			}));
-		},
+		emitNotification: notify,
 		evictProcess: () => {
 			if (managed.evictionTimer) return;
 			managed.evictionTimer = setTimeout(() => {
@@ -2984,12 +2648,14 @@ async function startProcess(execServer, processes, socket, params) {
 		}
 	};
 	processes.set(processId, managed);
+	const startPromise = runProcess(execServer, managed, {
+		argv,
+		cwd,
+		env
+	});
+	managed.startPromise = startPromise;
 	try {
-		await runProcess(execServer, managed, {
-			argv,
-			cwd,
-			env
-		});
+		await startPromise;
 	} catch (error) {
 		processes.delete(processId);
 		managed.failure = coerceErrorMessage(error);
@@ -2998,47 +2664,60 @@ async function startProcess(execServer, processes, socket, params) {
 		managed.closed = true;
 		notifyProcessWaiters(managed);
 		throw error;
+	} finally {
+		if (managed.startPromise === startPromise) managed.startPromise = void 0;
 	}
-	return { processId };
+	return {
+		processId,
+		sandboxType: "none"
+	};
+}
+function assertSupportedProcessSandbox(execServer, record) {
+	if (record.networkProxy !== void 0 && record.networkProxy !== null) throw new Error("Codex sandbox exec-server network proxy launch is not supported.");
+	if (record.enforceManagedNetwork === true || record.managedNetwork !== void 0 && record.managedNetwork !== null) throw new Error("Codex managed network restrictions cannot be enforced by the sandbox backend.");
+	if (resolveFsSandboxPolicy(execServer, record)?.unrestricted === false) throw new Error("Codex process filesystem sandbox restrictions cannot be enforced by the backend.");
+	if (record.sandbox === void 0 || record.sandbox === null) return;
+	if (requireObject(requireObject(record.sandbox, "process sandbox context").permissions, "process sandbox permissions").network !== "restricted") return;
+	if (!execServer.networkIsolated) throw new Error("Codex network restrictions cannot be enforced by the sandbox backend.");
 }
 async function runProcess(execServer, managed, params) {
-	const backend = execServer.sandbox.backend;
-	if (!backend) throw new Error("OpenClaw sandbox backend is unavailable.");
+	const backend = execServer.backend;
 	throwIfProcessStartCancelled(managed);
+	const remoteExec = prepareSandboxChildExec(backend, params.env);
 	const execSpec = await backend.buildExecSpec({
-		command: shellCommandFromArgv(params.argv),
+		command: buildRemoteCommand(params.argv),
 		workdir: params.cwd,
-		env: params.env,
+		env: remoteExec.env,
 		usePty: false
 	});
-	managed.finalizeToken = execSpec.finalizeToken;
-	managed.finalizeExec = backend.finalizeExec;
-	let child;
-	try {
-		if (managed.abortController.signal.aborted) throw new Error("process start cancelled");
-		const [command, ...args] = execSpec.argv;
-		if (!command) throw new Error("OpenClaw sandbox exec spec did not provide a command.");
-		child = spawn(command, args, {
-			env: execSpec.env,
-			stdio: [
-				"pipe",
-				"pipe",
-				"pipe"
-			]
+	if (managed.terminationRequested) {
+		await backend.finalizeExec?.({
+			status: "failed",
+			exitCode: null,
+			timedOut: false,
+			token: execSpec.finalizeToken
 		});
-	} catch (error) {
-		managed.failure = coerceErrorMessage(error);
-		await finalizeProcess(managed).catch((finalizeError) => {
-			embeddedAgentLog.warn("codex sandbox exec-server finalize after start failure failed", {
+		throw new Error("process start cancelled");
+	}
+	const owner = await spawnSandboxChild({
+		argv: execSpec.argv,
+		env: execSpec.env,
+		finalizeExec: backend.finalizeExec,
+		finalizeToken: execSpec.finalizeToken,
+		finalizeStatus: () => managed.failure ? "failed" : "completed",
+		onFinalizeError: (error) => {
+			const message = coerceErrorMessage(error);
+			managed.failure ??= message;
+			embeddedAgentLog.warn("codex sandbox exec-server finalize failed", {
 				processId: managed.processId,
-				error: coerceErrorMessage(finalizeError)
+				error: message
 			});
-		});
-		throw error;
-	}
-	managed.child = child;
-	const abortListener = () => child.kill("SIGTERM");
-	managed.abortController.signal.addEventListener("abort", abortListener, { once: true });
+		},
+		owners: execServer.children,
+		terminateRemote: remoteExec.terminate
+	});
+	managed.child = owner;
+	const child = owner.process;
 	child.stdout.on("data", (chunk) => appendProcessChunk(managed, managed.tty ? "pty" : "stdout", chunk));
 	child.stderr.on("data", (chunk) => appendProcessChunk(managed, "stderr", chunk));
 	child.once("error", (error) => {
@@ -3046,13 +2725,12 @@ async function runProcess(execServer, managed, params) {
 		notifyProcessWaiters(managed);
 	});
 	child.once("close", (code) => {
-		managed.abortController.signal.removeEventListener("abort", abortListener);
 		emitProcessClosed(managed, code ?? 1);
 	});
 	if (!managed.tty && !managed.pipeStdin) child.stdin.end();
 }
 function throwIfProcessStartCancelled(managed) {
-	if (managed.abortController.signal.aborted) throw new Error("process start cancelled");
+	if (managed.terminationRequested) throw new Error("process start cancelled");
 }
 function appendProcessChunk(managed, stream, data) {
 	if (data.length === 0) return;
@@ -3098,28 +2776,9 @@ function emitProcessClosed(managed, exitCode) {
 			seq: closeSeq
 		});
 	}
-	finalizeProcess(managed).catch((error) => {
-		const message = coerceErrorMessage(error);
-		managed.failure ??= message;
-		embeddedAgentLog.warn("codex sandbox exec-server finalize failed", {
-			processId: managed.processId,
-			error: message
-		});
-	});
 	managed.evictProcess();
 	notifyProcessWaiters(managed);
 }
-async function finalizeProcess(managed) {
-	if (managed.finalized) return;
-	managed.finalized = true;
-	managed.child?.stdin.destroy();
-	await managed.finalizeExec?.({
-		status: managed.failure ? "failed" : "completed",
-		exitCode: managed.exitCode,
-		timedOut: false,
-		token: managed.finalizeToken
-	});
-}
 function limitProcessChunks(chunks, maxBytes) {
 	if (!maxBytes) return chunks;
 	const retained = [];
@@ -3158,19 +2817,20 @@ function writeProcess(processes, params) {
 	const managed = processes.get(processId);
 	if (!managed) return { status: "unknownProcess" };
 	const chunk = Buffer.from(requireString(record.chunk, "chunk"), "base64");
-	if (!managed.tty && !managed.pipeStdin || managed.closed || !managed.child?.stdin.writable) return { status: "stdinClosed" };
-	managed.child.stdin.write(chunk);
+	if (!managed.tty && !managed.pipeStdin || managed.closed || !managed.child?.process.stdin.writable) return { status: "stdinClosed" };
+	managed.child.process.stdin.write(chunk);
 	return { status: "accepted" };
 }
 /** Requests process termination and reports whether it was running at call time. */
-function terminateProcess(processes, params) {
+async function terminateProcess(processes, params) {
 	const processId = requireString(requireObject(params, "process/terminate params").processId, "processId");
 	const managed = processes.get(processId);
 	if (!managed) return { running: false };
 	const running = !managed.exited;
-	managed.abortController.abort();
-	managed.child?.kill("SIGTERM");
-	if (running && !managed.child) emitProcessClosed(managed, null);
+	managed.terminationRequested = true;
+	await managed.startPromise?.catch(() => void 0);
+	if (managed.child) await managed.child.terminate();
+	else if (running && !managed.closed) emitProcessClosed(managed, null);
 	return { running };
 }
 function waitForProcessUpdate(managed, waitMs) {
@@ -3192,12 +2852,6 @@ function notifyProcessWaiters(managed) {
 function hasChunksAtOrAfter(managed, afterSeq) {
 	return managed.chunks.some((chunk) => chunk.seq > afterSeq);
 }
-function shellCommandFromArgv(argv) {
-	return argv.map(shellEscape).join(" ");
-}
-function shellEscape(value) {
-	return `'${value.replaceAll("'", `'"'"'`)}'`;
-}
 function requireProcess(processes, processId) {
 	const managed = processes.get(processId);
 	if (!managed) throw new Error(`unknown process: ${processId}`);
@@ -3241,47 +2895,148 @@ function readStringList(value) {
 	return Array.isArray(value) ? value.filter((entry) => typeof entry === "string") : [];
 }
 //#endregion
+//#region extensions/codex/src/app-server/sandbox-exec-server/session.ts
+/** Owns the JSON-RPC protocol and resources of one sandbox execution connection. */
+/** Connection-local execution state; closing it never enables session resumption. */
+var CodexSandboxExecSession = class {
+	constructor(execServer, transport) {
+		this.execServer = execServer;
+		this.transport = transport;
+		this.processes = /* @__PURE__ */ new Map();
+		this.fileReads = /* @__PURE__ */ new Map();
+		this.closeController = new AbortController();
+		this.notifications = {
+			isOpen: transport.isOpen,
+			signal: this.closeController.signal,
+			send: (method, params) => {
+				if (transport.isOpen()) transport.send({
+					jsonrpc: "2.0",
+					method,
+					params
+				});
+			}
+		};
+	}
+	async handleRequest(request) {
+		const method = request.method;
+		if (!method) {
+			sendError(this.transport.send, request.id, -32600, "Invalid Request");
+			return;
+		}
+		if (request.id === void 0) {
+			if (method !== "initialized") sendError(this.transport.send, -1, -32600, `Unexpected notification: ${method}`);
+			return;
+		}
+		try {
+			const result = await this.dispatchRequest(method, request.params);
+			sendResult(this.transport.send, request.id, result);
+		} catch (error) {
+			sendError(this.transport.send, request.id, error instanceof JsonRpcProtocolError ? error.code : -32603, error instanceof Error ? error.message : String(error));
+		}
+	}
+	close() {
+		if (!this.cleanup) {
+			this.closeController.abort();
+			closeAllFileReads(this.fileReads);
+			this.cleanup = Promise.all([...this.processes.keys()].map(async (processId) => terminateProcess(this.processes, { processId }))).then(() => void 0);
+		}
+		return this.cleanup;
+	}
+	async dispatchRequest(method, params) {
+		switch (method) {
+			case "initialize": return { sessionId: randomUUID() };
+			case "environment/info": return {
+				shell: {
+					name: "sh",
+					path: "/bin/sh"
+				},
+				cwd: pathToFileURL(this.execServer.sandbox.containerWorkdir, { windows: false }).href,
+				capabilities: { networkProxyLaunch: false }
+			};
+			case "environment/status": return { status: "ready" };
+			case "process/start": return startProcess(this.execServer, this.processes, this.notifications.send, params);
+			case "process/read": return await readProcess(this.processes, params);
+			case "process/write": return writeProcess(this.processes, params);
+			case "process/terminate": return await terminateProcess(this.processes, params);
+			case "fs/open": return await openFile(this.execServer, this.fileReads, params);
+			case "fs/readBlock": return readFileBlock(this.fileReads, params);
+			case "fs/close": return closeFile(this.fileReads, params);
+			case "fs/readFile": return await readFile(this.execServer, params);
+			case "fs/writeFile":
+				await writeFile(this.execServer, params);
+				return {};
+			case "fs/createDirectory":
+				await createDirectory(this.execServer, params);
+				return {};
+			case "fs/getMetadata": return await getMetadata(this.execServer, params);
+			case "fs/readDirectory": return await readDirectory(this.execServer, params);
+			case "fs/remove":
+				await removePath(this.execServer, params);
+				return {};
+			case "fs/copy":
+				await copyPath(this.execServer, params);
+				return {};
+			case "http/request": return await httpRequest(this.execServer, this.notifications, params);
+			default: throw new JsonRpcProtocolError(JSON_RPC_METHOD_NOT_FOUND, `Unsupported OpenClaw sandbox exec-server method: ${method}`);
+		}
+	}
+};
+//#endregion
 //#region extensions/codex/src/app-server/sandbox-exec-server.ts
 /**
 * Hosts the local OpenClaw sandbox exec-server that Codex app-server native
 * execution can register as an external environment.
 */
 const CODEX_SANDBOX_EXEC_SERVER_MAX_INBOUND_MESSAGE_BYTES = 100 * 1024 * 1024;
+const CODEX_NODE_EXEC_SERVER_MAX_MESSAGE_BYTES = 64 * 1024 * 1024;
+const codexNodeExecServerLeases = /* @__PURE__ */ new WeakMap();
 /** Starts or reuses a sandbox exec-server and registers it with Codex app-server. */
 async function ensureCodexSandboxExecServerEnvironment(params) {
-	if (!params.sandbox?.enabled || !params.sandbox.backend) return;
+	if (!params.sandbox?.enabled) return;
+	const placementNodeId = readCodexPlacementNodeId(params.sandbox);
+	if (!params.sandbox.backend && !placementNodeId) return;
+	if (placementNodeId && !params.runtime) throw new Error("Codex node execution requires its active plugin runtime.");
 	if (!canExposeLocalExecServerToAppServer(params.appServerStartOptions)) throw new Error("OpenClaw Codex exec-server uses a local loopback URL and cannot be registered with a remote Codex app-server.");
-	const execServer = await acquireOpenClawExecServer(params.sandbox);
+	const { server: execServer, nodeLease } = await acquireOpenClawExecServer({
+		sandbox: params.sandbox,
+		runtime: params.runtime,
+		signal: params.signal,
+		onExecutionDisconnect: params.onExecutionDisconnect
+	});
+	const environmentId = nodeLease ? `openclaw-node-${nodeLease.id}` : execServer.environmentId;
 	try {
+		const execServerUrl = nodeLease ? `${execServer.url}?lease=${nodeLease.id}` : execServer.url;
 		await params.client.request("environment/add", {
-			environmentId: execServer.environmentId,
-			execServerUrl: execServer.url
+			environmentId,
+			execServerUrl
 		}, {
 			timeoutMs: params.timeoutMs,
 			signal: params.signal
 		});
 	} catch (error) {
+		if (nodeLease && "node" in execServer) closeCodexNodeExecServerLease(execServer, nodeLease);
 		await releaseOpenClawExecServer(execServer);
-		if (isEnvironmentAddUnsupported(error)) {
-			embeddedAgentLog.warn("codex app-server does not support remote environments yet", { environmentId: execServer.environmentId });
-			return;
-		}
 		throw error;
 	}
-	return {
-		environmentId: execServer.environmentId,
+	const environment = {
+		environmentId,
 		cwd: params.sandbox.containerWorkdir
 	};
+	if (nodeLease) codexNodeExecServerLeases.set(environment, nodeLease);
+	return environment;
 }
 /** Releases the sandbox exec-server lease associated with a sandbox runtime. */
-async function releaseCodexSandboxExecServerEnvironment(sandbox) {
+async function releaseCodexSandboxExecServerEnvironment(sandbox, environment) {
 	if (!sandbox?.enabled) return;
 	const server = await sandboxExecServerRegistry.servers.get(sandbox.runtimeId)?.catch(() => void 0);
-	if (server) await releaseOpenClawExecServer(server);
-}
-function isEnvironmentAddUnsupported(error) {
-	if (!(error instanceof Error)) return false;
-	return error.message.includes("environment/add") && (error.message.includes("unknown variant") || error.message.includes("Method not found"));
+	if (server) {
+		const nodeLease = environment && codexNodeExecServerLeases.get(environment);
+		if (nodeLease && "node" in server) {
+			codexNodeExecServerLeases.delete(environment);
+			closeCodexNodeExecServerLease(server, nodeLease);
+		}
+		await releaseOpenClawExecServer(server);
+	}
 }
 function canExposeLocalExecServerToAppServer(startOptions) {
 	if (!startOptions || startOptions.transport !== "websocket") return true;
@@ -3295,14 +3050,60 @@ function canExposeLocalExecServerToAppServer(startOptions) {
 		return false;
 	}
 }
-async function acquireOpenClawExecServer(sandbox) {
+async function acquireOpenClawExecServer(params) {
+	const { sandbox, runtime, signal, onExecutionDisconnect } = params;
 	const key = sandbox.runtimeId;
 	while (true) {
 		const promise = sandboxExecServerRegistry.servers.get(key) ?? startAndRememberOpenClawExecServer(sandbox);
 		const server = await promise;
 		if (!server.closed && sandboxExecServerRegistry.servers.get(key) === promise) {
 			server.refCount += 1;
-			return server;
+			if (!("node" in server)) return { server };
+			if (!runtime || !signal) {
+				await releaseOpenClawExecServer(server);
+				throw new Error("Codex node execution requires an active runtime and attempt.");
+			}
+			try {
+				const placementIdentity = readCodexPlacementWorkspaceIdentity(sandbox);
+				const channel = await runtime.nodes.openDuplex({
+					nodeId: server.node.id,
+					command: "codex.exec-server.stdio.v1",
+					params: {
+						cwd: sandbox.containerWorkdir,
+						...placementIdentity
+					},
+					sessionKey: sandbox.sessionKey,
+					timeoutMs: 0,
+					maxMessageBytes: CODEX_NODE_EXEC_SERVER_MAX_MESSAGE_BYTES,
+					maxOutstandingDeliveryBytes: 69206016,
+					signal
+				});
+				if (signal.aborted || server.closed || sandboxExecServerRegistry.servers.get(key) !== promise) {
+					channel.close();
+					throw new Error("Codex node execution retired before its channel was ready.");
+				}
+				const nodeLease = {
+					id: randomUUID(),
+					channel,
+					claimed: false,
+					closed: false,
+					onDisconnected: onExecutionDisconnect
+				};
+				server.node.leases.set(nodeLease.id, nodeLease);
+				channel.closed.then(() => handleClosedCodexNodeExecServerLease(server, nodeLease, { failed: false }), (error) => handleClosedCodexNodeExecServerLease(server, nodeLease, {
+					failed: true,
+					error
+				})).catch((error) => {
+					embeddedAgentLog.warn("codex paired-device exec-server lease cleanup failed", { error: error instanceof Error ? error.message : String(error) });
+				});
+				return {
+					server,
+					nodeLease
+				};
+			} catch (error) {
+				await releaseOpenClawExecServer(server);
+				throw error;
+			}
 		}
 	}
 }
@@ -3316,24 +3117,55 @@ function startAndRememberOpenClawExecServer(sandbox) {
 	return created;
 }
 async function startOpenClawExecServer(sandbox) {
+	const backend = sandbox.backend;
+	const fsBridge = sandbox.fsBridge;
+	const placementNodeId = readCodexPlacementNodeId(sandbox);
+	let connection;
+	if (placementNodeId) connection = {
+		kind: "node",
+		id: placementNodeId
+	};
+	else {
+		if (!backend) throw new Error("OpenClaw sandbox backend is unavailable.");
+		if (!fsBridge) throw new Error("Sandbox filesystem bridge is unavailable.");
+		connection = {
+			kind: "sandbox",
+			backend,
+			fsBridge
+		};
+	}
 	const server = new WebSocketServer({
 		host: "127.0.0.1",
 		port: 0,
-		maxPayload: CODEX_SANDBOX_EXEC_SERVER_MAX_INBOUND_MESSAGE_BYTES
+		maxPayload: connection.kind === "node" ? CODEX_NODE_EXEC_SERVER_MAX_MESSAGE_BYTES : CODEX_SANDBOX_EXEC_SERVER_MAX_INBOUND_MESSAGE_BYTES
 	});
 	await once(server, "listening");
 	const address = server.address();
 	if (!address || typeof address === "string") throw new Error("OpenClaw Codex exec-server did not bind to a TCP port.");
 	const environmentId = buildEnvironmentId(sandbox);
 	const authPath = `/openclaw-${randomUUID()}`;
-	const execServer = {
+	const common = {
 		authPath,
 		closed: false,
 		environmentId,
 		refCount: 0,
 		url: `ws://127.0.0.1:${address.port}${authPath}`,
 		sandbox,
-		server
+		server,
+		children: /* @__PURE__ */ new Set(),
+		cleanupTasks: /* @__PURE__ */ new Set()
+	};
+	const execServer = connection.kind === "node" ? {
+		...common,
+		node: {
+			id: connection.id,
+			leases: /* @__PURE__ */ new Map()
+		}
+	} : {
+		...common,
+		backend: connection.backend,
+		fsBridge: connection.fsBridge,
+		networkIsolated: (connection.backend.id === "docker" || connection.backend.id === "podman") && sandbox.docker.network.trim().toLowerCase() === "none"
 	};
 	server.on("connection", (socket, request) => {
 		socket.on("error", handleExecServerSocketError);
@@ -3341,6 +3173,10 @@ async function startOpenClawExecServer(sandbox) {
 			socket.close(1008, "unauthorized");
 			return;
 		}
+		if ("node" in execServer) {
+			handleNodeConnection(execServer, socket, request);
+			return;
+		}
 		handleConnection(execServer, socket);
 	});
 	embeddedAgentLog.info("codex sandbox exec-server started", {
@@ -3357,15 +3193,7 @@ async function releaseOpenClawExecServer(execServer) {
 	const current = await sandboxExecServerRegistry.servers.get(execServer.sandbox.runtimeId)?.catch(() => void 0);
 	if (execServer.refCount > 0 || execServer.closed) return;
 	if (current === execServer) sandboxExecServerRegistry.servers.delete(execServer.sandbox.runtimeId);
-	await closeOpenClawExecServer(execServer);
-}
-async function closeOpenClawExecServer(execServer) {
-	if (execServer.closed) return;
-	execServer.closed = true;
-	for (const client of execServer.server.clients) client.close(1001, "shutdown");
-	await new Promise((resolve) => {
-		execServer.server.close(() => resolve());
-	});
+	await sandboxExecServerRegistry.close(execServer);
 }
 function buildEnvironmentId(sandbox) {
 	return `openclaw-sandbox-${createHash("sha256").update(sandbox.runtimeId).digest("hex").slice(0, 16)}`;
@@ -3373,80 +3201,82 @@ function buildEnvironmentId(sandbox) {
 function isAuthorizedExecServerRequest(execServer, request) {
 	return new URL(request.url ?? "", "ws://127.0.0.1").pathname === execServer.authPath;
 }
+function readCodexPlacementNodeId(sandbox) {
+	if (!("placementExecutionMode" in sandbox) || sandbox.placementExecutionMode !== "remote-exec" || !("placementNodeId" in sandbox) || typeof sandbox.placementNodeId !== "string" || !sandbox.placementNodeId) return;
+	return sandbox.placementNodeId;
+}
+function readCodexPlacementWorkspaceIdentity(sandbox) {
+	if (!("placementEnvironmentId" in sandbox) || typeof sandbox.placementEnvironmentId !== "string" || !sandbox.placementEnvironmentId || sandbox.placementEnvironmentId.trim() !== sandbox.placementEnvironmentId || !("placementSessionId" in sandbox) || typeof sandbox.placementSessionId !== "string" || !sandbox.placementSessionId || sandbox.placementSessionId.trim() !== sandbox.placementSessionId || !("placementOwnerEpoch" in sandbox) || typeof sandbox.placementOwnerEpoch !== "number" || !Number.isSafeInteger(sandbox.placementOwnerEpoch) || sandbox.placementOwnerEpoch < 1 || !sandbox.sessionKey || sandbox.sessionKey.trim() !== sandbox.sessionKey) throw new Error("Codex node execution requires its exact placement workspace identity.");
+	return {
+		environmentId: sandbox.placementEnvironmentId,
+		sessionId: sandbox.placementSessionId,
+		ownerEpoch: sandbox.placementOwnerEpoch,
+		sessionKey: sandbox.sessionKey
+	};
+}
+function handleNodeConnection(execServer, socket, request) {
+	const leaseId = new URL(request.url ?? "", "ws://127.0.0.1").searchParams.get("lease");
+	const lease = leaseId ? execServer.node.leases.get(leaseId) : void 0;
+	if (!lease || lease.claimed || lease.closed) {
+		socket.close(1008, "execution channel unavailable");
+		return;
+	}
+	lease.claimed = true;
+	const cleanup = startCodexNodeExecServerRelay({
+		lease,
+		socket
+	});
+	execServer.cleanupTasks.add(cleanup);
+	cleanup.then(() => execServer.cleanupTasks.delete(cleanup), (error) => {
+		execServer.cleanupTasks.delete(cleanup);
+		embeddedAgentLog.warn("codex paired-device exec-server relay failed", { error: error instanceof Error ? error.message : String(error) });
+	});
+}
+function closeCodexNodeExecServerLease(execServer, lease) {
+	execServer.node.leases.delete(lease.id);
+	if (!lease.closed) {
+		lease.closed = true;
+		lease.closeRelay?.();
+		lease.channel.close();
+	}
+}
+function handleClosedCodexNodeExecServerLease(execServer, lease, result) {
+	if (lease.closed) return;
+	if (lease.onChannelClosed) {
+		lease.onChannelClosed(result);
+		return;
+	}
+	try {
+		lease.onDisconnected?.(createCodexNodeExecServerDisconnectError(result.failed ? "execution node failed" : "execution node disconnected", result.error));
+	} finally {
+		closeCodexNodeExecServerLease(execServer, lease);
+	}
+}
 function handleConnection(execServer, socket) {
-	const processes = /* @__PURE__ */ new Map();
-	const fileReads = /* @__PURE__ */ new Map();
+	const session = new CodexSandboxExecSession(execServer, {
+		isOpen: () => socket.readyState === socket.OPEN,
+		send: (message) => socket.send(JSON.stringify(message))
+	});
 	socket.on("message", (data) => {
-		handleMessage(execServer, processes, fileReads, socket, data).catch((error) => {
+		handleMessage(session, data).catch((error) => {
 			embeddedAgentLog.warn("codex sandbox exec-server message failed", { error });
 		});
 	});
 	socket.on("close", () => {
-		closeAllFileReads(fileReads);
-		for (const process of processes.values()) process.abortController.abort();
+		const cleanup = session.close();
+		execServer.cleanupTasks.add(cleanup);
+		cleanup.then(() => execServer.cleanupTasks.delete(cleanup), (error) => {
+			execServer.cleanupTasks.delete(cleanup);
+			embeddedAgentLog.warn("codex sandbox exec-server socket cleanup failed", { error: error instanceof Error ? error.message : String(error) });
+		});
 	});
 }
 function handleExecServerSocketError(error) {
 	embeddedAgentLog.debug("codex sandbox exec-server websocket failed", { error });
 }
-async function handleMessage(execServer, processes, fileReads, socket, data) {
-	const request = parseRequest(data);
-	if (!request.method) {
-		sendError(socket, request.id, -32600, "Invalid Request");
-		return;
-	}
-	const method = request.method;
-	if (request.id === void 0) {
-		if (method !== "initialized") sendError(socket, -1, -32600, `Unexpected notification: ${method}`);
-		return;
-	}
-	try {
-		const result = await dispatchRequest(execServer, processes, fileReads, socket, {
-			...request,
-			method
-		});
-		sendResult(socket, request.id, result);
-	} catch (error) {
-		sendError(socket, request.id, error instanceof JsonRpcProtocolError ? error.code : -32603, error instanceof Error ? error.message : String(error));
-	}
-}
-async function dispatchRequest(execServer, processes, fileReads, socket, request) {
-	switch (request.method) {
-		case "initialize": return { sessionId: randomUUID() };
-		case "environment/info": return {
-			shell: {
-				name: "sh",
-				path: "/bin/sh"
-			},
-			cwd: pathToFileURL(execServer.sandbox.containerWorkdir, { windows: false }).href,
-			capabilities: { networkProxyLaunch: false }
-		};
-		case "environment/status": return { status: "ready" };
-		case "process/start": return startProcess(execServer, processes, socket, request.params);
-		case "process/read": return await readProcess(processes, request.params);
-		case "process/write": return writeProcess(processes, request.params);
-		case "process/terminate": return terminateProcess(processes, request.params);
-		case "fs/open": return await openFile(execServer, fileReads, request.params);
-		case "fs/readBlock": return readFileBlock(fileReads, request.params);
-		case "fs/close": return closeFile(fileReads, request.params);
-		case "fs/readFile": return await readFile(execServer, request.params);
-		case "fs/writeFile":
-			await writeFile(execServer, request.params);
-			return {};
-		case "fs/createDirectory":
-			await createDirectory(execServer, request.params);
-			return {};
-		case "fs/getMetadata": return await getMetadata(execServer, request.params);
-		case "fs/readDirectory": return await readDirectory(execServer, request.params);
-		case "fs/remove":
-			await removePath(execServer, request.params);
-			return {};
-		case "fs/copy":
-			await copyPath(execServer, request.params);
-			return {};
-		case "http/request": return await httpRequest(execServer, socket, request.params);
-		default: throw new JsonRpcProtocolError(JSON_RPC_METHOD_NOT_FOUND, `Unsupported OpenClaw sandbox exec-server method: ${request.method}`);
-	}
+async function handleMessage(session, data) {
+	const buffer = Array.isArray(data) ? Buffer.concat(data) : Buffer.isBuffer(data) ? data : Buffer.from(data);
+	await session.handleRequest(parseRequest(buffer.toString("utf8")));
 }
 //#endregion
 //#region extensions/codex/src/app-server/provider-capabilities.ts
@@ -3495,87 +3325,6 @@ async function resolveCodexProviderWebSearchSupport(params) {
 	}
 }
 //#endregion
-//#region extensions/codex/src/app-server/plugin-approval-roundtrip.ts
-const DEFAULT_CODEX_APPROVAL_TIMEOUT_MS = 12e4;
-const MAX_PLUGIN_APPROVAL_TITLE_LENGTH = 80;
-const MAX_PLUGIN_APPROVAL_DESCRIPTION_LENGTH = 256;
-const ANSI_OSC_SEQUENCE_RE = new RegExp(String.raw`(?:\u001b]|\u009d)[^\u001b\u009c\u0007]*(?:\u0007|\u001b\\|\u009c)`, "g");
-const ANSI_CONTROL_SEQUENCE_RE = new RegExp(String.raw`(?:\u001b\[[0-?]*[ -/]*[@-~]|\u009b[0-?]*[ -/]*[@-~]|\u001b[@-Z\\-_])`, "g");
-const CONTROL_CHARACTER_RE = new RegExp(String.raw`[\u0000-\u001f\u007f-\u009f]+`, "g");
-const INVISIBLE_FORMATTING_CONTROL_RE = new RegExp(String.raw`[\u00ad\u034f\u061c\u200b-\u200f\u202a-\u202e\u2060-\u206f\ufeff\ufe00-\ufe0f\u{e0100}-\u{e01ef}]`, "gu");
-const DANGLING_TERMINAL_SEQUENCE_SUFFIX_RE = new RegExp(String.raw`(?:\u001b\][^\u001b\u009c\u0007]*|\u009d[^\u001b\u009c\u0007]*|\u001b\[[0-?]*[ -/]*|\u009b[0-?]*[ -/]*|\u001b)$`);
-/** Starts a two-phase plugin approval request through the OpenClaw gateway. */
-async function requestPluginApproval(params) {
-	const timeoutMs = DEFAULT_CODEX_APPROVAL_TIMEOUT_MS;
-	return params.hostCapabilities.requestApproval({
-		title: truncateCodexApprovalDisplayText(params.title, MAX_PLUGIN_APPROVAL_TITLE_LENGTH),
-		description: truncateCodexApprovalDisplayText(params.description, MAX_PLUGIN_APPROVAL_DESCRIPTION_LENGTH),
-		severity: params.severity,
-		toolName: params.toolName,
-		toolCallId: params.toolCallId,
-		timeoutMs,
-		transportTimeoutMs: resolveCodexGatewayTimeoutWithGraceMs(timeoutMs),
-		...params.allowedDecisions ? { allowedDecisions: params.allowedDecisions } : {}
-	});
-}
-/** Detects the gateway's explicit null-decision marker for unavailable approvals. */
-function approvalRequestExplicitlyUnavailable(result) {
-	if (result === null || result === void 0 || typeof result !== "object") return false;
-	let descriptor;
-	try {
-		descriptor = Object.getOwnPropertyDescriptor(result, "decision");
-	} catch {
-		return false;
-	}
-	return descriptor !== void 0 && "value" in descriptor && descriptor.value === null;
-}
-/** Waits for the gateway's final approval decision, respecting turn aborts. */
-async function waitForPluginApprovalDecision(params) {
-	const timeoutMs = DEFAULT_CODEX_APPROVAL_TIMEOUT_MS;
-	const waitPromise = params.hostCapabilities.waitForApproval({
-		approvalId: params.approvalId,
-		timeoutMs,
-		transportTimeoutMs: resolveCodexGatewayTimeoutWithGraceMs(timeoutMs),
-		signal: params.signal
-	}).catch((error) => {
-		if (isApprovalNotFoundError(error)) return null;
-		throw error;
-	});
-	const bindDecision = (result) => result;
-	if (!params.signal) return bindDecision(await waitPromise);
-	let onAbort;
-	const abortPromise = new Promise((_, reject) => {
-		if (params.signal.aborted) {
-			reject(toErrorObject(params.signal.reason, "Non-Error rejection"));
-			return;
-		}
-		onAbort = () => reject(toErrorObject(params.signal.reason, "Non-Error rejection"));
-		params.signal.addEventListener("abort", onAbort, { once: true });
-	});
-	try {
-		return bindDecision(await Promise.race([waitPromise, abortPromise]));
-	} finally {
-		if (onAbort) params.signal.removeEventListener("abort", onAbort);
-	}
-}
-/** Converts a gateway exec approval decision into the app-server approval outcome enum. */
-function mapExecDecisionToOutcome(decision) {
-	if (decision === "allow-once") return "approved-once";
-	if (decision === "allow-always") return "approved-session";
-	if (decision === null || decision === void 0) return "unavailable";
-	return "denied";
-}
-function truncateCodexApprovalDisplayText(value, maxLength) {
-	return value.length <= maxLength ? value : `${truncateUtf16Safe(value, maxLength - 3)}...`;
-}
-function stripDanglingCodexApprovalTerminalSequence(value) {
-	return value.replace(DANGLING_TERMINAL_SEQUENCE_SUFFIX_RE, "");
-}
-function sanitizeCodexApprovalVisibleText(value, options = {}) {
-	const terminalSafe = value.replace(ANSI_OSC_SEQUENCE_RE, "").replace(ANSI_CONTROL_SEQUENCE_RE, "");
-	return (options.stripDanglingTerminalSequence ? stripDanglingCodexApprovalTerminalSequence(terminalSafe) : terminalSafe).replace(INVISIBLE_FORMATTING_CONTROL_RE, " ").replace(CONTROL_CHARACTER_RE, " ").replace(/\s+/g, " ").trim();
-}
-//#endregion
 //#region extensions/codex/src/app-server/approval-bridge.ts
 /**
 * Bridges Codex app-server approval requests into OpenClaw policy hooks and
@@ -3600,19 +3349,55 @@ async function handleCodexAppServerApprovalRequest(params) {
 		requestParams,
 		paramsForRun: params.paramsForRun
 	});
-	const resolvePolicyApproval = (outcome, message = approvalResolutionMessage(outcome)) => {
+	if (params.signal?.aborted) {
+		recordNativeToolFailureDisposition(params, context, "cancelled");
+		return buildApprovalResponse(params.method, context.requestParams, "cancelled");
+	}
+	let revalidateMutableFileApproval;
+	let mutableFileApprovalRequiresOneShot = false;
+	const resolvePolicyApproval = async (outcome, message = approvalResolutionMessage(outcome), approvalId) => {
+		let resolvedOutcome = outcome;
+		let resolvedMessage = message;
+		if (outcome !== "denied" && revalidateMutableFileApproval) {
+			const binding = await revalidateMutableFileApproval();
+			if (!binding.ok) {
+				resolvedOutcome = "denied";
+				resolvedMessage = binding.message;
+			}
+		}
+		if (resolvedOutcome === "approved-session" && mutableFileApprovalRequiresOneShot) {
+			resolvedOutcome = "approved-once";
+			resolvedMessage = "Codex app-server approval granted for this byte-bound command only.";
+		}
 		emitApprovalEvent(params.paramsForRun, {
 			phase: "resolved",
 			kind: context.kind,
-			status: outcome === "denied" ? "denied" : "approved",
+			status: resolvedOutcome === "denied" ? "denied" : "approved",
 			title: context.title,
+			...approvalId ? {
+				approvalId,
+				approvalSlug: approvalId
+			} : {},
 			...context.eventDetails,
-			...approvalEventScope(params.method, outcome),
-			message
+			...approvalEventScope(params.method, resolvedOutcome),
+			message: resolvedMessage
 		});
-		return buildApprovalResponse(params.method, context.requestParams, outcome);
+		return buildApprovalResponse(params.method, context.requestParams, resolvedOutcome);
 	};
 	try {
+		if (params.method === "item/commandExecution/requestApproval" && !readNetworkApprovalContext(requestParams)) {
+			const command = readPolicyCommand(requestParams);
+			const cwd = readStringField(requestParams, "cwd") ?? params.paramsForRun.workspaceDir;
+			const prepareMutableFileApproval = params.paramsForRun.hostCapabilities.prepareMutableFileApproval;
+			if (!prepareMutableFileApproval) return await resolvePolicyApproval("denied", "SYSTEM_RUN_DENIED: mutable file approval binding is unavailable");
+			const prepared = await prepareMutableFileApproval({
+				command: command ?? "",
+				cwd
+			});
+			if (!prepared.ok) return await resolvePolicyApproval("denied", prepared.message);
+			mutableFileApprovalRequiresOneShot = prepared.requiresOneShot;
+			revalidateMutableFileApproval = prepared.revalidate;
+		}
 		const policyOutcome = await runOpenClawToolPolicyForApprovalRequest({
 			method: params.method,
 			requestParams,
@@ -3624,19 +3409,22 @@ async function handleCodexAppServerApprovalRequest(params) {
 		});
 		if (policyOutcome?.outcome === "denied") {
 			recordNativeToolFailureDisposition(params, context, policyOutcome.failureDisposition);
-			return resolvePolicyApproval("denied", policyOutcome.reason);
+			return await resolvePolicyApproval("denied", policyOutcome.reason);
 		}
-		if (policyOutcome?.outcome === "approved-once" || policyOutcome?.outcome === "approved-session") return resolvePolicyApproval(policyOutcome.outcome);
-		const canAutoApproveConcreteToolCall = CONCRETE_TOOL_AUTO_APPROVAL_METHODS.has(params.method);
-		if (canAutoApproveConcreteToolCall && params.autoApproveOpenClawToolPolicy === true && policyOutcome?.outcome === "allowed") return resolvePolicyApproval("approved-once", "Codex app-server approval accepted by OpenClaw tool policy.");
-		if (canAutoApproveConcreteToolCall && params.autoApprove === true) return resolvePolicyApproval("approved-session", "Codex app-server approval auto-approved by runtime policy.");
+		if (policyOutcome?.outcome === "approved-once" || policyOutcome?.outcome === "approved-session") return await resolvePolicyApproval(policyOutcome.outcome);
+		if (CONCRETE_TOOL_AUTO_APPROVAL_METHODS.has(params.method) && !readNetworkApprovalContext(requestParams) && params.autoApprove === true) return await resolvePolicyApproval("approved-session", "Codex app-server approval auto-approved by runtime policy.");
 		const requestResult = await requestPluginApproval({
 			hostCapabilities: params.paramsForRun.hostCapabilities,
 			title: context.title,
 			description: context.description,
 			severity: context.severity,
 			toolName: context.toolName,
-			toolCallId: context.approvalId
+			toolCallId: context.approvalId,
+			allowedDecisions: nativeApprovalAllowedDecisions({
+				method: params.method,
+				requestParams,
+				requiresOneShot: mutableFileApprovalRequiresOneShot
+			})
 		});
 		const approvalId = requestResult?.id;
 		if (!approvalId) {
@@ -3662,16 +3450,17 @@ async function handleCodexAppServerApprovalRequest(params) {
 			...context.eventDetails,
 			message: "Codex app-server approval requested."
 		});
-		const requestUnavailable = approvalRequestExplicitlyUnavailable(requestResult);
-		const decision = requestUnavailable ? null : await waitForPluginApprovalDecision({
+		const approvalResult = approvalRequestExplicitlyUnavailable(requestResult) ? void 0 : await waitForPluginApprovalDecision({
 			approvalId,
 			signal: params.signal,
 			hostCapabilities: params.paramsForRun.hostCapabilities
 		});
-		const approvalExpired = !requestUnavailable && decision === null;
-		const outcome = params.signal?.aborted ? "cancelled" : mapExecDecisionToOutcome(decision);
-		if (outcome === "cancelled") recordNativeToolFailureDisposition(params, context, params.signal?.aborted ? resolveCodexToolAbortTerminalReason(params.signal) : "cancelled");
-		else if (outcome === "unavailable") recordNativeToolFailureDisposition(params, context, approvalExpired ? "timed_out" : "failed");
+		const approvalTimedOut = !params.signal?.aborted && approvalResult?.terminalReason === "timeout";
+		const outcome = params.signal?.aborted ? "cancelled" : mapExecDecisionToOutcome(approvalResult?.decision);
+		if (approvalTimedOut) recordNativeToolFailureDisposition(params, context, "timed_out", context.approvalKind);
+		else if (outcome === "cancelled") recordNativeToolFailureDisposition(params, context, params.signal?.aborted ? resolveCodexToolAbortTerminalReason(params.signal) : "cancelled");
+		else if (outcome === "unavailable") recordNativeToolFailureDisposition(params, context, "failed");
+		if (outcome === "approved-once" || outcome === "approved-session") return await resolvePolicyApproval(outcome, approvalResolutionMessage(outcome), approvalId);
 		emitApprovalEvent(params.paramsForRun, {
 			phase: "resolved",
 			kind: context.kind,
@@ -3681,7 +3470,7 @@ async function handleCodexAppServerApprovalRequest(params) {
 			approvalSlug: approvalId,
 			...context.eventDetails,
 			...approvalEventScope(params.method, outcome),
-			message: approvalResolutionMessage(outcome)
+			message: approvalTimedOut ? codexApprovalTimeoutText(context.approvalKind) : approvalResolutionMessage(outcome)
 		});
 		return buildApprovalResponse(params.method, context.requestParams, outcome);
 	} catch (error) {
@@ -3699,10 +3488,11 @@ async function handleCodexAppServerApprovalRequest(params) {
 		return buildApprovalResponse(params.method, context.requestParams, cancelled ? "cancelled" : "denied");
 	}
 }
-function recordNativeToolFailureDisposition(params, context, disposition) {
+function recordNativeToolFailureDisposition(params, context, disposition, approvalKind) {
 	if (!context.itemId || !disposition) return;
 	try {
-		params.onNativeToolFailureDisposition?.(context.itemId, params.signal?.aborted ? resolveCodexToolAbortTerminalReason(params.signal) : disposition);
+		const resolvedDisposition = params.signal?.aborted ? resolveCodexToolAbortTerminalReason(params.signal) : disposition;
+		params.onNativeToolFailureDisposition?.(context.itemId, resolvedDisposition, ...resolvedDisposition === "timed_out" && approvalKind ? [approvalKind] : []);
 	} catch {}
 }
 /** Converts an OpenClaw approval outcome into the app-server method response. */
@@ -3719,7 +3509,10 @@ function buildApprovalResponse(method, requestParams, outcome) {
 			scope: "turn"
 		};
 	}
-	return unsupportedApprovalResponse();
+	return {
+		decision: "decline",
+		reason: "OpenClaw codex app-server bridge does not grant native approvals yet."
+	};
 }
 function matchesCurrentTurn(requestParams, threadId, turnId) {
 	if (!requestParams) return false;
@@ -3735,20 +3528,19 @@ function buildApprovalContext(params) {
 	const reasonPreview = sanitizeApprovalPreview(readStringPreview(params.requestParams, "reason"), 180);
 	const command = commandPreview.text;
 	const reason = reasonPreview.text;
-	const kind = approvalKindForMethod(params.method);
+	const networkApproval = params.method === "item/commandExecution/requestApproval" ? readNetworkApprovalContext(params.requestParams) : void 0;
+	const approvalKind = params.method.includes("commandExecution") ? "command" : params.method.includes("fileChange") ? "file-change" : params.method.includes("permissions") ? "permissions" : "other";
+	const kind = approvalKind === "command" ? "exec" : approvalKind === "other" ? "unknown" : "plugin";
 	const permissionLines = params.method === "item/permissions/requestApproval" ? describeRequestedPermissions(params.requestParams) : [];
-	const title = kind === "exec" ? "Codex app-server command approval" : params.method === "item/permissions/requestApproval" ? "Codex app-server permission approval" : kind === "plugin" ? "Codex app-server file approval" : "Codex app-server approval";
-	const subject = permissionLines[0] ?? (command ? `Command: ${formatApprovalPreviewSubject(command, commandPreview.omitted)}` : commandPreview.omitted ? `Command: ${APPROVAL_PREVIEW_OMITTED}` : reason ? `Reason: ${formatApprovalPreviewSubject(reason, reasonPreview.omitted)}` : reasonPreview.omitted ? `Reason: ${APPROVAL_PREVIEW_OMITTED}` : `Request method: ${params.method}`);
+	const title = networkApproval ? "Codex app-server network approval" : kind === "exec" ? "Codex app-server command approval" : params.method === "item/permissions/requestApproval" ? "Codex app-server permission approval" : kind === "plugin" ? "Codex app-server file approval" : "Codex app-server approval";
+	const subject = (networkApproval ? `Network: ${sanitizePermissionScalar(networkApproval.protocol)}://${sanitizePermissionHostValue(networkApproval.host)}` : void 0) ?? permissionLines[0] ?? (command ? `Command: ${formatApprovalPreviewSubject(command, commandPreview.omitted)}` : commandPreview.omitted ? `Command: ${APPROVAL_PREVIEW_OMITTED}` : reason ? `Reason: ${formatApprovalPreviewSubject(reason, reasonPreview.omitted)}` : reasonPreview.omitted ? `Reason: ${APPROVAL_PREVIEW_OMITTED}` : `Request method: ${params.method}`);
 	return {
+		approvalKind,
 		kind,
 		title,
-		description: permissionLines.length > 0 ? joinDescriptionLinesWithinLimit(permissionLines, PERMISSION_DESCRIPTION_MAX_LENGTH) : [
-			subject,
-			...commandDetailLines,
-			params.paramsForRun.sessionKey && `Session: ${params.paramsForRun.sessionKey}`
-		].filter(Boolean).join("\n"),
+		description: permissionLines.length > 0 ? joinDescriptionLinesWithinLimit(permissionLines, PERMISSION_DESCRIPTION_MAX_LENGTH) : [subject, ...commandDetailLines].join("\n"),
 		severity: kind === "exec" ? "warning" : "info",
-		toolName: kind === "exec" ? "codex_command_approval" : params.method === "item/permissions/requestApproval" ? "codex_permission_approval" : "codex_file_approval",
+		toolName: networkApproval ? "codex_network_approval" : kind === "exec" ? "codex_command_approval" : params.method === "item/permissions/requestApproval" ? "codex_permission_approval" : "codex_file_approval",
 		itemId,
 		approvalId,
 		requestParams: params.requestParams,
@@ -3920,6 +3712,10 @@ function sanitizeRelayDecisionReason(value) {
 }
 function buildOpenClawToolPolicyRequest(method, requestParams) {
 	if (method === "item/commandExecution/requestApproval") {
+		if (readNetworkApprovalContext(requestParams)) return {
+			toolName: "codex_network_approval",
+			params: { approval: requestParams ?? {} }
+		};
 		const command = readPolicyCommand(requestParams);
 		return {
 			toolName: "exec",
@@ -3960,14 +3756,27 @@ function stableJsonText(value) {
 	}
 }
 function commandApprovalDecision(requestParams, outcome) {
-	if (outcome === "cancelled") return commandRejectionDecision(requestParams, "cancel");
-	if (outcome === "denied" || outcome === "unavailable") return commandRejectionDecision(requestParams, "decline");
-	if (outcome === "approved-session") {
-		if (hasAvailableDecision(requestParams, "acceptForSession")) return "acceptForSession";
-		const amendmentDecision = findAvailableCommandAmendmentDecision(requestParams);
-		if (amendmentDecision) return amendmentDecision;
-	}
-	return hasAvailableDecision(requestParams, "accept") ? "accept" : commandRejectionDecision(requestParams, "decline");
+	if (outcome === "cancelled") return "cancel";
+	if (outcome === "denied" || outcome === "unavailable") return "decline";
+	const capabilities = commandApprovalCapabilities(requestParams);
+	if (outcome === "approved-session" && capabilities.sessionDecision !== void 0) return capabilities.sessionDecision;
+	return capabilities.once ? "accept" : "decline";
+}
+function nativeApprovalAllowedDecisions(params) {
+	if (params.method === "item/fileChange/requestApproval") return [
+		"allow-once",
+		"allow-always",
+		"deny"
+	];
+	if (params.method !== "item/commandExecution/requestApproval") return;
+	const available = params.requestParams?.availableDecisions;
+	if (!Array.isArray(available)) return;
+	const capabilities = commandApprovalCapabilities(params.requestParams);
+	const decisions = [];
+	if (capabilities.once) decisions.push("allow-once");
+	if (!params.requiresOneShot && capabilities.sessionDecision !== void 0) decisions.push("allow-always");
+	decisions.push("deny");
+	return decisions;
 }
 function fileChangeApprovalDecision(outcome) {
 	if (outcome === "cancelled") return "cancel";
@@ -3981,12 +3790,6 @@ function requestedPermissions(requestParams) {
 	if (isJsonObject(permissions.fileSystem)) granted.fileSystem = permissions.fileSystem;
 	return granted;
 }
-function unsupportedApprovalResponse() {
-	return {
-		decision: "decline",
-		reason: "OpenClaw codex app-server bridge does not grant native approvals yet."
-	};
-}
 function describeRequestedPermissions(requestParams) {
 	return describePermissionProfile(requestedPermissions(requestParams), "Permissions");
 }
@@ -4154,43 +3957,38 @@ function isPrivateNetworkHostPattern(value) {
 	if (wildcardStripped.startsWith("10.") || wildcardStripped.startsWith("127.") || wildcardStripped.startsWith("192.168.") || wildcardStripped.startsWith("169.254.")) return true;
 	return /^172\.(1[6-9]|2\d|3[0-1])\./.test(wildcardStripped);
 }
-function hasAvailableDecision(requestParams, decision) {
+function commandApprovalCapabilities(requestParams) {
 	const available = requestParams?.availableDecisions;
-	if (!Array.isArray(available)) return true;
-	return available.includes(decision);
+	if (!Array.isArray(available)) return {
+		once: true,
+		sessionDecision: "acceptForSession"
+	};
+	return {
+		once: available.includes("accept"),
+		...available.includes("acceptForSession") ? { sessionDecision: "acceptForSession" } : { sessionDecision: findAvailableCommandAmendmentDecision(requestParams) }
+	};
 }
 function findAvailableCommandAmendmentDecision(requestParams) {
 	const available = requestParams?.availableDecisions;
 	if (!Array.isArray(available)) return;
 	return available.find((entry) => isJsonObject(entry) && (isJsonObject(entry.acceptWithExecpolicyAmendment) || isJsonObject(entry.applyNetworkPolicyAmendment)));
 }
-function commandRejectionDecision(requestParams, preferred) {
-	const available = requestParams?.availableDecisions;
-	if (!Array.isArray(available)) return preferred;
-	if (available.includes(preferred)) return preferred;
-	const alternate = preferred === "decline" ? "cancel" : "decline";
-	if (available.includes(alternate)) return alternate;
-	return preferred;
-}
 function approvalResolutionMessage(outcome) {
-	if (outcome === "approved-session") return "Codex app-server approval granted for the session.";
-	if (outcome === "approved-once") return "Codex app-server approval granted for this turn.";
-	if (outcome === "cancelled") return "Codex app-server approval cancelled.";
-	if (outcome === "unavailable") return "Codex app-server approval unavailable.";
-	return "Codex app-server approval denied.";
+	return {
+		"approved-session": "Codex app-server approval granted for the session.",
+		"approved-once": "Codex app-server approval granted for this turn.",
+		cancelled: "Codex app-server approval cancelled.",
+		unavailable: "Codex app-server approval unavailable.",
+		denied: "Codex app-server approval denied."
+	}[outcome];
 }
 function approvalEventScope(method, outcome) {
 	return method === "item/permissions/requestApproval" ? { scope: outcome === "approved-session" ? "session" : "turn" } : {};
 }
-function approvalKindForMethod(method) {
-	if (method.includes("commandExecution") || method.includes("execCommand")) return "exec";
-	if (method.includes("fileChange") || method.includes("Patch") || method.includes("permissions")) return "plugin";
-	return "unknown";
-}
 function emitApprovalEvent(params, data) {
 	params.onAgentEvent?.({
 		stream: "approval",
-		data
+		data: { ...data }
 	});
 }
 function readDisplayCommandPreview(record) {
@@ -4205,6 +4003,15 @@ function readPolicyCommand(record) {
 	const actionCommands = readCommandActions(record);
 	if (actionCommands.length > 0) return actionCommands.join(" && ");
 }
+function readNetworkApprovalContext(record) {
+	const context = isJsonObject(record?.networkApprovalContext) ? record.networkApprovalContext : void 0;
+	const host = readStringField(context, "host");
+	const protocol = readStringField(context, "protocol");
+	return host && protocol ? {
+		host,
+		protocol
+	} : void 0;
+}
 function readCommandActions(record) {
 	const actions = record?.commandActions;
 	if (!Array.isArray(actions)) return [];
@@ -4389,11 +4196,12 @@ const MAX_DISPLAY_VALUE_ARRAY_ITEMS = 8;
 const MAX_DISPLAY_VALUE_OBJECT_KEYS = 8;
 const MAX_DISPLAY_VALUE_DEPTH = 3;
 const DISPLAY_TEXT_SCAN_MAX_LENGTH = 4096;
-async function handleCodexAppServerElicitationRequest(params) {
+async function routeCodexAppServerElicitationRequest(params) {
 	const requestParams = isJsonObject(params.requestParams) ? params.requestParams : void 0;
-	if (!requestParams || readNonBlankStringField(requestParams, "threadId") !== params.threadId) return;
+	if (!requestParams || readNonBlankStringField(requestParams, "threadId") !== params.threadId) return { kind: "not-mine" };
 	const requestTurnId = requestParams.turnId;
-	if (requestTurnId !== null && requestTurnId !== void 0 && requestTurnId !== params.turnId) return;
+	if (requestTurnId !== null && requestTurnId !== void 0 && requestTurnId !== params.turnId) return { kind: "not-mine" };
+	if (!((isJsonObject(requestParams["_meta"]) ? requestParams["_meta"] : void 0)?.[MCP_TOOL_APPROVAL_KIND_KEY] === MCP_TOOL_APPROVAL_KIND || params.computerUseMcpServerName !== void 0 && readNonBlankStringField(requestParams, "serverName") === params.computerUseMcpServerName)) return { kind: "not-mine" };
 	const pluginResolution = resolvePluginElicitation({
 		requestParams,
 		pluginAppPolicyContext: params.pluginAppPolicyContext
@@ -4401,32 +4209,38 @@ async function handleCodexAppServerElicitationRequest(params) {
 	if (pluginResolution.kind !== "not_plugin") {
 		if (params.paramsForRun.trigger === "cron" && params.paramsForRun.scheduledRuntimeAuthority) {
 			logPluginElicitationDecline("scheduled_authority_non_interactive", requestParams);
-			return declineElicitationResponse();
+			return handled(createCodexElicitationResponse("decline"));
 		}
 		if (pluginResolution.kind === "decline") {
 			logPluginElicitationDecline(pluginResolution.reason, requestParams);
-			return declineElicitationResponse();
+			return handled(createCodexElicitationResponse("decline"));
 		}
 		if (requestTurnId !== params.turnId) {
 			logPluginElicitationDecline("missing_active_turn", requestParams);
-			return declineElicitationResponse();
+			return handled(createCodexElicitationResponse("decline"));
 		}
-		return await buildPluginPolicyElicitationResponse({
+		return handled(await buildPluginPolicyElicitationResponse({
 			entry: pluginResolution.entry,
 			requestParams,
 			paramsForRun: params.paramsForRun,
 			signal: params.signal
-		});
+		}));
 	}
 	const approvalPrompt = readComputerUseApprovalElicitation(requestParams, params.computerUseMcpServerName) ?? readBridgeableApprovalElicitation(requestParams);
-	if (!approvalPrompt) return;
-	return buildElicitationResponse(approvalPrompt, await requestPluginApprovalOutcome({
+	if (!approvalPrompt) return handled(createCodexElicitationResponse("decline"));
+	return handled(buildElicitationResponse(approvalPrompt, await requestPluginApprovalOutcome({
 		paramsForRun: params.paramsForRun,
 		title: approvalPrompt.title,
 		description: approvalPrompt.description,
 		allowedDecisions: approvalPrompt.allowedDecisions,
 		signal: params.signal
-	}));
+	})));
+}
+function handled(response) {
+	return {
+		kind: "handled",
+		response
+	};
 }
 function resolvePluginElicitation(params) {
 	const requestParams = params.requestParams;
@@ -4527,26 +4341,27 @@ async function buildPluginPolicyElicitationResponse(params) {
 	const mode = resolvePluginDestructiveApprovalMode(params.entry);
 	if (mode === "deny") {
 		logPluginElicitationDecline("destructive_actions_disabled", params.requestParams);
-		return declineElicitationResponse();
+		return createCodexElicitationResponse("decline");
 	}
 	const approvalPrompt = readPluginApprovalElicitation(params.entry, params.requestParams);
 	if (!approvalPrompt) {
 		logPluginElicitationDecline("unsupported_schema", params.requestParams);
-		return declineElicitationResponse();
+		return createCodexElicitationResponse("decline");
 	}
 	const response = buildElicitationResponse(approvalPrompt, "approved-once");
-	if (isJsonObject(response) && response.action === "accept") {
+	if (response.action === "accept") {
 		if (mode === "allow") return response;
-		return buildElicitationResponse(approvalPrompt, oneShotPluginPolicyApprovalOutcome(mode, await requestPluginApprovalOutcome({
+		const outcome = await requestPluginApprovalOutcome({
 			paramsForRun: params.paramsForRun,
 			title: approvalPrompt.title,
 			description: approvalPrompt.description,
 			allowedDecisions: allowedPluginPolicyApprovalDecisions(mode, approvalPrompt),
 			signal: params.signal
-		})));
+		});
+		return buildElicitationResponse(approvalPrompt, mode === "ask" && outcome === "approved-session" ? "approved-once" : outcome);
 	}
 	logPluginElicitationDecline("unmappable_schema", params.requestParams);
-	return declineElicitationResponse();
+	return createCodexElicitationResponse("decline");
 }
 function resolvePluginDestructiveApprovalMode(entry) {
 	return entry.destructiveApprovalMode ?? (entry.allowDestructiveActions ? "allow" : "deny");
@@ -4556,9 +4371,6 @@ function allowedPluginPolicyApprovalDecisions(mode, approvalPrompt) {
 	if (mode !== "ask") return allowedDecisions;
 	return allowedDecisions.filter((decision) => decision !== "allow-always");
 }
-function oneShotPluginPolicyApprovalOutcome(mode, outcome) {
-	return mode === "ask" && outcome === "approved-session" ? "approved-once" : outcome;
-}
 function readPluginApprovalElicitation(entry, requestParams) {
 	if (readNonBlankStringField(requestParams, "mode") !== "form" || !isJsonObject(requestParams.requestedSchema)) return;
 	const requestedSchema = requestParams.requestedSchema;
@@ -4602,13 +4414,6 @@ function canMapPersistentApproval(requestedSchema, meta) {
 		}) && chooseAlwaysPersistOptionValue(readEnumOptions(schema)) !== void 0;
 	});
 }
-function declineElicitationResponse() {
-	return {
-		action: "decline",
-		content: null,
-		_meta: null
-	};
-}
 function logPluginElicitationDecline(reason, requestParams) {
 	embeddedAgentLog.debug("codex plugin elicitation declined", {
 		reason,
@@ -4751,27 +4556,23 @@ async function requestPluginApprovalOutcome(params) {
 		});
 		const approvalId = requestResult?.id;
 		if (!approvalId) return "unavailable";
-		return mapExecDecisionToOutcome(approvalRequestExplicitlyUnavailable(requestResult) ? null : await waitForPluginApprovalDecision({
+		const approvalResult = approvalRequestExplicitlyUnavailable(requestResult) ? void 0 : await waitForPluginApprovalDecision({
 			hostCapabilities: params.paramsForRun.hostCapabilities,
 			approvalId,
 			signal: params.signal
-		}));
+		});
+		if (params.signal?.aborted) return "cancelled";
+		if (approvalResult?.terminalReason === "timeout") return "timed-out";
+		return mapExecDecisionToOutcome(approvalResult?.decision);
 	} catch {
 		return params.signal?.aborted ? "cancelled" : "denied";
 	}
 }
 function buildElicitationResponse(approvalPrompt, outcome) {
 	const { requestedSchema, meta } = approvalPrompt;
-	if (outcome === "cancelled") return {
-		action: "cancel",
-		content: null,
-		_meta: null
-	};
-	if (outcome === "denied" || outcome === "unavailable") return {
-		action: "decline",
-		content: null,
-		_meta: null
-	};
+	if (outcome === "cancelled") return createCodexElicitationResponse("cancel");
+	if (outcome === "timed-out") return createCodexElicitationResponse("decline", null, { message: codexApprovalTimeoutText("other") });
+	if (outcome === "denied" || outcome === "unavailable") return createCodexElicitationResponse("decline");
 	const content = buildAcceptedContent(approvalPrompt, outcome);
 	if (!content && !hasNoSchemaProperties(requestedSchema)) {
 		embeddedAgentLog.warn("codex MCP approval elicitation approved without a mappable response", {
@@ -4779,13 +4580,9 @@ function buildElicitationResponse(approvalPrompt, outcome) {
 			fields: Object.keys(requestedSchema.properties ?? {}),
 			outcome
 		});
-		return declineElicitationResponse();
+		return createCodexElicitationResponse("decline");
 	}
-	return {
-		action: "accept",
-		content: content ?? null,
-		_meta: buildAcceptedMeta(meta, outcome, approvalPrompt.persistHintsMode ?? "legacy")
-	};
+	return createCodexElicitationResponse("accept", content ?? null, buildAcceptedMeta(meta, outcome, approvalPrompt.persistHintsMode ?? "legacy"));
 }
 function buildAcceptedContent(approvalPrompt, outcome) {
 	const { requestedSchema, meta } = approvalPrompt;
@@ -4920,6 +4717,36 @@ function readFirstString$1(record, keys) {
 * Bridges OpenClaw runtime tools into Codex app-server dynamic tool specs and
 * tool-call responses.
 */
+const INTERNAL_TOOL_EXECUTION_VALIDATION = Symbol.for("openclaw.internalToolExecutionValidation");
+const MAX_CODEX_DYNAMIC_TOOL_VALIDATION_ERRORS = 4;
+const MAX_CODEX_DYNAMIC_TOOL_VALIDATION_ERROR_CHARS = 160;
+const CODEX_DYNAMIC_TOOL_VALIDATION_TRUNCATED_SUFFIX = " [detail truncated]";
+function shouldValidateCodexDynamicToolInput(tool) {
+	return getPluginToolMeta(tool)?.mcp?.operation !== "tool";
+}
+function assertCodexDynamicToolInputMatchesSchema(params) {
+	const validation = validateJsonSchemaValue({
+		schema: params.schema,
+		cacheKey: `codex-dynamic-tool-input:${params.toolName}:${JSON.stringify(params.schema)}`,
+		value: params.value
+	});
+	if (validation.ok) return;
+	const visibleErrors = validation.errors.slice(0, MAX_CODEX_DYNAMIC_TOOL_VALIDATION_ERRORS);
+	const details = visibleErrors.map((error) => {
+		if (error.text.length <= MAX_CODEX_DYNAMIC_TOOL_VALIDATION_ERROR_CHARS) return error.text;
+		return `${error.text.slice(0, MAX_CODEX_DYNAMIC_TOOL_VALIDATION_ERROR_CHARS - 19)}${CODEX_DYNAMIC_TOOL_VALIDATION_TRUNCATED_SUFFIX}`;
+	}).join("; ");
+	const omitted = validation.errors.length - visibleErrors.length;
+	const omittedSuffix = omitted > 0 ? `; ${omitted} more violation(s) omitted` : "";
+	throw new Error(`Invalid arguments for tool "${params.toolName}": ${details}${omittedSuffix}.`);
+}
+function createCodexDynamicToolValidationControl(params) {
+	return {
+		[INTERNAL_TOOL_EXECUTION_VALIDATION]: true,
+		toolCallId: params.toolCallId,
+		validate: params.validate
+	};
+}
 function applyCurrentMessageProvider(toolName, args, currentProvider) {
 	const hasProvider = typeof args.provider === "string" && args.provider.trim().length > 0 ? true : typeof args.channel === "string" && args.channel.trim().length > 0;
 	const provider = currentProvider?.trim();
@@ -5050,6 +4877,8 @@ function normalizeAcceptedSessionSpawn(result) {
 }
 /** Namespace attached to OpenClaw-owned dynamic tools exposed to Codex. */
 const CODEX_OPENCLAW_DYNAMIC_TOOL_NAMESPACE = "openclaw";
+const CODEX_DYNAMIC_TOOL_NAME_MAX_CHARS = 128;
+const CODEX_DYNAMIC_TOOL_NAME_PATTERN = /^[a-zA-Z0-9_-]+$/u;
 const ALWAYS_DIRECT_DYNAMIC_TOOL_NAMES = /* @__PURE__ */ new Set([
 	"agents_list",
 	"sessions_spawn",
@@ -5100,7 +4929,11 @@ function createCodexDynamicToolBridge(params) {
 	const toolMap = new Map(availableTools.map((entry) => [entry.name, entry]));
 	const registeredToolNames = new Set(registeredSpecTools.map((entry) => entry.name));
 	const quarantinedTools = dedupeQuarantinedDynamicTools([...availableProjection.quarantinedTools, ...registeredProjection.quarantinedTools]);
-	warnQuarantinedDynamicTools(quarantinedTools);
+	warnQuarantinedDynamicTools({
+		tools: quarantinedTools,
+		availableToolCount: availableTools.length,
+		registeredToolCount: registeredSpecTools.length
+	});
 	emitQuarantinedDynamicToolDiagnostics(quarantinedTools, params.hookContext);
 	const telemetry = {
 		didSendViaMessagingTool: false,
@@ -5140,6 +4973,10 @@ function createCodexDynamicToolBridge(params) {
 			directToolNames
 		}),
 		resultContentSourceForTool: (toolName) => toolMap.get(toolName)?.tool.resultContentSource,
+		sideEffectOwnerKeyForTool: (toolName) => {
+			const tool = toolMap.get(toolName)?.tool;
+			return tool ? getPluginToolSideEffectOwnerKey(tool) : void 0;
+		},
 		telemetry,
 		setRemoteWorkspaceFileReader: (reader) => {
 			readRemoteWorkspaceFile = reader;
@@ -5171,7 +5008,8 @@ function createCodexDynamicToolBridge(params) {
 				});
 			}
 			const { tool, name: toolName } = toolEntry;
-			const args = asNonArrayRecord(call.arguments);
+			const rawArguments = call.arguments;
+			const args = asNonArrayRecord(rawArguments);
 			const startedAt = Date.now();
 			const signal = composeAbortSignals(params.signal, options?.signal);
 			let didStartExecution = false;
@@ -5194,7 +5032,8 @@ function createCodexDynamicToolBridge(params) {
 				};
 			};
 			try {
-				const toolArgs = tool.prepareArguments ? tool.prepareArguments(args) : args;
+				const prepare = tool.prepareArguments;
+				const toolArgs = prepare ? Reflect.apply(prepare, tool, [rawArguments]) : args;
 				const preparedArgs = toolName === "message" && isRecord(toolArgs) ? await prepareCodexRemoteWorkspaceMessageMedia({
 					args: toolArgs,
 					localWorkspaceRoot: params.hookContext?.workspaceDir,
@@ -5214,7 +5053,20 @@ function createCodexDynamicToolBridge(params) {
 					hasRepliedRef: params.hookContext?.hasRepliedRef ? { value: params.hookContext.hasRepliedRef.value } : void 0
 				};
 				didDispatchExecution = true;
-				const rawResult = await tool.execute(call.callId, preparedArgs, signal);
+				const executionArgs = [
+					call.callId,
+					preparedArgs,
+					signal
+				];
+				if (shouldValidateCodexDynamicToolInput(tool)) executionArgs.push(createCodexDynamicToolValidationControl({
+					toolCallId: call.callId,
+					validate: (value) => assertCodexDynamicToolInputMatchesSchema({
+						toolName,
+						schema: toolEntry.inputSchema,
+						value
+					})
+				}));
+				const rawResult = await Reflect.apply(tool.execute, tool, executionArgs);
 				captureExecutionBoundary();
 				const telemetryRawResult = sanitizeToolResult(rawResult);
 				const rawIsError = isToolResultError(rawResult);
@@ -5282,7 +5134,7 @@ function createCodexDynamicToolBridge(params) {
 					contentItems,
 					success: !resultIsError
 				}, terminalType);
-				withDynamicToolTranscriptDetails(response, result.details);
+				withDynamicToolTranscriptDetails(response, asOptionalRecord(sanitizeToolResult(result))?.details);
 				withDiagnosticFailureDisposition(response, resultFailureKind);
 				const blocksSourceReplyTermination = hasExplicitNonSourceMessageRoute(executedArgs, params.hookContext, confirmedMessagingTarget);
 				const deliveredSourceReply = isDeliveredMessageToolOnlySourceReplyResult({
@@ -5533,6 +5385,13 @@ function projectCodexDynamicTools(tools) {
 			});
 			continue;
 		}
+		if (!isRecord(projection.schema)) {
+			quarantinedTools.push({
+				tool: descriptor.name,
+				violations: [`${descriptor.name}.inputSchema must be a JSON object schema`]
+			});
+			continue;
+		}
 		projectedTools.push({
 			tool,
 			name: descriptor.name,
@@ -5557,6 +5416,20 @@ function readCodexDynamicToolDescriptor(tool, toolIndex) {
 				violations: [`${fallbackName}.name must be a non-empty string`]
 			}
 		};
+		const trimmedName = rawName.trim();
+		let nameViolation;
+		if (!trimmedName) nameViolation = `${rawName}.name must not be empty`;
+		else if (trimmedName !== rawName) nameViolation = `${rawName}.name must not have leading or trailing whitespace`;
+		else if (!CODEX_DYNAMIC_TOOL_NAME_PATTERN.test(rawName)) nameViolation = `${rawName}.name must match ^[a-zA-Z0-9_-]+$`;
+		else if (rawName.length > CODEX_DYNAMIC_TOOL_NAME_MAX_CHARS) nameViolation = `${rawName}.name must be at most ${CODEX_DYNAMIC_TOOL_NAME_MAX_CHARS} characters`;
+		else if (rawName === "mcp" || rawName.startsWith("mcp__")) nameViolation = `${rawName}.name is reserved by Codex app-server`;
+		if (nameViolation) return {
+			ok: false,
+			diagnostic: {
+				tool: rawName,
+				violations: [nameViolation]
+			}
+		};
 		name = rawName;
 	} catch {
 		return {
@@ -5598,14 +5471,18 @@ function readCodexDynamicToolDescriptor(tool, toolIndex) {
 		parameters
 	};
 }
-function warnQuarantinedDynamicTools(tools) {
-	if (tools.length === 0) return;
+function warnQuarantinedDynamicTools(params) {
+	if (params.tools.length === 0) return;
 	const unique = /* @__PURE__ */ new Map();
-	for (const tool of tools) unique.set(tool.tool, tool.violations);
-	embeddedAgentLog.warn(`codex app-server quarantined ${unique.size} dynamic ${unique.size === 1 ? "tool" : "tools"} with unsupported input schemas: ${[...unique.keys()].join(", ")}`, { tools: [...unique.entries()].map(([tool, violations]) => ({
-		tool,
-		violations
-	})) });
+	for (const tool of params.tools) unique.set(tool.tool, tool.violations);
+	embeddedAgentLog.warn(`codex app-server quarantined ${unique.size} unsupported dynamic tool ${unique.size === 1 ? "definition" : "definitions"}: ${[...unique.keys()].join(", ")}; retained ${params.availableToolCount} available and ${params.registeredToolCount} registered tools`, {
+		tools: [...unique.entries()].map(([tool, violations]) => ({
+			tool,
+			violations
+		})),
+		availableToolCount: params.availableToolCount,
+		registeredToolCount: params.registeredToolCount
+	});
 }
 function emitQuarantinedDynamicToolDiagnostics(tools, ctx) {
 	for (const tool of tools) emitTrustedDiagnosticEvent({
@@ -5893,4 +5770,4 @@ function isCronAddAction(args) {
 	return typeof action === "string" && action.trim().toLowerCase() === "add";
 }
 //#endregion
-export { buildCodexNativeHookRelayDisabledConfig as A, resolveDynamicToolCallTimeoutMs as B, shouldWarnCodexDynamicToolBuildStageSummary as C, CODEX_NATIVE_HOOK_RELAY_EVENTS as D, CodexNativeToolLifecycleProjector as E, scheduleCodexNativeHookRelayUnregister as F, toCodexDynamicToolProtocolResponse as G, shouldBlockTerminalReleaseForNonTerminalDynamicToolResult as H, handleDynamicToolCallWithTimeout as I, resolveCodexToolAbortTerminalReason as K, hasPendingDynamicToolTerminalDiagnostic as L, emitCodexNativePreToolUseFailureDiagnostic as M, resolveCodexNativeHookRelayEvents as N, CODEX_NATIVE_HOOK_RELAY_TTL_GRACE_MS as O, resolveCodexNativeHookRelayTtlMs as P, isDynamicToolTerminalDiagnosticEvent as R, shouldRequireCodexSandboxExecServerEnvironment as S, readBoundedCodexRemoteWorkspaceFile as T, shouldReleaseTurnAfterTerminalDynamicTool as U, resolveTerminalDynamicToolBatchAction as V, toCodexDynamicToolProgressResponse as W, resolveCodexAppServerHookChannelId as _, emitDynamicToolStartedDiagnostic as a, resolveCodexSandboxEnvironmentSelection as b, resolveCodexProviderWebSearchSupport as c, releaseCodexSandboxExecServerEnvironment as d, buildDynamicTools as f, resolveCodexAppServerExecutionCwd as g, formatCodexDynamicToolBuildStageSummary as h, emitDynamicToolErrorDiagnostic as i, createCodexNativeHookRelay as j, buildCodexNativeHookRelayConfig as k, resolveCodexProviderWebSearchSupportForClient as l, disableCodexPluginThreadConfig as m, projectCodexExecutableDynamicTools as n, emitDynamicToolTerminalDiagnostic as o, createCodexDynamicToolBuildStageTracker as p, handleCodexAppServerElicitationRequest as r, handleCodexAppServerApprovalRequest as s, createCodexDynamicToolBridge as t, ensureCodexSandboxExecServerEnvironment as u, resolveCodexExternalSandboxPolicyForOpenClawSandbox as v, filterToolsForVisionInputs as w, shouldEnableCodexAppServerNativeToolSurface as x, resolveCodexMessageToolProvider as y, isMatchingDynamicToolTerminalDiagnostic as z };
+export { shouldRequireCodexSandboxExecServerEnvironment as C, CodexNativeToolLifecycleProjector as D, readBoundedCodexRemoteWorkspaceFile as E, shouldEnableCodexAppServerNativeToolSurface as S, filterCodexVisionTools as T, resolveCodexAppServerHookChannelId as _, emitDynamicToolStartedDiagnostic as a, resolveCodexNodePlacementToolConstructionPlan as b, resolveCodexProviderWebSearchSupport as c, releaseCodexSandboxExecServerEnvironment as d, buildDynamicTools as f, resolveCodexAppServerExecutionCwd as g, formatCodexDynamicToolBuildStageSummary as h, emitDynamicToolErrorDiagnostic as i, resolveCodexProviderWebSearchSupportForClient as l, disableCodexPluginThreadConfig as m, projectCodexExecutableDynamicTools as n, emitDynamicToolTerminalDiagnostic as o, createCodexDynamicToolBuildStageTracker as p, routeCodexAppServerElicitationRequest as r, handleCodexAppServerApprovalRequest as s, createCodexDynamicToolBridge as t, ensureCodexSandboxExecServerEnvironment as u, resolveCodexExternalSandboxPolicyForOpenClawSandbox as v, shouldWarnCodexDynamicToolBuildStageSummary as w, resolveCodexSandboxEnvironmentSelection as x, resolveCodexMessageToolProvider as y };