@openclaw/codex 2026.8.1-beta.2 → 2026.9.1-beta.1

package/dist/{side-question-9HAL26l9.js → side-question-DjA_jsNe.js}

@@ -1,16 +1,18 @@
-import { C as isCodexRemoteExecPlacementSandbox, N as resolveOpenClawExecPolicyForCodexAppServer, T as readCodexPluginConfig, d as sessionBindingIdentity, h as resolveCodexAppServerHomeScope, j as resolveCodexModelBackedReviewerPolicyContext, k as canUseCodexModelBackedApprovalsReviewerForModel, w as isCodexSandboxExecServerEnabled, x as shouldAutoApproveCodexAppServerApprovals } from "./session-binding-DPxIvMgE.js";
-import { A as isCodexAppServerApprovalRequest, H as ensureCodexAppServerClientRuntime, N as isCodexAppServerIndeterminateRequestCancellationError, X as readRecentCodexRateLimits, a as getLeasedSharedCodexAppServerClient, c as releaseCodexAppServerClientLease, ct as isJsonObject, h as withLeasedCodexAppServerClientStartSelectionRetry, rt as resolveCodexAppServerPreparedAuthHandoff } from "./shared-client-kIBbGjk4.js";
-import { d as unsubscribeCodexThreadBestEffort, h as isCodexNotificationForTurn, s as isCodexAlreadyTerminalInterruptError, u as retireUnsafeCodexTurnClientBestEffort } from "./attempt-client-cleanup-DMLXUfa8.js";
-import { l as readCodexTurn, o as assertCodexTurnStartResponse, r as assertCodexThreadForkResponse, s as readCodexDynamicToolCallParams } from "./protocol-validators-B4F7L8Rf.js";
-import { R as buildCodexPluginAppsConfigPatchFromPolicyContext, W as mergeCodexThreadConfigs, b as readCodexSupportedReasoningEfforts, f as resolveCodexWebSearchPlan, g as resolveCodexAppServerRequestModelSelection, h as resolveCodexAppServerModelProvider, k as resolveCodexDynamicToolsLoading, l as buildCodexRuntimeThreadConfig, m as CODEX_NATIVE_PERSONALITY_NONE, v as resolveCodexBindingModelProviderFallback, w as filterCodexDynamicTools, y as resolveReasoningEffort } from "./thread-lifecycle-Bu1BTDXr.js";
-import { n as formatCodexUsageLimitErrorMessage } from "./rate-limits-DZXmOL8-.js";
-import { t as resolveCodexAppServerForModelProvider } from "./app-server-policy-zcBDc1JU.js";
-import { n as resolveCodexNativeExecutionBlock } from "./sandbox-guard-Cmwc9eIk.js";
-import { n as resolveCodexBindingAppServerConnection, t as requireCodexSupervisionModelSelection } from "./binding-connection-I5Bo-AsX.js";
-import { A as buildCodexNativeHookRelayDisabledConfig, B as resolveDynamicToolCallTimeoutMs, D as CODEX_NATIVE_HOOK_RELAY_EVENTS, E as CodexNativeToolLifecycleProjector, I as handleDynamicToolCallWithTimeout, K as resolveCodexToolAbortTerminalReason, M as emitCodexNativePreToolUseFailureDiagnostic, S as shouldRequireCodexSandboxExecServerEnvironment, a as emitDynamicToolStartedDiagnostic, b as resolveCodexSandboxEnvironmentSelection, d as releaseCodexSandboxExecServerEnvironment, i as emitDynamicToolErrorDiagnostic, k as buildCodexNativeHookRelayConfig, l as resolveCodexProviderWebSearchSupportForClient, o as emitDynamicToolTerminalDiagnostic, r as handleCodexAppServerElicitationRequest, s as handleCodexAppServerApprovalRequest, t as createCodexDynamicToolBridge, u as ensureCodexSandboxExecServerEnvironment, v as resolveCodexExternalSandboxPolicyForOpenClawSandbox, w as filterToolsForVisionInputs, x as shouldEnableCodexAppServerNativeToolSurface, y as resolveCodexMessageToolProvider } from "./dynamic-tools-BVdyWkUD.js";
+import { C as resolveCodexModelBackedReviewerPolicyContext, D as readCodexRequirementsToml, f as isCodexPairedNodeRemoteExecPlacementSandbox, h as readCodexPluginConfig, j as resolveOpenClawExecPolicyForCodexAppServer, m as isCodexSandboxExecServerEnabled, p as isCodexRemoteExecPlacementSandbox, r as resolveCodexAppServerHomeScope, u as shouldAutoApproveCodexAppServerApprovals, x as canUseCodexModelBackedApprovalsReviewerForModel } from "./config-giW8X0QA.js";
+import { F as isCodexAppServerApprovalRequest, K as createCodexElicitationResponse, R as isCodexAppServerIndeterminateRequestCancellationError, Y as ensureCodexAppServerClientRuntime, at as readRecentCodexRateLimits, f as releaseCodexAppServerClientLease, o as getLeasedSharedCodexAppServerClient, pt as resolveCodexAppServerPreparedAuthHandoff, vt as isJsonObject, x as withLeasedCodexAppServerClientStartSelectionRetry } from "./shared-client-DKz23hHY.js";
+import { d as sessionBindingIdentity } from "./session-binding-Bcynfd-_.js";
+import { d as unsubscribeCodexThreadBestEffort, h as isCodexNotificationForTurn, s as isCodexAlreadyTerminalInterruptError, u as retireUnsafeCodexTurnClientBestEffort } from "./attempt-client-cleanup-bfsmcQ6m.js";
+import { l as readCodexTurn, o as assertCodexTurnStartResponse, r as assertCodexThreadForkResponse, s as readCodexDynamicToolCallParams } from "./protocol-validators-VeJxxJ0U.js";
+import { B as resolveCodexAppServerRequestModelSelection, F as resolveCodexWebSearchPlan, H as resolveCodexBindingModelProviderFallback, M as buildCodexRuntimeThreadConfig, R as CODEX_NATIVE_PERSONALITY_NONE, T as resolveCodexToolAbortTerminalReason, U as resolveReasoningEffort, W as readCodexSupportedReasoningEfforts, Z as filterCodexDynamicTools, bt as mergeCodexThreadConfigs, c as buildCodexNativeHookRelayConfig, d as emitCodexNativePreToolUseFailureDiagnostic, h as handleDynamicToolCallWithTimeout, l as buildCodexNativeHookRelayDisabledConfig, mt as buildCodexPluginAppsConfigPatchFromPolicyContext, o as CODEX_NATIVE_HOOK_RELAY_EVENTS, rt as resolveCodexDynamicToolsLoading, y as resolveDynamicToolCallTimeoutMs, z as resolveCodexAppServerModelProvider } from "./thread-lifecycle-L7oEkTlq.js";
+import { n as formatCodexUsageLimitErrorMessage } from "./rate-limits-C5_D8Gmb.js";
+import { a as resolveCodexAppServerForModelProvider, i as resolveCodexSessionPermissionCwd, n as applyCodexSessionPermissionPolicy, r as resolveCodexEffectiveSessionPermissionPolicy, t as CODEX_SESSION_PERMISSION_EXEC_MODES } from "./session-permission-policy-BrNH1bjy.js";
+import { n as resolveCodexNativeExecutionBlock } from "./sandbox-guard-kuWTn9C5.js";
+import { n as resolveCodexBindingAppServerConnection, t as requireCodexSupervisionModelSelection } from "./binding-connection-BMvPX73o.js";
+import { C as shouldRequireCodexSandboxExecServerEnvironment, D as CodexNativeToolLifecycleProjector, S as shouldEnableCodexAppServerNativeToolSurface, T as filterCodexVisionTools, a as emitDynamicToolStartedDiagnostic, b as resolveCodexNodePlacementToolConstructionPlan, d as releaseCodexSandboxExecServerEnvironment, i as emitDynamicToolErrorDiagnostic, l as resolveCodexProviderWebSearchSupportForClient, o as emitDynamicToolTerminalDiagnostic, r as routeCodexAppServerElicitationRequest, s as handleCodexAppServerApprovalRequest, t as createCodexDynamicToolBridge, u as ensureCodexSandboxExecServerEnvironment, v as resolveCodexExternalSandboxPolicyForOpenClawSandbox, x as resolveCodexSandboxEnvironmentSelection, y as resolveCodexMessageToolProvider } from "./dynamic-tools-Dnlfa--w.js";
 import { readStringField } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { buildAgentHookContextChannelFields, embeddedAgentLog, formatErrorMessage, registerNativeHookRelay, resolveAgentDir, resolveAttemptSpawnWorkspaceDir, resolveModelAuthMode, resolveSandboxContext, resolveSessionAgentIds, supportsModelTools } from "openclaw/plugin-sdk/agent-harness-runtime";
 import { randomUUID } from "node:crypto";
+import { resolveAgentWorkspaceDir } from "openclaw/plugin-sdk/agent-runtime";
 import { loadExecApprovals } from "openclaw/plugin-sdk/exec-approvals-runtime";
 //#region extensions/codex/src/app-server/side-question.ts
 const SIDE_QUESTION_COMPLETION_TIMEOUT_MS = 6e5;
@@ -56,14 +58,18 @@ async function runCodexAppServerSideQuestion(params, options) {
 		config: params.cfg
 	}));
 	if (!binding?.threadId) throw new Error("Codex /btw needs an active Codex thread. Send a normal message first, then try /btw again.");
+	if (isCodexPairedNodeRemoteExecPlacementSandbox(params.sandbox)) throw new Error("Normal Codex turns are supported on nodes, but /btw is not yet bound to the active placement.");
 	const pluginConfig = readCodexPluginConfig(options.pluginConfig);
 	const { sessionAgentId } = resolveSessionAgentIds({
 		sessionKey: params.sessionKey,
 		config: params.cfg,
 		agentId: params.agentId
 	});
+	const agentWorkspaceDir = params.workspaceDir?.trim() || resolveAgentWorkspaceDir(params.cfg, sessionAgentId);
 	const execPolicy = resolveOpenClawExecPolicyForCodexAppServer({
-		approvals: loadExecApprovals(),
+		permissionMode: params.sessionEntry.permissionMode,
+		execOverrides: params.sessionEntry.permissionMode ? { mode: CODEX_SESSION_PERMISSION_EXEC_MODES[params.sessionEntry.permissionMode] } : void 0,
+		approvals: params.sessionEntry.permissionMode === "full" ? void 0 : loadExecApprovals(),
 		config: params.cfg,
 		agentId: sessionAgentId
 	});
@@ -99,7 +105,7 @@ async function runCodexAppServerSideQuestion(params, options) {
 		bindingModelProvider: binding.modelProvider
 	});
 	const modelSelection = resolveCodexAppServerRequestModelSelection({
-		model: supervisionModelSelection?.model ?? params.model,
+		model: supervisionModelSelection?.model ?? options.runtimeModelId ?? params.model,
 		modelProvider,
 		authProfileId,
 		authProfileStore: preparedRuntimeAuth.authProfileStore,
@@ -123,8 +129,41 @@ async function runCodexAppServerSideQuestion(params, options) {
 		config: params.cfg,
 		agentDir: params.agentDir
 	});
-	const appServer = connection.appServer;
-	const cwd = binding.cwd || params.workspaceDir || process.cwd();
+	const reviewerContext = {
+		modelProvider: reviewerPolicyContext.modelProvider,
+		model: reviewerPolicyContext.model,
+		config: params.cfg,
+		env: process.env,
+		agentDir: params.agentDir
+	};
+	const appServer = resolveCodexAppServerForModelProvider({
+		appServer: applyCodexSessionPermissionPolicy({
+			appServer: connection.appServer,
+			permissionMode: params.sessionEntry.permissionMode,
+			sessionRoot: params.sessionEntry.sessionRoot,
+			defaultRoot: agentWorkspaceDir,
+			pluginConfig,
+			canUseAutoReview: canUseCodexModelBackedApprovalsReviewerForModel(reviewerContext),
+			requirementsToml: readCodexRequirementsToml({}),
+			policyLocked: usesSupervisionConnection,
+			execMode: execPolicy.mode
+		}),
+		...reviewerContext,
+		provider: reviewerContext.modelProvider
+	});
+	const sessionPermissionPolicy = resolveCodexEffectiveSessionPermissionPolicy({
+		appServer,
+		permissionMode: params.sessionEntry.permissionMode,
+		sessionRoot: params.sessionEntry.sessionRoot,
+		defaultRoot: agentWorkspaceDir
+	});
+	const cwd = resolveCodexSessionPermissionCwd({
+		permissionMode: params.sessionEntry.permissionMode,
+		sessionRoot: params.sessionEntry.sessionRoot,
+		defaultRoot: agentWorkspaceDir,
+		requestedCwd: binding.cwd,
+		fallbackCwd: agentWorkspaceDir
+	});
 	const runId = params.opts?.runId ?? randomUUID();
 	const effectiveParams = supervisionModelSelection ? {
 		...params,
@@ -151,8 +190,14 @@ async function runCodexAppServerSideQuestion(params, options) {
 		runId,
 		timeoutMs: appServer.requestTimeoutMs
 	});
+	sideRunParams.permissionMode = sessionPermissionPolicy?.mode;
+	sideRunParams.sessionRoot = sessionPermissionPolicy?.root;
+	sideRunParams.execOverrides = sessionPermissionPolicy && { mode: sessionPermissionPolicy.execMode };
 	const sandboxExecServerEnabled = isCodexSandboxExecServerEnabled(pluginConfig, params.sandbox);
-	const nativeToolSurfaceEnabled = shouldEnableCodexAppServerNativeToolSurface(sideRunParams, params.sandbox ?? void 0, { sandboxExecServerEnabled });
+	const nativeToolSurfaceEnabled = shouldEnableCodexAppServerNativeToolSurface(sideRunParams, params.sandbox ?? void 0, {
+		agentId: sideRunParams.agentId,
+		sandboxExecServerEnabled
+	});
 	const sandboxEnvironmentRequired = shouldRequireCodexSandboxExecServerEnvironment({
 		sandbox: params.sandbox ?? void 0,
 		nativeToolSurfaceEnabled,
@@ -162,6 +207,7 @@ async function runCodexAppServerSideQuestion(params, options) {
 		config: sideRunParams.config,
 		sessionKey: sideRunParams.sandboxSessionKey?.trim() || sideRunParams.sessionKey,
 		sessionId: sideRunParams.sessionId,
+		agentId: sideRunParams.agentId,
 		sandbox: params.sandbox,
 		sandboxEnvironmentSelected: sandboxEnvironmentRequired,
 		surface: "/btw side-question mode"
@@ -230,9 +276,10 @@ async function runCodexAppServerSideQuestion(params, options) {
 	const activeDynamicToolCalls = /* @__PURE__ */ new Set();
 	const releaseSandboxEnvironment = async () => {
 		if (!sandboxEnvironment) return;
+		const environment = sandboxEnvironment;
 		sandboxEnvironment = void 0;
 		sandboxEnvironmentClient = void 0;
-		await releaseCodexSandboxExecServerEnvironment(params.sandbox);
+		await releaseCodexSandboxExecServerEnvironment(params.sandbox, environment);
 	};
 	const ensureSandboxEnvironment = async (targetClient) => {
 		if (!sandboxEnvironmentRequired || sandboxEnvironmentClient === targetClient) return;
@@ -240,32 +287,23 @@ async function runCodexAppServerSideQuestion(params, options) {
 		const environment = await ensureCodexSandboxExecServerEnvironment({
 			client: targetClient,
 			sandbox: params.sandbox ?? null,
+			runtime: options.runtime,
 			appServerStartOptions: appServer.start,
 			timeoutMs: appServer.requestTimeoutMs,
-			signal: runAbortController.signal
+			signal: runAbortController.signal,
+			onExecutionDisconnect: (error) => {
+				collector.reject(error);
+				embeddedAgentLog.warn(error.message);
+				runAbortController.abort("client_closed");
+			}
 		});
 		if (!environment) throw new Error("Codex app-server did not register an OpenClaw sandbox exec-server environment.");
 		sandboxEnvironment = environment;
 		sandboxEnvironmentClient = targetClient;
 	};
 	try {
-		const modelScopedAppServer = resolveCodexAppServerForModelProvider({
-			appServer,
-			provider: reviewerPolicyContext.modelProvider,
-			model: reviewerPolicyContext.model,
-			config: params.cfg,
-			env: process.env,
-			agentDir: params.agentDir
-		});
-		const useModelScopedPolicy = !canUseCodexModelBackedApprovalsReviewerForModel({
-			modelProvider: reviewerPolicyContext.modelProvider,
-			model: reviewerPolicyContext.model,
-			config: params.cfg,
-			env: process.env,
-			agentDir: params.agentDir
-		});
-		const approvalPolicy = useModelScopedPolicy ? modelScopedAppServer.approvalPolicy : binding.approvalPolicy ?? modelScopedAppServer.approvalPolicy;
-		const sandbox = useModelScopedPolicy ? modelScopedAppServer.sandbox : binding.sandbox ?? modelScopedAppServer.sandbox;
+		const approvalPolicy = appServer.approvalPolicy;
+		const sandbox = appServer.sandbox;
 		const { toolBridge, webSearchPlan } = await createCodexSideToolBridge({
 			params: effectiveParams,
 			cwd,
@@ -281,6 +319,7 @@ async function runCodexAppServerSideQuestion(params, options) {
 				modelProviderOverride: modelSelection.modelProvider,
 				signal: runAbortController.signal
 			}) : "unsupported",
+			sessionPermissionPolicy,
 			runId,
 			signal: runAbortController.signal
 		});
@@ -295,14 +334,17 @@ async function runCodexAppServerSideQuestion(params, options) {
 		});
 		const registerRequestHandler = (targetClient) => targetClient.addRequestHandler(async (request) => {
 			if (!childThreadId || !turnId) return;
-			if (request.method === "mcpServer/elicitation/request") return handleCodexAppServerElicitationRequest({
-				requestParams: request.params,
-				paramsForRun: sideRunParams,
-				threadId: childThreadId,
-				turnId,
-				pluginAppPolicyContext: binding.pluginAppPolicyContext,
-				signal: runAbortController.signal
-			});
+			if (request.method === "mcpServer/elicitation/request") {
+				const approvalResult = await routeCodexAppServerElicitationRequest({
+					requestParams: request.params,
+					paramsForRun: sideRunParams,
+					threadId: childThreadId,
+					turnId,
+					pluginAppPolicyContext: binding.pluginAppPolicyContext,
+					signal: runAbortController.signal
+				});
+				return approvalResult.kind === "handled" ? approvalResult.response : createCodexElicitationResponse("decline", null, { message: "OpenClaw Codex side questions do not support interactive MCP input." });
+			}
 			if (request.method === "item/tool/requestUserInput") return isSideUserInputRequest(request.params, childThreadId, turnId) ? emptySideUserInputResponse() : void 0;
 			if (isCodexAppServerApprovalRequest(request.method)) return handleCodexAppServerApprovalRequest({
 				method: request.method,
@@ -313,7 +355,7 @@ async function runCodexAppServerSideQuestion(params, options) {
 				nativeHookRelay,
 				autoApprove: shouldAutoApproveCodexAppServerApprovals({
 					approvalPolicy,
-					networkProxy: modelScopedAppServer.networkProxy,
+					networkProxy: appServer.networkProxy,
 					sandbox
 				}),
 				signal: runAbortController.signal,
@@ -412,18 +454,17 @@ async function runCodexAppServerSideQuestion(params, options) {
 			relay: nativeHookRelay,
 			events: nativeHookRelayEvents,
 			hookTimeoutSec: options.nativeHookRelay?.hookTimeoutSec,
-			clearOmittedEvents: true,
-			loopDetectionPreToolUseRelay: appServer.loopDetectionPreToolUseRelay
+			clearOmittedEvents: true
 		}) : options.nativeHookRelay?.enabled === false ? buildCodexNativeHookRelayDisabledConfig() : void 0;
 		const runtimeThreadConfig = buildCodexRuntimeThreadConfig(webSearchPlan.threadConfig, {
 			nativeCodeModeEnabled: nativeToolSurfaceEnabled,
 			nativeCodeModeOnlyEnabled: appServer.codeModeOnly
 		});
-		const threadConfig = mergeCodexThreadConfigs(nativeHookRelayConfig, runtimeThreadConfig, binding.pluginAppPolicyContext ? buildCodexPluginAppsConfigPatchFromPolicyContext(binding.pluginAppPolicyContext) : void 0, modelScopedAppServer.networkProxy?.configPatch) ?? runtimeThreadConfig;
+		const threadConfig = mergeCodexThreadConfigs(nativeHookRelayConfig, runtimeThreadConfig, binding.pluginAppPolicyContext ? buildCodexPluginAppsConfigPatchFromPolicyContext(binding.pluginAppPolicyContext) : void 0, appServer.networkProxy?.configPatch) ?? runtimeThreadConfig;
 		const forkResponse = assertCodexThreadForkResponse(await withLeasedCodexAppServerClientStartSelectionRetry({
 			lease: clientLease,
 			options: clientOptions,
-			signal: params.opts?.abortSignal,
+			signal: runAbortController.signal,
 			run: async (forkClient, requestOptions) => {
 				await ensureSandboxEnvironment(forkClient);
 				const executionCwd = sandboxEnvironment?.cwd ?? cwd;
@@ -432,9 +473,10 @@ async function runCodexAppServerSideQuestion(params, options) {
 					model: modelSelection.model,
 					...modelSelection.modelProvider ? { modelProvider: modelSelection.modelProvider } : {},
 					cwd: executionCwd,
+					...sessionPermissionPolicy ? { runtimeWorkspaceRoots: [sessionPermissionPolicy.root] } : {},
 					approvalPolicy,
-					approvalsReviewer: modelScopedAppServer.approvalsReviewer,
-					...sandboxEnvironment || modelScopedAppServer.networkProxy ? {} : { sandbox },
+					approvalsReviewer: appServer.approvalsReviewer,
+					...sandboxEnvironment || appServer.networkProxy ? {} : { sandbox },
 					...serviceTier ? { serviceTier } : {},
 					config: threadConfig,
 					developerInstructions: SIDE_DEVELOPER_INSTRUCTIONS,
@@ -451,7 +493,7 @@ async function runCodexAppServerSideQuestion(params, options) {
 			items: [sideBoundaryPromptItem()]
 		}, {
 			timeoutMs: appServer.requestTimeoutMs,
-			signal: params.opts?.abortSignal
+			signal: runAbortController.signal
 		});
 		const effort = usesSupervisionConnection ? void 0 : resolveReasoningEffort(params.resolvedThinkLevel ?? "off", modelSelection.model, readCodexSupportedReasoningEfforts(params.runtimeModel?.compat));
 		turnId = assertCodexTurnStartResponse(await client.request("turn/start", {
@@ -482,7 +524,7 @@ async function runCodexAppServerSideQuestion(params, options) {
 			}
 		}, {
 			timeoutMs: appServer.requestTimeoutMs,
-			signal: params.opts?.abortSignal
+			signal: runAbortController.signal
 		}).catch((error) => {
 			if (isCodexAppServerIndeterminateRequestCancellationError(error)) turnId = "";
 			throw error;
@@ -499,7 +541,7 @@ async function runCodexAppServerSideQuestion(params, options) {
 		let text;
 		try {
 			text = await collector.wait({
-				signal: params.opts?.abortSignal,
+				signal: runAbortController.signal,
 				timeoutMs: Math.max(appServer.turnCompletionIdleTimeoutMs, SIDE_QUESTION_COMPLETION_TIMEOUT_MS)
 			});
 		} catch (error) {
@@ -622,6 +664,7 @@ function buildSideRunAttemptParams(params, options) {
 		authStorage: params.preparedRuntimeAuth.authStorage,
 		authProfileStore: params.preparedRuntimeAuth.authProfileStore,
 		modelRegistry: params.preparedRuntimeAuth.modelRegistry,
+		preparedModelRuntime: params.preparedModelRuntime,
 		...params.preparedRuntimeAuth.resolvedApiKey ? { resolvedApiKey: params.preparedRuntimeAuth.resolvedApiKey } : {},
 		runId: options.runId,
 		abortSignal: params.opts?.abortSignal,
@@ -641,6 +684,7 @@ async function createCodexSideToolBridge(input) {
 	};
 	const messageToolProvider = resolveCodexMessageToolProvider(input.params);
 	let tools = [];
+	const webFetchHostnameAllowlistRef = {};
 	if (supportsModelTools(runtimeModel)) {
 		const createOpenClawCodingTools = (await import("openclaw/plugin-sdk/agent-harness")).createOpenClawCodingTools;
 		const sandboxSessionKey = input.params.sandboxSessionKey?.trim() || input.params.sessionKey?.trim() || input.params.sessionId || input.sessionAgentId;
@@ -649,11 +693,14 @@ async function createCodexSideToolBridge(input) {
 			sessionKey: sandboxSessionKey,
 			workspaceDir: input.cwd
 		});
-		tools = filterToolsForVisionInputs(filterCodexDynamicTools(createOpenClawCodingTools({
+		const toolConstructionPlan = resolveCodexNodePlacementToolConstructionPlan(sandbox, input.nativeToolSurfaceEnabled);
+		tools = filterCodexVisionTools(filterCodexDynamicTools(createOpenClawCodingTools({
 			agentId: input.sessionAgentId,
 			sessionKey: sandboxSessionKey,
 			runSessionKey: input.params.sessionKey && input.params.sessionKey !== sandboxSessionKey ? input.params.sessionKey : void 0,
 			sessionId: input.params.sessionId,
+			exec: input.sessionPermissionPolicy && { mode: input.sessionPermissionPolicy.execMode },
+			sessionPermissionPolicy: input.sessionPermissionPolicy,
 			runId: input.runId,
 			agentDir: input.params.agentDir ?? resolveAgentDir(input.params.cfg ?? {}, input.sessionAgentId),
 			workspaceDir: input.cwd,
@@ -662,6 +709,7 @@ async function createCodexSideToolBridge(input) {
 				resolvedWorkspace: input.params.workspaceDir ?? input.cwd
 			}),
 			config: input.params.cfg,
+			preparedModelRuntime: input.params.preparedModelRuntime,
 			abortSignal: input.signal,
 			modelProvider: runtimeModel.provider,
 			modelId: input.params.model,
@@ -670,6 +718,7 @@ async function createCodexSideToolBridge(input) {
 			modelContextWindowTokens: runtimeModel.contextWindow,
 			modelAuthMode: resolveModelAuthMode(runtimeModel.provider, input.params.cfg, void 0, { workspaceDir: input.cwd }),
 			suppressManagedWebSearch: false,
+			webFetchHostnameAllowlistRef,
 			...input.params.messageProvider || input.params.messageChannel ? {
 				messageProvider: messageToolProvider,
 				toolPolicyMessageProvider: input.params.messageProvider ?? input.params.messageChannel
@@ -698,12 +747,13 @@ async function createCodexSideToolBridge(input) {
 				currentChannelId: input.params.currentChannelId
 			}).channelId,
 			sandbox,
+			...toolConstructionPlan ? { toolConstructionPlan } : {},
 			emitBeforeToolCallDiagnostics: false,
 			modelHasVision: runtimeModel.input?.includes("image") ?? false,
 			requireExplicitMessageTarget: true
 		}), input.pluginConfig), {
 			modelHasVision: runtimeModel.input?.includes("image") ?? false,
-			hasInboundImages: false
+			nativeImageInspectionEnabled: input.nativeToolSurfaceEnabled
 		});
 	}
 	const requestedWebSearchPlan = resolveCodexWebSearchPlan({
@@ -712,6 +762,7 @@ async function createCodexSideToolBridge(input) {
 		nativeProviderWebSearchSupport: input.nativeProviderWebSearchSupport,
 		webSearchAllowed: tools.some((tool) => tool.name === "web_search")
 	});
+	webFetchHostnameAllowlistRef.value = requestedWebSearchPlan.webFetchHostnameAllowlist;
 	const webSearchPlan = requestedWebSearchPlan.kind === "managed" ? resolveCodexWebSearchPlan({
 		config: input.params.cfg,
 		webSearchAllowed: false