@openclaw/codex 2026.8.1-beta.2 → 2026.9.1-beta.1

package/dist/{thread-lifecycle-Bu1BTDXr.js → thread-lifecycle-L7oEkTlq.js}

@@ -1,27 +1,35 @@
-import { D as CODEX_PLUGINS_MARKETPLACE_NAME, E as resolveCodexPluginsPolicy, O as CODEX_PLUGINS_WORKSPACE_MARKETPLACE_NAME, a as hashCodexAppServerBindingFingerprint, c as reclaimCurrentCodexSessionGeneration, d as sessionBindingIdentity, i as createCodexSessionGenerationSupersededError, m as codexSandboxPolicyForTurn, n as assertCodexBindingMayBeReplaced, o as isCodexAppServerNativeAuthProfile, s as normalizeCodexAppServerBindingModelProvider } from "./session-binding-DPxIvMgE.js";
-import { M as isCodexAppServerConnectionClosedError, R as resolveCodexAppServerClientInstanceId, V as consumeCodexAppServerLiveThread, ct as isJsonObject, d as retainSharedCodexAppServerClientByInstanceId, k as getCodexAppServerClientInstanceId, s as isCodexAppServerStartSelectionChangedError, st as flattenCodexDynamicToolFunctions, z as CodexAppServerRpcError } from "./shared-client-kIBbGjk4.js";
-import { a as closeCodexStartupClientBestEffort, c as isCodexAppServerUnsafeSubscriptionError, d as unsubscribeCodexThreadBestEffort, n as CODEX_APP_SERVER_UNSUBSCRIBE_TIMEOUT_MS, r as CodexAppServerUnsafeSubscriptionError } from "./attempt-client-cleanup-DMLXUfa8.js";
-import { a as assertCodexThreadStartResponse, r as assertCodexThreadForkResponse } from "./protocol-validators-B4F7L8Rf.js";
-import { a as serializeCodexAppInventoryError, i as defaultCodexAppInventoryCache, t as buildCodexAppServerConnectionFingerprint } from "./plugin-app-cache-key-C3H2CVp6.js";
+import { _ as CODEX_PLUGINS_MARKETPLACE_NAME, b as assertCodexModelBackedReviewerEffectiveConfig, g as resolveCodexPluginsPolicy, n as codexSandboxPolicyForTurn, v as CODEX_PLUGINS_WORKSPACE_MARKETPLACE_NAME } from "./config-giW8X0QA.js";
+import { G as CodexAppServerRpcError, J as consumeCodexAppServerLiveThread, L as isCodexAppServerConnectionClosedError, P as getCodexAppServerClientInstanceId, St as resolveCodexAppServerLocalHomeDir, U as resolveCodexAppServerClientInstanceId, _t as flattenCodexDynamicToolFunctions, c as isCodexAppServerStartSelectionChangedError, h as retainSharedCodexAppServerClientByInstanceId, vt as isJsonObject } from "./shared-client-DKz23hHY.js";
+import { a as hashCodexAppServerBindingFingerprint, c as reclaimCurrentCodexSessionGeneration, d as sessionBindingIdentity, i as createCodexSessionGenerationSupersededError, n as assertCodexBindingMayBeReplaced, o as isCodexAppServerNativeAuthProfile, s as normalizeCodexAppServerBindingModelProvider } from "./session-binding-Bcynfd-_.js";
+import { a as closeCodexStartupClientBestEffort, c as isCodexAppServerUnsafeSubscriptionError, d as unsubscribeCodexThreadBestEffort, n as CODEX_APP_SERVER_UNSUBSCRIBE_TIMEOUT_MS, r as CodexAppServerUnsafeSubscriptionError } from "./attempt-client-cleanup-bfsmcQ6m.js";
+import { a as assertCodexThreadStartResponse, r as assertCodexThreadForkResponse } from "./protocol-validators-VeJxxJ0U.js";
+import { o as defaultCodexAppInventoryCache, s as serializeCodexAppInventoryError, t as buildCodexAppServerConnectionFingerprint } from "./plugin-app-cache-key-C1CAdfcP.js";
 import { t as isIncognitoSessionKey } from "./incognito-session-ET_ufDH-.js";
-import { t as resumeCodexAppServerThread } from "./thread-resume-CPrJNQVM.js";
-import { u as projectBoundedCodexThreadHistory } from "./transcript-mirror-B9gGgnJS.js";
+import { n as codexCatalogHomeId } from "./session-catalog-home-id-BNwAJ9D7.js";
+import { t as resumeCodexAppServerThread } from "./thread-resume-BE9qNEW0.js";
+import { u as projectBoundedCodexThreadHistory } from "./transcript-mirror-DsCMWBca.js";
 import { r as sanitizeInlineImageDataUrl, t as invalidInlineImageText } from "./image-payload-sanitizer-CnfoUPCE.js";
 import { asOptionalRecord, isRecord, normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
 import fs from "node:fs/promises";
 import path from "node:path";
-import { SKILL_WORKSHOP_TOOL_NAME, TRANSCRIPT_CREDENTIAL_SAFETY_PROMPT, buildSkillWorkshopPromptSection, embeddedAgentLog, formatErrorMessage, isActiveHarnessContextEngine, isHostScopedAgentToolActive } from "openclaw/plugin-sdk/agent-harness-runtime";
+import { createDeferred } from "openclaw/plugin-sdk/extension-shared";
+import { addTimerTimeoutGraceMs, finiteSecondsToTimerSafeMilliseconds, parseStrictNonNegativeInteger } from "openclaw/plugin-sdk/number-runtime";
+import { SKILL_WORKSHOP_TOOL_NAME, TRANSCRIPT_CREDENTIAL_SAFETY_PROMPT, buildDelegationGuidanceSection, buildHarnessVisibleReplyGuidance, buildSkillWorkshopPromptSection, embeddedAgentLog, formatErrorMessage, formatToolExecutionErrorMessage, isActiveHarnessContextEngine, isHostScopedAgentToolActive, resolveMainSessionDelegationMode, resolveToolExecutionErrorKind } from "openclaw/plugin-sdk/agent-harness-runtime";
 import * as crypto$1 from "node:crypto";
-import crypto from "node:crypto";
+import crypto, { createHash } from "node:crypto";
 import os from "node:os";
+import { resolveAgentDir as resolveAgentDir$1, resolveSessionAgentIds as resolveSessionAgentIds$1 } from "openclaw/plugin-sdk/agent-runtime";
+import { z } from "zod";
 import { coerceErrorMessage } from "openclaw/plugin-sdk/error-runtime";
 import { sliceUtf16Safe, truncateUtf16Safe } from "openclaw/plugin-sdk/text-utility-runtime";
 import { redactSensitiveFieldValue, redactToolPayloadText } from "openclaw/plugin-sdk/logging-core";
+import { isPathInside } from "openclaw/plugin-sdk/file-access-runtime";
 import { resolveRequiredHomeDir, resolveStateDir } from "openclaw/plugin-sdk/state-paths";
 import { listRegisteredPluginAgentPromptGuidance } from "openclaw/plugin-sdk/plugin-runtime";
+import { buildHostnameAllowlistPolicyFromSuffixAllowlist } from "openclaw/plugin-sdk/ssrf-policy";
 import { buildCodexUserMcpServersThreadConfigPatchForRuntime } from "openclaw/plugin-sdk/codex-mcp-projection";
-import { isDiagnosticFlagEnabled } from "openclaw/plugin-sdk/diagnostic-runtime";
-import { GPT5_HEARTBEAT_PROMPT_OVERLAY } from "openclaw/plugin-sdk/provider-model-shared";
+import { emitTrustedDiagnosticEvent, hasPendingInternalDiagnosticEvent, isDiagnosticFlagEnabled } from "openclaw/plugin-sdk/diagnostic-runtime";
+import { registerRetainedNativeHookRelayForBundledRuntime } from "openclaw/plugin-sdk/native-hook-relay-runtime";
 //#region extensions/codex/src/app-server/plugin-inventory.ts
 /**
 * Reads Codex plugin marketplace state and app inventory to decide which
@@ -451,12 +459,21 @@ function activationFailure(identity, reason, diagnostic, extraDiagnostics = [])
 }
 //#endregion
 //#region extensions/codex/src/app-server/plugin-thread-app-admission.ts
+function resolveCodexPluginThreadAppCacheKey(params) {
+	return params.threadId ? `${params.appCacheKey}:thread:${encodeURIComponent(params.threadId)}` : params.appCacheKey;
+}
+function createCodexPluginThreadAppInventoryRequest(params) {
+	return async (method, requestParams) => await params.request(method, (method === "app/installed" || method === "app/read") && params.threadId ? {
+		...requestParams,
+		threadId: params.threadId
+	} : requestParams);
+}
 async function refreshCodexPluginAppInventory(params, appCache, options = {}) {
 	if (!params.appCacheKey) return;
-	const request = async (method, requestParams) => await params.request(method, requestParams);
+	const request = createCodexPluginThreadAppInventoryRequest(params);
 	try {
 		return await appCache.refreshNow({
-			key: params.appCacheKey,
+			key: resolveCodexPluginThreadAppCacheKey(params),
 			request,
 			nowMs: params.nowMs,
 			forceRefetch: options.forceRefetch,
@@ -493,9 +510,9 @@ function normalizeCodexPluginOwnerName(name) {
 	return name.trim().toLowerCase().replace(/[^a-z0-9]+/g, "");
 }
 async function readCodexThreadAdmissibleAccountApps(params, appCache) {
-	const request = async (method, requestParams) => await params.request(method, requestParams);
+	const request = createCodexPluginThreadAppInventoryRequest(params);
 	const cachedInventory = appCache.read({
-		key: params.appCacheKey,
+		key: resolveCodexPluginThreadAppCacheKey(params),
 		request,
 		nowMs: params.nowMs,
 		suppressRefresh: true
@@ -610,6 +627,11 @@ function buildCodexPluginThreadConfigTimeoutFallback(params) {
 /** Builds the Codex apps config patch and policy context for a native thread. */
 async function buildCodexPluginThreadConfig(params) {
 	const appCache = params.appCache ?? defaultCodexAppInventoryCache;
+	const threadAppCacheKey = resolveCodexPluginThreadAppCacheKey(params);
+	const threadRequest = (method, requestParams) => params.request(method, (method === "app/installed" || method === "app/read") && params.threadId && isJsonObject(requestParams) ? {
+		...requestParams,
+		threadId: params.threadId
+	} : requestParams);
 	let inputFingerprint = buildCodexPluginThreadConfigInputFingerprint({
 		pluginConfig: params.pluginConfig,
 		appCacheKey: params.appCacheKey
@@ -623,9 +645,9 @@ async function buildCodexPluginThreadConfig(params) {
 	let inventory = policy.pluginPolicies.length > 0 ? await readCodexPluginInventory({
 		pluginConfig: params.pluginConfig,
 		policy,
-		request: params.request,
+		request: threadRequest,
 		appCache,
-		appCacheKey: params.appCacheKey,
+		appCacheKey: threadAppCacheKey,
 		configCwd: params.configCwd,
 		metadataCache: params.metadataCache,
 		nowMs: params.nowMs,
@@ -641,9 +663,9 @@ async function buildCodexPluginThreadConfig(params) {
 		inventory = await readCodexPluginInventory({
 			pluginConfig: params.pluginConfig,
 			policy,
-			request: params.request,
+			request: threadRequest,
 			appCache,
-			appCacheKey: params.appCacheKey,
+			appCacheKey: threadAppCacheKey,
 			configCwd: params.configCwd,
 			metadataCache: params.metadataCache,
 			nowMs: params.nowMs
@@ -659,9 +681,9 @@ async function buildCodexPluginThreadConfig(params) {
 		if (!record.activationRequired) continue;
 		const activation = await ensureCodexPluginActivation({
 			identity: record.policy,
-			request: params.request,
+			request: threadRequest,
 			appCache,
-			appCacheKey: params.appCacheKey,
+			appCacheKey: threadAppCacheKey,
 			configCwd: params.configCwd,
 			metadataCache: params.metadataCache,
 			deferAppInventoryRefresh: true,
@@ -685,9 +707,9 @@ async function buildCodexPluginThreadConfig(params) {
 		inventory = await readCodexPluginInventory({
 			pluginConfig: params.pluginConfig,
 			policy,
-			request: params.request,
+			request: threadRequest,
 			appCache,
-			appCacheKey: params.appCacheKey,
+			appCacheKey: threadAppCacheKey,
 			configCwd: params.configCwd,
 			metadataCache: params.metadataCache,
 			nowMs: params.nowMs
@@ -706,9 +728,9 @@ async function buildCodexPluginThreadConfig(params) {
 		inventory = await readCodexPluginInventory({
 			pluginConfig: params.pluginConfig,
 			policy,
-			request: params.request,
+			request: threadRequest,
 			appCache,
-			appCacheKey: params.appCacheKey,
+			appCacheKey: threadAppCacheKey,
 			configCwd: params.configCwd,
 			metadataCache: params.metadataCache,
 			nowMs: params.nowMs
@@ -1063,6 +1085,32 @@ function resolveCodexContextEngineProjectionMaxChars(params) {
 function resolveCodexContextEngineProjectionReserveTokens() {
 	return DEFAULT_CODEX_PROJECTION_RESERVE_TOKENS;
 }
+const CONTINUITY_PROJECTION_RESERVE_RATIO = .5;
+const CONTINUITY_EMPIRICAL_CHARS_PER_TOKEN = 3;
+const CONTINUITY_MIN_CHARS_PER_TOKEN = .5;
+const CONTINUITY_MAX_CHARS_PER_TOKEN = CONTINUITY_EMPIRICAL_CHARS_PER_TOKEN;
+const CONTINUITY_CALIBRATION_MIN_PROMPT_CHARS = 5e4;
+/** Builds a calibration sample from a completed turn, or undefined if unusable. */
+function buildCodexContinuityCalibration(params) {
+	if (!Number.isFinite(params.promptChars) || !Number.isFinite(params.inputTokens) || params.promptChars < CONTINUITY_CALIBRATION_MIN_PROMPT_CHARS || params.inputTokens <= 0) return;
+	return {
+		promptChars: Math.floor(params.promptChars),
+		inputTokens: Math.floor(params.inputTokens)
+	};
+}
+function resolveContinuityCharsPerToken(calibration) {
+	if (!calibration || !Number.isFinite(calibration.promptChars) || !Number.isFinite(calibration.inputTokens) || calibration.promptChars < CONTINUITY_CALIBRATION_MIN_PROMPT_CHARS || calibration.inputTokens <= 0) return CONTINUITY_EMPIRICAL_CHARS_PER_TOKEN;
+	return Math.min(CONTINUITY_MAX_CHARS_PER_TOKEN, Math.max(CONTINUITY_MIN_CHARS_PER_TOKEN, calibration.promptChars / calibration.inputTokens));
+}
+/** Resolves rendered context size for no-engine continuity projections. */
+function resolveCodexContinuityProjectionMaxChars(params) {
+	const contextTokenBudget = typeof params.contextTokenBudget === "number" && Number.isFinite(params.contextTokenBudget) ? Math.floor(params.contextTokenBudget) : void 0;
+	if (!contextTokenBudget || contextTokenBudget <= 0) return DEFAULT_RENDERED_CONTEXT_CHARS;
+	return normalizeRenderedContextMaxChars(resolveProjectionPromptBudgetTokens({
+		contextTokenBudget,
+		reserveTokens: Math.max(DEFAULT_CODEX_PROJECTION_RESERVE_TOKENS, Math.floor(contextTokenBudget * CONTINUITY_PROJECTION_RESERVE_RATIO))
+	}) * resolveContinuityCharsPerToken(params.calibration));
+}
 /** Fits projected context prompts under Codex app-server turn/start text limits. */
 function fitCodexProjectedContextForTurnStart(params) {
 	const maxChars = typeof params.maxChars === "number" && Number.isFinite(params.maxChars) ? Math.max(0, Math.floor(params.maxChars)) : CODEX_TURN_START_TEXT_INPUT_MAX_CHARS;
@@ -1328,7 +1376,6 @@ const CODEX_APP_SERVER_OWNED_REPLACEABLE_TOOL_EXCLUDES = /* @__PURE__ */ new Set
 	"write",
 	"edit",
 	"apply_patch",
-	"update_plan",
 	...CODEX_NATIVE_GOAL_TOOL_EXCLUDES
 ]);
 const CODEX_APP_SERVER_OWNED_SHELL_TOOL_EXCLUDES = /* @__PURE__ */ new Set(["exec", "process"]);
@@ -1561,10 +1608,6 @@ const nativeSkillIsolationByClient = /* @__PURE__ */ new WeakMap();
 function isMissingPathError(error) {
 	return error.code === "ENOENT";
 }
-function isPathWithin(root, candidate) {
-	const relative = path.relative(path.resolve(root), path.resolve(candidate));
-	return relative === "" || !path.isAbsolute(relative) && !relative.startsWith(`..${path.sep}`) && relative !== "..";
-}
 async function canonicalizeExistingPath(candidate) {
 	try {
 		return await fs.realpath(candidate);
@@ -1590,12 +1633,12 @@ async function collectPersonalSkillRealPaths(homes, codexHome) {
 		const realDefaultCodexHome = await canonicalizeExistingPath(defaultCodexHome);
 		roots.push({
 			dir: path.join(defaultCodexHome, "skills"),
-			onlyEscapedStateTargets: isPathWithin(realStateDir, realDefaultCodexHome)
+			onlyEscapedStateTargets: isPathInside(realStateDir, realDefaultCodexHome)
 		});
 	}
 	const configuredCodexHome = codexHome?.trim() || process.env.CODEX_HOME?.trim();
 	if (configuredCodexHome) {
-		const stateOwned = isPathWithin(realStateDir, await canonicalizeExistingPath(configuredCodexHome));
+		const stateOwned = isPathInside(realStateDir, await canonicalizeExistingPath(configuredCodexHome));
 		roots.push({
 			dir: path.join(configuredCodexHome, "skills"),
 			onlyEscapedStateTargets: stateOwned
@@ -1613,7 +1656,7 @@ async function collectPersonalSkillRealPaths(homes, codexHome) {
 	const recordSkillFile = async (filePath, onlyEscapedStateTargets) => {
 		try {
 			const skillRealPath = await fs.realpath(filePath);
-			if (!onlyEscapedStateTargets || !isPathWithin(realStateDir, skillRealPath)) skillPaths.add(skillRealPath);
+			if (!onlyEscapedStateTargets || !isPathInside(realStateDir, skillRealPath)) skillPaths.add(skillRealPath);
 		} catch (error) {
 			if (!isMissingPathError(error)) complete = false;
 		}
@@ -1756,7 +1799,7 @@ function applyCodexNativeSkillIsolation(config, isolation) {
 //#region extensions/codex/src/app-server/thread-lifecycle-errors.ts
 var CodexThreadStartRequestError = class extends Error {
 	constructor(cause) {
-		super(formatErrorMessage(cause), { cause });
+		super(`thread/start: ${formatErrorMessage(cause)}`, { cause });
 		this.name = "CodexThreadStartRequestError";
 	}
 };
@@ -1780,6 +1823,64 @@ var CodexAdoptedThreadActiveError = class extends Error {
 	}
 };
 //#endregion
+//#region extensions/codex/src/app-server/managed-thread-store.ts
+const CODEX_MANAGED_THREAD_NAMESPACE = "app-server-managed-threads";
+const CODEX_MANAGED_THREAD_MAX_ENTRIES = 2e4;
+const managedThreadSchema = z.object({
+	version: z.literal(1),
+	kind: z.literal("managed-thread"),
+	sourceHomeId: z.string().min(1),
+	threadId: z.string().min(1),
+	rolloutPath: z.string().min(1).optional()
+});
+async function markStartedCodexManagedThread(store, params) {
+	if (!store) return;
+	try {
+		await store.mark({
+			sourceHomeId: params.sourceHomeId,
+			threadId: params.threadId,
+			...params.rolloutPath ? { rolloutPath: params.rolloutPath } : {}
+		});
+	} catch (error) {
+		embeddedAgentLog.warn("failed to record Codex managed thread ownership", { error });
+	}
+}
+function managedThreadStoreKey(sourceHomeId, threadId) {
+	return `sha256:${createHash("sha256").update("openclaw:codex-managed-thread:v1\0").update(sourceHomeId).update("\0").update(threadId).digest("hex")}`;
+}
+/** Durable ownership index for Codex threads created by OpenClaw. */
+function createCodexManagedThreadStore(state) {
+	return {
+		async mark(params) {
+			try {
+				const value = managedThreadSchema.parse({
+					version: 1,
+					kind: "managed-thread",
+					sourceHomeId: params.sourceHomeId.trim(),
+					threadId: params.threadId.trim(),
+					...params.rolloutPath?.trim() ? { rolloutPath: params.rolloutPath.trim() } : {}
+				});
+				state.registerIfAbsent(managedThreadStoreKey(value.sourceHomeId, value.threadId), value);
+				return true;
+			} catch (error) {
+				embeddedAgentLog.warn("failed to record Codex managed thread ownership", { error });
+				return false;
+			}
+		},
+		async snapshot() {
+			const byHome = /* @__PURE__ */ new Map();
+			for (const entry of state.entries()) {
+				const parsed = managedThreadSchema.safeParse(entry.value);
+				if (!parsed.success) continue;
+				const ids = byHome.get(parsed.data.sourceHomeId) ?? /* @__PURE__ */ new Set();
+				ids.add(parsed.data.threadId);
+				byHome.set(parsed.data.sourceHomeId, ids);
+			}
+			return byHome;
+		}
+	};
+}
+//#endregion
 //#region extensions/codex/src/app-server/plugin-thread-attestation.ts
 /**
 * Confirms admitted plugin and account apps against their actual Codex thread before
@@ -1835,6 +1936,50 @@ async function discardUnattestedCodexPluginThread(params) {
 	}
 }
 //#endregion
+//#region extensions/codex/src/app-server/thread-lifecycle-result.ts
+/** Materializes the public lifecycle result after a fresh thread is durably committed. */
+function buildStartedCodexThreadBinding(input) {
+	const { context, params, response, startParams } = input;
+	return {
+		threadId: response.thread.id,
+		...input.clientId ? { clientId: input.clientId } : {},
+		cwd: params.cwd,
+		...input.rolloutPath ? { rolloutPath: input.rolloutPath } : {},
+		authProfileId: params.params.authProfileId,
+		agentWorkspaceDeveloperInstructions: params.agentWorkspaceDeveloperInstructions,
+		model: response.model ?? startParams.model ?? params.params.modelId,
+		modelProvider: response.modelProvider ?? input.startModelProvider ?? input.modelProvider,
+		dynamicToolsFingerprint: context.dynamicToolsFingerprint,
+		dynamicToolsContainDeferred: context.dynamicToolsContainDeferred,
+		nativeSkillIsolationFingerprint: context.nativeSkillIsolationFingerprint,
+		userMcpServersFingerprint: context.userMcpServersFingerprint,
+		mcpServersFingerprint: input.nextMcpServersFingerprint,
+		configuredMcpOwnershipVersion: params.configuredMcpOwnershipVersion,
+		ringZeroConfigFingerprint: context.ringZeroConfigFingerprint,
+		ringZeroClientInstanceId: context.ringZeroClientInstanceId,
+		networkProxyProfileName: params.appServer.networkProxy?.profileName,
+		networkProxyConfigFingerprint: context.networkProxyConfigFingerprint,
+		nativeHookRelayGeneration: input.finalConfigPatch.nativeHookRelayGeneration,
+		appServerRuntimeFingerprint: params.appServerRuntimeFingerprint,
+		pluginAppsFingerprint: input.pluginThreadConfig?.fingerprint,
+		pluginAppsInputFingerprint: input.pluginThreadConfig?.inputFingerprint,
+		pluginAppPolicyContext: input.pluginThreadConfig?.policyContext,
+		contextEngine: context.contextEngineBinding,
+		environmentSelectionFingerprint: context.environmentSelectionFingerprint,
+		...!context.preserveExistingBinding ? { liveThreadConfigFingerprint: fingerprintCodexThreadConfig({
+			...startParams,
+			model: response.model ?? startParams.model ?? null,
+			requestedModel: startParams.model ?? null,
+			modelProvider: input.bindingModelProvider ?? null,
+			requestedModelProvider: startParams.modelProvider ?? input.bindingModelProvider ?? null
+		}, params.params.authProfileId, context.dynamicToolsFingerprint) } : {},
+		lifecycle: {
+			action: "started",
+			...context.rotatedContextEngineBinding ? { rotatedContextEngineBinding: true } : {}
+		}
+	};
+}
+//#endregion
 //#region extensions/codex/src/app-server/reasoning-effort.ts
 const CODEX_REASONING_EFFORTS = [
 	"minimal",
@@ -1963,12 +2108,21 @@ function resolveReasoningEffort(thinkLevel, modelId, supportedReasoningEfforts)
 	});
 }
 //#endregion
+//#region extensions/codex/src/app-server/project-doc-thread-config.ts
+const CODEX_NATIVE_PROJECT_DOC_MAX_BYTES = 128 * 1024;
+function buildCodexProjectDocThreadConfig(config) {
+	const defaults = { project_doc_max_bytes: CODEX_NATIVE_PROJECT_DOC_MAX_BYTES };
+	return mergeCodexThreadConfigs(defaults, config) ?? defaults;
+}
+//#endregion
 //#region extensions/codex/src/app-server/thread-prompt.ts
 function buildDeveloperInstructions(params, options = {}) {
 	const deferredToolNames = /* @__PURE__ */ new Set();
 	let hasSkillWorkshop = false;
 	let hasSessionsSpawn = false;
 	let hasSessionsYield = false;
+	let hasSubagentsList = false;
+	let hasSessionsSend = false;
 	let hasSeenDirectNamespace = false;
 	let messageToolAvailable = options.dynamicTools ? false : params.disableMessageTool !== true;
 	for (const spec of options.dynamicTools ?? []) {
@@ -1980,6 +2134,8 @@ function buildDeveloperInstructions(params, options = {}) {
 			hasSkillWorkshop ||= name === SKILL_WORKSHOP_TOOL_NAME;
 			hasSessionsSpawn ||= name === "sessions_spawn";
 			hasSessionsYield ||= isDirectNamespace && name === "sessions_yield";
+			hasSubagentsList ||= name === "subagents";
+			hasSessionsSend ||= name === "sessions_send";
 			messageToolAvailable ||= name === "message";
 		}
 	}
@@ -1987,25 +2143,71 @@ function buildDeveloperInstructions(params, options = {}) {
 		surface: "codex_app_server",
 		includeLegacyGlobalGuidance: false
 	}).join("\n");
-	const nativeDelegationAvailable = params.disableTools !== true && params.delegationCapability !== "report_only" && !isMessageOnlyCodexSourceReply(params) && !isSystemAgentOnlyCodexDynamicToolAllowlist(params.toolsAllow) && !shouldDisableCodexToolSearchForModel(params.modelId);
+	const delegationGuidanceAvailable = params.disableTools !== true && params.delegationCapability !== "report_only" && !isMessageOnlyCodexSourceReply(params);
+	const nativeDelegationAvailable = delegationGuidanceAvailable && !isSystemAgentOnlyCodexDynamicToolAllowlist(params.toolsAllow) && !shouldDisableCodexToolSearchForModel(params.modelId);
 	const deferredToolDiscoveryGuidance = deferredToolNames.size > 0 || nativeDelegationAvailable ? "Deferred tools may be absent from the direct tool list. Use `tool_search` when directly callable. On code-mode-only models, use `exec` instead: filter `ALL_TOOLS` by name and description, then call the matching entry through `tools`." : void 0;
 	return [
 		"You are a personal agent running inside OpenClaw. OpenClaw has dynamic tools for OpenClaw-owned messaging, cron, sessions, media, gateway, and nodes.",
 		deferredToolNames.size > 0 ? `Deferred searchable OpenClaw dynamic tools available: ${[...deferredToolNames].toSorted((left, right) => left.localeCompare(right)).join(", ")}.` : void 0,
 		deferredToolDiscoveryGuidance,
 		hasSkillWorkshop ? buildSkillWorkshopPromptSection().join("\n") : void 0,
-		nativeDelegationAvailable ? `Use Codex native \`spawn_agent\` for Codex subagents. \`spawn_agent\` and the other native collaboration tools may be deferred.${hasSessionsSpawn ? " Use OpenClaw `sessions_spawn` only for OpenClaw or ACP delegation, never as a substitute for `spawn_agent`." : ""}` : void 0,
+		nativeDelegationAvailable ? `Use Codex native \`spawn_agent\` for Codex subagents. \`spawn_agent\` and the other native collaboration tools may be deferred.${hasSessionsSpawn ? " Use OpenClaw `sessions_spawn` only for OpenClaw or ACP delegation, never as a substitute for `spawn_agent` on internal legwork." : ""}` : void 0,
 		hasSessionsYield && nativeDelegationAvailable ? "When a native child's result belongs in a later turn, end the current turn with `openclaw_direct.sessions_yield`; the completion arrives as the next model-visible input. Use native `wait_agent` only for an intentional same-turn wait when the immediate next step is blocked on the child. Never loop-poll for native child completion." : void 0,
-		buildVisibleReplyInstruction(params, messageToolAvailable),
+		delegationGuidanceAvailable ? buildDelegationGuidanceSection({
+			mode: resolveMainSessionDelegationMode({
+				config: params.config,
+				agentId: params.agentId,
+				sessionKey: params.sessionKey
+			}),
+			isMinimal: params.promptMode === "minimal" || params.promptMode === "none",
+			hiddenDelegationTool: nativeDelegationAvailable ? "native `spawn_agent`" : hasSessionsSpawn ? "`sessions_spawn`" : "",
+			hasVisibleSessionSpawn: hasSessionsSpawn,
+			hasSessionsYield,
+			hasSubagentsList,
+			hasSessionsSend
+		}).join("\n") : void 0,
+		buildHarnessVisibleReplyGuidance({
+			sourceReplyDeliveryMode: params.sourceReplyDeliveryMode,
+			messageToolAvailable
+		}),
 		TRANSCRIPT_CREDENTIAL_SAFETY_PROMPT,
 		nativeCommandGuidance,
 		params.extraSystemPrompt
 	].filter((section) => typeof section === "string" && section.trim()).join("\n\n");
 }
-function buildVisibleReplyInstruction(params, messageToolAvailable) {
-	if (params.sourceReplyDeliveryMode === "message_tool_only" && messageToolAvailable) return "Visible source replies are not automatically delivered for this run. Use `message(action=send)` for user-visible source-channel output. For progress, set `final=false`. Set `final=true`, or omit it, for the completed reply to the current source conversation; OpenClaw stops after confirming delivery. Do not repeat visible message content in your final answer.";
-	if (messageToolAvailable) return "For the current source conversation, reply normally in your final assistant message; OpenClaw will deliver it through the active source conversation. Use `message` for supported non-text actions in the current conversation, such as reacting to its current message. Reserve other `message` actions for explicit out-of-band sends or media/file delivery. Reactions are not delivered automatically.";
-	return "For the current source conversation, reply normally in your final assistant message; OpenClaw will deliver it through the active source conversation.";
+//#endregion
+//#region extensions/codex/src/app-server/thread-shell-environment.ts
+/** Applies host-selected values and any required login-shell restriction last. */
+function applyCodexManagedShellEnvironment(config, environment, disableLoginShell = false) {
+	if (!environment || Object.keys(environment).length === 0) return disableLoginShell ? {
+		...config,
+		allow_login_shell: false
+	} : config;
+	const current = isJsonObject(config.shell_environment_policy) ? config.shell_environment_policy : {};
+	const currentSet = isJsonObject(current.set) ? current.set : {};
+	const names = Object.keys(environment).toSorted();
+	const includeOnly = Array.isArray(current.include_only) ? current.include_only.filter((entry) => typeof entry === "string") : [];
+	const filters = isJsonObject(current.filters) ? current.filters : void 0;
+	const hasIncludeFilter = filters && Object.values(filters).includes("include");
+	const managedConfig = {
+		...config,
+		shell_environment_policy: {
+			...current,
+			experimental_use_profile: false,
+			set: {
+				...currentSet,
+				...environment
+			},
+			...filters ? hasIncludeFilter ? { filters: {
+				...filters,
+				...Object.fromEntries(names.map((name) => [name, "include"]))
+			} } : {} : includeOnly.length > 0 ? { include_only: [.../* @__PURE__ */ new Set([...includeOnly, ...names])] } : {}
+		}
+	};
+	return disableLoginShell ? {
+		...managedConfig,
+		allow_login_shell: false
+	} : managedConfig;
 }
 //#endregion
 //#region extensions/codex/src/app-server/web-search.ts
@@ -2068,20 +2270,23 @@ function resolveCodexWebSearchPlan(params) {
 	return {
 		kind: "native-hosted",
 		suppressManagedWebSearch: true,
-		threadConfig: buildCodexNativeWebSearchThreadConfig(params.config)
+		threadConfig: buildCodexNativeWebSearchThreadConfig(params.config),
+		webFetchHostnameAllowlist: buildHostnameAllowlistPolicyFromSuffixAllowlist(nativeConfig?.allowedDomains)?.hostnameAllowlist
 	};
 }
 const CODEX_CODE_MODE_THREAD_CONFIG = {
 	"features.code_mode": true,
 	"features.code_mode_only": false,
-	"features.apply_patch_streaming_events": true
+	"features.apply_patch_streaming_events": true,
+	suppress_unstable_features_warning: true
 };
 const CODEX_GOAL_CONTINUATION_DISABLED_THREAD_CONFIG = { "features.goals": false };
+const CODEX_NATIVE_UPDATE_PLAN_DISABLED_THREAD_CONFIG = { "tools.update_plan.enabled": false };
 const CODEX_CODE_MODE_DISABLED_THREAD_CONFIG = {
 	"features.code_mode": false,
 	"features.code_mode_only": false
 };
-const CODEX_LIGHTWEIGHT_CONTEXT_THREAD_CONFIG = { project_doc_max_bytes: 0 };
+const CODEX_NO_PROJECT_DOCS_CONFIG = { project_doc_max_bytes: 0 };
 const CODEX_TOOL_SEARCH_UNSUPPORTED_THREAD_CONFIG = { "features.multi_agent": false };
 const CODEX_DELEGATION_DISABLED_THREAD_CONFIG = {
 	"agents.enabled": false,
@@ -2127,7 +2332,6 @@ const CODEX_RING_ZERO_THREAD_CONFIG = {
 	"skills.bundled.enabled": false,
 	"skills.include_instructions": false,
 	"tools.experimental_request_user_input.enabled": false,
-	"tools.update_plan.enabled": false,
 	hooks: {
 		PreToolUse: [],
 		PermissionRequest: [],
@@ -2140,7 +2344,6 @@ const CODEX_RING_ZERO_THREAD_CONFIG = {
 		SubagentStop: [],
 		Stop: []
 	},
-	project_doc_max_bytes: 0,
 	notify: [],
 	web_search: "disabled"
 };
@@ -2153,6 +2356,7 @@ const CODEX_RING_ZERO_RESTRICTED_FEATURE_ALIASES = /* @__PURE__ */ new Map([
 	["codex_hooks", "hooks"]
 ]);
 const CODEX_RING_ZERO_OVERRIDABLE_LAYER_TYPES = /* @__PURE__ */ new Set([
+	"packagedDefaults",
 	"mdm",
 	"system",
 	"enterpriseManaged",
@@ -2181,6 +2385,7 @@ function buildThreadStartParams(params, options) {
 		model: modelSelection.model,
 		...modelSelection.modelProvider ? { modelProvider: modelSelection.modelProvider } : {},
 		cwd: options.cwd,
+		...options.appServer.sessionRoot ? { runtimeWorkspaceRoots: [options.appServer.sessionRoot] } : {},
 		approvalPolicy: options.appServer.approvalPolicy,
 		approvalsReviewer: resolveCodexThreadApprovalsReviewer(options.appServer, options.config),
 		...codexThreadSandboxOrPermissions(options.appServer),
@@ -2196,7 +2401,9 @@ function buildThreadStartParams(params, options) {
 			webSearchAllowed: options.webSearchAllowed,
 			appServer: options.appServer,
 			hostSystemAgentActive: options.hostSystemAgentActive,
-			restrictedToolSurfaceInheritedMcpServerNames: options.restrictedToolSurfaceInheritedMcpServerNames
+			restrictedToolSurfaceInheritedMcpServerNames: options.restrictedToolSurfaceInheritedMcpServerNames,
+			shellEnvironment: options.shellEnvironment,
+			disableLoginShell: options.disableLoginShell
 		}),
 		...resolveCodexThreadEnvironmentSelection(options),
 		developerInstructions: options.developerInstructions ?? buildDeveloperInstructions(params, { dynamicTools: options.dynamicTools }),
@@ -2222,6 +2429,8 @@ function buildThreadResumeParams(params, options) {
 	});
 	return {
 		threadId: options.threadId,
+		...options.cwd ? { cwd: options.cwd } : {},
+		...options.appServer.sessionRoot ? { runtimeWorkspaceRoots: [options.appServer.sessionRoot] } : {},
 		excludeTurns: true,
 		initialTurnsPage: {
 			limit: 1,
@@ -2245,29 +2454,38 @@ function buildThreadResumeParams(params, options) {
 			webSearchAllowed: options.webSearchAllowed,
 			appServer: options.appServer,
 			hostSystemAgentActive: options.hostSystemAgentActive,
-			restrictedToolSurfaceInheritedMcpServerNames: options.restrictedToolSurfaceInheritedMcpServerNames
+			restrictedToolSurfaceInheritedMcpServerNames: options.restrictedToolSurfaceInheritedMcpServerNames,
+			shellEnvironment: options.shellEnvironment,
+			disableLoginShell: options.disableLoginShell
 		}),
 		developerInstructions: options.developerInstructions ?? buildDeveloperInstructions(params, { dynamicTools: options.dynamicTools })
 	};
 }
 function buildCodexRuntimeThreadConfig(config, options = {}) {
+	const configured = buildCodexProjectDocThreadConfig(config);
 	const codeModeConfig = {
 		...CODEX_CODE_MODE_THREAD_CONFIG,
 		"features.code_mode_only": options.nativeCodeModeOnlyEnabled === true
 	};
 	if (options.nativeCodeModeEnabled === false) {
-		const disabledConfig = mergeCodexThreadConfigs(config, CODEX_CODE_MODE_DISABLED_THREAD_CONFIG, CODEX_GOAL_CONTINUATION_DISABLED_THREAD_CONFIG) ?? { ...CODEX_CODE_MODE_DISABLED_THREAD_CONFIG };
+		const disabledConfig = mergeCodexThreadConfigs(configured, CODEX_CODE_MODE_DISABLED_THREAD_CONFIG, CODEX_GOAL_CONTINUATION_DISABLED_THREAD_CONFIG, CODEX_NATIVE_UPDATE_PLAN_DISABLED_THREAD_CONFIG) ?? {
+			...CODEX_CODE_MODE_DISABLED_THREAD_CONFIG,
+			...CODEX_GOAL_CONTINUATION_DISABLED_THREAD_CONFIG,
+			...CODEX_NATIVE_UPDATE_PLAN_DISABLED_THREAD_CONFIG
+		};
 		delete disabledConfig["features.apply_patch_streaming_events"];
 		return disabledConfig;
 	}
-	if (options.nativeCodeModeOnlyEnabled === true) return ensureDirectOnlyToolNamespaces(mergeCodexThreadConfigs(codeModeConfig, config, CODEX_GOAL_CONTINUATION_DISABLED_THREAD_CONFIG, { "features.code_mode_only": true }) ?? {
+	if (options.nativeCodeModeOnlyEnabled === true) return ensureDirectOnlyToolNamespaces(mergeCodexThreadConfigs(codeModeConfig, configured, CODEX_GOAL_CONTINUATION_DISABLED_THREAD_CONFIG, CODEX_NATIVE_UPDATE_PLAN_DISABLED_THREAD_CONFIG, { "features.code_mode_only": true }) ?? {
 		...codeModeConfig,
 		...CODEX_GOAL_CONTINUATION_DISABLED_THREAD_CONFIG,
+		...CODEX_NATIVE_UPDATE_PLAN_DISABLED_THREAD_CONFIG,
 		"features.code_mode_only": true
 	}, options.directOnlyToolNamespaces);
-	return ensureDirectOnlyToolNamespaces(mergeCodexThreadConfigs(codeModeConfig, config, CODEX_GOAL_CONTINUATION_DISABLED_THREAD_CONFIG) ?? {
+	return ensureDirectOnlyToolNamespaces(mergeCodexThreadConfigs(codeModeConfig, configured, CODEX_GOAL_CONTINUATION_DISABLED_THREAD_CONFIG, CODEX_NATIVE_UPDATE_PLAN_DISABLED_THREAD_CONFIG) ?? {
 		...codeModeConfig,
-		...CODEX_GOAL_CONTINUATION_DISABLED_THREAD_CONFIG
+		...CODEX_GOAL_CONTINUATION_DISABLED_THREAD_CONFIG,
+		...CODEX_NATIVE_UPDATE_PLAN_DISABLED_THREAD_CONFIG
 	}, options.directOnlyToolNamespaces);
 }
 function ensureDirectOnlyToolNamespaces(config, requiredNamespaces) {
@@ -2286,6 +2504,7 @@ function buildCodexRuntimeThreadConfigForRun(params, config, options = {}) {
 	const ringZeroActive = (options.hostSystemAgentActive ?? isHostScopedAgentToolActive("openclaw")) && isSystemAgentOnlyCodexDynamicToolAllowlist(params.toolsAllow);
 	const messageOnlySourceReply = isMessageOnlyCodexSourceReply(params);
 	const restrictedToolSurface = ringZeroActive || messageOnlySourceReply || params.pluginHarnessToolPolicyRestricted === true;
+	const restrictedTurnDisablesProjectDocs = ringZeroActive || messageOnlySourceReply || params.pluginHarnessToolPolicyRestricted && params.disableTools;
 	const configMcpServers = config?.mcp_servers;
 	if (restrictedToolSurface && configMcpServers !== void 0 && !isJsonObject(configMcpServers)) throw new Error("Codex restricted tool surface received invalid thread mcp_servers config");
 	const restrictedToolSurfaceMcpServerNames = [...options.restrictedToolSurfaceInheritedMcpServerNames ?? [], ...isJsonObject(configMcpServers) ? Object.keys(configMcpServers) : []];
@@ -2301,18 +2520,19 @@ function buildCodexRuntimeThreadConfigForRun(params, config, options = {}) {
 		webSearchAllowed: options.webSearchAllowed
 	}).threadConfig;
 	const baseConfig = buildCodexRuntimeThreadConfig(mergeCodexThreadConfigs(restrictedRunConfig, webSearchConfig), options);
-	const runtimeConfig = mergeCodexThreadConfigs(baseConfig, options.appServer?.networkProxy?.configPatch, shouldDisableCodexToolSearchForModel(params.modelId) ? CODEX_TOOL_SEARCH_UNSUPPORTED_THREAD_CONFIG : void 0, params.delegationCapability === "report_only" ? CODEX_DELEGATION_DISABLED_THREAD_CONFIG : void 0, messageOnlySourceReply || params.pluginHarnessToolPolicyRestricted === true ? buildCodexRestrictedToolThreadConfigPatch(restrictedToolSurfaceMcpServerNames) : buildCodexRingZeroThreadConfigPatch(params, options.hostSystemAgentActive, restrictedToolSurfaceMcpServerNames)) ?? baseConfig;
-	if (params.bootstrapContextMode !== "lightweight") return runtimeConfig;
-	return mergeCodexThreadConfigs(runtimeConfig, CODEX_LIGHTWEIGHT_CONTEXT_THREAD_CONFIG) ?? {
-		...runtimeConfig,
-		...CODEX_LIGHTWEIGHT_CONTEXT_THREAD_CONFIG
-	};
+	return applyCodexManagedShellEnvironment({
+		...mergeCodexThreadConfigs(baseConfig, options.appServer?.networkProxy?.configPatch, params.pluginHarnessToolPolicySafeDeniedTools?.includes("image_generate") ? { "features.image_generation": false } : void 0, shouldDisableCodexToolSearchForModel(params.modelId) ? CODEX_TOOL_SEARCH_UNSUPPORTED_THREAD_CONFIG : void 0, params.delegationCapability === "report_only" ? CODEX_DELEGATION_DISABLED_THREAD_CONFIG : void 0, messageOnlySourceReply || params.pluginHarnessToolPolicyRestricted === true ? buildRestrictedToolConfigPatch(restrictedToolSurfaceMcpServerNames) : buildCodexRingZeroThreadConfigPatch(params, options.hostSystemAgentActive, restrictedToolSurfaceMcpServerNames), restrictedTurnDisablesProjectDocs ? CODEX_NO_PROJECT_DOCS_CONFIG : void 0, params.authoredContextTokenCap === void 0 ? void 0 : { model_context_window: params.authoredContextTokenCap }) ?? baseConfig,
+		...params.bootstrapContextMode === "lightweight" ? CODEX_NO_PROJECT_DOCS_CONFIG : {}
+	}, options.shellEnvironment, options.disableLoginShell);
 }
 function buildCodexRingZeroThreadConfigPatch(params, hostSystemAgentActive = isHostScopedAgentToolActive("openclaw"), inheritedMcpServerNames = []) {
 	if (!hostSystemAgentActive || !isSystemAgentOnlyCodexDynamicToolAllowlist(params.toolsAllow)) return;
-	return buildCodexRestrictedToolThreadConfigPatch(inheritedMcpServerNames);
+	return {
+		...buildRestrictedToolConfigPatch(inheritedMcpServerNames),
+		...CODEX_NO_PROJECT_DOCS_CONFIG
+	};
 }
-function buildCodexRestrictedToolThreadConfigPatch(inheritedMcpServerNames) {
+function buildRestrictedToolConfigPatch(inheritedMcpServerNames) {
 	const mcpServers = Object.fromEntries([...new Set(inheritedMcpServerNames)].toSorted().map((name) => [name, { enabled: false }]));
 	return {
 		...CODEX_RING_ZERO_THREAD_CONFIG,
@@ -2336,12 +2556,12 @@ async function readCodexInheritedMcpServerNames(client, cwd, signal) {
 	if (!isJsonObject(configuredServers)) throw new Error("Codex config/read returned invalid mcp_servers");
 	return Object.keys(configuredServers).toSorted();
 }
-async function assertCodexRestrictedToolSurfaceHasNoManagedHooks(client, signal) {
+async function assertCodexManagedRequirementsDoNotOverrideToolPolicy(client, options, signal) {
 	const response = await client.request("configRequirements/read", void 0, { signal });
 	if (!isJsonObject(response) || !Object.hasOwn(response, "requirements")) throw new Error("Codex configRequirements/read returned an invalid response");
 	if (response.requirements === null) return;
 	if (!isJsonObject(response.requirements)) throw new Error("Codex configRequirements/read returned invalid requirements");
-	for (const key of [
+	if (options.restrictedToolSurface) for (const key of [
 		"hooks",
 		"managedHooks",
 		"managed_hooks"
@@ -2351,6 +2571,7 @@ async function assertCodexRestrictedToolSurfaceHasNoManagedHooks(client, signal)
 		if (!isJsonObject(hooks)) throw new Error("Codex configRequirements/read returned invalid managed hooks");
 		if (hasNonEmptyJsonValue(hooks)) throw new Error("Codex restricted tool surface cannot override managed hooks");
 	}
+	const additionalDeniedFeatures = new Set(options.additionalDeniedFeatures);
 	for (const key of ["featureRequirements", "feature_requirements"]) {
 		const requirements = response.requirements[key];
 		if (requirements === void 0 || requirements === null) continue;
@@ -2358,7 +2579,8 @@ async function assertCodexRestrictedToolSurfaceHasNoManagedHooks(client, signal)
 		for (const [feature, enabled] of Object.entries(requirements)) {
 			if (typeof enabled !== "boolean") throw new Error("Codex configRequirements/read returned invalid feature requirements");
 			const canonicalFeature = CODEX_RING_ZERO_RESTRICTED_FEATURE_ALIASES.get(feature) ?? feature;
-			if (enabled && CODEX_RING_ZERO_RESTRICTED_FEATURES.has(canonicalFeature)) throw new Error(`Codex restricted tool surface cannot override required feature ${feature}`);
+			const deniedByToolPolicy = options.restrictedToolSurface && CODEX_RING_ZERO_RESTRICTED_FEATURES.has(canonicalFeature) || additionalDeniedFeatures.has(canonicalFeature);
+			if (enabled && deniedByToolPolicy) throw new Error(`Codex tool policy cannot override required feature ${feature}`);
 		}
 	}
 }
@@ -2408,6 +2630,15 @@ function resolveCodexThreadEnvironmentSelection(options) {
 }
 //#endregion
 //#region extensions/codex/src/app-server/thread-lifecycle-io.ts
+function resolveManagedThreadSourceHomeId(params) {
+	const agentId = resolveSessionAgentIds$1({
+		config: params.params.config,
+		sessionKey: params.params.sessionKey,
+		agentId: params.agentId ?? params.params.agentId
+	}).sessionAgentId;
+	const agentDir = params.agentDir ?? params.params.agentDir ?? resolveAgentDir$1(params.params.config ?? {}, agentId);
+	return codexCatalogHomeId(resolveCodexAppServerLocalHomeDir(params.appServer.start, agentDir));
+}
 function resolveCodexThreadRolloutPath(thread) {
 	const rolloutPath = thread.path?.trim();
 	if (!rolloutPath || !path.isAbsolute(rolloutPath) || path.extname(rolloutPath) !== ".jsonl" || !path.basename(rolloutPath).includes(thread.id)) return;
@@ -2429,6 +2660,7 @@ async function resumeExistingCodexThread(params, context) {
 		const resumeConfig = applyCodexNativeSkillIsolation(mergeCodexThreadConfigs(params.config, userMcpServersConfigPatch, pluginAppsConfigPatch, finalConfigPatch.configPatch), nativeSkillIsolation);
 		const resumeParams = lifecycleTiming.measureSync("thread-resume-params", () => buildThreadResumeParams(params.params, {
 			threadId: resumeBinding.threadId,
+			cwd: params.cwd,
 			authProfileId,
 			model: startModelSelection.model,
 			modelProvider: startModelProvider,
@@ -2442,7 +2674,9 @@ async function resumeExistingCodexThread(params, context) {
 			nativeCodeModeOnlyEnabled: params.nativeCodeModeOnlyEnabled,
 			webSearchAllowed: params.webSearchAllowed,
 			hostSystemAgentActive,
-			restrictedToolSurfaceInheritedMcpServerNames
+			restrictedToolSurfaceInheritedMcpServerNames,
+			shellEnvironment: params.shellEnvironment,
+			disableLoginShell: params.disableLoginShell
 		}));
 		const requestModelProvider = typeof resumeParams.modelProvider === "string" && resumeParams.modelProvider.trim() ? resumeParams.modelProvider : void 0;
 		throwIfAborted();
@@ -2579,7 +2813,9 @@ async function startFreshCodexThread(params, context) {
 		model: startModelSelection.model,
 		modelProvider: startModelProvider,
 		hostSystemAgentActive,
-		restrictedToolSurfaceInheritedMcpServerNames
+		restrictedToolSurfaceInheritedMcpServerNames,
+		shellEnvironment: params.shellEnvironment,
+		disableLoginShell: params.disableLoginShell
 	}));
 	const requestModelProvider = typeof startParams.modelProvider === "string" && startParams.modelProvider.trim() ? startParams.modelProvider : void 0;
 	const response = assertCodexThreadStartResponse(await lifecycleTiming.measure("thread-start-request", async () => {
@@ -2647,6 +2883,7 @@ async function startFreshCodexThread(params, context) {
 			cwd: params.cwd,
 			...rolloutPath ? { rolloutPath } : {},
 			authProfileId: params.params.authProfileId,
+			agentWorkspaceDeveloperInstructions: params.agentWorkspaceDeveloperInstructions,
 			model: response.model ?? startParams.model ?? params.params.modelId,
 			modelProvider: bindingModelProvider,
 			dynamicToolsFingerprint,
@@ -2679,6 +2916,12 @@ async function startFreshCodexThread(params, context) {
 				throw new CodexAppServerUnsafeSubscriptionError("Codex successor cleanup failed after a binding replacement conflict", cause === void 0 ? void 0 : { cause });
 			}
 		};
+		const managedSourceHomeId = resolveManagedThreadSourceHomeId(params);
+		await lifecycleTiming.measure("thread-start-mark-managed", () => markStartedCodexManagedThread(params.bindingStore.managedThreads, {
+			sourceHomeId: managedSourceHomeId,
+			threadId: response.thread.id,
+			...rolloutPath ? { rolloutPath } : {}
+		}));
 		let committed;
 		try {
 			committed = await lifecycleTiming.measure("thread-start-write-binding", () => params.bindingStore.mutate(bindingIdentity, replacementPredecessor ? {
@@ -2716,44 +2959,820 @@ async function startFreshCodexThread(params, context) {
 		threadId: response.thread.id,
 		action: rotatedContextEngineBinding ? "rotated" : "started"
 	});
+	return buildStartedCodexThreadBinding({
+		bindingModelProvider,
+		clientId,
+		context,
+		finalConfigPatch,
+		nextMcpServersFingerprint,
+		params,
+		pluginThreadConfig,
+		response,
+		rolloutPath,
+		startModelProvider: requestModelProvider ?? startModelProvider,
+		startParams,
+		modelProvider
+	});
+}
+//#endregion
+//#region extensions/codex/src/app-server/dynamic-tool-response-state.ts
+/** Retains the host-owned app preview without adding it to Codex's response payload. */
+function withDynamicToolTranscriptDetails(response, details) {
+	if (details === void 0) return response;
+	Object.defineProperty(response, "transcriptDetails", {
+		configurable: true,
+		enumerable: false,
+		value: details
+	});
+	return response;
+}
+function withDynamicToolTerminalResolution(response, terminalResolution) {
+	if (terminalResolution) {
+		Object.defineProperties(response, {
+			terminalResolution: {
+				configurable: true,
+				enumerable: false,
+				value: terminalResolution
+			},
+			executionStarted: {
+				configurable: true,
+				enumerable: false,
+				value: terminalResolution.executionStarted
+			},
+			...terminalResolution.executedArguments ? { executedArguments: {
+				configurable: true,
+				enumerable: false,
+				value: terminalResolution.executedArguments
+			} } : {}
+		});
+		withDynamicToolSideEffectEvidence(response, terminalResolution.sideEffectEvidence);
+	}
+	return response;
+}
+function withDynamicToolExecutionState(response, state) {
+	Object.defineProperties(response, {
+		executedArguments: {
+			configurable: true,
+			enumerable: false,
+			value: state.executedArguments
+		},
+		executionStarted: {
+			configurable: true,
+			enumerable: false,
+			value: state.executionStarted
+		}
+	});
+	return withDynamicToolSideEffectEvidence(response, state.sideEffectEvidence === true);
+}
+function withDynamicToolSideEffectEvidence(response, sideEffectEvidence) {
+	if (!sideEffectEvidence) {
+		delete response.sideEffectEvidence;
+		return response;
+	}
+	Object.defineProperty(response, "sideEffectEvidence", {
+		configurable: true,
+		enumerable: false,
+		value: true
+	});
+	return response;
+}
+function createFailedDynamicToolResponse(message, options) {
+	const response = {
+		contentItems: [{
+			type: "inputText",
+			text: message
+		}],
+		success: false
+	};
+	Object.defineProperties(response, {
+		diagnosticTerminalReason: {
+			configurable: true,
+			enumerable: false,
+			value: options?.terminalReason ?? "failed"
+		},
+		diagnosticTerminalType: {
+			configurable: true,
+			enumerable: false,
+			value: "error"
+		}
+	});
+	if (options?.executionStarted !== void 0) Object.defineProperty(response, "executionStarted", {
+		configurable: true,
+		enumerable: false,
+		value: options.executionStarted
+	});
+	if (options?.executedArguments !== void 0) Object.defineProperty(response, "executedArguments", {
+		configurable: true,
+		enumerable: false,
+		value: options.executedArguments
+	});
+	return withDynamicToolSideEffectEvidence(response, options?.sideEffectEvidence === true);
+}
+//#endregion
+//#region extensions/codex/src/app-server/tool-abort-terminal-reason.ts
+/** Leaf helper shared by native and dynamic tool diagnostics. */
+const CODEX_TIMEOUT_ABORT_REASONS = /* @__PURE__ */ new Set([
+	"codex_startup_timeout",
+	"turn_completion_idle_timeout",
+	"turn_progress_idle_timeout",
+	"turn_terminal_idle_timeout"
+]);
+/** Preserves timeout provenance when an enclosing run aborts an active tool. */
+function resolveCodexToolAbortTerminalReason(signal) {
+	try {
+		const reason = signal.reason;
+		if (typeof reason === "string") {
+			if (CODEX_TIMEOUT_ABORT_REASONS.has(reason)) return "timed_out";
+			return reason === "client_closed" ? "failed" : "cancelled";
+		}
+		if (reason && typeof reason === "object") {
+			const record = reason;
+			if (record.name === "TimeoutError" || record.reason === "timeout") return "timed_out";
+		}
+	} catch {
+		return "cancelled";
+	}
+	return "cancelled";
+}
+//#endregion
+//#region extensions/codex/src/app-server/dynamic-tool-execution.ts
+/**
+* Timeout, terminal-release, and diagnostic helpers for Codex dynamic tool
+* calls.
+*/
+/** Default timeout for Codex dynamic tool calls. */
+const CODEX_DYNAMIC_TOOL_TIMEOUT_MS = 9e4;
+/** Hard cap for per-call Codex dynamic tool timeout overrides. */
+const CODEX_DYNAMIC_TOOL_MAX_TIMEOUT_MS = 6e5;
+const CODEX_DYNAMIC_TOOL_TIMEOUT_SECONDS_GRACE_MS = 3e4;
+const CODEX_DYNAMIC_IMAGE_GENERATION_TOOL_TIMEOUT_MS = 12e4;
+const CODEX_DYNAMIC_COMPUTER_GATEWAY_TIMEOUT_MS = 3e4;
+const CODEX_DYNAMIC_COMPUTER_COMPLETION_GRACE_MS = 3e4;
+/** Timeout for image-understanding style dynamic tool calls. */
+const CODEX_DYNAMIC_IMAGE_TOOL_TIMEOUT_MS = 6e4;
+/** Timeout for message-delivery dynamic tool calls. */
+const CODEX_DYNAMIC_MESSAGE_TOOL_TIMEOUT_MS = 6e5;
+/** Outer default for collector waits: full swarm budget plus completion grace. */
+const CODEX_DYNAMIC_AGENTS_WAIT_TOOL_TIMEOUT_MS = 63e4;
+const LOG_FIELD_MAX_LENGTH = 160;
+function normalizeLogField(value) {
+	if (typeof value !== "string") return;
+	const normalized = value.replaceAll(String.fromCharCode(27), " ").replaceAll("\r", " ").replaceAll("\n", " ").replaceAll("	", " ").trim();
+	if (!normalized) return;
+	return normalized.length > LOG_FIELD_MAX_LENGTH ? `${truncateUtf16Safe(normalized, LOG_FIELD_MAX_LENGTH - 3)}...` : normalized;
+}
+function readNumericTimeoutMs(value) {
+	if (typeof value === "number" && Number.isFinite(value)) return Math.max(0, Math.floor(value));
+	if (typeof value === "string") {
+		const parsed = parseStrictNonNegativeInteger(value);
+		if (parsed !== void 0) return Math.max(0, Math.floor(parsed));
+	}
+}
+function formatDynamicToolTimeoutDetails(params) {
+	const tool = normalizeLogField(params.call.tool) ?? "unknown";
+	const baseMeta = {
+		tool: params.call.tool,
+		toolCallId: params.call.callId,
+		threadId: params.call.threadId,
+		turnId: params.call.turnId,
+		timeoutMs: params.timeoutMs,
+		timeoutKind: "codex_dynamic_tool_rpc"
+	};
+	if (tool !== "process" || !isJsonObject(params.call.arguments)) return {
+		responseMessage: `OpenClaw dynamic tool call timed out after ${params.timeoutMs}ms while running tool ${tool}.`,
+		consoleMessage: `codex dynamic tool timeout: tool=${tool} toolTimeoutMs=${params.timeoutMs}; per-tool-call watchdog, not session idle`,
+		meta: baseMeta
+	};
+	const action = normalizeLogField(params.call.arguments.action);
+	const sessionId = normalizeLogField(params.call.arguments.sessionId);
+	const requestedTimeoutMs = readNumericTimeoutMs(params.call.arguments.timeout);
+	const actionPart = action ? ` action=${action}` : "";
+	const sessionPart = sessionId ? ` sessionId=${sessionId}` : "";
+	const requestedPart = requestedTimeoutMs === void 0 ? "" : ` requestedWaitMs=${requestedTimeoutMs}`;
+	const retryHint = action === "poll" ? "; repeated lines usually mean process-poll retry churn, not model progress" : "";
+	const responseTarget = action || sessionId ? ` while waiting for process${actionPart}${sessionPart}` : " while waiting for the process tool";
 	return {
-		threadId: response.thread.id,
-		...clientId ? { clientId } : {},
-		cwd: params.cwd,
-		...rolloutPath ? { rolloutPath } : {},
-		authProfileId: params.params.authProfileId,
-		model: response.model ?? startParams.model ?? params.params.modelId,
-		modelProvider: response.modelProvider ?? requestModelProvider ?? startModelProvider ?? modelProvider,
-		dynamicToolsFingerprint,
-		dynamicToolsContainDeferred,
-		nativeSkillIsolationFingerprint,
-		userMcpServersFingerprint,
-		mcpServersFingerprint: nextMcpServersFingerprint,
-		configuredMcpOwnershipVersion: params.configuredMcpOwnershipVersion,
-		ringZeroConfigFingerprint,
-		ringZeroClientInstanceId,
-		networkProxyProfileName: params.appServer.networkProxy?.profileName,
-		networkProxyConfigFingerprint,
-		nativeHookRelayGeneration: finalConfigPatch.nativeHookRelayGeneration,
-		appServerRuntimeFingerprint: params.appServerRuntimeFingerprint,
-		pluginAppsFingerprint: pluginThreadConfig?.fingerprint,
-		pluginAppsInputFingerprint: pluginThreadConfig?.inputFingerprint,
-		pluginAppPolicyContext: pluginThreadConfig?.policyContext,
-		contextEngine: contextEngineBinding,
-		environmentSelectionFingerprint,
-		...!preserveExistingBinding ? { liveThreadConfigFingerprint: fingerprintCodexThreadConfig({
-			...startParams,
-			model: response.model ?? startParams.model ?? null,
-			requestedModel: startParams.model ?? null,
-			modelProvider: bindingModelProvider ?? null,
-			requestedModelProvider: startParams.modelProvider ?? bindingModelProvider ?? null
-		}, params.params.authProfileId, dynamicToolsFingerprint) } : {},
-		lifecycle: {
-			action: "started",
-			...rotatedContextEngineBinding ? { rotatedContextEngineBinding } : {}
+		responseMessage: `OpenClaw dynamic tool call timed out after ${params.timeoutMs}ms${responseTarget}. This is a tool RPC timeout, not a session idle timeout.`,
+		consoleMessage: `codex process tool timeout:${actionPart}${sessionPart} toolTimeoutMs=${params.timeoutMs}${requestedPart}; per-tool-call watchdog, not session idle${retryHint}`,
+		meta: {
+			...baseMeta,
+			processAction: action,
+			processSessionId: sessionId,
+			processRequestedTimeoutMs: requestedTimeoutMs
 		}
 	};
 }
+/**
+* Runs a dynamic tool call with run-abort and per-call timeout handling,
+* returning a Codex protocol response instead of throwing.
+*/
+async function handleDynamicToolCallWithTimeout(params) {
+	let didNotifyAgentToolResult = false;
+	const conservativeRaceResponses = /* @__PURE__ */ new WeakSet();
+	const finalizeTerminal = (response) => {
+		const executionSnapshot = params.toolBridge.consumeToolExecutionSnapshot?.(params.call.callId);
+		const ownerKey = params.toolBridge.sideEffectOwnerKeyForTool?.(params.call.tool);
+		const observedExecutionStarted = executionSnapshot?.executionStarted ?? (conservativeRaceResponses.has(response) ? void 0 : response.executionStarted);
+		const terminalResolution = params.observeToolTerminal?.({
+			toolCallId: params.call.callId,
+			toolName: params.call.tool,
+			arguments: response.executedArguments ?? executionSnapshot?.executedArguments ?? params.call.arguments,
+			...params.toolMeta ? { meta: params.toolMeta } : {},
+			...ownerKey ? { ownerMutation: { ownerKey } } : {},
+			...observedExecutionStarted !== void 0 ? { executionStarted: observedExecutionStarted } : {},
+			outcome: response.success ? "success" : "failure",
+			...!response.success ? { failure: { error: readDynamicToolResponseText(response) } } : {}
+		});
+		return withDynamicToolTerminalResolution(response, terminalResolution);
+	};
+	const createFailedAfterPossibleDispatch = (message, terminalReason) => {
+		const response = createFailedDynamicToolResponse(message, {
+			executionStarted: true,
+			sideEffectEvidence: true,
+			terminalReason
+		});
+		conservativeRaceResponses.add(response);
+		return response;
+	};
+	const notifyAgentToolResult = (event) => {
+		if (didNotifyAgentToolResult) return;
+		didNotifyAgentToolResult = true;
+		try {
+			params.onAgentToolResult?.(event);
+		} catch (error) {
+			embeddedAgentLog.warn(`onAgentToolResult handler failed: tool=${params.call.tool} error=${String(error)}`);
+		}
+	};
+	const notifyFailedToolResult = (message, terminalReason = "failed") => {
+		notifyAgentToolResult({
+			toolName: params.call.tool,
+			result: {
+				content: [{
+					type: "text",
+					text: message
+				}],
+				details: {
+					status: terminalReason,
+					error: message
+				}
+			},
+			isError: true
+		});
+	};
+	if (params.signal.aborted) {
+		const message = "OpenClaw dynamic tool call aborted before execution.";
+		const terminalReason = resolveCodexToolAbortTerminalReason(params.signal);
+		params.onFallbackSelected?.();
+		notifyFailedToolResult(message, terminalReason);
+		return finalizeTerminal(createFailedDynamicToolResponse(message, {
+			executionStarted: false,
+			terminalReason
+		}));
+	}
+	const controller = new AbortController();
+	let timeout;
+	let timedOut = false;
+	let resolveAbort;
+	const abortFromRun = () => {
+		const message = "OpenClaw dynamic tool call aborted.";
+		const terminalReason = resolveCodexToolAbortTerminalReason(params.signal);
+		params.onFallbackSelected?.();
+		controller.abort(params.signal.reason ?? /* @__PURE__ */ new Error(message));
+		notifyFailedToolResult(message, terminalReason);
+		resolveAbort?.(createFailedAfterPossibleDispatch(message, terminalReason));
+	};
+	const abortPromise = new Promise((resolve) => {
+		resolveAbort = resolve;
+	});
+	const timeoutPromise = new Promise((resolve) => {
+		const timeoutMs = clampDynamicToolTimeoutMs(params.timeoutMs);
+		timeout = setTimeout(() => {
+			timedOut = true;
+			const timeoutDetails = formatDynamicToolTimeoutDetails({
+				call: params.call,
+				timeoutMs
+			});
+			params.onFallbackSelected?.();
+			controller.abort(new Error(timeoutDetails.responseMessage));
+			params.onTimeout?.();
+			embeddedAgentLog.warn("codex dynamic tool call timed out", {
+				...timeoutDetails.meta,
+				consoleMessage: timeoutDetails.consoleMessage
+			});
+			notifyFailedToolResult(timeoutDetails.responseMessage, "timed_out");
+			resolve(createFailedAfterPossibleDispatch(timeoutDetails.responseMessage, "timed_out"));
+		}, timeoutMs);
+		timeout.unref?.();
+	});
+	try {
+		params.signal.addEventListener("abort", abortFromRun, { once: true });
+		if (params.signal.aborted) abortFromRun();
+		const response = await Promise.race([
+			params.toolBridge.handleToolCall(params.call, {
+				signal: controller.signal,
+				onAgentToolResult: notifyAgentToolResult,
+				toolCallOrdinal: params.toolCallOrdinal,
+				retainExecutionSnapshot: true
+			}),
+			abortPromise,
+			timeoutPromise
+		]);
+		if (!response.success && !didNotifyAgentToolResult) notifyFailedToolResult(readDynamicToolResponseText(response), response.diagnosticTerminalReason ?? "failed");
+		return finalizeTerminal(response);
+	} catch (error) {
+		const terminalReason = params.signal.aborted ? resolveCodexToolAbortTerminalReason(params.signal) : resolveToolExecutionErrorKind(error);
+		const message = formatToolExecutionErrorMessage(error, "OpenClaw dynamic tool call failed.");
+		notifyFailedToolResult(message, terminalReason);
+		return finalizeTerminal(createFailedAfterPossibleDispatch(message, terminalReason));
+	} finally {
+		if (timeout) clearTimeout(timeout);
+		params.signal.removeEventListener("abort", abortFromRun);
+		resolveAbort = void 0;
+		if (!timedOut && !controller.signal.aborted) controller.abort(/* @__PURE__ */ new Error("OpenClaw dynamic tool call finished."));
+	}
+}
+function readDynamicToolResponseText(response) {
+	return response.contentItems.flatMap((item) => item.type === "inputText" && typeof item.text === "string" ? [item.text] : []).join("\n").trim() || "OpenClaw dynamic tool call failed.";
+}
+/** Strips OpenClaw-only metadata before sending a dynamic tool response to Codex. */
+function toCodexDynamicToolProtocolResponse(response) {
+	return {
+		contentItems: response.contentItems,
+		success: response.success
+	};
+}
+/** Adds async-started progress details when a tool result continues out of band. */
+function toCodexDynamicToolProgressResponse(response, protocolResponse) {
+	const transcriptDetails = isJsonObject(response.transcriptDetails) ? response.transcriptDetails : void 0;
+	const mcpAppPreview = isJsonObject(transcriptDetails?.mcpAppPreview) ? transcriptDetails.mcpAppPreview : void 0;
+	const progressDetails = mcpAppPreview ? { mcpAppPreview } : void 0;
+	if (response.asyncStarted !== true && progressDetails === void 0) return protocolResponse;
+	return {
+		...protocolResponse,
+		...progressDetails ? { details: progressDetails } : {},
+		...response.asyncStarted === true ? { details: {
+			...progressDetails,
+			async: true,
+			status: "started"
+		} } : {}
+	};
+}
+/** Decides whether a terminal dynamic tool response can release the Codex turn. */
+function shouldReleaseTurnAfterTerminalDynamicTool(state) {
+	return !state.completed && !state.aborted && state.responseSuccess && !state.currentTurnHadNonTerminalDynamicToolResult && state.activeAppServerTurnRequests === 0 && state.activeTurnItemIdsCount === 0 && state.pendingOpenClawDynamicToolCompletionIdsCount === 0;
+}
+/** Returns true when a non-async result should block terminal-release shortcuts. */
+function shouldBlockTerminalReleaseForNonTerminalDynamicToolResult(response) {
+	return response.asyncStarted !== true;
+}
+/** Resolves whether terminal diagnostic state should release, wait, or stay idle. */
+function resolveTerminalDynamicToolBatchAction(state) {
+	if (state.activeAppServerTurnRequests > 0 || state.activeTurnItemIdsCount > 0 || state.pendingOpenClawDynamicToolCompletionIdsCount > 0) return "wait";
+	if (state.currentTurnHadNonTerminalDynamicToolResult) return "clear-nonterminal-batch";
+	if (state.hasPendingTerminalDynamicToolRelease) return "release-pending-terminal";
+	return "idle";
+}
+/** Returns true for diagnostic events that terminate a dynamic tool call. */
+function isDynamicToolTerminalDiagnosticEvent(event) {
+	return event.type === "tool.execution.completed" || event.type === "tool.execution.error" || event.type === "tool.execution.blocked";
+}
+/** Matches terminal diagnostics to a specific dynamic tool call id/name. */
+function isMatchingDynamicToolTerminalDiagnostic(params) {
+	if (params.event.toolCallId !== params.call.callId || params.event.toolName !== params.call.tool) return false;
+	if (params.runId !== void 0) return params.event.runId === params.runId;
+	if (params.sessionId !== void 0) return params.event.sessionId === params.sessionId;
+	if (params.sessionKey !== void 0) return params.event.sessionKey === params.sessionKey;
+	return params.event.runId === void 0 && params.event.sessionId === void 0 && params.event.sessionKey === void 0;
+}
+/** Checks pending diagnostics for a terminal event matching a tool call. */
+function hasPendingDynamicToolTerminalDiagnostic(params) {
+	return hasPendingInternalDiagnosticEvent((event) => {
+		if (!isDynamicToolTerminalDiagnosticEvent(event)) return false;
+		return isMatchingDynamicToolTerminalDiagnostic({
+			event,
+			call: params.call,
+			runId: params.runId,
+			sessionId: params.sessionId,
+			sessionKey: params.sessionKey
+		});
+	});
+}
+/** Resolves per-tool timeout, applying media/message defaults and hard caps. */
+function resolveDynamicToolCallTimeoutMs(params) {
+	if (params.call.tool === "computer") return clampDynamicToolTimeoutMs(readComputerToolTimeoutMs(params.call.arguments));
+	if (params.call.tool === "message") return CODEX_DYNAMIC_MESSAGE_TOOL_TIMEOUT_MS;
+	if (params.call.tool === "agents_wait") {
+		const requestedMs = readDynamicToolCallTimeoutMs(params.call.arguments) ?? readConfiguredDynamicToolTimeoutMs(params.call.tool, params.config) ?? CODEX_DYNAMIC_AGENTS_WAIT_TOOL_TIMEOUT_MS;
+		return Math.max(1, Math.min(63e4, Math.floor(requestedMs)));
+	}
+	return clampDynamicToolTimeoutMs(readDynamicToolCallTimeoutMs(params.call.arguments) ?? readConfiguredDynamicToolTimeoutMs(params.call.tool, params.config) ?? CODEX_DYNAMIC_TOOL_TIMEOUT_MS);
+}
+function readComputerToolTimeoutMs(value) {
+	const args = isJsonObject(value) ? value : void 0;
+	const action = typeof args?.action === "string" ? args.action : void 0;
+	const gatewayTimeoutMs = readPositiveFiniteTimeoutMs(args?.timeoutMs) ?? CODEX_DYNAMIC_COMPUTER_GATEWAY_TIMEOUT_MS;
+	const gatewayCallCount = action === "screenshot" || action === "wait" ? 3 : 4;
+	return (action === "wait" || action === "hold_key" ? Math.max(0, Number(args?.duration) || 0) * 1e3 : 0) + gatewayCallCount * gatewayTimeoutMs + CODEX_DYNAMIC_COMPUTER_COMPLETION_GRACE_MS;
+}
+function readDynamicToolCallTimeoutMs(value) {
+	if (!isJsonObject(value)) return;
+	const timeoutMs = readPositiveFiniteTimeoutMs(value.timeoutMs);
+	if (timeoutMs !== void 0) return timeoutMs;
+	const timeoutSecondsMs = readDynamicToolTimeoutSecondsAsMs(value.timeoutSeconds);
+	return timeoutSecondsMs === void 0 ? void 0 : addTimerTimeoutGraceMs(timeoutSecondsMs, CODEX_DYNAMIC_TOOL_TIMEOUT_SECONDS_GRACE_MS);
+}
+function readConfiguredDynamicToolTimeoutMs(toolName, config) {
+	if (toolName === "image_generate") {
+		const imageModel = config?.agents?.defaults?.mediaModels?.image;
+		if (!imageModel || typeof imageModel !== "object") return CODEX_DYNAMIC_IMAGE_GENERATION_TOOL_TIMEOUT_MS;
+		return readPositiveFiniteTimeoutMs(imageModel.timeoutMs) ?? CODEX_DYNAMIC_IMAGE_GENERATION_TOOL_TIMEOUT_MS;
+	}
+	if (toolName === "view_image") {
+		const candidates = (config?.tools?.media?.models ?? []).filter((entry) => !entry.capabilities || entry.capabilities.includes("image"));
+		const capabilityTimeoutMs = readTimeoutSecondsAsMs(config?.tools?.media?.image?.timeoutSeconds);
+		return Math.max(capabilityTimeoutMs ?? CODEX_DYNAMIC_IMAGE_TOOL_TIMEOUT_MS, ...candidates.map((entry) => readTimeoutSecondsAsMs(entry.timeoutSeconds) ?? capabilityTimeoutMs ?? CODEX_DYNAMIC_IMAGE_TOOL_TIMEOUT_MS));
+	}
+	if (toolName === "message") return CODEX_DYNAMIC_MESSAGE_TOOL_TIMEOUT_MS;
+}
+function readTimeoutSecondsAsMs(value) {
+	const seconds = readPositiveFiniteTimeoutMs(value);
+	return seconds === void 0 ? void 0 : seconds * 1e3;
+}
+function readDynamicToolTimeoutSecondsAsMs(value) {
+	if (typeof value !== "number" || !Number.isFinite(value) || !Number.isInteger(value) || value <= 0) return;
+	return value * 1e3;
+}
+function readPositiveFiniteTimeoutMs(value) {
+	return typeof value === "number" && Number.isFinite(value) && value > 0 ? Math.floor(value) : void 0;
+}
+function clampDynamicToolTimeoutMs(timeoutMs) {
+	return Math.max(1, Math.min(CODEX_DYNAMIC_TOOL_MAX_TIMEOUT_MS, Math.floor(timeoutMs)));
+}
+//#endregion
+//#region extensions/codex/src/app-server/native-hook-relay-state.ts
+const pending = /* @__PURE__ */ new Set();
+/** Owns delayed hook-relay cleanup across runtime scheduling and test teardown. */
+const nativeHookRelayUnregisterQueue = {
+	add(entry) {
+		pending.add(entry);
+	},
+	delete(entry) {
+		return pending.delete(entry);
+	},
+	flush() {
+		while (pending.size > 0) {
+			const entry = pending.values().next().value;
+			if (!entry) return;
+			clearTimeout(entry.timeout);
+			entry.unregister();
+		}
+	},
+	clear() {
+		for (const entry of pending) clearTimeout(entry.timeout);
+		pending.clear();
+	}
+};
+//#endregion
+//#region extensions/codex/src/app-server/native-hook-relay.ts
+/**
+* Bridges Codex native hook callbacks into OpenClaw's native hook relay so
+* app-server tool events can still run OpenClaw policy and diagnostics.
+*/
+/** Codex hook events that can be registered through OpenClaw's native relay. */
+const CODEX_NATIVE_HOOK_RELAY_EVENTS = [
+	"pre_tool_use",
+	"post_tool_use",
+	"permission_request",
+	"before_agent_finalize"
+];
+const CODEX_NATIVE_HOOK_RELAY_EVENTS_WITH_APP_SERVER_APPROVALS = CODEX_NATIVE_HOOK_RELAY_EVENTS.filter((event) => event !== "permission_request");
+const CODEX_NATIVE_HOOK_RELAY_MIN_TTL_MS = 30 * 6e4;
+/** Extra relay lifetime after the expected turn budget, preventing late hook drops. */
+const CODEX_NATIVE_HOOK_RELAY_TTL_GRACE_MS = 5 * 6e4;
+const CODEX_NATIVE_HOOK_RELAY_COMMAND_MIN_PARENT_MARGIN_MS = 250;
+const CODEX_NATIVE_HOOK_RELAY_COMMAND_MAX_PARENT_MARGIN_MS = 1e3;
+const CODEX_NATIVE_HOOK_RELAY_DEFAULT_TIMEOUT_SEC = 10;
+const CODEX_NATIVE_HOOK_RELAY_UNREGISTER_GRACE_MS = 1e4;
+const CODEX_NATIVE_HOOK_RELAY_UNREGISTER_EXTRA_GRACE_MS = 5e3;
+const MAX_PENDING_DIRECT_CHILD_ADMISSIONS = 32;
+const nativeHookPolicyByClient = /* @__PURE__ */ new WeakMap();
+const CODEX_HOOK_MATCHER_NAMES_BY_TOOL_ID = {
+	exec: [
+		"Bash",
+		"exec",
+		"exec_command"
+	],
+	apply_patch: [
+		"apply_patch",
+		"Write",
+		"Edit"
+	],
+	spawn_agent: ["spawn_agent", "Agent"]
+};
+/** Enterprise managed-only policy silently drops the session-layer hooks that enforce OpenClaw. */
+async function assertCodexNativeHookRelayAllowed(client, signal) {
+	let attestation = nativeHookPolicyByClient.get(client);
+	if (!attestation) {
+		attestation = client.request("configRequirements/read", void 0, { signal }).then((response) => {
+			if (!isJsonObject(response) || !Object.hasOwn(response, "requirements")) throw new Error("Codex configRequirements/read returned an invalid hook policy response");
+			const requirements = response.requirements;
+			if (requirements === null) return;
+			if (!isJsonObject(requirements)) throw new Error("Codex configRequirements/read returned invalid hook policy requirements");
+			const managedOnly = requirements.allowManagedHooksOnly;
+			if (managedOnly !== void 0 && managedOnly !== null && typeof managedOnly !== "boolean") throw new Error("Codex configRequirements/read returned invalid managed-only hook policy");
+			if (managedOnly === true) throw new Error("Codex managed-only hooks disable the OpenClaw native hook relay; refusing unenforced execution");
+		});
+		nativeHookPolicyByClient.set(client, attestation);
+		attestation.catch(() => {
+			if (nativeHookPolicyByClient.get(client) === attestation) nativeHookPolicyByClient.delete(client);
+		});
+	}
+	await attestation;
+}
+/** Defers relay unregister so late native hook subprocesses can still resolve. */
+function scheduleCodexNativeHookRelayUnregister(params) {
+	let pending;
+	const unregister = () => {
+		if (!pending) return;
+		const current = pending;
+		pending = void 0;
+		if (!nativeHookRelayUnregisterQueue.delete(current)) return;
+		params.relay.unregister();
+	};
+	const timeout = setTimeout(unregister, resolveCodexNativeHookRelayUnregisterGraceMs(params.hookTimeoutSec));
+	pending = {
+		timeout,
+		unregister
+	};
+	nativeHookRelayUnregisterQueue.add(pending);
+	timeout.unref();
+}
+/** Computes the delayed unregister window from Codex's hook timeout. */
+function resolveCodexNativeHookRelayUnregisterGraceMs(hookTimeoutSec) {
+	const hookTimeoutMs = finiteSecondsToTimerSafeMilliseconds(normalizeHookTimeoutSec(hookTimeoutSec)) ?? 0;
+	return Math.max(CODEX_NATIVE_HOOK_RELAY_UNREGISTER_GRACE_MS, addTimerTimeoutGraceMs(hookTimeoutMs, CODEX_NATIVE_HOOK_RELAY_UNREGISTER_EXTRA_GRACE_MS) ?? 0);
+}
+/** Records a native pre-tool failure that Codex does not project as a tool item. */
+function emitCodexNativePreToolUseFailureDiagnostic(params) {
+	emitTrustedDiagnosticEvent({
+		type: "tool.execution.error",
+		...params.agentId ? { agentId: params.agentId } : {},
+		sessionId: params.sessionId,
+		...params.sessionKey ? { sessionKey: params.sessionKey } : {},
+		runId: params.runId,
+		toolName: params.failure.toolName,
+		toolCallId: params.failure.toolCallId,
+		durationMs: params.failure.durationMs,
+		errorCategory: "before_tool_call",
+		terminalReason: params.terminalReason ?? (params.signal?.aborted ? resolveCodexToolAbortTerminalReason(params.signal) : params.failure.disposition),
+		...params.sourceTimestampMs !== void 0 ? { sourceTimestampMs: params.sourceTimestampMs } : {}
+	});
+}
+/** Registers an OpenClaw native hook relay for a Codex app-server turn. */
+function createCodexNativeHookRelay(params) {
+	if (params.options?.enabled === false) return;
+	const directChildClaims = /* @__PURE__ */ new Map();
+	const pendingDirectChildAdmissions = /* @__PURE__ */ new Map();
+	let foregroundClosed = false;
+	let successfulYieldRetentionAuthorized = false;
+	const assertClaim = (threadId, claim) => () => directChildClaims.get(threadId) === claim;
+	const rejectPendingAdmissions = (reason) => {
+		for (const pending of pendingDirectChildAdmissions.values()) pending.reject(new Error(reason));
+		pendingDirectChildAdmissions.clear();
+	};
+	const relay = registerRetainedNativeHookRelayForBundledRuntime({
+		provider: "codex",
+		relayId: buildCodexNativeHookRelayId({
+			agentId: params.agentId,
+			sessionId: params.sessionId,
+			sessionKey: params.sessionKey
+		}),
+		...params.generation ? { generation: params.generation } : {},
+		...params.generationMismatchGraceMs ? { generationMismatchGraceMs: params.generationMismatchGraceMs } : {},
+		...params.agentId ? { agentId: params.agentId } : {},
+		sessionId: params.sessionId,
+		...params.sessionKey ? { sessionKey: params.sessionKey } : {},
+		...params.config ? { config: params.config } : {},
+		runId: params.runId,
+		...params.channelId ? { channelId: params.channelId } : {},
+		...params.requester ? { requester: params.requester } : {},
+		...params.approvalContext ? { approvalContext: params.approvalContext } : {},
+		allowedEvents: params.events,
+		preToolUseLoopDetection: params.loopDetectionPreToolUseRelay,
+		ttlMs: resolveCodexNativeHookRelayTtlMs({
+			explicitTtlMs: params.options?.ttlMs,
+			attemptTimeoutMs: params.attemptTimeoutMs,
+			startupTimeoutMs: params.startupTimeoutMs,
+			turnStartTimeoutMs: params.turnStartTimeoutMs
+		}),
+		signal: params.signal,
+		runBeforeToolCall: params.hostCapabilities.runBeforeToolCall,
+		assertActive: params.hostCapabilities.assertActive,
+		retention: {
+			readClaim: readCodexNativeChildThreadId,
+			shouldRetainAfterForegroundClose: () => successfulYieldRetentionAuthorized && directChildClaims.size > 0,
+			allowPreToolUse: (childThreadId) => directChildClaims.has(childThreadId),
+			awaitForegroundAdmission: (childThreadId) => {
+				if (foregroundClosed) return Promise.reject(/* @__PURE__ */ new Error("native hook relay foreground admission unavailable"));
+				const existingClaim = directChildClaims.get(childThreadId);
+				if (existingClaim) return Promise.resolve(assertClaim(childThreadId, existingClaim));
+				const existingPending = pendingDirectChildAdmissions.get(childThreadId);
+				if (existingPending) return existingPending.promise.then((claim) => assertClaim(childThreadId, claim));
+				if (pendingDirectChildAdmissions.size >= MAX_PENDING_DIRECT_CHILD_ADMISSIONS) return Promise.reject(/* @__PURE__ */ new Error("native hook relay foreground admission capacity reached"));
+				const { promise, resolve, reject } = createDeferred();
+				pendingDirectChildAdmissions.set(childThreadId, {
+					promise,
+					resolve,
+					reject
+				});
+				return promise.then((claim) => assertClaim(childThreadId, claim));
+			},
+			onDispose: () => {
+				foregroundClosed = true;
+				rejectPendingAdmissions("native hook relay registration closed");
+			}
+		},
+		onPreToolUseFailure: params.onPreToolUseFailure,
+		command: {
+			nice: 10,
+			timeoutMs: params.options?.gatewayTimeoutMs
+		}
+	});
+	const unregister = () => {
+		foregroundClosed = true;
+		rejectPendingAdmissions("native hook relay foreground closed");
+		relay.unregister();
+	};
+	return {
+		...relay,
+		unregister,
+		authorizeRetentionAfterSuccessfulYield: () => {
+			successfulYieldRetentionAuthorized = true;
+		},
+		hasClaimedDirectChild: () => directChildClaims.size > 0,
+		rejectPendingDirectChild: (threadIdInput, reason) => {
+			const threadId = threadIdInput.trim();
+			const pending = threadId ? pendingDirectChildAdmissions.get(threadId) : void 0;
+			if (!pending) return;
+			pendingDirectChildAdmissions.delete(threadId);
+			pending.reject(new Error(reason));
+		},
+		claimDirectChild: (threadIdInput) => {
+			const threadId = threadIdInput.trim();
+			if (!threadId) return () => void 0;
+			if (directChildClaims.get(threadId)) return () => void 0;
+			const claim = Symbol(threadId);
+			directChildClaims.set(threadId, claim);
+			const pending = pendingDirectChildAdmissions.get(threadId);
+			pendingDirectChildAdmissions.delete(threadId);
+			pending?.resolve(claim);
+			let released = false;
+			return () => {
+				if (released) return;
+				released = true;
+				if (directChildClaims.get(threadId) !== claim) return;
+				directChildClaims.delete(threadId);
+				if (foregroundClosed && directChildClaims.size === 0) relay.unregister();
+			};
+		}
+	};
+}
+function readCodexNativeChildThreadId(rawPayload) {
+	if (!isJsonObject(rawPayload) || typeof rawPayload.agent_id !== "string") return;
+	return rawPayload.agent_id.trim() || void 0;
+}
+/** Selects the native hook events Codex should install for the current approval mode. */
+function resolveCodexNativeHookRelayEvents(params) {
+	if (params.configuredEvents?.length) return params.configuredEvents;
+	return params.appServer.approvalPolicy === "never" ? CODEX_NATIVE_HOOK_RELAY_EVENTS : CODEX_NATIVE_HOOK_RELAY_EVENTS_WITH_APP_SERVER_APPROVALS;
+}
+/** Derives the native hook relay TTL from the turn budget unless explicitly configured. */
+function resolveCodexNativeHookRelayTtlMs(params) {
+	if (params.explicitTtlMs !== void 0) return params.explicitTtlMs;
+	const relayBudgetMs = params.attemptTimeoutMs + params.startupTimeoutMs + params.turnStartTimeoutMs + CODEX_NATIVE_HOOK_RELAY_TTL_GRACE_MS;
+	return Math.max(CODEX_NATIVE_HOOK_RELAY_MIN_TTL_MS, Math.floor(relayBudgetMs));
+}
+/** Builds a stable relay id scoped to the agent and session identity. */
+function buildCodexNativeHookRelayId(params) {
+	const hash = createHash("sha256");
+	hash.update("openclaw:codex:native-hook-relay:v1");
+	hash.update("\0");
+	hash.update(params.agentId?.trim() || "");
+	hash.update("\0");
+	hash.update(params.sessionKey?.trim() || params.sessionId);
+	return `codex-${hash.digest("hex").slice(0, 40)}`;
+}
+const CODEX_HOOK_EVENT_BY_NATIVE_EVENT = {
+	pre_tool_use: "PreToolUse",
+	post_tool_use: "PostToolUse",
+	permission_request: "PermissionRequest",
+	before_agent_finalize: "Stop"
+};
+const CODEX_HOOK_KEY_LABEL_BY_NATIVE_EVENT = {
+	pre_tool_use: "pre_tool_use",
+	post_tool_use: "post_tool_use",
+	permission_request: "permission_request",
+	before_agent_finalize: "stop"
+};
+const CODEX_SESSION_FLAGS_HOOK_SOURCE_PATHS = ["/<session-flags>/config.toml", "<session-flags>/config.toml"];
+/** Builds the Codex config overlay that installs trusted command hooks for relay events. */
+function buildCodexNativeHookRelayConfig(params) {
+	const events = params.events?.length ? params.events : CODEX_NATIVE_HOOK_RELAY_EVENTS;
+	const selectedEvents = new Set(events);
+	const config = { "features.hooks": true };
+	const hookState = {};
+	for (const event of CODEX_NATIVE_HOOK_RELAY_EVENTS) {
+		const codexEvent = CODEX_HOOK_EVENT_BY_NATIVE_EVENT[event];
+		const selected = selectedEvents.has(event);
+		const shouldRelay = params.relay.shouldRelayEvent(event);
+		if (!selected || !shouldRelay) {
+			if (selected || params.clearOmittedEvents) config[`hooks.${codexEvent}`] = [];
+			if (params.clearOmittedEvents) for (const sourcePath of CODEX_SESSION_FLAGS_HOOK_SOURCE_PATHS) hookState[`${sourcePath}:${CODEX_HOOK_KEY_LABEL_BY_NATIVE_EVENT[event]}:0:0`] = { enabled: false };
+			continue;
+		}
+		const timeout = normalizeHookTimeoutSec(params.hookTimeoutSec);
+		const command = params.relay.commandForEvent(event, { timeoutMs: resolveCodexNativeHookRelayCommandTimeoutMs(timeout) });
+		const matcher = buildCodexNativeToolMatcher(params.relay.toolMatcherForEvent(event));
+		config[`hooks.${codexEvent}`] = [{
+			...matcher ? { matcher } : {},
+			hooks: [{
+				type: "command",
+				command,
+				timeout,
+				async: false,
+				statusMessage: "OpenClaw native hook relay"
+			}]
+		}];
+		const state = {
+			enabled: true,
+			trusted_hash: codexCommandHookTrustedHash({
+				event,
+				command,
+				matcher,
+				timeout,
+				statusMessage: "OpenClaw native hook relay"
+			})
+		};
+		for (const sourcePath of CODEX_SESSION_FLAGS_HOOK_SOURCE_PATHS) hookState[`${sourcePath}:${CODEX_HOOK_KEY_LABEL_BY_NATIVE_EVENT[event]}:0:0`] = state;
+	}
+	config["hooks.state"] = hookState;
+	return config;
+}
+/** Builds a Codex config overlay that disables native hooks and clears hook arrays. */
+function buildCodexNativeHookRelayDisabledConfig() {
+	return {
+		"features.hooks": false,
+		"hooks.PreToolUse": [],
+		"hooks.PostToolUse": [],
+		"hooks.PermissionRequest": [],
+		"hooks.Stop": []
+	};
+}
+function normalizeHookTimeoutSec(value) {
+	return typeof value === "number" && Number.isFinite(value) && value > 0 ? Math.ceil(value) : CODEX_NATIVE_HOOK_RELAY_DEFAULT_TIMEOUT_SEC;
+}
+function resolveCodexNativeHookRelayCommandTimeoutMs(hookTimeoutSec) {
+	const parentTimeoutMs = finiteSecondsToTimerSafeMilliseconds(normalizeHookTimeoutSec(hookTimeoutSec)) ?? 5e3;
+	const parentMarginMs = Math.min(CODEX_NATIVE_HOOK_RELAY_COMMAND_MAX_PARENT_MARGIN_MS, Math.max(CODEX_NATIVE_HOOK_RELAY_COMMAND_MIN_PARENT_MARGIN_MS, Math.floor(parentTimeoutMs / 5)));
+	return Math.max(1, parentTimeoutMs - parentMarginMs);
+}
+function buildCodexNativeToolMatcher(toolNames) {
+	if (toolNames === void 0) return;
+	if (toolNames.length === 0) throw new TypeError("Codex native hook matcher requires at least one tool name");
+	const nativeNames = /* @__PURE__ */ new Set();
+	let hasCustomToolName = false;
+	for (const toolName of toolNames) {
+		const canonicalToolName = toolName.trim();
+		if (!canonicalToolName || canonicalToolName === "*") throw new TypeError("Codex native hook matcher requires canonical OpenClaw tool ids");
+		const nativeAliases = CODEX_HOOK_MATCHER_NAMES_BY_TOOL_ID[canonicalToolName];
+		if (!nativeAliases) hasCustomToolName = true;
+		for (const nativeName of nativeAliases ?? [canonicalToolName]) nativeNames.add(nativeName);
+	}
+	const sortedNames = Array.from(nativeNames).toSorted();
+	if (!hasCustomToolName && sortedNames.every((toolName) => /^[A-Za-z0-9_]+$/.test(toolName))) return sortedNames.join("|");
+	return `(?i)^(?:${sortedNames.map((toolName) => toolName.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|")})$`;
+}
+function codexCommandHookTrustedHash(params) {
+	const identity = {
+		event_name: CODEX_HOOK_KEY_LABEL_BY_NATIVE_EVENT[params.event],
+		...params.matcher ? { matcher: params.matcher } : {},
+		hooks: [{
+			async: false,
+			command: params.command,
+			statusMessage: params.statusMessage,
+			timeout: params.timeout,
+			type: "command"
+		}]
+	};
+	return `sha256:${createHash("sha256").update(JSON.stringify(sortJsonValue(identity))).digest("hex")}`;
+}
+function sortJsonValue(value) {
+	if (!value || typeof value !== "object") return value;
+	if (Array.isArray(value)) return value.map(sortJsonValue);
+	const sorted = {};
+	for (const [key, entry] of Object.entries(value).toSorted(([left], [right]) => left.localeCompare(right))) sorted[key] = sortJsonValue(entry);
+	return sorted;
+}
 //#endregion
 //#region extensions/codex/src/app-server/profiler-flag.ts
 const PROFILER_FLAGS = ["profiler", "codex.profiler"];
@@ -2853,6 +3872,13 @@ function createCodexThreadLifecycleTimingTracker(options = {}) {
 //#endregion
 //#region extensions/codex/src/app-server/thread-lifecycle-preflight.ts
 async function prepareCodexThreadLifecyclePreflight(params) {
+	await assertCodexModelBackedReviewerEffectiveConfig({
+		client: params.client,
+		approvalsReviewer: params.appServer.approvalsReviewer,
+		cwd: params.cwd,
+		signal: params.signal
+	});
+	if (params.nativeHookRelayRequired) await assertCodexNativeHookRelayAllowed(params.client, params.signal);
 	const lifecycleTiming = createCodexThreadLifecycleTimingTracker({
 		...params.timing,
 		enabled: params.timing?.enabled ?? isCodexAppServerProfilerEnabled(params.params.config)
@@ -2898,9 +3924,13 @@ async function prepareCodexThreadLifecyclePreflight(params) {
 	const ringZeroActive = hostSystemAgentActive && isSystemAgentOnlyCodexDynamicToolAllowlist(params.params.toolsAllow);
 	const messageOnlySourceReply = isMessageOnlyCodexSourceReply(params.params);
 	const restrictedToolSurface = ringZeroActive || messageOnlySourceReply || params.params.pluginHarnessToolPolicyRestricted === true;
+	const imageGenerationDenied = params.params.pluginHarnessToolPolicySafeDeniedTools?.includes("image_generate") === true;
 	if (restrictedToolSurface && params.nativeCodeModeEnabled !== false) throw new Error("Codex restricted tool surfaces require native code mode to be disabled");
 	const restrictedToolSurfaceInheritedMcpServerNames = restrictedToolSurface ? await lifecycleTiming.measure("restricted-tool-surface-mcp-config-read", () => readCodexInheritedMcpServerNames(params.client, params.cwd, params.signal)) : [];
-	if (restrictedToolSurface) await lifecycleTiming.measure("restricted-tool-surface-config-requirements-read", () => assertCodexRestrictedToolSurfaceHasNoManagedHooks(params.client, params.signal));
+	if (restrictedToolSurface || imageGenerationDenied) await lifecycleTiming.measure("tool-policy-config-requirements-read", () => assertCodexManagedRequirementsDoNotOverrideToolPolicy(params.client, {
+		restrictedToolSurface,
+		additionalDeniedFeatures: imageGenerationDenied ? ["image_generation"] : void 0
+	}, params.signal));
 	const ringZeroConfigFingerprint = ringZeroActive ? fingerprintJsonObject({
 		version: 1,
 		baseInstructions: "",
@@ -2968,6 +3998,7 @@ async function tryReuseCodexLiveThread(options) {
 	const resumeConfig = mergeCodexThreadConfigs(params.config, userMcpServersConfigPatch, pluginAppsConfigPatch, prebuiltFinalConfigPatch.configPatch);
 	const resumeParams = lifecycleTiming.measureSync("warm-thread-resume-params", () => buildThreadResumeParams(params.params, {
 		threadId: binding.threadId,
+		cwd: params.cwd,
 		authProfileId: resumeAuthProfileId,
 		model: startModelSelection.model,
 		modelProvider: startModelProvider,
@@ -2981,7 +4012,9 @@ async function tryReuseCodexLiveThread(options) {
 		nativeCodeModeOnlyEnabled: params.nativeCodeModeOnlyEnabled,
 		webSearchAllowed: params.webSearchAllowed,
 		hostSystemAgentActive,
-		restrictedToolSurfaceInheritedMcpServerNames
+		restrictedToolSurfaceInheritedMcpServerNames,
+		shellEnvironment: params.shellEnvironment,
+		disableLoginShell: params.disableLoginShell
 	}));
 	const liveThreadConfigFingerprint = fingerprintCodexThreadConfig({
 		...resumeParams,
@@ -3102,7 +4135,9 @@ async function materializePendingSupervisionBranch(params) {
 			model: nativeModel,
 			modelProvider: nativeModelProvider,
 			hostSystemAgentActive: params.hostSystemAgentActive,
-			restrictedToolSurfaceInheritedMcpServerNames: params.restrictedToolSurfaceInheritedMcpServerNames
+			restrictedToolSurfaceInheritedMcpServerNames: params.restrictedToolSurfaceInheritedMcpServerNames,
+			shellEnvironment: params.shellEnvironment,
+			disableLoginShell: params.disableLoginShell
 		});
 		assertExactSupervisionModelSelection(startParams, {
 			model: nativeModel,
@@ -3258,7 +4293,9 @@ function buildPendingSupervisionProbeForkParams(params, pending) {
 		webSearchAllowed: params.webSearchAllowed,
 		appServer: params.appServer,
 		hostSystemAgentActive: params.hostSystemAgentActive,
-		restrictedToolSurfaceInheritedMcpServerNames: params.restrictedToolSurfaceInheritedMcpServerNames
+		restrictedToolSurfaceInheritedMcpServerNames: params.restrictedToolSurfaceInheritedMcpServerNames,
+		shellEnvironment: params.shellEnvironment,
+		disableLoginShell: params.disableLoginShell
 	});
 	return {
 		threadId: pending.sourceThreadId,
@@ -3465,6 +4502,8 @@ async function startOrResumeThread(params) {
 				hostSystemAgentActive,
 				restrictedToolSurface,
 				restrictedToolSurfaceInheritedMcpServerNames,
+				shellEnvironment: params.shellEnvironment,
+				disableLoginShell: params.disableLoginShell,
 				environmentSelection: params.environmentSelection,
 				provisionalAppIds: pluginThreadConfig?.provisionalAppIds,
 				signal: params.signal,
@@ -3475,6 +4514,7 @@ async function startOrResumeThread(params) {
 					cwd: params.cwd,
 					...clientId ? { clientId } : {},
 					authProfileId: void 0,
+					agentWorkspaceDeveloperInstructions: params.agentWorkspaceDeveloperInstructions,
 					preserveNativeModel: true,
 					dynamicToolsFingerprint,
 					dynamicToolsContainDeferred,
@@ -3541,7 +4581,7 @@ async function startOrResumeThread(params) {
 		}
 		const startModelSelection = resolveCodexAppServerThreadModelSelection({
 			provider: params.params.provider,
-			model: params.params.modelId,
+			model: params.runtimeModelId ?? params.params.modelId,
 			binding,
 			authProfileId: params.params.authProfileId,
 			authProfileStore: params.params.authProfileStore,
@@ -3855,9 +4895,10 @@ function buildTurnStartParams(params, options) {
 		input: [...buildCodexUserInput(options.promptText ?? params.prompt, params.images), ...options.explicitSkillInputs ?? []],
 		...additionalContext ? { additionalContext } : {},
 		cwd: options.cwd,
+		...options.appServer.sessionRoot ? { runtimeWorkspaceRoots: [options.appServer.sessionRoot] } : {},
 		approvalPolicy: options.appServer.approvalPolicy,
 		approvalsReviewer: options.appServer.approvalsReviewer,
-		...useThreadPermissionProfile ? {} : { sandboxPolicy: options.sandboxPolicy ?? codexSandboxPolicyForTurn(options.appServer.sandbox, options.cwd, options.appServer.start?.args) },
+		...useThreadPermissionProfile ? {} : { sandboxPolicy: options.sandboxPolicy ?? codexSandboxPolicyForTurn(options.appServer.sandbox, options.appServer.sessionRoot ?? options.cwd, options.appServer.start?.args) },
 		...modelSelection ? {
 			model: modelSelection.model,
 			personality: CODEX_NATIVE_PERSONALITY_NONE
@@ -3887,7 +4928,6 @@ function buildTurnCollaborationMode(params, options = {}) {
 function buildTurnScopedCollaborationInstructions(params, options = {}) {
 	const contextInstructions = joinPresentSections(options.turnScopedDeveloperInstructions, options.memoryCollaborationInstructions, options.skillsCollaborationInstructions);
 	if (params.trigger === "cron") return joinPresentSections(buildCronCollaborationInstructions(), contextInstructions);
-	if (params.trigger === "heartbeat") return joinPresentSections(buildHeartbeatCollaborationInstructions(), contextInstructions);
 	if (contextInstructions?.trim()) return joinPresentSections(buildDefaultCollaborationInstructions(), contextInstructions);
 	return null;
 }
@@ -3914,15 +4954,8 @@ function buildCronCollaborationInstructions() {
 		"Keep output concise and automation-oriented. Prefer the final command result or a short failure summary over status narration."
 	].join("\n\n");
 }
-function buildHeartbeatCollaborationInstructions() {
-	return [
-		"This is an OpenClaw heartbeat turn. Apply these instructions only to this heartbeat wake; ordinary chat turns should stay in Codex Default mode.",
-		"When you are ready to end the heartbeat, prefer the structured `heartbeat_respond` tool so OpenClaw can record the wake outcome and notification decision. If `heartbeat_respond` is not already available and `tool_search` is available, search for `heartbeat_respond`, load it, then call it. Use `notify=false` when nothing should visibly interrupt the user.",
-		GPT5_HEARTBEAT_PROMPT_OVERLAY
-	].join("\n\n");
-}
 function joinPresentSections(...sections) {
 	return sections.filter((section) => Boolean(section?.trim())).join("\n\n");
 }
 //#endregion
-export { resolveCodexDynamicToolsLoadingForRuntime as A, buildCodexPluginThreadConfigInputFingerprint as B, codexLegacyDynamicToolsFingerprint as C, isSystemAgentOnlyCodexDynamicToolAllowlist as D, isForcedPrivateQaCodexRuntime as E, projectContextEngineAssemblyForCodex as F, shouldBuildCodexPluginThreadConfig as G, buildDisabledAppsConfigPatch as H, resolveCodexContextEngineProjectionMaxChars as I, isOpenAiCuratedMarketplace as J, ensureCodexPluginActivation as K, resolveCodexContextEngineProjectionReserveTokens as L, isContextEngineBindingCompatible as M, fitCodexProjectedContextForTurnStart as N, normalizeCodexDynamicToolName as O, neutralizeCodexExplicitMentionSigils as P, buildCodexPluginAppsConfigPatchFromPolicyContext as R, codexDynamicToolsFingerprint as S, filterCodexDynamicToolsForDisabledNativeSurface as T, buildPluginAppPolicyContext as U, buildCodexPluginThreadConfigTimeoutFallback as V, mergeCodexThreadConfigs as W, pluginReadParams as X, isOpenAiCuratedMarketplaceName as Y, resolveRecoverableCodexPluginConfigKeys as Z, resolveCodexAppServerThreadModelSelection as _, isCodexAppServerProfilerEnabled as a, readCodexSupportedReasoningEfforts as b, buildCodexRingZeroThreadConfigPatch as c, buildCodexNativeWebSearchThreadConfig as d, resolveCodexWebSearchPlan as f, resolveCodexAppServerRequestModelSelection as g, resolveCodexAppServerModelProvider as h, startOrResumeThread as i, buildContextEngineBinding as j, resolveCodexDynamicToolsLoading as k, buildCodexRuntimeThreadConfig as l, CODEX_NATIVE_PERSONALITY_NONE as m, buildTurnStartParams as n, assertCodexRestrictedToolSurfaceHasNoManagedHooks as o, buildDeveloperInstructions as p, refreshCodexPluginRuntimeState as q, buildCodexUserInput as r, attestCodexRestrictedToolSurfaceMcpServersDisabled as s, buildTurnCollaborationMode as t, readCodexInheritedMcpServerNames as u, resolveCodexBindingModelProviderFallback as v, filterCodexDynamicTools as w, areCodexDynamicToolFingerprintsCompatible as x, resolveReasoningEffort as y, buildCodexPluginThreadConfig as z };
+export { isForcedPrivateQaCodexRuntime as $, attestCodexRestrictedToolSurfaceMcpServersDisabled as A, resolveCodexAppServerRequestModelSelection as B, toCodexDynamicToolProgressResponse as C, refreshCodexPluginRuntimeState as Ct, withDynamicToolExecutionState as D, resolveRecoverableCodexPluginConfigKeys as Dt, createFailedDynamicToolResponse as E, pluginReadParams as Et, resolveCodexWebSearchPlan as F, CODEX_MANAGED_THREAD_MAX_ENTRIES as G, resolveCodexBindingModelProviderFallback as H, buildDeveloperInstructions as I, areCodexDynamicToolFingerprintsCompatible as J, CODEX_MANAGED_THREAD_NAMESPACE as K, buildCodexProjectDocThreadConfig as L, buildCodexRuntimeThreadConfig as M, readCodexInheritedMcpServerNames as N, withDynamicToolTranscriptDetails as O, buildCodexNativeWebSearchThreadConfig as P, filterCodexDynamicToolsForDisabledNativeSurface as Q, CODEX_NATIVE_PERSONALITY_NONE as R, shouldReleaseTurnAfterTerminalDynamicTool as S, ensureCodexPluginActivation as St, resolveCodexToolAbortTerminalReason as T, isOpenAiCuratedMarketplaceName as Tt, resolveReasoningEffort as U, resolveCodexAppServerThreadModelSelection as V, readCodexSupportedReasoningEfforts as W, codexLegacyDynamicToolsFingerprint as X, codexDynamicToolsFingerprint as Y, filterCodexDynamicTools as Z, isDynamicToolTerminalDiagnosticEvent as _, buildCodexPluginThreadConfigTimeoutFallback as _t, isCodexAppServerProfilerEnabled as a, buildContextEngineBinding as at, resolveTerminalDynamicToolBatchAction as b, mergeCodexThreadConfigs as bt, buildCodexNativeHookRelayConfig as c, fitCodexProjectedContextForTurnStart as ct, emitCodexNativePreToolUseFailureDiagnostic as d, resolveCodexContextEngineProjectionMaxChars as dt, isMessageOnlyCodexSourceReply as et, resolveCodexNativeHookRelayEvents as f, resolveCodexContextEngineProjectionReserveTokens as ft, hasPendingDynamicToolTerminalDiagnostic as g, buildCodexPluginThreadConfigInputFingerprint as gt, handleDynamicToolCallWithTimeout as h, buildCodexPluginThreadConfig as ht, startOrResumeThread as i, resolveCodexDynamicToolsLoadingForRuntime as it, buildCodexRingZeroThreadConfigPatch as j, assertCodexManagedRequirementsDoNotOverrideToolPolicy as k, buildCodexNativeHookRelayDisabledConfig as l, neutralizeCodexExplicitMentionSigils as lt, scheduleCodexNativeHookRelayUnregister as m, buildCodexPluginAppsConfigPatchFromPolicyContext as mt, buildTurnStartParams as n, normalizeCodexDynamicToolName as nt, CODEX_NATIVE_HOOK_RELAY_EVENTS as o, isContextEngineBindingCompatible as ot, resolveCodexNativeHookRelayTtlMs as p, resolveCodexContinuityProjectionMaxChars as pt, createCodexManagedThreadStore as q, buildCodexUserInput as r, resolveCodexDynamicToolsLoading as rt, CODEX_NATIVE_HOOK_RELAY_TTL_GRACE_MS as s, buildCodexContinuityCalibration as st, buildTurnCollaborationMode as t, isSystemAgentOnlyCodexDynamicToolAllowlist as tt, createCodexNativeHookRelay as u, projectContextEngineAssemblyForCodex as ut, isMatchingDynamicToolTerminalDiagnostic as v, buildDisabledAppsConfigPatch as vt, toCodexDynamicToolProtocolResponse as w, isOpenAiCuratedMarketplace as wt, shouldBlockTerminalReleaseForNonTerminalDynamicToolResult as x, shouldBuildCodexPluginThreadConfig as xt, resolveDynamicToolCallTimeoutMs as y, buildPluginAppPolicyContext as yt, resolveCodexAppServerModelProvider as z };