@openclaw/codex 2026.8.1-beta.3 → 2026.8.1

package/dist/{thread-lifecycle-DKdrnTMX.js → thread-lifecycle-Ss-uwnC4.js}

@@ -1,33 +1,38 @@
-import { _ as CODEX_PLUGINS_MARKETPLACE_NAME, g as resolveCodexPluginsPolicy, n as codexSandboxPolicyForTurn, v as CODEX_PLUGINS_WORKSPACE_MARKETPLACE_NAME } from "./config-CpNeo5AE.js";
-import { B as CodexAppServerRpcError, M as isCodexAppServerConnectionClosedError, R as resolveCodexAppServerClientInstanceId, U as consumeCodexAppServerLiveThread, d as retainSharedCodexAppServerClientByInstanceId, k as getCodexAppServerClientInstanceId, lt as flattenCodexDynamicToolFunctions, pt as resolveCodexAppServerLocalHomeDir, s as isCodexAppServerStartSelectionChangedError, ut as isJsonObject } from "./shared-client-Dw-rzii0.js";
-import { a as hashCodexAppServerBindingFingerprint, c as reclaimCurrentCodexSessionGeneration, d as sessionBindingIdentity, i as createCodexSessionGenerationSupersededError, n as assertCodexBindingMayBeReplaced, o as isCodexAppServerNativeAuthProfile, s as normalizeCodexAppServerBindingModelProvider } from "./session-binding-BTrLf9Qm.js";
-import { a as closeCodexStartupClientBestEffort, c as isCodexAppServerUnsafeSubscriptionError, d as unsubscribeCodexThreadBestEffort, n as CODEX_APP_SERVER_UNSUBSCRIBE_TIMEOUT_MS, r as CodexAppServerUnsafeSubscriptionError } from "./attempt-client-cleanup-URjUlCHg.js";
-import { a as assertCodexThreadStartResponse, r as assertCodexThreadForkResponse } from "./protocol-validators-VAVyEnDp.js";
-import { o as defaultCodexAppInventoryCache, s as serializeCodexAppInventoryError, t as buildCodexAppServerConnectionFingerprint } from "./plugin-app-cache-key-DMNQ8Zi8.js";
-import { t as isIncognitoSessionKey } from "./incognito-session-ET_ufDH-.js";
-import { n as codexCatalogHomeId } from "./session-catalog-home-id-BNwAJ9D7.js";
-import { t as resumeCodexAppServerThread } from "./thread-resume-CdJk2Ehf.js";
-import { u as projectBoundedCodexThreadHistory } from "./transcript-mirror-BU0_LKAL.js";
+import { E as resolveCodexPluginsPolicy, F as resolveCodexAppServerLocalHomeDir, M as CODEX_PLUGINS_WORKSPACE_MARKETPLACE_NAME, P as resolveCodexAppServerHomeDir, f as assertCodexModelBackedReviewerEffectiveConfig, j as CODEX_PLUGINS_MARKETPLACE_NAME, n as codexSandboxPolicyForTurn } from "./config-Cxw3Cl3k.js";
+import { $ as CodexAppServerRpcError, D as CodexThreadStartRequestError, E as CodexThreadBindingConflictError, H as getCodexAppServerClientInstanceId, Ht as isJsonObject, J as isCodexAppServerOverloadError, Q as resolveCodexAppServerClientInstanceId, St as releaseCodexAppServerLiveThread, T as CodexRestrictedToolSurfaceAttestationError, Vt as flattenCodexDynamicToolFunctions, _ as retainSharedCodexAppServerClientByInstanceId, bt as isCodexAppServerLiveThreadClaimed, dt as resolveCodexToolAbortTerminalReason, gt as consumeCodexAppServerLiveThread, n as captureExclusiveSharedCodexAppServerClient, w as CodexAdoptedThreadActiveError, wt as unsubscribeCodexAppServerLiveThread } from "./shared-client-kNkljY-R.js";
+import { a as hashCodexAppServerBindingFingerprint, c as reclaimCurrentCodexSessionGeneration, d as sessionBindingIdentity, i as createCodexSessionGenerationSupersededError, n as assertCodexBindingMayBeReplaced, o as isCodexAppServerNativeAuthProfile, s as normalizeCodexAppServerBindingModelProvider } from "./session-binding-q2WSTVmC.js";
+import { a as assertCodexThreadForkResponse, r as assertCodexThreadAcceptsDirectInput, s as assertCodexThreadStartResponse, t as CodexThreadDirectInputError } from "./protocol-validators-Bg5rpNxk.js";
+import { a as closeCodexStartupClientBestEffort, c as isCodexAppServerUnsafeSubscriptionError, f as unsubscribeCodexThreadBestEffort, n as CODEX_APP_SERVER_UNSUBSCRIBE_TIMEOUT_MS, r as CodexAppServerUnsafeSubscriptionError } from "./attempt-client-cleanup-CVPvp9dL.js";
+import { c as serializeCodexAppInventoryError, n as buildCodexAppServerConnectionFingerprint, s as defaultCodexAppInventoryCache, t as resumeCodexAppServerThread } from "./thread-resume-DF54hagX.js";
+import { c as withExclusiveCodexAppServerThread, l as isIncognitoSessionKey } from "./thread-ownership-CeYBqg_4.js";
+import { i as readCodexSessionMeta, n as codexCatalogHomeId } from "./session-catalog-home-id-DAKUrm3C.js";
+import { d as projectBoundedCodexThreadHistory } from "./transcript-mirror-CkEQIna-.js";
 import { r as sanitizeInlineImageDataUrl, t as invalidInlineImageText } from "./image-payload-sanitizer-CnfoUPCE.js";
 import { asOptionalRecord, isRecord, normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
 import fs from "node:fs/promises";
 import path from "node:path";
-import { SKILL_WORKSHOP_TOOL_NAME, TRANSCRIPT_CREDENTIAL_SAFETY_PROMPT, buildDelegationGuidanceSection, buildHarnessVisibleReplyGuidance, buildSkillWorkshopPromptSection, embeddedAgentLog, formatErrorMessage, isActiveHarnessContextEngine, isHostScopedAgentToolActive, resolveMainSessionDelegationMode } from "openclaw/plugin-sdk/agent-harness-runtime";
+import { createDeferred } from "openclaw/plugin-sdk/extension-shared";
+import { addTimerTimeoutGraceMs, finiteSecondsToTimerSafeMilliseconds } from "openclaw/plugin-sdk/number-runtime";
+import { SKILL_WORKSHOP_TOOL_NAME, buildCredentialSafetyPrompt, buildDelegationGuidanceSection, buildHarnessVisibleReplyGuidance, buildSkillWorkshopPromptSection, embeddedAgentLog, formatErrorMessage, isActiveHarnessContextEngine, isHostScopedAgentToolActive, resolveMainSessionDelegationMode } from "openclaw/plugin-sdk/agent-harness-runtime";
 import * as crypto$1 from "node:crypto";
 import crypto, { createHash } from "node:crypto";
 import os from "node:os";
-import { resolveAgentDir as resolveAgentDir$1, resolveSessionAgentIds as resolveSessionAgentIds$1 } from "openclaw/plugin-sdk/agent-runtime";
+import { isDeepStrictEqual } from "node:util";
+import { resolveAgentDir as resolveAgentDir$1 } from "openclaw/plugin-sdk/agent-runtime";
+import { resolveSessionAgentIdsStrict } from "openclaw/plugin-sdk/agent-scope-runtime";
 import { z } from "zod";
 import { coerceErrorMessage } from "openclaw/plugin-sdk/error-runtime";
 import { sliceUtf16Safe, truncateUtf16Safe } from "openclaw/plugin-sdk/text-utility-runtime";
+import { emitTrustedDiagnosticEvent } from "openclaw/plugin-sdk/diagnostic-runtime";
+import { expectDefined } from "openclaw/plugin-sdk/expect-runtime";
 import { redactSensitiveFieldValue, redactToolPayloadText } from "openclaw/plugin-sdk/logging-core";
 import { isPathInside } from "openclaw/plugin-sdk/file-access-runtime";
 import { resolveRequiredHomeDir, resolveStateDir } from "openclaw/plugin-sdk/state-paths";
 import { listRegisteredPluginAgentPromptGuidance } from "openclaw/plugin-sdk/plugin-runtime";
 import { buildHostnameAllowlistPolicyFromSuffixAllowlist } from "openclaw/plugin-sdk/ssrf-policy";
-import { buildCodexUserMcpServersThreadConfigPatchForRuntime } from "openclaw/plugin-sdk/codex-mcp-projection";
-import { isDiagnosticFlagEnabled } from "openclaw/plugin-sdk/diagnostic-runtime";
-import { GPT5_HEARTBEAT_PROMPT_OVERLAY } from "openclaw/plugin-sdk/provider-model-shared";
+import { buildCodexUserMcpServersThreadConfigPatchForRun } from "openclaw/plugin-sdk/codex-mcp-projection";
+import { registerRetainedNativeHookRelayForBundledRuntime } from "openclaw/plugin-sdk/native-hook-relay-runtime";
+import { isDiagnosticFlagEnabled } from "openclaw/plugin-sdk/diagnostic-flags";
 //#region extensions/codex/src/app-server/plugin-inventory.ts
 /**
 * Reads Codex plugin marketplace state and app inventory to decide which
@@ -270,15 +275,39 @@ function resolveOwnedApps(params) {
 			enabled: false,
 			needsAuth: true
 		};
-		return {
+		return Object.assign({
 			id: app.id,
 			name: app.name,
 			accessible: info.isAccessible,
 			enabled: info.isEnabled,
 			needsAuth: !info.isAccessible
-		};
+		}, resolveOwnedAppReadOnlyToolConfigKeys(info));
 	}).toSorted((left, right) => left.id.localeCompare(right.id));
 }
+/** Returns the config keys that Codex metadata proves belong to read-only tools. */
+function resolveOwnedAppReadOnlyToolConfigKeys(app) {
+	const appName = app.name.trim();
+	const appNameLower = appName.toLowerCase();
+	const tools = app.toolSummaries ?? [];
+	const writableToolConfigKeys = new Set(tools.filter((tool) => !tool.isReadOnly).flatMap((tool) => resolveAppToolConfigKeys({
+		appName,
+		appNameLower,
+		tool
+	})));
+	const keys = tools.filter((tool) => tool.isReadOnly).flatMap((tool) => resolveAppToolConfigKeys({
+		appName,
+		appNameLower,
+		tool
+	})).filter((key) => !writableToolConfigKeys.has(key));
+	return keys.length > 0 ? { readOnlyToolConfigKeys: Array.from(new Set(keys)).toSorted() } : {};
+}
+function resolveAppToolConfigKeys(params) {
+	const keys = [params.tool.name];
+	if (params.tool.title) keys.push(params.tool.title);
+	if (params.appName) keys.push(`${params.appName}_${params.tool.name}`);
+	if (params.appNameLower && params.appNameLower !== params.appName) keys.push(`${params.appNameLower}_${params.tool.name}`);
+	return keys;
+}
 function findPluginSummary(marketplace, pluginName) {
 	const exact = marketplace.plugins.find((plugin) => plugin.id === pluginName || plugin.id === `${pluginName}@${marketplace.name}`);
 	if (exact) return exact;
@@ -457,12 +486,21 @@ function activationFailure(identity, reason, diagnostic, extraDiagnostics = [])
 }
 //#endregion
 //#region extensions/codex/src/app-server/plugin-thread-app-admission.ts
+function resolveCodexPluginThreadAppCacheKey(params) {
+	return params.threadId ? `${params.appCacheKey}:thread:${encodeURIComponent(params.threadId)}` : params.appCacheKey;
+}
+function createCodexPluginThreadAppInventoryRequest(params) {
+	return async (method, requestParams) => await params.request(method, (method === "app/installed" || method === "app/read") && params.threadId ? {
+		...requestParams,
+		threadId: params.threadId
+	} : requestParams);
+}
 async function refreshCodexPluginAppInventory(params, appCache, options = {}) {
 	if (!params.appCacheKey) return;
-	const request = async (method, requestParams) => await params.request(method, requestParams);
+	const request = createCodexPluginThreadAppInventoryRequest(params);
 	try {
 		return await appCache.refreshNow({
-			key: params.appCacheKey,
+			key: resolveCodexPluginThreadAppCacheKey(params),
 			request,
 			nowMs: params.nowMs,
 			forceRefetch: options.forceRefetch,
@@ -499,9 +537,9 @@ function normalizeCodexPluginOwnerName(name) {
 	return name.trim().toLowerCase().replace(/[^a-z0-9]+/g, "");
 }
 async function readCodexThreadAdmissibleAccountApps(params, appCache) {
-	const request = async (method, requestParams) => await params.request(method, requestParams);
+	const request = createCodexPluginThreadAppInventoryRequest(params);
 	const cachedInventory = appCache.read({
-		key: params.appCacheKey,
+		key: resolveCodexPluginThreadAppCacheKey(params),
 		request,
 		nowMs: params.nowMs,
 		suppressRefresh: true
@@ -527,7 +565,8 @@ function toCodexPluginOwnedAccountApp(app) {
 		name: app.name,
 		accessible: app.isAccessible,
 		enabled: app.isEnabled,
-		needsAuth: !app.isAccessible
+		needsAuth: !app.isAccessible,
+		...resolveOwnedAppReadOnlyToolConfigKeys(app)
 	};
 }
 function resolveCodexThreadConfigAppsForRecord(params) {
@@ -616,6 +655,11 @@ function buildCodexPluginThreadConfigTimeoutFallback(params) {
 /** Builds the Codex apps config patch and policy context for a native thread. */
 async function buildCodexPluginThreadConfig(params) {
 	const appCache = params.appCache ?? defaultCodexAppInventoryCache;
+	const threadAppCacheKey = resolveCodexPluginThreadAppCacheKey(params);
+	const threadRequest = (method, requestParams) => params.request(method, (method === "app/installed" || method === "app/read") && params.threadId && isJsonObject(requestParams) ? {
+		...requestParams,
+		threadId: params.threadId
+	} : requestParams);
 	let inputFingerprint = buildCodexPluginThreadConfigInputFingerprint({
 		pluginConfig: params.pluginConfig,
 		appCacheKey: params.appCacheKey
@@ -629,9 +673,9 @@ async function buildCodexPluginThreadConfig(params) {
 	let inventory = policy.pluginPolicies.length > 0 ? await readCodexPluginInventory({
 		pluginConfig: params.pluginConfig,
 		policy,
-		request: params.request,
+		request: threadRequest,
 		appCache,
-		appCacheKey: params.appCacheKey,
+		appCacheKey: threadAppCacheKey,
 		configCwd: params.configCwd,
 		metadataCache: params.metadataCache,
 		nowMs: params.nowMs,
@@ -647,9 +691,9 @@ async function buildCodexPluginThreadConfig(params) {
 		inventory = await readCodexPluginInventory({
 			pluginConfig: params.pluginConfig,
 			policy,
-			request: params.request,
+			request: threadRequest,
 			appCache,
-			appCacheKey: params.appCacheKey,
+			appCacheKey: threadAppCacheKey,
 			configCwd: params.configCwd,
 			metadataCache: params.metadataCache,
 			nowMs: params.nowMs
@@ -665,9 +709,9 @@ async function buildCodexPluginThreadConfig(params) {
 		if (!record.activationRequired) continue;
 		const activation = await ensureCodexPluginActivation({
 			identity: record.policy,
-			request: params.request,
+			request: threadRequest,
 			appCache,
-			appCacheKey: params.appCacheKey,
+			appCacheKey: threadAppCacheKey,
 			configCwd: params.configCwd,
 			metadataCache: params.metadataCache,
 			deferAppInventoryRefresh: true,
@@ -691,9 +735,9 @@ async function buildCodexPluginThreadConfig(params) {
 		inventory = await readCodexPluginInventory({
 			pluginConfig: params.pluginConfig,
 			policy,
-			request: params.request,
+			request: threadRequest,
 			appCache,
-			appCacheKey: params.appCacheKey,
+			appCacheKey: threadAppCacheKey,
 			configCwd: params.configCwd,
 			metadataCache: params.metadataCache,
 			nowMs: params.nowMs
@@ -712,9 +756,9 @@ async function buildCodexPluginThreadConfig(params) {
 		inventory = await readCodexPluginInventory({
 			pluginConfig: params.pluginConfig,
 			policy,
-			request: params.request,
+			request: threadRequest,
 			appCache,
-			appCacheKey: params.appCacheKey,
+			appCacheKey: threadAppCacheKey,
 			configCwd: params.configCwd,
 			metadataCache: params.metadataCache,
 			nowMs: params.nowMs
@@ -952,7 +996,7 @@ function readPersistedAppToolApprovalOverrideNames(config, app) {
 	const appConfig = isJsonObject(appsRoot) ? appsRoot[app.id] : void 0;
 	const tools = isJsonObject(appConfig) ? appConfig.tools : void 0;
 	if (!isJsonObject(tools)) return [];
-	return Object.entries(tools).filter(([, value]) => hasPersistedToolApprovalOverride(value)).map(([toolName]) => toolName).toSorted();
+	return Object.entries(tools).filter(([toolName]) => !app.readOnlyToolConfigKeys?.includes(toolName)).filter(([, value]) => hasPersistedToolApprovalOverride(value)).map(([toolName]) => toolName).toSorted();
 }
 function hasPersistedToolApprovalOverride(value) {
 	return isJsonObject(value) && value.approval_mode !== void 0;
@@ -1780,33 +1824,6 @@ function applyCodexNativeSkillIsolation(config, isolation) {
 	};
 }
 //#endregion
-//#region extensions/codex/src/app-server/thread-lifecycle-errors.ts
-var CodexThreadStartRequestError = class extends Error {
-	constructor(cause) {
-		super(`thread/start: ${formatErrorMessage(cause)}`, { cause });
-		this.name = "CodexThreadStartRequestError";
-	}
-};
-var CodexThreadBindingConflictError = class extends Error {
-	constructor(threadId, operation) {
-		super(`Codex thread binding changed while ${operation}: ${threadId}`);
-		this.name = "CodexThreadBindingConflictError";
-	}
-};
-var CodexRestrictedToolSurfaceAttestationError = class extends Error {
-	constructor(cause) {
-		super("Codex restricted-tool-surface MCP attestation failed", { cause });
-		this.name = "CodexRestrictedToolSurfaceAttestationError";
-	}
-};
-var CodexThreadBindingConflictAfterCleanupError = class extends CodexThreadBindingConflictError {};
-var CodexAdoptedThreadActiveError = class extends Error {
-	constructor() {
-		super("Codex session became active in another runner; wait for it to finish before continuing");
-		this.name = "CodexAdoptedThreadActiveError";
-	}
-};
-//#endregion
 //#region extensions/codex/src/app-server/managed-thread-store.ts
 const CODEX_MANAGED_THREAD_NAMESPACE = "app-server-managed-threads";
 const CODEX_MANAGED_THREAD_MAX_ENTRIES = 2e4;
@@ -1981,11 +1998,6 @@ const LEGACY_PRO_REASONING_EFFORTS = [
 ];
 const LEGACY_PRO_MODEL_ID_RE = /^gpt-5\.[45]-pro$/u;
 const MODERN_GPT_5_MODEL_ID_RE = /^gpt-5\.(?:[3-9]|[1-9]\d)(?:$|-)/u;
-function normalizeCodexReasoningEfforts(efforts) {
-	if (!efforts) return [];
-	const supported = new Set(efforts.map((effort) => effort.trim().toLowerCase()));
-	return CODEX_REASONING_EFFORTS.filter((effort) => supported.has(effort));
-}
 /** Read reasoning metadata after the Codex app-server route has been selected. */
 function readCodexSupportedReasoningEfforts(compat) {
 	if (!compat || typeof compat !== "object" || Array.isArray(compat)) return;
@@ -1994,7 +2006,8 @@ function readCodexSupportedReasoningEfforts(compat) {
 	return efforts.filter((effort) => typeof effort === "string");
 }
 function resolveSupportedReasoningEffort(params) {
-	const supported = normalizeCodexReasoningEfforts(params.supportedReasoningEfforts);
+	const declared = new Set(params.supportedReasoningEfforts.map((effort) => effort.trim().toLowerCase()));
+	const supported = CODEX_REASONING_EFFORTS.filter((effort) => declared.has(effort));
 	if (supported.includes(params.requested)) return params.requested;
 	const fallbackEfforts = params.requested === "ultra" ? supported : supported.filter((effort) => effort !== "ultra");
 	const requestedRank = CODEX_REASONING_EFFORTS.indexOf(params.requested);
@@ -2002,7 +2015,8 @@ function resolveSupportedReasoningEffort(params) {
 }
 /** Resolve a turn effort from the selected model's provider-owned metadata. */
 function resolveCodexAppServerReasoningEffort(params) {
-	if (params.thinkLevel === "off" || params.thinkLevel === "adaptive") return null;
+	if (params.thinkLevel === "off") return params.supportedReasoningEfforts?.includes("none") ? "none" : null;
+	if (params.thinkLevel === "adaptive") return null;
 	if (params.supportedReasoningEfforts) return resolveSupportedReasoningEffort({
 		requested: params.thinkLevel,
 		supportedReasoningEfforts: params.supportedReasoningEfforts
@@ -2102,6 +2116,7 @@ function buildCodexProjectDocThreadConfig(config) {
 //#region extensions/codex/src/app-server/thread-prompt.ts
 function buildDeveloperInstructions(params, options = {}) {
 	const deferredToolNames = /* @__PURE__ */ new Set();
+	let secretsToolName;
 	let hasSkillWorkshop = false;
 	let hasSessionsSpawn = false;
 	let hasSessionsYield = false;
@@ -2115,6 +2130,7 @@ function buildDeveloperInstructions(params, options = {}) {
 		for (const tool of spec.type === "namespace" ? spec.tools : [spec]) {
 			const name = tool.name.trim();
 			if (tool.deferLoading === true && name) deferredToolNames.add(name);
+			if (name === "secrets" && params.disableTools !== true) secretsToolName ??= spec.type === "namespace" ? `${spec.name}.${name}` : name;
 			hasSkillWorkshop ||= name === SKILL_WORKSHOP_TOOL_NAME;
 			hasSessionsSpawn ||= name === "sessions_spawn";
 			hasSessionsYield ||= isDirectNamespace && name === "sessions_yield";
@@ -2154,7 +2170,7 @@ function buildDeveloperInstructions(params, options = {}) {
 			sourceReplyDeliveryMode: params.sourceReplyDeliveryMode,
 			messageToolAvailable
 		}),
-		TRANSCRIPT_CREDENTIAL_SAFETY_PROMPT,
+		buildCredentialSafetyPrompt(secretsToolName),
 		nativeCommandGuidance,
 		params.extraSystemPrompt
 	].filter((section) => typeof section === "string" && section.trim()).join("\n\n");
@@ -2261,7 +2277,8 @@ function resolveCodexWebSearchPlan(params) {
 const CODEX_CODE_MODE_THREAD_CONFIG = {
 	"features.code_mode": true,
 	"features.code_mode_only": false,
-	"features.apply_patch_streaming_events": true
+	"features.apply_patch_streaming_events": true,
+	suppress_unstable_features_warning: true
 };
 const CODEX_GOAL_CONTINUATION_DISABLED_THREAD_CONFIG = { "features.goals": false };
 const CODEX_NATIVE_UPDATE_PLAN_DISABLED_THREAD_CONFIG = { "tools.update_plan.enabled": false };
@@ -2451,33 +2468,24 @@ function buildCodexRuntimeThreadConfig(config, options = {}) {
 		"features.code_mode_only": options.nativeCodeModeOnlyEnabled === true
 	};
 	if (options.nativeCodeModeEnabled === false) {
-		const disabledConfig = mergeCodexThreadConfigs(configured, CODEX_CODE_MODE_DISABLED_THREAD_CONFIG, CODEX_GOAL_CONTINUATION_DISABLED_THREAD_CONFIG, CODEX_NATIVE_UPDATE_PLAN_DISABLED_THREAD_CONFIG) ?? {
-			...CODEX_CODE_MODE_DISABLED_THREAD_CONFIG,
-			...CODEX_GOAL_CONTINUATION_DISABLED_THREAD_CONFIG,
-			...CODEX_NATIVE_UPDATE_PLAN_DISABLED_THREAD_CONFIG
-		};
+		const disabledConfig = expectDefined(mergeCodexThreadConfigs(configured, CODEX_CODE_MODE_DISABLED_THREAD_CONFIG, CODEX_GOAL_CONTINUATION_DISABLED_THREAD_CONFIG, CODEX_NATIVE_UPDATE_PLAN_DISABLED_THREAD_CONFIG), "Codex disabled code mode config");
 		delete disabledConfig["features.apply_patch_streaming_events"];
 		return disabledConfig;
 	}
-	if (options.nativeCodeModeOnlyEnabled === true) return ensureDirectOnlyToolNamespaces(mergeCodexThreadConfigs(codeModeConfig, configured, CODEX_GOAL_CONTINUATION_DISABLED_THREAD_CONFIG, CODEX_NATIVE_UPDATE_PLAN_DISABLED_THREAD_CONFIG, { "features.code_mode_only": true }) ?? {
-		...codeModeConfig,
-		...CODEX_GOAL_CONTINUATION_DISABLED_THREAD_CONFIG,
-		...CODEX_NATIVE_UPDATE_PLAN_DISABLED_THREAD_CONFIG,
-		"features.code_mode_only": true
-	}, options.directOnlyToolNamespaces);
-	return ensureDirectOnlyToolNamespaces(mergeCodexThreadConfigs(codeModeConfig, configured, CODEX_GOAL_CONTINUATION_DISABLED_THREAD_CONFIG, CODEX_NATIVE_UPDATE_PLAN_DISABLED_THREAD_CONFIG) ?? {
-		...codeModeConfig,
-		...CODEX_GOAL_CONTINUATION_DISABLED_THREAD_CONFIG,
-		...CODEX_NATIVE_UPDATE_PLAN_DISABLED_THREAD_CONFIG
-	}, options.directOnlyToolNamespaces);
+	if (options.nativeCodeModeOnlyEnabled === true) return ensureDirectOnlyToolNamespaces(expectDefined(mergeCodexThreadConfigs(codeModeConfig, configured, CODEX_GOAL_CONTINUATION_DISABLED_THREAD_CONFIG, CODEX_NATIVE_UPDATE_PLAN_DISABLED_THREAD_CONFIG, { "features.code_mode_only": true }), "Codex code mode only config"), options.directOnlyToolNamespaces);
+	return ensureDirectOnlyToolNamespaces(expectDefined(mergeCodexThreadConfigs(codeModeConfig, configured, CODEX_GOAL_CONTINUATION_DISABLED_THREAD_CONFIG, CODEX_NATIVE_UPDATE_PLAN_DISABLED_THREAD_CONFIG), "Codex code mode config"), options.directOnlyToolNamespaces);
 }
 function ensureDirectOnlyToolNamespaces(config, requiredNamespaces) {
 	if (!requiredNamespaces?.length) return config;
-	const configured = config["code_mode.direct_only_tool_namespaces"];
-	const namespaces = Array.isArray(configured) ? configured.filter((entry) => typeof entry === "string" && entry.length > 0) : [];
+	const feature = expectDefined(config["features.code_mode"], "Codex code mode config");
+	const configured = isJsonObject(feature) ? feature : { enabled: feature };
+	const namespaces = Array.isArray(configured.direct_only_tool_namespaces) ? configured.direct_only_tool_namespaces.filter((entry) => typeof entry === "string" && entry.length > 0) : [];
 	return {
 		...config,
-		"code_mode.direct_only_tool_namespaces": [.../* @__PURE__ */ new Set([...namespaces, ...requiredNamespaces])]
+		"features.code_mode": {
+			...configured,
+			direct_only_tool_namespaces: [.../* @__PURE__ */ new Set([...namespaces, ...requiredNamespaces])]
+		}
 	};
 }
 function resolveDirectOnlyToolNamespaces(dynamicTools) {
@@ -2491,10 +2499,6 @@ function buildCodexRuntimeThreadConfigForRun(params, config, options = {}) {
 	const configMcpServers = config?.mcp_servers;
 	if (restrictedToolSurface && configMcpServers !== void 0 && !isJsonObject(configMcpServers)) throw new Error("Codex restricted tool surface received invalid thread mcp_servers config");
 	const restrictedToolSurfaceMcpServerNames = [...options.restrictedToolSurfaceInheritedMcpServerNames ?? [], ...isJsonObject(configMcpServers) ? Object.keys(configMcpServers) : []];
-	const restrictedRunConfig = restrictedToolSurface && isJsonObject(configMcpServers) ? {
-		...config,
-		mcp_servers: {}
-	} : config;
 	const webSearchConfig = resolveCodexWebSearchPlan({
 		config: params.config,
 		disableTools: params.disableTools,
@@ -2502,7 +2506,7 @@ function buildCodexRuntimeThreadConfigForRun(params, config, options = {}) {
 		nativeProviderWebSearchSupport: options.nativeProviderWebSearchSupport,
 		webSearchAllowed: options.webSearchAllowed
 	}).threadConfig;
-	const baseConfig = buildCodexRuntimeThreadConfig(mergeCodexThreadConfigs(restrictedRunConfig, webSearchConfig), options);
+	const baseConfig = buildCodexRuntimeThreadConfig(mergeCodexThreadConfigs(config, webSearchConfig), options);
 	return applyCodexManagedShellEnvironment({
 		...mergeCodexThreadConfigs(baseConfig, options.appServer?.networkProxy?.configPatch, params.pluginHarnessToolPolicySafeDeniedTools?.includes("image_generate") ? { "features.image_generation": false } : void 0, shouldDisableCodexToolSearchForModel(params.modelId) ? CODEX_TOOL_SEARCH_UNSUPPORTED_THREAD_CONFIG : void 0, params.delegationCapability === "report_only" ? CODEX_DELEGATION_DISABLED_THREAD_CONFIG : void 0, messageOnlySourceReply || params.pluginHarnessToolPolicyRestricted === true ? buildRestrictedToolConfigPatch(restrictedToolSurfaceMcpServerNames) : buildCodexRingZeroThreadConfigPatch(params, options.hostSystemAgentActive, restrictedToolSurfaceMcpServerNames), restrictedTurnDisablesProjectDocs ? CODEX_NO_PROJECT_DOCS_CONFIG : void 0, params.authoredContextTokenCap === void 0 ? void 0 : { model_context_window: params.authoredContextTokenCap }) ?? baseConfig,
 		...params.bootstrapContextMode === "lightweight" ? CODEX_NO_PROJECT_DOCS_CONFIG : {}
@@ -2613,14 +2617,13 @@ function resolveCodexThreadEnvironmentSelection(options) {
 }
 //#endregion
 //#region extensions/codex/src/app-server/thread-lifecycle-io.ts
-function resolveManagedThreadSourceHomeId(params) {
-	const agentId = resolveSessionAgentIds$1({
+function resolveCodexThreadAgentDir(params) {
+	const agentId = resolveSessionAgentIdsStrict({
 		config: params.params.config,
 		sessionKey: params.params.sessionKey,
 		agentId: params.agentId ?? params.params.agentId
 	}).sessionAgentId;
-	const agentDir = params.agentDir ?? params.params.agentDir ?? resolveAgentDir$1(params.params.config ?? {}, agentId);
-	return codexCatalogHomeId(resolveCodexAppServerLocalHomeDir(params.appServer.start, agentDir));
+	return params.agentDir ?? params.params.agentDir ?? resolveAgentDir$1(params.params.config ?? {}, agentId);
 }
 function resolveCodexThreadRolloutPath(thread) {
 	const rolloutPath = thread.path?.trim();
@@ -2630,6 +2633,8 @@ function resolveCodexThreadRolloutPath(thread) {
 async function resumeExistingCodexThread(params, context) {
 	const { binding: resumeBinding, bindingIdentity, startModelSelection, startModelProvider, userMcpServersConfigPatch, dynamicToolsFingerprint, dynamicToolsContainDeferred, webSearchThreadConfigFingerprint, nativeSkillIsolationFingerprint, userMcpServersFingerprint, ringZeroConfigFingerprint, ringZeroClientInstanceId, networkProxyConfigFingerprint, contextEngineBinding, environmentSelectionFingerprint, hostSystemAgentActive, ringZeroActive, restrictedToolSurface, restrictedToolSurfaceInheritedMcpServerNames, nativeSkillIsolation, lifecycleTiming, normalizeBindingModelProvider, throwIfAborted, clearCurrentBinding } = context;
 	let resumeReservation;
+	let resumeResponseAccepted = false;
+	const abandonClient = params.abandonClient ?? (() => closeCodexStartupClientBestEffort(params.client));
 	try {
 		const authProfileId = resumeBinding.connectionScope === "supervision" ? void 0 : params.params.authProfileId ?? resumeBinding.authProfileId;
 		const finalConfigPatch = context.prebuiltFinalConfigPatch ?? params.buildFinalConfigPatch?.({
@@ -2663,25 +2668,29 @@ async function resumeExistingCodexThread(params, context) {
 		}));
 		const requestModelProvider = typeof resumeParams.modelProvider === "string" && resumeParams.modelProvider.trim() ? resumeParams.modelProvider : void 0;
 		throwIfAborted();
-		if (resumeBinding.preserveNativeModel === true) {
-			const current = await lifecycleTiming.measure("thread-read-adoption-status", () => params.client.request("thread/read", {
-				threadId: resumeBinding.threadId,
-				includeTurns: false
-			}, { signal: params.signal }));
-			throwIfAborted();
-			if (current.thread.status?.type === "active") throw new CodexAdoptedThreadActiveError();
-		}
 		resumeReservation = params.reserveResumeThread?.(resumeBinding.threadId);
 		const response = await lifecycleTiming.measure("thread-resume-request", () => resumeCodexAppServerThread({
 			client: params.client,
-			abandonClient: params.abandonClient ?? (() => closeCodexStartupClientBestEffort(params.client)),
+			abandonClient,
 			request: resumeParams,
-			signal: params.signal
+			signal: params.signal,
+			assertCurrent: context.assertResumeOwnership,
+			isPrewriteOwnershipError: (error) => error instanceof CodexAdoptedThreadActiveError
 		}));
+		resumeResponseAccepted = true;
+		assertCodexThreadAcceptsDirectInput(response.thread);
+		context.assertResumeConfiguration?.();
+		if (resumeBinding.pendingResumeConfiguration) await attestCodexPluginThreadApps({
+			client: params.client,
+			threadId: response.thread.id,
+			appIds: context.prebuiltPluginThreadConfig?.provisionalAppIds ?? [],
+			signal: params.signal
+		});
 		if (ringZeroActive || isMessageOnlyCodexSourceReply(params.params) || params.params.pluginHarnessToolPolicyRestricted === true) try {
 			await lifecycleTiming.measure("restricted-tool-surface-mcp-attestation", () => attestCodexRestrictedToolSurfaceMcpServersDisabled(params.client, response.thread.id, resumeParams.config, params.signal));
 		} catch (error) {
-			await (params.abandonClient ?? (() => closeCodexStartupClientBestEffort(params.client)))();
+			context.assertResumeOwnership?.();
+			await abandonClient();
 			throw new CodexRestrictedToolSurfaceAttestationError(error);
 		}
 		throwIfAborted();
@@ -2689,6 +2698,7 @@ async function resumeExistingCodexThread(params, context) {
 		const nextMcpServersFingerprint = params.mcpServersFingerprintEvaluated === true ? params.mcpServersFingerprint : resumeBinding.mcpServersFingerprint;
 		const resumePatch = {
 			clientId: resolveCodexAppServerClientInstanceId(params.client),
+			pendingResumeConfiguration: void 0,
 			cwd: params.cwd,
 			rolloutPath: resolveCodexThreadRolloutPath(response.thread) ?? resumeBinding.rolloutPath,
 			authProfileId: boundAuthProfileId,
@@ -2719,7 +2729,7 @@ async function resumeExistingCodexThread(params, context) {
 			kind: "patch",
 			threadId: resumeBinding.threadId,
 			patch: resumePatch
-		}))) throw new CodexThreadBindingConflictError(resumeBinding.threadId, "committing a resumed thread");
+		}, context.assertResumeConfiguration))) throw new CodexThreadBindingConflictError(resumeBinding.threadId, "committing a resumed thread");
 		if (contextEngineBinding) embeddedAgentLog.info("codex app-server wrote context-engine thread binding", {
 			sessionId: params.params.sessionId,
 			sessionKey: params.params.sessionKey,
@@ -2756,19 +2766,26 @@ async function resumeExistingCodexThread(params, context) {
 		};
 	} catch (error) {
 		resumeReservation?.release();
-		if (isCodexAppServerStartSelectionChangedError(error)) throw error;
+		if (!resumeResponseAccepted && (!(error instanceof CodexAppServerRpcError) || isCodexAppServerOverloadError(error))) throw error;
 		if (error instanceof CodexRestrictedToolSurfaceAttestationError) {
-			await clearCurrentBinding("retiring a failed restricted-tool-surface attestation");
+			if (!resumeBinding.pendingResumeConfiguration) await clearCurrentBinding("retiring a failed restricted-tool-surface attestation");
 			throw error;
 		}
-		if (error instanceof CodexAdoptedThreadActiveError) throw error;
-		if (isCodexAppServerUnsafeSubscriptionError(error)) throw error;
-		const resumeRejected = error instanceof CodexAppServerRpcError;
-		if (!await unsubscribeCodexThreadBestEffort(params.client, {
-			threadId: resumeBinding.threadId,
-			timeoutMs: 5e3
-		}) && !resumeRejected && !isCodexAppServerConnectionClosedError(error) && !params.signal?.aborted) throw new CodexAppServerUnsafeSubscriptionError("Codex thread/resume subscription cleanup failed", { cause: error });
-		if (isCodexAppServerConnectionClosedError(error) || params.signal?.aborted) throw error;
+		if (resumeResponseAccepted) {
+			if (!await unsubscribeCodexThreadBestEffort(params.client, {
+				threadId: resumeBinding.threadId,
+				timeoutMs: 5e3,
+				assertCurrent: context.assertResumeOwnership
+			}).catch(() => false)) {
+				try {
+					await abandonClient();
+				} catch (abandonError) {
+					throw new CodexAppServerUnsafeSubscriptionError("Codex thread/resume client could not be retired", { cause: abandonError });
+				}
+				throw new CodexAppServerUnsafeSubscriptionError("Codex thread/resume subscription cleanup failed", { cause: error });
+			}
+		}
+		if (resumeBinding.pendingResumeConfiguration || error instanceof CodexThreadDirectInputError || params.signal?.aborted) throw error;
 		embeddedAgentLog.warn("codex app-server thread resume failed; starting a new thread", { error });
 		await clearCurrentBinding("rotating a stale thread binding");
 	}
@@ -2899,7 +2916,7 @@ async function startFreshCodexThread(params, context) {
 				throw new CodexAppServerUnsafeSubscriptionError("Codex successor cleanup failed after a binding replacement conflict", cause === void 0 ? void 0 : { cause });
 			}
 		};
-		const managedSourceHomeId = resolveManagedThreadSourceHomeId(params);
+		const managedSourceHomeId = codexCatalogHomeId(resolveCodexAppServerLocalHomeDir(params.appServer.start, resolveCodexThreadAgentDir(params)));
 		await lifecycleTiming.measure("thread-start-mark-managed", () => markStartedCodexManagedThread(params.bindingStore.managedThreads, {
 			sourceHomeId: managedSourceHomeId,
 			threadId: response.thread.id,
@@ -2958,6 +2975,603 @@ async function startFreshCodexThread(params, context) {
 	});
 }
 //#endregion
+//#region extensions/codex/src/app-server/thread-lifecycle-warm.ts
+/** Preserves the caller's abort reason across thread ownership transitions. */
+function throwIfCodexThreadLifecycleAborted(signal) {
+	if (!signal?.aborted) return;
+	const reason = signal.reason;
+	if (reason instanceof Error) throw reason;
+	const error = new Error(typeof reason === "string" && reason.length > 0 ? reason : "codex app-server thread lifecycle aborted");
+	error.name = "AbortError";
+	throw error;
+}
+/** Releases consumed subscription ownership or retires an unsafe client. */
+async function releaseCodexConsumedLiveThread(options) {
+	if (await options.lifecycleTiming.measure("retained-thread-unsubscribe", () => unsubscribeCodexThreadBestEffort(options.client, {
+		threadId: options.threadId,
+		timeoutMs: 5e3,
+		assertCurrent: options.assertCurrent
+	}))) return;
+	return await abandonCodexLiveThreadRelease(options, options.cause);
+}
+async function abandonCodexLiveThreadRelease(options, cause) {
+	options.assertCurrent?.();
+	await (options.abandonClient ?? (() => closeCodexStartupClientBestEffort(options.client)))();
+	throw new CodexAppServerUnsafeSubscriptionError(`Codex retained thread subscription could not be released: ${options.threadId}`, cause !== void 0 ? { cause } : void 0);
+}
+/** Releases through the retained owner, preserving its guarded callback and rollback. */
+async function releaseCodexRetainedLiveThread(options) {
+	try {
+		return await options.lifecycleTiming.measure("retained-thread-unsubscribe", () => releaseCodexAppServerLiveThread(options.client, options.threadId, options.assertCurrent));
+	} catch (error) {
+		if (isCodexAppServerUnsafeSubscriptionError(error)) throw error;
+		return await abandonCodexLiveThreadRelease(options, error);
+	}
+}
+/** Reuses one safely owned, fully matching subscription on its original client. */
+async function tryReuseCodexLiveThread(options) {
+	const { params, binding, bindingIdentity, clientId, dynamicToolsFingerprint, environmentSelectionFingerprint, hostSystemAgentActive, lifecycleTiming, nativeSkillIsolation, releaseConsumedThread, ringZeroActive, restrictedToolSurfaceInheritedMcpServerNames, startModelProvider, startModelSelection, throwIfAborted, userMcpServersConfigPatch } = options;
+	if (!binding.clientId || binding.clientId !== clientId || binding.preserveNativeModel === true || binding.connectionScope === "supervision" || ringZeroActive) return {};
+	const prebuiltFinalConfigPatch = params.buildFinalConfigPatch?.({
+		action: "resume",
+		binding
+	}) ?? {
+		configPatch: params.finalConfigPatch,
+		nativeHookRelayGeneration: params.nativeHookRelayGeneration
+	};
+	const pluginAppsConfigPatch = params.pluginThreadConfig?.enabled && binding.pluginAppPolicyContext ? buildCodexPluginAppsConfigPatchFromPolicyContext(binding.pluginAppPolicyContext) : void 0;
+	const resumeAuthProfileId = params.params.authProfileId ?? binding.authProfileId;
+	const resumeConfig = mergeCodexThreadConfigs(params.config, userMcpServersConfigPatch, pluginAppsConfigPatch, prebuiltFinalConfigPatch.configPatch);
+	const resumeParams = lifecycleTiming.measureSync("warm-thread-resume-params", () => buildThreadResumeParams(params.params, {
+		threadId: binding.threadId,
+		cwd: params.cwd,
+		authProfileId: resumeAuthProfileId,
+		model: startModelSelection.model,
+		modelProvider: startModelProvider,
+		preserveNativeModel: false,
+		appServer: params.appServer,
+		dynamicTools: params.dynamicTools,
+		developerInstructions: params.developerInstructions,
+		config: applyCodexNativeSkillIsolation(resumeConfig, nativeSkillIsolation),
+		nativeCodeModeEnabled: params.nativeCodeModeEnabled,
+		nativeProviderWebSearchSupport: params.nativeProviderWebSearchSupport,
+		nativeCodeModeOnlyEnabled: params.nativeCodeModeOnlyEnabled,
+		webSearchAllowed: params.webSearchAllowed,
+		hostSystemAgentActive,
+		restrictedToolSurfaceInheritedMcpServerNames,
+		shellEnvironment: params.shellEnvironment,
+		disableLoginShell: params.disableLoginShell
+	}));
+	const liveThreadConfigFingerprint = fingerprintCodexThreadConfig({
+		...resumeParams,
+		model: binding.model ?? resumeParams.model ?? null,
+		requestedModel: resumeParams.model ?? null,
+		modelProvider: binding.modelProvider ?? resumeParams.modelProvider ?? null,
+		requestedModelProvider: resumeParams.modelProvider ?? binding.modelProvider ?? null
+	}, resumeAuthProfileId, dynamicToolsFingerprint);
+	const retainedThread = await consumeCodexAppServerLiveThread(params.client, binding.threadId, liveThreadConfigFingerprint);
+	if (!retainedThread) {
+		const incompatibleOwnership = await consumeCodexAppServerLiveThread(params.client, binding.threadId);
+		if (incompatibleOwnership) await incompatibleOwnership.release(binding.threadId);
+		return { prebuiltFinalConfigPatch };
+	}
+	try {
+		const nativeHookRelayGeneration = prebuiltFinalConfigPatch.nativeHookRelayGeneration ?? binding.nativeHookRelayGeneration;
+		const model = startModelSelection.model;
+		if (!await lifecycleTiming.measure("warm-thread-write-binding", () => params.bindingStore.mutate(bindingIdentity, {
+			kind: "patch",
+			threadId: binding.threadId,
+			patch: {
+				cwd: params.cwd,
+				model,
+				nativeHookRelayGeneration,
+				environmentSelectionFingerprint
+			}
+		}))) throw new CodexThreadBindingConflictError(binding.threadId, "committing a reused thread");
+		throwIfAborted();
+		lifecycleTiming.mark("thread-ready");
+		lifecycleTiming.logSummary({
+			runId: params.params.runId,
+			sessionId: params.params.sessionId,
+			sessionKey: params.params.sessionKey,
+			threadId: binding.threadId,
+			action: "resumed"
+		});
+		return {
+			binding: {
+				...binding,
+				cwd: params.cwd,
+				model,
+				nativeHookRelayGeneration,
+				environmentSelectionFingerprint,
+				liveThreadConfigFingerprint,
+				liveThreadOwnership: retainedThread,
+				...retainedThread.serviceTier && resumeParams.serviceTier === void 0 ? { clearInheritedServiceTier: true } : {},
+				lifecycle: { action: "resumed" }
+			},
+			prebuiltFinalConfigPatch
+		};
+	} catch (error) {
+		await releaseConsumedThread(binding.threadId, error);
+		throw error;
+	}
+}
+//#endregion
+//#region extensions/codex/src/app-server/thread-lifecycle-adoption.ts
+/** Passive refusal must precede releasing or acquiring any native subscription. */
+async function assertAdoptedCodexThreadResumeAllowed(params, threadId, context) {
+	const { thread } = await context.lifecycleTiming.measure("thread-read-adoption-status", () => params.client.request("thread/read", {
+		threadId,
+		includeTurns: false
+	}, { signal: params.signal }));
+	context.throwIfAborted();
+	assertCodexThreadAcceptsDirectInput(thread);
+	if (thread.status?.type === "active") throw new CodexAdoptedThreadActiveError();
+}
+/** Preserve attach's native-queue-before-binding-lease order when consuming pending intent. */
+async function withCodexThreadLifecycleBinding(params, run) {
+	const identity = sessionBindingIdentity({
+		sessionId: params.params.sessionId,
+		sessionKey: params.params.sessionKey,
+		agentId: params.agentId ?? params.params.agentId,
+		config: params.params.config
+	});
+	const snapshot = await params.bindingStore.read(identity);
+	const pendingThreadId = snapshot?.pendingResumeConfiguration ? snapshot.threadId : void 0;
+	const runWithLease = () => params.bindingStore.withLease(identity, async () => {
+		const binding = await params.bindingStore.read(identity);
+		if (pendingThreadId && (binding?.threadId !== pendingThreadId || !binding.pendingResumeConfiguration)) throw new CodexThreadBindingConflictError(pendingThreadId, "acquiring a pending resume configuration");
+		if (!pendingThreadId && binding?.pendingResumeConfiguration) throw new CodexThreadBindingConflictError(binding.threadId, "acquiring a pending resume configuration");
+		return await run(identity, binding);
+	});
+	return pendingThreadId ? await withExclusiveCodexAppServerThread({
+		bindingStore: params.bindingStore,
+		identity,
+		threadId: pendingThreadId,
+		run: runWithLease
+	}) : await runWithLease();
+}
+/** Completes manual attachment only under the native queue and exact binding lease. */
+async function resumePendingCodexThread(params, context) {
+	const { binding, contextEngineBinding, lifecycleTiming, restrictedToolSurface } = context;
+	if (isIncognitoSessionKey(params.params.sessionKey) || context.transientRestriction || !restrictedToolSurface && binding.nativeToolPolicyRestricted === true || (contextEngineBinding ? !isContextEngineBindingCompatible(binding.contextEngine, contextEngineBinding) : binding.contextEngine !== void 0) || shouldRotateCodexGpt56MultiAgentBinding({
+		bindingModel: binding.model,
+		requestedModel: params.params.modelId
+	})) throw new Error(`Cannot configure resumed Codex thread ${binding.threadId} under a transient or incompatible session policy. The thread is preserved; retry from its normal session or use /new for the current policy.`);
+	const prebuiltPluginThreadConfig = params.pluginThreadConfig?.enabled ? await lifecycleTiming.measure("plugin-config-build", () => params.pluginThreadConfig?.build()) : void 0;
+	const clientId = resolveCodexAppServerClientInstanceId(params.client);
+	const configuration = await preparePendingCodexThreadResume(params, binding, context.dynamicToolsFingerprint, async (assertCurrent) => {
+		const released = await context.releaseRetainedThread(binding.threadId, assertCurrent);
+		assertCurrent();
+		if (!released || binding.clientId && binding.clientId !== clientId) await releaseCodexConsumedLiveThread({
+			client: params.client,
+			abandonClient: params.abandonClient,
+			lifecycleTiming,
+			threadId: binding.threadId,
+			assertCurrent
+		});
+	});
+	try {
+		const resumed = await resumeExistingCodexThread(params, {
+			...context,
+			prebuiltPluginThreadConfig,
+			assertResumeConfiguration: configuration.assertConfigured,
+			assertResumeOwnership: configuration.assertCurrent
+		});
+		if (!resumed) throw new Error(`Codex did not configure resumed thread ${binding.threadId}.`);
+		return resumed;
+	} finally {
+		configuration.dispose();
+	}
+}
+/** Manual attachment is intent, never evidence that loaded native overrides took effect. */
+async function preparePendingCodexThreadResume(params, binding, dynamicToolsFingerprint, releaseSubscription) {
+	const fail = (reason) => /* @__PURE__ */ new Error(`Cannot configure resumed Codex thread ${binding.threadId}: ${reason}. The thread is preserved; continue it in native Codex or use /new for the current OpenClaw tools.`);
+	const agentDir = resolveCodexThreadAgentDir(params);
+	const localHome = resolveCodexAppServerLocalHomeDir(params.appServer.start, agentDir);
+	if (params.appServer.start.transport !== "stdio" || params.appServer.start.homeScope === "user" || path.resolve(localHome) !== resolveCodexAppServerHomeDir(agentDir) || binding.connectionScope === "supervision" || binding.preserveNativeModel === true) throw fail("configuration adoption requires an OpenClaw-owned local Codex home");
+	if (isCodexAppServerLiveThreadClaimed(params.client, binding.threadId)) throw fail("the thread is claimed by active work; stop that run before resuming");
+	const assertCurrent = captureExclusiveSharedCodexAppServerClient(params.client);
+	const { thread } = await params.client.request("thread/read", {
+		threadId: binding.threadId,
+		includeTurns: false
+	}, { signal: params.signal });
+	assertCurrent();
+	const statusType = thread.status?.type;
+	if (thread.id !== binding.threadId || statusType !== "idle" && statusType !== "notLoaded") throw fail("the native thread is not idle; wait for its current run to finish");
+	assertCodexThreadAcceptsDirectInput(thread);
+	let unloaded = statusType === "notLoaded";
+	const dispose = params.client.addNotificationHandler((notification) => {
+		if (notification.method === "thread/status/changed" && isJsonObject(notification.params) && notification.params.threadId === binding.threadId && isJsonObject(notification.params.status) && notification.params.status.type === "notLoaded") unloaded = true;
+	});
+	try {
+		const rolloutPath = thread.path ?? binding.rolloutPath;
+		const metadata = rolloutPath ? await readCodexSessionMeta(path.join(localHome, "sessions"), rolloutPath, binding.threadId) : void 0;
+		if (!metadata) throw fail("its native tool catalog could not be read from the selected Codex home");
+		const recordedTools = metadata.dynamic_tools ?? [];
+		if (!Array.isArray(recordedTools) || codexDynamicToolsFingerprint(recordedTools) !== dynamicToolsFingerprint) throw fail("its immutable native tool catalog does not match the current OpenClaw tools");
+		assertCurrent();
+		await releaseSubscription(assertCurrent);
+		assertCurrent();
+		return {
+			assertConfigured: () => {
+				assertCurrent();
+				if (!unloaded) throw fail("Codex did not confirm unloading its previous configuration");
+			},
+			assertCurrent,
+			dispose
+		};
+	} catch (error) {
+		dispose();
+		throw error;
+	}
+}
+//#endregion
+//#region extensions/codex/src/app-server/native-hook-relay-state.ts
+const pending = /* @__PURE__ */ new Set();
+/** Owns delayed hook-relay cleanup across runtime scheduling and test teardown. */
+const nativeHookRelayUnregisterQueue = {
+	add(entry) {
+		pending.add(entry);
+	},
+	delete(entry) {
+		return pending.delete(entry);
+	},
+	flush() {
+		while (pending.size > 0) {
+			const entry = pending.values().next().value;
+			if (!entry) return;
+			clearTimeout(entry.timeout);
+			entry.unregister();
+		}
+	},
+	clear() {
+		for (const entry of pending) clearTimeout(entry.timeout);
+		pending.clear();
+	}
+};
+//#endregion
+//#region extensions/codex/src/app-server/native-hook-relay.ts
+/**
+* Bridges Codex native hook callbacks into OpenClaw's native hook relay so
+* app-server tool events can still run OpenClaw policy and diagnostics.
+*/
+/** Codex hook events that can be registered through OpenClaw's native relay. */
+const CODEX_NATIVE_HOOK_RELAY_EVENTS = [
+	"pre_tool_use",
+	"post_tool_use",
+	"permission_request",
+	"before_agent_finalize"
+];
+const CODEX_NATIVE_HOOK_RELAY_EVENTS_WITH_APP_SERVER_APPROVALS = CODEX_NATIVE_HOOK_RELAY_EVENTS.filter((event) => event !== "permission_request");
+const CODEX_NATIVE_HOOK_RELAY_MIN_TTL_MS = 30 * 6e4;
+/** Extra relay lifetime after the expected turn budget, preventing late hook drops. */
+const CODEX_NATIVE_HOOK_RELAY_TTL_GRACE_MS = 5 * 6e4;
+const CODEX_NATIVE_HOOK_RELAY_COMMAND_MIN_PARENT_MARGIN_MS = 250;
+const CODEX_NATIVE_HOOK_RELAY_COMMAND_MAX_PARENT_MARGIN_MS = 1e3;
+const CODEX_NATIVE_HOOK_RELAY_DEFAULT_TIMEOUT_SEC = 10;
+const CODEX_NATIVE_HOOK_RELAY_UNREGISTER_GRACE_MS = 1e4;
+const CODEX_NATIVE_HOOK_RELAY_UNREGISTER_EXTRA_GRACE_MS = 5e3;
+const MAX_PENDING_DIRECT_CHILD_ADMISSIONS = 32;
+const nativeHookPolicyByClient = /* @__PURE__ */ new WeakMap();
+const CODEX_HOOK_MATCHER_NAMES_BY_TOOL_ID = {
+	exec: [
+		"Bash",
+		"exec",
+		"exec_command"
+	],
+	apply_patch: [
+		"apply_patch",
+		"Write",
+		"Edit"
+	],
+	spawn_agent: ["spawn_agent", "Agent"]
+};
+/** Enterprise managed-only policy silently drops the session-layer hooks that enforce OpenClaw. */
+async function assertCodexNativeHookRelayAllowed(client, signal) {
+	let attestation = nativeHookPolicyByClient.get(client);
+	if (!attestation) {
+		attestation = client.request("configRequirements/read", void 0, { signal }).then((response) => {
+			if (!isJsonObject(response) || !Object.hasOwn(response, "requirements")) throw new Error("Codex configRequirements/read returned an invalid hook policy response");
+			const requirements = response.requirements;
+			if (requirements === null) return;
+			if (!isJsonObject(requirements)) throw new Error("Codex configRequirements/read returned invalid hook policy requirements");
+			const managedOnly = requirements.allowManagedHooksOnly;
+			if (managedOnly !== void 0 && managedOnly !== null && typeof managedOnly !== "boolean") throw new Error("Codex configRequirements/read returned invalid managed-only hook policy");
+			if (managedOnly === true) throw new Error("Codex managed-only hooks disable the OpenClaw native hook relay; refusing unenforced execution");
+		});
+		nativeHookPolicyByClient.set(client, attestation);
+		attestation.catch(() => {
+			if (nativeHookPolicyByClient.get(client) === attestation) nativeHookPolicyByClient.delete(client);
+		});
+	}
+	await attestation;
+}
+/** Defers relay unregister so late native hook subprocesses can still resolve. */
+function scheduleCodexNativeHookRelayUnregister(params) {
+	let pending;
+	const unregister = () => {
+		if (!pending) return;
+		const current = pending;
+		pending = void 0;
+		if (!nativeHookRelayUnregisterQueue.delete(current)) return;
+		params.relay.unregister();
+	};
+	const timeout = setTimeout(unregister, resolveCodexNativeHookRelayUnregisterGraceMs(params.hookTimeoutSec));
+	pending = {
+		timeout,
+		unregister
+	};
+	nativeHookRelayUnregisterQueue.add(pending);
+	timeout.unref();
+}
+/** Computes the delayed unregister window from Codex's hook timeout. */
+function resolveCodexNativeHookRelayUnregisterGraceMs(hookTimeoutSec) {
+	const hookTimeoutMs = finiteSecondsToTimerSafeMilliseconds(normalizeHookTimeoutSec(hookTimeoutSec)) ?? 0;
+	return Math.max(CODEX_NATIVE_HOOK_RELAY_UNREGISTER_GRACE_MS, addTimerTimeoutGraceMs(hookTimeoutMs, CODEX_NATIVE_HOOK_RELAY_UNREGISTER_EXTRA_GRACE_MS) ?? 0);
+}
+/** Records a native pre-tool failure that Codex does not project as a tool item. */
+function emitCodexNativePreToolUseFailureDiagnostic(params) {
+	emitTrustedDiagnosticEvent({
+		type: "tool.execution.error",
+		...params.agentId ? { agentId: params.agentId } : {},
+		sessionId: params.sessionId,
+		...params.sessionKey ? { sessionKey: params.sessionKey } : {},
+		runId: params.runId,
+		toolName: params.failure.toolName,
+		toolCallId: params.failure.toolCallId,
+		durationMs: params.failure.durationMs,
+		errorCategory: "before_tool_call",
+		terminalReason: params.terminalReason ?? (params.signal?.aborted ? resolveCodexToolAbortTerminalReason(params.signal) : params.failure.disposition),
+		...params.sourceTimestampMs !== void 0 ? { sourceTimestampMs: params.sourceTimestampMs } : {}
+	});
+}
+/** Registers an OpenClaw native hook relay for a Codex app-server turn. */
+function createCodexNativeHookRelay(params) {
+	if (params.options?.enabled === false) return;
+	const directChildClaims = /* @__PURE__ */ new Map();
+	const pendingDirectChildAdmissions = /* @__PURE__ */ new Map();
+	let foregroundClosed = false;
+	let successfulYieldRetentionAuthorized = false;
+	const assertClaim = (threadId, claim) => () => directChildClaims.get(threadId) === claim;
+	const rejectPendingAdmissions = (reason) => {
+		for (const pending of pendingDirectChildAdmissions.values()) pending.reject(new Error(reason));
+		pendingDirectChildAdmissions.clear();
+	};
+	const relay = registerRetainedNativeHookRelayForBundledRuntime({
+		provider: "codex",
+		relayId: buildCodexNativeHookRelayId({
+			agentId: params.agentId,
+			sessionId: params.sessionId,
+			sessionKey: params.sessionKey
+		}),
+		...params.generation ? { generation: params.generation } : {},
+		...params.generationMismatchGraceMs ? { generationMismatchGraceMs: params.generationMismatchGraceMs } : {},
+		...params.agentId ? { agentId: params.agentId } : {},
+		sessionId: params.sessionId,
+		...params.sessionKey ? { sessionKey: params.sessionKey } : {},
+		...params.config ? { config: params.config } : {},
+		runId: params.runId,
+		...params.channelId ? { channelId: params.channelId } : {},
+		...params.requester ? { requester: params.requester } : {},
+		...params.approvalContext ? { approvalContext: params.approvalContext } : {},
+		allowedEvents: params.events,
+		preToolUseLoopDetection: params.loopDetectionPreToolUseRelay,
+		ttlMs: resolveCodexNativeHookRelayTtlMs({
+			explicitTtlMs: params.options?.ttlMs,
+			attemptTimeoutMs: params.attemptTimeoutMs,
+			startupTimeoutMs: params.startupTimeoutMs,
+			turnStartTimeoutMs: params.turnStartTimeoutMs
+		}),
+		signal: params.signal,
+		runBeforeToolCall: params.hostCapabilities.runBeforeToolCall,
+		assertActive: params.hostCapabilities.assertActive,
+		retention: {
+			readClaim: readCodexNativeChildThreadId,
+			shouldRetainAfterForegroundClose: () => successfulYieldRetentionAuthorized && directChildClaims.size > 0,
+			allowPreToolUse: (childThreadId) => directChildClaims.has(childThreadId),
+			awaitForegroundAdmission: (childThreadId) => {
+				if (foregroundClosed) return Promise.reject(/* @__PURE__ */ new Error("native hook relay foreground admission unavailable"));
+				const existingClaim = directChildClaims.get(childThreadId);
+				if (existingClaim) return Promise.resolve(assertClaim(childThreadId, existingClaim));
+				const existingPending = pendingDirectChildAdmissions.get(childThreadId);
+				if (existingPending) return existingPending.promise.then((claim) => assertClaim(childThreadId, claim));
+				if (pendingDirectChildAdmissions.size >= MAX_PENDING_DIRECT_CHILD_ADMISSIONS) return Promise.reject(/* @__PURE__ */ new Error("native hook relay foreground admission capacity reached"));
+				const { promise, resolve, reject } = createDeferred();
+				pendingDirectChildAdmissions.set(childThreadId, {
+					promise,
+					resolve,
+					reject
+				});
+				return promise.then((claim) => assertClaim(childThreadId, claim));
+			},
+			onDispose: () => {
+				foregroundClosed = true;
+				rejectPendingAdmissions("native hook relay registration closed");
+			}
+		},
+		onPreToolUseFailure: params.onPreToolUseFailure,
+		command: {
+			nice: 10,
+			timeoutMs: params.options?.gatewayTimeoutMs
+		}
+	});
+	const unregister = () => {
+		foregroundClosed = true;
+		rejectPendingAdmissions("native hook relay foreground closed");
+		relay.unregister();
+	};
+	return {
+		...relay,
+		unregister,
+		authorizeRetentionAfterSuccessfulYield: () => {
+			successfulYieldRetentionAuthorized = true;
+		},
+		hasClaimedDirectChild: () => directChildClaims.size > 0,
+		rejectPendingDirectChild: (threadIdInput, reason) => {
+			const threadId = threadIdInput.trim();
+			const pending = threadId ? pendingDirectChildAdmissions.get(threadId) : void 0;
+			if (!pending) return;
+			pendingDirectChildAdmissions.delete(threadId);
+			pending.reject(new Error(reason));
+		},
+		claimDirectChild: (threadIdInput) => {
+			const threadId = threadIdInput.trim();
+			if (!threadId) return () => void 0;
+			if (directChildClaims.get(threadId)) return () => void 0;
+			const claim = Symbol(threadId);
+			directChildClaims.set(threadId, claim);
+			const pending = pendingDirectChildAdmissions.get(threadId);
+			pendingDirectChildAdmissions.delete(threadId);
+			pending?.resolve(claim);
+			let released = false;
+			return () => {
+				if (released) return;
+				released = true;
+				if (directChildClaims.get(threadId) !== claim) return;
+				directChildClaims.delete(threadId);
+				if (foregroundClosed && directChildClaims.size === 0) relay.unregister();
+			};
+		}
+	};
+}
+function readCodexNativeChildThreadId(rawPayload) {
+	if (!isJsonObject(rawPayload) || typeof rawPayload.agent_id !== "string") return;
+	return rawPayload.agent_id.trim() || void 0;
+}
+/** Selects the native hook events Codex should install for the current approval mode. */
+function resolveCodexNativeHookRelayEvents(params) {
+	if (params.configuredEvents?.length) return params.configuredEvents;
+	return params.appServer.approvalPolicy === "never" ? CODEX_NATIVE_HOOK_RELAY_EVENTS : CODEX_NATIVE_HOOK_RELAY_EVENTS_WITH_APP_SERVER_APPROVALS;
+}
+/** Derives the native hook relay TTL from the turn budget unless explicitly configured. */
+function resolveCodexNativeHookRelayTtlMs(params) {
+	if (params.explicitTtlMs !== void 0) return params.explicitTtlMs;
+	const relayBudgetMs = params.attemptTimeoutMs + params.startupTimeoutMs + params.turnStartTimeoutMs + CODEX_NATIVE_HOOK_RELAY_TTL_GRACE_MS;
+	return Math.max(CODEX_NATIVE_HOOK_RELAY_MIN_TTL_MS, Math.floor(relayBudgetMs));
+}
+/** Builds a stable relay id scoped to the agent and session identity. */
+function buildCodexNativeHookRelayId(params) {
+	const hash = createHash("sha256");
+	hash.update("openclaw:codex:native-hook-relay:v1");
+	hash.update("\0");
+	hash.update(params.agentId?.trim() || "");
+	hash.update("\0");
+	hash.update(params.sessionKey?.trim() || params.sessionId);
+	return `codex-${hash.digest("hex").slice(0, 40)}`;
+}
+const CODEX_HOOK_EVENT_BY_NATIVE_EVENT = {
+	pre_tool_use: "PreToolUse",
+	post_tool_use: "PostToolUse",
+	permission_request: "PermissionRequest",
+	before_agent_finalize: "Stop"
+};
+const CODEX_HOOK_KEY_LABEL_BY_NATIVE_EVENT = {
+	pre_tool_use: "pre_tool_use",
+	post_tool_use: "post_tool_use",
+	permission_request: "permission_request",
+	before_agent_finalize: "stop"
+};
+const CODEX_SESSION_FLAGS_HOOK_SOURCE_PATHS = ["/<session-flags>/config.toml", "<session-flags>/config.toml"];
+/** Builds the Codex config overlay that installs trusted command hooks for relay events. */
+function buildCodexNativeHookRelayConfig(params) {
+	const events = params.events?.length ? params.events : CODEX_NATIVE_HOOK_RELAY_EVENTS;
+	const selectedEvents = new Set(events);
+	const config = { "features.hooks": true };
+	const hookState = {};
+	for (const event of CODEX_NATIVE_HOOK_RELAY_EVENTS) {
+		const codexEvent = CODEX_HOOK_EVENT_BY_NATIVE_EVENT[event];
+		const selected = selectedEvents.has(event);
+		const shouldRelay = params.relay.shouldRelayEvent(event);
+		if (!selected || !shouldRelay) {
+			if (selected || params.clearOmittedEvents) config[`hooks.${codexEvent}`] = [];
+			if (params.clearOmittedEvents) for (const sourcePath of CODEX_SESSION_FLAGS_HOOK_SOURCE_PATHS) hookState[`${sourcePath}:${CODEX_HOOK_KEY_LABEL_BY_NATIVE_EVENT[event]}:0:0`] = { enabled: false };
+			continue;
+		}
+		const timeout = normalizeHookTimeoutSec(params.hookTimeoutSec);
+		const command = params.relay.commandForEvent(event, { timeoutMs: resolveCodexNativeHookRelayCommandTimeoutMs(timeout) });
+		const matcher = buildCodexNativeToolMatcher(params.relay.toolMatcherForEvent(event));
+		config[`hooks.${codexEvent}`] = [{
+			...matcher ? { matcher } : {},
+			hooks: [{
+				type: "command",
+				command,
+				timeout,
+				async: false,
+				statusMessage: "OpenClaw native hook relay"
+			}]
+		}];
+		const state = {
+			enabled: true,
+			trusted_hash: codexCommandHookTrustedHash({
+				event,
+				command,
+				matcher,
+				timeout,
+				statusMessage: "OpenClaw native hook relay"
+			})
+		};
+		for (const sourcePath of CODEX_SESSION_FLAGS_HOOK_SOURCE_PATHS) hookState[`${sourcePath}:${CODEX_HOOK_KEY_LABEL_BY_NATIVE_EVENT[event]}:0:0`] = state;
+	}
+	config["hooks.state"] = hookState;
+	return config;
+}
+/** Builds a Codex config overlay that disables native hooks and clears hook arrays. */
+function buildCodexNativeHookRelayDisabledConfig() {
+	return {
+		"features.hooks": false,
+		"hooks.PreToolUse": [],
+		"hooks.PostToolUse": [],
+		"hooks.PermissionRequest": [],
+		"hooks.Stop": []
+	};
+}
+function normalizeHookTimeoutSec(value) {
+	return typeof value === "number" && Number.isFinite(value) && value > 0 ? Math.ceil(value) : CODEX_NATIVE_HOOK_RELAY_DEFAULT_TIMEOUT_SEC;
+}
+function resolveCodexNativeHookRelayCommandTimeoutMs(hookTimeoutSec) {
+	const parentTimeoutMs = finiteSecondsToTimerSafeMilliseconds(normalizeHookTimeoutSec(hookTimeoutSec)) ?? 5e3;
+	const parentMarginMs = Math.min(CODEX_NATIVE_HOOK_RELAY_COMMAND_MAX_PARENT_MARGIN_MS, Math.max(CODEX_NATIVE_HOOK_RELAY_COMMAND_MIN_PARENT_MARGIN_MS, Math.floor(parentTimeoutMs / 5)));
+	return Math.max(1, parentTimeoutMs - parentMarginMs);
+}
+function buildCodexNativeToolMatcher(toolNames) {
+	if (toolNames === void 0) return;
+	if (toolNames.length === 0) throw new TypeError("Codex native hook matcher requires at least one tool name");
+	const nativeNames = /* @__PURE__ */ new Set();
+	let hasCustomToolName = false;
+	for (const toolName of toolNames) {
+		const canonicalToolName = toolName.trim();
+		if (!canonicalToolName || canonicalToolName === "*") throw new TypeError("Codex native hook matcher requires canonical OpenClaw tool ids");
+		const nativeAliases = CODEX_HOOK_MATCHER_NAMES_BY_TOOL_ID[canonicalToolName];
+		if (!nativeAliases) hasCustomToolName = true;
+		for (const nativeName of nativeAliases ?? [canonicalToolName]) nativeNames.add(nativeName);
+	}
+	const sortedNames = Array.from(nativeNames).toSorted();
+	if (!hasCustomToolName && sortedNames.every((toolName) => /^[A-Za-z0-9_]+$/.test(toolName))) return sortedNames.join("|");
+	return `(?i)^(?:${sortedNames.map((toolName) => toolName.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|")})$`;
+}
+function codexCommandHookTrustedHash(params) {
+	const identity = {
+		event_name: CODEX_HOOK_KEY_LABEL_BY_NATIVE_EVENT[params.event],
+		...params.matcher ? { matcher: params.matcher } : {},
+		hooks: [{
+			async: false,
+			command: params.command,
+			statusMessage: params.statusMessage,
+			timeout: params.timeout,
+			type: "command"
+		}]
+	};
+	return `sha256:${createHash("sha256").update(JSON.stringify(sortJsonValue(identity))).digest("hex")}`;
+}
+function sortJsonValue(value) {
+	if (!value || typeof value !== "object") return value;
+	if (Array.isArray(value)) return value.map(sortJsonValue);
+	const sorted = {};
+	for (const [key, entry] of Object.entries(value).toSorted(([left], [right]) => left.localeCompare(right))) sorted[key] = sortJsonValue(entry);
+	return sorted;
+}
+//#endregion
 //#region extensions/codex/src/app-server/profiler-flag.ts
 const PROFILER_FLAGS = ["profiler", "codex.profiler"];
 /** Checks the generic and Codex-specific profiler diagnostic flags. */
@@ -3056,6 +3670,13 @@ function createCodexThreadLifecycleTimingTracker(options = {}) {
 //#endregion
 //#region extensions/codex/src/app-server/thread-lifecycle-preflight.ts
 async function prepareCodexThreadLifecyclePreflight(params) {
+	await assertCodexModelBackedReviewerEffectiveConfig({
+		client: params.client,
+		approvalsReviewer: params.appServer.approvalsReviewer,
+		cwd: params.cwd,
+		signal: params.signal
+	});
+	if (params.nativeHookRelayRequired) await assertCodexNativeHookRelayAllowed(params.client, params.signal);
 	const lifecycleTiming = createCodexThreadLifecycleTimingTracker({
 		...params.timing,
 		enabled: params.timing?.enabled ?? isCodexAppServerProfilerEnabled(params.params.config)
@@ -3072,11 +3693,12 @@ async function prepareCodexThreadLifecyclePreflight(params) {
 	})).threadConfig);
 	const networkProxyConfigFingerprint = params.appServer.networkProxy?.configFingerprint;
 	const contextEngineBinding = lifecycleTiming.measureSync("context-engine-binding", () => buildContextEngineBinding(params.params, params.contextEngineProjection));
-	const userMcpServersConfigPatch = params.userMcpServersEnabled === false ? void 0 : await buildCodexUserMcpServersThreadConfigPatchForRuntime(params.params.config, {
+	const userMcpServersConfigPatch = params.userMcpServersEnabled === false ? void 0 : await buildCodexUserMcpServersThreadConfigPatchForRun({
+		run: params.params,
+		cwd: params.cwd,
 		agentId: params.agentId ?? params.params.agentId,
-		agentDir: params.params.agentDir,
 		allowLiteralOAuthProjection: params.appServer.connectionClass !== "remote",
-		toolOverrides: params.params.toolOverrides,
+		warn: (message) => embeddedAgentLog.warn(message),
 		onServerUnavailable: (serverName, error) => embeddedAgentLog.warn("skipping unavailable MCP OAuth server", {
 			serverName,
 			error: formatErrorMessage(error)
@@ -3136,118 +3758,6 @@ async function prepareCodexThreadLifecyclePreflight(params) {
 	};
 }
 //#endregion
-//#region extensions/codex/src/app-server/thread-lifecycle-warm.ts
-/** Preserves the caller's abort reason across thread ownership transitions. */
-function throwIfCodexThreadLifecycleAborted(signal) {
-	if (!signal?.aborted) return;
-	const reason = signal.reason;
-	if (reason instanceof Error) throw reason;
-	const error = new Error(typeof reason === "string" && reason.length > 0 ? reason : "codex app-server thread lifecycle aborted");
-	error.name = "AbortError";
-	throw error;
-}
-/** Releases consumed subscription ownership or retires an unsafe client. */
-async function releaseCodexConsumedLiveThread(options) {
-	if (await options.lifecycleTiming.measure("retained-thread-unsubscribe", () => unsubscribeCodexThreadBestEffort(options.client, {
-		threadId: options.threadId,
-		timeoutMs: 5e3
-	}))) return;
-	await (options.abandonClient ?? (() => closeCodexStartupClientBestEffort(options.client)))();
-	throw new CodexAppServerUnsafeSubscriptionError(`Codex retained thread subscription could not be released: ${options.threadId}`, options.cause !== void 0 ? { cause: options.cause } : void 0);
-}
-/** Transfers retained-slot ownership before unconditionally releasing it. */
-async function releaseCodexRetainedLiveThread(options) {
-	if (await consumeCodexAppServerLiveThread(options.client, options.threadId)) await releaseCodexConsumedLiveThread(options);
-}
-/** Reuses one safely owned, fully matching subscription on its original client. */
-async function tryReuseCodexLiveThread(options) {
-	const { params, binding, bindingIdentity, clientId, dynamicToolsFingerprint, environmentSelectionFingerprint, hostSystemAgentActive, lifecycleTiming, nativeSkillIsolation, releaseConsumedThread, ringZeroActive, restrictedToolSurfaceInheritedMcpServerNames, startModelProvider, startModelSelection, throwIfAborted, userMcpServersConfigPatch } = options;
-	if (!binding.clientId || binding.clientId !== clientId || binding.preserveNativeModel === true || binding.connectionScope === "supervision" || ringZeroActive) return {};
-	const prebuiltFinalConfigPatch = params.buildFinalConfigPatch?.({
-		action: "resume",
-		binding
-	}) ?? {
-		configPatch: params.finalConfigPatch,
-		nativeHookRelayGeneration: params.nativeHookRelayGeneration
-	};
-	const pluginAppsConfigPatch = params.pluginThreadConfig?.enabled && binding.pluginAppPolicyContext ? buildCodexPluginAppsConfigPatchFromPolicyContext(binding.pluginAppPolicyContext) : void 0;
-	const resumeAuthProfileId = params.params.authProfileId ?? binding.authProfileId;
-	const resumeConfig = mergeCodexThreadConfigs(params.config, userMcpServersConfigPatch, pluginAppsConfigPatch, prebuiltFinalConfigPatch.configPatch);
-	const resumeParams = lifecycleTiming.measureSync("warm-thread-resume-params", () => buildThreadResumeParams(params.params, {
-		threadId: binding.threadId,
-		cwd: params.cwd,
-		authProfileId: resumeAuthProfileId,
-		model: startModelSelection.model,
-		modelProvider: startModelProvider,
-		preserveNativeModel: false,
-		appServer: params.appServer,
-		dynamicTools: params.dynamicTools,
-		developerInstructions: params.developerInstructions,
-		config: applyCodexNativeSkillIsolation(resumeConfig, nativeSkillIsolation),
-		nativeCodeModeEnabled: params.nativeCodeModeEnabled,
-		nativeProviderWebSearchSupport: params.nativeProviderWebSearchSupport,
-		nativeCodeModeOnlyEnabled: params.nativeCodeModeOnlyEnabled,
-		webSearchAllowed: params.webSearchAllowed,
-		hostSystemAgentActive,
-		restrictedToolSurfaceInheritedMcpServerNames,
-		shellEnvironment: params.shellEnvironment,
-		disableLoginShell: params.disableLoginShell
-	}));
-	const liveThreadConfigFingerprint = fingerprintCodexThreadConfig({
-		...resumeParams,
-		model: binding.model ?? resumeParams.model ?? null,
-		requestedModel: resumeParams.model ?? null,
-		modelProvider: binding.modelProvider ?? resumeParams.modelProvider ?? null,
-		requestedModelProvider: resumeParams.modelProvider ?? binding.modelProvider ?? null
-	}, resumeAuthProfileId, dynamicToolsFingerprint);
-	const retainedThread = await consumeCodexAppServerLiveThread(params.client, binding.threadId, liveThreadConfigFingerprint);
-	if (!retainedThread) {
-		const incompatibleOwnership = await consumeCodexAppServerLiveThread(params.client, binding.threadId);
-		if (incompatibleOwnership) await incompatibleOwnership.release(binding.threadId);
-		return { prebuiltFinalConfigPatch };
-	}
-	try {
-		const nativeHookRelayGeneration = prebuiltFinalConfigPatch.nativeHookRelayGeneration ?? binding.nativeHookRelayGeneration;
-		const model = startModelSelection.model;
-		if (!await lifecycleTiming.measure("warm-thread-write-binding", () => params.bindingStore.mutate(bindingIdentity, {
-			kind: "patch",
-			threadId: binding.threadId,
-			patch: {
-				cwd: params.cwd,
-				model,
-				nativeHookRelayGeneration,
-				environmentSelectionFingerprint
-			}
-		}))) throw new CodexThreadBindingConflictError(binding.threadId, "committing a reused thread");
-		throwIfAborted();
-		lifecycleTiming.mark("thread-ready");
-		lifecycleTiming.logSummary({
-			runId: params.params.runId,
-			sessionId: params.params.sessionId,
-			sessionKey: params.params.sessionKey,
-			threadId: binding.threadId,
-			action: "resumed"
-		});
-		return {
-			binding: {
-				...binding,
-				cwd: params.cwd,
-				model,
-				nativeHookRelayGeneration,
-				environmentSelectionFingerprint,
-				liveThreadConfigFingerprint,
-				liveThreadOwnership: retainedThread,
-				...retainedThread.serviceTier && resumeParams.serviceTier === void 0 ? { clearInheritedServiceTier: true } : {},
-				lifecycle: { action: "resumed" }
-			},
-			prebuiltFinalConfigPatch
-		};
-	} catch (error) {
-		await releaseConsumedThread(binding.threadId, error);
-		throw error;
-	}
-}
-//#endregion
 //#region extensions/codex/src/app-server/thread-supervision.ts
 async function materializePendingSupervisionBranch(params) {
 	let pending = params.binding.pendingSupervisionBranch;
@@ -3271,6 +3781,32 @@ async function materializePendingSupervisionBranch(params) {
 	});
 	let bindingCommitted = false;
 	let provisionalCleanupSafe = true;
+	let cleanupExpected = pending;
+	const trackPendingSupervisionArtifacts = async (cleanupThreadIds) => {
+		const expected = pending;
+		pending = withPendingSupervisionCleanup(pending, cleanupThreadIds);
+		let updated;
+		try {
+			updated = await params.bindingStore.mutate(params.bindingIdentity, {
+				kind: "patch-pending-supervision-branch",
+				expected,
+				pending
+			});
+		} catch (error) {
+			try {
+				const current = await params.bindingStore.read(params.bindingIdentity);
+				if (matchesPendingSupervisionState(current, pending)) cleanupExpected = pending;
+				else if (matchesPendingSupervisionState(current, expected)) cleanupExpected = expected;
+				else throw new CodexThreadBindingConflictError(pending.sourceThreadId, "verifying supervised Codex cleanup tracking");
+			} catch (verificationError) {
+				provisionalCleanupSafe = false;
+				throw new CodexAppServerUnsafeSubscriptionError(`Codex supervised branch cleanup tracking could not be verified: ${cleanupThreadIds.join(", ")}`, { cause: new AggregateError([error, verificationError], void 0, { cause: error }) });
+			}
+			throw error;
+		}
+		cleanupExpected = updated ? pending : void 0;
+		if (!updated) throw new CodexThreadBindingConflictError(pending.sourceThreadId, "tracking supervised Codex branch cleanup");
+	};
 	try {
 		const probeParams = buildPendingSupervisionProbeForkParams(params, pending);
 		const rawProbeResponse = await params.lifecycleTiming.measure("supervision-model-probe-fork", async () => {
@@ -3286,10 +3822,17 @@ async function materializePendingSupervisionBranch(params) {
 			sourceThreadId: pending.sourceThreadId,
 			role: "model probe"
 		});
-		pending = await trackPendingSupervisionArtifacts(params, pending, [probeThreadId]);
+		let probeResponse;
+		try {
+			params.throwIfAborted();
+			probeResponse = assertCodexThreadForkResponse(rawProbeResponse);
+			if (params.restrictedToolSurface) await params.lifecycleTiming.measure("restricted-tool-surface-mcp-attestation", () => attestCodexRestrictedToolSurfaceMcpServersDisabled(params.client, probeThreadId, probeParams.config ?? void 0, params.signal));
+		} finally {
+			await unsubscribeCodexAppServerLiveThread(params.client, probeThreadId, CODEX_APP_SERVER_UNSUBSCRIBE_TIMEOUT_MS).catch((cause) => {
+				throw new CodexAppServerUnsafeSubscriptionError(`Codex model probe subscription could not be released: ${probeThreadId}`, { cause });
+			});
+		}
 		params.throwIfAborted();
-		const probeResponse = assertCodexThreadForkResponse(rawProbeResponse);
-		if (params.restrictedToolSurface) await params.lifecycleTiming.measure("restricted-tool-surface-mcp-attestation", () => attestCodexRestrictedToolSurfaceMcpServersDisabled(params.client, probeThreadId, probeParams.config ?? void 0, params.signal));
 		const nativeModel = requireNonBlankSupervisionValue(probeResponse.model, "native model");
 		const nativeModelProvider = requireNativeSupervisionModelProvider({
 			responseModelProvider: probeResponse.modelProvider,
@@ -3335,7 +3878,7 @@ async function materializePendingSupervisionBranch(params) {
 			otherThreadId: probeThreadId,
 			role: "canonical branch"
 		});
-		pending = await trackPendingSupervisionArtifacts(params, pending, [probeThreadId, finalThreadId]);
+		await trackPendingSupervisionArtifacts([finalThreadId]);
 		params.throwIfAborted();
 		assertExactSupervisionModelSelection(assertCodexThreadStartResponse(rawStartResponse), {
 			model: nativeModel,
@@ -3355,11 +3898,11 @@ async function materializePendingSupervisionBranch(params) {
 				client: params.client,
 				threadId: finalThreadId,
 				ephemeral: startParams.ephemeral === true
-			}) || !await archiveSupervisionArtifact(params.client, probeThreadId)) {
+			})) {
 				provisionalCleanupSafe = false;
 				throw new CodexAppServerUnsafeSubscriptionError("Codex supervised plugin app attestation cleanup failed", { cause: error });
 			}
-			pending = await trackPendingSupervisionArtifacts(params, pending, []);
+			await trackPendingSupervisionArtifacts([]);
 			throw error;
 		}
 		if (history.responseItems.length > 0) {
@@ -3369,8 +3912,6 @@ async function materializePendingSupervisionBranch(params) {
 			}, { signal: params.signal }));
 			params.throwIfAborted();
 		}
-		if (!await archiveSupervisionArtifact(params.client, probeThreadId)) throw new Error(`Failed to archive temporary Codex model probe: ${probeThreadId}`);
-		pending = await trackPendingSupervisionArtifacts(params, pending, [finalThreadId]);
 		const historyCoveredThrough = (/* @__PURE__ */ new Date()).toISOString();
 		const bindingModelProvider = params.normalizeBindingModelProvider(params.attempt.authProfileId, nativeModelProvider);
 		let committed = false;
@@ -3432,31 +3973,28 @@ async function materializePendingSupervisionBranch(params) {
 		};
 	} catch (error) {
 		if (bindingCommitted) throw error;
-		if (error instanceof CodexThreadBindingConflictAfterCleanupError) throw error;
 		if (!provisionalCleanupSafe) {
 			await params.abandonClient();
 			throw error;
 		}
 		const cleanup = await cleanPendingSupervisionArtifacts(params.client, pending);
+		const nextPending = withPendingSupervisionCleanup(pending, cleanup.remaining);
 		let cleanupStateError;
-		if (cleanup.remaining.length !== (pending.cleanupThreadIds?.length ?? 0)) {
-			const nextPending = withPendingSupervisionCleanup(pending, cleanup.remaining);
-			try {
-				if (await params.bindingStore.mutate(params.bindingIdentity, {
-					kind: "patch-pending-supervision-branch",
-					expected: pending,
-					pending: nextPending
-				})) pending = nextPending;
-			} catch (stateError) {
-				cleanupStateError = stateError;
-			}
+		if (cleanupExpected && !isDeepStrictEqual(cleanupExpected, nextPending)) try {
+			await params.bindingStore.mutate(params.bindingIdentity, {
+				kind: "patch-pending-supervision-branch",
+				expected: cleanupExpected,
+				pending: nextPending
+			});
+		} catch (stateError) {
+			cleanupStateError = stateError;
 		}
 		const unsafeCleanup = cleanup.remaining.length > 0 || isCodexAppServerUnsafeSubscriptionError(error);
 		if (unsafeCleanup) await params.abandonClient();
 		if (cleanupStateError) {
-			const cause = new AggregateError([error, cleanupStateError]);
+			const cause = new AggregateError([error, cleanupStateError], "Codex supervised branch cleanup state could not be recorded", { cause: error });
 			if (unsafeCleanup) throw new CodexAppServerUnsafeSubscriptionError("Codex supervised branch cleanup state could not be recorded", { cause });
-			throw new AggregateError([error, cleanupStateError], "Codex supervised branch cleanup state could not be recorded", { cause: error });
+			throw cause;
 		}
 		if (cleanup.remaining.length > 0) throw new CodexAppServerUnsafeSubscriptionError(`Codex supervised branch cleanup remains pending: ${cleanup.remaining.join(", ")}`, { cause: error });
 		throw error;
@@ -3484,7 +4022,7 @@ function buildPendingSupervisionProbeForkParams(params, pending) {
 		...params.appServer.serviceTier !== void 0 ? { serviceTier: params.appServer.serviceTier } : {},
 		config: runtimeConfig,
 		developerInstructions: params.developerInstructions ?? buildDeveloperInstructions(params.attempt, { dynamicTools: params.dynamicTools }),
-		ephemeral: isIncognitoSessionKey(params.attempt.sessionKey),
+		ephemeral: true,
 		threadSource: "appServer",
 		excludeTurns: true
 	};
@@ -3526,10 +4064,8 @@ function requireDistinctSupervisionThreadId(params) {
 	return threadId;
 }
 function readSupervisionResponseThreadId(value) {
-	if (!value || typeof value !== "object" || Array.isArray(value)) return;
-	const thread = value.thread;
-	if (!thread || typeof thread !== "object" || Array.isArray(thread)) return;
-	return thread.id;
+	const thread = isRecord(value) ? value.thread : void 0;
+	return isRecord(thread) ? thread.id : void 0;
 }
 async function recoverPendingSupervisionArtifacts(params, pending) {
 	if (!pending.cleanupThreadIds?.length) return pending;
@@ -3552,20 +4088,6 @@ async function recoverPendingSupervisionArtifacts(params, pending) {
 	})) throw new CodexThreadBindingConflictError(pending.sourceThreadId, "recovering a supervised Codex branch");
 	return next;
 }
-async function trackPendingSupervisionArtifacts(params, pending, cleanupThreadIds) {
-	const next = withPendingSupervisionCleanup(pending, cleanupThreadIds);
-	if (!await params.bindingStore.mutate(params.bindingIdentity, {
-		kind: "patch-pending-supervision-branch",
-		expected: pending,
-		pending: next
-	})) {
-		const cleanupFailed = [];
-		for (const threadId of cleanupThreadIds) if (!await archiveSupervisionArtifact(params.client, threadId)) cleanupFailed.push(threadId);
-		if (cleanupFailed.length > 0) throw new CodexAppServerUnsafeSubscriptionError(`Codex supervised branch CAS cleanup failed: ${cleanupFailed.join(", ")}`);
-		throw new CodexThreadBindingConflictAfterCleanupError(pending.sourceThreadId, "tracking supervised Codex branch cleanup");
-	}
-	return next;
-}
 function withPendingSupervisionCleanup(pending, cleanupThreadIds) {
 	return {
 		sourceThreadId: pending.sourceThreadId,
@@ -3602,15 +4124,10 @@ async function archiveSupervisionArtifact(client, threadId) {
 async function startOrResumeThread(params) {
 	const incognito = isIncognitoSessionKey(params.params.sessionKey);
 	const clientId = resolveCodexAppServerClientInstanceId(params.client);
-	const bindingIdentity = sessionBindingIdentity({
-		sessionId: params.params.sessionId,
-		sessionKey: params.params.sessionKey,
-		agentId: params.agentId ?? params.params.agentId,
-		config: params.params.config
-	});
-	return await params.bindingStore.withLease(bindingIdentity, async () => {
-		const { contextEngineBinding, dynamicToolsContainDeferred, dynamicToolsFingerprint, environmentSelectionFingerprint, hostSystemAgentActive, legacyDynamicToolsFingerprint, legacyUserMcpServersFingerprint, lifecycleTiming, nativeSkillIsolation, nativeSkillIsolationFingerprint, networkProxyConfigFingerprint, ringZeroActive, ringZeroClientInstanceId, ringZeroConfigFingerprint, restrictedToolSurface, restrictedToolSurfaceInheritedMcpServerNames, userMcpServersConfigPatch, userMcpServersFingerprint, webSearchThreadConfigFingerprint } = await prepareCodexThreadLifecyclePreflight(params);
-		let binding = await lifecycleTiming.measure("read-binding", () => params.bindingStore.read(bindingIdentity));
+	return await withCodexThreadLifecycleBinding(params, async (bindingIdentity, currentBinding) => {
+		let binding = currentBinding;
+		const preflight = await prepareCodexThreadLifecyclePreflight(params);
+		const { contextEngineBinding, dynamicToolsContainDeferred, dynamicToolsFingerprint, environmentSelectionFingerprint, hostSystemAgentActive, legacyDynamicToolsFingerprint, legacyUserMcpServersFingerprint, lifecycleTiming, nativeSkillIsolation, nativeSkillIsolationFingerprint, networkProxyConfigFingerprint, ringZeroActive, ringZeroClientInstanceId, ringZeroConfigFingerprint, restrictedToolSurface, restrictedToolSurfaceInheritedMcpServerNames, userMcpServersConfigPatch, userMcpServersFingerprint, webSearchThreadConfigFingerprint } = preflight;
 		let replacementPredecessor;
 		const initialBoundThreadId = binding?.threadId;
 		const initialBoundClientId = binding?.clientId;
@@ -3622,26 +4139,33 @@ async function startOrResumeThread(params) {
 			config: params.params.config
 		});
 		const throwIfAborted = () => throwIfCodexThreadLifecycleAborted(params.signal);
-		const releaseRetainedThread = async (threadId, ownerClientId = initialBoundClientId) => {
+		const releaseRetainedThread = async (threadId, ownerClientId = initialBoundClientId, assertCurrent) => {
 			if (ownerClientId && ownerClientId !== clientId) {
 				const previousClient = retainSharedCodexAppServerClientByInstanceId(ownerClientId);
-				if (!previousClient) return;
+				if (!previousClient) return false;
 				try {
-					await releaseCodexRetainedLiveThread({
+					const assertPrevious = assertCurrent ? captureExclusiveSharedCodexAppServerClient(previousClient.client) : void 0;
+					if (isCodexAppServerLiveThreadClaimed(previousClient.client, threadId)) throw new Error(`Codex thread ${threadId} is claimed by active work; stop it first.`);
+					return await releaseCodexRetainedLiveThread({
 						client: previousClient.client,
 						lifecycleTiming,
-						threadId
+						threadId,
+						assertCurrent: assertCurrent ? () => {
+							assertCurrent();
+							assertPrevious?.();
+						} : void 0
 					});
 				} finally {
 					previousClient.release();
 				}
-				return;
 			}
-			await releaseCodexRetainedLiveThread({
+			if (isCodexAppServerLiveThreadClaimed(params.client, threadId)) throw new Error(`Codex thread ${threadId} is claimed by active work; stop it first.`);
+			return await releaseCodexRetainedLiveThread({
 				client: params.client,
 				abandonClient: params.abandonClient,
 				lifecycleTiming,
-				threadId
+				threadId,
+				assertCurrent
 			});
 		};
 		if (!binding && bindingIdentity.kind === "session" && bindingIdentity.sessionKey) {
@@ -3723,6 +4247,36 @@ async function startOrResumeThread(params) {
 			})) throw new CodexThreadBindingConflictError(current.threadId, operation);
 			binding = void 0;
 		};
+		const resolveRequestContext = () => {
+			const startModelSelection = resolveCodexAppServerThreadModelSelection({
+				provider: params.params.provider,
+				model: params.runtimeModelId ?? params.params.modelId,
+				binding,
+				authProfileId: params.params.authProfileId,
+				authProfileStore: params.params.authProfileStore,
+				agentDir: params.params.agentDir,
+				config: params.params.config
+			});
+			return {
+				...preflight,
+				bindingIdentity,
+				startModelSelection,
+				startModelProvider: startModelSelection.modelProvider,
+				normalizeBindingModelProvider,
+				throwIfAborted
+			};
+		};
+		const transientDelegationRestriction = params.params.delegationCapability === "report_only";
+		const persistentWebSearchRestriction = params.webSearchAllowed === false && params.persistentWebSearchAllowed === false;
+		const transientNativeToolRestriction = params.nativeCodeModeEnabled === false && !persistentWebSearchRestriction;
+		const transientWebSearchRestriction = isTransientWebSearchRestriction(params);
+		if (binding?.pendingResumeConfiguration) return await resumePendingCodexThread(params, {
+			...resolveRequestContext(),
+			binding,
+			clearCurrentBinding,
+			releaseRetainedThread: (threadId, assertCurrent) => releaseRetainedThread(threadId, initialBoundClientId, assertCurrent),
+			transientRestriction: transientDelegationRestriction || transientNativeToolRestriction || transientWebSearchRestriction
+		});
 		if (binding?.threadId && !restrictedToolSurface && binding.nativeToolPolicyRestricted === true) await clearCurrentBinding("rotating a host-policy-restricted thread binding");
 		if (binding?.threadId && binding.nativeSkillIsolationFingerprint !== nativeSkillIsolationFingerprint) {
 			embeddedAgentLog.debug("codex app-server native skill isolation changed; starting a new thread", { threadId: binding.threadId });
@@ -3756,24 +4310,12 @@ async function startOrResumeThread(params) {
 			await clearCurrentBinding("rotating a GPT-5.6 multi-agent thread binding");
 			binding = void 0;
 		}
-		const startModelSelection = resolveCodexAppServerThreadModelSelection({
-			provider: params.params.provider,
-			model: params.runtimeModelId ?? params.params.modelId,
-			binding,
-			authProfileId: params.params.authProfileId,
-			authProfileStore: params.params.authProfileStore,
-			agentDir: params.params.agentDir,
-			config: params.params.config
-		});
-		const startModelProvider = startModelSelection.modelProvider;
-		const transientDelegationRestriction = params.params.delegationCapability === "report_only";
+		const requestContext = resolveRequestContext();
+		const { startModelSelection, startModelProvider } = requestContext;
 		let preserveExistingBinding = transientDelegationRestriction || !ringZeroActive && params.nativeProviderWebSearchSupport === "unknown" && !binding?.threadId;
 		let rotatedContextEngineBinding = false;
 		let prebuiltPluginThreadConfig;
 		const webSearchBindingChanged = binding?.threadId && binding.webSearchThreadConfigFingerprint !== webSearchThreadConfigFingerprint;
-		const persistentWebSearchRestriction = params.webSearchAllowed === false && params.persistentWebSearchAllowed === false;
-		const transientNativeToolRestriction = params.nativeCodeModeEnabled === false && !persistentWebSearchRestriction;
-		const transientWebSearchRestriction = isTransientWebSearchRestriction(params);
 		const explicitTransientWebSearchRestriction = params.webSearchAllowed === false && params.persistentWebSearchAllowed !== false && transientWebSearchRestriction;
 		const unknownProviderWebSearchSupport = params.nativeProviderWebSearchSupport === "unknown";
 		if (binding?.threadId && (params.configuredMcpOwnershipVersion === 1 && (binding.configuredMcpOwnershipVersion !== 1 || binding.dynamicToolsFingerprint === void 0 || binding.mcpServersFingerprint !== void 0 || binding.userMcpServersFingerprint !== void 0) || params.configuredMcpOwnershipVersion !== 1 && binding.configuredMcpOwnershipVersion === 1) && binding?.threadId) {
@@ -3944,31 +4486,11 @@ async function startOrResumeThread(params) {
 				userMcpServersConfigPatch
 			});
 			if (warmReuse.binding) return warmReuse.binding;
+			if (binding.preserveNativeModel === true) await assertAdoptedCodexThreadResumeAllowed(params, binding.threadId, requestContext);
 			await releaseRetainedThread(binding.threadId);
 			const resumed = await resumeExistingCodexThread(params, {
+				...requestContext,
 				binding,
-				bindingIdentity,
-				startModelSelection,
-				startModelProvider,
-				userMcpServersConfigPatch,
-				dynamicToolsFingerprint,
-				dynamicToolsContainDeferred,
-				webSearchThreadConfigFingerprint,
-				nativeSkillIsolationFingerprint,
-				userMcpServersFingerprint,
-				ringZeroConfigFingerprint,
-				ringZeroClientInstanceId,
-				networkProxyConfigFingerprint,
-				contextEngineBinding,
-				environmentSelectionFingerprint,
-				hostSystemAgentActive,
-				ringZeroActive,
-				restrictedToolSurface,
-				restrictedToolSurfaceInheritedMcpServerNames,
-				nativeSkillIsolation,
-				lifecycleTiming,
-				normalizeBindingModelProvider,
-				throwIfAborted,
 				clearCurrentBinding,
 				prebuiltFinalConfigPatch: warmReuse.prebuiltFinalConfigPatch,
 				prebuiltPluginThreadConfig
@@ -3977,28 +4499,7 @@ async function startOrResumeThread(params) {
 		}
 		if (initialBoundThreadId && !preserveExistingBinding && !replacementPredecessor) await releaseRetainedThread(initialBoundThreadId);
 		const started = await startFreshCodexThread(params, {
-			bindingIdentity,
-			startModelSelection,
-			startModelProvider,
-			userMcpServersConfigPatch,
-			dynamicToolsFingerprint,
-			dynamicToolsContainDeferred,
-			webSearchThreadConfigFingerprint,
-			nativeSkillIsolationFingerprint,
-			userMcpServersFingerprint,
-			ringZeroConfigFingerprint,
-			ringZeroClientInstanceId,
-			networkProxyConfigFingerprint,
-			contextEngineBinding,
-			environmentSelectionFingerprint,
-			hostSystemAgentActive,
-			ringZeroActive,
-			restrictedToolSurface,
-			restrictedToolSurfaceInheritedMcpServerNames,
-			nativeSkillIsolation,
-			lifecycleTiming,
-			normalizeBindingModelProvider,
-			throwIfAborted,
+			...requestContext,
 			prebuiltPluginThreadConfig,
 			preserveExistingBinding,
 			rotatedContextEngineBinding,
@@ -4105,7 +4606,6 @@ function buildTurnCollaborationMode(params, options = {}) {
 function buildTurnScopedCollaborationInstructions(params, options = {}) {
 	const contextInstructions = joinPresentSections(options.turnScopedDeveloperInstructions, options.memoryCollaborationInstructions, options.skillsCollaborationInstructions);
 	if (params.trigger === "cron") return joinPresentSections(buildCronCollaborationInstructions(), contextInstructions);
-	if (params.trigger === "heartbeat") return joinPresentSections(buildHeartbeatCollaborationInstructions(), contextInstructions);
 	if (contextInstructions?.trim()) return joinPresentSections(buildDefaultCollaborationInstructions(), contextInstructions);
 	return null;
 }
@@ -4132,15 +4632,8 @@ function buildCronCollaborationInstructions() {
 		"Keep output concise and automation-oriented. Prefer the final command result or a short failure summary over status narration."
 	].join("\n\n");
 }
-function buildHeartbeatCollaborationInstructions() {
-	return [
-		"This is an OpenClaw heartbeat turn. Apply these instructions only to this heartbeat wake; ordinary chat turns should stay in Codex Default mode.",
-		"When you are ready to end the heartbeat, prefer the structured `heartbeat_respond` tool so OpenClaw can record the wake outcome and notification decision. If `heartbeat_respond` is not already available and `tool_search` is available, search for `heartbeat_respond`, load it, then call it. Use `notify=false` when nothing should visibly interrupt the user.",
-		GPT5_HEARTBEAT_PROMPT_OVERLAY
-	].join("\n\n");
-}
 function joinPresentSections(...sections) {
 	return sections.filter((section) => Boolean(section?.trim())).join("\n\n");
 }
 //#endregion
-export { ensureCodexPluginActivation as $, isForcedPrivateQaCodexRuntime as A, neutralizeCodexExplicitMentionSigils as B, CODEX_MANAGED_THREAD_NAMESPACE as C, codexLegacyDynamicToolsFingerprint as D, codexDynamicToolsFingerprint as E, resolveCodexDynamicToolsLoadingForRuntime as F, buildCodexPluginAppsConfigPatchFromPolicyContext as G, resolveCodexContextEngineProjectionMaxChars as H, buildContextEngineBinding as I, buildCodexPluginThreadConfigTimeoutFallback as J, buildCodexPluginThreadConfig as K, isContextEngineBindingCompatible as L, isSystemAgentOnlyCodexDynamicToolAllowlist as M, normalizeCodexDynamicToolName as N, filterCodexDynamicTools as O, resolveCodexDynamicToolsLoading as P, shouldBuildCodexPluginThreadConfig as Q, buildCodexContinuityCalibration as R, CODEX_MANAGED_THREAD_MAX_ENTRIES as S, areCodexDynamicToolFingerprintsCompatible as T, resolveCodexContextEngineProjectionReserveTokens as U, projectContextEngineAssemblyForCodex as V, resolveCodexContinuityProjectionMaxChars as W, buildPluginAppPolicyContext as X, buildDisabledAppsConfigPatch as Y, mergeCodexThreadConfigs as Z, resolveCodexAppServerRequestModelSelection as _, isCodexAppServerProfilerEnabled as a, resolveReasoningEffort as b, buildCodexRingZeroThreadConfigPatch as c, buildCodexNativeWebSearchThreadConfig as d, refreshCodexPluginRuntimeState as et, resolveCodexWebSearchPlan as f, resolveCodexAppServerModelProvider as g, CODEX_NATIVE_PERSONALITY_NONE as h, startOrResumeThread as i, resolveRecoverableCodexPluginConfigKeys as it, isMessageOnlyCodexSourceReply as j, filterCodexDynamicToolsForDisabledNativeSurface as k, buildCodexRuntimeThreadConfig as l, buildCodexProjectDocThreadConfig as m, buildTurnStartParams as n, isOpenAiCuratedMarketplaceName as nt, assertCodexManagedRequirementsDoNotOverrideToolPolicy as o, buildDeveloperInstructions as p, buildCodexPluginThreadConfigInputFingerprint as q, buildCodexUserInput as r, pluginReadParams as rt, attestCodexRestrictedToolSurfaceMcpServersDisabled as s, buildTurnCollaborationMode as t, isOpenAiCuratedMarketplace as tt, readCodexInheritedMcpServerNames as u, resolveCodexAppServerThreadModelSelection as v, createCodexManagedThreadStore as w, readCodexSupportedReasoningEfforts as x, resolveCodexBindingModelProviderFallback as y, fitCodexProjectedContextForTurnStart as z };
+export { resolveCodexContinuityProjectionMaxChars as $, readCodexSupportedReasoningEfforts as A, isMessageOnlyCodexSourceReply as B, buildCodexProjectDocThreadConfig as C, resolveCodexAppServerThreadModelSelection as D, resolveCodexAppServerRequestModelSelection as E, codexDynamicToolsFingerprint as F, buildContextEngineBinding as G, normalizeCodexDynamicToolName as H, codexLegacyDynamicToolsFingerprint as I, fitCodexProjectedContextForTurnStart as J, isContextEngineBindingCompatible as K, filterCodexDynamicTools as L, CODEX_MANAGED_THREAD_NAMESPACE as M, createCodexManagedThreadStore as N, resolveCodexBindingModelProviderFallback as O, areCodexDynamicToolFingerprintsCompatible as P, resolveCodexContextEngineProjectionReserveTokens as Q, filterCodexDynamicToolsForDisabledNativeSurface as R, buildDeveloperInstructions as S, resolveCodexAppServerModelProvider as T, resolveCodexDynamicToolsLoading as U, isSystemAgentOnlyCodexDynamicToolAllowlist as V, resolveCodexDynamicToolsLoadingForRuntime as W, projectContextEngineAssemblyForCodex as X, neutralizeCodexExplicitMentionSigils as Y, resolveCodexContextEngineProjectionMaxChars as Z, buildCodexRingZeroThreadConfigPatch as _, isCodexAppServerProfilerEnabled as a, buildPluginAppPolicyContext as at, buildCodexNativeWebSearchThreadConfig as b, buildCodexNativeHookRelayConfig as c, ensureCodexPluginActivation as ct, emitCodexNativePreToolUseFailureDiagnostic as d, isOpenAiCuratedMarketplaceName as dt, buildCodexPluginAppsConfigPatchFromPolicyContext as et, resolveCodexNativeHookRelayEvents as f, pluginReadParams as ft, attestCodexRestrictedToolSurfaceMcpServersDisabled as g, assertCodexManagedRequirementsDoNotOverrideToolPolicy as h, startOrResumeThread as i, buildDisabledAppsConfigPatch as it, CODEX_MANAGED_THREAD_MAX_ENTRIES as j, resolveReasoningEffort as k, buildCodexNativeHookRelayDisabledConfig as l, refreshCodexPluginRuntimeState as lt, scheduleCodexNativeHookRelayUnregister as m, buildTurnStartParams as n, buildCodexPluginThreadConfigInputFingerprint as nt, CODEX_NATIVE_HOOK_RELAY_EVENTS as o, mergeCodexThreadConfigs as ot, resolveCodexNativeHookRelayTtlMs as p, resolveRecoverableCodexPluginConfigKeys as pt, buildCodexContinuityCalibration as q, buildCodexUserInput as r, buildCodexPluginThreadConfigTimeoutFallback as rt, CODEX_NATIVE_HOOK_RELAY_TTL_GRACE_MS as s, shouldBuildCodexPluginThreadConfig as st, buildTurnCollaborationMode as t, buildCodexPluginThreadConfig as tt, createCodexNativeHookRelay as u, isOpenAiCuratedMarketplace as ut, buildCodexRuntimeThreadConfig as v, CODEX_NATIVE_PERSONALITY_NONE as w, resolveCodexWebSearchPlan as x, readCodexInheritedMcpServerNames as y, isForcedPrivateQaCodexRuntime as z };