@openclaw/codex 2026.8.1-beta.3 → 2026.8.1

package/dist/{dynamic-tools-fJZhl4CE.js → dynamic-tools-BFoUcRdx.js}

@@ -1,818 +1,39 @@
-import { h as readCodexPluginConfig, p as isCodexRemoteExecPlacementSandbox } from "./config-CpNeo5AE.js";
-import { V as createCodexElicitationResponse, ct as CODEX_OPENCLAW_DIRECT_DYNAMIC_TOOL_NAMESPACE, l as releaseLeasedSharedCodexAppServerClient, ut as isJsonObject } from "./shared-client-Dw-rzii0.js";
-import { E as itemStatus, F as readItem, b as auditNativeToolUnfinishedStatus, h as isCodexNotificationForTurn, v as auditNativeToolName, y as auditNativeToolTerminalStatus } from "./attempt-client-cleanup-URjUlCHg.js";
-import { l as readCodexTurn } from "./protocol-validators-VAVyEnDp.js";
-import { A as isForcedPrivateQaCodexRuntime, M as isSystemAgentOnlyCodexDynamicToolAllowlist, N as normalizeCodexDynamicToolName, O as filterCodexDynamicTools, f as resolveCodexWebSearchPlan, k as filterCodexDynamicToolsForDisabledNativeSurface } from "./thread-lifecycle-DKdrnTMX.js";
+import { C as isCodexRemoteExecPlacementSandbox, T as readCodexPluginConfig } from "./config-Cxw3Cl3k.js";
+import { Bt as CODEX_OPENCLAW_DIRECT_DYNAMIC_TOOL_NAMESPACE, Ht as isJsonObject, dt as resolveCodexToolAbortTerminalReason, et as createCodexElicitationResponse, ft as createFailedDynamicToolResponse, h as releaseLeasedSharedCodexAppServerClient, mt as withDynamicToolTranscriptDetails, pt as withDynamicToolExecutionState } from "./shared-client-kNkljY-R.js";
+import { d as readCodexTurn } from "./protocol-validators-Bg5rpNxk.js";
+import { D as itemStatus, I as readItem, b as auditNativeToolTerminalStatus, g as isCodexNotificationForTurn, x as auditNativeToolUnfinishedStatus, y as auditNativeToolName } from "./attempt-client-cleanup-CVPvp9dL.js";
+import { H as normalizeCodexDynamicToolName, L as filterCodexDynamicTools, R as filterCodexDynamicToolsForDisabledNativeSurface, V as isSystemAgentOnlyCodexDynamicToolAllowlist, d as emitCodexNativePreToolUseFailureDiagnostic, x as resolveCodexWebSearchPlan, z as isForcedPrivateQaCodexRuntime } from "./thread-lifecycle-Ss-uwnC4.js";
+import { l as resolveCodexNativeExecutionPolicy, u as resolveCodexNodeExecToolOverrides } from "./request-CCm4LaED.js";
 import { r as sanitizeInlineImageDataUrl, t as invalidInlineImageText } from "./image-payload-sanitizer-CnfoUPCE.js";
-import { r as formatCodexDisplayText } from "./command-formatters-D0nZ3qtd.js";
-import { a as resolveCodexNodeExecToolOverrides, i as resolveCodexNativeExecutionPolicy } from "./sandbox-guard-C1qEeZ5C.js";
-import { a as sanitizeCodexApprovalVisibleText, c as waitForPluginApprovalDecision, i as requestPluginApproval, n as codexApprovalTimeoutText, o as stripDanglingCodexApprovalTerminalSequence, r as mapExecDecisionToOutcome, s as truncateCodexApprovalDisplayText, t as approvalRequestExplicitlyUnavailable } from "./plugin-approval-roundtrip-C75Yiiwc.js";
+import { r as formatCodexDisplayText } from "./command-formatters-C54Yg3eA.js";
+import { a as sanitizeCodexApprovalVisibleText, c as waitForPluginApprovalDecision, i as requestPluginApproval, n as codexApprovalTimeoutText, o as stripDanglingCodexApprovalTerminalSequence, r as mapExecDecisionToOutcome, s as truncateCodexApprovalDisplayText, t as approvalRequestExplicitlyUnavailable } from "./plugin-approval-roundtrip-D80UZiJ_.js";
 import { asNonArrayRecord, asOptionalRecord, isRecord, normalizeOptionalString, normalizeTrimmedStringList, readStringField } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { validateJsonSchemaValue } from "openclaw/plugin-sdk/json-schema-runtime";
 import path, { posix } from "node:path";
 import { createDeferred } from "openclaw/plugin-sdk/extension-shared";
-import { addTimerTimeoutGraceMs, asDateTimestampMs, finiteSecondsToTimerSafeMilliseconds, parseStrictNonNegativeInteger } from "openclaw/plugin-sdk/number-runtime";
+import { asDateTimestampMs } from "openclaw/plugin-sdk/number-runtime";
 import { HEARTBEAT_RESPONSE_TOOL_NAME, buildAgentHookContextChannelFields, buildEmbeddedAttemptToolRunContext, consumeAdjustedParamsForToolCall, consumePreExecutionBlockedToolCall, createAgentToolResultMiddlewareRunner, createCodexAppServerToolResultExtensionRunner, embeddedAgentLog, extractMessagingToolSend, extractMessagingToolSendResult, extractToolResultMediaArtifact, filterProviderNormalizableTools, filterToolResultMediaUrls, finalizeToolTerminalPresentation, formatApprovalDisplayPath, formatToolExecutionErrorMessage, getBeforeToolCallFailureDisposition, getChannelAgentToolMeta, getPluginToolMeta, getPluginToolSideEffectOwnerKey, hasNativeHookRelayInvocation, invokeNativeHookRelay, isDeliveredMessageToolOnlySourceReplyResult, isDeliveredMessagingToolResult, isHostScopedAgentToolActive, isMessagingTool, isMessagingToolSendAction, isReplaySafeToolCall, isSubagentSessionKey, isToolResultError, isToolWrappedWithBeforeToolCallHook, normalizeAgentRuntimeTools, normalizeHeartbeatToolResponse, projectRuntimeToolInputSchema, resolveAttemptSpawnWorkspaceDir, resolveModelAuthMode, resolveNativeHookRelayDeferredToolApproval, resolveToolExecutionErrorKind, resolveToolResultFailureKind, runAgentHarnessAfterToolCallHook, sanitizeToolResult, setBeforeToolCallDiagnosticsEnabled, supportsModelTools, wrapToolWithBeforeToolCallHook } from "openclaw/plugin-sdk/agent-harness-runtime";
 import { createHash, randomUUID } from "node:crypto";
 import { resolveAgentDir as resolveAgentDir$1 } from "openclaw/plugin-sdk/agent-runtime";
-import { killProcessTree } from "openclaw/plugin-sdk/process-runtime";
 import { formatErrorMessage as formatErrorMessage$1, redactSensitiveText } from "openclaw/plugin-sdk/security-runtime";
+import { killProcessTree } from "openclaw/plugin-sdk/process-runtime";
 import { SsrFBlockedError, isBlockedHostnameOrIp } from "openclaw/plugin-sdk/ssrf-runtime";
 import { spawn } from "node:child_process";
+import { once } from "node:events";
 import { coerceErrorMessage } from "openclaw/plugin-sdk/error-runtime";
 import { DEFAULT_MAX_LIVE_TOOL_RESULT_CHARS, estimateToolResultTextChars, resolveLiveToolResultMaxChars, sliceToolResultTextToBudget, sliceUtf16Safe, truncateUtf16Safe } from "openclaw/plugin-sdk/text-utility-runtime";
-import { once } from "node:events";
+import { emitTrustedDiagnosticEvent } from "openclaw/plugin-sdk/diagnostic-runtime";
 import { isIP } from "node:net";
 import { WebSocketServer } from "ws";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { expectDefined } from "openclaw/plugin-sdk/expect-runtime";
 import { redactToolPayloadText } from "openclaw/plugin-sdk/logging-core";
 import { isPathStrictlyInside, root } from "openclaw/plugin-sdk/file-access-runtime";
-import { runWithCronCreatorAuthorityCapabilityResolver } from "openclaw/plugin-sdk/codex-mcp-projection";
-import { emitTrustedDiagnosticEvent, hasPendingInternalDiagnosticEvent } from "openclaw/plugin-sdk/diagnostic-runtime";
 import { buildRemoteCommand, isToolAllowed, sanitizeEnvVars } from "openclaw/plugin-sdk/sandbox";
+import { pinExecToolTarget, resolveCodexScheduledToolProjectionFactory, runWithCronCreatorAuthorityCapabilityResolver } from "openclaw/plugin-sdk/codex-mcp-projection";
 import { saveMediaBuffer } from "openclaw/plugin-sdk/media-store";
-import { registerRetainedNativeHookRelayForBundledRuntime } from "openclaw/plugin-sdk/native-hook-relay-runtime";
 import { getMediaDir } from "openclaw/plugin-sdk/media-runtime";
 import { normalizeOpenAIToolSchemas } from "openclaw/plugin-sdk/provider-tools";
-//#region extensions/codex/src/app-server/dynamic-tool-response-state.ts
-/** Retains the host-owned app preview without adding it to Codex's response payload. */
-function withDynamicToolTranscriptDetails(response, details) {
-	if (details === void 0) return response;
-	Object.defineProperty(response, "transcriptDetails", {
-		configurable: true,
-		enumerable: false,
-		value: details
-	});
-	return response;
-}
-function withDynamicToolTerminalResolution(response, terminalResolution) {
-	if (terminalResolution) {
-		Object.defineProperties(response, {
-			terminalResolution: {
-				configurable: true,
-				enumerable: false,
-				value: terminalResolution
-			},
-			executionStarted: {
-				configurable: true,
-				enumerable: false,
-				value: terminalResolution.executionStarted
-			},
-			...terminalResolution.executedArguments ? { executedArguments: {
-				configurable: true,
-				enumerable: false,
-				value: terminalResolution.executedArguments
-			} } : {}
-		});
-		withDynamicToolSideEffectEvidence(response, terminalResolution.sideEffectEvidence);
-	}
-	return response;
-}
-function withDynamicToolExecutionState(response, state) {
-	Object.defineProperties(response, {
-		executedArguments: {
-			configurable: true,
-			enumerable: false,
-			value: state.executedArguments
-		},
-		executionStarted: {
-			configurable: true,
-			enumerable: false,
-			value: state.executionStarted
-		}
-	});
-	return withDynamicToolSideEffectEvidence(response, state.sideEffectEvidence === true);
-}
-function withDynamicToolSideEffectEvidence(response, sideEffectEvidence) {
-	if (!sideEffectEvidence) {
-		delete response.sideEffectEvidence;
-		return response;
-	}
-	Object.defineProperty(response, "sideEffectEvidence", {
-		configurable: true,
-		enumerable: false,
-		value: true
-	});
-	return response;
-}
-function createFailedDynamicToolResponse(message, options) {
-	const response = {
-		contentItems: [{
-			type: "inputText",
-			text: message
-		}],
-		success: false
-	};
-	Object.defineProperties(response, {
-		diagnosticTerminalReason: {
-			configurable: true,
-			enumerable: false,
-			value: options?.terminalReason ?? "failed"
-		},
-		diagnosticTerminalType: {
-			configurable: true,
-			enumerable: false,
-			value: "error"
-		}
-	});
-	if (options?.executionStarted !== void 0) Object.defineProperty(response, "executionStarted", {
-		configurable: true,
-		enumerable: false,
-		value: options.executionStarted
-	});
-	if (options?.executedArguments !== void 0) Object.defineProperty(response, "executedArguments", {
-		configurable: true,
-		enumerable: false,
-		value: options.executedArguments
-	});
-	return withDynamicToolSideEffectEvidence(response, options?.sideEffectEvidence === true);
-}
-//#endregion
-//#region extensions/codex/src/app-server/tool-abort-terminal-reason.ts
-/** Leaf helper shared by native and dynamic tool diagnostics. */
-const CODEX_TIMEOUT_ABORT_REASONS = /* @__PURE__ */ new Set([
-	"codex_startup_timeout",
-	"turn_completion_idle_timeout",
-	"turn_progress_idle_timeout",
-	"turn_terminal_idle_timeout"
-]);
-/** Preserves timeout provenance when an enclosing run aborts an active tool. */
-function resolveCodexToolAbortTerminalReason(signal) {
-	try {
-		const reason = signal.reason;
-		if (typeof reason === "string") {
-			if (CODEX_TIMEOUT_ABORT_REASONS.has(reason)) return "timed_out";
-			return reason === "client_closed" ? "failed" : "cancelled";
-		}
-		if (reason && typeof reason === "object") {
-			const record = reason;
-			if (record.name === "TimeoutError" || record.reason === "timeout") return "timed_out";
-		}
-	} catch {
-		return "cancelled";
-	}
-	return "cancelled";
-}
-//#endregion
-//#region extensions/codex/src/app-server/dynamic-tool-execution.ts
-/**
-* Timeout, terminal-release, and diagnostic helpers for Codex dynamic tool
-* calls.
-*/
-/** Default timeout for Codex dynamic tool calls. */
-const CODEX_DYNAMIC_TOOL_TIMEOUT_MS = 9e4;
-/** Hard cap for per-call Codex dynamic tool timeout overrides. */
-const CODEX_DYNAMIC_TOOL_MAX_TIMEOUT_MS = 6e5;
-const CODEX_DYNAMIC_TOOL_TIMEOUT_SECONDS_GRACE_MS = 3e4;
-const CODEX_DYNAMIC_IMAGE_GENERATION_TOOL_TIMEOUT_MS = 12e4;
-const CODEX_DYNAMIC_COMPUTER_GATEWAY_TIMEOUT_MS = 3e4;
-const CODEX_DYNAMIC_COMPUTER_COMPLETION_GRACE_MS = 3e4;
-/** Timeout for image-understanding style dynamic tool calls. */
-const CODEX_DYNAMIC_IMAGE_TOOL_TIMEOUT_MS = 6e4;
-/** Timeout for message-delivery dynamic tool calls. */
-const CODEX_DYNAMIC_MESSAGE_TOOL_TIMEOUT_MS = 6e5;
-/** Outer default for collector waits: full swarm budget plus completion grace. */
-const CODEX_DYNAMIC_AGENTS_WAIT_TOOL_TIMEOUT_MS = 63e4;
-const LOG_FIELD_MAX_LENGTH = 160;
-function normalizeLogField(value) {
-	if (typeof value !== "string") return;
-	const normalized = value.replaceAll(String.fromCharCode(27), " ").replaceAll("\r", " ").replaceAll("\n", " ").replaceAll("	", " ").trim();
-	if (!normalized) return;
-	return normalized.length > LOG_FIELD_MAX_LENGTH ? `${truncateUtf16Safe(normalized, LOG_FIELD_MAX_LENGTH - 3)}...` : normalized;
-}
-function readNumericTimeoutMs(value) {
-	if (typeof value === "number" && Number.isFinite(value)) return Math.max(0, Math.floor(value));
-	if (typeof value === "string") {
-		const parsed = parseStrictNonNegativeInteger(value);
-		if (parsed !== void 0) return Math.max(0, Math.floor(parsed));
-	}
-}
-function formatDynamicToolTimeoutDetails(params) {
-	const tool = normalizeLogField(params.call.tool) ?? "unknown";
-	const baseMeta = {
-		tool: params.call.tool,
-		toolCallId: params.call.callId,
-		threadId: params.call.threadId,
-		turnId: params.call.turnId,
-		timeoutMs: params.timeoutMs,
-		timeoutKind: "codex_dynamic_tool_rpc"
-	};
-	if (tool !== "process" || !isJsonObject(params.call.arguments)) return {
-		responseMessage: `OpenClaw dynamic tool call timed out after ${params.timeoutMs}ms while running tool ${tool}.`,
-		consoleMessage: `codex dynamic tool timeout: tool=${tool} toolTimeoutMs=${params.timeoutMs}; per-tool-call watchdog, not session idle`,
-		meta: baseMeta
-	};
-	const action = normalizeLogField(params.call.arguments.action);
-	const sessionId = normalizeLogField(params.call.arguments.sessionId);
-	const requestedTimeoutMs = readNumericTimeoutMs(params.call.arguments.timeout);
-	const actionPart = action ? ` action=${action}` : "";
-	const sessionPart = sessionId ? ` sessionId=${sessionId}` : "";
-	const requestedPart = requestedTimeoutMs === void 0 ? "" : ` requestedWaitMs=${requestedTimeoutMs}`;
-	const retryHint = action === "poll" ? "; repeated lines usually mean process-poll retry churn, not model progress" : "";
-	const responseTarget = action || sessionId ? ` while waiting for process${actionPart}${sessionPart}` : " while waiting for the process tool";
-	return {
-		responseMessage: `OpenClaw dynamic tool call timed out after ${params.timeoutMs}ms${responseTarget}. This is a tool RPC timeout, not a session idle timeout.`,
-		consoleMessage: `codex process tool timeout:${actionPart}${sessionPart} toolTimeoutMs=${params.timeoutMs}${requestedPart}; per-tool-call watchdog, not session idle${retryHint}`,
-		meta: {
-			...baseMeta,
-			processAction: action,
-			processSessionId: sessionId,
-			processRequestedTimeoutMs: requestedTimeoutMs
-		}
-	};
-}
-/**
-* Runs a dynamic tool call with run-abort and per-call timeout handling,
-* returning a Codex protocol response instead of throwing.
-*/
-async function handleDynamicToolCallWithTimeout(params) {
-	let didNotifyAgentToolResult = false;
-	const conservativeRaceResponses = /* @__PURE__ */ new WeakSet();
-	const finalizeTerminal = (response) => {
-		const executionSnapshot = params.toolBridge.consumeToolExecutionSnapshot?.(params.call.callId);
-		const ownerKey = params.toolBridge.sideEffectOwnerKeyForTool?.(params.call.tool);
-		const observedExecutionStarted = executionSnapshot?.executionStarted ?? (conservativeRaceResponses.has(response) ? void 0 : response.executionStarted);
-		const terminalResolution = params.observeToolTerminal?.({
-			toolCallId: params.call.callId,
-			toolName: params.call.tool,
-			arguments: response.executedArguments ?? executionSnapshot?.executedArguments ?? params.call.arguments,
-			...params.toolMeta ? { meta: params.toolMeta } : {},
-			...ownerKey ? { ownerMutation: { ownerKey } } : {},
-			...observedExecutionStarted !== void 0 ? { executionStarted: observedExecutionStarted } : {},
-			outcome: response.success ? "success" : "failure",
-			...!response.success ? { failure: { error: readDynamicToolResponseText(response) } } : {}
-		});
-		return withDynamicToolTerminalResolution(response, terminalResolution);
-	};
-	const createFailedAfterPossibleDispatch = (message, terminalReason) => {
-		const response = createFailedDynamicToolResponse(message, {
-			executionStarted: true,
-			sideEffectEvidence: true,
-			terminalReason
-		});
-		conservativeRaceResponses.add(response);
-		return response;
-	};
-	const notifyAgentToolResult = (event) => {
-		if (didNotifyAgentToolResult) return;
-		didNotifyAgentToolResult = true;
-		try {
-			params.onAgentToolResult?.(event);
-		} catch (error) {
-			embeddedAgentLog.warn(`onAgentToolResult handler failed: tool=${params.call.tool} error=${String(error)}`);
-		}
-	};
-	const notifyFailedToolResult = (message, terminalReason = "failed") => {
-		notifyAgentToolResult({
-			toolName: params.call.tool,
-			result: {
-				content: [{
-					type: "text",
-					text: message
-				}],
-				details: {
-					status: terminalReason,
-					error: message
-				}
-			},
-			isError: true
-		});
-	};
-	if (params.signal.aborted) {
-		const message = "OpenClaw dynamic tool call aborted before execution.";
-		const terminalReason = resolveCodexToolAbortTerminalReason(params.signal);
-		params.onFallbackSelected?.();
-		notifyFailedToolResult(message, terminalReason);
-		return finalizeTerminal(createFailedDynamicToolResponse(message, {
-			executionStarted: false,
-			terminalReason
-		}));
-	}
-	const controller = new AbortController();
-	let timeout;
-	let timedOut = false;
-	let resolveAbort;
-	const abortFromRun = () => {
-		const message = "OpenClaw dynamic tool call aborted.";
-		const terminalReason = resolveCodexToolAbortTerminalReason(params.signal);
-		params.onFallbackSelected?.();
-		controller.abort(params.signal.reason ?? /* @__PURE__ */ new Error(message));
-		notifyFailedToolResult(message, terminalReason);
-		resolveAbort?.(createFailedAfterPossibleDispatch(message, terminalReason));
-	};
-	const abortPromise = new Promise((resolve) => {
-		resolveAbort = resolve;
-	});
-	const timeoutPromise = new Promise((resolve) => {
-		const timeoutMs = clampDynamicToolTimeoutMs(params.timeoutMs);
-		timeout = setTimeout(() => {
-			timedOut = true;
-			const timeoutDetails = formatDynamicToolTimeoutDetails({
-				call: params.call,
-				timeoutMs
-			});
-			params.onFallbackSelected?.();
-			controller.abort(new Error(timeoutDetails.responseMessage));
-			params.onTimeout?.();
-			embeddedAgentLog.warn("codex dynamic tool call timed out", {
-				...timeoutDetails.meta,
-				consoleMessage: timeoutDetails.consoleMessage
-			});
-			notifyFailedToolResult(timeoutDetails.responseMessage, "timed_out");
-			resolve(createFailedAfterPossibleDispatch(timeoutDetails.responseMessage, "timed_out"));
-		}, timeoutMs);
-		timeout.unref?.();
-	});
-	try {
-		params.signal.addEventListener("abort", abortFromRun, { once: true });
-		if (params.signal.aborted) abortFromRun();
-		const response = await Promise.race([
-			params.toolBridge.handleToolCall(params.call, {
-				signal: controller.signal,
-				onAgentToolResult: notifyAgentToolResult,
-				toolCallOrdinal: params.toolCallOrdinal,
-				retainExecutionSnapshot: true
-			}),
-			abortPromise,
-			timeoutPromise
-		]);
-		if (!response.success && !didNotifyAgentToolResult) notifyFailedToolResult(readDynamicToolResponseText(response), response.diagnosticTerminalReason ?? "failed");
-		return finalizeTerminal(response);
-	} catch (error) {
-		const terminalReason = params.signal.aborted ? resolveCodexToolAbortTerminalReason(params.signal) : resolveToolExecutionErrorKind(error);
-		const message = formatToolExecutionErrorMessage(error, "OpenClaw dynamic tool call failed.");
-		notifyFailedToolResult(message, terminalReason);
-		return finalizeTerminal(createFailedAfterPossibleDispatch(message, terminalReason));
-	} finally {
-		if (timeout) clearTimeout(timeout);
-		params.signal.removeEventListener("abort", abortFromRun);
-		resolveAbort = void 0;
-		if (!timedOut && !controller.signal.aborted) controller.abort(/* @__PURE__ */ new Error("OpenClaw dynamic tool call finished."));
-	}
-}
-function readDynamicToolResponseText(response) {
-	return response.contentItems.flatMap((item) => item.type === "inputText" && typeof item.text === "string" ? [item.text] : []).join("\n").trim() || "OpenClaw dynamic tool call failed.";
-}
-/** Strips OpenClaw-only metadata before sending a dynamic tool response to Codex. */
-function toCodexDynamicToolProtocolResponse(response) {
-	return {
-		contentItems: response.contentItems,
-		success: response.success
-	};
-}
-/** Adds async-started progress details when a tool result continues out of band. */
-function toCodexDynamicToolProgressResponse(response, protocolResponse) {
-	const transcriptDetails = isJsonObject(response.transcriptDetails) ? response.transcriptDetails : void 0;
-	const mcpAppPreview = isJsonObject(transcriptDetails?.mcpAppPreview) ? transcriptDetails.mcpAppPreview : void 0;
-	const progressDetails = mcpAppPreview ? { mcpAppPreview } : void 0;
-	if (response.asyncStarted !== true && progressDetails === void 0) return protocolResponse;
-	return {
-		...protocolResponse,
-		...progressDetails ? { details: progressDetails } : {},
-		...response.asyncStarted === true ? { details: {
-			...progressDetails,
-			async: true,
-			status: "started"
-		} } : {}
-	};
-}
-/** Decides whether a terminal dynamic tool response can release the Codex turn. */
-function shouldReleaseTurnAfterTerminalDynamicTool(state) {
-	return !state.completed && !state.aborted && state.responseSuccess && !state.currentTurnHadNonTerminalDynamicToolResult && state.activeAppServerTurnRequests === 0 && state.activeTurnItemIdsCount === 0 && state.pendingOpenClawDynamicToolCompletionIdsCount === 0;
-}
-/** Returns true when a non-async result should block terminal-release shortcuts. */
-function shouldBlockTerminalReleaseForNonTerminalDynamicToolResult(response) {
-	return response.asyncStarted !== true;
-}
-/** Resolves whether terminal diagnostic state should release, wait, or stay idle. */
-function resolveTerminalDynamicToolBatchAction(state) {
-	if (state.activeAppServerTurnRequests > 0 || state.activeTurnItemIdsCount > 0 || state.pendingOpenClawDynamicToolCompletionIdsCount > 0) return "wait";
-	if (state.currentTurnHadNonTerminalDynamicToolResult) return "clear-nonterminal-batch";
-	if (state.hasPendingTerminalDynamicToolRelease) return "release-pending-terminal";
-	return "idle";
-}
-/** Returns true for diagnostic events that terminate a dynamic tool call. */
-function isDynamicToolTerminalDiagnosticEvent(event) {
-	return event.type === "tool.execution.completed" || event.type === "tool.execution.error" || event.type === "tool.execution.blocked";
-}
-/** Matches terminal diagnostics to a specific dynamic tool call id/name. */
-function isMatchingDynamicToolTerminalDiagnostic(params) {
-	if (params.event.toolCallId !== params.call.callId || params.event.toolName !== params.call.tool) return false;
-	if (params.runId !== void 0) return params.event.runId === params.runId;
-	if (params.sessionId !== void 0) return params.event.sessionId === params.sessionId;
-	if (params.sessionKey !== void 0) return params.event.sessionKey === params.sessionKey;
-	return params.event.runId === void 0 && params.event.sessionId === void 0 && params.event.sessionKey === void 0;
-}
-/** Checks pending diagnostics for a terminal event matching a tool call. */
-function hasPendingDynamicToolTerminalDiagnostic(params) {
-	return hasPendingInternalDiagnosticEvent((event) => {
-		if (!isDynamicToolTerminalDiagnosticEvent(event)) return false;
-		return isMatchingDynamicToolTerminalDiagnostic({
-			event,
-			call: params.call,
-			runId: params.runId,
-			sessionId: params.sessionId,
-			sessionKey: params.sessionKey
-		});
-	});
-}
-/** Resolves per-tool timeout, applying media/message defaults and hard caps. */
-function resolveDynamicToolCallTimeoutMs(params) {
-	if (params.call.tool === "computer") return clampDynamicToolTimeoutMs(readComputerToolTimeoutMs(params.call.arguments));
-	if (params.call.tool === "message") return CODEX_DYNAMIC_MESSAGE_TOOL_TIMEOUT_MS;
-	if (params.call.tool === "agents_wait") {
-		const requestedMs = readDynamicToolCallTimeoutMs(params.call.arguments) ?? readConfiguredDynamicToolTimeoutMs(params.call.tool, params.config) ?? CODEX_DYNAMIC_AGENTS_WAIT_TOOL_TIMEOUT_MS;
-		return Math.max(1, Math.min(63e4, Math.floor(requestedMs)));
-	}
-	return clampDynamicToolTimeoutMs(readDynamicToolCallTimeoutMs(params.call.arguments) ?? readConfiguredDynamicToolTimeoutMs(params.call.tool, params.config) ?? CODEX_DYNAMIC_TOOL_TIMEOUT_MS);
-}
-function readComputerToolTimeoutMs(value) {
-	const args = isJsonObject(value) ? value : void 0;
-	const action = typeof args?.action === "string" ? args.action : void 0;
-	const gatewayTimeoutMs = readPositiveFiniteTimeoutMs(args?.timeoutMs) ?? CODEX_DYNAMIC_COMPUTER_GATEWAY_TIMEOUT_MS;
-	const gatewayCallCount = action === "screenshot" || action === "wait" ? 3 : 4;
-	return (action === "wait" || action === "hold_key" ? Math.max(0, Number(args?.duration) || 0) * 1e3 : 0) + gatewayCallCount * gatewayTimeoutMs + CODEX_DYNAMIC_COMPUTER_COMPLETION_GRACE_MS;
-}
-function readDynamicToolCallTimeoutMs(value) {
-	if (!isJsonObject(value)) return;
-	const timeoutMs = readPositiveFiniteTimeoutMs(value.timeoutMs);
-	if (timeoutMs !== void 0) return timeoutMs;
-	const timeoutSecondsMs = readDynamicToolTimeoutSecondsAsMs(value.timeoutSeconds);
-	return timeoutSecondsMs === void 0 ? void 0 : addTimerTimeoutGraceMs(timeoutSecondsMs, CODEX_DYNAMIC_TOOL_TIMEOUT_SECONDS_GRACE_MS);
-}
-function readConfiguredDynamicToolTimeoutMs(toolName, config) {
-	if (toolName === "image_generate") {
-		const imageModel = config?.agents?.defaults?.mediaModels?.image;
-		if (!imageModel || typeof imageModel !== "object") return CODEX_DYNAMIC_IMAGE_GENERATION_TOOL_TIMEOUT_MS;
-		return readPositiveFiniteTimeoutMs(imageModel.timeoutMs) ?? CODEX_DYNAMIC_IMAGE_GENERATION_TOOL_TIMEOUT_MS;
-	}
-	if (toolName === "view_image") {
-		const candidates = (config?.tools?.media?.models ?? []).filter((entry) => !entry.capabilities || entry.capabilities.includes("image"));
-		const capabilityTimeoutMs = readTimeoutSecondsAsMs(config?.tools?.media?.image?.timeoutSeconds);
-		return Math.max(capabilityTimeoutMs ?? CODEX_DYNAMIC_IMAGE_TOOL_TIMEOUT_MS, ...candidates.map((entry) => readTimeoutSecondsAsMs(entry.timeoutSeconds) ?? capabilityTimeoutMs ?? CODEX_DYNAMIC_IMAGE_TOOL_TIMEOUT_MS));
-	}
-	if (toolName === "message") return CODEX_DYNAMIC_MESSAGE_TOOL_TIMEOUT_MS;
-}
-function readTimeoutSecondsAsMs(value) {
-	const seconds = readPositiveFiniteTimeoutMs(value);
-	return seconds === void 0 ? void 0 : seconds * 1e3;
-}
-function readDynamicToolTimeoutSecondsAsMs(value) {
-	if (typeof value !== "number" || !Number.isFinite(value) || !Number.isInteger(value) || value <= 0) return;
-	return value * 1e3;
-}
-function readPositiveFiniteTimeoutMs(value) {
-	return typeof value === "number" && Number.isFinite(value) && value > 0 ? Math.floor(value) : void 0;
-}
-function clampDynamicToolTimeoutMs(timeoutMs) {
-	return Math.max(1, Math.min(CODEX_DYNAMIC_TOOL_MAX_TIMEOUT_MS, Math.floor(timeoutMs)));
-}
-//#endregion
-//#region extensions/codex/src/app-server/native-hook-relay-state.ts
-const pending = /* @__PURE__ */ new Set();
-/** Owns delayed hook-relay cleanup across runtime scheduling and test teardown. */
-const nativeHookRelayUnregisterQueue = {
-	add(entry) {
-		pending.add(entry);
-	},
-	delete(entry) {
-		return pending.delete(entry);
-	},
-	flush() {
-		while (pending.size > 0) {
-			const entry = pending.values().next().value;
-			if (!entry) return;
-			clearTimeout(entry.timeout);
-			entry.unregister();
-		}
-	},
-	clear() {
-		for (const entry of pending) clearTimeout(entry.timeout);
-		pending.clear();
-	}
-};
-//#endregion
-//#region extensions/codex/src/app-server/native-hook-relay.ts
-/**
-* Bridges Codex native hook callbacks into OpenClaw's native hook relay so
-* app-server tool events can still run OpenClaw policy and diagnostics.
-*/
-/** Codex hook events that can be registered through OpenClaw's native relay. */
-const CODEX_NATIVE_HOOK_RELAY_EVENTS = [
-	"pre_tool_use",
-	"post_tool_use",
-	"permission_request",
-	"before_agent_finalize"
-];
-const CODEX_NATIVE_HOOK_RELAY_EVENTS_WITH_APP_SERVER_APPROVALS = CODEX_NATIVE_HOOK_RELAY_EVENTS.filter((event) => event !== "permission_request");
-const CODEX_NATIVE_HOOK_RELAY_MIN_TTL_MS = 30 * 6e4;
-/** Extra relay lifetime after the expected turn budget, preventing late hook drops. */
-const CODEX_NATIVE_HOOK_RELAY_TTL_GRACE_MS = 5 * 6e4;
-const CODEX_NATIVE_HOOK_RELAY_COMMAND_MIN_PARENT_MARGIN_MS = 250;
-const CODEX_NATIVE_HOOK_RELAY_COMMAND_MAX_PARENT_MARGIN_MS = 1e3;
-const CODEX_NATIVE_HOOK_RELAY_DEFAULT_TIMEOUT_SEC = 10;
-const CODEX_NATIVE_HOOK_RELAY_UNREGISTER_GRACE_MS = 1e4;
-const CODEX_NATIVE_HOOK_RELAY_UNREGISTER_EXTRA_GRACE_MS = 5e3;
-const MAX_PENDING_DIRECT_CHILD_ADMISSIONS = 32;
-const CODEX_HOOK_MATCHER_NAMES_BY_TOOL_ID = {
-	exec: [
-		"Bash",
-		"exec",
-		"exec_command"
-	],
-	apply_patch: [
-		"apply_patch",
-		"Write",
-		"Edit"
-	],
-	spawn_agent: ["spawn_agent", "Agent"]
-};
-/** Defers relay unregister so late native hook subprocesses can still resolve. */
-function scheduleCodexNativeHookRelayUnregister(params) {
-	let pending;
-	const unregister = () => {
-		if (!pending) return;
-		const current = pending;
-		pending = void 0;
-		if (!nativeHookRelayUnregisterQueue.delete(current)) return;
-		params.relay.unregister();
-	};
-	const timeout = setTimeout(unregister, resolveCodexNativeHookRelayUnregisterGraceMs(params.hookTimeoutSec));
-	pending = {
-		timeout,
-		unregister
-	};
-	nativeHookRelayUnregisterQueue.add(pending);
-	timeout.unref();
-}
-/** Computes the delayed unregister window from Codex's hook timeout. */
-function resolveCodexNativeHookRelayUnregisterGraceMs(hookTimeoutSec) {
-	const hookTimeoutMs = finiteSecondsToTimerSafeMilliseconds(normalizeHookTimeoutSec(hookTimeoutSec)) ?? 0;
-	return Math.max(CODEX_NATIVE_HOOK_RELAY_UNREGISTER_GRACE_MS, addTimerTimeoutGraceMs(hookTimeoutMs, CODEX_NATIVE_HOOK_RELAY_UNREGISTER_EXTRA_GRACE_MS) ?? 0);
-}
-/** Records a native pre-tool failure that Codex does not project as a tool item. */
-function emitCodexNativePreToolUseFailureDiagnostic(params) {
-	emitTrustedDiagnosticEvent({
-		type: "tool.execution.error",
-		...params.agentId ? { agentId: params.agentId } : {},
-		sessionId: params.sessionId,
-		...params.sessionKey ? { sessionKey: params.sessionKey } : {},
-		runId: params.runId,
-		toolName: params.failure.toolName,
-		toolCallId: params.failure.toolCallId,
-		durationMs: params.failure.durationMs,
-		errorCategory: "before_tool_call",
-		terminalReason: params.terminalReason ?? (params.signal?.aborted ? resolveCodexToolAbortTerminalReason(params.signal) : params.failure.disposition),
-		...params.sourceTimestampMs !== void 0 ? { sourceTimestampMs: params.sourceTimestampMs } : {}
-	});
-}
-/** Registers an OpenClaw native hook relay for a Codex app-server turn. */
-function createCodexNativeHookRelay(params) {
-	if (params.options?.enabled === false) return;
-	const directChildClaims = /* @__PURE__ */ new Map();
-	const pendingDirectChildAdmissions = /* @__PURE__ */ new Map();
-	let foregroundClosed = false;
-	let successfulYieldRetentionAuthorized = false;
-	const assertClaim = (threadId, claim) => () => directChildClaims.get(threadId) === claim;
-	const rejectPendingAdmissions = (reason) => {
-		for (const pending of pendingDirectChildAdmissions.values()) pending.reject(new Error(reason));
-		pendingDirectChildAdmissions.clear();
-	};
-	const relay = registerRetainedNativeHookRelayForBundledRuntime({
-		provider: "codex",
-		relayId: buildCodexNativeHookRelayId({
-			agentId: params.agentId,
-			sessionId: params.sessionId,
-			sessionKey: params.sessionKey
-		}),
-		...params.generation ? { generation: params.generation } : {},
-		...params.generationMismatchGraceMs ? { generationMismatchGraceMs: params.generationMismatchGraceMs } : {},
-		...params.agentId ? { agentId: params.agentId } : {},
-		sessionId: params.sessionId,
-		...params.sessionKey ? { sessionKey: params.sessionKey } : {},
-		...params.config ? { config: params.config } : {},
-		runId: params.runId,
-		...params.channelId ? { channelId: params.channelId } : {},
-		...params.requester ? { requester: params.requester } : {},
-		...params.approvalContext ? { approvalContext: params.approvalContext } : {},
-		allowedEvents: params.events,
-		preToolUseLoopDetection: params.loopDetectionPreToolUseRelay,
-		ttlMs: resolveCodexNativeHookRelayTtlMs({
-			explicitTtlMs: params.options?.ttlMs,
-			attemptTimeoutMs: params.attemptTimeoutMs,
-			startupTimeoutMs: params.startupTimeoutMs,
-			turnStartTimeoutMs: params.turnStartTimeoutMs
-		}),
-		signal: params.signal,
-		runBeforeToolCall: params.hostCapabilities.runBeforeToolCall,
-		assertActive: params.hostCapabilities.assertActive,
-		retention: {
-			readClaim: readCodexNativeChildThreadId,
-			shouldRetainAfterForegroundClose: () => successfulYieldRetentionAuthorized && directChildClaims.size > 0,
-			allowPreToolUse: (childThreadId) => directChildClaims.has(childThreadId),
-			awaitForegroundAdmission: (childThreadId) => {
-				if (foregroundClosed) return Promise.reject(/* @__PURE__ */ new Error("native hook relay foreground admission unavailable"));
-				const existingClaim = directChildClaims.get(childThreadId);
-				if (existingClaim) return Promise.resolve(assertClaim(childThreadId, existingClaim));
-				const existingPending = pendingDirectChildAdmissions.get(childThreadId);
-				if (existingPending) return existingPending.promise.then((claim) => assertClaim(childThreadId, claim));
-				if (pendingDirectChildAdmissions.size >= MAX_PENDING_DIRECT_CHILD_ADMISSIONS) return Promise.reject(/* @__PURE__ */ new Error("native hook relay foreground admission capacity reached"));
-				const { promise, resolve, reject } = createDeferred();
-				pendingDirectChildAdmissions.set(childThreadId, {
-					promise,
-					resolve,
-					reject
-				});
-				return promise.then((claim) => assertClaim(childThreadId, claim));
-			},
-			onDispose: () => {
-				foregroundClosed = true;
-				rejectPendingAdmissions("native hook relay registration closed");
-			}
-		},
-		onPreToolUseFailure: params.onPreToolUseFailure,
-		command: {
-			nice: 10,
-			timeoutMs: params.options?.gatewayTimeoutMs
-		}
-	});
-	const unregister = () => {
-		foregroundClosed = true;
-		rejectPendingAdmissions("native hook relay foreground closed");
-		relay.unregister();
-	};
-	return {
-		...relay,
-		unregister,
-		authorizeRetentionAfterSuccessfulYield: () => {
-			successfulYieldRetentionAuthorized = true;
-		},
-		hasClaimedDirectChild: () => directChildClaims.size > 0,
-		rejectPendingDirectChild: (threadIdInput, reason) => {
-			const threadId = threadIdInput.trim();
-			const pending = threadId ? pendingDirectChildAdmissions.get(threadId) : void 0;
-			if (!pending) return;
-			pendingDirectChildAdmissions.delete(threadId);
-			pending.reject(new Error(reason));
-		},
-		claimDirectChild: (threadIdInput) => {
-			const threadId = threadIdInput.trim();
-			if (!threadId) return () => void 0;
-			if (directChildClaims.get(threadId)) return () => void 0;
-			const claim = Symbol(threadId);
-			directChildClaims.set(threadId, claim);
-			const pending = pendingDirectChildAdmissions.get(threadId);
-			pendingDirectChildAdmissions.delete(threadId);
-			pending?.resolve(claim);
-			let released = false;
-			return () => {
-				if (released) return;
-				released = true;
-				if (directChildClaims.get(threadId) !== claim) return;
-				directChildClaims.delete(threadId);
-				if (foregroundClosed && directChildClaims.size === 0) relay.unregister();
-			};
-		}
-	};
-}
-function readCodexNativeChildThreadId(rawPayload) {
-	if (!isJsonObject(rawPayload) || typeof rawPayload.agent_id !== "string") return;
-	return rawPayload.agent_id.trim() || void 0;
-}
-/** Selects the native hook events Codex should install for the current approval mode. */
-function resolveCodexNativeHookRelayEvents(params) {
-	if (params.configuredEvents?.length) return params.configuredEvents;
-	return params.appServer.approvalPolicy === "never" ? CODEX_NATIVE_HOOK_RELAY_EVENTS : CODEX_NATIVE_HOOK_RELAY_EVENTS_WITH_APP_SERVER_APPROVALS;
-}
-/** Derives the native hook relay TTL from the turn budget unless explicitly configured. */
-function resolveCodexNativeHookRelayTtlMs(params) {
-	if (params.explicitTtlMs !== void 0) return params.explicitTtlMs;
-	const relayBudgetMs = params.attemptTimeoutMs + params.startupTimeoutMs + params.turnStartTimeoutMs + CODEX_NATIVE_HOOK_RELAY_TTL_GRACE_MS;
-	return Math.max(CODEX_NATIVE_HOOK_RELAY_MIN_TTL_MS, Math.floor(relayBudgetMs));
-}
-/** Builds a stable relay id scoped to the agent and session identity. */
-function buildCodexNativeHookRelayId(params) {
-	const hash = createHash("sha256");
-	hash.update("openclaw:codex:native-hook-relay:v1");
-	hash.update("\0");
-	hash.update(params.agentId?.trim() || "");
-	hash.update("\0");
-	hash.update(params.sessionKey?.trim() || params.sessionId);
-	return `codex-${hash.digest("hex").slice(0, 40)}`;
-}
-const CODEX_HOOK_EVENT_BY_NATIVE_EVENT = {
-	pre_tool_use: "PreToolUse",
-	post_tool_use: "PostToolUse",
-	permission_request: "PermissionRequest",
-	before_agent_finalize: "Stop"
-};
-const CODEX_HOOK_KEY_LABEL_BY_NATIVE_EVENT = {
-	pre_tool_use: "pre_tool_use",
-	post_tool_use: "post_tool_use",
-	permission_request: "permission_request",
-	before_agent_finalize: "stop"
-};
-const CODEX_SESSION_FLAGS_HOOK_SOURCE_PATHS = ["/<session-flags>/config.toml", "<session-flags>/config.toml"];
-/** Builds the Codex config overlay that installs trusted command hooks for relay events. */
-function buildCodexNativeHookRelayConfig(params) {
-	const events = params.events?.length ? params.events : CODEX_NATIVE_HOOK_RELAY_EVENTS;
-	const selectedEvents = new Set(events);
-	const config = { "features.hooks": true };
-	const hookState = {};
-	for (const event of CODEX_NATIVE_HOOK_RELAY_EVENTS) {
-		const codexEvent = CODEX_HOOK_EVENT_BY_NATIVE_EVENT[event];
-		const selected = selectedEvents.has(event);
-		const shouldRelay = params.relay.shouldRelayEvent(event);
-		if (!selected || !shouldRelay) {
-			if (selected || params.clearOmittedEvents) config[`hooks.${codexEvent}`] = [];
-			if (params.clearOmittedEvents) for (const sourcePath of CODEX_SESSION_FLAGS_HOOK_SOURCE_PATHS) hookState[`${sourcePath}:${CODEX_HOOK_KEY_LABEL_BY_NATIVE_EVENT[event]}:0:0`] = { enabled: false };
-			continue;
-		}
-		const timeout = normalizeHookTimeoutSec(params.hookTimeoutSec);
-		const command = params.relay.commandForEvent(event, { timeoutMs: resolveCodexNativeHookRelayCommandTimeoutMs(timeout) });
-		const matcher = buildCodexNativeToolMatcher(params.relay.toolMatcherForEvent(event));
-		config[`hooks.${codexEvent}`] = [{
-			...matcher ? { matcher } : {},
-			hooks: [{
-				type: "command",
-				command,
-				timeout,
-				async: false,
-				statusMessage: "OpenClaw native hook relay"
-			}]
-		}];
-		const state = {
-			enabled: true,
-			trusted_hash: codexCommandHookTrustedHash({
-				event,
-				command,
-				matcher,
-				timeout,
-				statusMessage: "OpenClaw native hook relay"
-			})
-		};
-		for (const sourcePath of CODEX_SESSION_FLAGS_HOOK_SOURCE_PATHS) hookState[`${sourcePath}:${CODEX_HOOK_KEY_LABEL_BY_NATIVE_EVENT[event]}:0:0`] = state;
-	}
-	config["hooks.state"] = hookState;
-	return config;
-}
-/** Builds a Codex config overlay that disables native hooks and clears hook arrays. */
-function buildCodexNativeHookRelayDisabledConfig() {
-	return {
-		"features.hooks": false,
-		"hooks.PreToolUse": [],
-		"hooks.PostToolUse": [],
-		"hooks.PermissionRequest": [],
-		"hooks.Stop": []
-	};
-}
-function normalizeHookTimeoutSec(value) {
-	return typeof value === "number" && Number.isFinite(value) && value > 0 ? Math.ceil(value) : CODEX_NATIVE_HOOK_RELAY_DEFAULT_TIMEOUT_SEC;
-}
-function resolveCodexNativeHookRelayCommandTimeoutMs(hookTimeoutSec) {
-	const parentTimeoutMs = finiteSecondsToTimerSafeMilliseconds(normalizeHookTimeoutSec(hookTimeoutSec)) ?? 5e3;
-	const parentMarginMs = Math.min(CODEX_NATIVE_HOOK_RELAY_COMMAND_MAX_PARENT_MARGIN_MS, Math.max(CODEX_NATIVE_HOOK_RELAY_COMMAND_MIN_PARENT_MARGIN_MS, Math.floor(parentTimeoutMs / 5)));
-	return Math.max(1, parentTimeoutMs - parentMarginMs);
-}
-function buildCodexNativeToolMatcher(toolNames) {
-	if (toolNames === void 0) return;
-	if (toolNames.length === 0) throw new TypeError("Codex native hook matcher requires at least one tool name");
-	const nativeNames = /* @__PURE__ */ new Set();
-	let hasCustomToolName = false;
-	for (const toolName of toolNames) {
-		const canonicalToolName = toolName.trim();
-		if (!canonicalToolName || canonicalToolName === "*") throw new TypeError("Codex native hook matcher requires canonical OpenClaw tool ids");
-		const nativeAliases = CODEX_HOOK_MATCHER_NAMES_BY_TOOL_ID[canonicalToolName];
-		if (!nativeAliases) hasCustomToolName = true;
-		for (const nativeName of nativeAliases ?? [canonicalToolName]) nativeNames.add(nativeName);
-	}
-	const sortedNames = Array.from(nativeNames).toSorted();
-	if (!hasCustomToolName && sortedNames.every((toolName) => /^[A-Za-z0-9_]+$/.test(toolName))) return sortedNames.join("|");
-	return `(?i)^(?:${sortedNames.map((toolName) => toolName.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|")})$`;
-}
-function codexCommandHookTrustedHash(params) {
-	const identity = {
-		event_name: CODEX_HOOK_KEY_LABEL_BY_NATIVE_EVENT[params.event],
-		...params.matcher ? { matcher: params.matcher } : {},
-		hooks: [{
-			async: false,
-			command: params.command,
-			statusMessage: params.statusMessage,
-			timeout: params.timeout,
-			type: "command"
-		}]
-	};
-	return `sha256:${createHash("sha256").update(JSON.stringify(sortJsonValue(identity))).digest("hex")}`;
-}
-function sortJsonValue(value) {
-	if (!value || typeof value !== "object") return value;
-	if (Array.isArray(value)) return value.map(sortJsonValue);
-	const sorted = {};
-	for (const [key, entry] of Object.entries(value).toSorted(([left], [right]) => left.localeCompare(right))) sorted[key] = sortJsonValue(entry);
-	return sorted;
-}
-//#endregion
 //#region extensions/codex/src/app-server/event-projector-native-tool-lifecycle.ts
 /** Projects metadata-only lifecycle diagnostics for native tool items. */
 var CodexNativeToolLifecycleProjector = class {
@@ -1326,83 +547,47 @@ const dynamicToolBuildState = {};
 const CODEX_NODE_EXEC_DYNAMIC_TOOL_NAME = "node_exec";
 const CODEX_GATEWAY_EXEC_DYNAMIC_TOOL_NAME = "gateway_exec";
 const CODEX_GATEWAY_PROCESS_DYNAMIC_TOOL_NAME = "gateway_process";
-const CODEX_EXEC_POLICY_PARAMETER_NAMES = /* @__PURE__ */ new Set([
-	"host",
-	"security",
-	"ask"
-]);
-const CODEX_NODE_EXEC_PARAMETER_NAMES = /* @__PURE__ */ new Set([
-	"command",
-	"workdir",
-	"env",
-	"timeoutSeconds",
-	"node"
-]);
 const PROCESS_FOLLOWUP_TEXT = "Use process (list/poll/log/write/send-keys/submit/paste/kill/clear/remove) for follow-up.";
 /** Returns true when plugin config explicitly removes any named dynamic tool. */
 function isCodexDynamicToolExcluded(config, names) {
 	const normalizedNames = new Set(names.map((name) => normalizeCodexDynamicToolName(name)));
 	return (config.codexDynamicToolsExclude ?? []).some((name) => normalizedNames.has(normalizeCodexDynamicToolName(name)));
 }
-function createExecAliasDynamicTool(execTool, params) {
-	const pinnedNode = params.host === "node" ? params.node?.trim() : void 0;
-	const nodeAlias = params.host === "node";
-	const gatewayProcessAliasAvailable = params.host === "gateway" && params.processAliasAvailable;
-	const name = nodeAlias ? CODEX_NODE_EXEC_DYNAMIC_TOOL_NAME : CODEX_GATEWAY_EXEC_DYNAMIC_TOOL_NAME;
-	const description = nodeAlias ? pinnedNode ? "Run a shell command to completion on the OpenClaw configured remote node for this session. This tool always uses OpenClaw host=node internally and follows the existing node exec approval and allowlist policy. Remote-node background follow-up is unavailable. Use Codex's native shell for local app-server work." : "Run a shell command to completion on an OpenClaw remote node. Select the node by name or id when multiple nodes are available. This tool always uses OpenClaw host=node internally and follows the existing node exec approval and allowlist policy. Remote-node background follow-up is unavailable. Use Codex's native shell for local app-server work." : "Run a shell command through OpenClaw on the Gateway host for OpenClaw-managed Gateway environment access, including Secret Store agent-readable environment values and protected egress sentinels. Native Codex shell remains preferred for ordinary local work. This tool always uses OpenClaw host=gateway internally and follows Gateway exec approval and allowlist policy.";
-	const followupText = nodeAlias ? "Remote-node background follow-up is unavailable. Wait for the command to complete." : gatewayProcessAliasAvailable ? "Use gateway_process (list/poll/log/write/send-keys/submit/paste/kill/clear/remove) for follow-up." : "Background session follow-up is unavailable because gateway_process is not exposed. Rerun without background=true and set yieldMs high enough to wait for completion.";
-	return {
-		...execTool,
-		name,
-		description,
-		parameters: hideExecDynamicToolParameters(execTool.parameters, !nodeAlias || Boolean(pinnedNode), nodeAlias),
-		execute: async (toolCallId, args, signal, onUpdate) => {
-			const result = await execTool.execute(toolCallId, pinExecDynamicToolArgs(args, params.host, pinnedNode), signal, onUpdate);
-			return {
-				...result,
-				content: result.content.map((item) => item.type === "text" ? Object.assign({}, item, { text: item.text.replace(PROCESS_FOLLOWUP_TEXT, followupText) }) : item)
-			};
-		}
+function createNodeExecAliasDynamicTool(execTool, node) {
+	const pinnedNode = node?.trim();
+	const pinnedTool = pinExecToolTarget(execTool, {
+		host: "node",
+		...pinnedNode ? { node: pinnedNode } : {}
+	});
+	const execute = async (toolCallId, args, signal, onUpdate) => {
+		const result = await pinnedTool.execute(toolCallId, args, signal, onUpdate);
+		return {
+			...result,
+			content: result.content.map((item) => item.type === "text" ? Object.assign({}, item, { text: item.text.replace(PROCESS_FOLLOWUP_TEXT, "Remote-node background follow-up is unavailable. Wait for the command to complete.") }) : item)
+		};
 	};
-}
-function createGatewayProcessAliasDynamicTool(processTool) {
 	return {
-		...processTool,
-		name: CODEX_GATEWAY_PROCESS_DYNAMIC_TOOL_NAME,
-		description: "Manage background shell sessions in the existing per-session OpenClaw process scope: list, poll, log, write, send-keys, submit, paste, kill, clear, or remove. Use for gateway_exec follow-up; use native Codex shell session handling for ordinary local work."
+		...pinnedTool,
+		name: CODEX_NODE_EXEC_DYNAMIC_TOOL_NAME,
+		description: pinnedNode ? "Run a shell command to completion on the OpenClaw configured remote node for this session. This tool always uses OpenClaw host=node internally and follows the existing node exec approval and allowlist policy. Remote-node background follow-up is unavailable. Use Codex's native shell for local app-server work." : "Run a shell command to completion on an OpenClaw remote node. Select the node by name or id when multiple nodes are available. This tool always uses OpenClaw host=node internally and follows the existing node exec approval and allowlist policy. Remote-node background follow-up is unavailable. Use Codex's native shell for local app-server work.",
+		execute
 	};
 }
-function pinExecDynamicToolArgs(args, host, configuredNode) {
-	const { host: _host, security: _security, ask: _ask, node: requestedNode, ...rest } = normalizeExecDynamicToolArgs(args);
-	if (host === "gateway") return {
-		...rest,
-		host
-	};
-	const nodeArgs = Object.fromEntries(Object.entries(rest).filter(([name]) => CODEX_NODE_EXEC_PARAMETER_NAMES.has(name)));
-	const node = configuredNode ?? (typeof requestedNode === "string" ? requestedNode.trim() : "");
-	return {
-		...nodeArgs,
-		host,
-		...node ? { node } : {}
-	};
+function createGatewayExecProjection(createProjection, execTool, params) {
+	return createProjection(execTool, {
+		kind: "exec",
+		name: CODEX_GATEWAY_EXEC_DYNAMIC_TOOL_NAME,
+		description: "Run a shell command through OpenClaw on the Gateway host for OpenClaw-managed Gateway environment access, including Secret Store agent-readable environment values and protected egress sentinels. Native Codex shell remains preferred for ordinary local work. This tool always uses OpenClaw host=gateway internally and follows Gateway exec approval and allowlist policy.",
+		followupText: params.processAliasAvailable ? "Use gateway_process (list/poll/log/write/send-keys/submit/paste/kill/clear/remove) for follow-up." : "Background session follow-up is unavailable because gateway_process is not exposed. Rerun without background=true and set yieldMs high enough to wait for completion.",
+		...params.ask ? { ask: params.ask } : {}
+	});
 }
-function normalizeExecDynamicToolArgs(args) {
-	return args && typeof args === "object" && !Array.isArray(args) ? args : {};
-}
-function hideExecDynamicToolParameters(parameters, hideNode, nodeOnly) {
-	if (!parameters || typeof parameters !== "object" || Array.isArray(parameters)) return parameters;
-	const schema = parameters;
-	const rawProperties = schema.properties;
-	if (!rawProperties || typeof rawProperties !== "object" || Array.isArray(rawProperties)) return parameters;
-	const includeParameter = (name) => nodeOnly ? CODEX_NODE_EXEC_PARAMETER_NAMES.has(name) && !(hideNode && name === "node") : !CODEX_EXEC_POLICY_PARAMETER_NAMES.has(normalizeCodexDynamicToolName(name)) && !(hideNode && normalizeCodexDynamicToolName(name) === "node");
-	const nextProperties = Object.fromEntries(Object.entries(rawProperties).filter(([name]) => includeParameter(name)));
-	const rawRequired = schema.required;
-	const nextRequired = Array.isArray(rawRequired) ? rawRequired.filter((name) => typeof name !== "string" || includeParameter(name)) : rawRequired;
-	return {
-		...schema,
-		properties: nextProperties,
-		...Array.isArray(rawRequired) ? { required: nextRequired } : {}
-	};
+function createGatewayProcessProjection(createProjection, processTool) {
+	return createProjection(processTool, {
+		kind: "process",
+		name: CODEX_GATEWAY_PROCESS_DYNAMIC_TOOL_NAME,
+		description: "Manage background shell sessions in the existing per-session OpenClaw process scope: list, poll, log, write, send-keys, submit, paste, kill, clear, or remove. Use for gateway_exec follow-up; use native Codex shell session handling for ordinary local work."
+	});
 }
 //#endregion
 //#region extensions/codex/src/app-server/vision-tools.ts
@@ -1430,10 +615,10 @@ const CODEX_NATIVE_SANDBOX_TOOL_REQUIREMENTS = [
 	"apply_patch"
 ];
 const CODEX_MEMORY_FLUSH_DYNAMIC_TOOL_ALLOW = /* @__PURE__ */ new Set(["read", "write"]);
-/** Keeps paired-device filesystem and process ownership on its native exec-server. */
+/** Keeps node filesystem and process ownership on its native exec-server. */
 function resolveCodexNodePlacementToolConstructionPlan(sandbox, nativeToolSurfaceEnabled) {
 	if (!isCodexRemoteExecPlacementSandbox(sandbox) || sandbox?.backendId !== "node" || !("placementNodeId" in sandbox) || typeof sandbox.placementNodeId !== "string" || !sandbox.placementNodeId) return;
-	if (!nativeToolSurfaceEnabled) throw new Error("Codex paired-device remote execution requires its native exec-server tool surface; adjust the session tool policy and start a fresh attempt.");
+	if (!nativeToolSurfaceEnabled) throw new Error("Codex node execution requires its native exec-server tool surface; adjust the session tool policy and start a fresh attempt.");
 	return {
 		includeBaseCodingTools: false,
 		includeShellTools: false,
@@ -1518,6 +703,10 @@ async function buildDynamicTools(input) {
 		...params,
 		disableMessageTool: false
 	} : params;
+	const toolRunContext = buildEmbeddedAttemptToolRunContext({
+		...params,
+		forceMessageTool: shouldForceMessageTool(messagePolicyParams)
+	});
 	if (params.disableTools) {
 		input.onWebSearchPolicyResolved?.(false);
 		return [];
@@ -1547,16 +736,17 @@ async function buildDynamicTools(input) {
 		const toolConstructionPlan = resolveCodexNodePlacementToolConstructionPlan(input.sandbox, input.nativeToolSurfaceEnabled);
 		const options = {
 			agentId: input.sessionAgentId,
-			...buildEmbeddedAttemptToolRunContext(params),
+			...toolRunContext,
 			exec: {
 				...params.execOverrides,
+				...input.sessionPermissionPolicy ? { mode: input.sessionPermissionPolicy.execMode } : {},
 				...resolveCodexNodeExecToolOverrides(nativeExecutionPolicy),
 				config: params.config,
 				elevated: params.bashElevated
 			},
-			sessionPermissionPolicy: params.permissionMode && params.sessionRoot ? {
-				mode: params.permissionMode,
-				root: params.sessionRoot
+			sessionPermissionPolicy: input.sessionPermissionPolicy ? {
+				mode: input.sessionPermissionPolicy.mode,
+				root: input.sessionPermissionPolicy.root
 			} : void 0,
 			sandbox: input.sandbox,
 			...toolConstructionPlan ? { toolConstructionPlan } : {},
@@ -1595,6 +785,7 @@ async function buildDynamicTools(input) {
 				resolvedWorkspace: input.resolvedWorkspace
 			}),
 			config: params.config,
+			githubPublicationAvailable: params.githubPublicationAvailable,
 			authProfileStore: params.toolAuthProfileStore ?? params.authProfileStore,
 			abortSignal: input.runAbortController.signal,
 			emitBeforeToolCallDiagnostics: false,
@@ -1616,6 +807,7 @@ async function buildDynamicTools(input) {
 			hasRepliedRef: params.hasRepliedRef,
 			modelHasVision,
 			computerContextEpoch: input.computerContextEpoch,
+			registerRunCleanup: input.registerRunCleanup,
 			requireExplicitMessageTarget: params.requireExplicitMessageTarget ?? isSubagentSessionKey(params.sessionKey),
 			sourceReplyDeliveryMode: params.sourceReplyDeliveryMode,
 			taskSuggestionDeliveryMode: params.taskSuggestionDeliveryMode,
@@ -1698,7 +890,7 @@ async function buildDynamicTools(input) {
 	};
 	const transientWebSearchRestriction = !webSearchPolicy.allowed && webSearchPolicy.persistentAllowed || isCodexMemoryFlushRun(params);
 	input.onPersistentWebSearchPolicyResolved?.(webSearchPresent || persistentCodexWebSearchSurface && transientWebSearchRestriction && webSearchPolicy.persistentAllowed);
-	const filteredTools = filterCodexDynamicToolsForAllowlist(visionFilteredTools, includeForcedCodexDynamicToolAllow(params.toolsAllow, messagePolicyParams));
+	const filteredTools = filterCodexDynamicToolsForAllowlist(visionFilteredTools, toolRunContext.runtimeToolAllowlist);
 	toolBuildStages.mark("allowlist-filter");
 	const normalizedTools = normalizeAgentRuntimeTools({
 		runtimePlan: input.ignoreRuntimePlan ? void 0 : params.runtimePlan,
@@ -1759,23 +951,15 @@ function addGatewayShellDynamicToolsIfAvailable(filteredTools, allTools, input,
 	if (!execTool || execExcluded || existingNames.has("gateway_exec")) return filteredTools;
 	const processExcluded = isCodexDynamicToolExcluded(input.pluginConfig, ["process", CODEX_GATEWAY_PROCESS_DYNAMIC_TOOL_NAME]);
 	const processAliasAvailable = Boolean(processTool && !processExcluded && !existingNames.has("gateway_process"));
-	const toolsToAppend = [createExecAliasDynamicTool(execTool, {
-		host: "gateway",
-		processAliasAvailable
+	const createProjection = resolveCodexScheduledToolProjectionFactory(input.params.hostCapabilities);
+	if (!createProjection) return filteredTools;
+	const toolsToAppend = [createGatewayExecProjection(createProjection, execTool, {
+		processAliasAvailable,
+		...input.sessionPermissionPolicy?.mode === "guarded" ? { ask: "always" } : {}
 	})];
-	if (processAliasAvailable && processTool) toolsToAppend.push(createGatewayProcessAliasDynamicTool(processTool));
+	if (processAliasAvailable && processTool) toolsToAppend.push(createGatewayProcessProjection(createProjection, processTool));
 	return [...filteredTools, ...toolsToAppend];
 }
-/** Preserves delivery-critical tools when a narrow allowlist would otherwise hide them. */
-function includeForcedCodexDynamicToolAllow(toolsAllow, params) {
-	if (toolsAllow === void 0 || hasWildcardCodexToolsAllow(toolsAllow)) return toolsAllow;
-	const forcedToolNames = shouldForceMessageTool(params) ? ["message"] : [];
-	if (forcedToolNames.length === 0) return toolsAllow;
-	if (toolsAllow.length === 0) return forcedToolNames;
-	const normalized = new Set(toolsAllow.map((name) => normalizeCodexDynamicToolName(name)));
-	const missingToolNames = forcedToolNames.filter((toolName) => !normalized.has(normalizeCodexDynamicToolName(toolName)));
-	return missingToolNames.length === 0 ? toolsAllow : [...toolsAllow, ...missingToolNames];
-}
 /** Decides whether Codex native code mode can own shell/file tools for this turn. */
 function shouldEnableCodexAppServerNativeToolSurface(params, sandbox, options = {}) {
 	if (params.pluginHarnessToolPolicyRestricted === true) return false;
@@ -1786,7 +970,7 @@ function shouldEnableCodexAppServerNativeToolSurface(params, sandbox, options =
 		runtimeSessionKey: options.runtimeSessionKey,
 		sandbox
 	})) return false;
-	const toolsAllow = includeForcedCodexDynamicToolAllow(params.toolsAllow, params);
+	const toolsAllow = params.toolsAllow;
 	if (toolsAllow === void 0) return canCodexAppServerNativeToolSurfaceHonorSandbox(sandbox, options);
 	return hasWildcardCodexToolsAllow(toolsAllow) && canCodexAppServerNativeToolSurfaceHonorSandbox(sandbox, options);
 }
@@ -1916,10 +1100,7 @@ function addNodeShellDynamicToolsIfNeeded(filteredTools, allTools, input, nodePo
 	if (!nodeExecIsDefault && !nodeExecAvailableFromAuto) return filteredTools;
 	const execTool = allTools.find((tool) => normalizeCodexDynamicToolName(tool.name) === "exec");
 	if (!execTool) return filteredTools;
-	if (!isCodexDynamicToolExcluded(input.pluginConfig, ["exec", "node_exec"]) && !filteredTools.some((tool) => normalizeCodexDynamicToolName(tool.name) === "node_exec")) return [...filteredTools, createExecAliasDynamicTool(execTool, {
-		host: "node",
-		node: nodePolicy.node
-	})];
+	if (!isCodexDynamicToolExcluded(input.pluginConfig, ["exec", "node_exec"]) && !filteredTools.some((tool) => normalizeCodexDynamicToolName(tool.name) === "node_exec")) return [...filteredTools, createNodeExecAliasDynamicTool(execTool, nodePolicy.node)];
 	return filteredTools;
 }
 function shouldKeepOpenClawShellDynamicTools(input, nodePolicy) {
@@ -1986,7 +1167,7 @@ const nodeExecServerTextDecoder = new TextDecoder("utf-8", { fatal: true });
 /** Produces the bounded, redacted terminal failure shared by pending and claimed node leases. */
 function createCodexNodeExecServerDisconnectError(reason, cause) {
 	const detail = cause === void 0 ? "" : `: ${truncateUtf16Safe(redactSensitiveText(formatErrorMessage$1(cause), { mode: "tools" }), CODEX_NODE_EXEC_SERVER_MAX_FAILURE_DETAIL_CHARS)}`;
-	return /* @__PURE__ */ new Error(`Codex paired execution device disconnected; start a fresh attempt. (${reason}${detail})`);
+	return /* @__PURE__ */ new Error(`Codex execution node disconnected; start a fresh attempt. (${reason}${detail})`);
 }
 /** Relays one authorized, single-use Codex exec-server channel without interpreting its protocol. */
 async function startCodexNodeExecServerRelay(params) {
@@ -2013,7 +1194,7 @@ async function startCodexNodeExecServerRelay(params) {
 		if (!closed && !params.lease.closed) params.lease.onDisconnected?.(createCodexNodeExecServerDisconnectError(reason, cause));
 		closeBoth(code, reason);
 	};
-	params.lease.onChannelClosed = ({ failed, error }) => failUnexpectedly(failed ? 1011 : 1001, failed ? "execution device failed" : "execution device disconnected", error);
+	params.lease.onChannelClosed = ({ failed, error }) => failUnexpectedly(failed ? 1011 : 1001, failed ? "execution node failed" : "execution node disconnected", error);
 	socket.once("close", () => failUnexpectedly(1001, "execution socket closed"));
 	socket.once("error", () => failUnexpectedly(1011, "execution socket failed"));
 	let toNode = Promise.resolve();
@@ -2217,7 +1398,7 @@ function createCredentialedCodexNodeHttpRejection(request) {
 		id: request.id,
 		error: {
 			code: -32602,
-			message: "Authenticated remote HTTP is unavailable on paired devices; run on Gateway or use an intentionally credential-free endpoint."
+			message: "Authenticated remote HTTP is unavailable on execution nodes; run on Gateway or use an intentionally credential-free endpoint."
 		}
 	}));
 }
@@ -3012,6 +2193,8 @@ async function httpRequest(execServer, notifications, params) {
 	const record = requireObject(params, "http/request params");
 	const requestId = requireString(record.requestId, "requestId");
 	const url = requireString(record.url, "url");
+	const redirectPolicy = record.redirectPolicy ?? "follow";
+	if (redirectPolicy !== "follow" && redirectPolicy !== "stop") throw new Error("http/request redirectPolicy must be follow or stop");
 	assertSandboxHttpRequestTargetAllowed(url);
 	const request = {
 		method: requireString(record.method, "method"),
@@ -3019,6 +2202,7 @@ async function httpRequest(execServer, notifications, params) {
 		headers: readHttpHeaders(record.headers),
 		bodyBase64: typeof record.bodyBase64 === "string" ? record.bodyBase64 : void 0,
 		timeoutMs: typeof record.timeoutMs === "number" && record.timeoutMs > 0 ? Math.floor(record.timeoutMs) : void 0,
+		redirectPolicy,
 		streamResponse: record.streamResponse === true
 	};
 	if (request.streamResponse) return await runStreamingSandboxHttpRequest(execServer, notifications, requestId, request);
@@ -3315,9 +2499,40 @@ def assert_url_allowed(url):
     PINNED_ADDRESSES[hostname] = sorted(addresses)
 
 class GuardedRedirectHandler(urllib.request.HTTPRedirectHandler):
+    def __init__(self, redirect_policy):
+        self.redirect_policy = redirect_policy
+
     def redirect_request(self, req, fp, code, msg, headers, newurl):
+        if self.redirect_policy == "stop":
+            return None
         assert_url_allowed(newurl)
-        return super().redirect_request(req, fp, code, msg, headers, newurl)
+        method = req.get_method()
+        drop_body = code == 303 or (code in (301, 302) and method == "POST")
+        next_headers = dict(req.headers)
+        if drop_body:
+            if method != "HEAD":
+                method = "GET"
+            for name in ("content-type", "content-length", "content-encoding", "transfer-encoding"):
+                next_headers.pop(name.capitalize(), None)
+        redirected = urllib.request.Request(
+            newurl,
+            data=None if drop_body else req.data,
+            headers=next_headers,
+            method=method,
+            origin_req_host=req.origin_req_host,
+            unverifiable=True,
+        )
+        previous = urllib.parse.urlsplit(req.full_url)
+        target = urllib.parse.urlsplit(newurl)
+        previous_port = previous.port or (443 if previous.scheme == "https" else 80)
+        target_port = target.port or (443 if target.scheme == "https" else 80)
+        if (previous.scheme, previous.hostname, previous_port) != (
+            target.scheme, target.hostname, target_port
+        ):
+            # Match Codex's route-aware client: cross-origin hops never inherit secrets.
+            for name in ("authorization", "cookie", "proxy-authorization", "www-authenticate", "cookie2"):
+                redirected.remove_header(name.capitalize())
+        return redirected
 
 def pinned_getaddrinfo(original_getaddrinfo):
     def getaddrinfo(host, port, family=0, type=0, proto=0, flags=0):
@@ -3373,7 +2588,8 @@ def main():
     timeout = None
     if isinstance(timeout_ms, (int, float)) and timeout_ms > 0:
         timeout = timeout_ms / 1000
-    opener = urllib.request.build_opener(urllib.request.ProxyHandler({}), GuardedRedirectHandler)
+    redirect_handler = GuardedRedirectHandler(input_data.get("redirectPolicy", "follow"))
+    opener = urllib.request.build_opener(urllib.request.ProxyHandler({}), redirect_handler)
     original_getaddrinfo = socket.getaddrinfo
     socket.getaddrinfo = pinned_getaddrinfo(original_getaddrinfo)
     try:
@@ -3406,6 +2622,7 @@ async function startProcess(execServer, processes, notify, params) {
 	const argv = requireStringArray(record.argv, "argv");
 	const cwd = resolveExecServerPath(requireString(record.cwd, "cwd"), "process cwd");
 	rejectUnsupportedArg0(record.arg0);
+	assertSupportedProcessSandbox(execServer, record);
 	const env = readProcessEnv(record);
 	const managed = {
 		processId,
@@ -3450,7 +2667,18 @@ async function startProcess(execServer, processes, notify, params) {
 	} finally {
 		if (managed.startPromise === startPromise) managed.startPromise = void 0;
 	}
-	return { processId };
+	return {
+		processId,
+		sandboxType: "none"
+	};
+}
+function assertSupportedProcessSandbox(execServer, record) {
+	if (record.networkProxy !== void 0 && record.networkProxy !== null) throw new Error("Codex sandbox exec-server network proxy launch is not supported.");
+	if (record.enforceManagedNetwork === true || record.managedNetwork !== void 0 && record.managedNetwork !== null) throw new Error("Codex managed network restrictions cannot be enforced by the sandbox backend.");
+	if (resolveFsSandboxPolicy(execServer, record)?.unrestricted === false) throw new Error("Codex process filesystem sandbox restrictions cannot be enforced by the backend.");
+	if (record.sandbox === void 0 || record.sandbox === null) return;
+	if (requireObject(requireObject(record.sandbox, "process sandbox context").permissions, "process sandbox permissions").network !== "restricted") return;
+	if (!execServer.networkIsolated) throw new Error("Codex network restrictions cannot be enforced by the sandbox backend.");
 }
 async function runProcess(execServer, managed, params) {
 	const backend = execServer.backend;
@@ -3767,7 +2995,7 @@ async function ensureCodexSandboxExecServerEnvironment(params) {
 	if (!params.sandbox?.enabled) return;
 	const placementNodeId = readCodexPlacementNodeId(params.sandbox);
 	if (!params.sandbox.backend && !placementNodeId) return;
-	if (placementNodeId && !params.runtime) throw new Error("Codex paired-device execution requires its active plugin runtime.");
+	if (placementNodeId && !params.runtime) throw new Error("Codex node execution requires its active plugin runtime.");
 	if (!canExposeLocalExecServerToAppServer(params.appServerStartOptions)) throw new Error("OpenClaw Codex exec-server uses a local loopback URL and cannot be registered with a remote Codex app-server.");
 	const { server: execServer, nodeLease } = await acquireOpenClawExecServer({
 		sandbox: params.sandbox,
@@ -3833,7 +3061,7 @@ async function acquireOpenClawExecServer(params) {
 			if (!("node" in server)) return { server };
 			if (!runtime || !signal) {
 				await releaseOpenClawExecServer(server);
-				throw new Error("Codex paired-device execution requires an active runtime and attempt.");
+				throw new Error("Codex node execution requires an active runtime and attempt.");
 			}
 			try {
 				const placementIdentity = readCodexPlacementWorkspaceIdentity(sandbox);
@@ -3852,7 +3080,7 @@ async function acquireOpenClawExecServer(params) {
 				});
 				if (signal.aborted || server.closed || sandboxExecServerRegistry.servers.get(key) !== promise) {
 					channel.close();
-					throw new Error("Codex paired-device execution retired before its channel was ready.");
+					throw new Error("Codex node execution retired before its channel was ready.");
 				}
 				const nodeLease = {
 					id: randomUUID(),
@@ -3936,7 +3164,8 @@ async function startOpenClawExecServer(sandbox) {
 	} : {
 		...common,
 		backend: connection.backend,
-		fsBridge: connection.fsBridge
+		fsBridge: connection.fsBridge,
+		networkIsolated: (connection.backend.id === "docker" || connection.backend.id === "podman") && sandbox.docker.network.trim().toLowerCase() === "none"
 	};
 	server.on("connection", (socket, request) => {
 		socket.on("error", handleExecServerSocketError);
@@ -3977,7 +3206,7 @@ function readCodexPlacementNodeId(sandbox) {
 	return sandbox.placementNodeId;
 }
 function readCodexPlacementWorkspaceIdentity(sandbox) {
-	if (!("placementEnvironmentId" in sandbox) || typeof sandbox.placementEnvironmentId !== "string" || !sandbox.placementEnvironmentId || sandbox.placementEnvironmentId.trim() !== sandbox.placementEnvironmentId || !("placementSessionId" in sandbox) || typeof sandbox.placementSessionId !== "string" || !sandbox.placementSessionId || sandbox.placementSessionId.trim() !== sandbox.placementSessionId || !("placementOwnerEpoch" in sandbox) || typeof sandbox.placementOwnerEpoch !== "number" || !Number.isSafeInteger(sandbox.placementOwnerEpoch) || sandbox.placementOwnerEpoch < 1 || !sandbox.sessionKey || sandbox.sessionKey.trim() !== sandbox.sessionKey) throw new Error("Codex paired-device execution requires its exact placement workspace identity.");
+	if (!("placementEnvironmentId" in sandbox) || typeof sandbox.placementEnvironmentId !== "string" || !sandbox.placementEnvironmentId || sandbox.placementEnvironmentId.trim() !== sandbox.placementEnvironmentId || !("placementSessionId" in sandbox) || typeof sandbox.placementSessionId !== "string" || !sandbox.placementSessionId || sandbox.placementSessionId.trim() !== sandbox.placementSessionId || !("placementOwnerEpoch" in sandbox) || typeof sandbox.placementOwnerEpoch !== "number" || !Number.isSafeInteger(sandbox.placementOwnerEpoch) || sandbox.placementOwnerEpoch < 1 || !sandbox.sessionKey || sandbox.sessionKey.trim() !== sandbox.sessionKey) throw new Error("Codex node execution requires its exact placement workspace identity.");
 	return {
 		environmentId: sandbox.placementEnvironmentId,
 		sessionId: sandbox.placementSessionId,
@@ -4018,7 +3247,7 @@ function handleClosedCodexNodeExecServerLease(execServer, lease, result) {
 		return;
 	}
 	try {
-		lease.onDisconnected?.(createCodexNodeExecServerDisconnectError(result.failed ? "execution device failed" : "execution device disconnected", result.error));
+		lease.onDisconnected?.(createCodexNodeExecServerDisconnectError(result.failed ? "execution node failed" : "execution node disconnected", result.error));
 	} finally {
 		closeCodexNodeExecServerLease(execServer, lease);
 	}
@@ -4156,7 +3385,7 @@ async function handleCodexAppServerApprovalRequest(params) {
 		return buildApprovalResponse(params.method, context.requestParams, resolvedOutcome);
 	};
 	try {
-		if (params.method === "item/commandExecution/requestApproval") {
+		if (params.method === "item/commandExecution/requestApproval" && !readNetworkApprovalContext(requestParams)) {
 			const command = readPolicyCommand(requestParams);
 			const cwd = readStringField(requestParams, "cwd") ?? params.paramsForRun.workspaceDir;
 			const prepareMutableFileApproval = params.paramsForRun.hostCapabilities.prepareMutableFileApproval;
@@ -4183,7 +3412,7 @@ async function handleCodexAppServerApprovalRequest(params) {
 			return await resolvePolicyApproval("denied", policyOutcome.reason);
 		}
 		if (policyOutcome?.outcome === "approved-once" || policyOutcome?.outcome === "approved-session") return await resolvePolicyApproval(policyOutcome.outcome);
-		if (CONCRETE_TOOL_AUTO_APPROVAL_METHODS.has(params.method) && params.autoApprove === true) return await resolvePolicyApproval("approved-session", "Codex app-server approval auto-approved by runtime policy.");
+		if (CONCRETE_TOOL_AUTO_APPROVAL_METHODS.has(params.method) && !readNetworkApprovalContext(requestParams) && params.autoApprove === true) return await resolvePolicyApproval("approved-session", "Codex app-server approval auto-approved by runtime policy.");
 		const requestResult = await requestPluginApproval({
 			hostCapabilities: params.paramsForRun.hostCapabilities,
 			title: context.title,
@@ -4299,18 +3528,19 @@ function buildApprovalContext(params) {
 	const reasonPreview = sanitizeApprovalPreview(readStringPreview(params.requestParams, "reason"), 180);
 	const command = commandPreview.text;
 	const reason = reasonPreview.text;
+	const networkApproval = params.method === "item/commandExecution/requestApproval" ? readNetworkApprovalContext(params.requestParams) : void 0;
 	const approvalKind = params.method.includes("commandExecution") ? "command" : params.method.includes("fileChange") ? "file-change" : params.method.includes("permissions") ? "permissions" : "other";
 	const kind = approvalKind === "command" ? "exec" : approvalKind === "other" ? "unknown" : "plugin";
 	const permissionLines = params.method === "item/permissions/requestApproval" ? describeRequestedPermissions(params.requestParams) : [];
-	const title = kind === "exec" ? "Codex app-server command approval" : params.method === "item/permissions/requestApproval" ? "Codex app-server permission approval" : kind === "plugin" ? "Codex app-server file approval" : "Codex app-server approval";
-	const subject = permissionLines[0] ?? (command ? `Command: ${formatApprovalPreviewSubject(command, commandPreview.omitted)}` : commandPreview.omitted ? `Command: ${APPROVAL_PREVIEW_OMITTED}` : reason ? `Reason: ${formatApprovalPreviewSubject(reason, reasonPreview.omitted)}` : reasonPreview.omitted ? `Reason: ${APPROVAL_PREVIEW_OMITTED}` : `Request method: ${params.method}`);
+	const title = networkApproval ? "Codex app-server network approval" : kind === "exec" ? "Codex app-server command approval" : params.method === "item/permissions/requestApproval" ? "Codex app-server permission approval" : kind === "plugin" ? "Codex app-server file approval" : "Codex app-server approval";
+	const subject = (networkApproval ? `Network: ${sanitizePermissionScalar(networkApproval.protocol)}://${sanitizePermissionHostValue(networkApproval.host)}` : void 0) ?? permissionLines[0] ?? (command ? `Command: ${formatApprovalPreviewSubject(command, commandPreview.omitted)}` : commandPreview.omitted ? `Command: ${APPROVAL_PREVIEW_OMITTED}` : reason ? `Reason: ${formatApprovalPreviewSubject(reason, reasonPreview.omitted)}` : reasonPreview.omitted ? `Reason: ${APPROVAL_PREVIEW_OMITTED}` : `Request method: ${params.method}`);
 	return {
 		approvalKind,
 		kind,
 		title,
 		description: permissionLines.length > 0 ? joinDescriptionLinesWithinLimit(permissionLines, PERMISSION_DESCRIPTION_MAX_LENGTH) : [subject, ...commandDetailLines].join("\n"),
 		severity: kind === "exec" ? "warning" : "info",
-		toolName: kind === "exec" ? "codex_command_approval" : params.method === "item/permissions/requestApproval" ? "codex_permission_approval" : "codex_file_approval",
+		toolName: networkApproval ? "codex_network_approval" : kind === "exec" ? "codex_command_approval" : params.method === "item/permissions/requestApproval" ? "codex_permission_approval" : "codex_file_approval",
 		itemId,
 		approvalId,
 		requestParams: params.requestParams,
@@ -4482,6 +3712,10 @@ function sanitizeRelayDecisionReason(value) {
 }
 function buildOpenClawToolPolicyRequest(method, requestParams) {
 	if (method === "item/commandExecution/requestApproval") {
+		if (readNetworkApprovalContext(requestParams)) return {
+			toolName: "codex_network_approval",
+			params: { approval: requestParams ?? {} }
+		};
 		const command = readPolicyCommand(requestParams);
 		return {
 			toolName: "exec",
@@ -4769,6 +4003,15 @@ function readPolicyCommand(record) {
 	const actionCommands = readCommandActions(record);
 	if (actionCommands.length > 0) return actionCommands.join(" && ");
 }
+function readNetworkApprovalContext(record) {
+	const context = isJsonObject(record?.networkApprovalContext) ? record.networkApprovalContext : void 0;
+	const host = readStringField(context, "host");
+	const protocol = readStringField(context, "protocol");
+	return host && protocol ? {
+		host,
+		protocol
+	} : void 0;
+}
 function readCommandActions(record) {
 	const actions = record?.commandActions;
 	if (!Array.isArray(actions)) return [];
@@ -4958,6 +4201,7 @@ async function routeCodexAppServerElicitationRequest(params) {
 	if (!requestParams || readNonBlankStringField(requestParams, "threadId") !== params.threadId) return { kind: "not-mine" };
 	const requestTurnId = requestParams.turnId;
 	if (requestTurnId !== null && requestTurnId !== void 0 && requestTurnId !== params.turnId) return { kind: "not-mine" };
+	if (!((isJsonObject(requestParams["_meta"]) ? requestParams["_meta"] : void 0)?.[MCP_TOOL_APPROVAL_KIND_KEY] === MCP_TOOL_APPROVAL_KIND || params.computerUseMcpServerName !== void 0 && readNonBlankStringField(requestParams, "serverName") === params.computerUseMcpServerName)) return { kind: "not-mine" };
 	const pluginResolution = resolvePluginElicitation({
 		requestParams,
 		pluginAppPolicyContext: params.pluginAppPolicyContext
@@ -4983,7 +4227,7 @@ async function routeCodexAppServerElicitationRequest(params) {
 		}));
 	}
 	const approvalPrompt = readComputerUseApprovalElicitation(requestParams, params.computerUseMcpServerName) ?? readBridgeableApprovalElicitation(requestParams);
-	if (!approvalPrompt) return (isJsonObject(requestParams["_meta"]) ? requestParams["_meta"] : void 0)?.[MCP_TOOL_APPROVAL_KIND_KEY] === MCP_TOOL_APPROVAL_KIND || params.computerUseMcpServerName !== void 0 && readNonBlankStringField(requestParams, "serverName") === params.computerUseMcpServerName ? handled(createCodexElicitationResponse("decline")) : { kind: "not-mine" };
+	if (!approvalPrompt) return handled(createCodexElicitationResponse("decline"));
 	return handled(buildElicitationResponse(approvalPrompt, await requestPluginApprovalOutcome({
 		paramsForRun: params.paramsForRun,
 		title: approvalPrompt.title,
@@ -6526,4 +5770,4 @@ function isCronAddAction(args) {
 	return typeof action === "string" && action.trim().toLowerCase() === "add";
 }
 //#endregion
-export { buildCodexNativeHookRelayConfig as A, isMatchingDynamicToolTerminalDiagnostic as B, shouldRequireCodexSandboxExecServerEnvironment as C, CodexNativeToolLifecycleProjector as D, readBoundedCodexRemoteWorkspaceFile as E, resolveCodexNativeHookRelayTtlMs as F, toCodexDynamicToolProgressResponse as G, resolveTerminalDynamicToolBatchAction as H, scheduleCodexNativeHookRelayUnregister as I, toCodexDynamicToolProtocolResponse as K, handleDynamicToolCallWithTimeout as L, createCodexNativeHookRelay as M, emitCodexNativePreToolUseFailureDiagnostic as N, CODEX_NATIVE_HOOK_RELAY_EVENTS as O, resolveCodexNativeHookRelayEvents as P, hasPendingDynamicToolTerminalDiagnostic as R, shouldEnableCodexAppServerNativeToolSurface as S, filterCodexVisionTools as T, shouldBlockTerminalReleaseForNonTerminalDynamicToolResult as U, resolveDynamicToolCallTimeoutMs as V, shouldReleaseTurnAfterTerminalDynamicTool as W, resolveCodexAppServerHookChannelId as _, emitDynamicToolStartedDiagnostic as a, resolveCodexNodePlacementToolConstructionPlan as b, resolveCodexProviderWebSearchSupport as c, releaseCodexSandboxExecServerEnvironment as d, buildDynamicTools as f, resolveCodexAppServerExecutionCwd as g, formatCodexDynamicToolBuildStageSummary as h, emitDynamicToolErrorDiagnostic as i, buildCodexNativeHookRelayDisabledConfig as j, CODEX_NATIVE_HOOK_RELAY_TTL_GRACE_MS as k, resolveCodexProviderWebSearchSupportForClient as l, disableCodexPluginThreadConfig as m, projectCodexExecutableDynamicTools as n, emitDynamicToolTerminalDiagnostic as o, createCodexDynamicToolBuildStageTracker as p, resolveCodexToolAbortTerminalReason as q, routeCodexAppServerElicitationRequest as r, handleCodexAppServerApprovalRequest as s, createCodexDynamicToolBridge as t, ensureCodexSandboxExecServerEnvironment as u, resolveCodexExternalSandboxPolicyForOpenClawSandbox as v, shouldWarnCodexDynamicToolBuildStageSummary as w, resolveCodexSandboxEnvironmentSelection as x, resolveCodexMessageToolProvider as y, isDynamicToolTerminalDiagnosticEvent as z };
+export { shouldRequireCodexSandboxExecServerEnvironment as C, CodexNativeToolLifecycleProjector as D, readBoundedCodexRemoteWorkspaceFile as E, shouldEnableCodexAppServerNativeToolSurface as S, filterCodexVisionTools as T, resolveCodexAppServerHookChannelId as _, emitDynamicToolStartedDiagnostic as a, resolveCodexNodePlacementToolConstructionPlan as b, resolveCodexProviderWebSearchSupport as c, releaseCodexSandboxExecServerEnvironment as d, buildDynamicTools as f, resolveCodexAppServerExecutionCwd as g, formatCodexDynamicToolBuildStageSummary as h, emitDynamicToolErrorDiagnostic as i, resolveCodexProviderWebSearchSupportForClient as l, disableCodexPluginThreadConfig as m, projectCodexExecutableDynamicTools as n, emitDynamicToolTerminalDiagnostic as o, createCodexDynamicToolBuildStageTracker as p, routeCodexAppServerElicitationRequest as r, handleCodexAppServerApprovalRequest as s, createCodexDynamicToolBridge as t, ensureCodexSandboxExecServerEnvironment as u, resolveCodexExternalSandboxPolicyForOpenClawSandbox as v, shouldWarnCodexDynamicToolBuildStageSummary as w, resolveCodexSandboxEnvironmentSelection as x, resolveCodexMessageToolProvider as y };