@openclaw/codex 2026.8.1 → 2026.8.2

package/dist/{shared-client-kNkljY-R.js → shared-client-B1tT5U6r.js}

@@ -1,8 +1,8 @@
 import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
-import { F as resolveCodexAppServerLocalHomeDir, I as resolveCodexAppServerUserHomeDir, L as withEphemeralCodexAuthStore, P as resolveCodexAppServerHomeDir, a as resolveCodexAppServerStartOptionsForAgent, i as resolveCodexAppServerRuntimeOptions, o as resolveCodexComputerUseConfig, t as codexAppServerStartOptionsKey } from "./config-Cxw3Cl3k.js";
+import { F as resolveCodexAppServerLocalHomeDir, I as resolveCodexAppServerUserHomeDir, L as withEphemeralCodexAuthStore, P as resolveCodexAppServerHomeDir, a as resolveCodexAppServerStartOptionsForAgent, i as resolveCodexAppServerRuntimeOptions, o as resolveCodexComputerUseConfig, t as codexAppServerStartOptionsKey } from "./config-CcYL77O6.js";
 import { a as CODEX_APP_SERVER_VERSION, c as resolveMacOSDesktopCodexAppPathCandidates, l as resolveMacOSDesktopCodexBundledMarketplaceCandidates, n as resolveManagedCodexAppServerStartOptions, o as MIN_SUPPORTED_CODEX_APP_SERVER_VERSION, r as resolveManagedCodexNativeCommand, s as resolveFirstExistingMacOSDesktopCodexBundledMarketplacePath, t as isManagedCodexDesktopCommand, u as resolveMacOSDesktopCodexComputerUseServiceAppCandidates } from "./managed-binary-ZkGodW19.js";
-import { o as isCodexAppServerNativeAuthProfile } from "./session-binding-q2WSTVmC.js";
-import { a as hasCodexAppServerNaturalExit, i as closeCodexAppServerTransportAndWait, n as resolveCodexAppServerSpawnEnv, r as closeCodexAppServerTransport, t as createStdioTransport } from "./transport-stdio-C7-s9TLG.js";
+import { o as isCodexAppServerNativeAuthProfile } from "./session-binding-D0zinCP1.js";
+import { a as hasCodexAppServerNaturalExit, i as closeCodexAppServerTransportAndWait, n as resolveCodexAppServerSpawnEnv, r as closeCodexAppServerTransport, t as createStdioTransport } from "./transport-stdio-NT_Dpd9V.js";
 import { l as readCodexDynamicToolCallParams } from "./protocol-validators-Bg5rpNxk.js";
 import { isRecord, normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
 import fs from "node:fs/promises";
@@ -1215,21 +1215,15 @@ async function applyCodexAppServerAuthProfile(params) {
 		await assertNativeCodexAccountMatchesRoute(params.client, params.authRequirement);
 		return;
 	}
-	let loginParams;
-	try {
-		loginParams = params.preparedAuth?.kind === "profile" ? params.preparedAuth.snapshot.loginParams : params.preparedAuth?.kind === "api-key" ? {
-			type: "apiKey",
-			apiKey: params.preparedAuth.apiKey
-		} : await resolveCodexAppServerAuthProfileLoginParams({
-			agentDir: params.agentDir,
-			authProfileId: params.authProfileId ?? void 0,
-			authProfileStore: params.authProfileStore,
-			config: params.config
-		});
-	} catch (error) {
-		if (params.authRequirement === "subscription" && error instanceof CodexAppServerAuthProfileUnavailableError) throw createCodexAppServerAuthError("Codex subscription auth profile could not produce login credentials. Sign in with `openclaw models auth login --provider openai`, select that profile, then retry.", error);
-		throw error;
-	}
+	const loginParams = params.preparedAuth?.kind === "profile" ? params.preparedAuth.snapshot.loginParams : params.preparedAuth?.kind === "api-key" ? {
+		type: "apiKey",
+		apiKey: params.preparedAuth.apiKey
+	} : await resolveCodexAppServerAuthProfileLoginParams({
+		agentDir: params.agentDir,
+		authProfileId: params.authProfileId ?? void 0,
+		authProfileStore: params.authProfileStore,
+		config: params.config
+	});
 	if (params.authRequirement === "subscription" && loginParams?.type !== "chatgptAuthTokens") throw createCodexAppServerAuthError("Codex subscription auth profile could not produce login credentials. Sign in with `openclaw models auth login --provider openai`, select that profile, then retry.");
 	if (!loginParams) {
 		if (params.authRequirement !== "api-key" || params.startOptions?.transport !== "stdio") return;
@@ -1269,6 +1263,7 @@ var CodexAppServerAuthProfileUnavailableError = class extends Error {
 	constructor(..._args) {
 		super(..._args);
 		this.status = 401;
+		this.code = "selected_auth_profile_unavailable";
 	}
 };
 async function resolveCodexAppServerAuthProfileLoginParams(params) {
@@ -1325,8 +1320,8 @@ async function resolveCodexAppServerAuthProfileLoginParamsInternal(params) {
 	});
 	if (!profileId) return;
 	const credential = store.profiles[profileId];
-	if (!credential) throw new Error(`Codex app-server auth profile "${profileId}" was not found. Select an existing OpenAI profile or sign in again with OpenClaw, then retry.`);
-	if (!isCodexAppServerAuthProfileCredential(credential)) throw new Error(`Codex app-server auth profile "${profileId}" must use the canonical OpenAI auth provider; run "openclaw doctor --fix" to migrate legacy provider IDs.`);
+	if (!credential) throw new CodexAppServerAuthProfileUnavailableError(`Codex app-server auth profile "${profileId}" was not found. Select an existing OpenAI profile or sign in again with OpenClaw, then retry.`);
+	if (!isCodexAppServerAuthProfileCredential(credential)) throw new CodexAppServerAuthProfileUnavailableError(`Codex app-server auth profile "${profileId}" must use the canonical OpenAI auth provider; run "openclaw doctor --fix" to migrate legacy provider IDs.`);
 	const loginParams = await resolveLoginParamsForCredential(profileId, credential, {
 		agentDir: params.agentDir,
 		store,
@@ -1573,7 +1568,7 @@ function resolveExplicitChatgptAccountId(credential) {
 }
 //#endregion
 //#region extensions/codex/src/app-server/rate-limit-cache.ts
-const DEFAULT_CODEX_RATE_LIMIT_CACHE_MAX_AGE_MS = 10 * 6e4;
+const DEFAULT_CODEX_RATE_LIMIT_CACHE_MAX_AGE_MS = 6e5;
 const SPARSE_ACCOUNT_METADATA_KEYS = [
 	"credits",
 	"individualLimit",
@@ -1705,7 +1700,7 @@ async function withAbortableTimeout(params) {
 //#region extensions/codex/src/app-server/client-runtime.ts
 /** Client-scoped Codex auth and account observers. */
 /** Match Codex's native grace window without retaining inactive conversations indefinitely. */
-const CODEX_APP_SERVER_LIVE_THREAD_IDLE_TIMEOUT_MS = 30 * 6e4;
+const CODEX_APP_SERVER_LIVE_THREAD_IDLE_TIMEOUT_MS = 18e5;
 /** Native-child parents are active ownership, so only otherwise-idle threads count against this cap. */
 const CODEX_APP_SERVER_LIVE_THREAD_MAX_IDLE = 64;
 /** Return a deterministic error before Codex cancels its ten-second external-auth request. */
@@ -2178,7 +2173,7 @@ function normalizeLogField(value) {
 	if (typeof value !== "string") return;
 	const normalized = value.replaceAll(String.fromCharCode(27), " ").replaceAll("\r", " ").replaceAll("\n", " ").replaceAll("	", " ").trim();
 	if (!normalized) return;
-	return normalized.length > LOG_FIELD_MAX_LENGTH ? `${truncateUtf16Safe(normalized, LOG_FIELD_MAX_LENGTH - 3)}...` : normalized;
+	return normalized.length > LOG_FIELD_MAX_LENGTH ? `${truncateUtf16Safe(normalized, 157)}...` : normalized;
 }
 function readNumericTimeoutMs(value) {
 	if (typeof value === "number" && Number.isFinite(value)) return Math.max(0, Math.floor(value));
@@ -2692,7 +2687,7 @@ function websocketFrameToText(data) {
 * routing, notification fanout, server request handlers, and version checks.
 */
 const CODEX_APP_SERVER_PARSE_LOG_MAX = 500;
-const CODEX_APP_SERVER_PARSE_BUFFER_MAX = 8 * 1024 * 1024;
+const CODEX_APP_SERVER_PARSE_BUFFER_MAX = 8388608;
 const CODEX_APP_SERVER_PARSE_BUFFER_MAX_LINES = 1e3;
 const CODEX_APP_SERVER_STDERR_TAIL_MAX = 2e3;
 const CODEX_APP_SERVER_OVERLOADED_ERROR_CODE = -32001;
@@ -3424,12 +3419,12 @@ const CODEX_APP_SERVER_STARTUP_TIMEOUT_FLOOR_MS = 100;
 const CODEX_TURN_COMPLETION_IDLE_TIMEOUT_MS = 6e4;
 /** Short guard after apparent assistant completion. */
 const CODEX_TURN_ASSISTANT_COMPLETION_IDLE_TIMEOUT_MS = 1e4;
-const CODEX_POST_TOOL_RAW_ASSISTANT_COMPLETION_IDLE_TIMEOUT_MS = 5 * 6e4;
+const CODEX_POST_TOOL_RAW_ASSISTANT_COMPLETION_IDLE_TIMEOUT_MS = 3e5;
 /** Guard after reasoning/commentary progress when no tool handoff occurred. */
-const CODEX_POST_REASONING_REPLY_IDLE_TIMEOUT_MS = 5 * 6e4;
+const CODEX_POST_REASONING_REPLY_IDLE_TIMEOUT_MS = 3e5;
 /** Long terminal idle watch for app-server turns that never send completion. */
-const CODEX_TURN_TERMINAL_IDLE_TIMEOUT_MS = 30 * 6e4;
-const TURN_TERMINAL_SETTLEMENT_IDLE_TIMEOUT_MS = 2 * 6e4;
+const CODEX_TURN_TERMINAL_IDLE_TIMEOUT_MS = 18e5;
+const TURN_TERMINAL_SETTLEMENT_IDLE_TIMEOUT_MS = 12e4;
 const TURN_FINALIZE_DRAIN_ABORT_GRACE_MS = 5e3;
 var CodexAppServerStartupError = class extends Error {
 	constructor(reason, message = reason === "timed_out" ? "codex app-server startup timed out" : "codex app-server startup aborted") {
@@ -3443,7 +3438,8 @@ function isCodexAppServerStartupError(error, reason) {
 	return error instanceof Error && "code" in error && error.code === "CODEX_APP_SERVER_STARTUP_CANCELLED" && "reason" in error && (error.reason === "aborted" || error.reason === "timed_out") && (reason === void 0 || error.reason === reason);
 }
 function resolvePositiveIntegerTimeoutMs(value, fallbackMs) {
-	return resolveTimerTimeoutMs(value, resolveTimerTimeoutMs(fallbackMs, 1));
+	const fallback = resolveTimerTimeoutMs(fallbackMs, 1);
+	return resolveTimerTimeoutMs(value, fallback);
 }
 /** Runs startup work with abort and timeout handling plus optional cleanup. */
 async function withCodexStartupTimeout(params) {
@@ -3509,7 +3505,8 @@ function resolveCodexTurnTerminalIdleTimeoutMs(value, runTimeoutOverrideMs) {
 /** Adds gateway grace time to a caller timeout without overflowing invalid values. */
 function resolveCodexGatewayTimeoutWithGraceMs(timeoutMs, graceMs = 1e4) {
 	const timeout = resolvePositiveIntegerTimeoutMs(timeoutMs, 1);
-	return addTimerTimeoutGraceMs(timeout, resolveTimerTimeoutMs(graceMs, 0, 0)) ?? timeout;
+	const grace = resolveTimerTimeoutMs(graceMs, 0, 0);
+	return addTimerTimeoutGraceMs(timeout, grace) ?? timeout;
 }
 //#endregion
 //#region extensions/codex/src/app-server/desktop-generation-fingerprint.ts
@@ -4101,6 +4098,10 @@ async function resolveCodexAppServerClientStartContext(options) {
 		store: authProfileStore,
 		snapshot: preparedAuthProfileSnapshot
 	} : void 0;
+	const agentStartOptions = resolveCodexAppServerStartOptionsForAgent({
+		startOptions: requestedStartOptions,
+		agentDir
+	});
 	return {
 		agentDir,
 		usesNativeAuth,
@@ -4110,10 +4111,7 @@ async function resolveCodexAppServerClientStartContext(options) {
 		preparedAuth: resolvedPreparedAuth,
 		authRequirement,
 		startOptions: await bridgeCodexAppServerStartOptions({
-			startOptions: await resolveManagedCodexAppServerStartOptions(resolveCodexAppServerStartOptionsForAgent({
-				startOptions: requestedStartOptions,
-				agentDir
-			})),
+			startOptions: await resolveManagedCodexAppServerStartOptions(agentStartOptions),
 			agentId: options?.agentId,
 			agentDir,
 			authProfileId: usesNativeAuth || preparedAuth?.kind === "api-key" ? null : authProfileId,
@@ -4448,7 +4446,7 @@ async function startInitializedCodexAppServerClient(params) {
 		} finally {
 			artifactDrain?.cancel();
 		}
-		const runtimeArtifactModule = params.runtimeArtifactMode ? await import("./runtime-artifact-DeBvleJw.js") : void 0;
+		const runtimeArtifactModule = params.runtimeArtifactMode ? await import("./runtime-artifact-D9pYp4zL.js") : void 0;
 		const nativeCommandBeforeStart = startOptions.commandSource === "resolved-managed" ? resolveManagedCodexNativeCommand(startOptions.command) : void 0;
 		const runtimeArtifactBeforeStart = runtimeArtifactModule ? await runtimeArtifactModule.captureCodexAppServerRuntimeArtifactBeforeStart({
 			startOptions,

package/dist/{side-question-GwD73tX6.js → side-question-CZ-mCw-t.js}

@@ -1,14 +1,14 @@
-import { C as isCodexRemoteExecPlacementSandbox, D as resolveOpenClawExecPolicyForCodexAppServer, S as isCodexPairedNodeRemoteExecPlacementSandbox, T as readCodexPluginConfig, m as resolveCodexModelBackedReviewerPolicyContext, p as canUseCodexModelBackedApprovalsReviewerForModel, r as resolveCodexAppServerHomeScope, u as shouldAutoApproveCodexAppServerApprovals, v as readCodexRequirementsToml, w as isCodexSandboxExecServerEnabled } from "./config-Cxw3Cl3k.js";
-import { C as withLeasedCodexAppServerClientStartSelectionRetry, Ht as isJsonObject, K as isCodexAppServerIndeterminateRequestCancellationError, Lt as resolveCodexAppServerPreparedAuthHandoff, Ot as readRecentCodexRateLimits, U as isCodexAppServerApprovalRequest, _t as ensureCodexAppServerClientRuntime, at as resolveDynamicToolCallTimeoutMs, c as getLeasedSharedCodexAppServerClient, dt as resolveCodexToolAbortTerminalReason, et as createCodexElicitationResponse, m as releaseCodexAppServerClientLease, tt as handleDynamicToolCallWithTimeout } from "./shared-client-kNkljY-R.js";
-import { d as sessionBindingIdentity } from "./session-binding-q2WSTVmC.js";
+import { C as isCodexRemoteExecPlacementSandbox, D as resolveOpenClawExecPolicyForCodexAppServer, S as isCodexPairedNodeRemoteExecPlacementSandbox, T as readCodexPluginConfig, m as resolveCodexModelBackedReviewerPolicyContext, p as canUseCodexModelBackedApprovalsReviewerForModel, r as resolveCodexAppServerHomeScope, u as shouldAutoApproveCodexAppServerApprovals, v as readCodexRequirementsToml, w as isCodexSandboxExecServerEnabled } from "./config-CcYL77O6.js";
+import { C as withLeasedCodexAppServerClientStartSelectionRetry, Ht as isJsonObject, K as isCodexAppServerIndeterminateRequestCancellationError, Lt as resolveCodexAppServerPreparedAuthHandoff, Ot as readRecentCodexRateLimits, U as isCodexAppServerApprovalRequest, _t as ensureCodexAppServerClientRuntime, at as resolveDynamicToolCallTimeoutMs, c as getLeasedSharedCodexAppServerClient, dt as resolveCodexToolAbortTerminalReason, et as createCodexElicitationResponse, m as releaseCodexAppServerClientLease, tt as handleDynamicToolCallWithTimeout } from "./shared-client-B1tT5U6r.js";
+import { d as sessionBindingIdentity } from "./session-binding-D0zinCP1.js";
 import { a as assertCodexThreadForkResponse, c as assertCodexTurnStartResponse, d as readCodexTurn, l as readCodexDynamicToolCallParams } from "./protocol-validators-Bg5rpNxk.js";
-import { f as unsubscribeCodexThreadBestEffort, g as isCodexNotificationForTurn, s as isCodexAlreadyTerminalInterruptError, u as retireUnsafeCodexTurnClientBestEffort } from "./attempt-client-cleanup-CVPvp9dL.js";
-import { A as readCodexSupportedReasoningEfforts, E as resolveCodexAppServerRequestModelSelection, L as filterCodexDynamicTools, O as resolveCodexBindingModelProviderFallback, T as resolveCodexAppServerModelProvider, U as resolveCodexDynamicToolsLoading, c as buildCodexNativeHookRelayConfig, d as emitCodexNativePreToolUseFailureDiagnostic, et as buildCodexPluginAppsConfigPatchFromPolicyContext, k as resolveReasoningEffort, l as buildCodexNativeHookRelayDisabledConfig, o as CODEX_NATIVE_HOOK_RELAY_EVENTS, ot as mergeCodexThreadConfigs, v as buildCodexRuntimeThreadConfig, w as CODEX_NATIVE_PERSONALITY_NONE, x as resolveCodexWebSearchPlan } from "./thread-lifecycle-Ss-uwnC4.js";
-import { s as resolveCodexNativeExecutionBlock } from "./request-CCm4LaED.js";
-import { n as formatCodexUsageLimitErrorMessage } from "./rate-limits-hFtzt2Up.js";
-import { a as resolveCodexAppServerForModelProvider, i as resolveCodexSessionPermissionCwd, n as applyCodexSessionPermissionPolicy, r as resolveCodexEffectiveSessionPermissionPolicy, t as CODEX_SESSION_PERMISSION_EXEC_MODES } from "./session-permission-policy-gLm40Vtq.js";
-import { n as resolveCodexBindingAppServerConnection, t as requireCodexSupervisionModelSelection } from "./binding-connection-CCQFs8lf.js";
-import { C as shouldRequireCodexSandboxExecServerEnvironment, D as CodexNativeToolLifecycleProjector, S as shouldEnableCodexAppServerNativeToolSurface, T as filterCodexVisionTools, a as emitDynamicToolStartedDiagnostic, b as resolveCodexNodePlacementToolConstructionPlan, d as releaseCodexSandboxExecServerEnvironment, i as emitDynamicToolErrorDiagnostic, l as resolveCodexProviderWebSearchSupportForClient, o as emitDynamicToolTerminalDiagnostic, r as routeCodexAppServerElicitationRequest, s as handleCodexAppServerApprovalRequest, t as createCodexDynamicToolBridge, u as ensureCodexSandboxExecServerEnvironment, v as resolveCodexExternalSandboxPolicyForOpenClawSandbox, x as resolveCodexSandboxEnvironmentSelection, y as resolveCodexMessageToolProvider } from "./dynamic-tools-BFoUcRdx.js";
+import { f as unsubscribeCodexThreadBestEffort, g as isCodexNotificationForTurn, s as isCodexAlreadyTerminalInterruptError, u as retireUnsafeCodexTurnClientBestEffort } from "./attempt-client-cleanup-CpVfwctT.js";
+import { A as readCodexSupportedReasoningEfforts, E as resolveCodexAppServerRequestModelSelection, L as filterCodexDynamicTools, O as resolveCodexBindingModelProviderFallback, T as resolveCodexAppServerModelProvider, U as resolveCodexDynamicToolsLoading, c as buildCodexNativeHookRelayConfig, d as emitCodexNativePreToolUseFailureDiagnostic, et as buildCodexPluginAppsConfigPatchFromPolicyContext, k as resolveReasoningEffort, l as buildCodexNativeHookRelayDisabledConfig, o as CODEX_NATIVE_HOOK_RELAY_EVENTS, ot as mergeCodexThreadConfigs, v as buildCodexRuntimeThreadConfig, w as CODEX_NATIVE_PERSONALITY_NONE, x as resolveCodexWebSearchPlan } from "./thread-lifecycle-CGGKP720.js";
+import { s as resolveCodexNativeExecutionBlock } from "./request-BWxweEdK.js";
+import { n as formatCodexUsageLimitErrorMessage } from "./rate-limits-BqHEHXQJ.js";
+import { a as resolveCodexAppServerForModelProvider, i as resolveCodexSessionPermissionCwd, n as applyCodexSessionPermissionPolicy, r as resolveCodexEffectiveSessionPermissionPolicy, t as CODEX_SESSION_PERMISSION_EXEC_MODES } from "./session-permission-policy-ScnAyG90.js";
+import { n as resolveCodexBindingAppServerConnection, t as requireCodexSupervisionModelSelection } from "./binding-connection-CF7BmrDk.js";
+import { C as shouldRequireCodexSandboxExecServerEnvironment, D as CodexNativeToolLifecycleProjector, S as shouldEnableCodexAppServerNativeToolSurface, T as filterCodexVisionTools, a as emitDynamicToolStartedDiagnostic, b as resolveCodexNodePlacementToolConstructionPlan, d as releaseCodexSandboxExecServerEnvironment, i as emitDynamicToolErrorDiagnostic, l as resolveCodexProviderWebSearchSupportForClient, o as emitDynamicToolTerminalDiagnostic, r as routeCodexAppServerElicitationRequest, s as handleCodexAppServerApprovalRequest, t as createCodexDynamicToolBridge, u as ensureCodexSandboxExecServerEnvironment, v as resolveCodexExternalSandboxPolicyForOpenClawSandbox, x as resolveCodexSandboxEnvironmentSelection, y as resolveCodexMessageToolProvider } from "./dynamic-tools-BmeXjwNZ.js";
 import { readStringField } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { buildAgentHookContextChannelFields, embeddedAgentLog, formatErrorMessage, registerNativeHookRelay, resolveAgentDir, resolveAttemptSpawnWorkspaceDir, resolveModelAuthMode, resolveSandboxContext, supportsModelTools } from "openclaw/plugin-sdk/agent-harness-runtime";
 import { randomUUID } from "node:crypto";
@@ -23,8 +23,8 @@ var CodexSideQuestionTimeoutError = class extends Error {
 		this.name = "TimeoutError";
 	}
 };
-const CODEX_SIDE_NATIVE_HOOK_RELAY_MIN_TTL_MS = 30 * 6e4;
-const CODEX_SIDE_NATIVE_HOOK_RELAY_TTL_GRACE_MS = 5 * 6e4;
+const CODEX_SIDE_NATIVE_HOOK_RELAY_MIN_TTL_MS = 18e5;
+const CODEX_SIDE_NATIVE_HOOK_RELAY_TTL_GRACE_MS = 3e5;
 const CODEX_SIDE_NATIVE_HOOK_RELAY_STARTUP_REQUEST_COUNT = 3;
 const CODEX_SIDE_NATIVE_HOOK_RELAY_EVENTS_WITH_APP_SERVER_APPROVALS = CODEX_NATIVE_HOOK_RELAY_EVENTS.filter((event) => event !== "permission_request");
 const SIDE_BOUNDARY_PROMPT = `Side conversation boundary.
@@ -461,7 +461,8 @@ async function runCodexAppServerSideQuestion(params, options) {
 			nativeCodeModeEnabled: nativeToolSurfaceEnabled,
 			nativeCodeModeOnlyEnabled: appServer.codeModeOnly
 		});
-		const threadConfig = mergeCodexThreadConfigs(nativeHookRelayConfig, runtimeThreadConfig, binding.pluginAppPolicyContext ? buildCodexPluginAppsConfigPatchFromPolicyContext(binding.pluginAppPolicyContext) : void 0, appServer.networkProxy?.configPatch) ?? runtimeThreadConfig;
+		const pluginAppsConfigPatch = binding.pluginAppPolicyContext ? buildCodexPluginAppsConfigPatchFromPolicyContext(binding.pluginAppPolicyContext) : void 0;
+		const threadConfig = mergeCodexThreadConfigs(nativeHookRelayConfig, runtimeThreadConfig, pluginAppsConfigPatch, appServer.networkProxy?.configPatch) ?? runtimeThreadConfig;
 		const forkResponse = assertCodexThreadForkResponse(await withLeasedCodexAppServerClientStartSelectionRetry({
 			lease: clientLease,
 			options: clientOptions,
@@ -695,7 +696,7 @@ async function createCodexSideToolBridge(input) {
 			workspaceDir: input.cwd
 		});
 		const toolConstructionPlan = resolveCodexNodePlacementToolConstructionPlan(sandbox, input.nativeToolSurfaceEnabled);
-		tools = filterCodexVisionTools(filterCodexDynamicTools(createOpenClawCodingTools({
+		const allTools = createOpenClawCodingTools({
 			agentId: input.sessionAgentId,
 			sessionKey: sandboxSessionKey,
 			runSessionKey: input.params.sessionKey && input.params.sessionKey !== sandboxSessionKey ? input.params.sessionKey : void 0,
@@ -752,7 +753,9 @@ async function createCodexSideToolBridge(input) {
 			emitBeforeToolCallDiagnostics: false,
 			modelHasVision: runtimeModel.input?.includes("image") ?? false,
 			requireExplicitMessageTarget: true
-		}), input.pluginConfig), {
+		});
+		const codexFilteredTools = filterCodexDynamicTools(allTools, input.pluginConfig);
+		tools = filterCodexVisionTools(codexFilteredTools, {
 			modelHasVision: runtimeModel.input?.includes("image") ?? false,
 			nativeImageInspectionEnabled: input.nativeToolSurfaceEnabled
 		});