@openclaw/codex 2026.8.1 → 2026.8.33

package/dist/{thread-lifecycle-Ss-uwnC4.js → .setup/thread-lifecycle-Cc6I-gbl.mjs}

@@ -1,13 +1,13 @@
-import { E as resolveCodexPluginsPolicy, F as resolveCodexAppServerLocalHomeDir, M as CODEX_PLUGINS_WORKSPACE_MARKETPLACE_NAME, P as resolveCodexAppServerHomeDir, f as assertCodexModelBackedReviewerEffectiveConfig, j as CODEX_PLUGINS_MARKETPLACE_NAME, n as codexSandboxPolicyForTurn } from "./config-Cxw3Cl3k.js";
-import { $ as CodexAppServerRpcError, D as CodexThreadStartRequestError, E as CodexThreadBindingConflictError, H as getCodexAppServerClientInstanceId, Ht as isJsonObject, J as isCodexAppServerOverloadError, Q as resolveCodexAppServerClientInstanceId, St as releaseCodexAppServerLiveThread, T as CodexRestrictedToolSurfaceAttestationError, Vt as flattenCodexDynamicToolFunctions, _ as retainSharedCodexAppServerClientByInstanceId, bt as isCodexAppServerLiveThreadClaimed, dt as resolveCodexToolAbortTerminalReason, gt as consumeCodexAppServerLiveThread, n as captureExclusiveSharedCodexAppServerClient, w as CodexAdoptedThreadActiveError, wt as unsubscribeCodexAppServerLiveThread } from "./shared-client-kNkljY-R.js";
-import { a as hashCodexAppServerBindingFingerprint, c as reclaimCurrentCodexSessionGeneration, d as sessionBindingIdentity, i as createCodexSessionGenerationSupersededError, n as assertCodexBindingMayBeReplaced, o as isCodexAppServerNativeAuthProfile, s as normalizeCodexAppServerBindingModelProvider } from "./session-binding-q2WSTVmC.js";
-import { a as assertCodexThreadForkResponse, r as assertCodexThreadAcceptsDirectInput, s as assertCodexThreadStartResponse, t as CodexThreadDirectInputError } from "./protocol-validators-Bg5rpNxk.js";
-import { a as closeCodexStartupClientBestEffort, c as isCodexAppServerUnsafeSubscriptionError, f as unsubscribeCodexThreadBestEffort, n as CODEX_APP_SERVER_UNSUBSCRIBE_TIMEOUT_MS, r as CodexAppServerUnsafeSubscriptionError } from "./attempt-client-cleanup-CVPvp9dL.js";
-import { c as serializeCodexAppInventoryError, n as buildCodexAppServerConnectionFingerprint, s as defaultCodexAppInventoryCache, t as resumeCodexAppServerThread } from "./thread-resume-DF54hagX.js";
-import { c as withExclusiveCodexAppServerThread, l as isIncognitoSessionKey } from "./thread-ownership-CeYBqg_4.js";
-import { i as readCodexSessionMeta, n as codexCatalogHomeId } from "./session-catalog-home-id-DAKUrm3C.js";
-import { d as projectBoundedCodexThreadHistory } from "./transcript-mirror-CkEQIna-.js";
-import { r as sanitizeInlineImageDataUrl, t as invalidInlineImageText } from "./image-payload-sanitizer-CnfoUPCE.js";
+import { E as resolveCodexPluginsPolicy, F as resolveCodexAppServerLocalHomeDir, M as CODEX_PLUGINS_WORKSPACE_MARKETPLACE_NAME, P as resolveCodexAppServerHomeDir, f as assertCodexModelBackedReviewerEffectiveConfig, j as CODEX_PLUGINS_MARKETPLACE_NAME, n as codexSandboxPolicyForTurn } from "./config-ClwHKKTN.mjs";
+import { $ as CodexAppServerRpcError, D as CodexThreadStartRequestError, E as CodexThreadBindingConflictError, H as getCodexAppServerClientInstanceId, Ht as isJsonObject, J as isCodexAppServerOverloadError, Q as resolveCodexAppServerClientInstanceId, St as releaseCodexAppServerLiveThread, T as CodexRestrictedToolSurfaceAttestationError, Vt as flattenCodexDynamicToolFunctions, _ as retainSharedCodexAppServerClientByInstanceId, bt as isCodexAppServerLiveThreadClaimed, dt as resolveCodexToolAbortTerminalReason, gt as consumeCodexAppServerLiveThread, n as captureExclusiveSharedCodexAppServerClient, w as CodexAdoptedThreadActiveError, wt as unsubscribeCodexAppServerLiveThread, yt as isCodexAppServerClientRuntimeLive } from "./shared-client-DG1kAfGq.mjs";
+import { a as hashCodexAppServerBindingFingerprint, c as reclaimCurrentCodexSessionGeneration, d as sessionBindingIdentity, i as createCodexSessionGenerationSupersededError, n as assertCodexBindingMayBeReplaced, o as isCodexAppServerNativeAuthProfile, s as normalizeCodexAppServerBindingModelProvider } from "./session-binding-Bd9dh1Er.mjs";
+import { a as assertCodexThreadForkResponse, r as assertCodexThreadAcceptsDirectInput, s as assertCodexThreadStartResponse, t as CodexThreadDirectInputError } from "./protocol-validators-Bg5rpNxk.mjs";
+import { a as closeCodexStartupClientBestEffort, c as isCodexAppServerUnsafeSubscriptionError, f as unsubscribeCodexThreadBestEffort, n as CODEX_APP_SERVER_UNSUBSCRIBE_TIMEOUT_MS, r as CodexAppServerUnsafeSubscriptionError } from "./attempt-client-cleanup-FBnDjmtX.mjs";
+import { c as serializeCodexAppInventoryError, n as buildCodexAppServerConnectionFingerprint, s as defaultCodexAppInventoryCache, t as resumeCodexAppServerThread } from "./thread-resume-OMjvue9F.mjs";
+import { c as withExclusiveCodexAppServerThread, l as isIncognitoSessionKey } from "./thread-ownership-B3vjUi0P.mjs";
+import { i as readCodexSessionMeta, n as codexCatalogHomeId } from "./session-catalog-home-id-CjyBDShn.mjs";
+import { f as projectBoundedCodexThreadHistory } from "./transcript-mirror-DN-ed7Kf.mjs";
+import { r as sanitizeInlineImageDataUrl, t as invalidInlineImageText } from "./image-payload-sanitizer-CnfoUPCE.mjs";
 import { asOptionalRecord, isRecord, normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
 import fs from "node:fs/promises";
 import path from "node:path";
@@ -1198,6 +1198,7 @@ function renderMessagesForCodexContext(messages, options) {
 	}).filter((value) => Boolean(value)).join("\n\n");
 }
 function renderMessageBody(message, options) {
+	if (message.role === "compactionSummary" || message.role === "branchSummary") return truncateText(message.summary.trim(), options.maxTextPartChars);
 	if (!hasMessageContent(message)) return "";
 	if (typeof message.content === "string") return truncateText(message.content.trim(), options.maxTextPartChars);
 	if (!Array.isArray(message.content)) return "[non-text content omitted]";
@@ -1666,7 +1667,8 @@ async function collectPersonalSkillRealPaths(homes, codexHome) {
 	}
 	const configuredCodexHome = codexHome?.trim() || process.env.CODEX_HOME?.trim();
 	if (configuredCodexHome) {
-		const stateOwned = isPathInside(realStateDir, await canonicalizeExistingPath(configuredCodexHome));
+		const realCodexHome = await canonicalizeExistingPath(configuredCodexHome);
+		const stateOwned = isPathInside(realStateDir, realCodexHome);
 		roots.push({
 			dir: path.join(configuredCodexHome, "skills"),
 			onlyEscapedStateTargets: stateOwned
@@ -1729,12 +1731,14 @@ async function collectPersonalSkillRealPaths(homes, codexHome) {
 					try {
 						const stat = await fs.stat(entryPath);
 						if (entry.name === "SKILL.md" && stat.isFile()) await recordSkillFile(entryPath, current.onlyEscapedStateTargets);
-						else if (stat.isDirectory()) if (current.depth < MAX_PERSONAL_SKILL_DEPTH) queue.push({
-							dir: entryPath,
-							depth: current.depth + 1,
-							onlyEscapedStateTargets: current.onlyEscapedStateTargets
-						});
-						else complete = false;
+						else if (stat.isDirectory()) {
+							if (current.depth < MAX_PERSONAL_SKILL_DEPTH) queue.push({
+								dir: entryPath,
+								depth: current.depth + 1,
+								onlyEscapedStateTargets: current.onlyEscapedStateTargets
+							});
+							else complete = false;
+						}
 					} catch (error) {
 						if (!isMissingPathError(error)) complete = false;
 					}
@@ -1852,6 +1856,10 @@ function managedThreadStoreKey(sourceHomeId, threadId) {
 /** Durable ownership index for Codex threads created by OpenClaw. */
 function createCodexManagedThreadStore(state) {
 	return {
+		async has(sourceHomeId, threadId) {
+			const parsed = managedThreadSchema.safeParse(state.lookup(managedThreadStoreKey(sourceHomeId, threadId)));
+			return parsed.success && parsed.data.sourceHomeId === sourceHomeId && parsed.data.threadId === threadId;
+		},
 		async mark(params) {
 			try {
 				const value = managedThreadSchema.parse({
@@ -1981,56 +1989,6 @@ function buildStartedCodexThreadBinding(input) {
 	};
 }
 //#endregion
-//#region extensions/codex/src/app-server/reasoning-effort.ts
-const CODEX_REASONING_EFFORTS = [
-	"minimal",
-	"low",
-	"medium",
-	"high",
-	"xhigh",
-	"max",
-	"ultra"
-];
-const LEGACY_PRO_REASONING_EFFORTS = [
-	"medium",
-	"high",
-	"xhigh"
-];
-const LEGACY_PRO_MODEL_ID_RE = /^gpt-5\.[45]-pro$/u;
-const MODERN_GPT_5_MODEL_ID_RE = /^gpt-5\.(?:[3-9]|[1-9]\d)(?:$|-)/u;
-/** Read reasoning metadata after the Codex app-server route has been selected. */
-function readCodexSupportedReasoningEfforts(compat) {
-	if (!compat || typeof compat !== "object" || Array.isArray(compat)) return;
-	const efforts = compat.supportedReasoningEfforts;
-	if (!Array.isArray(efforts)) return;
-	return efforts.filter((effort) => typeof effort === "string");
-}
-function resolveSupportedReasoningEffort(params) {
-	const declared = new Set(params.supportedReasoningEfforts.map((effort) => effort.trim().toLowerCase()));
-	const supported = CODEX_REASONING_EFFORTS.filter((effort) => declared.has(effort));
-	if (supported.includes(params.requested)) return params.requested;
-	const fallbackEfforts = params.requested === "ultra" ? supported : supported.filter((effort) => effort !== "ultra");
-	const requestedRank = CODEX_REASONING_EFFORTS.indexOf(params.requested);
-	return fallbackEfforts.find((effort) => CODEX_REASONING_EFFORTS.indexOf(effort) >= requestedRank) ?? fallbackEfforts.at(-1);
-}
-/** Resolve a turn effort from the selected model's provider-owned metadata. */
-function resolveCodexAppServerReasoningEffort(params) {
-	if (params.thinkLevel === "off") return params.supportedReasoningEfforts?.includes("none") ? "none" : null;
-	if (params.thinkLevel === "adaptive") return null;
-	if (params.supportedReasoningEfforts) return resolveSupportedReasoningEffort({
-		requested: params.thinkLevel,
-		supportedReasoningEfforts: params.supportedReasoningEfforts
-	}) ?? null;
-	const modelId = params.modelId.trim().toLowerCase();
-	if (LEGACY_PRO_MODEL_ID_RE.test(modelId)) return resolveSupportedReasoningEffort({
-		requested: params.thinkLevel,
-		supportedReasoningEfforts: LEGACY_PRO_REASONING_EFFORTS
-	}) ?? null;
-	if (params.thinkLevel === "minimal" && MODERN_GPT_5_MODEL_ID_RE.test(modelId)) return "low";
-	if (params.thinkLevel === "minimal" || params.thinkLevel === "low" || params.thinkLevel === "medium" || params.thinkLevel === "high" || params.thinkLevel === "xhigh") return params.thinkLevel;
-	return null;
-}
-//#endregion
 //#region extensions/codex/src/app-server/thread-model-selection.ts
 const CODEX_NATIVE_PERSONALITY_NONE = "none";
 function resolveCodexBindingModelProviderFallback(params) {
@@ -2098,16 +2056,9 @@ function resolveCodexAppServerModelProvider(params) {
 	if (isCodexAppServerNativeAuthProfile(params) && normalizedLower === "openai") return;
 	return normalizedLower === "openai" ? "openai" : normalized;
 }
-function resolveReasoningEffort(thinkLevel, modelId, supportedReasoningEfforts) {
-	return resolveCodexAppServerReasoningEffort({
-		thinkLevel,
-		modelId,
-		supportedReasoningEfforts
-	});
-}
 //#endregion
 //#region extensions/codex/src/app-server/project-doc-thread-config.ts
-const CODEX_NATIVE_PROJECT_DOC_MAX_BYTES = 128 * 1024;
+const CODEX_NATIVE_PROJECT_DOC_MAX_BYTES = 131072;
 function buildCodexProjectDocThreadConfig(config) {
 	const defaults = { project_doc_max_bytes: CODEX_NATIVE_PROJECT_DOC_MAX_BYTES };
 	return mergeCodexThreadConfigs(defaults, config) ?? defaults;
@@ -2634,6 +2585,7 @@ async function resumeExistingCodexThread(params, context) {
 	const { binding: resumeBinding, bindingIdentity, startModelSelection, startModelProvider, userMcpServersConfigPatch, dynamicToolsFingerprint, dynamicToolsContainDeferred, webSearchThreadConfigFingerprint, nativeSkillIsolationFingerprint, userMcpServersFingerprint, ringZeroConfigFingerprint, ringZeroClientInstanceId, networkProxyConfigFingerprint, contextEngineBinding, environmentSelectionFingerprint, hostSystemAgentActive, ringZeroActive, restrictedToolSurface, restrictedToolSurfaceInheritedMcpServerNames, nativeSkillIsolation, lifecycleTiming, normalizeBindingModelProvider, throwIfAborted, clearCurrentBinding } = context;
 	let resumeReservation;
 	let resumeResponseAccepted = false;
+	let checkingLoadedPluginThreadConfig = false;
 	const abandonClient = params.abandonClient ?? (() => closeCodexStartupClientBestEffort(params.client));
 	try {
 		const authProfileId = resumeBinding.connectionScope === "supervision" ? void 0 : params.params.authProfileId ?? resumeBinding.authProfileId;
@@ -2644,7 +2596,8 @@ async function resumeExistingCodexThread(params, context) {
 			configPatch: params.finalConfigPatch,
 			nativeHookRelayGeneration: params.nativeHookRelayGeneration
 		};
-		const pluginAppsConfigPatch = context.prebuiltPluginThreadConfig?.configPatch ?? (params.pluginThreadConfig?.enabled && resumeBinding.pluginAppPolicyContext ? buildCodexPluginAppsConfigPatchFromPolicyContext(resumeBinding.pluginAppPolicyContext) : void 0);
+		const pluginThreadConfig = context.prebuiltPluginThreadConfig ?? (params.pluginThreadConfig?.requiresCurrentPolicyCheck ? await lifecycleTiming.measure("plugin-config-build", () => params.pluginThreadConfig?.build()) : void 0);
+		const pluginAppsConfigPatch = pluginThreadConfig?.configPatch ?? (params.pluginThreadConfig?.enabled && resumeBinding.pluginAppPolicyContext ? buildCodexPluginAppsConfigPatchFromPolicyContext(resumeBinding.pluginAppPolicyContext) : void 0);
 		const resumeConfig = applyCodexNativeSkillIsolation(mergeCodexThreadConfigs(params.config, userMcpServersConfigPatch, pluginAppsConfigPatch, finalConfigPatch.configPatch), nativeSkillIsolation);
 		const resumeParams = lifecycleTiming.measureSync("thread-resume-params", () => buildThreadResumeParams(params.params, {
 			threadId: resumeBinding.threadId,
@@ -2680,12 +2633,19 @@ async function resumeExistingCodexThread(params, context) {
 		resumeResponseAccepted = true;
 		assertCodexThreadAcceptsDirectInput(response.thread);
 		context.assertResumeConfiguration?.();
-		if (resumeBinding.pendingResumeConfiguration) await attestCodexPluginThreadApps({
+		checkingLoadedPluginThreadConfig = true;
+		const loadedPluginThreadConfig = await context.buildLoadedPluginThreadConfig?.(resumeBinding);
+		if (loadedPluginThreadConfig && loadedPluginThreadConfig.fingerprint !== (pluginThreadConfig?.fingerprint ?? resumeBinding.pluginAppsFingerprint)) {
+			checkingLoadedPluginThreadConfig = false;
+			throw new Error("Codex thread app policy changed; a fresh thread configuration is required");
+		}
+		await attestCodexPluginThreadApps({
 			client: params.client,
 			threadId: response.thread.id,
-			appIds: context.prebuiltPluginThreadConfig?.provisionalAppIds ?? [],
+			appIds: loadedPluginThreadConfig?.provisionalAppIds ?? pluginThreadConfig?.provisionalAppIds ?? [],
 			signal: params.signal
 		});
+		checkingLoadedPluginThreadConfig = false;
 		if (ringZeroActive || isMessageOnlyCodexSourceReply(params.params) || params.params.pluginHarnessToolPolicyRestricted === true) try {
 			await lifecycleTiming.measure("restricted-tool-surface-mcp-attestation", () => attestCodexRestrictedToolSurfaceMcpServersDisabled(params.client, response.thread.id, resumeParams.config, params.signal));
 		} catch (error) {
@@ -2719,9 +2679,9 @@ async function resumeExistingCodexThread(params, context) {
 			networkProxyConfigFingerprint,
 			nativeHookRelayGeneration: finalConfigPatch.nativeHookRelayGeneration ?? resumeBinding.nativeHookRelayGeneration,
 			appServerRuntimeFingerprint: resumeBinding.connectionScope === "supervision" ? buildCodexAppServerConnectionFingerprint(params.appServer, params.params.agentDir) : params.appServerRuntimeFingerprint,
-			pluginAppsFingerprint: context.prebuiltPluginThreadConfig?.fingerprint ?? resumeBinding.pluginAppsFingerprint,
-			pluginAppsInputFingerprint: context.prebuiltPluginThreadConfig?.inputFingerprint ?? resumeBinding.pluginAppsInputFingerprint,
-			pluginAppPolicyContext: context.prebuiltPluginThreadConfig?.policyContext ?? resumeBinding.pluginAppPolicyContext,
+			pluginAppsFingerprint: pluginThreadConfig?.fingerprint ?? resumeBinding.pluginAppsFingerprint,
+			pluginAppsInputFingerprint: pluginThreadConfig?.inputFingerprint ?? resumeBinding.pluginAppsInputFingerprint,
+			pluginAppPolicyContext: pluginThreadConfig?.policyContext ?? resumeBinding.pluginAppPolicyContext,
 			contextEngine: contextEngineBinding,
 			environmentSelectionFingerprint
 		};
@@ -2785,7 +2745,7 @@ async function resumeExistingCodexThread(params, context) {
 				throw new CodexAppServerUnsafeSubscriptionError("Codex thread/resume subscription cleanup failed", { cause: error });
 			}
 		}
-		if (resumeBinding.pendingResumeConfiguration || error instanceof CodexThreadDirectInputError || params.signal?.aborted) throw error;
+		if (checkingLoadedPluginThreadConfig || resumeBinding.pendingResumeConfiguration || error instanceof CodexThreadDirectInputError || params.signal?.aborted) throw error;
 		embeddedAgentLog.warn("codex app-server thread resume failed; starting a new thread", { error });
 		await clearCurrentBinding("rotating a stale thread binding");
 	}
@@ -2818,14 +2778,15 @@ async function startFreshCodexThread(params, context) {
 		disableLoginShell: params.disableLoginShell
 	}));
 	const requestModelProvider = typeof startParams.modelProvider === "string" && startParams.modelProvider.trim() ? startParams.modelProvider : void 0;
-	const response = assertCodexThreadStartResponse(await lifecycleTiming.measure("thread-start-request", async () => {
+	const threadStartResponse = await lifecycleTiming.measure("thread-start-request", async () => {
 		try {
 			return await params.client.request("thread/start", startParams, { signal: params.signal });
 		} catch (error) {
 			if (error instanceof CodexAppServerRpcError) throw new CodexThreadStartRequestError(error);
 			throw error;
 		}
-	}));
+	});
+	const response = assertCodexThreadStartResponse(threadStartResponse);
 	const provisionalAppIds = pluginThreadConfig?.provisionalAppIds;
 	if (provisionalAppIds?.length) try {
 		await lifecycleTiming.measure("plugin-app-attestation", () => attestCodexPluginThreadApps({
@@ -3010,52 +2971,67 @@ async function releaseCodexRetainedLiveThread(options) {
 }
 /** Reuses one safely owned, fully matching subscription on its original client. */
 async function tryReuseCodexLiveThread(options) {
-	const { params, binding, bindingIdentity, clientId, dynamicToolsFingerprint, environmentSelectionFingerprint, hostSystemAgentActive, lifecycleTiming, nativeSkillIsolation, releaseConsumedThread, ringZeroActive, restrictedToolSurfaceInheritedMcpServerNames, startModelProvider, startModelSelection, throwIfAborted, userMcpServersConfigPatch } = options;
-	if (!binding.clientId || binding.clientId !== clientId || binding.preserveNativeModel === true || binding.connectionScope === "supervision" || ringZeroActive) return {};
-	const prebuiltFinalConfigPatch = params.buildFinalConfigPatch?.({
-		action: "resume",
-		binding
-	}) ?? {
-		configPatch: params.finalConfigPatch,
-		nativeHookRelayGeneration: params.nativeHookRelayGeneration
+	const { params, binding, bindingIdentity, clientId, dynamicToolsFingerprint, environmentSelectionFingerprint, hostSystemAgentActive, lifecycleTiming, nativeSkillIsolation, ringZeroActive, restrictedToolSurfaceInheritedMcpServerNames, startModelProvider, startModelSelection, throwIfAborted, userMcpServersConfigPatch } = options;
+	if (!binding.clientId || binding.clientId !== clientId || binding.preserveNativeModel === true || binding.connectionScope === "supervision" || ringZeroActive) return { kind: "resume" };
+	const retainedThread = await consumeCodexAppServerLiveThread(params.client, binding.threadId);
+	if (!retainedThread) return { kind: "resume" };
+	const assertCurrentClient = () => {
+		throwIfAborted();
+		if (!isCodexAppServerClientRuntimeLive(params.client)) throw params.client.getCloseError() ?? /* @__PURE__ */ new Error("codex app-server client is closed");
 	};
-	const pluginAppsConfigPatch = params.pluginThreadConfig?.enabled && binding.pluginAppPolicyContext ? buildCodexPluginAppsConfigPatchFromPolicyContext(binding.pluginAppPolicyContext) : void 0;
-	const resumeAuthProfileId = params.params.authProfileId ?? binding.authProfileId;
-	const resumeConfig = mergeCodexThreadConfigs(params.config, userMcpServersConfigPatch, pluginAppsConfigPatch, prebuiltFinalConfigPatch.configPatch);
-	const resumeParams = lifecycleTiming.measureSync("warm-thread-resume-params", () => buildThreadResumeParams(params.params, {
-		threadId: binding.threadId,
-		cwd: params.cwd,
-		authProfileId: resumeAuthProfileId,
-		model: startModelSelection.model,
-		modelProvider: startModelProvider,
-		preserveNativeModel: false,
-		appServer: params.appServer,
-		dynamicTools: params.dynamicTools,
-		developerInstructions: params.developerInstructions,
-		config: applyCodexNativeSkillIsolation(resumeConfig, nativeSkillIsolation),
-		nativeCodeModeEnabled: params.nativeCodeModeEnabled,
-		nativeProviderWebSearchSupport: params.nativeProviderWebSearchSupport,
-		nativeCodeModeOnlyEnabled: params.nativeCodeModeOnlyEnabled,
-		webSearchAllowed: params.webSearchAllowed,
-		hostSystemAgentActive,
-		restrictedToolSurfaceInheritedMcpServerNames,
-		shellEnvironment: params.shellEnvironment,
-		disableLoginShell: params.disableLoginShell
-	}));
-	const liveThreadConfigFingerprint = fingerprintCodexThreadConfig({
-		...resumeParams,
-		model: binding.model ?? resumeParams.model ?? null,
-		requestedModel: resumeParams.model ?? null,
-		modelProvider: binding.modelProvider ?? resumeParams.modelProvider ?? null,
-		requestedModelProvider: resumeParams.modelProvider ?? binding.modelProvider ?? null
-	}, resumeAuthProfileId, dynamicToolsFingerprint);
-	const retainedThread = await consumeCodexAppServerLiveThread(params.client, binding.threadId, liveThreadConfigFingerprint);
-	if (!retainedThread) {
-		const incompatibleOwnership = await consumeCodexAppServerLiveThread(params.client, binding.threadId);
-		if (incompatibleOwnership) await incompatibleOwnership.release(binding.threadId);
-		return { prebuiltFinalConfigPatch };
-	}
+	let ownershipTransferred = false;
 	try {
+		const pluginThreadConfig = await options.buildLoadedPluginThreadConfig(binding);
+		assertCurrentClient();
+		if (pluginThreadConfig && pluginThreadConfig.fingerprint !== binding.pluginAppsFingerprint) return { kind: "rotate" };
+		const prebuiltFinalConfigPatch = params.buildFinalConfigPatch?.({
+			action: "resume",
+			binding
+		}) ?? {
+			configPatch: params.finalConfigPatch,
+			nativeHookRelayGeneration: params.nativeHookRelayGeneration
+		};
+		const pluginAppsConfigPatch = pluginThreadConfig?.configPatch ?? (params.pluginThreadConfig?.enabled && binding.pluginAppPolicyContext ? buildCodexPluginAppsConfigPatchFromPolicyContext(binding.pluginAppPolicyContext) : void 0);
+		const resumeAuthProfileId = params.params.authProfileId ?? binding.authProfileId;
+		const resumeConfig = mergeCodexThreadConfigs(params.config, userMcpServersConfigPatch, pluginAppsConfigPatch, prebuiltFinalConfigPatch.configPatch);
+		const resumeParams = lifecycleTiming.measureSync("warm-thread-resume-params", () => buildThreadResumeParams(params.params, {
+			threadId: binding.threadId,
+			cwd: params.cwd,
+			authProfileId: resumeAuthProfileId,
+			model: startModelSelection.model,
+			modelProvider: startModelProvider,
+			preserveNativeModel: false,
+			appServer: params.appServer,
+			dynamicTools: params.dynamicTools,
+			developerInstructions: params.developerInstructions,
+			config: applyCodexNativeSkillIsolation(resumeConfig, nativeSkillIsolation),
+			nativeCodeModeEnabled: params.nativeCodeModeEnabled,
+			nativeProviderWebSearchSupport: params.nativeProviderWebSearchSupport,
+			nativeCodeModeOnlyEnabled: params.nativeCodeModeOnlyEnabled,
+			webSearchAllowed: params.webSearchAllowed,
+			hostSystemAgentActive,
+			restrictedToolSurfaceInheritedMcpServerNames,
+			shellEnvironment: params.shellEnvironment,
+			disableLoginShell: params.disableLoginShell
+		}));
+		const liveThreadConfigFingerprint = fingerprintCodexThreadConfig({
+			...resumeParams,
+			model: binding.model ?? resumeParams.model ?? null,
+			requestedModel: resumeParams.model ?? null,
+			modelProvider: binding.modelProvider ?? resumeParams.modelProvider ?? null,
+			requestedModelProvider: resumeParams.modelProvider ?? binding.modelProvider ?? null
+		}, resumeAuthProfileId, dynamicToolsFingerprint);
+		if (retainedThread.configFingerprint !== liveThreadConfigFingerprint) return {
+			kind: "resume",
+			prebuiltFinalConfigPatch
+		};
+		await attestCodexPluginThreadApps({
+			client: params.client,
+			threadId: binding.threadId,
+			appIds: pluginThreadConfig?.provisionalAppIds ?? [],
+			signal: params.signal
+		});
+		assertCurrentClient();
 		const nativeHookRelayGeneration = prebuiltFinalConfigPatch.nativeHookRelayGeneration ?? binding.nativeHookRelayGeneration;
 		const model = startModelSelection.model;
 		if (!await lifecycleTiming.measure("warm-thread-write-binding", () => params.bindingStore.mutate(bindingIdentity, {
@@ -3067,8 +3043,8 @@ async function tryReuseCodexLiveThread(options) {
 				nativeHookRelayGeneration,
 				environmentSelectionFingerprint
 			}
-		}))) throw new CodexThreadBindingConflictError(binding.threadId, "committing a reused thread");
-		throwIfAborted();
+		}, assertCurrentClient))) throw new CodexThreadBindingConflictError(binding.threadId, "committing a reused thread");
+		assertCurrentClient();
 		lifecycleTiming.mark("thread-ready");
 		lifecycleTiming.logSummary({
 			runId: params.params.runId,
@@ -3077,7 +3053,9 @@ async function tryReuseCodexLiveThread(options) {
 			threadId: binding.threadId,
 			action: "resumed"
 		});
+		ownershipTransferred = true;
 		return {
+			kind: "ready",
 			binding: {
 				...binding,
 				cwd: params.cwd,
@@ -3088,12 +3066,19 @@ async function tryReuseCodexLiveThread(options) {
 				liveThreadOwnership: retainedThread,
 				...retainedThread.serviceTier && resumeParams.serviceTier === void 0 ? { clearInheritedServiceTier: true } : {},
 				lifecycle: { action: "resumed" }
-			},
-			prebuiltFinalConfigPatch
+			}
 		};
-	} catch (error) {
-		await releaseConsumedThread(binding.threadId, error);
-		throw error;
+	} finally {
+		if (!ownershipTransferred) try {
+			await retainedThread.release(binding.threadId);
+		} catch (error) {
+			await abandonCodexLiveThreadRelease({
+				client: params.client,
+				abandonClient: params.abandonClient,
+				lifecycleTiming,
+				threadId: binding.threadId
+			}, error);
+		}
 	}
 }
 //#endregion
@@ -3244,9 +3229,9 @@ const CODEX_NATIVE_HOOK_RELAY_EVENTS = [
 	"before_agent_finalize"
 ];
 const CODEX_NATIVE_HOOK_RELAY_EVENTS_WITH_APP_SERVER_APPROVALS = CODEX_NATIVE_HOOK_RELAY_EVENTS.filter((event) => event !== "permission_request");
-const CODEX_NATIVE_HOOK_RELAY_MIN_TTL_MS = 30 * 6e4;
+const CODEX_NATIVE_HOOK_RELAY_MIN_TTL_MS = 18e5;
 /** Extra relay lifetime after the expected turn budget, preventing late hook drops. */
-const CODEX_NATIVE_HOOK_RELAY_TTL_GRACE_MS = 5 * 6e4;
+const CODEX_NATIVE_HOOK_RELAY_TTL_GRACE_MS = 3e5;
 const CODEX_NATIVE_HOOK_RELAY_COMMAND_MIN_PARENT_MARGIN_MS = 250;
 const CODEX_NATIVE_HOOK_RELAY_COMMAND_MAX_PARENT_MARGIN_MS = 1e3;
 const CODEX_NATIVE_HOOK_RELAY_DEFAULT_TIMEOUT_SEC = 10;
@@ -4311,10 +4296,28 @@ async function startOrResumeThread(params) {
 			binding = void 0;
 		}
 		const requestContext = resolveRequestContext();
-		const { startModelSelection, startModelProvider } = requestContext;
 		let preserveExistingBinding = transientDelegationRestriction || !ringZeroActive && params.nativeProviderWebSearchSupport === "unknown" && !binding?.threadId;
 		let rotatedContextEngineBinding = false;
 		let prebuiltPluginThreadConfig;
+		const buildLoadedPluginThreadConfig = async (current) => {
+			if (!params.pluginThreadConfig?.requiresCurrentPolicyCheck && !shouldRecheckRecoverablePluginBinding({
+				binding: current,
+				pluginThreadConfig: params.pluginThreadConfig
+			})) return;
+			try {
+				prebuiltPluginThreadConfig = await lifecycleTiming.measure("plugin-config-recovery", () => params.pluginThreadConfig?.build({ threadId: current.threadId }));
+			} catch (error) {
+				throwIfAborted();
+				if (params.pluginThreadConfig?.requiresCurrentPolicyCheck) throw error;
+				embeddedAgentLog.warn("codex app-server plugin app config recovery check failed", {
+					error,
+					threadId: current.threadId
+				});
+				return;
+			}
+			throwIfAborted();
+			return prebuiltPluginThreadConfig;
+		};
 		const webSearchBindingChanged = binding?.threadId && binding.webSearchThreadConfigFingerprint !== webSearchThreadConfigFingerprint;
 		const explicitTransientWebSearchRestriction = params.webSearchAllowed === false && params.persistentWebSearchAllowed !== false && transientWebSearchRestriction;
 		const unknownProviderWebSearchSupport = params.nativeProviderWebSearchSupport === "unknown";
@@ -4393,28 +4396,13 @@ async function startOrResumeThread(params) {
 			binding = void 0;
 		}
 		if (binding?.threadId) {
-			let pluginBindingStale = isCodexPluginThreadBindingStale({
+			if (isCodexPluginThreadBindingStale({
 				codexPluginsEnabled: params.pluginThreadConfig?.enabled ?? false,
 				bindingFingerprint: binding.pluginAppsFingerprint,
 				bindingInputFingerprint: binding.pluginAppsInputFingerprint,
 				currentInputFingerprint: params.pluginThreadConfig?.inputFingerprint,
 				hasBindingPolicyContext: Boolean(binding.pluginAppPolicyContext)
-			});
-			if (!pluginBindingStale && (params.pluginThreadConfig?.requiresCurrentPolicyCheck || shouldRecheckRecoverablePluginBinding({
-				binding,
-				pluginThreadConfig: params.pluginThreadConfig
-			}))) try {
-				const bindingThreadId = binding.threadId;
-				prebuiltPluginThreadConfig = await lifecycleTiming.measure("plugin-config-recovery", () => params.pluginThreadConfig?.build({ threadId: bindingThreadId }));
-				pluginBindingStale = prebuiltPluginThreadConfig?.fingerprint !== binding.pluginAppsFingerprint;
-			} catch (error) {
-				if (params.pluginThreadConfig?.requiresCurrentPolicyCheck) throw error;
-				embeddedAgentLog.warn("codex app-server plugin app config recovery check failed", {
-					error,
-					threadId: binding.threadId
-				});
-			}
-			if (pluginBindingStale) {
+			})) {
 				embeddedAgentLog.debug("codex app-server plugin app config changed; starting a new thread", { threadId: binding.threadId });
 				await clearCurrentBinding("rotating a stale thread binding");
 				binding = void 0;
@@ -4427,75 +4415,66 @@ async function startOrResumeThread(params) {
 				binding = void 0;
 			}
 		}
-		if (binding?.threadId) if (binding.dynamicToolsFingerprint && !areDynamicToolFingerprintsCompatible(binding.dynamicToolsFingerprint, dynamicToolsFingerprint, legacyDynamicToolsFingerprint)) {
-			assertCodexBindingMayBeReplaced(binding, "changing the dynamic tool catalog");
-			preserveExistingBinding = shouldStartTransientNoToolThread({
-				previous: binding.dynamicToolsFingerprint,
-				nextHasDynamicTools: params.dynamicTools.length > 0
-			});
-			if (preserveExistingBinding) embeddedAgentLog.debug("codex app-server dynamic tools unavailable for turn; starting transient thread", { threadId: binding.threadId });
-			else {
-				embeddedAgentLog.debug("codex app-server dynamic tool catalog changed; starting a new thread", { threadId: binding.threadId });
-				await clearCurrentBinding("rotating a stale thread binding");
-			}
-		} else if (incognito) {
-			if (binding.clientId && binding.clientId === clientId) {
-				params.buildFinalConfigPatch?.({
-					action: "resume",
-					binding
+		if (binding?.threadId) {
+			if (binding.dynamicToolsFingerprint && !areDynamicToolFingerprintsCompatible(binding.dynamicToolsFingerprint, dynamicToolsFingerprint, legacyDynamicToolsFingerprint)) {
+				assertCodexBindingMayBeReplaced(binding, "changing the dynamic tool catalog");
+				preserveExistingBinding = shouldStartTransientNoToolThread({
+					previous: binding.dynamicToolsFingerprint,
+					nextHasDynamicTools: params.dynamicTools.length > 0
 				});
-				throwIfAborted();
-				lifecycleTiming.mark("thread-ready");
-				lifecycleTiming.logSummary({
-					runId: params.params.runId,
-					sessionId: params.params.sessionId,
-					sessionKey: params.params.sessionKey,
-					threadId: binding.threadId,
-					action: "resumed"
+				if (preserveExistingBinding) embeddedAgentLog.debug("codex app-server dynamic tools unavailable for turn; starting transient thread", { threadId: binding.threadId });
+				else {
+					embeddedAgentLog.debug("codex app-server dynamic tool catalog changed; starting a new thread", { threadId: binding.threadId });
+					await clearCurrentBinding("rotating a stale thread binding");
+				}
+			} else if (incognito) {
+				if (binding.clientId && binding.clientId === clientId && ((await buildLoadedPluginThreadConfig(binding))?.fingerprint ?? binding.pluginAppsFingerprint) === binding.pluginAppsFingerprint) {
+					params.buildFinalConfigPatch?.({
+						action: "resume",
+						binding
+					});
+					throwIfAborted();
+					lifecycleTiming.mark("thread-ready");
+					lifecycleTiming.logSummary({
+						runId: params.params.runId,
+						sessionId: params.params.sessionId,
+						sessionKey: params.params.sessionKey,
+						threadId: binding.threadId,
+						action: "resumed"
+					});
+					return {
+						...binding,
+						lifecycle: { action: "resumed" }
+					};
+				}
+				await clearCurrentBinding("rotating an unavailable ephemeral thread binding");
+				binding = void 0;
+			} else {
+				const warmReuse = await tryReuseCodexLiveThread({
+					...requestContext,
+					params,
+					binding,
+					clientId,
+					buildLoadedPluginThreadConfig
 				});
-				return {
-					...binding,
-					lifecycle: { action: "resumed" }
-				};
+				if (warmReuse.kind === "ready") return warmReuse.binding;
+				if (warmReuse.kind === "rotate") {
+					throwIfAborted();
+					await clearCurrentBinding("rotating a stale plugin app binding");
+				} else {
+					if (binding.preserveNativeModel === true) await assertAdoptedCodexThreadResumeAllowed(params, binding.threadId, requestContext);
+					await releaseRetainedThread(binding.threadId);
+					const resumed = await resumeExistingCodexThread(params, {
+						...requestContext,
+						binding,
+						clearCurrentBinding,
+						prebuiltFinalConfigPatch: warmReuse.prebuiltFinalConfigPatch,
+						prebuiltPluginThreadConfig,
+						buildLoadedPluginThreadConfig
+					});
+					if (resumed) return resumed;
+				}
 			}
-			await clearCurrentBinding("rotating an unavailable ephemeral thread binding");
-			binding = void 0;
-		} else {
-			const warmReuse = await tryReuseCodexLiveThread({
-				params,
-				binding,
-				bindingIdentity,
-				clientId,
-				dynamicToolsFingerprint,
-				environmentSelectionFingerprint,
-				hostSystemAgentActive,
-				lifecycleTiming,
-				nativeSkillIsolation,
-				releaseConsumedThread: (threadId, cause) => releaseCodexConsumedLiveThread({
-					client: params.client,
-					abandonClient: params.abandonClient,
-					lifecycleTiming,
-					threadId,
-					cause
-				}),
-				ringZeroActive,
-				restrictedToolSurfaceInheritedMcpServerNames,
-				startModelProvider,
-				startModelSelection,
-				throwIfAborted,
-				userMcpServersConfigPatch
-			});
-			if (warmReuse.binding) return warmReuse.binding;
-			if (binding.preserveNativeModel === true) await assertAdoptedCodexThreadResumeAllowed(params, binding.threadId, requestContext);
-			await releaseRetainedThread(binding.threadId);
-			const resumed = await resumeExistingCodexThread(params, {
-				...requestContext,
-				binding,
-				clearCurrentBinding,
-				prebuiltFinalConfigPatch: warmReuse.prebuiltFinalConfigPatch,
-				prebuiltPluginThreadConfig
-			});
-			if (resumed) return resumed;
 		}
 		if (initialBoundThreadId && !preserveExistingBinding && !replacementPredecessor) await releaseRetainedThread(initialBoundThreadId);
 		const started = await startFreshCodexThread(params, {
@@ -4510,6 +4489,54 @@ async function startOrResumeThread(params) {
 	});
 }
 //#endregion
+//#region extensions/codex/src/app-server/reasoning-effort.ts
+const CODEX_REASONING_EFFORTS = [
+	"minimal",
+	"low",
+	"medium",
+	"high",
+	"xhigh",
+	"max"
+];
+const LEGACY_PRO_REASONING_EFFORTS = [
+	"medium",
+	"high",
+	"xhigh"
+];
+const LEGACY_PRO_MODEL_ID_RE = /^gpt-5\.[45]-pro$/u;
+const MODERN_GPT_5_MODEL_ID_RE = /^gpt-5\.(?:[3-9]|[1-9]\d)(?:$|-)/u;
+/** Read reasoning metadata after the Codex app-server route has been selected. */
+function readCodexSupportedReasoningEfforts(compat) {
+	if (!compat || typeof compat !== "object" || Array.isArray(compat)) return;
+	const efforts = compat.supportedReasoningEfforts;
+	if (!Array.isArray(efforts)) return;
+	return efforts.filter((effort) => typeof effort === "string");
+}
+function resolveSupportedReasoningEffort(params) {
+	const declared = new Set(params.supportedReasoningEfforts.map((effort) => effort.trim().toLowerCase()));
+	const supported = CODEX_REASONING_EFFORTS.filter((effort) => declared.has(effort));
+	if (supported.includes(params.requested)) return params.requested;
+	const requestedRank = CODEX_REASONING_EFFORTS.indexOf(params.requested);
+	return supported.find((effort) => CODEX_REASONING_EFFORTS.indexOf(effort) >= requestedRank) ?? supported.at(-1);
+}
+function resolveCodexAppServerReasoningEffort(params) {
+	if (params.thinkLevel === "ultra") return "ultra";
+	if (params.thinkLevel === "off") return params.supportedReasoningEfforts?.includes("none") ? "none" : null;
+	if (params.thinkLevel === "adaptive") return null;
+	if (params.supportedReasoningEfforts) return resolveSupportedReasoningEffort({
+		requested: params.thinkLevel,
+		supportedReasoningEfforts: params.supportedReasoningEfforts
+	}) ?? null;
+	const modelId = params.modelId.trim().toLowerCase();
+	if (LEGACY_PRO_MODEL_ID_RE.test(modelId)) return resolveSupportedReasoningEffort({
+		requested: params.thinkLevel,
+		supportedReasoningEfforts: LEGACY_PRO_REASONING_EFFORTS
+	}) ?? null;
+	if (params.thinkLevel === "minimal" && MODERN_GPT_5_MODEL_ID_RE.test(modelId)) return "low";
+	if (params.thinkLevel === "minimal" || params.thinkLevel === "low" || params.thinkLevel === "medium" || params.thinkLevel === "high" || params.thinkLevel === "xhigh") return params.thinkLevel;
+	return null;
+}
+//#endregion
 //#region extensions/codex/src/app-server/user-input.ts
 /** Builds ordered Codex user input for both new turns and same-turn steering. */
 function buildCodexUserInput(text, images) {
@@ -4562,12 +4589,25 @@ function buildTurnStartParams(params, options) {
 		agentDir: params.agentDir,
 		config: params.config
 	});
+	const collaborationMode = modelSelection ? buildTurnCollaborationMode(params, {
+		model: modelSelection.model,
+		turnScopedDeveloperInstructions: options.turnScopedDeveloperInstructions,
+		skillsCollaborationInstructions: options.skillsCollaborationInstructions,
+		memoryCollaborationInstructions: options.memoryCollaborationInstructions
+	}) : void 0;
 	const useThreadPermissionProfile = options.appServer.networkProxy && !options.sandboxPolicy;
 	const currentSenderContext = params.trigger === "user" ? buildCodexCurrentSenderContextValue(params) : void 0;
-	const additionalContext = currentSenderContext ? { openclaw_current_sender: {
+	let additionalContext = currentSenderContext ? { openclaw_current_sender: {
 		kind: "untrusted",
 		value: currentSenderContext
 	} } : void 0;
+	if (params.permissionChange?.notice) additionalContext = {
+		...additionalContext,
+		openclaw_permission_change: {
+			kind: "application",
+			value: params.permissionChange.notice
+		}
+	};
 	return {
 		threadId: options.threadId,
 		input: [...buildCodexUserInput(options.promptText ?? params.prompt, params.images), ...options.explicitSkillInputs ?? []],
@@ -4582,14 +4622,11 @@ function buildTurnStartParams(params, options) {
 			personality: CODEX_NATIVE_PERSONALITY_NONE
 		} : {},
 		...options.appServer.serviceTier !== void 0 ? { serviceTier: options.appServer.serviceTier } : options.clearInheritedServiceTier ? { serviceTier: null } : {},
-		...modelSelection ? { effort: resolveReasoningEffort(params.thinkLevel, modelSelection.model, readCodexSupportedReasoningEfforts(params.model?.compat)) } : {},
-		...options.environmentSelection ? { environments: options.environmentSelection } : {},
-		...modelSelection ? { collaborationMode: buildTurnCollaborationMode(params, {
-			model: modelSelection.model,
-			turnScopedDeveloperInstructions: options.turnScopedDeveloperInstructions,
-			skillsCollaborationInstructions: options.skillsCollaborationInstructions,
-			memoryCollaborationInstructions: options.memoryCollaborationInstructions
-		}) } : {}
+		...collaborationMode ? {
+			effort: collaborationMode.settings.reasoning_effort,
+			collaborationMode
+		} : {},
+		...options.environmentSelection ? { environments: options.environmentSelection } : {}
 	};
 }
 function buildTurnCollaborationMode(params, options = {}) {
@@ -4598,7 +4635,11 @@ function buildTurnCollaborationMode(params, options = {}) {
 		mode: "default",
 		settings: {
 			model,
-			reasoning_effort: resolveReasoningEffort(params.thinkLevel, model, readCodexSupportedReasoningEfforts(params.model?.compat)),
+			reasoning_effort: resolveCodexAppServerReasoningEffort({
+				thinkLevel: params.thinkLevel,
+				modelId: model,
+				supportedReasoningEfforts: readCodexSupportedReasoningEfforts(params.model?.compat)
+			}),
 			developer_instructions: buildTurnScopedCollaborationInstructions(params, options)
 		}
 	};
@@ -4636,4 +4677,4 @@ function joinPresentSections(...sections) {
 	return sections.filter((section) => Boolean(section?.trim())).join("\n\n");
 }
 //#endregion
-export { resolveCodexContinuityProjectionMaxChars as $, readCodexSupportedReasoningEfforts as A, isMessageOnlyCodexSourceReply as B, buildCodexProjectDocThreadConfig as C, resolveCodexAppServerThreadModelSelection as D, resolveCodexAppServerRequestModelSelection as E, codexDynamicToolsFingerprint as F, buildContextEngineBinding as G, normalizeCodexDynamicToolName as H, codexLegacyDynamicToolsFingerprint as I, fitCodexProjectedContextForTurnStart as J, isContextEngineBindingCompatible as K, filterCodexDynamicTools as L, CODEX_MANAGED_THREAD_NAMESPACE as M, createCodexManagedThreadStore as N, resolveCodexBindingModelProviderFallback as O, areCodexDynamicToolFingerprintsCompatible as P, resolveCodexContextEngineProjectionReserveTokens as Q, filterCodexDynamicToolsForDisabledNativeSurface as R, buildDeveloperInstructions as S, resolveCodexAppServerModelProvider as T, resolveCodexDynamicToolsLoading as U, isSystemAgentOnlyCodexDynamicToolAllowlist as V, resolveCodexDynamicToolsLoadingForRuntime as W, projectContextEngineAssemblyForCodex as X, neutralizeCodexExplicitMentionSigils as Y, resolveCodexContextEngineProjectionMaxChars as Z, buildCodexRingZeroThreadConfigPatch as _, isCodexAppServerProfilerEnabled as a, buildPluginAppPolicyContext as at, buildCodexNativeWebSearchThreadConfig as b, buildCodexNativeHookRelayConfig as c, ensureCodexPluginActivation as ct, emitCodexNativePreToolUseFailureDiagnostic as d, isOpenAiCuratedMarketplaceName as dt, buildCodexPluginAppsConfigPatchFromPolicyContext as et, resolveCodexNativeHookRelayEvents as f, pluginReadParams as ft, attestCodexRestrictedToolSurfaceMcpServersDisabled as g, assertCodexManagedRequirementsDoNotOverrideToolPolicy as h, startOrResumeThread as i, buildDisabledAppsConfigPatch as it, CODEX_MANAGED_THREAD_MAX_ENTRIES as j, resolveReasoningEffort as k, buildCodexNativeHookRelayDisabledConfig as l, refreshCodexPluginRuntimeState as lt, scheduleCodexNativeHookRelayUnregister as m, buildTurnStartParams as n, buildCodexPluginThreadConfigInputFingerprint as nt, CODEX_NATIVE_HOOK_RELAY_EVENTS as o, mergeCodexThreadConfigs as ot, resolveCodexNativeHookRelayTtlMs as p, resolveRecoverableCodexPluginConfigKeys as pt, buildCodexContinuityCalibration as q, buildCodexUserInput as r, buildCodexPluginThreadConfigTimeoutFallback as rt, CODEX_NATIVE_HOOK_RELAY_TTL_GRACE_MS as s, shouldBuildCodexPluginThreadConfig as st, buildTurnCollaborationMode as t, buildCodexPluginThreadConfig as tt, createCodexNativeHookRelay as u, isOpenAiCuratedMarketplace as ut, buildCodexRuntimeThreadConfig as v, CODEX_NATIVE_PERSONALITY_NONE as w, resolveCodexWebSearchPlan as x, readCodexInheritedMcpServerNames as y, isForcedPrivateQaCodexRuntime as z };
+export { resolveCodexContinuityProjectionMaxChars as $, resolveCodexBindingModelProviderFallback as A, isMessageOnlyCodexSourceReply as B, resolveCodexWebSearchPlan as C, resolveCodexAppServerModelProvider as D, CODEX_NATIVE_PERSONALITY_NONE as E, codexDynamicToolsFingerprint as F, buildContextEngineBinding as G, normalizeCodexDynamicToolName as H, codexLegacyDynamicToolsFingerprint as I, fitCodexProjectedContextForTurnStart as J, isContextEngineBindingCompatible as K, filterCodexDynamicTools as L, CODEX_MANAGED_THREAD_NAMESPACE as M, createCodexManagedThreadStore as N, resolveCodexAppServerRequestModelSelection as O, areCodexDynamicToolFingerprintsCompatible as P, resolveCodexContextEngineProjectionReserveTokens as Q, filterCodexDynamicToolsForDisabledNativeSurface as R, buildCodexNativeWebSearchThreadConfig as S, buildCodexProjectDocThreadConfig as T, resolveCodexDynamicToolsLoading as U, isSystemAgentOnlyCodexDynamicToolAllowlist as V, resolveCodexDynamicToolsLoadingForRuntime as W, projectContextEngineAssemblyForCodex as X, neutralizeCodexExplicitMentionSigils as Y, resolveCodexContextEngineProjectionMaxChars as Z, assertCodexManagedRequirementsDoNotOverrideToolPolicy as _, resolveCodexAppServerReasoningEffort as a, buildPluginAppPolicyContext as at, buildCodexRuntimeThreadConfig as b, CODEX_NATIVE_HOOK_RELAY_EVENTS as c, ensureCodexPluginActivation as ct, buildCodexNativeHookRelayDisabledConfig as d, isOpenAiCuratedMarketplaceName as dt, buildCodexPluginAppsConfigPatchFromPolicyContext as et, createCodexNativeHookRelay as f, pluginReadParams as ft, scheduleCodexNativeHookRelayUnregister as g, resolveCodexNativeHookRelayTtlMs as h, readCodexSupportedReasoningEfforts as i, buildDisabledAppsConfigPatch as it, CODEX_MANAGED_THREAD_MAX_ENTRIES as j, resolveCodexAppServerThreadModelSelection as k, CODEX_NATIVE_HOOK_RELAY_TTL_GRACE_MS as l, refreshCodexPluginRuntimeState as lt, resolveCodexNativeHookRelayEvents as m, buildTurnStartParams as n, buildCodexPluginThreadConfigInputFingerprint as nt, startOrResumeThread as o, mergeCodexThreadConfigs as ot, emitCodexNativePreToolUseFailureDiagnostic as p, resolveRecoverableCodexPluginConfigKeys as pt, buildCodexContinuityCalibration as q, buildCodexUserInput as r, buildCodexPluginThreadConfigTimeoutFallback as rt, isCodexAppServerProfilerEnabled as s, shouldBuildCodexPluginThreadConfig as st, buildTurnCollaborationMode as t, buildCodexPluginThreadConfig as tt, buildCodexNativeHookRelayConfig as u, isOpenAiCuratedMarketplace as ut, attestCodexRestrictedToolSurfaceMcpServersDisabled as v, buildDeveloperInstructions as w, readCodexInheritedMcpServerNames as x, buildCodexRingZeroThreadConfigPatch as y, isForcedPrivateQaCodexRuntime as z };