@openclaw/codex 2026.8.2 → 2026.9.1

package/dist/{thread-lifecycle-CGGKP720.js → thread-lifecycle-DAcEJ_Om.js}

@@ -1,19 +1,19 @@
-import { E as resolveCodexPluginsPolicy, F as resolveCodexAppServerLocalHomeDir, M as CODEX_PLUGINS_WORKSPACE_MARKETPLACE_NAME, P as resolveCodexAppServerHomeDir, f as assertCodexModelBackedReviewerEffectiveConfig, j as CODEX_PLUGINS_MARKETPLACE_NAME, n as codexSandboxPolicyForTurn } from "./config-CcYL77O6.js";
-import { $ as CodexAppServerRpcError, D as CodexThreadStartRequestError, E as CodexThreadBindingConflictError, H as getCodexAppServerClientInstanceId, Ht as isJsonObject, J as isCodexAppServerOverloadError, Q as resolveCodexAppServerClientInstanceId, St as releaseCodexAppServerLiveThread, T as CodexRestrictedToolSurfaceAttestationError, Vt as flattenCodexDynamicToolFunctions, _ as retainSharedCodexAppServerClientByInstanceId, bt as isCodexAppServerLiveThreadClaimed, dt as resolveCodexToolAbortTerminalReason, gt as consumeCodexAppServerLiveThread, n as captureExclusiveSharedCodexAppServerClient, w as CodexAdoptedThreadActiveError, wt as unsubscribeCodexAppServerLiveThread, yt as isCodexAppServerClientRuntimeLive } from "./shared-client-B1tT5U6r.js";
-import { a as hashCodexAppServerBindingFingerprint, c as reclaimCurrentCodexSessionGeneration, d as sessionBindingIdentity, i as createCodexSessionGenerationSupersededError, n as assertCodexBindingMayBeReplaced, o as isCodexAppServerNativeAuthProfile, s as normalizeCodexAppServerBindingModelProvider } from "./session-binding-D0zinCP1.js";
-import { a as assertCodexThreadForkResponse, r as assertCodexThreadAcceptsDirectInput, s as assertCodexThreadStartResponse, t as CodexThreadDirectInputError } from "./protocol-validators-Bg5rpNxk.js";
-import { a as closeCodexStartupClientBestEffort, c as isCodexAppServerUnsafeSubscriptionError, f as unsubscribeCodexThreadBestEffort, n as CODEX_APP_SERVER_UNSUBSCRIBE_TIMEOUT_MS, r as CodexAppServerUnsafeSubscriptionError } from "./attempt-client-cleanup-CpVfwctT.js";
-import { c as serializeCodexAppInventoryError, n as buildCodexAppServerConnectionFingerprint, s as defaultCodexAppInventoryCache, t as resumeCodexAppServerThread } from "./thread-resume-BFt1-ZDa.js";
-import { c as withExclusiveCodexAppServerThread, l as isIncognitoSessionKey } from "./thread-ownership-RkaoZCmQ.js";
-import { i as readCodexSessionMeta, n as codexCatalogHomeId } from "./session-catalog-home-id-Dt2GiG5o.js";
-import { f as projectBoundedCodexThreadHistory } from "./transcript-mirror-1ep4XjzF.js";
+import { $t as isJsonObject, E as CodexThreadStartRequestError, Et as isCodexAppServerLiveThreadClaimed, H as isCodexAppServerOverloadError, I as getCodexAppServerClientInstanceId, Jt as readCodexSessionMeta, K as resolveCodexAppServerClientInstanceId, Mt as withAbortableTimeout, Ot as readCodexClientSessionMeta, Q as assertCodexThreadForkResponse, Qt as flattenCodexDynamicToolFunctions, St as consumeCodexAppServerLiveThread, T as CodexThreadBindingConflictError, Tt as isCodexAppServerClientRuntimeLive, W as isCodexAppServerRequestTimeoutError, X as assertCodexThreadAcceptsDirectInput, _ as retainSharedCodexAppServerClientByInstanceId, _t as resolveCodexToolAbortTerminalReason, et as assertCodexThreadStartResponse, jt as unsubscribeCodexAppServerLiveThread, kt as releaseCodexAppServerLiveThread, n as captureCodexAppServerClientLifetime, q as CodexAppServerRpcError, w as CodexAdoptedThreadActiveError } from "./shared-client-DxcfF9KX.js";
+import { D as resolveCodexPluginsPolicy, F as resolveCodexAppServerHomeDir, I as resolveCodexAppServerLocalHomeDir, M as CODEX_PLUGINS_MARKETPLACE_NAME, N as CODEX_PLUGINS_WORKSPACE_MARKETPLACE_NAME, n as codexSandboxPolicyForTurn, p as assertCodexModelBackedReviewerEffectiveConfig } from "./config-BhmfC1s6.js";
+import { a as hashCodexAppServerBindingFingerprint, c as reclaimCurrentCodexSessionGeneration, d as sessionBindingIdentity, i as createCodexSessionGenerationSupersededError, n as assertCodexBindingMayBeReplaced, o as isCodexAppServerNativeAuthProfile, s as normalizeCodexAppServerBindingModelProvider } from "./session-binding-BHuTCRZQ.js";
+import { a as closeCodexStartupClientBestEffort, c as isCodexAppServerUnsafeSubscriptionError, d as unsubscribeCodexThreadBestEffort, l as retireUnsafeCodexTurnClientBestEffort, n as CODEX_APP_SERVER_UNSUBSCRIBE_TIMEOUT_MS, r as CodexAppServerUnsafeSubscriptionError } from "./attempt-client-cleanup-DYHcRQAa.js";
+import { c as serializeCodexAppInventoryError, n as buildCodexAppServerConnectionFingerprint, s as defaultCodexAppInventoryCache, t as resumeCodexAppServerThread } from "./thread-resume-C7pyVKeW.js";
+import { c as withExclusiveCodexAppServerThread, l as isIncognitoSessionKey, o as withCodexAppServerThreadMutation, r as retainCodexAppServerBindingSubscription } from "./thread-ownership-zGokd8i1.js";
+import { f as projectBoundedCodexThreadHistory, g as codexCatalogHomeId } from "./transcript-mirror-DTUxFWa_.js";
+import { i as refreshCodexThreadPolicy, n as CodexThreadPolicyHandoffError, r as assertCodexSupervisionThreadLineage, t as CodexIncognitoPolicyChangeError } from "./thread-policy-g4KbJPzp.js";
 import { r as sanitizeInlineImageDataUrl, t as invalidInlineImageText } from "./image-payload-sanitizer-CnfoUPCE.js";
 import { asOptionalRecord, isRecord, normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
 import fs from "node:fs/promises";
 import path from "node:path";
 import { createDeferred } from "openclaw/plugin-sdk/extension-shared";
 import { addTimerTimeoutGraceMs, finiteSecondsToTimerSafeMilliseconds } from "openclaw/plugin-sdk/number-runtime";
-import { SKILL_WORKSHOP_TOOL_NAME, buildCredentialSafetyPrompt, buildDelegationGuidanceSection, buildHarnessVisibleReplyGuidance, buildSkillWorkshopPromptSection, embeddedAgentLog, formatErrorMessage, isActiveHarnessContextEngine, isHostScopedAgentToolActive, resolveMainSessionDelegationMode } from "openclaw/plugin-sdk/agent-harness-runtime";
+import { AgentHarnessPreflightError, SKILL_WORKSHOP_TOOL_NAME, buildCredentialSafetyPrompt, buildDelegationGuidanceSection, buildHarnessVisibleReplyGuidance, buildSkillWorkshopPromptSection, buildTemporalContextText, embeddedAgentLog, formatErrorMessage, isActiveHarnessContextEngine, isHostScopedAgentToolActive, resolveMainSessionDelegationMode } from "openclaw/plugin-sdk/agent-harness-runtime";
+import { isPathInside } from "openclaw/plugin-sdk/file-access-runtime";
 import * as crypto$1 from "node:crypto";
 import crypto, { createHash } from "node:crypto";
 import os from "node:os";
@@ -26,13 +26,12 @@ import { sliceUtf16Safe, truncateUtf16Safe } from "openclaw/plugin-sdk/text-util
 import { emitTrustedDiagnosticEvent } from "openclaw/plugin-sdk/diagnostic-runtime";
 import { expectDefined } from "openclaw/plugin-sdk/expect-runtime";
 import { redactSensitiveFieldValue, redactToolPayloadText } from "openclaw/plugin-sdk/logging-core";
-import { isPathInside } from "openclaw/plugin-sdk/file-access-runtime";
 import { resolveRequiredHomeDir, resolveStateDir } from "openclaw/plugin-sdk/state-paths";
-import { listRegisteredPluginAgentPromptGuidance } from "openclaw/plugin-sdk/plugin-runtime";
-import { buildHostnameAllowlistPolicyFromSuffixAllowlist } from "openclaw/plugin-sdk/ssrf-policy";
 import { buildCodexUserMcpServersThreadConfigPatchForRun } from "openclaw/plugin-sdk/codex-mcp-projection";
 import { registerRetainedNativeHookRelayForBundledRuntime } from "openclaw/plugin-sdk/native-hook-relay-runtime";
 import { isDiagnosticFlagEnabled } from "openclaw/plugin-sdk/diagnostic-flags";
+import { listRegisteredPluginAgentPromptGuidance } from "openclaw/plugin-sdk/plugin-runtime";
+import { buildHostnameAllowlistPolicyFromSuffixAllowlist } from "openclaw/plugin-sdk/ssrf-policy";
 //#region extensions/codex/src/app-server/plugin-inventory.ts
 /**
 * Reads Codex plugin marketplace state and app inventory to decide which
@@ -281,25 +280,20 @@ function resolveOwnedApps(params) {
 			accessible: info.isAccessible,
 			enabled: info.isEnabled,
 			needsAuth: !info.isAccessible
-		}, resolveOwnedAppReadOnlyToolConfigKeys(info));
+		}, resolveOwnedAppApprovalOverrideKeys(info));
 	}).toSorted((left, right) => left.id.localeCompare(right.id));
 }
-/** Returns the config keys that Codex metadata proves belong to read-only tools. */
-function resolveOwnedAppReadOnlyToolConfigKeys(app) {
+/** Returns current tool keys whose overrides could bypass the requested reviewer. */
+function resolveOwnedAppApprovalOverrideKeys(app) {
+	if (!app.toolSummaries) return {};
 	const appName = app.name.trim();
 	const appNameLower = appName.toLowerCase();
-	const tools = app.toolSummaries ?? [];
-	const writableToolConfigKeys = new Set(tools.filter((tool) => !tool.isReadOnly).flatMap((tool) => resolveAppToolConfigKeys({
-		appName,
-		appNameLower,
-		tool
-	})));
-	const keys = tools.filter((tool) => tool.isReadOnly).flatMap((tool) => resolveAppToolConfigKeys({
+	const keys = app.toolSummaries.filter((tool) => !tool.isReadOnly).flatMap((tool) => resolveAppToolConfigKeys({
 		appName,
 		appNameLower,
 		tool
-	})).filter((key) => !writableToolConfigKeys.has(key));
-	return keys.length > 0 ? { readOnlyToolConfigKeys: Array.from(new Set(keys)).toSorted() } : {};
+	}));
+	return { approvalOverrideToolConfigKeys: Array.from(new Set(keys)).toSorted() };
 }
 function resolveAppToolConfigKeys(params) {
 	const keys = [params.tool.name];
@@ -566,7 +560,7 @@ function toCodexPluginOwnedAccountApp(app) {
 		accessible: app.isAccessible,
 		enabled: app.isEnabled,
 		needsAuth: !app.isAccessible,
-		...resolveOwnedAppReadOnlyToolConfigKeys(app)
+		...resolveOwnedAppApprovalOverrideKeys(app)
 	};
 }
 function resolveCodexThreadConfigAppsForRecord(params) {
@@ -623,7 +617,7 @@ function shouldForceRefreshCodexNotReadyPluginApps(params, policy, inventory) {
 * Builds Codex thread config patches that expose only policy-approved apps
 * for native Codex turns.
 */
-const CODEX_PLUGIN_THREAD_CONFIG_INPUT_FINGERPRINT_VERSION = 3;
+const CODEX_PLUGIN_THREAD_CONFIG_INPUT_FINGERPRINT_VERSION = 4;
 const CODEX_PLUGIN_THREAD_CONFIG_FINGERPRINT_VERSION = 2;
 /** Returns true when plugin config exists and thread config may need app patches. */
 function shouldBuildCodexPluginThreadConfig(pluginConfig) {
@@ -996,10 +990,11 @@ function readPersistedAppToolApprovalOverrideNames(config, app) {
 	const appConfig = isJsonObject(appsRoot) ? appsRoot[app.id] : void 0;
 	const tools = isJsonObject(appConfig) ? appConfig.tools : void 0;
 	if (!isJsonObject(tools)) return [];
-	return Object.entries(tools).filter(([toolName]) => !app.readOnlyToolConfigKeys?.includes(toolName)).filter(([, value]) => hasPersistedToolApprovalOverride(value)).map(([toolName]) => toolName).toSorted();
+	const keys = app.approvalOverrideToolConfigKeys;
+	return Object.entries(tools).flatMap(([name, value]) => (!keys || keys.includes(name)) && hasPersistedToolApprovalOverride(value) ? [name] : []).toSorted();
 }
 function hasPersistedToolApprovalOverride(value) {
-	return isJsonObject(value) && value.approval_mode !== void 0;
+	return isJsonObject(value) && value.approval_mode !== void 0 && value.approval_mode !== null;
 }
 function quoteConfigKeyPathSegment(segment) {
 	return `"${segment.replace(/["\\]/g, (char) => `\\${char}`)}"`;
@@ -1043,11 +1038,11 @@ function mergeJsonObjects(left, right) {
 	return merged;
 }
 function fingerprintJson(value) {
-	return crypto.createHash("sha256").update(stableStringify(value)).digest("hex");
+	return crypto.createHash("sha256").update(stableStringify$1(value)).digest("hex");
 }
-function stableStringify(value) {
-	if (Array.isArray(value)) return `[${value.map((item) => stableStringify(item)).join(",")}]`;
-	if (value && typeof value === "object") return `{${Object.entries(value).toSorted(([left], [right]) => left.localeCompare(right)).map(([key, item]) => `${JSON.stringify(key)}:${stableStringify(item)}`).join(",")}}`;
+function stableStringify$1(value) {
+	if (Array.isArray(value)) return `[${value.map((item) => stableStringify$1(item)).join(",")}]`;
+	if (value && typeof value === "object") return `{${Object.entries(value).toSorted(([left], [right]) => left.localeCompare(right)).map(([key, item]) => `${JSON.stringify(key)}:${stableStringify$1(item)}`).join(",")}}`;
 	return JSON.stringify(value);
 }
 //#endregion
@@ -1828,6 +1823,65 @@ function applyCodexNativeSkillIsolation(config, isolation) {
 	};
 }
 //#endregion
+//#region extensions/codex/src/app-server/native-tool-catalog.ts
+function hasCodexNativeToolCatalog(binding) {
+	return binding?.connectionScope === "supervision" && !binding.pendingSupervisionBranch;
+}
+/** Pinned serde omits false deferLoading; every other declaration byte remains native-owned. */
+function parseCodexNativeToolCatalog(metadata, threadId, fingerprint) {
+	const fail = () => /* @__PURE__ */ new Error("The canonical Codex native tool catalog is missing, corrupt, or changed; the thread is preserved. Reconnect and inspect its native metadata before retrying.");
+	if (!isJsonObject(metadata) || metadata.id !== threadId || !Array.isArray(metadata.dynamic_tools) || Buffer.byteLength(JSON.stringify(metadata.dynamic_tools)) > 1048576) throw fail();
+	const names = /* @__PURE__ */ new Set();
+	const namespaces = /* @__PURE__ */ new Set();
+	const validName = (name) => typeof name === "string" && /^[a-zA-Z0-9_-]{1,128}$/u.test(name);
+	const readFunction = (value) => {
+		if (!isJsonObject(value) || value.type !== "function" || !validName(value.name) || typeof value.description !== "string" || !isJsonObject(value.inputSchema) || value.deferLoading !== void 0 && typeof value.deferLoading !== "boolean" || Object.keys(value).some((key) => ![
+			"type",
+			"name",
+			"description",
+			"inputSchema",
+			"deferLoading"
+		].includes(key)) || names.has(value.name) || names.size >= 2e3) throw fail();
+		names.add(value.name);
+		return {
+			type: "function",
+			name: value.name,
+			description: value.description,
+			inputSchema: structuredClone(value.inputSchema),
+			...value.deferLoading === true ? { deferLoading: true } : {}
+		};
+	};
+	const tools = metadata.dynamic_tools.map((value) => {
+		if (!isJsonObject(value) || value.type !== "namespace") return readFunction(value);
+		if (!validName(value.name) || namespaces.has(value.name) || typeof value.description !== "string" || !Array.isArray(value.tools) || !value.tools.length || Object.keys(value).some((key) => ![
+			"type",
+			"name",
+			"description",
+			"tools"
+		].includes(key))) throw fail();
+		namespaces.add(value.name);
+		return {
+			type: "namespace",
+			name: value.name,
+			description: value.description,
+			tools: value.tools.map(readFunction)
+		};
+	});
+	if (fingerprint !== void 0 && codexDynamicToolsFingerprint(tools) !== fingerprint) throw fail();
+	return tools;
+}
+/** Existing supervised bindings identify data, never authorize an executor or a new adoption. */
+async function loadCodexNativeToolCatalog(params) {
+	const { binding, client, appServer, agentDir, assertCurrent } = params;
+	assertCurrent();
+	const home = resolveCodexAppServerLocalHomeDir(appServer.start, agentDir);
+	const actualHome = client.getRuntimeIdentity()?.codexHome;
+	if (!hasCodexNativeToolCatalog(binding) || !binding.dynamicToolsFingerprint || appServer.start.transport !== "stdio" || appServer.remoteWorkspaceRoot || !actualHome || path.resolve(actualHome) !== path.resolve(home) || binding.appServerRuntimeFingerprint !== buildCodexAppServerConnectionFingerprint(appServer, agentDir)) throw new Error("Canonical Codex declarations require the original verified local binding and selected native connection; the thread is preserved.");
+	const metadata = await readCodexClientSessionMeta(client, path.join(home, "sessions"), binding.rolloutPath, binding.threadId);
+	assertCurrent();
+	return parseCodexNativeToolCatalog(metadata, binding.threadId, binding.dynamicToolsFingerprint);
+}
+//#endregion
 //#region extensions/codex/src/app-server/managed-thread-store.ts
 const CODEX_MANAGED_THREAD_NAMESPACE = "app-server-managed-threads";
 const CODEX_MANAGED_THREAD_MAX_ENTRIES = 2e4;
@@ -1890,11 +1944,59 @@ function createCodexManagedThreadStore(state) {
 	};
 }
 //#endregion
+//#region extensions/codex/src/app-server/thread-mcp-attestation.ts
+async function attestCodexRestrictedToolSurfaceMcpServersDisabled(client, threadId, threadConfig, signal, expectedActiveServerNames = []) {
+	const configuredServers = threadConfig?.mcp_servers;
+	if (configuredServers !== void 0 && !isJsonObject(configuredServers)) throw new Error("Codex restricted-tool-surface thread config has invalid mcp_servers");
+	const expectedServers = /* @__PURE__ */ new Map();
+	for (const [name, serverConfig] of Object.entries(configuredServers ?? {})) {
+		if (!isJsonObject(serverConfig) || serverConfig.enabled !== false) throw new Error(`Codex restricted-tool-surface MCP server ${name} is not disabled`);
+		expectedServers.set(name, "disabled");
+	}
+	for (const name of expectedActiveServerNames) {
+		if (expectedServers.get(name) === "disabled") throw new Error(`Codex restricted-tool-surface MCP server ${name} has conflicting policy`);
+		expectedServers.set(name, "active");
+	}
+	const response = await client.request("mcpServerStatus/list", {
+		threadId,
+		detail: "toolsAndAuthOnly"
+	}, { signal });
+	if (!isJsonObject(response) || !Array.isArray(response.data)) throw new Error("Codex mcpServerStatus/list returned an invalid restricted-tool-surface attestation");
+	const observedServerNames = /* @__PURE__ */ new Set();
+	for (const status of response.data) {
+		if (!isJsonObject(status) || typeof status.name !== "string" || !isJsonObject(status.tools)) throw new Error("Codex mcpServerStatus/list returned an invalid restricted-tool-surface server");
+		if (!expectedServers.has(status.name)) throw new Error(`Codex restricted-tool-surface MCP attestation found unexpected server ${status.name}`);
+		if (observedServerNames.has(status.name)) throw new Error(`Codex restricted-tool-surface MCP attestation returned duplicate server ${status.name}`);
+		observedServerNames.add(status.name);
+		if (!Object.hasOwn(status, "serverInfo")) throw new Error(`Codex restricted-tool-surface MCP attestation returned malformed server ${status.name}`);
+		if (expectedServers.get(status.name) === "active") {
+			if (status.serverInfo === null || Object.keys(status.tools).length === 0) throw new Error(`Codex restricted-tool-surface MCP attestation found inactive admitted server ${status.name}`);
+			continue;
+		}
+		if (status.serverInfo !== null) throw new Error(`Codex restricted-tool-surface MCP attestation found active server ${status.name}`);
+		if (Object.keys(status.tools).length > 0) throw new Error(`Codex restricted-tool-surface MCP attestation found tools for server ${status.name}`);
+	}
+	for (const [expectedName, state] of expectedServers) if (!observedServerNames.has(expectedName)) throw new Error(`Codex restricted-tool-surface MCP attestation is missing ${state === "active" ? "admitted " : ""}server ${expectedName}`);
+	if (response.nextCursor !== void 0 && response.nextCursor !== null) throw new Error("Codex mcpServerStatus/list returned an invalid empty-page cursor");
+}
+//#endregion
 //#region extensions/codex/src/app-server/plugin-thread-attestation.ts
 /**
 * Confirms admitted plugin and account apps against their actual Codex thread before
 * OpenClaw commits a binding or starts a turn.
 */
+/** Every admission path checks the same surface; its lifecycle owner keeps the claim fenced. */
+async function attestCodexThreadToolSurface(params) {
+	params.assertCurrent();
+	if (params.appIds.length > 0) {
+		await params.lifecycleTiming.measure("plugin-app-attestation", () => attestCodexPluginThreadApps(params));
+		params.assertCurrent();
+	}
+	if (params.restrictedToolSurface) {
+		await params.lifecycleTiming.measure("restricted-tool-surface-mcp-attestation", () => attestCodexRestrictedToolSurfaceMcpServersDisabled(params.client, params.threadId, params.threadConfig, params.signal, params.appIds.length > 0 ? ["codex_apps"] : []));
+		params.assertCurrent();
+	}
+}
 var CodexPluginThreadAppAttestationError = class extends Error {
 	constructor(message, options) {
 		super(message, options);
@@ -1945,211 +2047,505 @@ async function discardUnattestedCodexPluginThread(params) {
 	}
 }
 //#endregion
-//#region extensions/codex/src/app-server/thread-lifecycle-result.ts
-/** Materializes the public lifecycle result after a fresh thread is durably committed. */
-function buildStartedCodexThreadBinding(input) {
-	const { context, params, response, startParams } = input;
-	return {
-		threadId: response.thread.id,
-		...input.clientId ? { clientId: input.clientId } : {},
-		cwd: params.cwd,
-		...input.rolloutPath ? { rolloutPath: input.rolloutPath } : {},
-		authProfileId: params.params.authProfileId,
-		agentWorkspaceDeveloperInstructions: params.agentWorkspaceDeveloperInstructions,
-		model: response.model ?? startParams.model ?? params.params.modelId,
-		modelProvider: response.modelProvider ?? input.startModelProvider ?? input.modelProvider,
-		dynamicToolsFingerprint: context.dynamicToolsFingerprint,
-		dynamicToolsContainDeferred: context.dynamicToolsContainDeferred,
-		nativeSkillIsolationFingerprint: context.nativeSkillIsolationFingerprint,
-		userMcpServersFingerprint: context.userMcpServersFingerprint,
-		mcpServersFingerprint: input.nextMcpServersFingerprint,
-		configuredMcpOwnershipVersion: params.configuredMcpOwnershipVersion,
-		ringZeroConfigFingerprint: context.ringZeroConfigFingerprint,
-		ringZeroClientInstanceId: context.ringZeroClientInstanceId,
-		networkProxyProfileName: params.appServer.networkProxy?.profileName,
-		networkProxyConfigFingerprint: context.networkProxyConfigFingerprint,
-		nativeHookRelayGeneration: input.finalConfigPatch.nativeHookRelayGeneration,
-		appServerRuntimeFingerprint: params.appServerRuntimeFingerprint,
-		pluginAppsFingerprint: input.pluginThreadConfig?.fingerprint,
-		pluginAppsInputFingerprint: input.pluginThreadConfig?.inputFingerprint,
-		pluginAppPolicyContext: input.pluginThreadConfig?.policyContext,
-		contextEngine: context.contextEngineBinding,
-		environmentSelectionFingerprint: context.environmentSelectionFingerprint,
-		...!context.preserveExistingBinding ? { liveThreadConfigFingerprint: fingerprintCodexThreadConfig({
-			...startParams,
-			model: response.model ?? startParams.model ?? null,
-			requestedModel: startParams.model ?? null,
-			modelProvider: input.bindingModelProvider ?? null,
-			requestedModelProvider: startParams.modelProvider ?? input.bindingModelProvider ?? null
-		}, params.params.authProfileId, context.dynamicToolsFingerprint) } : {},
-		lifecycle: {
-			action: "started",
-			...context.rotatedContextEngineBinding ? { rotatedContextEngineBinding: true } : {}
+//#region extensions/codex/src/app-server/native-hook-relay-state.ts
+const pending = /* @__PURE__ */ new Set();
+/** Owns delayed hook-relay cleanup across runtime scheduling and test teardown. */
+const nativeHookRelayUnregisterQueue = {
+	add(entry) {
+		pending.add(entry);
+	},
+	delete(entry) {
+		return pending.delete(entry);
+	},
+	flush() {
+		while (pending.size > 0) {
+			const entry = pending.values().next().value;
+			if (!entry) return;
+			clearTimeout(entry.timeout);
+			entry.unregister();
 		}
-	};
-}
+	},
+	clear() {
+		for (const entry of pending) clearTimeout(entry.timeout);
+		pending.clear();
+	}
+};
 //#endregion
-//#region extensions/codex/src/app-server/reasoning-effort.ts
-const CODEX_REASONING_EFFORTS = [
-	"minimal",
-	"low",
-	"medium",
-	"high",
-	"xhigh",
-	"max",
-	"ultra"
-];
-const LEGACY_PRO_REASONING_EFFORTS = [
-	"medium",
-	"high",
-	"xhigh"
+//#region extensions/codex/src/app-server/native-hook-relay.ts
+/**
+* Bridges Codex native hook callbacks into OpenClaw's native hook relay so
+* app-server tool events can still run OpenClaw policy and diagnostics.
+*/
+/** Codex hook events that can be registered through OpenClaw's native relay. */
+const CODEX_NATIVE_HOOK_RELAY_EVENTS = [
+	"pre_tool_use",
+	"post_tool_use",
+	"permission_request",
+	"before_agent_finalize"
 ];
-const LEGACY_PRO_MODEL_ID_RE = /^gpt-5\.[45]-pro$/u;
-const MODERN_GPT_5_MODEL_ID_RE = /^gpt-5\.(?:[3-9]|[1-9]\d)(?:$|-)/u;
-/** Read reasoning metadata after the Codex app-server route has been selected. */
-function readCodexSupportedReasoningEfforts(compat) {
-	if (!compat || typeof compat !== "object" || Array.isArray(compat)) return;
-	const efforts = compat.supportedReasoningEfforts;
-	if (!Array.isArray(efforts)) return;
-	return efforts.filter((effort) => typeof effort === "string");
+const CODEX_NATIVE_HOOK_RELAY_EVENTS_WITH_APP_SERVER_APPROVALS = CODEX_NATIVE_HOOK_RELAY_EVENTS.filter((event) => event !== "permission_request");
+const CODEX_NATIVE_HOOK_RELAY_MIN_TTL_MS = 18e5;
+/** Extra relay lifetime after the expected turn budget, preventing late hook drops. */
+const CODEX_NATIVE_HOOK_RELAY_TTL_GRACE_MS = 3e5;
+const CODEX_NATIVE_HOOK_RELAY_COMMAND_MIN_PARENT_MARGIN_MS = 250;
+const CODEX_NATIVE_HOOK_RELAY_COMMAND_MAX_PARENT_MARGIN_MS = 1e3;
+const CODEX_NATIVE_HOOK_RELAY_DEFAULT_TIMEOUT_SEC = 10;
+const CODEX_NATIVE_HOOK_RELAY_UNREGISTER_GRACE_MS = 1e4;
+const CODEX_NATIVE_HOOK_RELAY_UNREGISTER_EXTRA_GRACE_MS = 5e3;
+const MAX_PENDING_DIRECT_CHILD_ADMISSIONS = 32;
+const nativeHookPolicyByClient = /* @__PURE__ */ new WeakMap();
+const CODEX_HOOK_MATCHER_NAMES_BY_TOOL_ID = {
+	exec: [
+		"Bash",
+		"exec",
+		"exec_command"
+	],
+	apply_patch: [
+		"apply_patch",
+		"Write",
+		"Edit"
+	],
+	spawn_agent: ["spawn_agent", "Agent"]
+};
+/** Enterprise managed-only policy silently drops the session-layer hooks that enforce OpenClaw. */
+async function assertCodexNativeHookRelayAllowed(client, signal) {
+	let attestation = nativeHookPolicyByClient.get(client);
+	if (!attestation) {
+		attestation = client.request("configRequirements/read", void 0, { signal }).then((response) => {
+			if (!isJsonObject(response) || !Object.hasOwn(response, "requirements")) throw new Error("Codex configRequirements/read returned an invalid hook policy response");
+			const requirements = response.requirements;
+			if (requirements === null) return;
+			if (!isJsonObject(requirements)) throw new Error("Codex configRequirements/read returned invalid hook policy requirements");
+			const managedOnly = requirements.allowManagedHooksOnly;
+			if (managedOnly !== void 0 && managedOnly !== null && typeof managedOnly !== "boolean") throw new Error("Codex configRequirements/read returned invalid managed-only hook policy");
+			if (managedOnly === true) throw new Error("Codex managed-only hooks disable the OpenClaw native hook relay; refusing unenforced execution");
+		});
+		nativeHookPolicyByClient.set(client, attestation);
+		attestation.catch(() => {
+			if (nativeHookPolicyByClient.get(client) === attestation) nativeHookPolicyByClient.delete(client);
+		});
+	}
+	await attestation;
 }
-function resolveSupportedReasoningEffort(params) {
-	const declared = new Set(params.supportedReasoningEfforts.map((effort) => effort.trim().toLowerCase()));
-	const supported = CODEX_REASONING_EFFORTS.filter((effort) => declared.has(effort));
-	if (supported.includes(params.requested)) return params.requested;
-	const fallbackEfforts = params.requested === "ultra" ? supported : supported.filter((effort) => effort !== "ultra");
-	const requestedRank = CODEX_REASONING_EFFORTS.indexOf(params.requested);
-	return fallbackEfforts.find((effort) => CODEX_REASONING_EFFORTS.indexOf(effort) >= requestedRank) ?? fallbackEfforts.at(-1);
+/** Defers relay unregister so late native hook subprocesses can still resolve. */
+function scheduleCodexNativeHookRelayUnregister(params) {
+	let pending;
+	const unregister = () => {
+		if (!pending) return;
+		const current = pending;
+		pending = void 0;
+		if (!nativeHookRelayUnregisterQueue.delete(current)) return;
+		params.relay.unregister();
+	};
+	const timeout = setTimeout(unregister, resolveCodexNativeHookRelayUnregisterGraceMs(params.hookTimeoutSec));
+	pending = {
+		timeout,
+		unregister
+	};
+	nativeHookRelayUnregisterQueue.add(pending);
+	timeout.unref();
 }
-/** Resolve a turn effort from the selected model's provider-owned metadata. */
-function resolveCodexAppServerReasoningEffort(params) {
-	if (params.thinkLevel === "off") return params.supportedReasoningEfforts?.includes("none") ? "none" : null;
-	if (params.thinkLevel === "adaptive") return null;
-	if (params.supportedReasoningEfforts) return resolveSupportedReasoningEffort({
-		requested: params.thinkLevel,
-		supportedReasoningEfforts: params.supportedReasoningEfforts
-	}) ?? null;
-	const modelId = params.modelId.trim().toLowerCase();
-	if (LEGACY_PRO_MODEL_ID_RE.test(modelId)) return resolveSupportedReasoningEffort({
-		requested: params.thinkLevel,
-		supportedReasoningEfforts: LEGACY_PRO_REASONING_EFFORTS
-	}) ?? null;
-	if (params.thinkLevel === "minimal" && MODERN_GPT_5_MODEL_ID_RE.test(modelId)) return "low";
-	if (params.thinkLevel === "minimal" || params.thinkLevel === "low" || params.thinkLevel === "medium" || params.thinkLevel === "high" || params.thinkLevel === "xhigh") return params.thinkLevel;
-	return null;
+/** Computes the delayed unregister window from Codex's hook timeout. */
+function resolveCodexNativeHookRelayUnregisterGraceMs(hookTimeoutSec) {
+	const hookTimeoutMs = finiteSecondsToTimerSafeMilliseconds(normalizeHookTimeoutSec(hookTimeoutSec)) ?? 0;
+	return Math.max(CODEX_NATIVE_HOOK_RELAY_UNREGISTER_GRACE_MS, addTimerTimeoutGraceMs(hookTimeoutMs, CODEX_NATIVE_HOOK_RELAY_UNREGISTER_EXTRA_GRACE_MS) ?? 0);
 }
-//#endregion
-//#region extensions/codex/src/app-server/thread-model-selection.ts
-const CODEX_NATIVE_PERSONALITY_NONE = "none";
-function resolveCodexBindingModelProviderFallback(params) {
-	const provider = params.provider?.trim().toLowerCase();
-	if (provider && provider !== "codex") return;
-	const currentModel = params.currentModel?.trim();
-	const bindingModel = params.bindingModel?.trim();
-	if (currentModel && bindingModel && currentModel === bindingModel && params.bindingModelProvider) return params.bindingModelProvider;
-	return hasProviderQualifiedModelRef(currentModel) ? void 0 : params.bindingModelProvider;
+/** Records a native pre-tool failure that Codex does not project as a tool item. */
+function emitCodexNativePreToolUseFailureDiagnostic(params) {
+	emitTrustedDiagnosticEvent({
+		type: "tool.execution.error",
+		...params.agentId ? { agentId: params.agentId } : {},
+		sessionId: params.sessionId,
+		...params.sessionKey ? { sessionKey: params.sessionKey } : {},
+		runId: params.runId,
+		toolName: params.failure.toolName,
+		toolCallId: params.failure.toolCallId,
+		durationMs: params.failure.durationMs,
+		errorCategory: "before_tool_call",
+		terminalReason: params.terminalReason ?? (params.signal?.aborted ? resolveCodexToolAbortTerminalReason(params.signal) : params.failure.disposition),
+		...params.sourceTimestampMs !== void 0 ? { sourceTimestampMs: params.sourceTimestampMs } : {}
+	});
 }
-function resolveCodexAppServerThreadModelSelection(params) {
-	const authProfileId = params.authProfileId ?? params.binding?.authProfileId;
-	const explicitModelProvider = resolveCodexAppServerModelProvider({
-		provider: params.provider,
-		authProfileId,
-		authProfileStore: params.authProfileStore,
-		agentDir: params.agentDir,
-		config: params.config
-	});
-	const bindingModelProvider = params.binding?.threadId ? resolveCodexBindingModelProviderFallback({
-		provider: params.provider,
-		currentModel: params.model,
-		bindingModel: params.binding.model,
-		bindingModelProvider: params.binding.modelProvider
-	}) : void 0;
-	return resolveCodexAppServerRequestModelSelection({
-		model: params.model,
-		modelProvider: explicitModelProvider ?? bindingModelProvider,
-		authProfileId,
-		authProfileStore: params.authProfileStore,
-		agentDir: params.agentDir,
-		config: params.config
-	});
-}
-function resolveCodexAppServerRequestModelSelection(params) {
-	const model = params.model.trim();
-	const modelProvider = params.modelProvider?.trim();
-	if (modelProvider) return {
-		model,
-		modelProvider
+/** Registers an OpenClaw native hook relay for a Codex app-server turn. */
+function createCodexNativeHookRelay(params) {
+	if (params.options?.enabled === false) return;
+	const directChildClaims = /* @__PURE__ */ new Map();
+	const pendingDirectChildAdmissions = /* @__PURE__ */ new Map();
+	let foregroundClosed = false;
+	let successfulYieldRetentionAuthorized = false;
+	const assertClaim = (threadId, claim) => () => directChildClaims.get(threadId) === claim;
+	const rejectPendingAdmissions = (reason) => {
+		for (const pending of pendingDirectChildAdmissions.values()) pending.reject(new Error(reason));
+		pendingDirectChildAdmissions.clear();
 	};
-	const slashIndex = model.indexOf("/");
-	if (slashIndex <= 0 || slashIndex >= model.length - 1) return { model };
-	const inferredModelProvider = resolveCodexAppServerModelProvider({
-		provider: model.slice(0, slashIndex),
-		authProfileId: params.authProfileId,
-		authProfileStore: params.authProfileStore,
-		agentDir: params.agentDir,
-		config: params.config
+	const relay = registerRetainedNativeHookRelayForBundledRuntime({
+		provider: "codex",
+		relayId: buildCodexNativeHookRelayId({
+			agentId: params.agentId,
+			sessionId: params.sessionId,
+			sessionKey: params.sessionKey
+		}),
+		...params.generation ? { generation: params.generation } : {},
+		...params.generationMismatchGraceMs ? { generationMismatchGraceMs: params.generationMismatchGraceMs } : {},
+		...params.agentId ? { agentId: params.agentId } : {},
+		sessionId: params.sessionId,
+		...params.sessionKey ? { sessionKey: params.sessionKey } : {},
+		...params.config ? { config: params.config } : {},
+		autoApproveMcpTools: params.autoApproveMcpTools,
+		projectedMcpServers: params.projectedMcpServers,
+		runId: params.runId,
+		...params.channelId ? { channelId: params.channelId } : {},
+		...params.requester ? { requester: params.requester } : {},
+		...params.approvalContext ? { approvalContext: params.approvalContext } : {},
+		allowedEvents: params.events,
+		preToolUseLoopDetection: params.loopDetectionPreToolUseRelay,
+		ttlMs: resolveCodexNativeHookRelayTtlMs({
+			explicitTtlMs: params.options?.ttlMs,
+			attemptTimeoutMs: params.attemptTimeoutMs,
+			startupTimeoutMs: params.startupTimeoutMs,
+			turnStartTimeoutMs: params.turnStartTimeoutMs
+		}),
+		signal: params.signal,
+		runBeforeToolCall: params.hostCapabilities.runBeforeToolCall,
+		assertActive: params.hostCapabilities.assertActive,
+		retention: {
+			readClaim: readCodexNativeChildThreadId,
+			shouldRetainAfterForegroundClose: () => successfulYieldRetentionAuthorized && directChildClaims.size > 0,
+			allowPreToolUse: (childThreadId) => directChildClaims.has(childThreadId),
+			awaitForegroundAdmission: (childThreadId) => {
+				if (foregroundClosed) return Promise.reject(/* @__PURE__ */ new Error("native hook relay foreground admission unavailable"));
+				const existingClaim = directChildClaims.get(childThreadId);
+				if (existingClaim) return Promise.resolve(assertClaim(childThreadId, existingClaim));
+				const existingPending = pendingDirectChildAdmissions.get(childThreadId);
+				if (existingPending) return existingPending.promise.then((claim) => assertClaim(childThreadId, claim));
+				if (pendingDirectChildAdmissions.size >= MAX_PENDING_DIRECT_CHILD_ADMISSIONS) return Promise.reject(/* @__PURE__ */ new Error("native hook relay foreground admission capacity reached"));
+				const { promise, resolve, reject } = createDeferred();
+				pendingDirectChildAdmissions.set(childThreadId, {
+					promise,
+					resolve,
+					reject
+				});
+				return promise.then((claim) => assertClaim(childThreadId, claim));
+			},
+			onDispose: () => {
+				foregroundClosed = true;
+				rejectPendingAdmissions("native hook relay registration closed");
+			}
+		},
+		onPreToolUseFailure: params.onPreToolUseFailure,
+		command: {
+			nice: 10,
+			timeoutMs: params.options?.gatewayTimeoutMs
+		}
 	});
+	const unregister = () => {
+		foregroundClosed = true;
+		rejectPendingAdmissions("native hook relay foreground closed");
+		relay.unregister();
+	};
 	return {
-		model: model.slice(slashIndex + 1).trim(),
-		...inferredModelProvider ? { modelProvider: inferredModelProvider } : {}
+		...relay,
+		unregister,
+		authorizeRetentionAfterSuccessfulYield: () => {
+			successfulYieldRetentionAuthorized = true;
+		},
+		hasClaimedDirectChild: () => directChildClaims.size > 0,
+		rejectPendingDirectChild: (threadIdInput, reason) => {
+			const threadId = threadIdInput.trim();
+			const pending = threadId ? pendingDirectChildAdmissions.get(threadId) : void 0;
+			if (!pending) return;
+			pendingDirectChildAdmissions.delete(threadId);
+			pending.reject(new Error(reason));
+		},
+		claimDirectChild: (threadIdInput) => {
+			const threadId = threadIdInput.trim();
+			if (!threadId) return () => void 0;
+			if (directChildClaims.get(threadId)) return () => void 0;
+			const claim = Symbol(threadId);
+			directChildClaims.set(threadId, claim);
+			const pending = pendingDirectChildAdmissions.get(threadId);
+			pendingDirectChildAdmissions.delete(threadId);
+			pending?.resolve(claim);
+			let released = false;
+			return () => {
+				if (released) return;
+				released = true;
+				if (directChildClaims.get(threadId) !== claim) return;
+				directChildClaims.delete(threadId);
+				if (foregroundClosed && directChildClaims.size === 0) relay.unregister();
+			};
+		}
 	};
 }
-function hasProviderQualifiedModelRef(model) {
-	const trimmed = model?.trim();
-	const slashIndex = trimmed?.indexOf("/") ?? -1;
-	return slashIndex > 0 && slashIndex < (trimmed?.length ?? 0) - 1;
+function readCodexNativeChildThreadId(rawPayload) {
+	if (!isJsonObject(rawPayload) || typeof rawPayload.agent_id !== "string") return;
+	return rawPayload.agent_id.trim() || void 0;
 }
-function resolveCodexAppServerModelProvider(params) {
-	const normalized = params.provider.trim();
-	const normalizedLower = normalized.toLowerCase();
-	if (!normalized || normalizedLower === "codex") return;
-	if (isCodexAppServerNativeAuthProfile(params) && normalizedLower === "openai") return;
-	return normalizedLower === "openai" ? "openai" : normalized;
+/** Selects the native hook events Codex should install for the current approval mode. */
+function resolveCodexNativeHookRelayEvents(params) {
+	if (params.configuredEvents?.length) return params.configuredEvents;
+	return params.appServer.approvalPolicy === "never" ? CODEX_NATIVE_HOOK_RELAY_EVENTS : CODEX_NATIVE_HOOK_RELAY_EVENTS_WITH_APP_SERVER_APPROVALS;
 }
-function resolveReasoningEffort(thinkLevel, modelId, supportedReasoningEfforts) {
-	return resolveCodexAppServerReasoningEffort({
-		thinkLevel,
-		modelId,
-		supportedReasoningEfforts
-	});
+/** Derives the native hook relay TTL from the turn budget unless explicitly configured. */
+function resolveCodexNativeHookRelayTtlMs(params) {
+	if (params.explicitTtlMs !== void 0) return params.explicitTtlMs;
+	const relayBudgetMs = params.attemptTimeoutMs + params.startupTimeoutMs + params.turnStartTimeoutMs + CODEX_NATIVE_HOOK_RELAY_TTL_GRACE_MS;
+	return Math.max(CODEX_NATIVE_HOOK_RELAY_MIN_TTL_MS, Math.floor(relayBudgetMs));
 }
-//#endregion
-//#region extensions/codex/src/app-server/project-doc-thread-config.ts
-const CODEX_NATIVE_PROJECT_DOC_MAX_BYTES = 131072;
-function buildCodexProjectDocThreadConfig(config) {
-	const defaults = { project_doc_max_bytes: CODEX_NATIVE_PROJECT_DOC_MAX_BYTES };
-	return mergeCodexThreadConfigs(defaults, config) ?? defaults;
+/** Builds a stable relay id scoped to the agent and session identity. */
+function buildCodexNativeHookRelayId(params) {
+	const hash = createHash("sha256");
+	hash.update("openclaw:codex:native-hook-relay:v1");
+	hash.update("\0");
+	hash.update(params.agentId?.trim() || "");
+	hash.update("\0");
+	hash.update(params.sessionKey?.trim() || params.sessionId);
+	return `codex-${hash.digest("hex").slice(0, 40)}`;
 }
-//#endregion
-//#region extensions/codex/src/app-server/thread-prompt.ts
-function buildDeveloperInstructions(params, options = {}) {
-	const deferredToolNames = /* @__PURE__ */ new Set();
-	let secretsToolName;
-	let hasSkillWorkshop = false;
-	let hasSessionsSpawn = false;
-	let hasSessionsYield = false;
-	let hasSubagentsList = false;
-	let hasSessionsSend = false;
-	let hasSeenDirectNamespace = false;
-	let messageToolAvailable = options.dynamicTools ? false : params.disableMessageTool !== true;
-	for (const spec of options.dynamicTools ?? []) {
-		const isDirectNamespace = spec.type === "namespace" && !hasSeenDirectNamespace && spec.name.trim() === "openclaw_direct";
-		if (isDirectNamespace) hasSeenDirectNamespace = true;
-		for (const tool of spec.type === "namespace" ? spec.tools : [spec]) {
-			const name = tool.name.trim();
-			if (tool.deferLoading === true && name) deferredToolNames.add(name);
-			if (name === "secrets" && params.disableTools !== true) secretsToolName ??= spec.type === "namespace" ? `${spec.name}.${name}` : name;
-			hasSkillWorkshop ||= name === SKILL_WORKSHOP_TOOL_NAME;
-			hasSessionsSpawn ||= name === "sessions_spawn";
-			hasSessionsYield ||= isDirectNamespace && name === "sessions_yield";
-			hasSubagentsList ||= name === "subagents";
-			hasSessionsSend ||= name === "sessions_send";
-			messageToolAvailable ||= name === "message";
+const CODEX_HOOK_EVENT_BY_NATIVE_EVENT = {
+	pre_tool_use: "PreToolUse",
+	post_tool_use: "PostToolUse",
+	permission_request: "PermissionRequest",
+	before_agent_finalize: "Stop"
+};
+const CODEX_HOOK_KEY_LABEL_BY_NATIVE_EVENT = {
+	pre_tool_use: "pre_tool_use",
+	post_tool_use: "post_tool_use",
+	permission_request: "permission_request",
+	before_agent_finalize: "stop"
+};
+const CODEX_SESSION_FLAGS_HOOK_SOURCE_PATHS = ["/<session-flags>/config.toml", "<session-flags>/config.toml"];
+/** Builds the Codex config overlay that installs trusted command hooks for relay events. */
+function buildCodexNativeHookRelayConfig(params) {
+	const events = params.events?.length ? params.events : CODEX_NATIVE_HOOK_RELAY_EVENTS;
+	const selectedEvents = new Set(events);
+	const config = { "features.hooks": true };
+	const hookState = {};
+	for (const event of CODEX_NATIVE_HOOK_RELAY_EVENTS) {
+		const codexEvent = CODEX_HOOK_EVENT_BY_NATIVE_EVENT[event];
+		const selected = selectedEvents.has(event);
+		const shouldRelay = params.relay.shouldRelayEvent(event);
+		if (!selected || !shouldRelay) {
+			if (selected || params.clearOmittedEvents) config[`hooks.${codexEvent}`] = [];
+			if (params.clearOmittedEvents) for (const sourcePath of CODEX_SESSION_FLAGS_HOOK_SOURCE_PATHS) hookState[`${sourcePath}:${CODEX_HOOK_KEY_LABEL_BY_NATIVE_EVENT[event]}:0:0`] = { enabled: false };
+			continue;
 		}
+		const timeout = normalizeHookTimeoutSec(params.hookTimeoutSec);
+		const command = params.relay.commandForEvent(event, { timeoutMs: resolveCodexNativeHookRelayCommandTimeoutMs(timeout) });
+		const matcher = buildCodexNativeToolMatcher(params.relay.toolMatcherForEvent(event));
+		config[`hooks.${codexEvent}`] = [{
+			...matcher ? { matcher } : {},
+			hooks: [{
+				type: "command",
+				command,
+				timeout,
+				async: false,
+				statusMessage: "OpenClaw native hook relay"
+			}]
+		}];
+		const state = {
+			enabled: true,
+			trusted_hash: codexCommandHookTrustedHash({
+				event,
+				command,
+				matcher,
+				timeout,
+				statusMessage: "OpenClaw native hook relay"
+			})
+		};
+		for (const sourcePath of CODEX_SESSION_FLAGS_HOOK_SOURCE_PATHS) hookState[`${sourcePath}:${CODEX_HOOK_KEY_LABEL_BY_NATIVE_EVENT[event]}:0:0`] = state;
 	}
-	const nativeCommandGuidance = listRegisteredPluginAgentPromptGuidance({
-		surface: "codex_app_server",
-		includeLegacyGlobalGuidance: false
+	config["hooks.state"] = hookState;
+	return config;
+}
+/** Builds a Codex config overlay that disables native hooks and clears hook arrays. */
+function buildCodexNativeHookRelayDisabledConfig() {
+	return {
+		"features.hooks": false,
+		"hooks.PreToolUse": [],
+		"hooks.PostToolUse": [],
+		"hooks.PermissionRequest": [],
+		"hooks.Stop": []
+	};
+}
+function normalizeHookTimeoutSec(value) {
+	return typeof value === "number" && Number.isFinite(value) && value > 0 ? Math.ceil(value) : CODEX_NATIVE_HOOK_RELAY_DEFAULT_TIMEOUT_SEC;
+}
+function resolveCodexNativeHookRelayCommandTimeoutMs(hookTimeoutSec) {
+	const parentTimeoutMs = finiteSecondsToTimerSafeMilliseconds(normalizeHookTimeoutSec(hookTimeoutSec)) ?? 5e3;
+	const parentMarginMs = Math.min(CODEX_NATIVE_HOOK_RELAY_COMMAND_MAX_PARENT_MARGIN_MS, Math.max(CODEX_NATIVE_HOOK_RELAY_COMMAND_MIN_PARENT_MARGIN_MS, Math.floor(parentTimeoutMs / 5)));
+	return Math.max(1, parentTimeoutMs - parentMarginMs);
+}
+function buildCodexNativeToolMatcher(toolNames) {
+	if (toolNames === void 0) return;
+	if (toolNames.length === 0) throw new TypeError("Codex native hook matcher requires at least one tool name");
+	const nativeNames = /* @__PURE__ */ new Set();
+	let hasCustomToolName = false;
+	for (const toolName of toolNames) {
+		const canonicalToolName = toolName.trim();
+		if (!canonicalToolName || canonicalToolName === "*") throw new TypeError("Codex native hook matcher requires canonical OpenClaw tool ids");
+		const nativeAliases = CODEX_HOOK_MATCHER_NAMES_BY_TOOL_ID[canonicalToolName];
+		if (!nativeAliases) hasCustomToolName = true;
+		for (const nativeName of nativeAliases ?? [canonicalToolName]) nativeNames.add(nativeName);
+	}
+	const sortedNames = Array.from(nativeNames).toSorted();
+	if (!hasCustomToolName && sortedNames.every((toolName) => /^[A-Za-z0-9_]+$/.test(toolName))) return sortedNames.join("|");
+	return `(?i)^(?:${sortedNames.map((toolName) => toolName.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|")})$`;
+}
+function codexCommandHookTrustedHash(params) {
+	const identity = {
+		event_name: CODEX_HOOK_KEY_LABEL_BY_NATIVE_EVENT[params.event],
+		...params.matcher ? { matcher: params.matcher } : {},
+		hooks: [{
+			async: false,
+			command: params.command,
+			statusMessage: params.statusMessage,
+			timeout: params.timeout,
+			type: "command"
+		}]
+	};
+	return `sha256:${createHash("sha256").update(JSON.stringify(sortJsonValue(identity))).digest("hex")}`;
+}
+function sortJsonValue(value) {
+	if (!value || typeof value !== "object") return value;
+	if (Array.isArray(value)) return value.map(sortJsonValue);
+	const sorted = {};
+	for (const [key, entry] of Object.entries(value).toSorted(([left], [right]) => left.localeCompare(right))) sorted[key] = sortJsonValue(entry);
+	return sorted;
+}
+//#endregion
+//#region extensions/codex/src/app-server/profiler-flag.ts
+const PROFILER_FLAGS = ["profiler", "codex.profiler"];
+/** Checks the generic and Codex-specific profiler diagnostic flags. */
+function isCodexAppServerProfilerEnabled(config, env = process.env) {
+	return PROFILER_FLAGS.some((flag) => isDiagnosticFlagEnabled(flag, config, env));
+}
+//#endregion
+//#region extensions/codex/src/app-server/mcp-tool-metadata.ts
+/** Hosted app ownership is authoritative only on metadata supplied by Codex. */
+function readCodexMcpToolConnectorId(tool) {
+	const metadata = asOptionalRecord(asOptionalRecord(tool)?.["_meta"]);
+	return normalizeOptionalString(metadata?.connector_id) ?? normalizeOptionalString(metadata?.connectorId);
+}
+/** Preserve MCP App visibility so model-only tools cannot become widget authority. */
+function readCodexMcpToolUiVisibility(tool) {
+	const metadata = asOptionalRecord(asOptionalRecord(tool)?.["_meta"]);
+	const visibility = asOptionalRecord(metadata?.ui)?.visibility;
+	if (!Array.isArray(visibility)) return;
+	return [...new Set(visibility.filter((value) => value === "app" || value === "model"))].toSorted();
+}
+//#endregion
+//#region extensions/codex/src/app-server/project-doc-thread-config.ts
+const CODEX_NATIVE_PROJECT_DOC_MAX_BYTES = 131072;
+function buildCodexProjectDocThreadConfig(config) {
+	const defaults = { project_doc_max_bytes: CODEX_NATIVE_PROJECT_DOC_MAX_BYTES };
+	return mergeCodexThreadConfigs(defaults, config) ?? defaults;
+}
+//#endregion
+//#region extensions/codex/src/app-server/thread-model-selection.ts
+const CODEX_NATIVE_PERSONALITY_NONE = "none";
+function resolveCodexBindingModelProviderFallback(params) {
+	const provider = params.provider?.trim().toLowerCase();
+	if (provider && provider !== "codex") return;
+	const currentModel = params.currentModel?.trim();
+	const bindingModel = params.bindingModel?.trim();
+	if (currentModel && bindingModel && currentModel === bindingModel && params.bindingModelProvider) return params.bindingModelProvider;
+	return hasProviderQualifiedModelRef(currentModel) ? void 0 : params.bindingModelProvider;
+}
+function resolveCodexAppServerThreadModelSelection(params) {
+	const authProfileId = params.authProfileId ?? params.binding?.authProfileId;
+	const explicitModelProvider = resolveCodexAppServerModelProvider({
+		provider: params.provider,
+		authProfileId,
+		authProfileStore: params.authProfileStore,
+		agentDir: params.agentDir,
+		config: params.config
+	});
+	const bindingModelProvider = params.binding?.threadId ? resolveCodexBindingModelProviderFallback({
+		provider: params.provider,
+		currentModel: params.model,
+		bindingModel: params.binding.model,
+		bindingModelProvider: params.binding.modelProvider
+	}) : void 0;
+	return resolveCodexAppServerRequestModelSelection({
+		model: params.model,
+		modelProvider: explicitModelProvider ?? bindingModelProvider,
+		authProfileId,
+		authProfileStore: params.authProfileStore,
+		agentDir: params.agentDir,
+		config: params.config
+	});
+}
+function resolveCodexAppServerRequestModelSelection(params) {
+	const model = params.model.trim();
+	const modelProvider = params.modelProvider?.trim();
+	if (modelProvider) return {
+		model,
+		modelProvider
+	};
+	const slashIndex = model.indexOf("/");
+	if (slashIndex <= 0 || slashIndex >= model.length - 1) return { model };
+	const inferredModelProvider = resolveCodexAppServerModelProvider({
+		provider: model.slice(0, slashIndex),
+		authProfileId: params.authProfileId,
+		authProfileStore: params.authProfileStore,
+		agentDir: params.agentDir,
+		config: params.config
+	});
+	return {
+		model: model.slice(slashIndex + 1).trim(),
+		...inferredModelProvider ? { modelProvider: inferredModelProvider } : {}
+	};
+}
+function hasProviderQualifiedModelRef(model) {
+	const trimmed = model?.trim();
+	const slashIndex = trimmed?.indexOf("/") ?? -1;
+	return slashIndex > 0 && slashIndex < (trimmed?.length ?? 0) - 1;
+}
+function resolveCodexAppServerModelProvider(params) {
+	const normalized = params.provider.trim();
+	const normalizedLower = normalized.toLowerCase();
+	if (!normalized || normalizedLower === "codex") return;
+	if (isCodexAppServerNativeAuthProfile(params) && normalizedLower === "openai") return;
+	return normalizedLower === "openai" ? "openai" : normalized;
+}
+//#endregion
+//#region extensions/codex/src/app-server/thread-prompt.ts
+function buildDeveloperInstructions(params, options = {}) {
+	const deferredToolNames = /* @__PURE__ */ new Set();
+	let secretsToolName;
+	let showWidgetToolName;
+	let dashboardToolName;
+	let portalToolName;
+	let hasSkillWorkshop = false;
+	let hasSessionsSpawn = false;
+	let hasSessionsYield = false;
+	let hasSubagentsList = false;
+	let hasSessionsSend = false;
+	let hasSeenDirectNamespace = false;
+	let messageToolAvailable = options.dynamicTools ? false : params.disableMessageTool !== true;
+	for (const spec of options.dynamicTools ?? []) {
+		const isDirectNamespace = spec.type === "namespace" && !hasSeenDirectNamespace && spec.name.trim() === "openclaw_direct";
+		if (isDirectNamespace) hasSeenDirectNamespace = true;
+		for (const tool of spec.type === "namespace" ? spec.tools : [spec]) {
+			const name = tool.name.trim();
+			const qualifiedName = spec.type === "namespace" ? `${spec.name}.${name}` : name;
+			if (tool.deferLoading === true && name) deferredToolNames.add(name);
+			if (name === "secrets" && params.disableTools !== true) secretsToolName ??= qualifiedName;
+			if (name === "show_widget") showWidgetToolName ??= qualifiedName;
+			if (name === "dashboard") dashboardToolName ??= qualifiedName;
+			if (name === "portal") portalToolName ??= qualifiedName;
+			hasSkillWorkshop ||= name === SKILL_WORKSHOP_TOOL_NAME;
+			hasSessionsSpawn ||= name === "sessions_spawn";
+			hasSessionsYield ||= isDirectNamespace && name === "sessions_yield";
+			hasSubagentsList ||= name === "subagents";
+			hasSessionsSend ||= name === "sessions_send";
+			messageToolAvailable ||= name === "message";
+		}
+	}
+	const nativeCommandGuidance = listRegisteredPluginAgentPromptGuidance({
+		surface: "codex_app_server",
+		includeLegacyGlobalGuidance: false
 	}).join("\n");
 	const delegationGuidanceAvailable = params.disableTools !== true && params.delegationCapability !== "report_only" && !isMessageOnlyCodexSourceReply(params);
 	const nativeDelegationAvailable = delegationGuidanceAvailable && !isSystemAgentOnlyCodexDynamicToolAllowlist(params.toolsAllow) && !shouldDisableCodexToolSearchForModel(params.modelId);
@@ -2176,7 +2572,12 @@ function buildDeveloperInstructions(params, options = {}) {
 		}).join("\n") : void 0,
 		buildHarnessVisibleReplyGuidance({
 			sourceReplyDeliveryMode: params.sourceReplyDeliveryMode,
-			messageToolAvailable
+			messageToolAvailable,
+			uiPresentation: params.disableTools !== true && params.promptMode !== "minimal" && params.promptMode !== "none" ? {
+				showWidgetToolName,
+				dashboardToolName,
+				portalToolName
+			} : void 0
 		}),
 		buildCredentialSafetyPrompt(secretsToolName),
 		nativeCommandGuidance,
@@ -2372,8 +2773,31 @@ const CODEX_RING_ZERO_OVERRIDABLE_LAYER_TYPES = /* @__PURE__ */ new Set([
 	"project",
 	"sessionFlags"
 ]);
+/** Common deterministic start/resume/fork fields; no run resources or unsupported setters. */
+function buildCodexThreadConfiguration(params, options) {
+	return {
+		...options.cwd !== void 0 ? { cwd: options.cwd } : {},
+		...options.appServer.sessionRoot ? { runtimeWorkspaceRoots: [options.appServer.sessionRoot] } : {},
+		approvalPolicy: options.appServer.approvalPolicy,
+		approvalsReviewer: resolveCodexThreadApprovalsReviewer(options.appServer, options.config),
+		...codexThreadSandboxOrPermissions(options.appServer),
+		...options.appServer.serviceTier !== void 0 ? { serviceTier: options.appServer.serviceTier } : {},
+		config: buildCodexRuntimeThreadConfigForRun(params, options.config, {
+			nativeCodeModeEnabled: options.nativeCodeModeEnabled,
+			nativeProviderWebSearchSupport: options.nativeProviderWebSearchSupport,
+			nativeCodeModeOnlyEnabled: options.nativeCodeModeOnlyEnabled,
+			directOnlyToolNamespaces: resolveDirectOnlyToolNamespaces(options.dynamicTools),
+			webSearchAllowed: options.webSearchAllowed,
+			appServer: options.appServer,
+			hostSystemAgentActive: options.hostSystemAgentActive,
+			restrictedToolSurfaceInheritedMcpServerNames: options.restrictedToolSurfaceInheritedMcpServerNames,
+			shellEnvironment: options.shellEnvironment,
+			disableLoginShell: options.disableLoginShell
+		}),
+		developerInstructions: options.developerInstructions ?? buildDeveloperInstructions(params, { dynamicTools: options.dynamicTools })
+	};
+}
 function buildThreadStartParams(params, options) {
-	const ringZeroActive = (options.hostSystemAgentActive ?? isHostScopedAgentToolActive("openclaw")) && isSystemAgentOnlyCodexDynamicToolAllowlist(params.toolsAllow);
 	const resolvedModelProvider = resolveCodexAppServerModelProvider({
 		provider: params.provider,
 		authProfileId: params.authProfileId,
@@ -2392,29 +2816,11 @@ function buildThreadStartParams(params, options) {
 	return {
 		model: modelSelection.model,
 		...modelSelection.modelProvider ? { modelProvider: modelSelection.modelProvider } : {},
-		cwd: options.cwd,
-		...options.appServer.sessionRoot ? { runtimeWorkspaceRoots: [options.appServer.sessionRoot] } : {},
-		approvalPolicy: options.appServer.approvalPolicy,
-		approvalsReviewer: resolveCodexThreadApprovalsReviewer(options.appServer, options.config),
-		...codexThreadSandboxOrPermissions(options.appServer),
-		...options.appServer.serviceTier !== void 0 ? { serviceTier: options.appServer.serviceTier } : {},
+		...buildCodexThreadConfiguration(params, options),
+		...(options.hostSystemAgentActive ?? isHostScopedAgentToolActive("openclaw")) && isSystemAgentOnlyCodexDynamicToolAllowlist(params.toolsAllow) ? { baseInstructions: "" } : {},
 		personality: CODEX_NATIVE_PERSONALITY_NONE,
 		serviceName: "OpenClaw",
-		...ringZeroActive ? { baseInstructions: "" } : {},
-		config: buildCodexRuntimeThreadConfigForRun(params, options.config, {
-			nativeCodeModeEnabled: options.nativeCodeModeEnabled,
-			nativeProviderWebSearchSupport: options.nativeProviderWebSearchSupport,
-			nativeCodeModeOnlyEnabled: options.nativeCodeModeOnlyEnabled,
-			directOnlyToolNamespaces: resolveDirectOnlyToolNamespaces(options.dynamicTools),
-			webSearchAllowed: options.webSearchAllowed,
-			appServer: options.appServer,
-			hostSystemAgentActive: options.hostSystemAgentActive,
-			restrictedToolSurfaceInheritedMcpServerNames: options.restrictedToolSurfaceInheritedMcpServerNames,
-			shellEnvironment: options.shellEnvironment,
-			disableLoginShell: options.disableLoginShell
-		}),
 		...resolveCodexThreadEnvironmentSelection(options),
-		developerInstructions: options.developerInstructions ?? buildDeveloperInstructions(params, { dynamicTools: options.dynamicTools }),
 		dynamicTools: [...options.dynamicTools],
 		experimentalRawEvents: true,
 		...isIncognitoSessionKey(params.sessionKey) ? { ephemeral: true } : {}
@@ -2437,8 +2843,6 @@ function buildThreadResumeParams(params, options) {
 	});
 	return {
 		threadId: options.threadId,
-		...options.cwd ? { cwd: options.cwd } : {},
-		...options.appServer.sessionRoot ? { runtimeWorkspaceRoots: [options.appServer.sessionRoot] } : {},
 		excludeTurns: true,
 		initialTurnsPage: {
 			limit: 1,
@@ -2449,24 +2853,8 @@ function buildThreadResumeParams(params, options) {
 			model: modelSelection.model,
 			...modelSelection.modelProvider ? { modelProvider: modelSelection.modelProvider } : {}
 		} : {},
-		approvalPolicy: options.appServer.approvalPolicy,
-		approvalsReviewer: resolveCodexThreadApprovalsReviewer(options.appServer, options.config),
-		...codexThreadSandboxOrPermissions(options.appServer),
-		...options.appServer.serviceTier !== void 0 ? { serviceTier: options.appServer.serviceTier } : {},
-		personality: CODEX_NATIVE_PERSONALITY_NONE,
-		config: buildCodexRuntimeThreadConfigForRun(params, options.config, {
-			nativeCodeModeEnabled: options.nativeCodeModeEnabled,
-			nativeProviderWebSearchSupport: options.nativeProviderWebSearchSupport,
-			nativeCodeModeOnlyEnabled: options.nativeCodeModeOnlyEnabled,
-			directOnlyToolNamespaces: resolveDirectOnlyToolNamespaces(options.dynamicTools),
-			webSearchAllowed: options.webSearchAllowed,
-			appServer: options.appServer,
-			hostSystemAgentActive: options.hostSystemAgentActive,
-			restrictedToolSurfaceInheritedMcpServerNames: options.restrictedToolSurfaceInheritedMcpServerNames,
-			shellEnvironment: options.shellEnvironment,
-			disableLoginShell: options.disableLoginShell
-		}),
-		developerInstructions: options.developerInstructions ?? buildDeveloperInstructions(params, { dynamicTools: options.dynamicTools })
+		...buildCodexThreadConfiguration(params, options),
+		personality: CODEX_NATIVE_PERSONALITY_NONE
 	};
 }
 function buildCodexRuntimeThreadConfig(config, options = {}) {
@@ -2516,7 +2904,7 @@ function buildCodexRuntimeThreadConfigForRun(params, config, options = {}) {
 	}).threadConfig;
 	const baseConfig = buildCodexRuntimeThreadConfig(mergeCodexThreadConfigs(config, webSearchConfig), options);
 	return applyCodexManagedShellEnvironment({
-		...mergeCodexThreadConfigs(baseConfig, options.appServer?.networkProxy?.configPatch, params.pluginHarnessToolPolicySafeDeniedTools?.includes("image_generate") ? { "features.image_generation": false } : void 0, shouldDisableCodexToolSearchForModel(params.modelId) ? CODEX_TOOL_SEARCH_UNSUPPORTED_THREAD_CONFIG : void 0, params.delegationCapability === "report_only" ? CODEX_DELEGATION_DISABLED_THREAD_CONFIG : void 0, messageOnlySourceReply || params.pluginHarnessToolPolicyRestricted === true ? buildRestrictedToolConfigPatch(restrictedToolSurfaceMcpServerNames) : buildCodexRingZeroThreadConfigPatch(params, options.hostSystemAgentActive, restrictedToolSurfaceMcpServerNames), restrictedTurnDisablesProjectDocs ? CODEX_NO_PROJECT_DOCS_CONFIG : void 0, params.authoredContextTokenCap === void 0 ? void 0 : { model_context_window: params.authoredContextTokenCap }) ?? baseConfig,
+		...mergeCodexThreadConfigs(baseConfig, options.appServer?.networkProxy?.configPatch, params.pluginHarnessToolPolicySafeDeniedTools?.includes("image_generate") ? { "features.image_generation": false } : void 0, shouldDisableCodexToolSearchForModel(params.modelId) ? CODEX_TOOL_SEARCH_UNSUPPORTED_THREAD_CONFIG : void 0, params.delegationCapability === "report_only" ? CODEX_DELEGATION_DISABLED_THREAD_CONFIG : void 0, messageOnlySourceReply || params.pluginHarnessToolPolicyRestricted === true ? buildRestrictedToolConfigPatch(restrictedToolSurfaceMcpServerNames, Boolean(params.scheduledRuntimeAuthority)) : buildCodexRingZeroThreadConfigPatch(params, options.hostSystemAgentActive, restrictedToolSurfaceMcpServerNames), restrictedTurnDisablesProjectDocs ? CODEX_NO_PROJECT_DOCS_CONFIG : void 0, params.authoredContextTokenCap === void 0 ? void 0 : { model_context_window: params.authoredContextTokenCap }) ?? baseConfig,
 		...params.bootstrapContextMode === "lightweight" ? CODEX_NO_PROJECT_DOCS_CONFIG : {}
 	}, options.shellEnvironment, options.disableLoginShell);
 }
@@ -2527,10 +2915,14 @@ function buildCodexRingZeroThreadConfigPatch(params, hostSystemAgentActive = isH
 		...CODEX_NO_PROJECT_DOCS_CONFIG
 	};
 }
-function buildRestrictedToolConfigPatch(inheritedMcpServerNames) {
+function buildRestrictedToolConfigPatch(inheritedMcpServerNames, scheduledAppAuthorityActive = false) {
 	const mcpServers = Object.fromEntries([...new Set(inheritedMcpServerNames)].toSorted().map((name) => [name, { enabled: false }]));
 	return {
 		...CODEX_RING_ZERO_THREAD_CONFIG,
+		...scheduledAppAuthorityActive ? {
+			"features.apps": true,
+			"orchestrator.mcp.enabled": true
+		} : {},
 		...Object.keys(mcpServers).length > 0 ? { mcp_servers: mcpServers } : {}
 	};
 }
@@ -2552,58 +2944,53 @@ async function readCodexInheritedMcpServerNames(client, cwd, signal) {
 	return Object.keys(configuredServers).toSorted();
 }
 async function assertCodexManagedRequirementsDoNotOverrideToolPolicy(client, options, signal) {
-	const response = await client.request("configRequirements/read", void 0, { signal });
-	if (!isJsonObject(response) || !Object.hasOwn(response, "requirements")) throw new Error("Codex configRequirements/read returned an invalid response");
-	if (response.requirements === null) return;
-	if (!isJsonObject(response.requirements)) throw new Error("Codex configRequirements/read returned invalid requirements");
+	const requirements = await readCodexManagedRequirements(client, signal);
+	const managedRequirementsFingerprint = buildCodexManagedRequirementsFingerprint(requirements);
+	const managedRequirementsMatch = options.allowedManagedRequirementsFingerprint !== void 0 && managedRequirementsFingerprint === options.allowedManagedRequirementsFingerprint;
+	const managedHooksAllowed = managedRequirementsMatch || options.allowConfiguredManagedHooks === true;
+	if (options.allowedManagedRequirementsFingerprint !== void 0 && !managedRequirementsMatch) throw new Error("Codex managed requirements changed since this automation was authorized; reauthorize the automation from a fresh owner turn");
+	if (requirements === null) return;
 	if (options.restrictedToolSurface) for (const key of [
 		"hooks",
 		"managedHooks",
 		"managed_hooks"
 	]) {
-		const hooks = response.requirements[key];
+		const hooks = requirements[key];
 		if (hooks === void 0 || hooks === null) continue;
 		if (!isJsonObject(hooks)) throw new Error("Codex configRequirements/read returned invalid managed hooks");
-		if (hasNonEmptyJsonValue(hooks)) throw new Error("Codex restricted tool surface cannot override managed hooks");
+		if (hasNonEmptyJsonValue(hooks) && !managedHooksAllowed) throw new Error("Codex restricted tool surface cannot override managed hooks");
 	}
 	const additionalDeniedFeatures = new Set(options.additionalDeniedFeatures);
 	for (const key of ["featureRequirements", "feature_requirements"]) {
-		const requirements = response.requirements[key];
-		if (requirements === void 0 || requirements === null) continue;
-		if (!isJsonObject(requirements)) throw new Error("Codex configRequirements/read returned invalid feature requirements");
-		for (const [feature, enabled] of Object.entries(requirements)) {
+		const featureRequirements = requirements[key];
+		if (featureRequirements === void 0 || featureRequirements === null) continue;
+		if (!isJsonObject(featureRequirements)) throw new Error("Codex configRequirements/read returned invalid feature requirements");
+		for (const [feature, enabled] of Object.entries(featureRequirements)) {
 			if (typeof enabled !== "boolean") throw new Error("Codex configRequirements/read returned invalid feature requirements");
 			const canonicalFeature = CODEX_RING_ZERO_RESTRICTED_FEATURE_ALIASES.get(feature) ?? feature;
 			const deniedByToolPolicy = options.restrictedToolSurface && CODEX_RING_ZERO_RESTRICTED_FEATURES.has(canonicalFeature) || additionalDeniedFeatures.has(canonicalFeature);
+			if (canonicalFeature === "hooks" && managedHooksAllowed) continue;
 			if (enabled && deniedByToolPolicy) throw new Error(`Codex tool policy cannot override required feature ${feature}`);
 		}
 	}
 }
-async function attestCodexRestrictedToolSurfaceMcpServersDisabled(client, threadId, threadConfig, signal) {
-	const configuredServers = threadConfig?.mcp_servers;
-	if (configuredServers !== void 0 && !isJsonObject(configuredServers)) throw new Error("Codex restricted-tool-surface thread config has invalid mcp_servers");
-	const expectedDisabledServerNames = /* @__PURE__ */ new Set();
-	for (const [name, serverConfig] of Object.entries(configuredServers ?? {})) {
-		if (!isJsonObject(serverConfig) || serverConfig.enabled !== false) throw new Error(`Codex restricted-tool-surface MCP server ${name} is not disabled`);
-		expectedDisabledServerNames.add(name);
-	}
-	const response = await client.request("mcpServerStatus/list", {
-		threadId,
-		detail: "toolsAndAuthOnly"
-	}, { signal });
-	if (!isJsonObject(response) || !Array.isArray(response.data)) throw new Error("Codex mcpServerStatus/list returned an invalid restricted-tool-surface attestation");
-	const observedDisabledServerNames = /* @__PURE__ */ new Set();
-	for (const status of response.data) {
-		if (!isJsonObject(status) || typeof status.name !== "string" || !isJsonObject(status.tools)) throw new Error("Codex mcpServerStatus/list returned an invalid restricted-tool-surface server");
-		if (!expectedDisabledServerNames.has(status.name)) throw new Error(`Codex restricted-tool-surface MCP attestation found unexpected server ${status.name}`);
-		if (observedDisabledServerNames.has(status.name)) throw new Error(`Codex restricted-tool-surface MCP attestation returned duplicate server ${status.name}`);
-		observedDisabledServerNames.add(status.name);
-		if (!Object.hasOwn(status, "serverInfo")) throw new Error(`Codex restricted-tool-surface MCP attestation returned malformed server ${status.name}`);
-		if (status.serverInfo !== null) throw new Error(`Codex restricted-tool-surface MCP attestation found active server ${status.name}`);
-		if (Object.keys(status.tools).length > 0) throw new Error(`Codex restricted-tool-surface MCP attestation found tools for server ${status.name}`);
-	}
-	for (const expectedName of expectedDisabledServerNames) if (!observedDisabledServerNames.has(expectedName)) throw new Error(`Codex restricted-tool-surface MCP attestation is missing server ${expectedName}`);
-	if (response.nextCursor !== void 0 && response.nextCursor !== null) throw new Error("Codex mcpServerStatus/list returned an invalid empty-page cursor");
+/** Hashes the exact managed requirements without retaining their hook commands or policy details. */
+function buildCodexManagedRequirementsFingerprint(requirements) {
+	const fingerprint = fingerprintJsonObject({
+		version: 1,
+		requirements
+	});
+	return crypto.createHash("sha256").update(fingerprint).digest("hex");
+}
+/** Reads and fingerprints the exact managed requirements active on this app-server. */
+async function readCodexManagedRequirementsFingerprint(client, signal) {
+	return buildCodexManagedRequirementsFingerprint(await readCodexManagedRequirements(client, signal));
+}
+async function readCodexManagedRequirements(client, signal) {
+	const response = await client.request("configRequirements/read", void 0, { signal });
+	if (!isJsonObject(response) || !Object.hasOwn(response, "requirements")) throw new Error("Codex configRequirements/read returned an invalid response");
+	if (response.requirements !== null && !isJsonObject(response.requirements)) throw new Error("Codex configRequirements/read returned invalid requirements");
+	return response.requirements;
 }
 function hasNonEmptyJsonValue(value) {
 	if (value === null || value === false || value === "") return false;
@@ -2624,1179 +3011,1298 @@ function resolveCodexThreadEnvironmentSelection(options) {
 	return {};
 }
 //#endregion
-//#region extensions/codex/src/app-server/thread-lifecycle-io.ts
-function resolveCodexThreadAgentDir(params) {
-	const agentId = resolveSessionAgentIdsStrict({
-		config: params.params.config,
-		sessionKey: params.params.sessionKey,
-		agentId: params.agentId ?? params.params.agentId
-	}).sessionAgentId;
-	return params.agentDir ?? params.params.agentDir ?? resolveAgentDir$1(params.params.config ?? {}, agentId);
+//#region extensions/codex/src/app-server/scheduled-app-authority.ts
+const CODEX_SCHEDULED_APP_AUTHORITY_NAMESPACE = "codex.apps";
+const CODEX_APPS_MCP_SERVER = "codex_apps";
+const MCP_STATUS_PAGE_SIZE = 100;
+const MCP_STATUS_MAX_PAGES = 100;
+const CODEX_APP_AUTHORITY_CAPTURE_TIMEOUT_MS = 6e4;
+const CODEX_APP_AUTHORITY_CAPTURE_MIN_TIMEOUT_MS = 100;
+/** Hashes stable configured endpoint identity without retaining credentials or endpoint details. */
+function buildScheduledCodexAppServerConnectionIdentity(appServer) {
+	const start = appServer.start;
+	return crypto.createHash("sha256").update("openclaw:codex:scheduled-app-server:v1\0").update(JSON.stringify({
+		transport: start.transport,
+		command: start.command,
+		commandSource: start.commandSource ?? null,
+		args: start.args,
+		cwd: start.cwd ?? null,
+		url: start.url ?? null,
+		homeScope: start.homeScope ?? null,
+		connectionClass: appServer.connectionClass,
+		remoteWorkspaceRoot: appServer.remoteWorkspaceRoot ?? null
+	})).digest("hex");
+}
+function resolveScheduledCodexAppCreatorCaptureDecision(params) {
+	if (!params.appsMayBeVisible) return {
+		required: false,
+		supported: false
+	};
+	const unavailableReason = params.authenticatedScheduledMode ? "A scheduled Codex continuation cannot create new app-authorized automations. Recreate it from a fresh authenticated owner turn; no automation changes were saved." : params.usesSupervisionConnection ? "Codex apps are visible through a supervised connection that cannot capture creator authority. Use an isolated prepared-profile Codex creator turn; no automation changes were saved." : params.homeScope === "user" ? "Codex apps are visible through a user-home runtime that cannot capture isolated creator authority. Use an agent-scoped prepared-profile Codex creator turn; no automation changes were saved." : !params.hasPreparedAccountIdentity && !params.hasConfiguredAppServerIdentity ? "Codex app authority requires either a prepared ChatGPT profile or an isolated configured app-server identity. Reauthenticate the selected Codex profile or configured app-server, then retry; no automation changes were saved." : void 0;
+	return {
+		required: true,
+		supported: !unavailableReason,
+		...unavailableReason ? { unavailableReason } : {}
+	};
 }
-function resolveCodexThreadRolloutPath(thread) {
-	const rolloutPath = thread.path?.trim();
-	if (!rolloutPath || !path.isAbsolute(rolloutPath) || path.extname(rolloutPath) !== ".jsonl" || !path.basename(rolloutPath).includes(thread.id)) return;
-	return rolloutPath;
+function normalizeApprovalMode(value) {
+	return value === "allow" || value === "deny" || value === "auto" || value === "ask" ? value : void 0;
+}
+function normalizeAppToolApprovalMode(value) {
+	return value === "auto" || value === "prompt" || value === "writes" || value === "approve" ? value : void 0;
+}
+function defaultApprovalMode(entry) {
+	return entry.destructiveApprovalMode ?? (entry.allowDestructiveActions ? "allow" : "deny");
+}
+function parseScheduledCodexAppAuthority(authority) {
+	if (!authority || authority.runtimeId !== "codex") return;
+	if (authority.version !== 1) throw new Error("Unsupported Codex scheduled authority version; reauthorize this automation.");
+	if (authority.namespace !== CODEX_SCHEDULED_APP_AUTHORITY_NAMESPACE) throw new Error(`Unsupported Codex scheduled authority namespace ${authority.namespace}; reauthorize this automation.`);
+	const payload = asOptionalRecord(authority.payload);
+	const auth = asOptionalRecord(payload?.auth);
+	const profileId = normalizeOptionalString(auth?.profileId);
+	const connectionFingerprint = normalizeOptionalString(auth?.connectionFingerprint);
+	const managedRequirementsFingerprint = normalizeOptionalString(auth?.managedRequirementsFingerprint);
+	const accountId = normalizeOptionalString(auth?.accountId);
+	const parsedAuth = auth?.kind === "configured-app-server" && connectionFingerprint && managedRequirementsFingerprint ? {
+		kind: "configured-app-server",
+		connectionFingerprint,
+		managedRequirementsFingerprint
+	} : auth?.kind === void 0 && profileId && accountId ? {
+		profileId,
+		accountId
+	} : void 0;
+	if (payload?.version !== 1 || !parsedAuth || !Array.isArray(payload.apps)) throw new Error("Stored Codex app authority is invalid; reauthorize this automation.");
+	const seen = /* @__PURE__ */ new Set();
+	return {
+		version: 1,
+		auth: parsedAuth,
+		apps: payload.apps.map((raw) => {
+			const app = asOptionalRecord(raw);
+			const id = normalizeOptionalString(app?.id);
+			const destructiveApprovalMode = normalizeApprovalMode(app?.destructiveApprovalMode);
+			const rawTools = asOptionalRecord(app?.tools);
+			if (!id || seen.has(id) || typeof app?.allowDestructiveActions !== "boolean" || typeof app.allowOpenWorld !== "boolean" || !destructiveApprovalMode || !rawTools) throw new Error("Stored Codex app authority is invalid; reauthorize this automation.");
+			seen.add(id);
+			const tools = {};
+			for (const [name, rawMode] of Object.entries(rawTools)) {
+				const toolName = normalizeOptionalString(name);
+				const mode = normalizeAppToolApprovalMode(rawMode);
+				if (!toolName || !mode) throw new Error("Stored Codex app authority is invalid; reauthorize this automation.");
+				tools[toolName] = mode;
+			}
+			return {
+				id,
+				allowDestructiveActions: app.allowDestructiveActions,
+				allowOpenWorld: app.allowOpenWorld,
+				destructiveApprovalMode,
+				tools
+			};
+		})
+	};
 }
-async function resumeExistingCodexThread(params, context) {
-	const { binding: resumeBinding, bindingIdentity, startModelSelection, startModelProvider, userMcpServersConfigPatch, dynamicToolsFingerprint, dynamicToolsContainDeferred, webSearchThreadConfigFingerprint, nativeSkillIsolationFingerprint, userMcpServersFingerprint, ringZeroConfigFingerprint, ringZeroClientInstanceId, networkProxyConfigFingerprint, contextEngineBinding, environmentSelectionFingerprint, hostSystemAgentActive, ringZeroActive, restrictedToolSurface, restrictedToolSurfaceInheritedMcpServerNames, nativeSkillIsolation, lifecycleTiming, normalizeBindingModelProvider, throwIfAborted, clearCurrentBinding } = context;
-	let resumeReservation;
-	let resumeResponseAccepted = false;
-	let checkingLoadedPluginThreadConfig = false;
-	const abandonClient = params.abandonClient ?? (() => closeCodexStartupClientBestEffort(params.client));
-	try {
-		const authProfileId = resumeBinding.connectionScope === "supervision" ? void 0 : params.params.authProfileId ?? resumeBinding.authProfileId;
-		const finalConfigPatch = context.prebuiltFinalConfigPatch ?? params.buildFinalConfigPatch?.({
-			action: "resume",
-			binding: resumeBinding
-		}) ?? {
-			configPatch: params.finalConfigPatch,
-			nativeHookRelayGeneration: params.nativeHookRelayGeneration
-		};
-		const pluginThreadConfig = context.prebuiltPluginThreadConfig ?? (params.pluginThreadConfig?.requiresCurrentPolicyCheck ? await lifecycleTiming.measure("plugin-config-build", () => params.pluginThreadConfig?.build()) : void 0);
-		const pluginAppsConfigPatch = pluginThreadConfig?.configPatch ?? (params.pluginThreadConfig?.enabled && resumeBinding.pluginAppPolicyContext ? buildCodexPluginAppsConfigPatchFromPolicyContext(resumeBinding.pluginAppPolicyContext) : void 0);
-		const resumeConfig = applyCodexNativeSkillIsolation(mergeCodexThreadConfigs(params.config, userMcpServersConfigPatch, pluginAppsConfigPatch, finalConfigPatch.configPatch), nativeSkillIsolation);
-		const resumeParams = lifecycleTiming.measureSync("thread-resume-params", () => buildThreadResumeParams(params.params, {
-			threadId: resumeBinding.threadId,
-			cwd: params.cwd,
-			authProfileId,
-			model: startModelSelection.model,
-			modelProvider: startModelProvider,
-			preserveNativeModel: resumeBinding.preserveNativeModel === true,
-			appServer: params.appServer,
-			dynamicTools: params.dynamicTools,
-			developerInstructions: params.developerInstructions,
-			config: resumeConfig,
-			nativeCodeModeEnabled: params.nativeCodeModeEnabled,
-			nativeProviderWebSearchSupport: params.nativeProviderWebSearchSupport,
-			nativeCodeModeOnlyEnabled: params.nativeCodeModeOnlyEnabled,
-			webSearchAllowed: params.webSearchAllowed,
-			hostSystemAgentActive,
-			restrictedToolSurfaceInheritedMcpServerNames,
-			shellEnvironment: params.shellEnvironment,
-			disableLoginShell: params.disableLoginShell
-		}));
-		const requestModelProvider = typeof resumeParams.modelProvider === "string" && resumeParams.modelProvider.trim() ? resumeParams.modelProvider : void 0;
-		throwIfAborted();
-		resumeReservation = params.reserveResumeThread?.(resumeBinding.threadId);
-		const response = await lifecycleTiming.measure("thread-resume-request", () => resumeCodexAppServerThread({
-			client: params.client,
-			abandonClient,
-			request: resumeParams,
-			signal: params.signal,
-			assertCurrent: context.assertResumeOwnership,
-			isPrewriteOwnershipError: (error) => error instanceof CodexAdoptedThreadActiveError
-		}));
-		resumeResponseAccepted = true;
-		assertCodexThreadAcceptsDirectInput(response.thread);
-		context.assertResumeConfiguration?.();
-		checkingLoadedPluginThreadConfig = true;
-		const loadedPluginThreadConfig = await context.buildLoadedPluginThreadConfig?.(resumeBinding);
-		if (loadedPluginThreadConfig && loadedPluginThreadConfig.fingerprint !== (pluginThreadConfig?.fingerprint ?? resumeBinding.pluginAppsFingerprint)) {
-			checkingLoadedPluginThreadConfig = false;
-			throw new Error("Codex thread app policy changed; a fresh thread configuration is required");
-		}
-		await attestCodexPluginThreadApps({
-			client: params.client,
-			threadId: response.thread.id,
-			appIds: loadedPluginThreadConfig?.provisionalAppIds ?? pluginThreadConfig?.provisionalAppIds ?? [],
-			signal: params.signal
-		});
-		checkingLoadedPluginThreadConfig = false;
-		if (ringZeroActive || isMessageOnlyCodexSourceReply(params.params) || params.params.pluginHarnessToolPolicyRestricted === true) try {
-			await lifecycleTiming.measure("restricted-tool-surface-mcp-attestation", () => attestCodexRestrictedToolSurfaceMcpServersDisabled(params.client, response.thread.id, resumeParams.config, params.signal));
-		} catch (error) {
-			context.assertResumeOwnership?.();
-			await abandonClient();
-			throw new CodexRestrictedToolSurfaceAttestationError(error);
-		}
-		throwIfAborted();
-		const boundAuthProfileId = authProfileId;
-		const nextMcpServersFingerprint = params.mcpServersFingerprintEvaluated === true ? params.mcpServersFingerprint : resumeBinding.mcpServersFingerprint;
-		const resumePatch = {
-			clientId: resolveCodexAppServerClientInstanceId(params.client),
-			pendingResumeConfiguration: void 0,
-			cwd: params.cwd,
-			rolloutPath: resolveCodexThreadRolloutPath(response.thread) ?? resumeBinding.rolloutPath,
-			authProfileId: boundAuthProfileId,
-			model: response.model ?? resumeParams.model ?? params.params.modelId,
-			preserveNativeModel: resumeBinding.preserveNativeModel === true ? true : void 0,
-			modelProvider: normalizeBindingModelProvider(boundAuthProfileId, response.modelProvider ?? requestModelProvider ?? startModelProvider),
-			dynamicToolsFingerprint,
-			dynamicToolsContainDeferred,
-			webSearchThreadConfigFingerprint,
-			nativeSkillIsolationFingerprint,
-			userMcpServersFingerprint,
-			mcpServersFingerprint: nextMcpServersFingerprint,
-			configuredMcpOwnershipVersion: params.configuredMcpOwnershipVersion,
-			ringZeroConfigFingerprint,
-			ringZeroClientInstanceId,
-			nativeToolPolicyRestricted: restrictedToolSurface ? true : void 0,
-			networkProxyProfileName: params.appServer.networkProxy?.profileName,
-			networkProxyConfigFingerprint,
-			nativeHookRelayGeneration: finalConfigPatch.nativeHookRelayGeneration ?? resumeBinding.nativeHookRelayGeneration,
-			appServerRuntimeFingerprint: resumeBinding.connectionScope === "supervision" ? buildCodexAppServerConnectionFingerprint(params.appServer, params.params.agentDir) : params.appServerRuntimeFingerprint,
-			pluginAppsFingerprint: pluginThreadConfig?.fingerprint ?? resumeBinding.pluginAppsFingerprint,
-			pluginAppsInputFingerprint: pluginThreadConfig?.inputFingerprint ?? resumeBinding.pluginAppsInputFingerprint,
-			pluginAppPolicyContext: pluginThreadConfig?.policyContext ?? resumeBinding.pluginAppPolicyContext,
-			contextEngine: contextEngineBinding,
-			environmentSelectionFingerprint
-		};
-		if (!await lifecycleTiming.measure("thread-resume-write-binding", () => params.bindingStore.mutate(bindingIdentity, {
-			kind: "patch",
-			threadId: resumeBinding.threadId,
-			patch: resumePatch
-		}, context.assertResumeConfiguration))) throw new CodexThreadBindingConflictError(resumeBinding.threadId, "committing a resumed thread");
-		if (contextEngineBinding) embeddedAgentLog.info("codex app-server wrote context-engine thread binding", {
-			sessionId: params.params.sessionId,
-			sessionKey: params.params.sessionKey,
-			threadId: response.thread.id,
-			engineId: contextEngineBinding.engineId,
-			epoch: contextEngineBinding.projection?.epoch,
-			fingerprint: contextEngineBinding.projection?.fingerprint,
-			action: "resumed"
-		});
-		lifecycleTiming.mark("thread-ready");
-		lifecycleTiming.logSummary({
-			runId: params.params.runId,
-			sessionId: params.params.sessionId,
-			sessionKey: params.params.sessionKey,
-			threadId: response.thread.id,
-			action: "resumed"
+async function readCodexScheduledAppToolsByApp(params) {
+	const toolsByApp = /* @__PURE__ */ new Map();
+	const seenCursors = /* @__PURE__ */ new Set();
+	let cursor;
+	for (let page = 0; page < MCP_STATUS_MAX_PAGES; page += 1) {
+		const response = await params.request("mcpServerStatus/list", {
+			...params.threadId ? { threadId: params.threadId } : {},
+			detail: "toolsAndAuthOnly",
+			limit: MCP_STATUS_PAGE_SIZE,
+			...cursor ? { cursor } : {}
 		});
-		const activeTurnIds = readActiveCodexTurnIdsFromResume(response);
-		return {
-			...resumeBinding,
-			threadId: response.thread.id,
-			...resumePatch,
-			liveThreadConfigFingerprint: fingerprintCodexThreadConfig({
-				...resumeParams,
-				model: resumeBinding.preserveNativeModel === true ? null : response.model ?? resumeParams.model ?? null,
-				requestedModel: resumeBinding.preserveNativeModel === true ? null : resumeParams.model ?? null,
-				modelProvider: resumeBinding.preserveNativeModel === true ? null : resumePatch.modelProvider ?? null,
-				requestedModelProvider: resumeBinding.preserveNativeModel === true ? null : resumeParams.modelProvider ?? resumePatch.modelProvider ?? null
-			}, authProfileId, dynamicToolsFingerprint),
-			lifecycle: {
-				action: "resumed",
-				...activeTurnIds.length ? { activeTurnIds } : {}
-			}
-		};
-	} catch (error) {
-		resumeReservation?.release();
-		if (!resumeResponseAccepted && (!(error instanceof CodexAppServerRpcError) || isCodexAppServerOverloadError(error))) throw error;
-		if (error instanceof CodexRestrictedToolSurfaceAttestationError) {
-			if (!resumeBinding.pendingResumeConfiguration) await clearCurrentBinding("retiring a failed restricted-tool-surface attestation");
-			throw error;
-		}
-		if (resumeResponseAccepted) {
-			if (!await unsubscribeCodexThreadBestEffort(params.client, {
-				threadId: resumeBinding.threadId,
-				timeoutMs: 5e3,
-				assertCurrent: context.assertResumeOwnership
-			}).catch(() => false)) {
-				try {
-					await abandonClient();
-				} catch (abandonError) {
-					throw new CodexAppServerUnsafeSubscriptionError("Codex thread/resume client could not be retired", { cause: abandonError });
+		if (!isJsonObject(response) || !Array.isArray(response.data)) throw new Error("Codex mcpServerStatus/list returned invalid scheduled app inventory");
+		for (const status of response.data) {
+			if (!isJsonObject(status) || !isJsonObject(status.tools)) throw new Error("Codex scheduled app inventory contained an invalid server status");
+			if (status.name !== CODEX_APPS_MCP_SERVER) continue;
+			for (const [toolName, tool] of Object.entries(status.tools)) {
+				const connectorId = readCodexMcpToolConnectorId(tool);
+				if (connectorId) {
+					const tools = toolsByApp.get(connectorId) ?? /* @__PURE__ */ new Map();
+					const metadata = asOptionalRecord(tool);
+					const annotations = asOptionalRecord(metadata?.annotations);
+					tools.set(toolName, {
+						title: typeof metadata?.title === "string" ? metadata.title : void 0,
+						destructiveHint: annotations?.destructiveHint === false ? false : void 0,
+						openWorldHint: annotations?.openWorldHint === false ? false : void 0
+					});
+					toolsByApp.set(connectorId, tools);
 				}
-				throw new CodexAppServerUnsafeSubscriptionError("Codex thread/resume subscription cleanup failed", { cause: error });
 			}
 		}
-		if (checkingLoadedPluginThreadConfig || resumeBinding.pendingResumeConfiguration || error instanceof CodexThreadDirectInputError || params.signal?.aborted) throw error;
-		embeddedAgentLog.warn("codex app-server thread resume failed; starting a new thread", { error });
-		await clearCurrentBinding("rotating a stale thread binding");
+		if (response.nextCursor !== void 0 && response.nextCursor !== null && typeof response.nextCursor !== "string") throw new Error("Codex scheduled app inventory returned an invalid pagination cursor");
+		cursor = response.nextCursor;
+		if (!cursor) return toolsByApp;
+		if (seenCursors.has(cursor)) throw new Error("Codex app connector inventory repeated its pagination cursor");
+		seenCursors.add(cursor);
 	}
+	throw new Error("Codex app connector inventory exceeded its bounded page limit");
+}
+/** Reads current account policy and connector-backed tool metadata under one caller deadline. */
+async function readCurrentCodexScheduledAppPolicy(params) {
+	const [configResponse, toolsByApp] = await Promise.all([params.request("config/read", {
+		includeLayers: false,
+		...params.configCwd ? { cwd: params.configCwd } : {}
+	}), readCodexScheduledAppToolsByApp(params)]);
+	if (!isJsonObject(configResponse)) throw new Error("Codex config/read returned an invalid scheduled app policy response");
+	return {
+		config: isJsonObject(configResponse.config) ? configResponse.config : {},
+		toolsByApp
+	};
 }
-async function startFreshCodexThread(params, context) {
-	const clientId = resolveCodexAppServerClientInstanceId(params.client);
-	const { bindingIdentity, startModelSelection, startModelProvider, userMcpServersConfigPatch, dynamicToolsFingerprint, dynamicToolsContainDeferred, webSearchThreadConfigFingerprint, nativeSkillIsolationFingerprint, userMcpServersFingerprint, ringZeroConfigFingerprint, ringZeroClientInstanceId, networkProxyConfigFingerprint, contextEngineBinding, environmentSelectionFingerprint, hostSystemAgentActive, ringZeroActive, restrictedToolSurface, restrictedToolSurfaceInheritedMcpServerNames, nativeSkillIsolation, lifecycleTiming, normalizeBindingModelProvider, throwIfAborted, prebuiltPluginThreadConfig, preserveExistingBinding, rotatedContextEngineBinding, replacementPredecessor } = context;
-	const pluginThreadConfig = params.pluginThreadConfig?.enabled ? prebuiltPluginThreadConfig ?? await lifecycleTiming.measure("plugin-config-build", () => params.pluginThreadConfig?.build()) : void 0;
-	const finalConfigPatch = params.buildFinalConfigPatch?.({ action: "start" }) ?? {
-		configPatch: params.finalConfigPatch,
-		nativeHookRelayGeneration: params.nativeHookRelayGeneration
+function readCurrentToolPolicy(config, appId, toolName, metadata, fallbackApprovalMode = "auto") {
+	const apps = asOptionalRecord(config.apps);
+	const app = asOptionalRecord(apps?.[appId]);
+	const defaults = asOptionalRecord(apps?.["_default"]);
+	const tools = asOptionalRecord(app?.tools);
+	const tool = asOptionalRecord(tools?.[toolName] ?? (metadata?.title !== void 0 ? tools?.[metadata.title] : void 0));
+	const defaultToolsEnabled = app?.default_tools_enabled;
+	return {
+		enabled: (app ? app.enabled !== false : defaults?.enabled !== false) && (typeof tool?.enabled === "boolean" ? tool.enabled : typeof defaultToolsEnabled === "boolean" ? defaultToolsEnabled : appToolHintsAllowed(metadata, {
+			allowDestructiveActions: (app?.destructive_enabled ?? defaults?.destructive_enabled) !== false,
+			allowOpenWorld: (app?.open_world_enabled ?? defaults?.open_world_enabled) !== false
+		})),
+		approvalMode: normalizeAppToolApprovalMode(tool?.approval_mode) ?? normalizeAppToolApprovalMode(app?.default_tools_approval_mode) ?? normalizeAppToolApprovalMode(defaults?.default_tools_approval_mode) ?? fallbackApprovalMode
 	};
-	const config = lifecycleTiming.measureSync("merge-thread-config", () => applyCodexNativeSkillIsolation(mergeCodexThreadConfigs(params.config, userMcpServersConfigPatch, pluginThreadConfig?.configPatch, finalConfigPatch.configPatch), nativeSkillIsolation));
-	const startParams = lifecycleTiming.measureSync("thread-start-params", () => buildThreadStartParams(params.params, {
-		cwd: params.cwd,
-		dynamicTools: params.dynamicTools,
-		appServer: params.appServer,
-		developerInstructions: params.developerInstructions,
-		config,
-		nativeCodeModeEnabled: params.nativeCodeModeEnabled,
-		nativeProviderWebSearchSupport: params.nativeProviderWebSearchSupport,
-		nativeCodeModeOnlyEnabled: params.nativeCodeModeOnlyEnabled,
-		webSearchAllowed: params.webSearchAllowed,
-		environmentSelection: params.environmentSelection,
-		model: startModelSelection.model,
-		modelProvider: startModelProvider,
-		hostSystemAgentActive,
-		restrictedToolSurfaceInheritedMcpServerNames,
-		shellEnvironment: params.shellEnvironment,
-		disableLoginShell: params.disableLoginShell
-	}));
-	const requestModelProvider = typeof startParams.modelProvider === "string" && startParams.modelProvider.trim() ? startParams.modelProvider : void 0;
-	const threadStartResponse = await lifecycleTiming.measure("thread-start-request", async () => {
-		try {
-			return await params.client.request("thread/start", startParams, { signal: params.signal });
-		} catch (error) {
-			if (error instanceof CodexAppServerRpcError) throw new CodexThreadStartRequestError(error);
-			throw error;
-		}
-	});
-	const response = assertCodexThreadStartResponse(threadStartResponse);
-	const provisionalAppIds = pluginThreadConfig?.provisionalAppIds;
-	if (provisionalAppIds?.length) try {
-		await lifecycleTiming.measure("plugin-app-attestation", () => attestCodexPluginThreadApps({
-			client: params.client,
-			threadId: response.thread.id,
-			appIds: provisionalAppIds,
+}
+function appToolHintsAllowed(tool, policy) {
+	return (policy.allowDestructiveActions || tool?.destructiveHint === false) && (policy.allowOpenWorld !== false || tool?.openWorldHint === false);
+}
+/** Captures only apps callable on the exact active Codex client/thread. */
+async function captureScheduledCodexAppAuthority(params) {
+	const requestedTimeoutMs = params.timeoutMs ?? CODEX_APP_AUTHORITY_CAPTURE_TIMEOUT_MS;
+	const timeoutMs = Math.min(CODEX_APP_AUTHORITY_CAPTURE_TIMEOUT_MS, Math.max(CODEX_APP_AUTHORITY_CAPTURE_MIN_TIMEOUT_MS, Number.isFinite(requestedTimeoutMs) ? Math.floor(requestedTimeoutMs) : CODEX_APP_AUTHORITY_CAPTURE_TIMEOUT_MS));
+	const deadlineMs = Date.now() + timeoutMs;
+	const boundedClient = { request: ((method, requestParams) => {
+		const remainingTimeoutMs = deadlineMs - Date.now();
+		if (remainingTimeoutMs <= 0) throw new CodexScheduledAppAuthorityCaptureTimeoutError();
+		return params.client.request(method, requestParams, {
+			timeoutMs: remainingTimeoutMs,
 			signal: params.signal
-		}));
+		});
+	}) };
+	let installed;
+	let currentPolicy;
+	let auth;
+	const creatorAuth = params.auth;
+	try {
+		[installed, currentPolicy, auth] = await withAbortableTimeout({
+			promise: Promise.all([
+				boundedClient.request("app/installed", {
+					threadId: params.threadId,
+					forceRefresh: false
+				}),
+				readCurrentCodexScheduledAppPolicy({
+					request: (method, requestParams) => boundedClient.request(method, requestParams),
+					threadId: params.threadId,
+					configCwd: params.configCwd
+				}),
+				creatorAuth.kind === "prepared-profile" ? Promise.resolve({
+					profileId: creatorAuth.profileId,
+					accountId: creatorAuth.accountId
+				}) : readCodexManagedRequirementsFingerprint(boundedClient, params.signal).then((managedRequirementsFingerprint) => ({
+					kind: creatorAuth.kind,
+					connectionFingerprint: creatorAuth.connectionFingerprint,
+					managedRequirementsFingerprint
+				}))
+			]),
+			timeoutMs,
+			signal: params.signal,
+			timeoutMessage: "Codex scheduled app authority capture deadline elapsed",
+			createTimeoutError: () => new CodexScheduledAppAuthorityCaptureTimeoutError()
+		});
 	} catch (error) {
-		if (!await discardUnattestedCodexPluginThread({
-			client: params.client,
-			threadId: response.thread.id,
-			ephemeral: startParams.ephemeral === true
-		})) {
-			await (params.abandonClient ?? (() => closeCodexStartupClientBestEffort(params.client)))();
-			throw new CodexAppServerUnsafeSubscriptionError("Codex plugin app attestation cleanup failed", { cause: error });
+		if (params.signal?.aborted || !(error instanceof CodexScheduledAppAuthorityCaptureTimeoutError) && !isCodexAppServerRequestTimeoutError(error)) throw error;
+		throw new Error(`Codex app authority capture exceeded its ${timeoutMs} ms total budget. No automation changes were saved; retry after Codex app inventory is responsive.`, { cause: error });
+	}
+	const callableIds = new Set(installed.apps.filter((app) => app.enabled && app.callable).map((app) => app.id));
+	const apps = Object.entries(params.policyContext.apps).filter(([id]) => callableIds.has(id) && currentPolicy.toolsByApp.has(id)).map(([id, policy]) => ({
+		id,
+		allowDestructiveActions: policy.allowDestructiveActions,
+		allowOpenWorld: policy.allowOpenWorld !== false,
+		destructiveApprovalMode: defaultApprovalMode(policy),
+		tools: Object.fromEntries([...currentPolicy.toolsByApp.get(id)?.keys() ?? []].toSorted().map((toolName) => [toolName, readCurrentToolPolicy(currentPolicy.config, id, toolName, currentPolicy.toolsByApp.get(id)?.get(toolName), appApprovalCeiling(defaultApprovalMode(policy))).approvalMode]))
+	})).toSorted((left, right) => left.id.localeCompare(right.id));
+	if (apps.length === 0) return;
+	return {
+		version: 1,
+		runtimeId: "codex",
+		namespace: CODEX_SCHEDULED_APP_AUTHORITY_NAMESPACE,
+		payload: {
+			version: 1,
+			auth,
+			apps
 		}
-		throw error;
+	};
+}
+var CodexScheduledAppAuthorityCaptureTimeoutError = class extends Error {
+	constructor() {
+		super("Codex scheduled app authority capture deadline elapsed");
+		this.name = "CodexScheduledAppAuthorityCaptureTimeoutError";
 	}
-	const rolloutPath = resolveCodexThreadRolloutPath(response.thread);
-	if (ringZeroActive || isMessageOnlyCodexSourceReply(params.params) || params.params.pluginHarnessToolPolicyRestricted === true) try {
-		await lifecycleTiming.measure("restricted-tool-surface-mcp-attestation", () => attestCodexRestrictedToolSurfaceMcpServersDisabled(params.client, response.thread.id, startParams.config, params.signal));
-	} catch (error) {
-		await (params.abandonClient ?? (() => closeCodexStartupClientBestEffort(params.client)))();
-		throw error;
+};
+const APPROVAL_RANK = {
+	deny: 0,
+	ask: 1,
+	auto: 2,
+	allow: 3
+};
+function stricterApprovalMode(left, right) {
+	return APPROVAL_RANK[left] <= APPROVAL_RANK[right] ? left : right;
+}
+function intersectToolApprovalMode(captured, current) {
+	if (captured === current) return captured;
+	if (captured === "prompt" || current === "prompt") return "prompt";
+	if (captured === "approve") return current;
+	if (current === "approve") return captured;
+	return "prompt";
+}
+function appApprovalCeiling(mode) {
+	if (mode === "allow") return "approve";
+	return mode === "ask" ? "prompt" : "auto";
+}
+function stableStringify(value) {
+	if (Array.isArray(value)) return `[${value.map(stableStringify).join(",")}]`;
+	if (value && typeof value === "object") return `{${Object.entries(value).toSorted(([left], [right]) => left.localeCompare(right)).map(([key, item]) => `${JSON.stringify(key)}:${stableStringify(item)}`).join(",")}}`;
+	return JSON.stringify(value);
+}
+/** Intersects a stored app-ID cap with current policy without admitting new apps. */
+function intersectCodexPluginThreadConfigWithScheduledAuthority(config, authority, currentPolicy = {
+	config: {},
+	toolsByApp: /* @__PURE__ */ new Map()
+}) {
+	const scheduled = parseScheduledCodexAppAuthority(authority);
+	if (!scheduled) return config;
+	const omittedAppIds = scheduled.apps.map((app) => app.id).filter((id) => {
+		const currentTools = currentPolicy.toolsByApp.get(id);
+		return !Object.hasOwn(config.policyContext.apps, id) || !currentTools || currentTools.size === 0;
+	}).toSorted();
+	if (omittedAppIds.length > 0) {
+		const visibleIds = omittedAppIds.slice(0, 10).join(", ");
+		const remaining = omittedAppIds.length - Math.min(omittedAppIds.length, 10);
+		throw new AgentHarnessPreflightError(`Scheduled Codex apps are unavailable under the current policy or account: ${visibleIds}${remaining > 0 ? ` (and ${remaining} more)` : ""}. Restore access or reauthorize the automation from a fresh authenticated Codex owner turn.`);
 	}
-	try {
-		throwIfAborted();
-	} catch (error) {
-		if (replacementPredecessor) {
-			if (!await discardUnattestedCodexPluginThread({
-				client: params.client,
-				threadId: response.thread.id,
-				ephemeral: startParams.ephemeral === true
-			})) {
-				await (params.abandonClient ?? (() => closeCodexStartupClientBestEffort(params.client)))();
-				throw new CodexAppServerUnsafeSubscriptionError("Codex successor cleanup failed after an aborted binding replacement", { cause: error });
-			}
-		}
-		throw error;
+	const capturedById = new Map(scheduled.apps.map((app) => [app.id, app]));
+	const apps = {};
+	for (const [id, current] of Object.entries(config.policyContext.apps)) {
+		const captured = capturedById.get(id);
+		if (!captured) continue;
+		apps[id] = {
+			...current,
+			allowDestructiveActions: current.allowDestructiveActions && captured.allowDestructiveActions,
+			allowOpenWorld: current.allowOpenWorld !== false && captured.allowOpenWorld,
+			destructiveApprovalMode: stricterApprovalMode(defaultApprovalMode(current), captured.destructiveApprovalMode)
+		};
 	}
-	const modelProvider = resolveCodexAppServerModelProvider({
-		provider: params.params.provider,
-		authProfileId: params.params.authProfileId,
-		authProfileStore: params.params.authProfileStore,
-		agentDir: params.params.agentDir,
-		config: params.params.config
-	});
-	const bindingModelProvider = normalizeBindingModelProvider(params.params.authProfileId, response.modelProvider ?? requestModelProvider ?? startModelProvider ?? modelProvider);
-	const nextMcpServersFingerprint = params.mcpServersFingerprintEvaluated === true ? params.mcpServersFingerprint : void 0;
-	if (!preserveExistingBinding) {
-		const nextBinding = {
-			threadId: response.thread.id,
-			...clientId ? { clientId } : {},
-			cwd: params.cwd,
-			...rolloutPath ? { rolloutPath } : {},
-			authProfileId: params.params.authProfileId,
-			agentWorkspaceDeveloperInstructions: params.agentWorkspaceDeveloperInstructions,
-			model: response.model ?? startParams.model ?? params.params.modelId,
-			modelProvider: bindingModelProvider,
-			dynamicToolsFingerprint,
-			dynamicToolsContainDeferred,
-			webSearchThreadConfigFingerprint,
-			nativeSkillIsolationFingerprint,
-			userMcpServersFingerprint,
-			mcpServersFingerprint: nextMcpServersFingerprint,
-			configuredMcpOwnershipVersion: params.configuredMcpOwnershipVersion,
-			ringZeroConfigFingerprint,
-			ringZeroClientInstanceId,
-			nativeToolPolicyRestricted: restrictedToolSurface ? true : void 0,
-			networkProxyProfileName: params.appServer.networkProxy?.profileName,
-			networkProxyConfigFingerprint,
-			nativeHookRelayGeneration: finalConfigPatch.nativeHookRelayGeneration,
-			appServerRuntimeFingerprint: params.appServerRuntimeFingerprint,
-			pluginAppsFingerprint: pluginThreadConfig?.fingerprint,
-			pluginAppsInputFingerprint: pluginThreadConfig?.inputFingerprint,
-			pluginAppPolicyContext: pluginThreadConfig?.policyContext,
-			contextEngine: contextEngineBinding,
-			environmentSelectionFingerprint
-		};
-		const cleanupUncommittedSuccessor = async (cause) => {
-			if (!await discardUnattestedCodexPluginThread({
-				client: params.client,
-				threadId: response.thread.id,
-				ephemeral: startParams.ephemeral === true
-			})) {
-				await (params.abandonClient ?? (() => closeCodexStartupClientBestEffort(params.client)))();
-				throw new CodexAppServerUnsafeSubscriptionError("Codex successor cleanup failed after a binding replacement conflict", cause === void 0 ? void 0 : { cause });
-			}
-		};
-		const managedSourceHomeId = codexCatalogHomeId(resolveCodexAppServerLocalHomeDir(params.appServer.start, resolveCodexThreadAgentDir(params)));
-		await lifecycleTiming.measure("thread-start-mark-managed", () => markStartedCodexManagedThread(params.bindingStore.managedThreads, {
-			sourceHomeId: managedSourceHomeId,
-			threadId: response.thread.id,
-			...rolloutPath ? { rolloutPath } : {}
+	const policyContext = buildPluginAppPolicyContext(apps, Object.fromEntries(Object.entries(config.policyContext.pluginAppIds).map(([key, ids]) => [key, ids.filter((id) => Object.hasOwn(apps, id))]).filter(([, ids]) => ids.length > 0)));
+	const configPatch = buildCodexPluginAppsConfigPatchFromPolicyContext(policyContext);
+	const appsPatch = asOptionalRecord(configPatch.apps);
+	for (const [appId, captured] of capturedById) {
+		const appPatch = asOptionalRecord(appsPatch?.[appId]);
+		if (!appPatch || !Object.hasOwn(apps, appId)) continue;
+		const currentApp = apps[appId];
+		if (!currentApp) continue;
+		const storedAppCeiling = appApprovalCeiling(captured.destructiveApprovalMode);
+		const currentAppCeiling = appApprovalCeiling(defaultApprovalMode(currentApp));
+		const tools = currentPolicy.toolsByApp.get(appId) ?? /* @__PURE__ */ new Map();
+		appPatch.tools = Object.fromEntries([...tools.keys()].toSorted().map((toolName) => {
+			const capturedMode = captured.tools[toolName] ?? storedAppCeiling;
+			const currentToolPolicy = readCurrentToolPolicy(currentPolicy.config, appId, toolName, tools.get(toolName), currentAppCeiling);
+			return [toolName, {
+				enabled: currentToolPolicy.enabled && appToolHintsAllowed(tools.get(toolName), currentApp),
+				approval_mode: intersectToolApprovalMode(intersectToolApprovalMode(capturedMode, storedAppCeiling), intersectToolApprovalMode(currentToolPolicy.approvalMode, currentAppCeiling))
+			}];
 		}));
-		let committed;
-		try {
-			committed = await lifecycleTiming.measure("thread-start-write-binding", () => params.bindingStore.mutate(bindingIdentity, replacementPredecessor ? {
-				kind: "replace-thread",
-				expectedThreadId: replacementPredecessor.threadId,
-				binding: nextBinding
-			} : {
-				kind: "set",
-				if: { kind: "absent" },
-				binding: nextBinding
-			}));
-		} catch (error) {
-			if (replacementPredecessor) await cleanupUncommittedSuccessor(error);
-			throw error;
-		}
-		if (!committed) {
-			if (replacementPredecessor) await cleanupUncommittedSuccessor();
-			throw new CodexThreadBindingConflictError(replacementPredecessor?.threadId ?? response.thread.id, "committing a fresh thread");
-		}
-		if (contextEngineBinding) embeddedAgentLog.info("codex app-server wrote context-engine thread binding", {
-			sessionId: params.params.sessionId,
-			sessionKey: params.params.sessionKey,
-			threadId: response.thread.id,
-			engineId: contextEngineBinding.engineId,
-			epoch: contextEngineBinding.projection?.epoch,
-			fingerprint: contextEngineBinding.projection?.fingerprint,
-			action: rotatedContextEngineBinding ? "rotated" : "started"
-		});
 	}
-	lifecycleTiming.mark("thread-ready");
-	lifecycleTiming.logSummary({
-		runId: params.params.runId,
-		sessionId: params.params.sessionId,
-		sessionKey: params.params.sessionKey,
-		threadId: response.thread.id,
-		action: rotatedContextEngineBinding ? "rotated" : "started"
-	});
-	return buildStartedCodexThreadBinding({
-		bindingModelProvider,
-		clientId,
-		context,
-		finalConfigPatch,
-		nextMcpServersFingerprint,
-		params,
-		pluginThreadConfig,
-		response,
-		rolloutPath,
-		startModelProvider: requestModelProvider ?? startModelProvider,
-		startParams,
-		modelProvider
-	});
-}
-//#endregion
-//#region extensions/codex/src/app-server/thread-lifecycle-warm.ts
-/** Preserves the caller's abort reason across thread ownership transitions. */
-function throwIfCodexThreadLifecycleAborted(signal) {
-	if (!signal?.aborted) return;
-	const reason = signal.reason;
-	if (reason instanceof Error) throw reason;
-	const error = new Error(typeof reason === "string" && reason.length > 0 ? reason : "codex app-server thread lifecycle aborted");
-	error.name = "AbortError";
-	throw error;
+	const fingerprint = crypto.createHash("sha256").update(stableStringify({
+		version: 1,
+		namespace: CODEX_SCHEDULED_APP_AUTHORITY_NAMESPACE,
+		authority: scheduled,
+		inputFingerprint: config.inputFingerprint,
+		policyContext,
+		configPatch
+	})).digest("hex");
+	return {
+		...config,
+		fingerprint,
+		configPatch,
+		provisionalAppIds: Object.keys(apps).toSorted(),
+		policyContext
+	};
 }
-/** Releases consumed subscription ownership or retires an unsafe client. */
-async function releaseCodexConsumedLiveThread(options) {
-	if (await options.lifecycleTiming.measure("retained-thread-unsubscribe", () => unsubscribeCodexThreadBestEffort(options.client, {
-		threadId: options.threadId,
-		timeoutMs: 5e3,
-		assertCurrent: options.assertCurrent
-	}))) return;
-	return await abandonCodexLiveThreadRelease(options, options.cause);
+/** Returns the managed-requirements identity captured for a configured app-server job. */
+function readScheduledCodexAppManagedRequirementsFingerprint(authority) {
+	const auth = parseScheduledCodexAppAuthority(authority)?.auth;
+	return auth?.kind === "configured-app-server" ? auth.managedRequirementsFingerprint : void 0;
+}
+function assertScheduledCodexAppAuthorityRuntime(connection, params) {
+	const scheduledAuth = parseScheduledCodexAppAuthority(params.scheduledRuntimeAuthority)?.auth;
+	if (!scheduledAuth) return;
+	if (params.trigger !== "cron" || connection.usesSupervisionConnection || connection.appServer.start.homeScope === "user") throw new AgentHarnessPreflightError("This automation's Codex app authority requires an isolated scheduled runtime. Reauthorize it from a supported Codex creator turn.");
+	if (scheduledAuth.kind === "configured-app-server") {
+		if (buildScheduledCodexAppServerConnectionIdentity(connection.appServer) !== scheduledAuth.connectionFingerprint) throw new AgentHarnessPreflightError("This automation was authorized for a different configured Codex app-server. Restore that connection or reauthorize the automation from a fresh owner turn.");
+		return;
+	}
+	const prepared = connection.startupPreparedAuth;
+	if (prepared?.kind !== "profile" || prepared.profileId !== scheduledAuth.profileId || prepared.snapshot?.loginParams.type !== "chatgptAuthTokens" || prepared.snapshot.chatgptAccountId !== scheduledAuth.accountId) throw new AgentHarnessPreflightError(`This automation was authorized for Codex profile ${scheduledAuth.profileId}, but that exact prepared account is not active. Restore the profile or reauthorize the automation from a fresh owner turn.`);
+}
+function buildLegacyScheduledCodexAppRecoveryPrompt(params) {
+	if (params.trigger !== "cron" || !params.scheduledRuntimeAuthorityRecoveryRequired || params.scheduledRuntimeAuthority) return;
+	return "Scheduled Codex app access is unavailable because this automation predates runtime-specific app authority capture. Tell the operator to recreate or reauthorize it from a fresh authenticated Codex owner turn; do not claim an app action succeeded.";
+}
+/** Makes stored-cap identity part of thread reuse admission, including cap removal. */
+function buildScheduledCodexAppAuthorityInputFingerprint(baseFingerprint, authority) {
+	const scheduled = parseScheduledCodexAppAuthority(authority);
+	if (!scheduled) return baseFingerprint;
+	return crypto.createHash("sha256").update(stableStringify({
+		version: 1,
+		namespace: CODEX_SCHEDULED_APP_AUTHORITY_NAMESPACE,
+		baseFingerprint,
+		authority: scheduled
+	})).digest("hex");
 }
-async function abandonCodexLiveThreadRelease(options, cause) {
-	options.assertCurrent?.();
-	await (options.abandonClient ?? (() => closeCodexStartupClientBestEffort(options.client)))();
-	throw new CodexAppServerUnsafeSubscriptionError(`Codex retained thread subscription could not be released: ${options.threadId}`, cause !== void 0 ? { cause } : void 0);
+//#endregion
+//#region extensions/codex/src/app-server/thread-lifecycle-timing.ts
+const CODEX_THREAD_LIFECYCLE_TIMING_WARN_TOTAL_MS = 1e3;
+const CODEX_THREAD_LIFECYCLE_TIMING_WARN_STAGE_MS = 500;
+function shouldWarnCodexThreadLifecycleTimingSummary(summary, options = {}) {
+	const totalThresholdMs = options.totalThresholdMs ?? CODEX_THREAD_LIFECYCLE_TIMING_WARN_TOTAL_MS;
+	const stageThresholdMs = options.stageThresholdMs ?? CODEX_THREAD_LIFECYCLE_TIMING_WARN_STAGE_MS;
+	return summary.totalMs >= totalThresholdMs || summary.spans.some((span) => span.durationMs >= stageThresholdMs);
 }
-/** Releases through the retained owner, preserving its guarded callback and rollback. */
-async function releaseCodexRetainedLiveThread(options) {
-	try {
-		return await options.lifecycleTiming.measure("retained-thread-unsubscribe", () => releaseCodexAppServerLiveThread(options.client, options.threadId, options.assertCurrent));
-	} catch (error) {
-		if (isCodexAppServerUnsafeSubscriptionError(error)) throw error;
-		return await abandonCodexLiveThreadRelease(options, error);
-	}
+function formatCodexThreadLifecycleTimingSummary(params) {
+	const spans = params.summary.spans.length > 0 ? params.summary.spans.map((span) => `${span.name}:${span.durationMs}ms@${span.elapsedMs}ms`).join(",") : "none";
+	return `[trace:codex-app-server] thread lifecycle: runId=${params.runId} sessionId=${params.sessionId} sessionKey=${params.sessionKey ?? "unknown"} action=${params.action} totalMs=${params.summary.totalMs} stages=${spans}`;
 }
-/** Reuses one safely owned, fully matching subscription on its original client. */
-async function tryReuseCodexLiveThread(options) {
-	const { params, binding, bindingIdentity, clientId, dynamicToolsFingerprint, environmentSelectionFingerprint, hostSystemAgentActive, lifecycleTiming, nativeSkillIsolation, ringZeroActive, restrictedToolSurfaceInheritedMcpServerNames, startModelProvider, startModelSelection, throwIfAborted, userMcpServersConfigPatch } = options;
-	if (!binding.clientId || binding.clientId !== clientId || binding.preserveNativeModel === true || binding.connectionScope === "supervision" || ringZeroActive) return { kind: "resume" };
-	const retainedThread = await consumeCodexAppServerLiveThread(params.client, binding.threadId);
-	if (!retainedThread) return { kind: "resume" };
-	const assertCurrentClient = () => {
-		throwIfAborted();
-		if (!isCodexAppServerClientRuntimeLive(params.client)) throw params.client.getCloseError() ?? /* @__PURE__ */ new Error("codex app-server client is closed");
+function createCodexThreadLifecycleTimingTracker(options = {}) {
+	const log = options.log ?? embeddedAgentLog;
+	if (!options.enabled && log.isEnabled?.("trace") !== true) return {
+		async measure(_name, run) {
+			return await run();
+		},
+		measureSync(_name, run) {
+			return run();
+		},
+		mark() {},
+		logSummary() {}
 	};
-	let ownershipTransferred = false;
-	try {
-		const pluginThreadConfig = await options.buildLoadedPluginThreadConfig(binding);
-		assertCurrentClient();
-		if (pluginThreadConfig && pluginThreadConfig.fingerprint !== binding.pluginAppsFingerprint) return { kind: "rotate" };
-		const prebuiltFinalConfigPatch = params.buildFinalConfigPatch?.({
-			action: "resume",
-			binding
-		}) ?? {
-			configPatch: params.finalConfigPatch,
-			nativeHookRelayGeneration: params.nativeHookRelayGeneration
-		};
-		const pluginAppsConfigPatch = pluginThreadConfig?.configPatch ?? (params.pluginThreadConfig?.enabled && binding.pluginAppPolicyContext ? buildCodexPluginAppsConfigPatchFromPolicyContext(binding.pluginAppPolicyContext) : void 0);
-		const resumeAuthProfileId = params.params.authProfileId ?? binding.authProfileId;
-		const resumeConfig = mergeCodexThreadConfigs(params.config, userMcpServersConfigPatch, pluginAppsConfigPatch, prebuiltFinalConfigPatch.configPatch);
-		const resumeParams = lifecycleTiming.measureSync("warm-thread-resume-params", () => buildThreadResumeParams(params.params, {
-			threadId: binding.threadId,
-			cwd: params.cwd,
-			authProfileId: resumeAuthProfileId,
-			model: startModelSelection.model,
-			modelProvider: startModelProvider,
-			preserveNativeModel: false,
-			appServer: params.appServer,
-			dynamicTools: params.dynamicTools,
-			developerInstructions: params.developerInstructions,
-			config: applyCodexNativeSkillIsolation(resumeConfig, nativeSkillIsolation),
-			nativeCodeModeEnabled: params.nativeCodeModeEnabled,
-			nativeProviderWebSearchSupport: params.nativeProviderWebSearchSupport,
-			nativeCodeModeOnlyEnabled: params.nativeCodeModeOnlyEnabled,
-			webSearchAllowed: params.webSearchAllowed,
-			hostSystemAgentActive,
-			restrictedToolSurfaceInheritedMcpServerNames,
-			shellEnvironment: params.shellEnvironment,
-			disableLoginShell: params.disableLoginShell
-		}));
-		const liveThreadConfigFingerprint = fingerprintCodexThreadConfig({
-			...resumeParams,
-			model: binding.model ?? resumeParams.model ?? null,
-			requestedModel: resumeParams.model ?? null,
-			modelProvider: binding.modelProvider ?? resumeParams.modelProvider ?? null,
-			requestedModelProvider: resumeParams.modelProvider ?? binding.modelProvider ?? null
-		}, resumeAuthProfileId, dynamicToolsFingerprint);
-		if (retainedThread.configFingerprint !== liveThreadConfigFingerprint) return {
-			kind: "resume",
-			prebuiltFinalConfigPatch
-		};
-		await attestCodexPluginThreadApps({
-			client: params.client,
-			threadId: binding.threadId,
-			appIds: pluginThreadConfig?.provisionalAppIds ?? [],
-			signal: params.signal
+	const now = options.now ?? Date.now;
+	const startedAt = now();
+	let didLog = false;
+	const spans = [];
+	const toMs = (value) => Math.max(0, Math.round(value));
+	const record = (name, spanStartedAt) => {
+		const currentAt = now();
+		spans.push({
+			name,
+			durationMs: toMs(currentAt - spanStartedAt),
+			elapsedMs: toMs(currentAt - startedAt)
 		});
-		assertCurrentClient();
-		const nativeHookRelayGeneration = prebuiltFinalConfigPatch.nativeHookRelayGeneration ?? binding.nativeHookRelayGeneration;
-		const model = startModelSelection.model;
-		if (!await lifecycleTiming.measure("warm-thread-write-binding", () => params.bindingStore.mutate(bindingIdentity, {
-			kind: "patch",
-			threadId: binding.threadId,
-			patch: {
-				cwd: params.cwd,
-				model,
-				nativeHookRelayGeneration,
-				environmentSelectionFingerprint
+	};
+	const snapshot = () => ({
+		totalMs: toMs(now() - startedAt),
+		spans: spans.slice()
+	});
+	return {
+		async measure(name, run) {
+			const spanStartedAt = now();
+			try {
+				return await run();
+			} finally {
+				record(name, spanStartedAt);
 			}
-		}, assertCurrentClient))) throw new CodexThreadBindingConflictError(binding.threadId, "committing a reused thread");
-		assertCurrentClient();
-		lifecycleTiming.mark("thread-ready");
-		lifecycleTiming.logSummary({
-			runId: params.params.runId,
-			sessionId: params.params.sessionId,
-			sessionKey: params.params.sessionKey,
-			threadId: binding.threadId,
-			action: "resumed"
-		});
-		ownershipTransferred = true;
-		return {
-			kind: "ready",
-			binding: {
-				...binding,
-				cwd: params.cwd,
-				model,
-				nativeHookRelayGeneration,
-				environmentSelectionFingerprint,
-				liveThreadConfigFingerprint,
-				liveThreadOwnership: retainedThread,
-				...retainedThread.serviceTier && resumeParams.serviceTier === void 0 ? { clearInheritedServiceTier: true } : {},
-				lifecycle: { action: "resumed" }
+		},
+		measureSync(name, run) {
+			const spanStartedAt = now();
+			try {
+				return run();
+			} finally {
+				record(name, spanStartedAt);
 			}
-		};
-	} finally {
-		if (!ownershipTransferred) try {
-			await retainedThread.release(binding.threadId);
-		} catch (error) {
-			await abandonCodexLiveThreadRelease({
-				client: params.client,
-				abandonClient: params.abandonClient,
-				lifecycleTiming,
-				threadId: binding.threadId
-			}, error);
+		},
+		mark(name) {
+			record(name, now());
+		},
+		logSummary(params) {
+			if (didLog) return;
+			const summary = snapshot();
+			const shouldWarn = shouldWarnCodexThreadLifecycleTimingSummary(summary, options);
+			if (!shouldWarn && !log.isEnabled?.("trace")) return;
+			didLog = true;
+			const message = formatCodexThreadLifecycleTimingSummary({
+				runId: params.runId,
+				sessionId: params.sessionId,
+				sessionKey: params.sessionKey,
+				action: params.action,
+				summary
+			});
+			const meta = {
+				runId: params.runId,
+				sessionId: params.sessionId,
+				sessionKey: params.sessionKey,
+				action: params.action,
+				threadId: params.threadId,
+				totalMs: summary.totalMs,
+				spans: summary.spans
+			};
+			if (shouldWarn) log.warn(message, meta);
+			else log.trace(message, meta);
 		}
-	}
+	};
 }
 //#endregion
-//#region extensions/codex/src/app-server/thread-lifecycle-adoption.ts
-/** Passive refusal must precede releasing or acquiring any native subscription. */
-async function assertAdoptedCodexThreadResumeAllowed(params, threadId, context) {
-	const { thread } = await context.lifecycleTiming.measure("thread-read-adoption-status", () => params.client.request("thread/read", {
-		threadId,
-		includeTurns: false
-	}, { signal: params.signal }));
-	context.throwIfAborted();
-	assertCodexThreadAcceptsDirectInput(thread);
-	if (thread.status?.type === "active") throw new CodexAdoptedThreadActiveError();
-}
-/** Preserve attach's native-queue-before-binding-lease order when consuming pending intent. */
-async function withCodexThreadLifecycleBinding(params, run) {
-	const identity = sessionBindingIdentity({
-		sessionId: params.params.sessionId,
+//#region extensions/codex/src/app-server/thread-lifecycle-preflight.ts
+function resolveCodexThreadAgentDir(params) {
+	const agentId = resolveSessionAgentIdsStrict({
+		config: params.params.config,
 		sessionKey: params.params.sessionKey,
-		agentId: params.agentId ?? params.params.agentId,
-		config: params.params.config
-	});
-	const snapshot = await params.bindingStore.read(identity);
-	const pendingThreadId = snapshot?.pendingResumeConfiguration ? snapshot.threadId : void 0;
-	const runWithLease = () => params.bindingStore.withLease(identity, async () => {
-		const binding = await params.bindingStore.read(identity);
-		if (pendingThreadId && (binding?.threadId !== pendingThreadId || !binding.pendingResumeConfiguration)) throw new CodexThreadBindingConflictError(pendingThreadId, "acquiring a pending resume configuration");
-		if (!pendingThreadId && binding?.pendingResumeConfiguration) throw new CodexThreadBindingConflictError(binding.threadId, "acquiring a pending resume configuration");
-		return await run(identity, binding);
-	});
-	return pendingThreadId ? await withExclusiveCodexAppServerThread({
-		bindingStore: params.bindingStore,
-		identity,
-		threadId: pendingThreadId,
-		run: runWithLease
-	}) : await runWithLease();
+		agentId: params.agentId ?? params.params.agentId
+	}).sessionAgentId;
+	return params.agentDir ?? params.params.agentDir ?? resolveAgentDir$1(params.params.config ?? {}, agentId);
 }
-/** Completes manual attachment only under the native queue and exact binding lease. */
-async function resumePendingCodexThread(params, context) {
-	const { binding, contextEngineBinding, lifecycleTiming, restrictedToolSurface } = context;
-	if (isIncognitoSessionKey(params.params.sessionKey) || context.transientRestriction || !restrictedToolSurface && binding.nativeToolPolicyRestricted === true || (contextEngineBinding ? !isContextEngineBindingCompatible(binding.contextEngine, contextEngineBinding) : binding.contextEngine !== void 0) || shouldRotateCodexGpt56MultiAgentBinding({
-		bindingModel: binding.model,
-		requestedModel: params.params.modelId
-	})) throw new Error(`Cannot configure resumed Codex thread ${binding.threadId} under a transient or incompatible session policy. The thread is preserved; retry from its normal session or use /new for the current policy.`);
-	const prebuiltPluginThreadConfig = params.pluginThreadConfig?.enabled ? await lifecycleTiming.measure("plugin-config-build", () => params.pluginThreadConfig?.build()) : void 0;
-	const clientId = resolveCodexAppServerClientInstanceId(params.client);
-	const configuration = await preparePendingCodexThreadResume(params, binding, context.dynamicToolsFingerprint, async (assertCurrent) => {
-		const released = await context.releaseRetainedThread(binding.threadId, assertCurrent);
-		assertCurrent();
-		if (!released || binding.clientId && binding.clientId !== clientId) await releaseCodexConsumedLiveThread({
-			client: params.client,
-			abandonClient: params.abandonClient,
-			lifecycleTiming,
-			threadId: binding.threadId,
-			assertCurrent
-		});
+async function prepareCodexThreadLifecyclePreflight(params) {
+	await assertCodexModelBackedReviewerEffectiveConfig({
+		client: params.client,
+		approvalsReviewer: params.appServer.approvalsReviewer,
+		cwd: params.cwd,
+		signal: params.signal
 	});
-	try {
-		const resumed = await resumeExistingCodexThread(params, {
-			...context,
-			prebuiltPluginThreadConfig,
-			assertResumeConfiguration: configuration.assertConfigured,
-			assertResumeOwnership: configuration.assertCurrent
-		});
-		if (!resumed) throw new Error(`Codex did not configure resumed thread ${binding.threadId}.`);
-		return resumed;
-	} finally {
-		configuration.dispose();
-	}
-}
-/** Manual attachment is intent, never evidence that loaded native overrides took effect. */
-async function preparePendingCodexThreadResume(params, binding, dynamicToolsFingerprint, releaseSubscription) {
-	const fail = (reason) => /* @__PURE__ */ new Error(`Cannot configure resumed Codex thread ${binding.threadId}: ${reason}. The thread is preserved; continue it in native Codex or use /new for the current OpenClaw tools.`);
-	const agentDir = resolveCodexThreadAgentDir(params);
-	const localHome = resolveCodexAppServerLocalHomeDir(params.appServer.start, agentDir);
-	if (params.appServer.start.transport !== "stdio" || params.appServer.start.homeScope === "user" || path.resolve(localHome) !== resolveCodexAppServerHomeDir(agentDir) || binding.connectionScope === "supervision" || binding.preserveNativeModel === true) throw fail("configuration adoption requires an OpenClaw-owned local Codex home");
-	if (isCodexAppServerLiveThreadClaimed(params.client, binding.threadId)) throw fail("the thread is claimed by active work; stop that run before resuming");
-	const assertCurrent = captureExclusiveSharedCodexAppServerClient(params.client);
-	const { thread } = await params.client.request("thread/read", {
-		threadId: binding.threadId,
-		includeTurns: false
-	}, { signal: params.signal });
-	assertCurrent();
-	const statusType = thread.status?.type;
-	if (thread.id !== binding.threadId || statusType !== "idle" && statusType !== "notLoaded") throw fail("the native thread is not idle; wait for its current run to finish");
-	assertCodexThreadAcceptsDirectInput(thread);
-	let unloaded = statusType === "notLoaded";
-	const dispose = params.client.addNotificationHandler((notification) => {
-		if (notification.method === "thread/status/changed" && isJsonObject(notification.params) && notification.params.threadId === binding.threadId && isJsonObject(notification.params.status) && notification.params.status.type === "notLoaded") unloaded = true;
+	if (params.nativeHookRelayRequired) await assertCodexNativeHookRelayAllowed(params.client, params.signal);
+	const lifecycleTiming = createCodexThreadLifecycleTimingTracker({
+		...params.timing,
+		enabled: params.timing?.enabled ?? isCodexAppServerProfilerEnabled(params.params.config)
 	});
-	try {
-		const rolloutPath = thread.path ?? binding.rolloutPath;
-		const metadata = rolloutPath ? await readCodexSessionMeta(path.join(localHome, "sessions"), rolloutPath, binding.threadId) : void 0;
-		if (!metadata) throw fail("its native tool catalog could not be read from the selected Codex home");
-		const recordedTools = metadata.dynamic_tools ?? [];
-		if (!Array.isArray(recordedTools) || codexDynamicToolsFingerprint(recordedTools) !== dynamicToolsFingerprint) throw fail("its immutable native tool catalog does not match the current OpenClaw tools");
-		assertCurrent();
-		await releaseSubscription(assertCurrent);
-		assertCurrent();
-		return {
-			assertConfigured: () => {
-				assertCurrent();
-				if (!unloaded) throw fail("Codex did not confirm unloading its previous configuration");
-			},
-			assertCurrent,
-			dispose
-		};
-	} catch (error) {
-		dispose();
-		throw error;
-	}
+	const legacyDynamicToolsFingerprint = lifecycleTiming.measureSync("legacy-dynamic-tools-fingerprint", () => codexLegacyDynamicToolsFingerprint(params.dynamicTools));
+	const dynamicToolsFingerprint = lifecycleTiming.measureSync("dynamic-tools-fingerprint", () => hashCodexAppServerBindingFingerprint(legacyDynamicToolsFingerprint));
+	const dynamicToolsContainDeferred = flattenCodexDynamicToolFunctions(params.dynamicTools).some((tool) => tool.deferLoading === true);
+	const webSearchThreadConfigFingerprint = fingerprintJsonObject(lifecycleTiming.measureSync("web-search-plan", () => resolveCodexWebSearchPlan({
+		config: params.params.config,
+		disableTools: params.params.disableTools,
+		nativeToolSurfaceEnabled: params.nativeCodeModeEnabled,
+		nativeProviderWebSearchSupport: params.nativeProviderWebSearchSupport,
+		webSearchAllowed: params.webSearchAllowed
+	})).threadConfig);
+	const networkProxyConfigFingerprint = params.appServer.networkProxy?.configFingerprint;
+	const contextEngineBinding = lifecycleTiming.measureSync("context-engine-binding", () => buildContextEngineBinding(params.params, params.contextEngineProjection));
+	const userMcpServersConfigPatch = params.userMcpServersEnabled === false ? void 0 : await buildCodexUserMcpServersThreadConfigPatchForRun({
+		run: params.params,
+		cwd: params.cwd,
+		agentId: params.agentId ?? params.params.agentId,
+		allowLiteralOAuthProjection: params.appServer.connectionClass !== "remote",
+		warn: (message) => embeddedAgentLog.warn(message),
+		onServerUnavailable: (serverName, error) => embeddedAgentLog.warn("skipping unavailable MCP OAuth server", {
+			serverName,
+			error: formatErrorMessage(error)
+		})
+	});
+	const nativeSkillIsolation = await lifecycleTiming.measure("native-skill-isolation", () => resolveCodexNativeSkillIsolation({
+		client: params.client,
+		codexHome: params.appServer.start.env?.CODEX_HOME,
+		cwd: params.cwd,
+		home: params.appServer.start.env?.HOME,
+		signal: params.signal,
+		userProfile: params.appServer.start.env?.USERPROFILE
+	}));
+	const nativeSkillIsolationFingerprint = nativeSkillIsolation ? fingerprintJsonObject({
+		version: 1,
+		disabledUserSkillPaths: nativeSkillIsolation.disabledUserSkillPaths
+	}) : void 0;
+	const legacyUserMcpServersFingerprint = legacyFingerprintUserMcpServersConfigPatch(userMcpServersConfigPatch);
+	const userMcpServersFingerprint = fingerprintUserMcpServersConfigPatch(userMcpServersConfigPatch);
+	const environmentSelectionFingerprint = fingerprintEnvironmentSelection(params.environmentSelection);
+	const hostSystemAgentActive = params.hostSystemAgentActive ?? isHostScopedAgentToolActive("openclaw");
+	const ringZeroActive = hostSystemAgentActive && isSystemAgentOnlyCodexDynamicToolAllowlist(params.params.toolsAllow);
+	const messageOnlySourceReply = isMessageOnlyCodexSourceReply(params.params);
+	const restrictedToolSurface = ringZeroActive || messageOnlySourceReply || params.params.pluginHarnessToolPolicyRestricted === true;
+	const allowConfiguredManagedHooks = params.params.pluginHarnessToolPolicyRestricted === true && !ringZeroActive && !messageOnlySourceReply && params.params.scheduledRuntimeAuthority === void 0;
+	const imageGenerationDenied = params.params.pluginHarnessToolPolicySafeDeniedTools?.includes("image_generate") === true;
+	if (restrictedToolSurface && params.nativeCodeModeEnabled !== false) throw new Error("Codex restricted tool surfaces require native code mode to be disabled");
+	const restrictedToolSurfaceInheritedMcpServerNames = restrictedToolSurface ? await lifecycleTiming.measure("restricted-tool-surface-mcp-config-read", () => readCodexInheritedMcpServerNames(params.client, params.cwd, params.signal)) : [];
+	if (restrictedToolSurface || imageGenerationDenied) await lifecycleTiming.measure("tool-policy-config-requirements-read", () => assertCodexManagedRequirementsDoNotOverrideToolPolicy(params.client, {
+		restrictedToolSurface,
+		additionalDeniedFeatures: imageGenerationDenied ? ["image_generation"] : void 0,
+		allowedManagedRequirementsFingerprint: readScheduledCodexAppManagedRequirementsFingerprint(params.params.scheduledRuntimeAuthority),
+		allowConfiguredManagedHooks
+	}, params.signal));
+	const ringZeroConfigFingerprint = ringZeroActive ? fingerprintJsonObject({
+		version: 1,
+		baseInstructions: "",
+		config: buildCodexRingZeroThreadConfigPatch(params.params, true, restrictedToolSurfaceInheritedMcpServerNames)
+	}) : void 0;
+	return {
+		contextEngineBinding,
+		dynamicToolsContainDeferred,
+		dynamicToolsFingerprint,
+		environmentSelectionFingerprint,
+		hostSystemAgentActive,
+		legacyDynamicToolsFingerprint,
+		legacyUserMcpServersFingerprint,
+		lifecycleTiming,
+		nativeSkillIsolation,
+		nativeSkillIsolationFingerprint,
+		networkProxyConfigFingerprint,
+		ringZeroActive,
+		ringZeroClientInstanceId: ringZeroActive ? getCodexAppServerClientInstanceId(params.client) : void 0,
+		ringZeroConfigFingerprint,
+		restrictedToolSurface,
+		restrictedToolSurfaceInheritedMcpServerNames,
+		userMcpServersConfigPatch,
+		userMcpServersFingerprint,
+		webSearchThreadConfigFingerprint
+	};
 }
 //#endregion
-//#region extensions/codex/src/app-server/native-hook-relay-state.ts
-const pending = /* @__PURE__ */ new Set();
-/** Owns delayed hook-relay cleanup across runtime scheduling and test teardown. */
-const nativeHookRelayUnregisterQueue = {
-	add(entry) {
-		pending.add(entry);
-	},
-	delete(entry) {
-		return pending.delete(entry);
-	},
-	flush() {
-		while (pending.size > 0) {
-			const entry = pending.values().next().value;
-			if (!entry) return;
-			clearTimeout(entry.timeout);
-			entry.unregister();
-		}
-	},
-	clear() {
-		for (const entry of pending) clearTimeout(entry.timeout);
-		pending.clear();
-	}
-};
-//#endregion
-//#region extensions/codex/src/app-server/native-hook-relay.ts
-/**
-* Bridges Codex native hook callbacks into OpenClaw's native hook relay so
-* app-server tool events can still run OpenClaw policy and diagnostics.
-*/
-/** Codex hook events that can be registered through OpenClaw's native relay. */
-const CODEX_NATIVE_HOOK_RELAY_EVENTS = [
-	"pre_tool_use",
-	"post_tool_use",
-	"permission_request",
-	"before_agent_finalize"
-];
-const CODEX_NATIVE_HOOK_RELAY_EVENTS_WITH_APP_SERVER_APPROVALS = CODEX_NATIVE_HOOK_RELAY_EVENTS.filter((event) => event !== "permission_request");
-const CODEX_NATIVE_HOOK_RELAY_MIN_TTL_MS = 18e5;
-/** Extra relay lifetime after the expected turn budget, preventing late hook drops. */
-const CODEX_NATIVE_HOOK_RELAY_TTL_GRACE_MS = 3e5;
-const CODEX_NATIVE_HOOK_RELAY_COMMAND_MIN_PARENT_MARGIN_MS = 250;
-const CODEX_NATIVE_HOOK_RELAY_COMMAND_MAX_PARENT_MARGIN_MS = 1e3;
-const CODEX_NATIVE_HOOK_RELAY_DEFAULT_TIMEOUT_SEC = 10;
-const CODEX_NATIVE_HOOK_RELAY_UNREGISTER_GRACE_MS = 1e4;
-const CODEX_NATIVE_HOOK_RELAY_UNREGISTER_EXTRA_GRACE_MS = 5e3;
-const MAX_PENDING_DIRECT_CHILD_ADMISSIONS = 32;
-const nativeHookPolicyByClient = /* @__PURE__ */ new WeakMap();
-const CODEX_HOOK_MATCHER_NAMES_BY_TOOL_ID = {
-	exec: [
-		"Bash",
-		"exec",
-		"exec_command"
-	],
-	apply_patch: [
-		"apply_patch",
-		"Write",
-		"Edit"
-	],
-	spawn_agent: ["spawn_agent", "Agent"]
-};
-/** Enterprise managed-only policy silently drops the session-layer hooks that enforce OpenClaw. */
-async function assertCodexNativeHookRelayAllowed(client, signal) {
-	let attestation = nativeHookPolicyByClient.get(client);
-	if (!attestation) {
-		attestation = client.request("configRequirements/read", void 0, { signal }).then((response) => {
-			if (!isJsonObject(response) || !Object.hasOwn(response, "requirements")) throw new Error("Codex configRequirements/read returned an invalid hook policy response");
-			const requirements = response.requirements;
-			if (requirements === null) return;
-			if (!isJsonObject(requirements)) throw new Error("Codex configRequirements/read returned invalid hook policy requirements");
-			const managedOnly = requirements.allowManagedHooksOnly;
-			if (managedOnly !== void 0 && managedOnly !== null && typeof managedOnly !== "boolean") throw new Error("Codex configRequirements/read returned invalid managed-only hook policy");
-			if (managedOnly === true) throw new Error("Codex managed-only hooks disable the OpenClaw native hook relay; refusing unenforced execution");
-		});
-		nativeHookPolicyByClient.set(client, attestation);
-		attestation.catch(() => {
-			if (nativeHookPolicyByClient.get(client) === attestation) nativeHookPolicyByClient.delete(client);
-		});
-	}
-	await attestation;
+//#region extensions/codex/src/app-server/thread-lifecycle-result.ts
+function resolveCodexThreadRolloutPath(thread) {
+	const rolloutPath = thread.path?.trim();
+	if (!rolloutPath || !path.isAbsolute(rolloutPath) || path.extname(rolloutPath) !== ".jsonl" || !path.basename(rolloutPath).includes(thread.id)) return;
+	return rolloutPath;
 }
-/** Defers relay unregister so late native hook subprocesses can still resolve. */
-function scheduleCodexNativeHookRelayUnregister(params) {
-	let pending;
-	const unregister = () => {
-		if (!pending) return;
-		const current = pending;
-		pending = void 0;
-		if (!nativeHookRelayUnregisterQueue.delete(current)) return;
-		params.relay.unregister();
-	};
-	const timeout = setTimeout(unregister, resolveCodexNativeHookRelayUnregisterGraceMs(params.hookTimeoutSec));
-	pending = {
-		timeout,
-		unregister
+/** Materializes the public lifecycle result after a fresh thread is durably committed. */
+function buildStartedCodexThreadBinding(input) {
+	const { context, params, response, startParams } = input;
+	return {
+		threadId: response.thread.id,
+		...input.clientId ? { clientId: input.clientId } : {},
+		cwd: params.cwd,
+		...input.rolloutPath ? { rolloutPath: input.rolloutPath } : {},
+		authProfileId: params.params.authProfileId,
+		agentWorkspaceDeveloperInstructions: params.agentWorkspaceDeveloperInstructions,
+		model: response.model ?? startParams.model ?? params.params.modelId,
+		modelProvider: response.modelProvider ?? input.startModelProvider ?? input.modelProvider,
+		dynamicToolsFingerprint: context.dynamicToolsFingerprint,
+		dynamicToolsContainDeferred: context.dynamicToolsContainDeferred,
+		nativeSkillIsolationFingerprint: context.nativeSkillIsolationFingerprint,
+		userMcpServersFingerprint: context.userMcpServersFingerprint,
+		mcpServersFingerprint: input.nextMcpServersFingerprint,
+		configuredMcpOwnershipVersion: params.configuredMcpOwnershipVersion,
+		ringZeroConfigFingerprint: context.ringZeroConfigFingerprint,
+		ringZeroClientInstanceId: context.ringZeroClientInstanceId,
+		networkProxyProfileName: params.appServer.networkProxy?.profileName,
+		networkProxyConfigFingerprint: context.networkProxyConfigFingerprint,
+		nativeHookRelayGeneration: input.finalConfigPatch.nativeHookRelayGeneration,
+		appServerRuntimeFingerprint: params.appServerRuntimeFingerprint,
+		pluginAppsFingerprint: input.pluginThreadConfig?.fingerprint,
+		pluginAppsInputFingerprint: input.pluginThreadConfig?.inputFingerprint,
+		pluginAppPolicyContext: input.pluginThreadConfig?.policyContext,
+		contextEngine: context.contextEngineBinding,
+		environmentSelectionFingerprint: context.environmentSelectionFingerprint,
+		...startParams.ephemeral ? { liveThreadEphemeralPolicy: startParams.developerInstructions } : {},
+		...!context.preserveExistingBinding ? { liveThreadConfigFingerprint: fingerprintCodexThreadConfig({
+			...startParams,
+			model: response.model ?? startParams.model ?? null,
+			requestedModel: startParams.model ?? null,
+			modelProvider: input.bindingModelProvider ?? null,
+			requestedModelProvider: startParams.modelProvider ?? input.bindingModelProvider ?? null
+		}, params.params.authProfileId, context.dynamicToolsFingerprint) } : {},
+		lifecycle: {
+			action: "started",
+			...context.rotatedContextEngineBinding ? { rotatedContextEngineBinding: true } : {}
+		}
 	};
-	nativeHookRelayUnregisterQueue.add(pending);
-	timeout.unref();
 }
-/** Computes the delayed unregister window from Codex's hook timeout. */
-function resolveCodexNativeHookRelayUnregisterGraceMs(hookTimeoutSec) {
-	const hookTimeoutMs = finiteSecondsToTimerSafeMilliseconds(normalizeHookTimeoutSec(hookTimeoutSec)) ?? 0;
-	return Math.max(CODEX_NATIVE_HOOK_RELAY_UNREGISTER_GRACE_MS, addTimerTimeoutGraceMs(hookTimeoutMs, CODEX_NATIVE_HOOK_RELAY_UNREGISTER_EXTRA_GRACE_MS) ?? 0);
-}
-/** Records a native pre-tool failure that Codex does not project as a tool item. */
-function emitCodexNativePreToolUseFailureDiagnostic(params) {
-	emitTrustedDiagnosticEvent({
-		type: "tool.execution.error",
-		...params.agentId ? { agentId: params.agentId } : {},
-		sessionId: params.sessionId,
-		...params.sessionKey ? { sessionKey: params.sessionKey } : {},
-		runId: params.runId,
-		toolName: params.failure.toolName,
-		toolCallId: params.failure.toolCallId,
-		durationMs: params.failure.durationMs,
-		errorCategory: "before_tool_call",
-		terminalReason: params.terminalReason ?? (params.signal?.aborted ? resolveCodexToolAbortTerminalReason(params.signal) : params.failure.disposition),
-		...params.sourceTimestampMs !== void 0 ? { sourceTimestampMs: params.sourceTimestampMs } : {}
-	});
-}
-/** Registers an OpenClaw native hook relay for a Codex app-server turn. */
-function createCodexNativeHookRelay(params) {
-	if (params.options?.enabled === false) return;
-	const directChildClaims = /* @__PURE__ */ new Map();
-	const pendingDirectChildAdmissions = /* @__PURE__ */ new Map();
-	let foregroundClosed = false;
-	let successfulYieldRetentionAuthorized = false;
-	const assertClaim = (threadId, claim) => () => directChildClaims.get(threadId) === claim;
-	const rejectPendingAdmissions = (reason) => {
-		for (const pending of pendingDirectChildAdmissions.values()) pending.reject(new Error(reason));
-		pendingDirectChildAdmissions.clear();
+//#endregion
+//#region extensions/codex/src/app-server/thread-lifecycle-io.ts
+async function resumeExistingCodexThread(params, context) {
+	const { binding: resumeBinding, bindingIdentity, startModelSelection, startModelProvider, userMcpServersConfigPatch, dynamicToolsFingerprint, dynamicToolsContainDeferred, webSearchThreadConfigFingerprint, nativeSkillIsolationFingerprint, userMcpServersFingerprint, ringZeroConfigFingerprint, ringZeroClientInstanceId, networkProxyConfigFingerprint, contextEngineBinding, environmentSelectionFingerprint, hostSystemAgentActive, restrictedToolSurface, restrictedToolSurfaceInheritedMcpServerNames, nativeSkillIsolation, lifecycleTiming, normalizeBindingModelProvider, throwIfAborted, clearCurrentBinding } = context;
+	let resumeReservation;
+	let resumeResponseAccepted = false;
+	let ordinaryAppConfigChanged = false;
+	let policyOutcome = "not-written";
+	const assertHandoffCurrent = () => {
+		params.params.hostCapabilities.assertActive();
+		throwIfAborted();
+		context.assertResumeOwnership();
+		context.assertResumeConfiguration();
 	};
-	const relay = registerRetainedNativeHookRelayForBundledRuntime({
-		provider: "codex",
-		relayId: buildCodexNativeHookRelayId({
-			agentId: params.agentId,
-			sessionId: params.sessionId,
-			sessionKey: params.sessionKey
-		}),
-		...params.generation ? { generation: params.generation } : {},
-		...params.generationMismatchGraceMs ? { generationMismatchGraceMs: params.generationMismatchGraceMs } : {},
-		...params.agentId ? { agentId: params.agentId } : {},
-		sessionId: params.sessionId,
-		...params.sessionKey ? { sessionKey: params.sessionKey } : {},
-		...params.config ? { config: params.config } : {},
-		runId: params.runId,
-		...params.channelId ? { channelId: params.channelId } : {},
-		...params.requester ? { requester: params.requester } : {},
-		...params.approvalContext ? { approvalContext: params.approvalContext } : {},
-		allowedEvents: params.events,
-		preToolUseLoopDetection: params.loopDetectionPreToolUseRelay,
-		ttlMs: resolveCodexNativeHookRelayTtlMs({
-			explicitTtlMs: params.options?.ttlMs,
-			attemptTimeoutMs: params.attemptTimeoutMs,
-			startupTimeoutMs: params.startupTimeoutMs,
-			turnStartTimeoutMs: params.turnStartTimeoutMs
-		}),
-		signal: params.signal,
-		runBeforeToolCall: params.hostCapabilities.runBeforeToolCall,
-		assertActive: params.hostCapabilities.assertActive,
-		retention: {
-			readClaim: readCodexNativeChildThreadId,
-			shouldRetainAfterForegroundClose: () => successfulYieldRetentionAuthorized && directChildClaims.size > 0,
-			allowPreToolUse: (childThreadId) => directChildClaims.has(childThreadId),
-			awaitForegroundAdmission: (childThreadId) => {
-				if (foregroundClosed) return Promise.reject(/* @__PURE__ */ new Error("native hook relay foreground admission unavailable"));
-				const existingClaim = directChildClaims.get(childThreadId);
-				if (existingClaim) return Promise.resolve(assertClaim(childThreadId, existingClaim));
-				const existingPending = pendingDirectChildAdmissions.get(childThreadId);
-				if (existingPending) return existingPending.promise.then((claim) => assertClaim(childThreadId, claim));
-				if (pendingDirectChildAdmissions.size >= MAX_PENDING_DIRECT_CHILD_ADMISSIONS) return Promise.reject(/* @__PURE__ */ new Error("native hook relay foreground admission capacity reached"));
-				const { promise, resolve, reject } = createDeferred();
-				pendingDirectChildAdmissions.set(childThreadId, {
-					promise,
-					resolve,
-					reject
-				});
-				return promise.then((claim) => assertClaim(childThreadId, claim));
-			},
-			onDispose: () => {
-				foregroundClosed = true;
-				rejectPendingAdmissions("native hook relay registration closed");
+	const abandonClient = params.abandonClient ?? (() => closeCodexStartupClientBestEffort(params.client));
+	try {
+		const authProfileId = resumeBinding.connectionScope === "supervision" ? void 0 : params.params.authProfileId ?? resumeBinding.authProfileId;
+		const finalConfigPatch = context.prebuiltFinalConfigPatch ?? params.buildFinalConfigPatch?.({
+			action: "resume",
+			binding: resumeBinding
+		}) ?? {
+			configPatch: params.finalConfigPatch,
+			nativeHookRelayGeneration: params.nativeHookRelayGeneration
+		};
+		const pluginThreadConfig = context.prebuiltPluginThreadConfig ?? (params.pluginThreadConfig?.requiresCurrentPolicyCheck ? await lifecycleTiming.measure("plugin-config-build", () => params.pluginThreadConfig?.build()) : void 0);
+		const pluginAppsConfigPatch = pluginThreadConfig?.configPatch ?? (params.pluginThreadConfig?.enabled && resumeBinding.pluginAppPolicyContext ? buildCodexPluginAppsConfigPatchFromPolicyContext(resumeBinding.pluginAppPolicyContext) : void 0);
+		const resumeConfig = applyCodexNativeSkillIsolation(mergeCodexThreadConfigs(params.config, userMcpServersConfigPatch, pluginAppsConfigPatch, finalConfigPatch.configPatch), nativeSkillIsolation);
+		const resumeParams = lifecycleTiming.measureSync("thread-resume-params", () => buildThreadResumeParams(params.params, {
+			threadId: resumeBinding.threadId,
+			cwd: params.cwd,
+			authProfileId,
+			model: startModelSelection.model,
+			modelProvider: startModelProvider,
+			preserveNativeModel: resumeBinding.preserveNativeModel === true,
+			appServer: params.appServer,
+			dynamicTools: params.dynamicTools,
+			developerInstructions: params.developerInstructions,
+			config: resumeConfig,
+			nativeCodeModeEnabled: params.nativeCodeModeEnabled,
+			nativeProviderWebSearchSupport: params.nativeProviderWebSearchSupport,
+			nativeCodeModeOnlyEnabled: params.nativeCodeModeOnlyEnabled,
+			webSearchAllowed: params.webSearchAllowed,
+			hostSystemAgentActive,
+			restrictedToolSurfaceInheritedMcpServerNames,
+			shellEnvironment: params.shellEnvironment,
+			disableLoginShell: params.disableLoginShell
+		}));
+		const requestModelProvider = typeof resumeParams.modelProvider === "string" && resumeParams.modelProvider.trim() ? resumeParams.modelProvider : void 0;
+		throwIfAborted();
+		resumeReservation = params.reserveResumeThread?.(resumeBinding.threadId);
+		const response = await lifecycleTiming.measure("thread-resume-request", () => resumeCodexAppServerThread({
+			client: params.client,
+			abandonClient,
+			request: resumeParams,
+			signal: params.signal,
+			assertCurrent: context.assertResumeOwnership
+		}));
+		resumeResponseAccepted = true;
+		assertCodexThreadAcceptsDirectInput(response.thread);
+		context.assertResumeConfiguration();
+		const loadedPluginThreadConfig = await context.buildLoadedPluginThreadConfig?.(resumeBinding);
+		if (loadedPluginThreadConfig && loadedPluginThreadConfig.fingerprint !== (pluginThreadConfig?.fingerprint ?? resumeBinding.pluginAppsFingerprint)) {
+			ordinaryAppConfigChanged = resumeBinding.connectionScope !== "supervision" && !resumeBinding.pendingResumeConfiguration;
+			throw new Error("Codex thread app policy changed; a fresh thread configuration is required");
+		}
+		const provisionalAppIds = loadedPluginThreadConfig?.provisionalAppIds ?? pluginThreadConfig?.provisionalAppIds ?? [];
+		await attestCodexThreadToolSurface({
+			client: params.client,
+			threadId: response.thread.id,
+			appIds: provisionalAppIds,
+			signal: params.signal,
+			threadConfig: resumeParams.config,
+			restrictedToolSurface,
+			lifecycleTiming,
+			assertCurrent: assertHandoffCurrent
+		});
+		throwIfAborted();
+		await refreshCodexThreadPolicy({
+			client: params.client,
+			threadId: resumeBinding.threadId,
+			developerInstructions: resumeParams.developerInstructions,
+			timeoutMs: params.appServer.requestTimeoutMs,
+			signal: params.signal,
+			assertCurrent: assertHandoffCurrent
+		});
+		policyOutcome = "acknowledged";
+		assertHandoffCurrent();
+		const resumePatch = {
+			clientId: resolveCodexAppServerClientInstanceId(params.client),
+			pendingResumeConfiguration: void 0,
+			cwd: params.cwd,
+			rolloutPath: resolveCodexThreadRolloutPath(response.thread) ?? resumeBinding.rolloutPath,
+			authProfileId,
+			model: response.model ?? resumeParams.model ?? params.params.modelId,
+			preserveNativeModel: resumeBinding.preserveNativeModel === true ? true : void 0,
+			modelProvider: normalizeBindingModelProvider(authProfileId, response.modelProvider ?? requestModelProvider ?? startModelProvider),
+			dynamicToolsFingerprint,
+			dynamicToolsContainDeferred,
+			webSearchThreadConfigFingerprint,
+			nativeSkillIsolationFingerprint,
+			userMcpServersFingerprint,
+			mcpServersFingerprint: params.mcpServersFingerprintEvaluated === true ? params.mcpServersFingerprint : resumeBinding.mcpServersFingerprint,
+			configuredMcpOwnershipVersion: params.configuredMcpOwnershipVersion,
+			ringZeroConfigFingerprint,
+			ringZeroClientInstanceId,
+			nativeToolPolicyRestricted: restrictedToolSurface ? true : void 0,
+			networkProxyProfileName: params.appServer.networkProxy?.profileName,
+			networkProxyConfigFingerprint,
+			nativeHookRelayGeneration: finalConfigPatch.nativeHookRelayGeneration ?? resumeBinding.nativeHookRelayGeneration,
+			appServerRuntimeFingerprint: resumeBinding.connectionScope === "supervision" ? buildCodexAppServerConnectionFingerprint(params.appServer, params.params.agentDir) : params.appServerRuntimeFingerprint,
+			pluginAppsFingerprint: pluginThreadConfig?.fingerprint ?? resumeBinding.pluginAppsFingerprint,
+			pluginAppsInputFingerprint: pluginThreadConfig?.inputFingerprint ?? resumeBinding.pluginAppsInputFingerprint,
+			pluginAppPolicyContext: pluginThreadConfig?.policyContext ?? resumeBinding.pluginAppPolicyContext,
+			contextEngine: contextEngineBinding,
+			environmentSelectionFingerprint
+		};
+		if (!await lifecycleTiming.measure("thread-resume-write-binding", () => params.bindingStore.mutate(bindingIdentity, {
+			kind: "patch",
+			threadId: resumeBinding.threadId,
+			patch: resumePatch
+		}, assertHandoffCurrent))) throw new CodexThreadBindingConflictError(resumeBinding.threadId, "committing a resumed thread");
+		assertHandoffCurrent();
+		if (contextEngineBinding) embeddedAgentLog.info("codex app-server wrote context-engine thread binding", {
+			sessionId: params.params.sessionId,
+			sessionKey: params.params.sessionKey,
+			threadId: response.thread.id,
+			engineId: contextEngineBinding.engineId,
+			epoch: contextEngineBinding.projection?.epoch,
+			fingerprint: contextEngineBinding.projection?.fingerprint,
+			action: "resumed"
+		});
+		lifecycleTiming.mark("thread-ready");
+		lifecycleTiming.logSummary({
+			runId: params.params.runId,
+			sessionId: params.params.sessionId,
+			sessionKey: params.params.sessionKey,
+			threadId: response.thread.id,
+			action: "resumed"
+		});
+		const activeTurnIds = readActiveCodexTurnIdsFromResume(response);
+		return {
+			...resumeBinding,
+			threadId: response.thread.id,
+			...resumePatch,
+			liveThreadConfigFingerprint: fingerprintCodexThreadConfig({
+				...resumeParams,
+				model: resumeBinding.preserveNativeModel === true ? null : response.model ?? resumeParams.model ?? null,
+				requestedModel: resumeBinding.preserveNativeModel === true ? null : resumeParams.model ?? null,
+				modelProvider: resumeBinding.preserveNativeModel === true ? null : resumePatch.modelProvider ?? null,
+				requestedModelProvider: resumeBinding.preserveNativeModel === true ? null : resumeParams.modelProvider ?? resumePatch.modelProvider ?? null
+			}, authProfileId, dynamicToolsFingerprint),
+			lifecycle: {
+				action: "resumed",
+				...activeTurnIds.length ? { activeTurnIds } : {}
 			}
-		},
-		onPreToolUseFailure: params.onPreToolUseFailure,
-		command: {
-			nice: 10,
-			timeoutMs: params.options?.gatewayTimeoutMs
+		};
+	} catch (error) {
+		resumeReservation?.release();
+		if (!resumeResponseAccepted && (!(error instanceof CodexAppServerRpcError) || isCodexAppServerOverloadError(error))) throw error;
+		if (resumeResponseAccepted) {
+			const handoffError = error instanceof CodexThreadPolicyHandoffError || error instanceof CodexAppServerUnsafeSubscriptionError ? error : new CodexThreadPolicyHandoffError(policyOutcome, error);
+			const subscriptionReleased = await unsubscribeCodexThreadBestEffort(params.client, {
+				threadId: resumeBinding.threadId,
+				timeoutMs: CODEX_APP_SERVER_UNSUBSCRIBE_TIMEOUT_MS,
+				assertCurrent: context.assertResumeOwnership
+			}).catch(() => false);
+			if (!subscriptionReleased || handoffError instanceof CodexThreadPolicyHandoffError && handoffError.outcome === "unknown") {
+				if (resumeBinding.connectionScope === "supervision") await retireUnsafeCodexTurnClientBestEffort(params.client, "session policy handoff");
+				else try {
+					await abandonClient();
+				} catch (cause) {
+					throw new CodexThreadPolicyHandoffError(handoffError instanceof CodexThreadPolicyHandoffError ? handoffError.outcome : policyOutcome, new AggregateError([handoffError, cause], "Codex thread/resume client could not be retired"));
+				}
+			}
+			if (!ordinaryAppConfigChanged || !subscriptionReleased) throw handoffError;
+			assertHandoffCurrent();
+		}
+		if (resumeBinding.pendingResumeConfiguration || resumeBinding.connectionScope === "supervision" || params.signal?.aborted) throw error;
+		embeddedAgentLog.warn("codex app-server thread resume failed; starting a new thread", { error });
+		await clearCurrentBinding("rotating a stale thread binding");
+	}
+}
+async function startFreshCodexThread(params, context) {
+	const clientId = resolveCodexAppServerClientInstanceId(params.client);
+	const { bindingIdentity, startModelSelection, startModelProvider, userMcpServersConfigPatch, dynamicToolsFingerprint, dynamicToolsContainDeferred, webSearchThreadConfigFingerprint, nativeSkillIsolationFingerprint, userMcpServersFingerprint, ringZeroConfigFingerprint, ringZeroClientInstanceId, networkProxyConfigFingerprint, contextEngineBinding, environmentSelectionFingerprint, hostSystemAgentActive, restrictedToolSurface, restrictedToolSurfaceInheritedMcpServerNames, nativeSkillIsolation, lifecycleTiming, normalizeBindingModelProvider, throwIfAborted, prebuiltPluginThreadConfig, preserveExistingBinding, rotatedContextEngineBinding, replacementPredecessor } = context;
+	const pluginThreadConfig = params.pluginThreadConfig?.enabled ? prebuiltPluginThreadConfig ?? await lifecycleTiming.measure("plugin-config-build", () => params.pluginThreadConfig?.build()) : void 0;
+	const finalConfigPatch = params.buildFinalConfigPatch?.({ action: "start" }) ?? {
+		configPatch: params.finalConfigPatch,
+		nativeHookRelayGeneration: params.nativeHookRelayGeneration
+	};
+	const config = lifecycleTiming.measureSync("merge-thread-config", () => applyCodexNativeSkillIsolation(mergeCodexThreadConfigs(params.config, userMcpServersConfigPatch, pluginThreadConfig?.configPatch, finalConfigPatch.configPatch), nativeSkillIsolation));
+	const startParams = lifecycleTiming.measureSync("thread-start-params", () => buildThreadStartParams(params.params, {
+		cwd: params.cwd,
+		dynamicTools: params.dynamicTools,
+		appServer: params.appServer,
+		developerInstructions: params.developerInstructions,
+		config,
+		nativeCodeModeEnabled: params.nativeCodeModeEnabled,
+		nativeProviderWebSearchSupport: params.nativeProviderWebSearchSupport,
+		nativeCodeModeOnlyEnabled: params.nativeCodeModeOnlyEnabled,
+		webSearchAllowed: params.webSearchAllowed,
+		environmentSelection: params.environmentSelection,
+		model: startModelSelection.model,
+		modelProvider: startModelProvider,
+		hostSystemAgentActive,
+		restrictedToolSurfaceInheritedMcpServerNames,
+		shellEnvironment: params.shellEnvironment,
+		disableLoginShell: params.disableLoginShell
+	}));
+	const requestModelProvider = typeof startParams.modelProvider === "string" && startParams.modelProvider.trim() ? startParams.modelProvider : void 0;
+	const threadStartResponse = await lifecycleTiming.measure("thread-start-request", async () => {
+		try {
+			return await params.client.request("thread/start", startParams, { signal: params.signal });
+		} catch (error) {
+			if (error instanceof CodexAppServerRpcError) throw new CodexThreadStartRequestError(error);
+			throw error;
 		}
 	});
-	const unregister = () => {
-		foregroundClosed = true;
-		rejectPendingAdmissions("native hook relay foreground closed");
-		relay.unregister();
+	const response = assertCodexThreadStartResponse(threadStartResponse);
+	const provisionalAppIds = pluginThreadConfig?.provisionalAppIds;
+	const assertCurrent = () => {
+		throwIfAborted();
+		params.params.hostCapabilities.assertActive();
 	};
-	return {
-		...relay,
-		unregister,
-		authorizeRetentionAfterSuccessfulYield: () => {
-			successfulYieldRetentionAuthorized = true;
-		},
-		hasClaimedDirectChild: () => directChildClaims.size > 0,
-		rejectPendingDirectChild: (threadIdInput, reason) => {
-			const threadId = threadIdInput.trim();
-			const pending = threadId ? pendingDirectChildAdmissions.get(threadId) : void 0;
-			if (!pending) return;
-			pendingDirectChildAdmissions.delete(threadId);
-			pending.reject(new Error(reason));
-		},
-		claimDirectChild: (threadIdInput) => {
-			const threadId = threadIdInput.trim();
-			if (!threadId) return () => void 0;
-			if (directChildClaims.get(threadId)) return () => void 0;
-			const claim = Symbol(threadId);
-			directChildClaims.set(threadId, claim);
-			const pending = pendingDirectChildAdmissions.get(threadId);
-			pendingDirectChildAdmissions.delete(threadId);
-			pending?.resolve(claim);
-			let released = false;
-			return () => {
-				if (released) return;
-				released = true;
-				if (directChildClaims.get(threadId) !== claim) return;
-				directChildClaims.delete(threadId);
-				if (foregroundClosed && directChildClaims.size === 0) relay.unregister();
-			};
+	const rejectUncommittedThread = async (cause) => {
+		if (!await discardUnattestedCodexPluginThread({
+			client: params.client,
+			threadId: response.thread.id,
+			ephemeral: startParams.ephemeral === true
+		})) {
+			await (params.abandonClient ?? (() => closeCodexStartupClientBestEffort(params.client)))();
+			throw new CodexAppServerUnsafeSubscriptionError("Codex uncommitted thread cleanup failed", { cause });
 		}
+		throw cause;
 	};
-}
-function readCodexNativeChildThreadId(rawPayload) {
-	if (!isJsonObject(rawPayload) || typeof rawPayload.agent_id !== "string") return;
-	return rawPayload.agent_id.trim() || void 0;
-}
-/** Selects the native hook events Codex should install for the current approval mode. */
-function resolveCodexNativeHookRelayEvents(params) {
-	if (params.configuredEvents?.length) return params.configuredEvents;
-	return params.appServer.approvalPolicy === "never" ? CODEX_NATIVE_HOOK_RELAY_EVENTS : CODEX_NATIVE_HOOK_RELAY_EVENTS_WITH_APP_SERVER_APPROVALS;
-}
-/** Derives the native hook relay TTL from the turn budget unless explicitly configured. */
-function resolveCodexNativeHookRelayTtlMs(params) {
-	if (params.explicitTtlMs !== void 0) return params.explicitTtlMs;
-	const relayBudgetMs = params.attemptTimeoutMs + params.startupTimeoutMs + params.turnStartTimeoutMs + CODEX_NATIVE_HOOK_RELAY_TTL_GRACE_MS;
-	return Math.max(CODEX_NATIVE_HOOK_RELAY_MIN_TTL_MS, Math.floor(relayBudgetMs));
-}
-/** Builds a stable relay id scoped to the agent and session identity. */
-function buildCodexNativeHookRelayId(params) {
-	const hash = createHash("sha256");
-	hash.update("openclaw:codex:native-hook-relay:v1");
-	hash.update("\0");
-	hash.update(params.agentId?.trim() || "");
-	hash.update("\0");
-	hash.update(params.sessionKey?.trim() || params.sessionId);
-	return `codex-${hash.digest("hex").slice(0, 40)}`;
-}
-const CODEX_HOOK_EVENT_BY_NATIVE_EVENT = {
-	pre_tool_use: "PreToolUse",
-	post_tool_use: "PostToolUse",
-	permission_request: "PermissionRequest",
-	before_agent_finalize: "Stop"
-};
-const CODEX_HOOK_KEY_LABEL_BY_NATIVE_EVENT = {
-	pre_tool_use: "pre_tool_use",
-	post_tool_use: "post_tool_use",
-	permission_request: "permission_request",
-	before_agent_finalize: "stop"
-};
-const CODEX_SESSION_FLAGS_HOOK_SOURCE_PATHS = ["/<session-flags>/config.toml", "<session-flags>/config.toml"];
-/** Builds the Codex config overlay that installs trusted command hooks for relay events. */
-function buildCodexNativeHookRelayConfig(params) {
-	const events = params.events?.length ? params.events : CODEX_NATIVE_HOOK_RELAY_EVENTS;
-	const selectedEvents = new Set(events);
-	const config = { "features.hooks": true };
-	const hookState = {};
-	for (const event of CODEX_NATIVE_HOOK_RELAY_EVENTS) {
-		const codexEvent = CODEX_HOOK_EVENT_BY_NATIVE_EVENT[event];
-		const selected = selectedEvents.has(event);
-		const shouldRelay = params.relay.shouldRelayEvent(event);
-		if (!selected || !shouldRelay) {
-			if (selected || params.clearOmittedEvents) config[`hooks.${codexEvent}`] = [];
-			if (params.clearOmittedEvents) for (const sourcePath of CODEX_SESSION_FLAGS_HOOK_SOURCE_PATHS) hookState[`${sourcePath}:${CODEX_HOOK_KEY_LABEL_BY_NATIVE_EVENT[event]}:0:0`] = { enabled: false };
-			continue;
-		}
-		const timeout = normalizeHookTimeoutSec(params.hookTimeoutSec);
-		const command = params.relay.commandForEvent(event, { timeoutMs: resolveCodexNativeHookRelayCommandTimeoutMs(timeout) });
-		const matcher = buildCodexNativeToolMatcher(params.relay.toolMatcherForEvent(event));
-		config[`hooks.${codexEvent}`] = [{
-			...matcher ? { matcher } : {},
-			hooks: [{
-				type: "command",
-				command,
-				timeout,
-				async: false,
-				statusMessage: "OpenClaw native hook relay"
-			}]
-		}];
-		const state = {
-			enabled: true,
-			trusted_hash: codexCommandHookTrustedHash({
-				event,
-				command,
-				matcher,
-				timeout,
-				statusMessage: "OpenClaw native hook relay"
-			})
+	try {
+		await attestCodexThreadToolSurface({
+			client: params.client,
+			threadId: response.thread.id,
+			appIds: provisionalAppIds ?? [],
+			signal: params.signal,
+			threadConfig: startParams.config,
+			restrictedToolSurface,
+			lifecycleTiming,
+			assertCurrent
+		});
+		assertCurrent();
+	} catch (error) {
+		return await rejectUncommittedThread(error);
+	}
+	const rolloutPath = resolveCodexThreadRolloutPath(response.thread);
+	const modelProvider = resolveCodexAppServerModelProvider({
+		provider: params.params.provider,
+		authProfileId: params.params.authProfileId,
+		authProfileStore: params.params.authProfileStore,
+		agentDir: params.params.agentDir,
+		config: params.params.config
+	});
+	const bindingModelProvider = normalizeBindingModelProvider(params.params.authProfileId, response.modelProvider ?? requestModelProvider ?? startModelProvider ?? modelProvider);
+	const nextMcpServersFingerprint = params.mcpServersFingerprintEvaluated === true ? params.mcpServersFingerprint : void 0;
+	if (!preserveExistingBinding) {
+		const nextBinding = {
+			threadId: response.thread.id,
+			...clientId ? { clientId } : {},
+			cwd: params.cwd,
+			...rolloutPath ? { rolloutPath } : {},
+			authProfileId: params.params.authProfileId,
+			agentWorkspaceDeveloperInstructions: params.agentWorkspaceDeveloperInstructions,
+			model: response.model ?? startParams.model ?? params.params.modelId,
+			modelProvider: bindingModelProvider,
+			dynamicToolsFingerprint,
+			dynamicToolsContainDeferred,
+			webSearchThreadConfigFingerprint,
+			nativeSkillIsolationFingerprint,
+			userMcpServersFingerprint,
+			mcpServersFingerprint: nextMcpServersFingerprint,
+			configuredMcpOwnershipVersion: params.configuredMcpOwnershipVersion,
+			ringZeroConfigFingerprint,
+			ringZeroClientInstanceId,
+			nativeToolPolicyRestricted: restrictedToolSurface ? true : void 0,
+			networkProxyProfileName: params.appServer.networkProxy?.profileName,
+			networkProxyConfigFingerprint,
+			nativeHookRelayGeneration: finalConfigPatch.nativeHookRelayGeneration,
+			appServerRuntimeFingerprint: params.appServerRuntimeFingerprint,
+			pluginAppsFingerprint: pluginThreadConfig?.fingerprint,
+			pluginAppsInputFingerprint: pluginThreadConfig?.inputFingerprint,
+			pluginAppPolicyContext: pluginThreadConfig?.policyContext,
+			contextEngine: contextEngineBinding,
+			environmentSelectionFingerprint
 		};
-		for (const sourcePath of CODEX_SESSION_FLAGS_HOOK_SOURCE_PATHS) hookState[`${sourcePath}:${CODEX_HOOK_KEY_LABEL_BY_NATIVE_EVENT[event]}:0:0`] = state;
+		const managedSourceHomeId = codexCatalogHomeId(resolveCodexAppServerLocalHomeDir(params.appServer.start, resolveCodexThreadAgentDir(params)));
+		let committed;
+		try {
+			await lifecycleTiming.measure("thread-start-mark-managed", () => markStartedCodexManagedThread(params.bindingStore.managedThreads, {
+				sourceHomeId: managedSourceHomeId,
+				threadId: response.thread.id,
+				...rolloutPath ? { rolloutPath } : {}
+			}));
+			committed = await lifecycleTiming.measure("thread-start-write-binding", () => params.bindingStore.mutate(bindingIdentity, replacementPredecessor ? {
+				kind: "replace-thread",
+				expectedThreadId: replacementPredecessor.threadId,
+				binding: nextBinding
+			} : {
+				kind: "set",
+				if: { kind: "absent" },
+				binding: nextBinding
+			}, assertCurrent));
+		} catch (error) {
+			return await rejectUncommittedThread(error);
+		}
+		if (!committed) return await rejectUncommittedThread(new CodexThreadBindingConflictError(replacementPredecessor?.threadId ?? response.thread.id, "committing a fresh thread"));
+		if (contextEngineBinding) embeddedAgentLog.info("codex app-server wrote context-engine thread binding", {
+			sessionId: params.params.sessionId,
+			sessionKey: params.params.sessionKey,
+			threadId: response.thread.id,
+			engineId: contextEngineBinding.engineId,
+			epoch: contextEngineBinding.projection?.epoch,
+			fingerprint: contextEngineBinding.projection?.fingerprint,
+			action: rotatedContextEngineBinding ? "rotated" : "started"
+		});
 	}
-	config["hooks.state"] = hookState;
-	return config;
+	lifecycleTiming.mark("thread-ready");
+	lifecycleTiming.logSummary({
+		runId: params.params.runId,
+		sessionId: params.params.sessionId,
+		sessionKey: params.params.sessionKey,
+		threadId: response.thread.id,
+		action: rotatedContextEngineBinding ? "rotated" : "started"
+	});
+	return buildStartedCodexThreadBinding({
+		bindingModelProvider,
+		clientId,
+		context,
+		finalConfigPatch,
+		nextMcpServersFingerprint,
+		params,
+		pluginThreadConfig,
+		response,
+		rolloutPath,
+		startModelProvider: requestModelProvider ?? startModelProvider,
+		startParams,
+		modelProvider
+	});
 }
-/** Builds a Codex config overlay that disables native hooks and clears hook arrays. */
-function buildCodexNativeHookRelayDisabledConfig() {
-	return {
-		"features.hooks": false,
-		"hooks.PreToolUse": [],
-		"hooks.PostToolUse": [],
-		"hooks.PermissionRequest": [],
-		"hooks.Stop": []
-	};
+//#endregion
+//#region extensions/codex/src/app-server/thread-lifecycle-warm.ts
+/** Preserves the caller's abort reason across thread ownership transitions. */
+function throwIfCodexThreadLifecycleAborted(signal) {
+	if (!signal?.aborted) return;
+	const reason = signal.reason;
+	if (reason instanceof Error) throw reason;
+	const error = new Error(typeof reason === "string" && reason.length > 0 ? reason : "codex app-server thread lifecycle aborted");
+	error.name = "AbortError";
+	throw error;
 }
-function normalizeHookTimeoutSec(value) {
-	return typeof value === "number" && Number.isFinite(value) && value > 0 ? Math.ceil(value) : CODEX_NATIVE_HOOK_RELAY_DEFAULT_TIMEOUT_SEC;
+/** Releases consumed subscription ownership or retires an unsafe client. */
+async function releaseCodexConsumedLiveThread(options) {
+	if (await options.lifecycleTiming.measure("retained-thread-unsubscribe", () => unsubscribeCodexThreadBestEffort(options.client, {
+		threadId: options.threadId,
+		timeoutMs: 5e3,
+		assertCurrent: options.assertCurrent
+	}))) return;
+	return await abandonCodexLiveThreadRelease(options, options.cause);
+}
+async function abandonCodexLiveThreadRelease(options, cause) {
+	options.assertCurrent?.();
+	await (options.abandonClient ?? (() => closeCodexStartupClientBestEffort(options.client)))();
+	throw new CodexAppServerUnsafeSubscriptionError(`Codex retained thread subscription could not be released: ${options.threadId}`, cause !== void 0 ? { cause } : void 0);
 }
-function resolveCodexNativeHookRelayCommandTimeoutMs(hookTimeoutSec) {
-	const parentTimeoutMs = finiteSecondsToTimerSafeMilliseconds(normalizeHookTimeoutSec(hookTimeoutSec)) ?? 5e3;
-	const parentMarginMs = Math.min(CODEX_NATIVE_HOOK_RELAY_COMMAND_MAX_PARENT_MARGIN_MS, Math.max(CODEX_NATIVE_HOOK_RELAY_COMMAND_MIN_PARENT_MARGIN_MS, Math.floor(parentTimeoutMs / 5)));
-	return Math.max(1, parentTimeoutMs - parentMarginMs);
+/** Releases through the retained owner, preserving its guarded callback and rollback. */
+async function releaseCodexRetainedLiveThread(options) {
+	try {
+		return await options.lifecycleTiming.measure("retained-thread-unsubscribe", () => releaseCodexAppServerLiveThread(options.client, options.threadId, options.assertCurrent));
+	} catch (error) {
+		if (isCodexAppServerUnsafeSubscriptionError(error)) throw error;
+		return await abandonCodexLiveThreadRelease(options, error);
+	}
 }
-function buildCodexNativeToolMatcher(toolNames) {
-	if (toolNames === void 0) return;
-	if (toolNames.length === 0) throw new TypeError("Codex native hook matcher requires at least one tool name");
-	const nativeNames = /* @__PURE__ */ new Set();
-	let hasCustomToolName = false;
-	for (const toolName of toolNames) {
-		const canonicalToolName = toolName.trim();
-		if (!canonicalToolName || canonicalToolName === "*") throw new TypeError("Codex native hook matcher requires canonical OpenClaw tool ids");
-		const nativeAliases = CODEX_HOOK_MATCHER_NAMES_BY_TOOL_ID[canonicalToolName];
-		if (!nativeAliases) hasCustomToolName = true;
-		for (const nativeName of nativeAliases ?? [canonicalToolName]) nativeNames.add(nativeName);
+/** Release follows the physical owner across connection rotation, never a copied thread id. */
+async function releaseCodexBoundLiveThread(options) {
+	const changedClient = options.ownerClientId && options.ownerClientId !== options.clientId;
+	const previous = changedClient ? retainSharedCodexAppServerClientByInstanceId(options.ownerClientId) : void 0;
+	if (changedClient && !previous) return false;
+	try {
+		const client = previous?.client ?? options.client;
+		const assertPrevious = previous && options.assertCurrent ? captureCodexAppServerClientLifetime(client, "connection") : void 0;
+		if (isCodexAppServerLiveThreadClaimed(client, options.threadId)) throw new Error(`Codex thread ${options.threadId} is claimed by active work; stop it first.`);
+		return await releaseCodexRetainedLiveThread({
+			...options,
+			client,
+			abandonClient: previous ? void 0 : options.abandonClient,
+			assertCurrent: options.assertCurrent ? () => {
+				options.assertCurrent?.();
+				assertPrevious?.();
+			} : void 0
+		});
+	} finally {
+		previous?.release();
 	}
-	const sortedNames = Array.from(nativeNames).toSorted();
-	if (!hasCustomToolName && sortedNames.every((toolName) => /^[A-Za-z0-9_]+$/.test(toolName))) return sortedNames.join("|");
-	return `(?i)^(?:${sortedNames.map((toolName) => toolName.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|")})$`;
 }
-function codexCommandHookTrustedHash(params) {
-	const identity = {
-		event_name: CODEX_HOOK_KEY_LABEL_BY_NATIVE_EVENT[params.event],
-		...params.matcher ? { matcher: params.matcher } : {},
-		hooks: [{
-			async: false,
-			command: params.command,
-			statusMessage: params.statusMessage,
-			timeout: params.timeout,
-			type: "command"
-		}]
+/** Reuses one safely owned, fully matching subscription on its original client. */
+async function tryReuseCodexLiveThread(options) {
+	const { params, binding, bindingIdentity, clientId, dynamicToolsFingerprint, environmentSelectionFingerprint, hostSystemAgentActive, lifecycleTiming, nativeSkillIsolation, ringZeroActive, restrictedToolSurface, restrictedToolSurfaceInheritedMcpServerNames, startModelProvider, startModelSelection, throwIfAborted, userMcpServersConfigPatch } = options;
+	const incognito = isIncognitoSessionKey(params.params.sessionKey);
+	if (incognito && (binding.preserveNativeModel || binding.connectionScope === "supervision")) {
+		if (binding.clientId === clientId && binding.clientId && ((await options.buildLoadedPluginThreadConfig(binding))?.fingerprint ?? binding.pluginAppsFingerprint) === binding.pluginAppsFingerprint) {
+			params.buildFinalConfigPatch?.({
+				action: "resume",
+				binding
+			});
+			throwIfAborted();
+			return {
+				kind: "ready",
+				binding: {
+					...binding,
+					lifecycle: { action: "resumed" }
+				}
+			};
+		}
+		return { kind: "rotate" };
+	}
+	if (!binding.clientId || binding.clientId !== clientId || binding.preserveNativeModel === true || binding.connectionScope === "supervision" || ringZeroActive && !incognito) return { kind: "resume" };
+	const retainedThread = await consumeCodexAppServerLiveThread(params.client, binding.threadId);
+	if (!retainedThread) return { kind: "resume" };
+	const assertWarmOwner = () => {
+		throwIfAborted();
+		if (!isCodexAppServerClientRuntimeLive(params.client)) throw params.client.getCloseError() ?? /* @__PURE__ */ new Error("codex app-server client is closed");
+		try {
+			retainedThread.assertCurrent();
+			params.params.hostCapabilities.assertActive();
+		} catch (cause) {
+			throw new AgentHarnessPreflightError("Codex warm thread ownership changed before this turn could run. No turn was sent; reconnect before continuing, or start a new conversation if the original thread was closed.", { cause });
+		}
 	};
-	return `sha256:${createHash("sha256").update(JSON.stringify(sortJsonValue(identity))).digest("hex")}`;
-}
-function sortJsonValue(value) {
-	if (!value || typeof value !== "object") return value;
-	if (Array.isArray(value)) return value.map(sortJsonValue);
-	const sorted = {};
-	for (const [key, entry] of Object.entries(value).toSorted(([left], [right]) => left.localeCompare(right))) sorted[key] = sortJsonValue(entry);
-	return sorted;
+	let ownershipTransferred = false;
+	let preserveSubscription = false;
+	try {
+		assertWarmOwner();
+		const pluginThreadConfig = await options.buildLoadedPluginThreadConfig(binding);
+		assertWarmOwner();
+		if (pluginThreadConfig && pluginThreadConfig.fingerprint !== binding.pluginAppsFingerprint) return { kind: "rotate" };
+		const prebuiltFinalConfigPatch = params.buildFinalConfigPatch?.({
+			action: "resume",
+			binding
+		}) ?? {
+			configPatch: params.finalConfigPatch,
+			nativeHookRelayGeneration: params.nativeHookRelayGeneration
+		};
+		const pluginAppsConfigPatch = pluginThreadConfig?.configPatch ?? (params.pluginThreadConfig?.enabled && binding.pluginAppPolicyContext ? buildCodexPluginAppsConfigPatchFromPolicyContext(binding.pluginAppPolicyContext) : void 0);
+		const resumeAuthProfileId = params.params.authProfileId ?? binding.authProfileId;
+		const resumeConfig = mergeCodexThreadConfigs(params.config, userMcpServersConfigPatch, pluginAppsConfigPatch, prebuiltFinalConfigPatch.configPatch);
+		const resumeParams = lifecycleTiming.measureSync("warm-thread-resume-params", () => buildThreadResumeParams(params.params, {
+			threadId: binding.threadId,
+			cwd: params.cwd,
+			authProfileId: resumeAuthProfileId,
+			model: startModelSelection.model,
+			modelProvider: startModelProvider,
+			preserveNativeModel: false,
+			appServer: params.appServer,
+			dynamicTools: params.dynamicTools,
+			developerInstructions: params.developerInstructions,
+			config: applyCodexNativeSkillIsolation(resumeConfig, nativeSkillIsolation),
+			nativeCodeModeEnabled: params.nativeCodeModeEnabled,
+			nativeProviderWebSearchSupport: params.nativeProviderWebSearchSupport,
+			nativeCodeModeOnlyEnabled: params.nativeCodeModeOnlyEnabled,
+			webSearchAllowed: params.webSearchAllowed,
+			hostSystemAgentActive,
+			restrictedToolSurfaceInheritedMcpServerNames,
+			shellEnvironment: params.shellEnvironment,
+			disableLoginShell: params.disableLoginShell
+		}));
+		const liveThreadConfigFingerprint = incognito ? retainedThread.configFingerprint : fingerprintCodexThreadConfig({
+			...resumeParams,
+			model: binding.model ?? resumeParams.model ?? null,
+			requestedModel: resumeParams.model ?? null,
+			modelProvider: binding.modelProvider ?? resumeParams.modelProvider ?? null,
+			requestedModelProvider: resumeParams.modelProvider ?? binding.modelProvider ?? null
+		}, resumeAuthProfileId, dynamicToolsFingerprint);
+		if (incognito && retainedThread.ephemeralPolicy !== resumeParams.developerInstructions) {
+			preserveSubscription = true;
+			throw new CodexIncognitoPolicyChangeError();
+		}
+		if (!incognito && retainedThread.configFingerprint !== liveThreadConfigFingerprint) {
+			preserveSubscription = true;
+			return {
+				kind: "resume",
+				prebuiltFinalConfigPatch
+			};
+		}
+		await attestCodexThreadToolSurface({
+			client: params.client,
+			threadId: binding.threadId,
+			appIds: pluginThreadConfig?.provisionalAppIds ?? [],
+			signal: params.signal,
+			threadConfig: resumeParams.config,
+			restrictedToolSurface,
+			lifecycleTiming,
+			assertCurrent: assertWarmOwner
+		});
+		assertWarmOwner();
+		const nativeHookRelayGeneration = prebuiltFinalConfigPatch.nativeHookRelayGeneration ?? binding.nativeHookRelayGeneration;
+		const model = startModelSelection.model;
+		if (!(incognito || await lifecycleTiming.measure("warm-thread-write-binding", () => params.bindingStore.mutate(bindingIdentity, {
+			kind: "patch",
+			threadId: binding.threadId,
+			patch: {
+				cwd: params.cwd,
+				model,
+				nativeHookRelayGeneration,
+				environmentSelectionFingerprint
+			}
+		}, assertWarmOwner)))) throw new CodexThreadBindingConflictError(binding.threadId, "committing a reused thread");
+		assertWarmOwner();
+		lifecycleTiming.mark("thread-ready");
+		lifecycleTiming.logSummary({
+			runId: params.params.runId,
+			sessionId: params.params.sessionId,
+			sessionKey: params.params.sessionKey,
+			threadId: binding.threadId,
+			action: "resumed"
+		});
+		ownershipTransferred = true;
+		return {
+			kind: "ready",
+			binding: {
+				...binding,
+				...!incognito ? {
+					cwd: params.cwd,
+					model,
+					nativeHookRelayGeneration,
+					environmentSelectionFingerprint
+				} : {},
+				liveThreadConfigFingerprint,
+				liveThreadEphemeralPolicy: retainedThread.ephemeralPolicy,
+				liveThreadOwnership: retainedThread,
+				...!incognito && retainedThread.serviceTier && resumeParams.serviceTier === void 0 ? { clearInheritedServiceTier: true } : {},
+				lifecycle: { action: "resumed" }
+			}
+		};
+	} finally {
+		if (!ownershipTransferred) {
+			let failure;
+			try {
+				if (preserveSubscription) {
+					if (!await retainCodexAppServerBindingSubscription(params.client, binding.threadId, retainedThread)) failure = { cause: /* @__PURE__ */ new Error("Codex live thread ownership could not be returned to its session") };
+				} else await retainedThread.release(binding.threadId);
+			} catch (cause) {
+				failure = { cause };
+			}
+			if (failure) await abandonCodexLiveThreadRelease({
+				client: params.client,
+				abandonClient: params.abandonClient,
+				lifecycleTiming,
+				threadId: binding.threadId
+			}, failure.cause);
+		}
+	}
 }
 //#endregion
-//#region extensions/codex/src/app-server/profiler-flag.ts
-const PROFILER_FLAGS = ["profiler", "codex.profiler"];
-/** Checks the generic and Codex-specific profiler diagnostic flags. */
-function isCodexAppServerProfilerEnabled(config, env = process.env) {
-	return PROFILER_FLAGS.some((flag) => isDiagnosticFlagEnabled(flag, config, env));
+//#region extensions/codex/src/app-server/thread-lifecycle-adoption.ts
+/** Passive refusal must precede releasing or acquiring any native subscription. */
+async function assertAdoptedCodexThreadResumeAllowed(params, threadId, context) {
+	const { thread } = await context.lifecycleTiming.measure("thread-read-adoption-status", () => params.client.request("thread/read", {
+		threadId,
+		includeTurns: false
+	}, { signal: params.signal }));
+	context.throwIfAborted();
+	assertCodexThreadAcceptsDirectInput(thread);
+	if (thread.status?.type === "active") throw new CodexAdoptedThreadActiveError();
+	if (thread.id !== threadId) throw new Error("Codex returned another thread during adoption status read");
+	return thread;
 }
-//#endregion
-//#region extensions/codex/src/app-server/thread-lifecycle-timing.ts
-const CODEX_THREAD_LIFECYCLE_TIMING_WARN_TOTAL_MS = 1e3;
-const CODEX_THREAD_LIFECYCLE_TIMING_WARN_STAGE_MS = 500;
-function shouldWarnCodexThreadLifecycleTimingSummary(summary, options = {}) {
-	const totalThresholdMs = options.totalThresholdMs ?? CODEX_THREAD_LIFECYCLE_TIMING_WARN_TOTAL_MS;
-	const stageThresholdMs = options.stageThresholdMs ?? CODEX_THREAD_LIFECYCLE_TIMING_WARN_STAGE_MS;
-	return summary.totalMs >= totalThresholdMs || summary.spans.some((span) => span.durationMs >= stageThresholdMs);
+/** All bound preparation follows attach's native-queue-before-binding-lease order. */
+async function withCodexThreadLifecycleBinding(params, run) {
+	const identity = sessionBindingIdentity({
+		sessionId: params.params.sessionId,
+		sessionKey: params.params.sessionKey,
+		agentId: params.agentId ?? params.params.agentId,
+		config: params.params.config
+	});
+	const snapshot = await params.bindingStore.read(identity);
+	const runWithLease = () => params.bindingStore.withLease(identity, async () => {
+		const binding = await params.bindingStore.read(identity);
+		if (binding?.threadId !== snapshot?.threadId || binding?.clientId !== snapshot?.clientId) throw new CodexThreadBindingConflictError(binding?.threadId ?? snapshot?.threadId ?? params.params.sessionId, "acquiring thread lifecycle ownership");
+		params.params.hostCapabilities.assertActive();
+		params.signal?.throwIfAborted();
+		return await run(identity, binding);
+	});
+	return snapshot?.pendingResumeConfiguration ? await withExclusiveCodexAppServerThread({
+		bindingStore: params.bindingStore,
+		identity,
+		threadId: snapshot.threadId,
+		run: runWithLease
+	}) : snapshot ? await withCodexAppServerThreadMutation(snapshot.threadId, runWithLease) : await runWithLease();
 }
-function formatCodexThreadLifecycleTimingSummary(params) {
-	const spans = params.summary.spans.length > 0 ? params.summary.spans.map((span) => `${span.name}:${span.durationMs}ms@${span.elapsedMs}ms`).join(",") : "none";
-	return `[trace:codex-app-server] thread lifecycle: runId=${params.runId} sessionId=${params.sessionId} sessionKey=${params.sessionKey ?? "unknown"} action=${params.action} totalMs=${params.summary.totalMs} stages=${spans}`;
+/** Completes manual attachment only under the native queue and exact binding lease. */
+async function resumePendingCodexThread(params, context) {
+	const { binding, contextEngineBinding, lifecycleTiming, restrictedToolSurface } = context;
+	if (isIncognitoSessionKey(params.params.sessionKey) || context.transientRestriction || !restrictedToolSurface && binding.nativeToolPolicyRestricted === true || (contextEngineBinding ? !isContextEngineBindingCompatible(binding.contextEngine, contextEngineBinding) : binding.contextEngine !== void 0) || shouldRotateCodexGpt56MultiAgentBinding({
+		bindingModel: binding.model,
+		requestedModel: params.params.modelId
+	})) throw new Error(`Cannot configure resumed Codex thread ${binding.threadId} under a transient or incompatible session policy. The thread is preserved; retry from its normal session or use /new for the current policy.`);
+	const prebuiltPluginThreadConfig = params.pluginThreadConfig?.enabled ? await lifecycleTiming.measure("plugin-config-build", () => params.pluginThreadConfig?.build()) : void 0;
+	const clientId = resolveCodexAppServerClientInstanceId(params.client);
+	const configuration = await preparePendingCodexThreadResume(params, binding, context.dynamicToolsFingerprint, async (assertCurrent) => {
+		const released = await context.releaseRetainedThread(binding.threadId, assertCurrent);
+		assertCurrent();
+		if (!released || binding.clientId && binding.clientId !== clientId) await releaseCodexConsumedLiveThread({
+			client: params.client,
+			abandonClient: params.abandonClient,
+			lifecycleTiming,
+			threadId: binding.threadId,
+			assertCurrent
+		});
+	});
+	try {
+		const resumed = await resumeExistingCodexThread(params, {
+			...context,
+			prebuiltPluginThreadConfig,
+			assertResumeConfiguration: configuration.assertConfigured,
+			assertResumeOwnership: configuration.assertCurrent
+		});
+		if (!resumed) throw new Error(`Codex did not configure resumed thread ${binding.threadId}.`);
+		return resumed;
+	} finally {
+		configuration.dispose();
+	}
+}
+/** Manual attachment is intent, never evidence that loaded native overrides took effect. */
+async function preparePendingCodexThreadResume(params, binding, dynamicToolsFingerprint, releaseSubscription) {
+	const fail = (reason) => /* @__PURE__ */ new Error(`Cannot configure resumed Codex thread ${binding.threadId}: ${reason}. The thread is preserved; continue it in native Codex or use /new for the current OpenClaw tools.`);
+	const agentDir = resolveCodexThreadAgentDir(params);
+	const localHome = resolveCodexAppServerLocalHomeDir(params.appServer.start, agentDir);
+	if (params.appServer.start.transport !== "stdio" || params.appServer.start.homeScope === "user" || path.resolve(localHome) !== resolveCodexAppServerHomeDir(agentDir) || binding.connectionScope === "supervision" || binding.preserveNativeModel === true) throw fail("configuration adoption requires an OpenClaw-owned local Codex home");
+	if (isCodexAppServerLiveThreadClaimed(params.client, binding.threadId)) throw fail("the thread is claimed by active work; stop that run before resuming");
+	const assertClient = captureCodexAppServerClientLifetime(params.client, "native-process");
+	const assertCurrent = () => {
+		params.params.hostCapabilities.assertActive();
+		params.signal?.throwIfAborted();
+		assertClient();
+		if (isCodexAppServerLiveThreadClaimed(params.client, binding.threadId)) throw new CodexAdoptedThreadActiveError();
+	};
+	assertCurrent();
+	const { thread } = await params.client.request("thread/read", {
+		threadId: binding.threadId,
+		includeTurns: false
+	}, { signal: params.signal });
+	assertCurrent();
+	const statusType = thread.status?.type;
+	if (thread.id !== binding.threadId || statusType !== "idle" && statusType !== "notLoaded") throw fail("the native thread is not idle; wait for its current run to finish");
+	assertCodexThreadAcceptsDirectInput(thread);
+	const observation = observeCodexThreadConfiguration(params, thread, assertCurrent);
+	const dispose = observation.dispose;
+	try {
+		const rolloutPath = thread.path ?? binding.rolloutPath;
+		const metadata = rolloutPath ? await readCodexSessionMeta(path.join(localHome, "sessions"), rolloutPath, binding.threadId) : void 0;
+		if (!metadata) throw fail("its native tool catalog could not be read from the selected Codex home");
+		const recordedTools = metadata.dynamic_tools ?? [];
+		if (!Array.isArray(recordedTools) || codexDynamicToolsFingerprint(recordedTools) !== dynamicToolsFingerprint) throw fail("its immutable native tool catalog does not match the current OpenClaw tools");
+		assertCurrent();
+		await releaseSubscription(assertCurrent);
+		assertCurrent();
+		return {
+			assertConfigured: observation.assertConfigured,
+			assertCurrent,
+			dispose
+		};
+	} catch (error) {
+		dispose();
+		throw error;
+	}
 }
-function createCodexThreadLifecycleTimingTracker(options = {}) {
-	const log = options.log ?? embeddedAgentLog;
-	if (!options.enabled && log.isEnabled?.("trace") !== true) return {
-		async measure(_name, run) {
-			return await run();
-		},
-		measureSync(_name, run) {
-			return run();
-		},
-		mark() {},
-		logSummary() {}
-	};
-	const now = options.now ?? Date.now;
-	const startedAt = now();
-	let didLog = false;
-	const spans = [];
-	const toMs = (value) => Math.max(0, Math.round(value));
-	const record = (name, spanStartedAt) => {
-		const currentAt = now();
-		spans.push({
-			name,
-			durationMs: toMs(currentAt - spanStartedAt),
-			elapsedMs: toMs(currentAt - startedAt)
-		});
+/** Observe teardown before release; a successful resume alone can acknowledge ignored overrides. */
+async function prepareCodexThreadResume(params, binding, context) {
+	const assertClient = captureCodexAppServerClientLifetime(params.client, binding.connectionScope === "supervision" ? "connection" : "native-process");
+	const assertCurrent = () => {
+		params.params.hostCapabilities.assertActive();
+		params.signal?.throwIfAborted();
+		assertClient();
+		if (isCodexAppServerLiveThreadClaimed(params.client, binding.threadId)) throw new CodexAdoptedThreadActiveError();
 	};
-	const snapshot = () => ({
-		totalMs: toMs(now() - startedAt),
-		spans: spans.slice()
-	});
+	assertCurrent();
+	const thread = await assertAdoptedCodexThreadResumeAllowed(params, binding.threadId, context);
+	assertCurrent();
+	assertCodexSupervisionThreadLineage(binding, thread);
 	return {
-		async measure(name, run) {
-			const spanStartedAt = now();
-			try {
-				return await run();
-			} finally {
-				record(name, spanStartedAt);
-			}
-		},
-		measureSync(name, run) {
-			const spanStartedAt = now();
-			try {
-				return run();
-			} finally {
-				record(name, spanStartedAt);
-			}
-		},
-		mark(name) {
-			record(name, now());
-		},
-		logSummary(params) {
-			if (didLog) return;
-			const summary = snapshot();
-			const shouldWarn = shouldWarnCodexThreadLifecycleTimingSummary(summary, options);
-			if (!shouldWarn && !log.isEnabled?.("trace")) return;
-			didLog = true;
-			const message = formatCodexThreadLifecycleTimingSummary({
-				runId: params.runId,
-				sessionId: params.sessionId,
-				sessionKey: params.sessionKey,
-				action: params.action,
-				summary
-			});
-			const meta = {
-				runId: params.runId,
-				sessionId: params.sessionId,
-				sessionKey: params.sessionKey,
-				action: params.action,
-				threadId: params.threadId,
-				totalMs: summary.totalMs,
-				spans: summary.spans
-			};
-			if (shouldWarn) log.warn(message, meta);
-			else log.trace(message, meta);
-		}
+		...observeCodexThreadConfiguration(params, thread, assertCurrent),
+		assertCurrent
 	};
 }
-//#endregion
-//#region extensions/codex/src/app-server/thread-lifecycle-preflight.ts
-async function prepareCodexThreadLifecyclePreflight(params) {
-	await assertCodexModelBackedReviewerEffectiveConfig({
-		client: params.client,
-		approvalsReviewer: params.appServer.approvalsReviewer,
-		cwd: params.cwd,
-		signal: params.signal
-	});
-	if (params.nativeHookRelayRequired) await assertCodexNativeHookRelayAllowed(params.client, params.signal);
-	const lifecycleTiming = createCodexThreadLifecycleTimingTracker({
-		...params.timing,
-		enabled: params.timing?.enabled ?? isCodexAppServerProfilerEnabled(params.params.config)
-	});
-	const legacyDynamicToolsFingerprint = lifecycleTiming.measureSync("legacy-dynamic-tools-fingerprint", () => codexLegacyDynamicToolsFingerprint(params.dynamicTools));
-	const dynamicToolsFingerprint = lifecycleTiming.measureSync("dynamic-tools-fingerprint", () => hashCodexAppServerBindingFingerprint(legacyDynamicToolsFingerprint));
-	const dynamicToolsContainDeferred = flattenCodexDynamicToolFunctions(params.dynamicTools).some((tool) => tool.deferLoading === true);
-	const webSearchThreadConfigFingerprint = fingerprintJsonObject(lifecycleTiming.measureSync("web-search-plan", () => resolveCodexWebSearchPlan({
-		config: params.params.config,
-		disableTools: params.params.disableTools,
-		nativeToolSurfaceEnabled: params.nativeCodeModeEnabled,
-		nativeProviderWebSearchSupport: params.nativeProviderWebSearchSupport,
-		webSearchAllowed: params.webSearchAllowed
-	})).threadConfig);
-	const networkProxyConfigFingerprint = params.appServer.networkProxy?.configFingerprint;
-	const contextEngineBinding = lifecycleTiming.measureSync("context-engine-binding", () => buildContextEngineBinding(params.params, params.contextEngineProjection));
-	const userMcpServersConfigPatch = params.userMcpServersEnabled === false ? void 0 : await buildCodexUserMcpServersThreadConfigPatchForRun({
-		run: params.params,
-		cwd: params.cwd,
-		agentId: params.agentId ?? params.params.agentId,
-		allowLiteralOAuthProjection: params.appServer.connectionClass !== "remote",
-		warn: (message) => embeddedAgentLog.warn(message),
-		onServerUnavailable: (serverName, error) => embeddedAgentLog.warn("skipping unavailable MCP OAuth server", {
-			serverName,
-			error: formatErrorMessage(error)
-		})
-	});
-	const nativeSkillIsolation = await lifecycleTiming.measure("native-skill-isolation", () => resolveCodexNativeSkillIsolation({
-		client: params.client,
-		codexHome: params.appServer.start.env?.CODEX_HOME,
-		cwd: params.cwd,
-		home: params.appServer.start.env?.HOME,
-		signal: params.signal,
-		userProfile: params.appServer.start.env?.USERPROFILE
-	}));
-	const nativeSkillIsolationFingerprint = nativeSkillIsolation ? fingerprintJsonObject({
-		version: 1,
-		disabledUserSkillPaths: nativeSkillIsolation.disabledUserSkillPaths
-	}) : void 0;
-	const legacyUserMcpServersFingerprint = legacyFingerprintUserMcpServersConfigPatch(userMcpServersConfigPatch);
-	const userMcpServersFingerprint = fingerprintUserMcpServersConfigPatch(userMcpServersConfigPatch);
-	const environmentSelectionFingerprint = fingerprintEnvironmentSelection(params.environmentSelection);
-	const hostSystemAgentActive = params.hostSystemAgentActive ?? isHostScopedAgentToolActive("openclaw");
-	const ringZeroActive = hostSystemAgentActive && isSystemAgentOnlyCodexDynamicToolAllowlist(params.params.toolsAllow);
-	const messageOnlySourceReply = isMessageOnlyCodexSourceReply(params.params);
-	const restrictedToolSurface = ringZeroActive || messageOnlySourceReply || params.params.pluginHarnessToolPolicyRestricted === true;
-	const imageGenerationDenied = params.params.pluginHarnessToolPolicySafeDeniedTools?.includes("image_generate") === true;
-	if (restrictedToolSurface && params.nativeCodeModeEnabled !== false) throw new Error("Codex restricted tool surfaces require native code mode to be disabled");
-	const restrictedToolSurfaceInheritedMcpServerNames = restrictedToolSurface ? await lifecycleTiming.measure("restricted-tool-surface-mcp-config-read", () => readCodexInheritedMcpServerNames(params.client, params.cwd, params.signal)) : [];
-	if (restrictedToolSurface || imageGenerationDenied) await lifecycleTiming.measure("tool-policy-config-requirements-read", () => assertCodexManagedRequirementsDoNotOverrideToolPolicy(params.client, {
-		restrictedToolSurface,
-		additionalDeniedFeatures: imageGenerationDenied ? ["image_generation"] : void 0
-	}, params.signal));
-	const ringZeroConfigFingerprint = ringZeroActive ? fingerprintJsonObject({
-		version: 1,
-		baseInstructions: "",
-		config: buildCodexRingZeroThreadConfigPatch(params.params, true, restrictedToolSurfaceInheritedMcpServerNames)
-	}) : void 0;
+function observeCodexThreadConfiguration(params, thread, assertCurrent) {
+	if (thread.status?.type !== "idle" && thread.status?.type !== "notLoaded") throw new CodexAdoptedThreadActiveError();
+	let unloaded = thread.status.type === "notLoaded";
 	return {
-		contextEngineBinding,
-		dynamicToolsContainDeferred,
-		dynamicToolsFingerprint,
-		environmentSelectionFingerprint,
-		hostSystemAgentActive,
-		legacyDynamicToolsFingerprint,
-		legacyUserMcpServersFingerprint,
-		lifecycleTiming,
-		nativeSkillIsolation,
-		nativeSkillIsolationFingerprint,
-		networkProxyConfigFingerprint,
-		ringZeroActive,
-		ringZeroClientInstanceId: ringZeroActive ? getCodexAppServerClientInstanceId(params.client) : void 0,
-		ringZeroConfigFingerprint,
-		restrictedToolSurface,
-		restrictedToolSurfaceInheritedMcpServerNames,
-		userMcpServersConfigPatch,
-		userMcpServersFingerprint,
-		webSearchThreadConfigFingerprint
+		dispose: params.client.addNotificationHandler((notification) => {
+			if (notification.method === "thread/status/changed" && isJsonObject(notification.params) && notification.params.threadId === thread.id && isJsonObject(notification.params.status) && notification.params.status.type === "notLoaded") unloaded = true;
+		}),
+		assertConfigured: () => {
+			assertCurrent();
+			if (!unloaded) throw new Error("Codex did not confirm unloading its previous configuration. The thread is preserved; stop competing native work and reconnect before retrying.");
+		}
 	};
 }
 //#endregion
@@ -4168,6 +4674,19 @@ async function startOrResumeThread(params) {
 	const clientId = resolveCodexAppServerClientInstanceId(params.client);
 	return await withCodexThreadLifecycleBinding(params, async (bindingIdentity, currentBinding) => {
 		let binding = currentBinding;
+		if (hasCodexNativeToolCatalog(binding)) {
+			const nativeCatalog = await loadCodexNativeToolCatalog({
+				client: params.client,
+				binding,
+				appServer: params.appServer,
+				agentDir: resolveCodexThreadAgentDir(params),
+				assertCurrent: () => {
+					params.signal?.throwIfAborted();
+					params.params.hostCapabilities.assertActive();
+				}
+			});
+			if (!isDeepStrictEqual(params.dynamicTools, nativeCatalog)) throw new Error("Canonical Codex declarations changed after tool preparation; retry the turn on its preserved native thread.");
+		}
 		const preflight = await prepareCodexThreadLifecyclePreflight(params);
 		const { contextEngineBinding, dynamicToolsContainDeferred, dynamicToolsFingerprint, environmentSelectionFingerprint, hostSystemAgentActive, legacyDynamicToolsFingerprint, legacyUserMcpServersFingerprint, lifecycleTiming, nativeSkillIsolation, nativeSkillIsolationFingerprint, networkProxyConfigFingerprint, ringZeroActive, ringZeroClientInstanceId, ringZeroConfigFingerprint, restrictedToolSurface, restrictedToolSurfaceInheritedMcpServerNames, userMcpServersConfigPatch, userMcpServersFingerprint, webSearchThreadConfigFingerprint } = preflight;
 		let replacementPredecessor;
@@ -4181,35 +4700,15 @@ async function startOrResumeThread(params) {
 			config: params.params.config
 		});
 		const throwIfAborted = () => throwIfCodexThreadLifecycleAborted(params.signal);
-		const releaseRetainedThread = async (threadId, ownerClientId = initialBoundClientId, assertCurrent) => {
-			if (ownerClientId && ownerClientId !== clientId) {
-				const previousClient = retainSharedCodexAppServerClientByInstanceId(ownerClientId);
-				if (!previousClient) return false;
-				try {
-					const assertPrevious = assertCurrent ? captureExclusiveSharedCodexAppServerClient(previousClient.client) : void 0;
-					if (isCodexAppServerLiveThreadClaimed(previousClient.client, threadId)) throw new Error(`Codex thread ${threadId} is claimed by active work; stop it first.`);
-					return await releaseCodexRetainedLiveThread({
-						client: previousClient.client,
-						lifecycleTiming,
-						threadId,
-						assertCurrent: assertCurrent ? () => {
-							assertCurrent();
-							assertPrevious?.();
-						} : void 0
-					});
-				} finally {
-					previousClient.release();
-				}
-			}
-			if (isCodexAppServerLiveThreadClaimed(params.client, threadId)) throw new Error(`Codex thread ${threadId} is claimed by active work; stop it first.`);
-			return await releaseCodexRetainedLiveThread({
-				client: params.client,
-				abandonClient: params.abandonClient,
-				lifecycleTiming,
-				threadId,
-				assertCurrent
-			});
-		};
+		const releaseRetainedThread = (threadId, ownerClientId = initialBoundClientId, assertCurrent) => releaseCodexBoundLiveThread({
+			client: params.client,
+			clientId,
+			ownerClientId,
+			abandonClient: params.abandonClient,
+			lifecycleTiming,
+			threadId,
+			assertCurrent
+		});
 		if (!binding && bindingIdentity.kind === "session" && bindingIdentity.sessionKey) {
 			if (!await lifecycleTiming.measure("reclaim-binding-generation", () => reclaimCurrentCodexSessionGeneration({
 				bindingStore: params.bindingStore,
@@ -4484,28 +4983,6 @@ async function startOrResumeThread(params) {
 					embeddedAgentLog.debug("codex app-server dynamic tool catalog changed; starting a new thread", { threadId: binding.threadId });
 					await clearCurrentBinding("rotating a stale thread binding");
 				}
-			} else if (incognito) {
-				if (binding.clientId && binding.clientId === clientId && ((await buildLoadedPluginThreadConfig(binding))?.fingerprint ?? binding.pluginAppsFingerprint) === binding.pluginAppsFingerprint) {
-					params.buildFinalConfigPatch?.({
-						action: "resume",
-						binding
-					});
-					throwIfAborted();
-					lifecycleTiming.mark("thread-ready");
-					lifecycleTiming.logSummary({
-						runId: params.params.runId,
-						sessionId: params.params.sessionId,
-						sessionKey: params.params.sessionKey,
-						threadId: binding.threadId,
-						action: "resumed"
-					});
-					return {
-						...binding,
-						lifecycle: { action: "resumed" }
-					};
-				}
-				await clearCurrentBinding("rotating an unavailable ephemeral thread binding");
-				binding = void 0;
 			} else {
 				const warmReuse = await tryReuseCodexLiveThread({
 					...requestContext,
@@ -4515,21 +4992,28 @@ async function startOrResumeThread(params) {
 					buildLoadedPluginThreadConfig
 				});
 				if (warmReuse.kind === "ready") return warmReuse.binding;
-				if (warmReuse.kind === "rotate") {
+				if (incognito || warmReuse.kind === "rotate") {
 					throwIfAborted();
-					await clearCurrentBinding("rotating a stale plugin app binding");
+					await clearCurrentBinding(incognito ? "rotating an unavailable ephemeral thread binding" : "rotating a stale plugin app binding");
 				} else {
-					if (binding.preserveNativeModel === true) await assertAdoptedCodexThreadResumeAllowed(params, binding.threadId, requestContext);
-					await releaseRetainedThread(binding.threadId);
-					const resumed = await resumeExistingCodexThread(params, {
-						...requestContext,
-						binding,
-						clearCurrentBinding,
-						prebuiltFinalConfigPatch: warmReuse.prebuiltFinalConfigPatch,
-						prebuiltPluginThreadConfig,
-						buildLoadedPluginThreadConfig
-					});
-					if (resumed) return resumed;
+					const configuration = await prepareCodexThreadResume(params, binding, requestContext);
+					try {
+						await releaseRetainedThread(binding.threadId, binding.clientId, configuration.assertCurrent);
+						configuration.assertCurrent();
+						const resumed = await resumeExistingCodexThread(params, {
+							...requestContext,
+							binding,
+							clearCurrentBinding,
+							prebuiltFinalConfigPatch: warmReuse.prebuiltFinalConfigPatch,
+							prebuiltPluginThreadConfig,
+							buildLoadedPluginThreadConfig,
+							assertResumeOwnership: configuration.assertCurrent,
+							assertResumeConfiguration: configuration.assertConfigured
+						});
+						if (resumed) return resumed;
+					} finally {
+						configuration.dispose();
+					}
 				}
 			}
 		}
@@ -4546,6 +5030,54 @@ async function startOrResumeThread(params) {
 	});
 }
 //#endregion
+//#region extensions/codex/src/app-server/reasoning-effort.ts
+const CODEX_REASONING_EFFORTS = [
+	"minimal",
+	"low",
+	"medium",
+	"high",
+	"xhigh",
+	"max"
+];
+const LEGACY_PRO_REASONING_EFFORTS = [
+	"medium",
+	"high",
+	"xhigh"
+];
+const LEGACY_PRO_MODEL_ID_RE = /^gpt-5\.[45]-pro$/u;
+const MODERN_GPT_5_MODEL_ID_RE = /^gpt-5\.(?:[3-9]|[1-9]\d)(?:$|-)/u;
+/** Read reasoning metadata after the Codex app-server route has been selected. */
+function readCodexSupportedReasoningEfforts(compat) {
+	if (!compat || typeof compat !== "object" || Array.isArray(compat)) return;
+	const efforts = compat.supportedReasoningEfforts;
+	if (!Array.isArray(efforts)) return;
+	return efforts.filter((effort) => typeof effort === "string");
+}
+function resolveSupportedReasoningEffort(params) {
+	const declared = new Set(params.supportedReasoningEfforts.map((effort) => effort.trim().toLowerCase()));
+	const supported = CODEX_REASONING_EFFORTS.filter((effort) => declared.has(effort));
+	if (supported.includes(params.requested)) return params.requested;
+	const requestedRank = CODEX_REASONING_EFFORTS.indexOf(params.requested);
+	return supported.find((effort) => CODEX_REASONING_EFFORTS.indexOf(effort) >= requestedRank) ?? supported.at(-1);
+}
+function resolveCodexAppServerReasoningEffort(params) {
+	if (params.thinkLevel === "ultra") return "ultra";
+	if (params.thinkLevel === "off") return params.supportedReasoningEfforts?.includes("none") ? "none" : null;
+	if (params.thinkLevel === "adaptive") return null;
+	if (params.supportedReasoningEfforts) return resolveSupportedReasoningEffort({
+		requested: params.thinkLevel,
+		supportedReasoningEfforts: params.supportedReasoningEfforts
+	}) ?? null;
+	const modelId = params.modelId.trim().toLowerCase();
+	if (LEGACY_PRO_MODEL_ID_RE.test(modelId)) return resolveSupportedReasoningEffort({
+		requested: params.thinkLevel,
+		supportedReasoningEfforts: LEGACY_PRO_REASONING_EFFORTS
+	}) ?? null;
+	if (params.thinkLevel === "minimal" && MODERN_GPT_5_MODEL_ID_RE.test(modelId)) return "low";
+	if (params.thinkLevel === "minimal" || params.thinkLevel === "low" || params.thinkLevel === "medium" || params.thinkLevel === "high" || params.thinkLevel === "xhigh") return params.thinkLevel;
+	return null;
+}
+//#endregion
 //#region extensions/codex/src/app-server/user-input.ts
 /** Builds ordered Codex user input for both new turns and same-turn steering. */
 function buildCodexUserInput(text, images) {
@@ -4598,12 +5130,22 @@ function buildTurnStartParams(params, options) {
 		agentDir: params.agentDir,
 		config: params.config
 	});
+	const collaborationMode = modelSelection ? buildTurnCollaborationMode(params, {
+		model: modelSelection.model,
+		turnScopedDeveloperInstructions: options.turnScopedDeveloperInstructions,
+		skillsCollaborationInstructions: options.skillsCollaborationInstructions,
+		memoryCollaborationInstructions: options.memoryCollaborationInstructions
+	}) : void 0;
 	const useThreadPermissionProfile = options.appServer.networkProxy && !options.sandboxPolicy;
 	const currentSenderContext = params.trigger === "user" ? buildCodexCurrentSenderContextValue(params) : void 0;
-	let additionalContext = currentSenderContext ? { openclaw_current_sender: {
-		kind: "untrusted",
-		value: currentSenderContext
-	} } : void 0;
+	let additionalContext = buildCodexTemporalAdditionalContext(params, { sessionStatusAvailable: options.sessionStatusAvailable === true });
+	if (currentSenderContext) additionalContext = {
+		...additionalContext,
+		openclaw_current_sender: {
+			kind: "untrusted",
+			value: currentSenderContext
+		}
+	};
 	if (params.permissionChange?.notice) additionalContext = {
 		...additionalContext,
 		openclaw_permission_change: {
@@ -4625,23 +5167,33 @@ function buildTurnStartParams(params, options) {
 			personality: CODEX_NATIVE_PERSONALITY_NONE
 		} : {},
 		...options.appServer.serviceTier !== void 0 ? { serviceTier: options.appServer.serviceTier } : options.clearInheritedServiceTier ? { serviceTier: null } : {},
-		...modelSelection ? { effort: resolveReasoningEffort(params.thinkLevel, modelSelection.model, readCodexSupportedReasoningEfforts(params.model?.compat)) } : {},
-		...options.environmentSelection ? { environments: options.environmentSelection } : {},
-		...modelSelection ? { collaborationMode: buildTurnCollaborationMode(params, {
-			model: modelSelection.model,
-			turnScopedDeveloperInstructions: options.turnScopedDeveloperInstructions,
-			skillsCollaborationInstructions: options.skillsCollaborationInstructions,
-			memoryCollaborationInstructions: options.memoryCollaborationInstructions
-		}) } : {}
+		...collaborationMode ? {
+			effort: collaborationMode.settings.reasoning_effort,
+			collaborationMode
+		} : {},
+		...options.environmentSelection ? { environments: options.environmentSelection } : {}
 	};
 }
+function buildCodexTemporalAdditionalContext(params, options) {
+	return { openclaw_temporal_context: {
+		kind: "application",
+		value: buildTemporalContextText({
+			configuredTimezone: params.config?.agents?.defaults?.userTimezone,
+			sessionStatusAvailable: options.sessionStatusAvailable
+		})
+	} };
+}
 function buildTurnCollaborationMode(params, options = {}) {
 	const model = options.model ?? params.modelId;
 	return {
 		mode: "default",
 		settings: {
 			model,
-			reasoning_effort: resolveReasoningEffort(params.thinkLevel, model, readCodexSupportedReasoningEfforts(params.model?.compat)),
+			reasoning_effort: resolveCodexAppServerReasoningEffort({
+				thinkLevel: params.thinkLevel,
+				modelId: model,
+				supportedReasoningEfforts: readCodexSupportedReasoningEfforts(params.model?.compat)
+			}),
 			developer_instructions: buildTurnScopedCollaborationInstructions(params, options)
 		}
 	};
@@ -4679,4 +5231,4 @@ function joinPresentSections(...sections) {
 	return sections.filter((section) => Boolean(section?.trim())).join("\n\n");
 }
 //#endregion
-export { resolveCodexContinuityProjectionMaxChars as $, readCodexSupportedReasoningEfforts as A, isMessageOnlyCodexSourceReply as B, buildCodexProjectDocThreadConfig as C, resolveCodexAppServerThreadModelSelection as D, resolveCodexAppServerRequestModelSelection as E, codexDynamicToolsFingerprint as F, buildContextEngineBinding as G, normalizeCodexDynamicToolName as H, codexLegacyDynamicToolsFingerprint as I, fitCodexProjectedContextForTurnStart as J, isContextEngineBindingCompatible as K, filterCodexDynamicTools as L, CODEX_MANAGED_THREAD_NAMESPACE as M, createCodexManagedThreadStore as N, resolveCodexBindingModelProviderFallback as O, areCodexDynamicToolFingerprintsCompatible as P, resolveCodexContextEngineProjectionReserveTokens as Q, filterCodexDynamicToolsForDisabledNativeSurface as R, buildDeveloperInstructions as S, resolveCodexAppServerModelProvider as T, resolveCodexDynamicToolsLoading as U, isSystemAgentOnlyCodexDynamicToolAllowlist as V, resolveCodexDynamicToolsLoadingForRuntime as W, projectContextEngineAssemblyForCodex as X, neutralizeCodexExplicitMentionSigils as Y, resolveCodexContextEngineProjectionMaxChars as Z, buildCodexRingZeroThreadConfigPatch as _, isCodexAppServerProfilerEnabled as a, buildPluginAppPolicyContext as at, buildCodexNativeWebSearchThreadConfig as b, buildCodexNativeHookRelayConfig as c, ensureCodexPluginActivation as ct, emitCodexNativePreToolUseFailureDiagnostic as d, isOpenAiCuratedMarketplaceName as dt, buildCodexPluginAppsConfigPatchFromPolicyContext as et, resolveCodexNativeHookRelayEvents as f, pluginReadParams as ft, attestCodexRestrictedToolSurfaceMcpServersDisabled as g, assertCodexManagedRequirementsDoNotOverrideToolPolicy as h, startOrResumeThread as i, buildDisabledAppsConfigPatch as it, CODEX_MANAGED_THREAD_MAX_ENTRIES as j, resolveReasoningEffort as k, buildCodexNativeHookRelayDisabledConfig as l, refreshCodexPluginRuntimeState as lt, scheduleCodexNativeHookRelayUnregister as m, buildTurnStartParams as n, buildCodexPluginThreadConfigInputFingerprint as nt, CODEX_NATIVE_HOOK_RELAY_EVENTS as o, mergeCodexThreadConfigs as ot, resolveCodexNativeHookRelayTtlMs as p, resolveRecoverableCodexPluginConfigKeys as pt, buildCodexContinuityCalibration as q, buildCodexUserInput as r, buildCodexPluginThreadConfigTimeoutFallback as rt, CODEX_NATIVE_HOOK_RELAY_TTL_GRACE_MS as s, shouldBuildCodexPluginThreadConfig as st, buildTurnCollaborationMode as t, buildCodexPluginThreadConfig as tt, createCodexNativeHookRelay as u, isOpenAiCuratedMarketplace as ut, buildCodexRuntimeThreadConfig as v, CODEX_NATIVE_PERSONALITY_NONE as w, resolveCodexWebSearchPlan as x, readCodexInheritedMcpServerNames as y, isForcedPrivateQaCodexRuntime as z };
+export { resolveCodexNativeSkillIsolation as $, readCodexMcpToolConnectorId as A, refreshCodexPluginRuntimeState as At, emitCodexNativePreToolUseFailureDiagnostic as B, buildDeveloperInstructions as C, buildCodexPluginThreadConfig as Ct, resolveCodexAppServerThreadModelSelection as D, mergeCodexThreadConfigs as Dt, resolveCodexAppServerRequestModelSelection as E, buildDisabledAppsConfigPatch as Et, assertCodexNativeHookRelayAllowed as F, attestCodexRestrictedToolSurfaceMcpServersDisabled as G, resolveCodexNativeHookRelayTtlMs as H, buildCodexNativeHookRelayConfig as I, createCodexManagedThreadStore as J, CODEX_MANAGED_THREAD_MAX_ENTRIES as K, buildCodexNativeHookRelayDisabledConfig as L, isCodexAppServerProfilerEnabled as M, isOpenAiCuratedMarketplaceName as Mt, CODEX_NATIVE_HOOK_RELAY_EVENTS as N, pluginReadParams as Nt, resolveCodexBindingModelProviderFallback as O, shouldBuildCodexPluginThreadConfig as Ot, CODEX_NATIVE_HOOK_RELAY_TTL_GRACE_MS as P, resolveRecoverableCodexPluginConfigKeys as Pt, applyCodexNativeSkillIsolation as Q, buildCodexNativeHookRelayId as R, resolveCodexWebSearchPlan as S, buildCodexPluginAppsConfigPatchFromPolicyContext as St, resolveCodexAppServerModelProvider as T, buildCodexPluginThreadConfigTimeoutFallback as Tt, scheduleCodexNativeHookRelayUnregister as U, resolveCodexNativeHookRelayEvents as V, attestCodexPluginThreadApps as W, loadCodexNativeToolCatalog as X, hasCodexNativeToolCatalog as Y, parseCodexNativeToolCatalog as Z, buildCodexRingZeroThreadConfigPatch as _, neutralizeCodexExplicitMentionSigils as _t, readCodexSupportedReasoningEfforts as a, filterCodexDynamicTools as at, readCodexInheritedMcpServerNames as b, resolveCodexContextEngineProjectionReserveTokens as bt, assertScheduledCodexAppAuthorityRuntime as c, isMessageOnlyCodexSourceReply as ct, buildScheduledCodexAppServerConnectionIdentity as d, resolveCodexDynamicToolsLoading as dt, areCodexDynamicToolFingerprintsCompatible as et, captureScheduledCodexAppAuthority as f, resolveCodexDynamicToolsLoadingForRuntime as ft, assertCodexManagedRequirementsDoNotOverrideToolPolicy as g, fitCodexProjectedContextForTurnStart as gt, resolveScheduledCodexAppCreatorCaptureDecision as h, buildCodexContinuityCalibration as ht, buildCodexUserInput as i, fingerprintUserMcpServersConfigPatch as it, readCodexMcpToolUiVisibility as j, isOpenAiCuratedMarketplace as jt, buildCodexProjectDocThreadConfig as k, ensureCodexPluginActivation as kt, buildLegacyScheduledCodexAppRecoveryPrompt as l, isSystemAgentOnlyCodexDynamicToolAllowlist as lt, readCurrentCodexScheduledAppPolicy as m, isContextEngineBindingCompatible as mt, buildTurnCollaborationMode as n, codexLegacyDynamicToolsFingerprint as nt, resolveCodexAppServerReasoningEffort as o, filterCodexDynamicToolsForDisabledNativeSurface as ot, intersectCodexPluginThreadConfigWithScheduledAuthority as p, buildContextEngineBinding as pt, CODEX_MANAGED_THREAD_NAMESPACE as q, buildTurnStartParams as r, fingerprintJsonObject as rt, startOrResumeThread as s, isForcedPrivateQaCodexRuntime as st, buildCodexTemporalAdditionalContext as t, codexDynamicToolsFingerprint as tt, buildScheduledCodexAppAuthorityInputFingerprint as u, normalizeCodexDynamicToolName as ut, buildCodexRuntimeThreadConfig as v, projectContextEngineAssemblyForCodex as vt, CODEX_NATIVE_PERSONALITY_NONE as w, buildCodexPluginThreadConfigInputFingerprint as wt, buildCodexNativeWebSearchThreadConfig as x, resolveCodexContinuityProjectionMaxChars as xt, buildCodexThreadConfiguration as y, resolveCodexContextEngineProjectionMaxChars as yt, createCodexNativeHookRelay as z };