@openclaw/codex 2026.8.2 → 2026.9.1

package/dist/{dynamic-tools-BmeXjwNZ.js → dynamic-tools-BU9tmlYm.js}

@@ -1,18 +1,19 @@
-import { C as isCodexRemoteExecPlacementSandbox, T as readCodexPluginConfig } from "./config-CcYL77O6.js";
-import { Bt as CODEX_OPENCLAW_DIRECT_DYNAMIC_TOOL_NAMESPACE, Ht as isJsonObject, dt as resolveCodexToolAbortTerminalReason, et as createCodexElicitationResponse, ft as createFailedDynamicToolResponse, h as releaseLeasedSharedCodexAppServerClient, mt as withDynamicToolTranscriptDetails, pt as withDynamicToolExecutionState } from "./shared-client-B1tT5U6r.js";
-import { d as readCodexTurn } from "./protocol-validators-Bg5rpNxk.js";
-import { D as itemStatus, I as readItem, b as auditNativeToolTerminalStatus, g as isCodexNotificationForTurn, x as auditNativeToolUnfinishedStatus, y as auditNativeToolName } from "./attempt-client-cleanup-CpVfwctT.js";
-import { H as normalizeCodexDynamicToolName, L as filterCodexDynamicTools, R as filterCodexDynamicToolsForDisabledNativeSurface, V as isSystemAgentOnlyCodexDynamicToolAllowlist, d as emitCodexNativePreToolUseFailureDiagnostic, x as resolveCodexWebSearchPlan, z as isForcedPrivateQaCodexRuntime } from "./thread-lifecycle-CGGKP720.js";
-import { l as resolveCodexNativeExecutionPolicy, u as resolveCodexNodeExecToolOverrides } from "./request-BWxweEdK.js";
+import { $t as isJsonObject, Qt as flattenCodexDynamicToolFunctions, Zt as CODEX_OPENCLAW_DIRECT_DYNAMIC_TOOL_NAMESPACE, _t as resolveCodexToolAbortTerminalReason, bt as withDynamicToolTranscriptDetails, it as readCodexTurn, ot as createCodexElicitationResponse, vt as createFailedDynamicToolResponse, yt as withDynamicToolExecutionState } from "./shared-client-DxcfF9KX.js";
+import { E as readCodexPluginConfig, w as isCodexRemoteExecPlacementSandbox } from "./config-BhmfC1s6.js";
+import { E as itemStatus, I as readItem, b as auditNativeToolUnfinishedStatus, h as isCodexNotificationForTurn, v as auditNativeToolName, y as auditNativeToolTerminalStatus } from "./attempt-client-cleanup-DYHcRQAa.js";
+import { B as emitCodexNativePreToolUseFailureDiagnostic, S as resolveCodexWebSearchPlan, at as filterCodexDynamicTools, lt as isSystemAgentOnlyCodexDynamicToolAllowlist, ot as filterCodexDynamicToolsForDisabledNativeSurface, st as isForcedPrivateQaCodexRuntime, ut as normalizeCodexDynamicToolName } from "./thread-lifecycle-DAcEJ_Om.js";
+import { l as resolveCodexNativeExecutionPolicy, u as resolveCodexNodeExecToolOverrides } from "./request-DYAI5FQE.js";
 import { r as sanitizeInlineImageDataUrl, t as invalidInlineImageText } from "./image-payload-sanitizer-CnfoUPCE.js";
-import { r as formatCodexDisplayText } from "./command-formatters--UToCokS.js";
-import { a as sanitizeCodexApprovalVisibleText, c as waitForPluginApprovalDecision, i as requestPluginApproval, n as codexApprovalTimeoutText, o as stripDanglingCodexApprovalTerminalSequence, r as mapExecDecisionToOutcome, s as truncateCodexApprovalDisplayText, t as approvalRequestExplicitlyUnavailable } from "./plugin-approval-roundtrip-CCWQGlAI.js";
+import { a as formatCodexDisplayText } from "./command-formatters-CLHhEB1Q.js";
+import { a as requestPluginApprovalOutcome, c as truncateCodexApprovalDisplayText, i as requestPluginApproval, l as waitForPluginApprovalDecision, n as codexApprovalTimeoutText, o as sanitizeCodexApprovalVisibleText, r as mapExecDecisionToOutcome, s as stripDanglingCodexApprovalTerminalSequence, t as approvalRequestExplicitlyUnavailable } from "./plugin-approval-roundtrip-CNe-Xrjx.js";
+import { a as CODEX_NODE_EXEC_DYNAMIC_TOOL_NAME, c as createNodeExecAliasDynamicTool, i as CODEX_GATEWAY_PROCESS_DYNAMIC_TOOL_NAME, l as isCodexDynamicToolExcluded, o as createGatewayExecProjection, r as CODEX_GATEWAY_EXEC_DYNAMIC_TOOL_NAME, s as createGatewayProcessProjection } from "./provider-capabilities-DW5p4k9w.js";
 import { asNonArrayRecord, asOptionalRecord, isRecord, normalizeOptionalString, normalizeTrimmedStringList, readStringField } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { validateJsonSchemaValue } from "openclaw/plugin-sdk/json-schema-runtime";
 import path, { posix } from "node:path";
 import { createDeferred } from "openclaw/plugin-sdk/extension-shared";
 import { asDateTimestampMs } from "openclaw/plugin-sdk/number-runtime";
 import { HEARTBEAT_RESPONSE_TOOL_NAME, buildAgentHookContextChannelFields, buildEmbeddedAttemptToolRunContext, consumeAdjustedParamsForToolCall, consumePreExecutionBlockedToolCall, createAgentToolResultMiddlewareRunner, createCodexAppServerToolResultExtensionRunner, embeddedAgentLog, extractMessagingToolSend, extractMessagingToolSendResult, extractToolResultMediaArtifact, filterProviderNormalizableTools, filterToolResultMediaUrls, finalizeToolTerminalPresentation, formatApprovalDisplayPath, formatToolExecutionErrorMessage, getBeforeToolCallFailureDisposition, getChannelAgentToolMeta, getPluginToolMeta, getPluginToolSideEffectOwnerKey, hasNativeHookRelayInvocation, invokeNativeHookRelay, isDeliveredMessageToolOnlySourceReplyResult, isDeliveredMessagingToolResult, isHostScopedAgentToolActive, isMessagingTool, isMessagingToolSendAction, isReplaySafeToolCall, isSubagentSessionKey, isToolResultError, isToolWrappedWithBeforeToolCallHook, normalizeAgentRuntimeTools, normalizeHeartbeatToolResponse, projectRuntimeToolInputSchema, resolveAttemptSpawnWorkspaceDir, resolveModelAuthMode, resolveNativeHookRelayDeferredToolApproval, resolveToolExecutionErrorKind, resolveToolResultFailureKind, runAgentHarnessAfterToolCallHook, sanitizeToolResult, setBeforeToolCallDiagnosticsEnabled, supportsModelTools, wrapToolWithBeforeToolCallHook } from "openclaw/plugin-sdk/agent-harness-runtime";
+import { isPathStrictlyInside, root } from "openclaw/plugin-sdk/file-access-runtime";
 import { createHash, randomUUID } from "node:crypto";
 import { resolveAgentDir as resolveAgentDir$1 } from "openclaw/plugin-sdk/agent-runtime";
 import { formatErrorMessage as formatErrorMessage$1, redactSensitiveText } from "openclaw/plugin-sdk/security-runtime";
@@ -28,15 +29,17 @@ import { WebSocketServer } from "ws";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { expectDefined } from "openclaw/plugin-sdk/expect-runtime";
 import { redactToolPayloadText } from "openclaw/plugin-sdk/logging-core";
-import { isPathStrictlyInside, root } from "openclaw/plugin-sdk/file-access-runtime";
+import { formatMcpCodexApprovalRemedy, requiresMcpCodexToolApproval, resolveCodexScheduledToolProjectionFactory, resolveProjectedMcpCodexToolApprovalMode, runWithCronCreatorAuthorityCapabilityResolver } from "openclaw/plugin-sdk/codex-mcp-projection";
 import { buildRemoteCommand, isToolAllowed, sanitizeEnvVars } from "openclaw/plugin-sdk/sandbox";
-import { pinExecToolTarget, resolveCodexScheduledToolProjectionFactory, runWithCronCreatorAuthorityCapabilityResolver } from "openclaw/plugin-sdk/codex-mcp-projection";
 import { saveMediaBuffer } from "openclaw/plugin-sdk/media-store";
 import { getMediaDir } from "openclaw/plugin-sdk/media-runtime";
-import { getCoreTtsToolResultMediaUrls } from "openclaw/plugin-sdk/agent-harness-tool-runtime";
-import { normalizeOpenAIToolSchemas } from "openclaw/plugin-sdk/provider-tools";
+import { consumeTrustedToolNoStartError, getCoreTtsToolResultMediaUrls } from "openclaw/plugin-sdk/agent-harness-tool-runtime";
+import { normalizeOpenAIStrictCompatSchema } from "openclaw/plugin-sdk/provider-tools";
 //#region extensions/codex/src/app-server/event-projector-native-tool-lifecycle.ts
-/** Projects metadata-only lifecycle diagnostics for native tool items. */
+function isMcpToolCallItemNotification(method, params) {
+	return (method === "item/started" || method === "item/completed") && isJsonObject(params.item) && params.item.type === "mcpToolCall";
+}
+/** Owns native item lifetimes for diagnostics and MCP approval correlation. */
 var CodexNativeToolLifecycleProjector = class {
 	constructor(context, threadId, turnId, options = {}) {
 		this.context = context;
@@ -50,13 +53,39 @@ var CodexNativeToolLifecycleProjector = class {
 		this.approvalFailureDispositionByItem = /* @__PURE__ */ new Map();
 		this.preToolUseFailureByItem = /* @__PURE__ */ new Map();
 		this.finalized = false;
+		this.turnCompleted = false;
+		this.pendingMcpNotifications = 0;
+	}
+	getActiveMcpToolCall(serverName) {
+		if (this.finalized || this.turnCompleted || this.pendingMcpNotifications > 0 || this.options.runAbortSignal?.aborted) return;
+		let candidate;
+		for (const { mcpToolCall } of this.activeItems.values()) {
+			if (mcpToolCall?.server !== serverName) continue;
+			if (candidate) return;
+			candidate = mcpToolCall;
+		}
+		if (!candidate || candidate.status !== "inProgress" || typeof candidate.server !== "string" || !candidate.server.trim() || typeof candidate.tool !== "string" || !candidate.tool.trim() || candidate.arguments === void 0 || candidate.appContext != null || candidate.pluginId != null) return;
+		return {
+			id: candidate.id,
+			server: candidate.server,
+			tool: candidate.tool,
+			arguments: candidate.arguments
+		};
+	}
+	recordMcpToolCallReceipt(notification) {
+		const params = isJsonObject(notification.params) ? notification.params : void 0;
+		if (!params || !isCodexNotificationForTurn(params, this.threadId, this.turnId)) return;
+		if (isMcpToolCallItemNotification(notification.method, params)) this.pendingMcpNotifications += 1;
+		else if (notification.method === "turn/completed" && readCodexTurn(params.turn)?.id === this.turnId) this.turnCompleted = true;
 	}
 	handleNotification(notification) {
 		const params = isJsonObject(notification.params) ? notification.params : void 0;
 		if (!params || !isCodexNotificationForTurn(params, this.threadId, this.turnId)) return;
+		if (this.pendingMcpNotifications > 0 && isMcpToolCallItemNotification(notification.method, params)) this.pendingMcpNotifications -= 1;
 		if (notification.method === "turn/completed") {
 			const turn = readCodexTurn(params.turn);
 			if (!turn || turn.id !== this.turnId) return;
+			this.turnCompleted = true;
 			for (const item of turn.items ?? []) this.recordSnapshotItem(item);
 			return;
 		}
@@ -75,10 +104,10 @@ var CodexNativeToolLifecycleProjector = class {
 		});
 	}
 	recordItem(params) {
-		const toolName = auditNativeToolName(params.item);
+		const toolName = auditNativeToolName(params.item) ?? (params.item.type === "mcpToolCall" ? params.item.type : void 0);
 		if (!toolName || this.completedItemIds.has(params.item.id)) return;
 		if (params.phase === "start") {
-			this.recordStarted(params.item.id, toolName, auditNativeToolUnfinishedStatus(params.item), params.sourceTimestampMs);
+			this.recordStarted(params.item.id, toolName, auditNativeToolUnfinishedStatus(params.item), params.sourceTimestampMs, params.item.type === "mcpToolCall" ? params.item : void 0);
 			return;
 		}
 		if (params.item.type === "webSearch") {
@@ -204,12 +233,13 @@ var CodexNativeToolLifecycleProjector = class {
 			item
 		});
 	}
-	recordStarted(toolCallId, toolName, unfinishedStatus, sourceTimestampMs) {
+	recordStarted(toolCallId, toolName, unfinishedStatus, sourceTimestampMs, mcpToolCall) {
 		if (this.activeItems.has(toolCallId)) return;
 		this.startedAtByItem.set(toolCallId, sourceTimestampMs ?? Date.now());
 		this.activeItems.set(toolCallId, {
 			toolName,
-			unfinishedStatus
+			unfinishedStatus,
+			mcpToolCall
 		});
 		emitTrustedDiagnosticEvent({
 			type: "tool.execution.started",
@@ -544,53 +574,6 @@ function mapMessageMediaValues(args, mapValue) {
 /** Mutable dependency seam shared by dynamic-tool construction and its behavioral tests. */
 const dynamicToolBuildState = {};
 //#endregion
-//#region extensions/codex/src/app-server/shell-dynamic-tools.ts
-const CODEX_NODE_EXEC_DYNAMIC_TOOL_NAME = "node_exec";
-const CODEX_GATEWAY_EXEC_DYNAMIC_TOOL_NAME = "gateway_exec";
-const CODEX_GATEWAY_PROCESS_DYNAMIC_TOOL_NAME = "gateway_process";
-const PROCESS_FOLLOWUP_TEXT = "Use process (list/poll/log/write/send-keys/submit/paste/kill/clear/remove) for follow-up.";
-/** Returns true when plugin config explicitly removes any named dynamic tool. */
-function isCodexDynamicToolExcluded(config, names) {
-	const normalizedNames = new Set(names.map((name) => normalizeCodexDynamicToolName(name)));
-	return (config.codexDynamicToolsExclude ?? []).some((name) => normalizedNames.has(normalizeCodexDynamicToolName(name)));
-}
-function createNodeExecAliasDynamicTool(execTool, node) {
-	const pinnedNode = node?.trim();
-	const pinnedTool = pinExecToolTarget(execTool, {
-		host: "node",
-		...pinnedNode ? { node: pinnedNode } : {}
-	});
-	const execute = async (toolCallId, args, signal, onUpdate) => {
-		const result = await pinnedTool.execute(toolCallId, args, signal, onUpdate);
-		return {
-			...result,
-			content: result.content.map((item) => item.type === "text" ? Object.assign({}, item, { text: item.text.replace(PROCESS_FOLLOWUP_TEXT, "Remote-node background follow-up is unavailable. Wait for the command to complete.") }) : item)
-		};
-	};
-	return {
-		...pinnedTool,
-		name: CODEX_NODE_EXEC_DYNAMIC_TOOL_NAME,
-		description: pinnedNode ? "Run a shell command to completion on the OpenClaw configured remote node for this session. This tool always uses OpenClaw host=node internally and follows the existing node exec approval and allowlist policy. Remote-node background follow-up is unavailable. Use Codex's native shell for local app-server work." : "Run a shell command to completion on an OpenClaw remote node. Select the node by name or id when multiple nodes are available. This tool always uses OpenClaw host=node internally and follows the existing node exec approval and allowlist policy. Remote-node background follow-up is unavailable. Use Codex's native shell for local app-server work.",
-		execute
-	};
-}
-function createGatewayExecProjection(createProjection, execTool, params) {
-	return createProjection(execTool, {
-		kind: "exec",
-		name: CODEX_GATEWAY_EXEC_DYNAMIC_TOOL_NAME,
-		description: "Run a shell command through OpenClaw on the Gateway host for OpenClaw-managed Gateway environment access, including Secret Store agent-readable environment values and protected egress sentinels. Native Codex shell remains preferred for ordinary local work. This tool always uses OpenClaw host=gateway internally and follows Gateway exec approval and allowlist policy.",
-		followupText: params.processAliasAvailable ? "Use gateway_process (list/poll/log/write/send-keys/submit/paste/kill/clear/remove) for follow-up." : "Background session follow-up is unavailable because gateway_process is not exposed. Rerun without background=true and set yieldMs high enough to wait for completion.",
-		...params.ask ? { ask: params.ask } : {}
-	});
-}
-function createGatewayProcessProjection(createProjection, processTool) {
-	return createProjection(processTool, {
-		kind: "process",
-		name: CODEX_GATEWAY_PROCESS_DYNAMIC_TOOL_NAME,
-		description: "Manage background shell sessions in the existing per-session OpenClaw process scope: list, poll, log, write, send-keys, submit, paste, kill, clear, or remove. Use for gateway_exec follow-up; use native Codex shell session handling for ordinary local work."
-	});
-}
-//#endregion
 //#region extensions/codex/src/app-server/vision-tools.ts
 /**
 * Codex's enabled native surface includes its stable view_image loader. Keep
@@ -616,6 +599,15 @@ const CODEX_NATIVE_SANDBOX_TOOL_REQUIREMENTS = [
 	"apply_patch"
 ];
 const CODEX_MEMORY_FLUSH_DYNAMIC_TOOL_ALLOW = /* @__PURE__ */ new Set(["read", "write"]);
+const CODEX_DISABLED_NATIVE_SHELL_DYNAMIC_TOOLS = /* @__PURE__ */ new Set([
+	"exec",
+	"process",
+	"sandbox_exec",
+	"sandbox_process",
+	CODEX_GATEWAY_EXEC_DYNAMIC_TOOL_NAME,
+	CODEX_GATEWAY_PROCESS_DYNAMIC_TOOL_NAME,
+	CODEX_NODE_EXEC_DYNAMIC_TOOL_NAME
+]);
 /** Keeps node filesystem and process ownership on its native exec-server. */
 function resolveCodexNodePlacementToolConstructionPlan(sandbox, nativeToolSurfaceEnabled) {
 	if (!isCodexRemoteExecPlacementSandbox(sandbox) || sandbox?.backendId !== "node" || !("placementNodeId" in sandbox) || typeof sandbox.placementNodeId !== "string" || !sandbox.placementNodeId) return;
@@ -726,112 +718,114 @@ async function buildDynamicTools(input) {
 		nativeProviderWebSearchSupport: input.nativeProviderWebSearchSupport
 	});
 	const webFetchHostnameAllowlistRef = {};
-	const buildOpenClawCodingTools = () => {
-		const toolConstructionPlan = resolveCodexNodePlacementToolConstructionPlan(input.sandbox, input.nativeToolSurfaceEnabled);
-		const options = {
-			agentId: input.sessionAgentId,
-			policyAgentId: input.policyAgentId,
-			...toolRunContext,
-			exec: {
-				...params.execOverrides,
-				...input.sessionPermissionPolicy ? { mode: input.sessionPermissionPolicy.execMode } : {},
-				...resolveCodexNodeExecToolOverrides(nativeExecutionPolicy),
-				config: params.config,
-				elevated: params.bashElevated
-			},
-			sessionPermissionPolicy: input.sessionPermissionPolicy ? {
-				mode: input.sessionPermissionPolicy.mode,
-				root: input.sessionPermissionPolicy.root
-			} : void 0,
-			sandbox: input.sandbox,
-			...toolConstructionPlan ? { toolConstructionPlan } : {},
-			messageProvider: resolveCodexMessageToolProvider(params),
-			toolPolicyMessageProvider: params.messageProvider ?? params.messageChannel,
-			clientCaps: params.clientCaps,
-			chatType: params.chatType,
-			agentAccountId: params.agentAccountId,
-			messageTo: params.messageTo,
-			messageThreadId: params.messageThreadId,
-			nativeChannelId: params.chatId,
-			messageActionTurnCapability: params.messageActionTurnCapability,
-			groupId: params.groupId,
-			groupChannel: params.groupChannel,
-			groupSpace: params.groupSpace,
-			spawnedBy: params.spawnedBy,
-			senderId: params.senderId,
-			senderName: params.senderName,
-			senderUsername: params.senderUsername,
-			senderE164: params.senderE164,
-			senderIsOwner: params.senderIsOwner,
-			inputProvenance: params.inputProvenance,
-			trustedInternalHandoff: params.trustedInternalHandoff,
-			scheduledToolPolicy: params.scheduledToolPolicy,
-			allowGatewaySubagentBinding: params.allowGatewaySubagentBinding || isForcedPrivateQaCodexRuntime(),
-			sessionKey: input.sandboxSessionKey,
-			runSessionKey: params.sessionKey && params.sessionKey !== input.sandboxSessionKey ? params.sessionKey : void 0,
-			sessionId: params.sessionId,
-			runId: params.runId,
-			approvalReviewerDeviceId: params.approvalReviewerDeviceId,
-			agentDir,
-			preparedModelRuntime: params.preparedModelRuntime,
-			cwd: input.effectiveCwd ?? input.effectiveWorkspace,
-			workspaceDir: input.effectiveWorkspace,
-			spawnWorkspaceDir: input.effectiveCwd && input.effectiveCwd !== input.effectiveWorkspace ? input.resolvedWorkspace : resolveAttemptSpawnWorkspaceDir({
-				sandbox: input.sandbox,
-				resolvedWorkspace: input.resolvedWorkspace
-			}),
+	const toolConstructionPlan = resolveCodexNodePlacementToolConstructionPlan(input.sandbox, input.nativeToolSurfaceEnabled);
+	const options = {
+		agentId: input.sessionAgentId,
+		policyAgentId: input.policyAgentId,
+		...toolRunContext,
+		exec: {
+			...params.execOverrides,
+			...input.sessionPermissionPolicy ? { mode: input.sessionPermissionPolicy.execMode } : {},
+			...resolveCodexNodeExecToolOverrides(nativeExecutionPolicy),
 			config: params.config,
-			githubPublicationAvailable: params.githubPublicationAvailable,
-			authProfileStore: params.toolAuthProfileStore ?? params.authProfileStore,
-			abortSignal: input.runAbortController.signal,
-			emitBeforeToolCallDiagnostics: false,
-			modelProvider: params.model.provider,
-			modelId: params.modelId,
-			modelCompat: params.model.compat && typeof params.model.compat === "object" ? params.model.compat : void 0,
-			modelApi: params.model.api,
-			modelContextWindowTokens: params.model.contextWindow,
-			delegationCapability: params.delegationCapability,
-			modelAuthMode: resolveModelAuthMode(params.model.provider, params.config, params.toolAuthProfileStore ?? params.authProfileStore, { workspaceDir: input.effectiveWorkspace }),
-			suppressManagedWebSearch: false,
-			webFetchHostnameAllowlistRef,
-			currentChannelId: params.currentChannelId,
-			currentMessagingTarget: params.currentMessagingTarget,
-			hookChannelId: resolveCodexAppServerHookChannelId(params, input.sandboxSessionKey),
-			currentThreadTs: params.currentThreadTs,
-			currentMessageId: params.currentMessageId,
-			replyToMode: params.replyToMode,
-			hasRepliedRef: params.hasRepliedRef,
-			modelHasVision,
-			computerContextEpoch: input.computerContextEpoch,
-			registerRunCleanup: input.registerRunCleanup,
-			requireExplicitMessageTarget: params.requireExplicitMessageTarget ?? isSubagentSessionKey(params.sessionKey),
-			sourceReplyDeliveryMode: params.sourceReplyDeliveryMode,
-			taskSuggestionDeliveryMode: params.taskSuggestionDeliveryMode,
-			disableMessageTool: input.ignoreDisableMessageTool ? false : params.disableMessageTool,
-			forceMessageTool: shouldForceMessageTool(messagePolicyParams),
-			enableHeartbeatTool: params.trigger === "heartbeat" || input.forceHeartbeatTool === true,
-			forceHeartbeatTool: params.trigger === "heartbeat" || input.forceHeartbeatTool === true,
-			onYield: (message, acknowledgment) => {
-				input.onYieldDetected(acknowledgment);
-				input.onCodexAppServerEvent?.({
-					stream: "codex_app_server.tool",
-					data: {
-						name: "sessions_yield",
-						message
-					}
-				});
-			},
-			claimYieldCompletion: input.claimYieldCompletion,
-			recordToolPrepStage: (name) => {
-				toolBuildStages.mark(name);
-			},
-			onToolOutcome: params.onToolOutcome,
-			isTurnTainted: params.isTurnTainted,
-			allocateToolOutcomeOrdinal: params.allocateToolOutcomeOrdinal,
-			cronCreatorToolAllowlistRef: input.cronCreatorToolAllowlistRef,
-			cronCreatorToolAllowlistCaptureRef: input.cronCreatorToolAllowlistCaptureRef,
-			cronCreatorAuthorityUnavailableReason: input.cronCreatorAuthorityUnavailableReason
-		};
+			elevated: params.bashElevated
+		},
+		sessionPermissionPolicy: input.sessionPermissionPolicy ? {
+			mode: input.sessionPermissionPolicy.mode,
+			root: input.sessionPermissionPolicy.root
+		} : void 0,
+		sandbox: input.sandbox,
+		...toolConstructionPlan ? { toolConstructionPlan } : {},
+		messageProvider: resolveCodexMessageToolProvider(params),
+		toolPolicyMessageProvider: params.messageProvider ?? params.messageChannel,
+		clientCaps: params.clientCaps,
+		chatType: params.chatType,
+		agentAccountId: params.agentAccountId,
+		messageTo: params.messageTo,
+		messageThreadId: params.messageThreadId,
+		nativeChannelId: params.chatId,
+		messageActionTurnCapability: params.messageActionTurnCapability,
+		groupId: params.groupId,
+		groupChannel: params.groupChannel,
+		groupSpace: params.groupSpace,
+		spawnedBy: params.spawnedBy,
+		senderId: params.senderId,
+		senderName: params.senderName,
+		senderUsername: params.senderUsername,
+		senderE164: params.senderE164,
+		senderIsOwner: params.senderIsOwner,
+		inputProvenance: params.inputProvenance,
+		trustedInternalHandoff: params.trustedInternalHandoff,
+		scheduledToolPolicy: params.scheduledToolPolicy,
+		allowGatewaySubagentBinding: params.allowGatewaySubagentBinding || isForcedPrivateQaCodexRuntime(),
+		sessionKey: input.sandboxSessionKey,
+		runSessionKey: params.sessionKey && params.sessionKey !== input.sandboxSessionKey ? params.sessionKey : void 0,
+		sessionId: params.sessionId,
+		runId: params.runId,
+		approvalReviewerDeviceId: params.approvalReviewerDeviceId,
+		agentDir,
+		preparedModelRuntime: params.preparedModelRuntime,
+		cwd: input.effectiveCwd ?? input.effectiveWorkspace,
+		workspaceDir: input.effectiveWorkspace,
+		spawnWorkspaceDir: input.effectiveCwd && input.effectiveCwd !== input.effectiveWorkspace ? input.resolvedWorkspace : resolveAttemptSpawnWorkspaceDir({
+			sandbox: input.sandbox,
+			resolvedWorkspace: input.resolvedWorkspace
+		}),
+		config: params.config,
+		skillsSnapshot: params.skillsSnapshot,
+		...params.skillLibraryAuthoring ? { skillWorkshop: { libraryAuthoring: params.skillLibraryAuthoring } } : {},
+		githubPublicationAvailable: params.githubPublicationAvailable,
+		authProfileStore: params.toolAuthProfileStore ?? params.authProfileStore,
+		abortSignal: input.runAbortController.signal,
+		emitBeforeToolCallDiagnostics: false,
+		modelProvider: params.model.provider,
+		modelId: params.modelId,
+		modelCompat: params.model.compat && typeof params.model.compat === "object" ? params.model.compat : void 0,
+		modelApi: params.model.api,
+		modelContextWindowTokens: params.model.contextWindow,
+		delegationCapability: params.delegationCapability,
+		modelAuthMode: resolveModelAuthMode(params.model.provider, params.config, params.toolAuthProfileStore ?? params.authProfileStore, { workspaceDir: input.effectiveWorkspace }),
+		suppressManagedWebSearch: false,
+		webFetchHostnameAllowlistRef,
+		currentChannelId: params.currentChannelId,
+		currentMessagingTarget: params.currentMessagingTarget,
+		hookChannelId: resolveCodexAppServerHookChannelId(params, input.sandboxSessionKey),
+		currentThreadTs: params.currentThreadTs,
+		currentMessageId: params.currentMessageId,
+		replyToMode: params.replyToMode,
+		hasRepliedRef: params.hasRepliedRef,
+		modelHasVision,
+		computerContextEpoch: input.computerContextEpoch,
+		registerRunCleanup: input.registerRunCleanup,
+		requireExplicitMessageTarget: params.requireExplicitMessageTarget ?? isSubagentSessionKey(params.sessionKey),
+		sourceReplyDeliveryMode: params.sourceReplyDeliveryMode,
+		taskSuggestionDeliveryMode: params.taskSuggestionDeliveryMode,
+		disableMessageTool: input.ignoreDisableMessageTool ? false : params.disableMessageTool,
+		forceMessageTool: shouldForceMessageTool(messagePolicyParams),
+		enableHeartbeatTool: params.trigger === "heartbeat" || input.forceHeartbeatTool === true,
+		forceHeartbeatTool: params.trigger === "heartbeat" || input.forceHeartbeatTool === true,
+		onYield: (message, acknowledgment) => {
+			input.onYieldDetected(acknowledgment);
+			input.onCodexAppServerEvent?.({
+				stream: "codex_app_server.tool",
+				data: {
+					name: "sessions_yield",
+					message
+				}
+			});
+		},
+		claimYieldCompletion: input.claimYieldCompletion,
+		recordToolPrepStage: (name) => {
+			toolBuildStages.mark(name);
+		},
+		onToolOutcome: params.onToolOutcome,
+		isTurnTainted: params.isTurnTainted,
+		allocateToolOutcomeOrdinal: params.allocateToolOutcomeOrdinal,
+		cronCreatorToolAllowlistRef: input.cronCreatorToolAllowlistRef,
+		cronCreatorToolAllowlistCaptureRef: input.cronCreatorToolAllowlistCaptureRef,
+		cronCreatorAuthorityUnavailableReason: input.cronCreatorAuthorityUnavailableReason
+	};
+	const buildOpenClawCodingTools = () => {
 		const bindingOptions = { cwd: input.effectiveCwd ?? input.effectiveWorkspace };
 		if (injectedOpenClawCodingToolsFactory) return params.hostCapabilities.bindToolSurface(injectedOpenClawCodingToolsFactory(options), bindingOptions);
 		const createToolSurface = params.hostCapabilities.createToolSurface;
@@ -851,7 +845,7 @@ async function buildDynamicTools(input) {
 	const readableAllTools = [...readableAllToolProjection.tools];
 	const normallyProfiledTools = input.nativeToolSurfaceEnabled === false ? filterCodexDynamicToolsForDisabledNativeSurface(readableAllTools, input.pluginConfig, { preserveShell: shouldKeepOpenClawShellDynamicTools(input, nativeExecutionPolicy) }) : filterCodexDynamicTools(readableAllTools, input.pluginConfig);
 	const profileFilteredTools = (input.isHostScopedToolActive?.("openclaw") ?? isHostScopedAgentToolActive("openclaw")) && isSystemAgentOnlyCodexDynamicToolAllowlist(params.toolsAllow) ? preserveRingZeroSystemAgentTool(readableAllTools, normallyProfiledTools) : normallyProfiledTools;
-	const codexFilteredTools = addNodeShellDynamicToolsIfNeeded(addGatewayShellDynamicToolsIfAvailable(addSandboxShellDynamicToolsIfAvailable(isCodexMemoryFlushRun(params) ? filterCodexMemoryFlushDynamicTools(readableAllTools) : profileFilteredTools, readableAllTools, input, nativeExecutionPolicy), readableAllTools, input, nativeExecutionPolicy), readableAllTools, input, nativeExecutionPolicy);
+	const codexFilteredTools = await addNodeShellDynamicToolsIfNeeded(addGatewayShellDynamicToolsIfAvailable(addSandboxShellDynamicToolsIfAvailable(isCodexMemoryFlushRun(params) ? filterCodexMemoryFlushDynamicTools(readableAllTools) : profileFilteredTools, readableAllTools, input, nativeExecutionPolicy), readableAllTools, input, nativeExecutionPolicy), readableAllTools, input, nativeExecutionPolicy);
 	toolBuildStages.mark("codex-filtering");
 	const visionFilteredTools = filterCodexVisionTools(codexFilteredTools, {
 		modelHasVision,
@@ -905,7 +899,7 @@ async function buildDynamicTools(input) {
 	const webSearchAllowed = normalizedTools.some((tool) => tool.name === "web_search");
 	webFetchHostnameAllowlistRef.value = webSearchAllowed ? webSearchPlan.webFetchHostnameAllowlist : void 0;
 	input.onWebSearchPolicyResolved?.(webSearchAllowed);
-	const exposedTools = webSearchPlan.suppressManagedWebSearch ? normalizedTools.filter((tool) => tool.name !== "web_search") : normalizedTools;
+	const exposedTools = placeDisabledNativeShellToolsInDirectNamespace(webSearchPlan.suppressManagedWebSearch ? normalizedTools.filter((tool) => tool.name !== "web_search") : normalizedTools, input.nativeToolSurfaceEnabled);
 	if (preNormalizationDiagnostics.length > 0) embeddedAgentLog.warn(`codex app-server quarantined ${preNormalizationDiagnostics.length} unsupported runtime tool schema${preNormalizationDiagnostics.length === 1 ? "" : "s"} before dynamic tool registration`, {
 		runId: params.runId,
 		sessionId: params.sessionId,
@@ -1078,19 +1072,25 @@ function isSandboxShellDynamicToolExcluded(config) {
 		"sandbox_process"
 	]);
 }
-function addNodeShellDynamicToolsIfNeeded(filteredTools, allTools, input, nodePolicy) {
+async function addNodeShellDynamicToolsIfNeeded(filteredTools, allTools, input, nodePolicy) {
 	if (isCodexMemoryFlushRun(input.params)) return filteredTools;
 	const nodeExecIsDefault = nodePolicy.effectiveExecHost === "node";
 	const nodeExecAvailableFromAuto = nodePolicy.requestedExecHost === "auto" && nodePolicy.effectiveExecHost === "gateway";
 	if (!nodeExecIsDefault && !nodeExecAvailableFromAuto) return filteredTools;
 	const execTool = allTools.find((tool) => normalizeCodexDynamicToolName(tool.name) === "exec");
-	if (!execTool) return filteredTools;
-	if (!isCodexDynamicToolExcluded(input.pluginConfig, ["exec", "node_exec"]) && !filteredTools.some((tool) => normalizeCodexDynamicToolName(tool.name) === "node_exec")) return [...filteredTools, createNodeExecAliasDynamicTool(execTool, nodePolicy.node)];
-	return filteredTools;
+	if (!execTool || isCodexDynamicToolExcluded(input.pluginConfig, ["exec", "node_exec"]) || filteredTools.some((tool) => normalizeCodexDynamicToolName(tool.name) === "node_exec")) return filteredTools;
+	const nodeExec = await createNodeExecAliasDynamicTool(execTool, nodePolicy.node, input.runAbortController.signal, input.nodeExecAvailability);
+	return nodeExec ? [...filteredTools, nodeExec] : filteredTools;
 }
 function shouldKeepOpenClawShellDynamicTools(input, nodePolicy) {
 	return !isCodexMemoryFlushRun(input.params) && input.nativeToolSurfaceEnabled === false && input.sandbox?.enabled !== true && nodePolicy.effectiveExecHost !== "node";
 }
+/** Keeps replacement shell tools direct even when model metadata mandates Codex Code Mode. */
+function placeDisabledNativeShellToolsInDirectNamespace(tools, nativeToolSurfaceEnabled) {
+	if (nativeToolSurfaceEnabled !== false) return tools;
+	for (const tool of tools) if (CODEX_DISABLED_NATIVE_SHELL_DYNAMIC_TOOLS.has(normalizeCodexDynamicToolName(tool.name))) tool.catalogMode = "direct-only";
+	return tools;
+}
 /** Applies a normalized tool allowlist while preserving shell aliases for exec/process. */
 function filterCodexDynamicToolsForAllowlist(tools, toolsAllow) {
 	if (!toolsAllow) return tools;
@@ -3257,52 +3257,6 @@ async function handleMessage(session, data) {
 	await session.handleRequest(parseRequest(buffer.toString("utf8")));
 }
 //#endregion
-//#region extensions/codex/src/app-server/provider-capabilities.ts
-function resolveOverriddenProviderWebSearchSupport(modelProviderOverride) {
-	const provider = modelProviderOverride?.trim().toLowerCase();
-	if (!provider) return;
-	return provider === "openai" ? "supported" : "unsupported";
-}
-async function readConfiguredProviderWebSearchSupport(params) {
-	return (await params.client.request("modelProvider/capabilities/read", {}, {
-		timeoutMs: params.timeoutMs,
-		signal: params.signal
-	})).webSearch ? "supported" : "unsupported";
-}
-async function resolveCodexProviderWebSearchSupportForClient(params) {
-	const overrideSupport = resolveOverriddenProviderWebSearchSupport(params.modelProviderOverride);
-	if (overrideSupport) return overrideSupport;
-	try {
-		return await readConfiguredProviderWebSearchSupport(params);
-	} catch {
-		return "unknown";
-	}
-}
-async function resolveCodexProviderWebSearchSupport(params) {
-	const overrideSupport = resolveOverriddenProviderWebSearchSupport(params.modelProviderOverride);
-	if (overrideSupport) return overrideSupport;
-	let client;
-	try {
-		client = await params.clientFactory({
-			startOptions: params.appServer.start,
-			...params.preparedAuth ? { preparedAuth: params.preparedAuth } : { authProfileId: params.authProfileId },
-			agentDir: params.agentDir,
-			config: params.config,
-			timeoutMs: params.appServer.requestTimeoutMs
-		});
-		return await resolveCodexProviderWebSearchSupportForClient({
-			client,
-			timeoutMs: params.appServer.requestTimeoutMs,
-			modelProviderOverride: params.modelProviderOverride,
-			signal: params.signal
-		});
-	} catch {
-		return "unknown";
-	} finally {
-		if (client) releaseLeasedSharedCodexAppServerClient(client);
-	}
-}
-//#endregion
 //#region extensions/codex/src/app-server/approval-bridge.ts
 /**
 * Bridges Codex app-server approval requests into OpenClaw policy hooks and
@@ -4211,16 +4165,63 @@ async function routeCodexAppServerElicitationRequest(params) {
 			signal: params.signal
 		}));
 	}
-	const approvalPrompt = readComputerUseApprovalElicitation(requestParams, params.computerUseMcpServerName) ?? readBridgeableApprovalElicitation(requestParams);
+	const computerUsePrompt = readComputerUseApprovalElicitation(requestParams, params.computerUseMcpServerName);
+	const approvalPrompt = computerUsePrompt ?? readBridgeableApprovalElicitation(requestParams);
 	if (!approvalPrompt) return handled(createCodexElicitationResponse("decline"));
+	let persistence;
+	if (!computerUsePrompt) {
+		const serverName = readNonBlankStringField(requestParams, "serverName");
+		const server = serverName ? params.paramsForRun.config?.mcp?.servers?.[serverName] : void 0;
+		const mode = serverName ? resolveProjectedMcpCodexToolApprovalMode(serverName, server ?? {}, params.projectedMcpServers?.[serverName]) : void 0;
+		if (!requiresMcpCodexToolApproval({
+			mode,
+			fullPermission: params.autoApproveMcpTools
+		})) {
+			params.paramsForRun.hostCapabilities.assertActive();
+			return handled(buildElicitationResponse(approvalPrompt, "approved-once"));
+		}
+		if (mode === "prompt") approvalPrompt.allowedDecisions = ["allow-once", "deny"];
+		else if (serverName && serverName !== CODEX_APPS_SERVER_NAME && Object.hasOwn(params.paramsForRun.config?.mcp?.servers ?? {}, serverName) && requestTurnId === params.turnId && readPersistHints(approvalPrompt.meta, "explicit").includes("always")) {
+			const resolveItem = () => {
+				const item = params.getActiveMcpToolCall?.(serverName);
+				return item?.server === serverName && matchesMcpApprovalDisplay(item, approvalPrompt.meta) ? item : void 0;
+			};
+			const item = resolveItem();
+			if (item) persistence = {
+				mcpTool: {
+					server: serverName,
+					tool: item.tool
+				},
+				toolCallId: item.id,
+				isMcpToolApprovalActive: () => {
+					const current = resolveItem();
+					return current?.id === item.id && current.tool === item.tool;
+				}
+			};
+		}
+	}
 	return handled(buildElicitationResponse(approvalPrompt, await requestPluginApprovalOutcome({
-		paramsForRun: params.paramsForRun,
+		hostCapabilities: params.paramsForRun.hostCapabilities,
 		title: approvalPrompt.title,
 		description: approvalPrompt.description,
 		allowedDecisions: approvalPrompt.allowedDecisions,
+		toolName: "codex_mcp_tool_approval",
+		...persistence,
 		signal: params.signal
 	})));
 }
+function matchesMcpApprovalDisplay(item, meta) {
+	if (!Object.hasOwn(meta, MCP_TOOL_APPROVAL_TOOL_PARAMS_DISPLAY_KEY)) return true;
+	const display = meta[MCP_TOOL_APPROVAL_TOOL_PARAMS_DISPLAY_KEY];
+	if (!Array.isArray(display)) return false;
+	const args = item.arguments;
+	return display.every((param) => {
+		if (!isJsonObject(param) || typeof param.name !== "string" || !isJsonObject(args)) return false;
+		if (!Object.hasOwn(args, param.name)) return false;
+		const value = args[param.name];
+		return typeof param.value !== "string" || param.value === (typeof value === "string" ? value : JSON.stringify(value));
+	});
+}
 function handled(response) {
 	return {
 		kind: "handled",
@@ -4336,14 +4337,14 @@ async function buildPluginPolicyElicitationResponse(params) {
 	const response = buildElicitationResponse(approvalPrompt, "approved-once");
 	if (response.action === "accept") {
 		if (mode === "allow") return response;
-		const outcome = await requestPluginApprovalOutcome({
-			paramsForRun: params.paramsForRun,
+		return buildElicitationResponse(approvalPrompt, await requestPluginApprovalOutcome({
+			hostCapabilities: params.paramsForRun.hostCapabilities,
 			title: approvalPrompt.title,
 			description: approvalPrompt.description,
 			allowedDecisions: allowedPluginPolicyApprovalDecisions(mode, approvalPrompt),
+			toolName: "codex_mcp_tool_approval",
 			signal: params.signal
-		});
-		return buildElicitationResponse(approvalPrompt, mode === "ask" && outcome === "approved-session" ? "approved-once" : outcome);
+		}));
 	}
 	logPluginElicitationDecline("unmappable_schema", params.requestParams);
 	return createCodexElicitationResponse("decline");
@@ -4378,15 +4379,16 @@ function readPluginApprovalElicitation(entry, requestParams) {
 		allowedDecisions: buildApprovalAllowedDecisions(requestedSchema, meta)
 	};
 }
-function buildApprovalAllowedDecisions(requestedSchema, meta) {
-	return canMapPersistentApproval(requestedSchema, meta) ? [
+function buildApprovalAllowedDecisions(requestedSchema, meta, allowSession = false) {
+	return canMapPersistentApproval(requestedSchema, meta, allowSession) ? [
 		"allow-once",
 		"allow-always",
 		"deny"
 	] : ["allow-once", "deny"];
 }
-function canMapPersistentApproval(requestedSchema, meta) {
+function canMapPersistentApproval(requestedSchema, meta, allowSession) {
 	const persistHints = readPersistHints(meta, "explicit");
+	if (allowSession) return choosePersistHint(persistHints) !== void 0;
 	if (persistHints.length > 0) return persistHints.includes("always");
 	const properties = isJsonObject(requestedSchema.properties) ? requestedSchema.properties : {};
 	return Object.entries(properties).some(([name, value]) => {
@@ -4411,16 +4413,20 @@ function readBridgeableApprovalElicitation(requestParams) {
 	const requestedSchema = requestParams.requestedSchema;
 	if (readNonBlankStringField(requestedSchema, "type") !== "object" || !isJsonObject(requestedSchema.properties)) return;
 	const title = sanitizeDisplayText(readNonBlankStringField(requestParams, "message") ?? "") || "Codex MCP tool approval";
+	const serverName = readNonBlankStringField(requestParams, "serverName");
 	return {
 		title,
 		description: buildApprovalDescription({
 			title,
 			meta: requestParams["_meta"],
 			requestedSchema,
-			serverName: sanitizeOptionalDisplayText(readNonBlankStringField(requestParams, "serverName"))
+			serverName: sanitizeOptionalDisplayText(serverName),
+			remedy: serverName ? formatMcpCodexApprovalRemedy(serverName) : void 0
 		}),
 		requestedSchema,
-		meta: requestParams["_meta"]
+		meta: requestParams["_meta"],
+		persistHintsMode: "explicit",
+		allowedDecisions: buildApprovalAllowedDecisions(requestedSchema, requestParams["_meta"], true)
 	};
 }
 function readComputerUseApprovalElicitation(requestParams, expectedServerName) {
@@ -4450,6 +4456,7 @@ function buildApprovalDescription(params) {
 		connectorName && `App: ${connectorName}`,
 		toolTitle && `Tool: ${toolTitle}`,
 		params.serverName && `MCP server: ${params.serverName}`,
+		params.remedy,
 		toolDescription
 	].filter((line) => Boolean(line));
 	const paramLines = readDisplayParamLines(params.meta);
@@ -4530,36 +4537,10 @@ function sanitizeDisplayText(value) {
 	const escaped = sanitized ? formatCodexDisplayText(sanitized) : "";
 	return clipped && escaped ? `${escaped}...` : escaped;
 }
-async function requestPluginApprovalOutcome(params) {
-	try {
-		const requestResult = await requestPluginApproval({
-			hostCapabilities: params.paramsForRun.hostCapabilities,
-			signal: params.signal,
-			title: params.title,
-			description: params.description,
-			severity: "warning",
-			toolName: "codex_mcp_tool_approval",
-			allowedDecisions: params.allowedDecisions
-		});
-		const approvalId = requestResult?.id;
-		if (!approvalId) return "unavailable";
-		const approvalResult = approvalRequestExplicitlyUnavailable(requestResult) ? void 0 : await waitForPluginApprovalDecision({
-			hostCapabilities: params.paramsForRun.hostCapabilities,
-			approvalId,
-			signal: params.signal
-		});
-		if (params.signal?.aborted) return "cancelled";
-		if (approvalResult?.terminalReason === "timeout") return "timed-out";
-		return mapExecDecisionToOutcome(approvalResult?.decision);
-	} catch {
-		return params.signal?.aborted ? "cancelled" : "denied";
-	}
-}
 function buildElicitationResponse(approvalPrompt, outcome) {
 	const { requestedSchema, meta } = approvalPrompt;
 	if (outcome === "cancelled") return createCodexElicitationResponse("cancel");
-	if (outcome === "timed-out") return createCodexElicitationResponse("decline", null, { message: codexApprovalTimeoutText("other") });
-	if (outcome === "denied" || outcome === "unavailable") return createCodexElicitationResponse("decline");
+	if (outcome === "timed-out" || outcome === "denied" || outcome === "unavailable") return createCodexElicitationResponse("decline");
 	const content = buildAcceptedContent(approvalPrompt, outcome);
 	if (!content && !hasNoSchemaProperties(requestedSchema)) {
 		embeddedAgentLog.warn("codex MCP approval elicitation approved without a mappable response", {
@@ -4586,7 +4567,7 @@ function buildAcceptedContent(approvalPrompt, outcome) {
 			schema,
 			required: required.has(name)
 		};
-		const next = readApprovalFieldValue(property, outcome) ?? readPersistFieldValue(property, meta, outcome, approvalPrompt.persistHintsMode ?? "legacy") ?? readFallbackFieldValue(property, outcome);
+		const next = readApprovalFieldValue(property, outcome, choosePersistHint(readPersistHints(meta, approvalPrompt.persistHintsMode))) ?? readPersistFieldValue(property, meta, outcome, approvalPrompt.persistHintsMode ?? "legacy") ?? readFallbackFieldValue(property, outcome);
 		if (next === void 0) {
 			if (isApprovalField(property)) sawApprovalField = true;
 			if (property.required) return;
@@ -4597,15 +4578,14 @@ function buildAcceptedContent(approvalPrompt, outcome) {
 	}
 	return sawApprovalField ? content : void 0;
 }
-function readApprovalFieldValue(property, outcome) {
+function readApprovalFieldValue(property, outcome, persist) {
 	if (!isApprovalField(property)) return;
 	if (readNonBlankStringField(property.schema, "type") === "boolean") return true;
 	const options = readEnumOptions(property.schema);
 	if (options.length === 0) return;
-	const sessionChoice = options.find((option) => isSessionApprovalOption(option));
 	const acceptChoice = options.find((option) => isPositiveApprovalOption(option));
-	if (outcome === "approved-session") return sessionChoice?.value ?? acceptChoice?.value;
-	return acceptChoice?.value ?? sessionChoice?.value;
+	if (outcome === "approved-session") return options.find((option) => isPersistentApprovalOption(option, persist))?.value ?? acceptChoice?.value;
+	return acceptChoice?.value;
 }
 function readPersistFieldValue(property, meta, outcome, persistHintsMode) {
 	if (!isPersistField(property) || outcome !== "approved-session") return;
@@ -4684,9 +4664,9 @@ function isPositiveApprovalOption(option) {
 	const haystack = `${option.value} ${option.label}`.toLowerCase();
 	return /\b(allow|approve|accept|yes|continue|proceed|true)\b/.test(haystack);
 }
-function isSessionApprovalOption(option) {
+function isPersistentApprovalOption(option, persist) {
 	const haystack = `${option.value} ${option.label}`.toLowerCase();
-	return /\b(session|always|persistent)\b/.test(haystack) && /\b(allow|approve|accept)\b/.test(haystack);
+	return (persist === "always" ? /\b(always|persistent)\b|\bdon't ask me again\b/.test(haystack) : persist === "session" && /\bsession\b/.test(haystack)) && /\b(allow|approve|accept)\b/.test(haystack);
 }
 function readNonBlankStringField(record, key) {
 	const value = record?.[key];
@@ -4699,6 +4679,191 @@ function readFirstString$1(record, keys) {
 	}
 }
 //#endregion
+//#region extensions/codex/src/app-server/dynamic-tool-catalog.ts
+/** Namespace attached to OpenClaw-owned dynamic tools exposed to Codex. */
+const CODEX_OPENCLAW_DYNAMIC_TOOL_NAMESPACE = "openclaw";
+const CODEX_DYNAMIC_TOOL_NAME_MAX_CHARS = 128;
+const CODEX_DYNAMIC_TOOL_NAME_PATTERN = /^[a-zA-Z0-9_-]+$/u;
+const ALWAYS_DIRECT_DYNAMIC_TOOL_NAMES = /* @__PURE__ */ new Set([
+	"agents_list",
+	"progress_card",
+	"sessions_spawn",
+	"sessions_yield"
+]);
+function createCodexDynamicToolSpecs(params) {
+	const directToolNames = /* @__PURE__ */ new Set([...ALWAYS_DIRECT_DYNAMIC_TOOL_NAMES, ...params.directToolNames ?? []]);
+	const specs = [];
+	const namespaceTools = [];
+	const directOnlyNamespaceTools = [];
+	const entries = params.loading === "direct" ? params.entries : params.entries.toSorted((left, right) => left.name.localeCompare(right.name));
+	for (const entry of entries) {
+		const functionSpec = createCodexDynamicToolFunctionSpec({ entry });
+		if (entry.name === "openclaw" && directToolNames.has(entry.name)) {
+			specs.push(functionSpec);
+			continue;
+		}
+		if (entry.tool.catalogMode === "direct-only") {
+			directOnlyNamespaceTools.push(functionSpec);
+			continue;
+		}
+		if (params.loading === "direct" || directToolNames.has(entry.name)) {
+			specs.push(functionSpec);
+			continue;
+		}
+		namespaceTools.push({
+			...functionSpec,
+			deferLoading: true
+		});
+	}
+	if (namespaceTools.length > 0) specs.push({
+		type: "namespace",
+		name: CODEX_OPENCLAW_DYNAMIC_TOOL_NAMESPACE,
+		description: "",
+		tools: namespaceTools
+	});
+	if (directOnlyNamespaceTools.length > 0) specs.push({
+		type: "namespace",
+		name: CODEX_OPENCLAW_DIRECT_DYNAMIC_TOOL_NAMESPACE,
+		description: "",
+		tools: directOnlyNamespaceTools
+	});
+	return specs;
+}
+function createCodexDynamicToolFunctionSpec(params) {
+	return {
+		type: "function",
+		name: params.entry.name,
+		description: params.entry.description,
+		inputSchema: params.entry.inputSchema
+	};
+}
+function projectCodexDynamicTools(tools) {
+	const projectedTools = [];
+	const quarantinedTools = [];
+	let length;
+	try {
+		length = tools.length;
+	} catch {
+		return {
+			tools: [],
+			quarantinedTools: [{
+				tool: "tool[0]",
+				violations: ["tool[0] is unreadable"]
+			}]
+		};
+	}
+	for (let toolIndex = 0; toolIndex < length; toolIndex += 1) {
+		let tool;
+		try {
+			tool = tools[toolIndex];
+		} catch {
+			quarantinedTools.push({
+				tool: `tool[${toolIndex}]`,
+				violations: [`tool[${toolIndex}] is unreadable`]
+			});
+			continue;
+		}
+		const descriptor = readCodexDynamicToolDescriptor(tool, toolIndex);
+		if (!descriptor.ok) {
+			quarantinedTools.push(descriptor.diagnostic);
+			continue;
+		}
+		const normalizedParameters = normalizeOpenAIStrictCompatSchema(descriptor.parameters);
+		const projection = projectRuntimeToolInputSchema(normalizedParameters ?? descriptor.parameters, `${descriptor.name}.inputSchema`);
+		if (projection.violations.length > 0) {
+			quarantinedTools.push({
+				tool: descriptor.name,
+				violations: projection.violations
+			});
+			continue;
+		}
+		if (!isRecord(projection.schema)) {
+			quarantinedTools.push({
+				tool: descriptor.name,
+				violations: [`${descriptor.name}.inputSchema must be a JSON object schema`]
+			});
+			continue;
+		}
+		projectedTools.push({
+			tool,
+			name: descriptor.name,
+			description: descriptor.description,
+			inputSchema: projection.schema
+		});
+	}
+	return {
+		tools: projectedTools,
+		quarantinedTools
+	};
+}
+function readCodexDynamicToolDescriptor(tool, toolIndex) {
+	const fallbackName = `tool[${toolIndex}]`;
+	let name;
+	try {
+		const rawName = tool.name;
+		if (typeof rawName !== "string" || !rawName) return {
+			ok: false,
+			diagnostic: {
+				tool: fallbackName,
+				violations: [`${fallbackName}.name must be a non-empty string`]
+			}
+		};
+		const trimmedName = rawName.trim();
+		let nameViolation;
+		if (!trimmedName) nameViolation = `${rawName}.name must not be empty`;
+		else if (trimmedName !== rawName) nameViolation = `${rawName}.name must not have leading or trailing whitespace`;
+		else if (!CODEX_DYNAMIC_TOOL_NAME_PATTERN.test(rawName)) nameViolation = `${rawName}.name must match ^[a-zA-Z0-9_-]+$`;
+		else if (rawName.length > CODEX_DYNAMIC_TOOL_NAME_MAX_CHARS) nameViolation = `${rawName}.name must be at most ${CODEX_DYNAMIC_TOOL_NAME_MAX_CHARS} characters`;
+		else if (rawName === "mcp" || rawName.startsWith("mcp__")) nameViolation = `${rawName}.name is reserved by Codex app-server`;
+		if (nameViolation) return {
+			ok: false,
+			diagnostic: {
+				tool: rawName,
+				violations: [nameViolation]
+			}
+		};
+		name = rawName;
+	} catch {
+		return {
+			ok: false,
+			diagnostic: {
+				tool: fallbackName,
+				violations: [`${fallbackName}.name is unreadable`]
+			}
+		};
+	}
+	let description;
+	try {
+		description = typeof tool.description === "string" ? tool.description : "";
+	} catch {
+		return {
+			ok: false,
+			diagnostic: {
+				tool: name,
+				violations: [`${name}.description is unreadable`]
+			}
+		};
+	}
+	let parameters;
+	try {
+		parameters = tool.parameters;
+	} catch {
+		return {
+			ok: false,
+			diagnostic: {
+				tool: name,
+				violations: [`${name}.inputSchema is unreadable`]
+			}
+		};
+	}
+	return {
+		ok: true,
+		name,
+		description,
+		parameters
+	};
+}
+//#endregion
 //#region extensions/codex/src/app-server/dynamic-tools.ts
 /**
 * Bridges OpenClaw runtime tools into Codex app-server dynamic tool specs and
@@ -4862,15 +5027,6 @@ function normalizeAcceptedSessionSpawn(result) {
 		childSessionKey
 	} : null;
 }
-/** Namespace attached to OpenClaw-owned dynamic tools exposed to Codex. */
-const CODEX_OPENCLAW_DYNAMIC_TOOL_NAMESPACE = "openclaw";
-const CODEX_DYNAMIC_TOOL_NAME_MAX_CHARS = 128;
-const CODEX_DYNAMIC_TOOL_NAME_PATTERN = /^[a-zA-Z0-9_-]+$/u;
-const ALWAYS_DIRECT_DYNAMIC_TOOL_NAMES = /* @__PURE__ */ new Set([
-	"agents_list",
-	"sessions_spawn",
-	"sessions_yield"
-]);
 const EXPLICIT_MESSAGE_PROVIDER_KEYS = ["channel", "provider"];
 const EXPLICIT_MESSAGE_TARGET_KEYS = [
 	"target",
@@ -4910,11 +5066,13 @@ function createCodexDynamicToolBridge(params) {
 	const toolResultMaxChars = typeof contextWindowTokens === "number" && Number.isFinite(contextWindowTokens) && contextWindowTokens > 0 ? Math.max(1, resolveLiveToolResultMaxChars({ contextWindowTokens })) : DEFAULT_MAX_LIVE_TOOL_RESULT_CHARS;
 	const availableProjection = projectCodexExecutableDynamicToolSurface(params.tools, params.hookContext);
 	const registeredProjection = params.registeredTools ? projectCodexDynamicTools(params.registeredTools) : availableProjection;
-	const availableTools = availableProjection.tools;
+	const inheritedSpecs = params.registeredSpecs ? structuredClone([...params.registeredSpecs]) : void 0;
+	const inheritedNames = inheritedSpecs ? new Set(flattenCodexDynamicToolFunctions(inheritedSpecs).map((tool) => tool.name)) : void 0;
+	const availableTools = availableProjection.tools.filter((entry) => !inheritedNames || inheritedNames.has(entry.name));
 	const quarantinedAvailableToolNames = new Set(availableProjection.quarantinedTools.map((tool) => tool.tool));
 	const registeredSpecTools = (params.registeredTools ? registeredProjection.tools : availableTools).filter((entry) => !quarantinedAvailableToolNames.has(entry.name));
 	const toolMap = new Map(availableTools.map((entry) => [entry.name, entry]));
-	const registeredToolNames = new Set(registeredSpecTools.map((entry) => entry.name));
+	const registeredToolNames = inheritedNames ?? new Set(registeredSpecTools.map((entry) => entry.name));
 	const quarantinedTools = dedupeQuarantinedDynamicTools([...availableProjection.quarantinedTools, ...registeredProjection.quarantinedTools]);
 	warnQuarantinedDynamicTools({
 		tools: quarantinedTools,
@@ -4947,16 +5105,23 @@ function createCodexDynamicToolBridge(params) {
 	};
 	const legacyExtensionRunner = createCodexAppServerToolResultExtensionRunner(toolResultHookContext);
 	const executionSnapshotStates = /* @__PURE__ */ new Map();
-	const directToolNames = /* @__PURE__ */ new Set([...ALWAYS_DIRECT_DYNAMIC_TOOL_NAMES, ...params.directToolNames ?? []]);
+	const directToolNames = params.directToolNames;
 	let readRemoteWorkspaceFile;
 	return {
 		availableTools: availableTools.map((entry) => entry.tool),
-		availableSpecs: createCodexDynamicToolSpecs({
+		availableSpecs: inheritedSpecs ? inheritedSpecs.flatMap((spec) => {
+			if (spec.type === "function") return toolMap.has(spec.name) ? [spec] : [];
+			const tools = spec.tools.filter((tool) => toolMap.has(tool.name));
+			return tools.length ? [{
+				...spec,
+				tools
+			}] : [];
+		}) : createCodexDynamicToolSpecs({
 			entries: availableTools,
 			loading: params.loading ?? "searchable",
 			directToolNames
 		}),
-		specs: createCodexDynamicToolSpecs({
+		specs: inheritedSpecs ?? createCodexDynamicToolSpecs({
 			entries: registeredSpecTools,
 			loading: params.loading ?? "searchable",
 			directToolNames
@@ -5171,6 +5336,8 @@ function createCodexDynamicToolBridge(params) {
 					sideEffectEvidence: !replaySafe
 				});
 			} catch (error) {
+				const trustedNoStart = consumeTrustedToolNoStartError(error);
+				executionPrevented ||= trustedNoStart;
 				captureExecutionBoundary();
 				if (toolName === "computer" && params.computerContextEpoch?.frameToolCallId === call.callId) invalidateComputerFrame(params.computerContextEpoch);
 				const executionDisposition = getBeforeToolCallFailureDisposition(error) ?? (signal.aborted ? resolveCodexToolAbortTerminalReason(signal) : resolveToolExecutionErrorKind(error));
@@ -5281,182 +5448,6 @@ function wrapProjectedCodexDynamicTools(tools, hookContext) {
 		quarantinedTools
 	};
 }
-function createCodexDynamicToolSpecs(params) {
-	const specs = [];
-	const namespaceTools = [];
-	const directOnlyNamespaceTools = [];
-	const entries = params.loading === "direct" ? params.entries : params.entries.toSorted((left, right) => left.name.localeCompare(right.name));
-	for (const entry of entries) {
-		const functionSpec = createCodexDynamicToolFunctionSpec({ entry });
-		if (entry.name === "openclaw" && params.directToolNames.has(entry.name)) {
-			specs.push(functionSpec);
-			continue;
-		}
-		if (entry.tool.catalogMode === "direct-only") {
-			directOnlyNamespaceTools.push(functionSpec);
-			continue;
-		}
-		if (params.loading === "direct" || params.directToolNames.has(entry.name)) {
-			specs.push(functionSpec);
-			continue;
-		}
-		namespaceTools.push({
-			...functionSpec,
-			deferLoading: true
-		});
-	}
-	if (namespaceTools.length > 0) specs.push({
-		type: "namespace",
-		name: CODEX_OPENCLAW_DYNAMIC_TOOL_NAMESPACE,
-		description: "",
-		tools: namespaceTools
-	});
-	if (directOnlyNamespaceTools.length > 0) specs.push({
-		type: "namespace",
-		name: CODEX_OPENCLAW_DIRECT_DYNAMIC_TOOL_NAMESPACE,
-		description: "",
-		tools: directOnlyNamespaceTools
-	});
-	return specs;
-}
-function createCodexDynamicToolFunctionSpec(params) {
-	return {
-		type: "function",
-		name: params.entry.name,
-		description: params.entry.description,
-		inputSchema: params.entry.inputSchema
-	};
-}
-function projectCodexDynamicTools(tools) {
-	const projectedTools = [];
-	const quarantinedTools = [];
-	let length;
-	try {
-		length = tools.length;
-	} catch {
-		return {
-			tools: [],
-			quarantinedTools: [{
-				tool: "tool[0]",
-				violations: ["tool[0] is unreadable"]
-			}]
-		};
-	}
-	for (let toolIndex = 0; toolIndex < length; toolIndex += 1) {
-		let tool;
-		try {
-			tool = tools[toolIndex];
-		} catch {
-			quarantinedTools.push({
-				tool: `tool[${toolIndex}]`,
-				violations: [`tool[${toolIndex}] is unreadable`]
-			});
-			continue;
-		}
-		const descriptor = readCodexDynamicToolDescriptor(tool, toolIndex);
-		if (!descriptor.ok) {
-			quarantinedTools.push(descriptor.diagnostic);
-			continue;
-		}
-		const normalizedParameters = normalizeOpenAIToolSchemas({
-			provider: "openai",
-			modelApi: "openai-chatgpt-responses",
-			tools: [{ parameters: descriptor.parameters }]
-		})[0]?.parameters;
-		const projection = projectRuntimeToolInputSchema(normalizedParameters ?? descriptor.parameters, `${descriptor.name}.inputSchema`);
-		if (projection.violations.length > 0) {
-			quarantinedTools.push({
-				tool: descriptor.name,
-				violations: projection.violations
-			});
-			continue;
-		}
-		if (!isRecord(projection.schema)) {
-			quarantinedTools.push({
-				tool: descriptor.name,
-				violations: [`${descriptor.name}.inputSchema must be a JSON object schema`]
-			});
-			continue;
-		}
-		projectedTools.push({
-			tool,
-			name: descriptor.name,
-			description: descriptor.description,
-			inputSchema: projection.schema
-		});
-	}
-	return {
-		tools: projectedTools,
-		quarantinedTools
-	};
-}
-function readCodexDynamicToolDescriptor(tool, toolIndex) {
-	const fallbackName = `tool[${toolIndex}]`;
-	let name;
-	try {
-		const rawName = tool.name;
-		if (typeof rawName !== "string" || !rawName) return {
-			ok: false,
-			diagnostic: {
-				tool: fallbackName,
-				violations: [`${fallbackName}.name must be a non-empty string`]
-			}
-		};
-		const trimmedName = rawName.trim();
-		let nameViolation;
-		if (!trimmedName) nameViolation = `${rawName}.name must not be empty`;
-		else if (trimmedName !== rawName) nameViolation = `${rawName}.name must not have leading or trailing whitespace`;
-		else if (!CODEX_DYNAMIC_TOOL_NAME_PATTERN.test(rawName)) nameViolation = `${rawName}.name must match ^[a-zA-Z0-9_-]+$`;
-		else if (rawName.length > CODEX_DYNAMIC_TOOL_NAME_MAX_CHARS) nameViolation = `${rawName}.name must be at most ${CODEX_DYNAMIC_TOOL_NAME_MAX_CHARS} characters`;
-		else if (rawName === "mcp" || rawName.startsWith("mcp__")) nameViolation = `${rawName}.name is reserved by Codex app-server`;
-		if (nameViolation) return {
-			ok: false,
-			diagnostic: {
-				tool: rawName,
-				violations: [nameViolation]
-			}
-		};
-		name = rawName;
-	} catch {
-		return {
-			ok: false,
-			diagnostic: {
-				tool: fallbackName,
-				violations: [`${fallbackName}.name is unreadable`]
-			}
-		};
-	}
-	let description;
-	try {
-		description = typeof tool.description === "string" ? tool.description : "";
-	} catch {
-		return {
-			ok: false,
-			diagnostic: {
-				tool: name,
-				violations: [`${name}.description is unreadable`]
-			}
-		};
-	}
-	let parameters;
-	try {
-		parameters = tool.parameters;
-	} catch {
-		return {
-			ok: false,
-			diagnostic: {
-				tool: name,
-				violations: [`${name}.inputSchema is unreadable`]
-			}
-		};
-	}
-	return {
-		ok: true,
-		name,
-		description,
-		parameters
-	};
-}
 function warnQuarantinedDynamicTools(params) {
 	if (params.tools.length === 0) return;
 	const unique = /* @__PURE__ */ new Map();
@@ -5767,4 +5758,4 @@ function isCronAddAction(args) {
 	return typeof action === "string" && action.trim().toLowerCase() === "add";
 }
 //#endregion
-export { shouldRequireCodexSandboxExecServerEnvironment as C, CodexNativeToolLifecycleProjector as D, readBoundedCodexRemoteWorkspaceFile as E, shouldEnableCodexAppServerNativeToolSurface as S, filterCodexVisionTools as T, resolveCodexAppServerHookChannelId as _, emitDynamicToolStartedDiagnostic as a, resolveCodexNodePlacementToolConstructionPlan as b, resolveCodexProviderWebSearchSupport as c, releaseCodexSandboxExecServerEnvironment as d, buildDynamicTools as f, resolveCodexAppServerExecutionCwd as g, formatCodexDynamicToolBuildStageSummary as h, emitDynamicToolErrorDiagnostic as i, resolveCodexProviderWebSearchSupportForClient as l, disableCodexPluginThreadConfig as m, projectCodexExecutableDynamicTools as n, emitDynamicToolTerminalDiagnostic as o, createCodexDynamicToolBuildStageTracker as p, routeCodexAppServerElicitationRequest as r, handleCodexAppServerApprovalRequest as s, createCodexDynamicToolBridge as t, ensureCodexSandboxExecServerEnvironment as u, resolveCodexExternalSandboxPolicyForOpenClawSandbox as v, shouldWarnCodexDynamicToolBuildStageSummary as w, resolveCodexSandboxEnvironmentSelection as x, resolveCodexMessageToolProvider as y };
+export { filterCodexVisionTools as C, shouldWarnCodexDynamicToolBuildStageSummary as S, CodexNativeToolLifecycleProjector as T, resolveCodexMessageToolProvider as _, emitDynamicToolStartedDiagnostic as a, shouldEnableCodexAppServerNativeToolSurface as b, ensureCodexSandboxExecServerEnvironment as c, createCodexDynamicToolBuildStageTracker as d, disableCodexPluginThreadConfig as f, resolveCodexExternalSandboxPolicyForOpenClawSandbox as g, resolveCodexAppServerHookChannelId as h, emitDynamicToolErrorDiagnostic as i, releaseCodexSandboxExecServerEnvironment as l, resolveCodexAppServerExecutionCwd as m, projectCodexExecutableDynamicTools as n, emitDynamicToolTerminalDiagnostic as o, formatCodexDynamicToolBuildStageSummary as p, routeCodexAppServerElicitationRequest as r, handleCodexAppServerApprovalRequest as s, createCodexDynamicToolBridge as t, buildDynamicTools as u, resolveCodexNodePlacementToolConstructionPlan as v, readBoundedCodexRemoteWorkspaceFile as w, shouldRequireCodexSandboxExecServerEnvironment as x, resolveCodexSandboxEnvironmentSelection as y };