@openclaw/codex 2026.9.1-beta.1 → 2026.9.1

package/dist/{thread-lifecycle-L7oEkTlq.js → thread-lifecycle-DAcEJ_Om.js}

@@ -1,35 +1,37 @@
-import { _ as CODEX_PLUGINS_MARKETPLACE_NAME, b as assertCodexModelBackedReviewerEffectiveConfig, g as resolveCodexPluginsPolicy, n as codexSandboxPolicyForTurn, v as CODEX_PLUGINS_WORKSPACE_MARKETPLACE_NAME } from "./config-giW8X0QA.js";
-import { G as CodexAppServerRpcError, J as consumeCodexAppServerLiveThread, L as isCodexAppServerConnectionClosedError, P as getCodexAppServerClientInstanceId, St as resolveCodexAppServerLocalHomeDir, U as resolveCodexAppServerClientInstanceId, _t as flattenCodexDynamicToolFunctions, c as isCodexAppServerStartSelectionChangedError, h as retainSharedCodexAppServerClientByInstanceId, vt as isJsonObject } from "./shared-client-DKz23hHY.js";
-import { a as hashCodexAppServerBindingFingerprint, c as reclaimCurrentCodexSessionGeneration, d as sessionBindingIdentity, i as createCodexSessionGenerationSupersededError, n as assertCodexBindingMayBeReplaced, o as isCodexAppServerNativeAuthProfile, s as normalizeCodexAppServerBindingModelProvider } from "./session-binding-Bcynfd-_.js";
-import { a as closeCodexStartupClientBestEffort, c as isCodexAppServerUnsafeSubscriptionError, d as unsubscribeCodexThreadBestEffort, n as CODEX_APP_SERVER_UNSUBSCRIBE_TIMEOUT_MS, r as CodexAppServerUnsafeSubscriptionError } from "./attempt-client-cleanup-bfsmcQ6m.js";
-import { a as assertCodexThreadStartResponse, r as assertCodexThreadForkResponse } from "./protocol-validators-VeJxxJ0U.js";
-import { o as defaultCodexAppInventoryCache, s as serializeCodexAppInventoryError, t as buildCodexAppServerConnectionFingerprint } from "./plugin-app-cache-key-C1CAdfcP.js";
-import { t as isIncognitoSessionKey } from "./incognito-session-ET_ufDH-.js";
-import { n as codexCatalogHomeId } from "./session-catalog-home-id-BNwAJ9D7.js";
-import { t as resumeCodexAppServerThread } from "./thread-resume-BE9qNEW0.js";
-import { u as projectBoundedCodexThreadHistory } from "./transcript-mirror-DsCMWBca.js";
+import { $t as isJsonObject, E as CodexThreadStartRequestError, Et as isCodexAppServerLiveThreadClaimed, H as isCodexAppServerOverloadError, I as getCodexAppServerClientInstanceId, Jt as readCodexSessionMeta, K as resolveCodexAppServerClientInstanceId, Mt as withAbortableTimeout, Ot as readCodexClientSessionMeta, Q as assertCodexThreadForkResponse, Qt as flattenCodexDynamicToolFunctions, St as consumeCodexAppServerLiveThread, T as CodexThreadBindingConflictError, Tt as isCodexAppServerClientRuntimeLive, W as isCodexAppServerRequestTimeoutError, X as assertCodexThreadAcceptsDirectInput, _ as retainSharedCodexAppServerClientByInstanceId, _t as resolveCodexToolAbortTerminalReason, et as assertCodexThreadStartResponse, jt as unsubscribeCodexAppServerLiveThread, kt as releaseCodexAppServerLiveThread, n as captureCodexAppServerClientLifetime, q as CodexAppServerRpcError, w as CodexAdoptedThreadActiveError } from "./shared-client-DxcfF9KX.js";
+import { D as resolveCodexPluginsPolicy, F as resolveCodexAppServerHomeDir, I as resolveCodexAppServerLocalHomeDir, M as CODEX_PLUGINS_MARKETPLACE_NAME, N as CODEX_PLUGINS_WORKSPACE_MARKETPLACE_NAME, n as codexSandboxPolicyForTurn, p as assertCodexModelBackedReviewerEffectiveConfig } from "./config-BhmfC1s6.js";
+import { a as hashCodexAppServerBindingFingerprint, c as reclaimCurrentCodexSessionGeneration, d as sessionBindingIdentity, i as createCodexSessionGenerationSupersededError, n as assertCodexBindingMayBeReplaced, o as isCodexAppServerNativeAuthProfile, s as normalizeCodexAppServerBindingModelProvider } from "./session-binding-BHuTCRZQ.js";
+import { a as closeCodexStartupClientBestEffort, c as isCodexAppServerUnsafeSubscriptionError, d as unsubscribeCodexThreadBestEffort, l as retireUnsafeCodexTurnClientBestEffort, n as CODEX_APP_SERVER_UNSUBSCRIBE_TIMEOUT_MS, r as CodexAppServerUnsafeSubscriptionError } from "./attempt-client-cleanup-DYHcRQAa.js";
+import { c as serializeCodexAppInventoryError, n as buildCodexAppServerConnectionFingerprint, s as defaultCodexAppInventoryCache, t as resumeCodexAppServerThread } from "./thread-resume-C7pyVKeW.js";
+import { c as withExclusiveCodexAppServerThread, l as isIncognitoSessionKey, o as withCodexAppServerThreadMutation, r as retainCodexAppServerBindingSubscription } from "./thread-ownership-zGokd8i1.js";
+import { f as projectBoundedCodexThreadHistory, g as codexCatalogHomeId } from "./transcript-mirror-DTUxFWa_.js";
+import { i as refreshCodexThreadPolicy, n as CodexThreadPolicyHandoffError, r as assertCodexSupervisionThreadLineage, t as CodexIncognitoPolicyChangeError } from "./thread-policy-g4KbJPzp.js";
 import { r as sanitizeInlineImageDataUrl, t as invalidInlineImageText } from "./image-payload-sanitizer-CnfoUPCE.js";
 import { asOptionalRecord, isRecord, normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
 import fs from "node:fs/promises";
 import path from "node:path";
 import { createDeferred } from "openclaw/plugin-sdk/extension-shared";
-import { addTimerTimeoutGraceMs, finiteSecondsToTimerSafeMilliseconds, parseStrictNonNegativeInteger } from "openclaw/plugin-sdk/number-runtime";
-import { SKILL_WORKSHOP_TOOL_NAME, TRANSCRIPT_CREDENTIAL_SAFETY_PROMPT, buildDelegationGuidanceSection, buildHarnessVisibleReplyGuidance, buildSkillWorkshopPromptSection, embeddedAgentLog, formatErrorMessage, formatToolExecutionErrorMessage, isActiveHarnessContextEngine, isHostScopedAgentToolActive, resolveMainSessionDelegationMode, resolveToolExecutionErrorKind } from "openclaw/plugin-sdk/agent-harness-runtime";
+import { addTimerTimeoutGraceMs, finiteSecondsToTimerSafeMilliseconds } from "openclaw/plugin-sdk/number-runtime";
+import { AgentHarnessPreflightError, SKILL_WORKSHOP_TOOL_NAME, buildCredentialSafetyPrompt, buildDelegationGuidanceSection, buildHarnessVisibleReplyGuidance, buildSkillWorkshopPromptSection, buildTemporalContextText, embeddedAgentLog, formatErrorMessage, isActiveHarnessContextEngine, isHostScopedAgentToolActive, resolveMainSessionDelegationMode } from "openclaw/plugin-sdk/agent-harness-runtime";
+import { isPathInside } from "openclaw/plugin-sdk/file-access-runtime";
 import * as crypto$1 from "node:crypto";
 import crypto, { createHash } from "node:crypto";
 import os from "node:os";
-import { resolveAgentDir as resolveAgentDir$1, resolveSessionAgentIds as resolveSessionAgentIds$1 } from "openclaw/plugin-sdk/agent-runtime";
+import { isDeepStrictEqual } from "node:util";
+import { resolveAgentDir as resolveAgentDir$1 } from "openclaw/plugin-sdk/agent-runtime";
+import { resolveSessionAgentIdsStrict } from "openclaw/plugin-sdk/agent-scope-runtime";
 import { z } from "zod";
 import { coerceErrorMessage } from "openclaw/plugin-sdk/error-runtime";
 import { sliceUtf16Safe, truncateUtf16Safe } from "openclaw/plugin-sdk/text-utility-runtime";
+import { emitTrustedDiagnosticEvent } from "openclaw/plugin-sdk/diagnostic-runtime";
+import { expectDefined } from "openclaw/plugin-sdk/expect-runtime";
 import { redactSensitiveFieldValue, redactToolPayloadText } from "openclaw/plugin-sdk/logging-core";
-import { isPathInside } from "openclaw/plugin-sdk/file-access-runtime";
 import { resolveRequiredHomeDir, resolveStateDir } from "openclaw/plugin-sdk/state-paths";
+import { buildCodexUserMcpServersThreadConfigPatchForRun } from "openclaw/plugin-sdk/codex-mcp-projection";
+import { registerRetainedNativeHookRelayForBundledRuntime } from "openclaw/plugin-sdk/native-hook-relay-runtime";
+import { isDiagnosticFlagEnabled } from "openclaw/plugin-sdk/diagnostic-flags";
 import { listRegisteredPluginAgentPromptGuidance } from "openclaw/plugin-sdk/plugin-runtime";
 import { buildHostnameAllowlistPolicyFromSuffixAllowlist } from "openclaw/plugin-sdk/ssrf-policy";
-import { buildCodexUserMcpServersThreadConfigPatchForRuntime } from "openclaw/plugin-sdk/codex-mcp-projection";
-import { emitTrustedDiagnosticEvent, hasPendingInternalDiagnosticEvent, isDiagnosticFlagEnabled } from "openclaw/plugin-sdk/diagnostic-runtime";
-import { registerRetainedNativeHookRelayForBundledRuntime } from "openclaw/plugin-sdk/native-hook-relay-runtime";
 //#region extensions/codex/src/app-server/plugin-inventory.ts
 /**
 * Reads Codex plugin marketplace state and app inventory to decide which
@@ -272,15 +274,34 @@ function resolveOwnedApps(params) {
 			enabled: false,
 			needsAuth: true
 		};
-		return {
+		return Object.assign({
 			id: app.id,
 			name: app.name,
 			accessible: info.isAccessible,
 			enabled: info.isEnabled,
 			needsAuth: !info.isAccessible
-		};
+		}, resolveOwnedAppApprovalOverrideKeys(info));
 	}).toSorted((left, right) => left.id.localeCompare(right.id));
 }
+/** Returns current tool keys whose overrides could bypass the requested reviewer. */
+function resolveOwnedAppApprovalOverrideKeys(app) {
+	if (!app.toolSummaries) return {};
+	const appName = app.name.trim();
+	const appNameLower = appName.toLowerCase();
+	const keys = app.toolSummaries.filter((tool) => !tool.isReadOnly).flatMap((tool) => resolveAppToolConfigKeys({
+		appName,
+		appNameLower,
+		tool
+	}));
+	return { approvalOverrideToolConfigKeys: Array.from(new Set(keys)).toSorted() };
+}
+function resolveAppToolConfigKeys(params) {
+	const keys = [params.tool.name];
+	if (params.tool.title) keys.push(params.tool.title);
+	if (params.appName) keys.push(`${params.appName}_${params.tool.name}`);
+	if (params.appNameLower && params.appNameLower !== params.appName) keys.push(`${params.appNameLower}_${params.tool.name}`);
+	return keys;
+}
 function findPluginSummary(marketplace, pluginName) {
 	const exact = marketplace.plugins.find((plugin) => plugin.id === pluginName || plugin.id === `${pluginName}@${marketplace.name}`);
 	if (exact) return exact;
@@ -538,7 +559,8 @@ function toCodexPluginOwnedAccountApp(app) {
 		name: app.name,
 		accessible: app.isAccessible,
 		enabled: app.isEnabled,
-		needsAuth: !app.isAccessible
+		needsAuth: !app.isAccessible,
+		...resolveOwnedAppApprovalOverrideKeys(app)
 	};
 }
 function resolveCodexThreadConfigAppsForRecord(params) {
@@ -595,7 +617,7 @@ function shouldForceRefreshCodexNotReadyPluginApps(params, policy, inventory) {
 * Builds Codex thread config patches that expose only policy-approved apps
 * for native Codex turns.
 */
-const CODEX_PLUGIN_THREAD_CONFIG_INPUT_FINGERPRINT_VERSION = 3;
+const CODEX_PLUGIN_THREAD_CONFIG_INPUT_FINGERPRINT_VERSION = 4;
 const CODEX_PLUGIN_THREAD_CONFIG_FINGERPRINT_VERSION = 2;
 /** Returns true when plugin config exists and thread config may need app patches. */
 function shouldBuildCodexPluginThreadConfig(pluginConfig) {
@@ -968,10 +990,11 @@ function readPersistedAppToolApprovalOverrideNames(config, app) {
 	const appConfig = isJsonObject(appsRoot) ? appsRoot[app.id] : void 0;
 	const tools = isJsonObject(appConfig) ? appConfig.tools : void 0;
 	if (!isJsonObject(tools)) return [];
-	return Object.entries(tools).filter(([, value]) => hasPersistedToolApprovalOverride(value)).map(([toolName]) => toolName).toSorted();
+	const keys = app.approvalOverrideToolConfigKeys;
+	return Object.entries(tools).flatMap(([name, value]) => (!keys || keys.includes(name)) && hasPersistedToolApprovalOverride(value) ? [name] : []).toSorted();
 }
 function hasPersistedToolApprovalOverride(value) {
-	return isJsonObject(value) && value.approval_mode !== void 0;
+	return isJsonObject(value) && value.approval_mode !== void 0 && value.approval_mode !== null;
 }
 function quoteConfigKeyPathSegment(segment) {
 	return `"${segment.replace(/["\\]/g, (char) => `\\${char}`)}"`;
@@ -1015,11 +1038,11 @@ function mergeJsonObjects(left, right) {
 	return merged;
 }
 function fingerprintJson(value) {
-	return crypto.createHash("sha256").update(stableStringify(value)).digest("hex");
+	return crypto.createHash("sha256").update(stableStringify$1(value)).digest("hex");
 }
-function stableStringify(value) {
-	if (Array.isArray(value)) return `[${value.map((item) => stableStringify(item)).join(",")}]`;
-	if (value && typeof value === "object") return `{${Object.entries(value).toSorted(([left], [right]) => left.localeCompare(right)).map(([key, item]) => `${JSON.stringify(key)}:${stableStringify(item)}`).join(",")}}`;
+function stableStringify$1(value) {
+	if (Array.isArray(value)) return `[${value.map((item) => stableStringify$1(item)).join(",")}]`;
+	if (value && typeof value === "object") return `{${Object.entries(value).toSorted(([left], [right]) => left.localeCompare(right)).map(([key, item]) => `${JSON.stringify(key)}:${stableStringify$1(item)}`).join(",")}}`;
 	return JSON.stringify(value);
 }
 //#endregion
@@ -1170,6 +1193,7 @@ function renderMessagesForCodexContext(messages, options) {
 	}).filter((value) => Boolean(value)).join("\n\n");
 }
 function renderMessageBody(message, options) {
+	if (message.role === "compactionSummary" || message.role === "branchSummary") return truncateText(message.summary.trim(), options.maxTextPartChars);
 	if (!hasMessageContent(message)) return "";
 	if (typeof message.content === "string") return truncateText(message.content.trim(), options.maxTextPartChars);
 	if (!Array.isArray(message.content)) return "[non-text content omitted]";
@@ -1638,7 +1662,8 @@ async function collectPersonalSkillRealPaths(homes, codexHome) {
 	}
 	const configuredCodexHome = codexHome?.trim() || process.env.CODEX_HOME?.trim();
 	if (configuredCodexHome) {
-		const stateOwned = isPathInside(realStateDir, await canonicalizeExistingPath(configuredCodexHome));
+		const realCodexHome = await canonicalizeExistingPath(configuredCodexHome);
+		const stateOwned = isPathInside(realStateDir, realCodexHome);
 		roots.push({
 			dir: path.join(configuredCodexHome, "skills"),
 			onlyEscapedStateTargets: stateOwned
@@ -1701,12 +1726,14 @@ async function collectPersonalSkillRealPaths(homes, codexHome) {
 					try {
 						const stat = await fs.stat(entryPath);
 						if (entry.name === "SKILL.md" && stat.isFile()) await recordSkillFile(entryPath, current.onlyEscapedStateTargets);
-						else if (stat.isDirectory()) if (current.depth < MAX_PERSONAL_SKILL_DEPTH) queue.push({
-							dir: entryPath,
-							depth: current.depth + 1,
-							onlyEscapedStateTargets: current.onlyEscapedStateTargets
-						});
-						else complete = false;
+						else if (stat.isDirectory()) {
+							if (current.depth < MAX_PERSONAL_SKILL_DEPTH) queue.push({
+								dir: entryPath,
+								depth: current.depth + 1,
+								onlyEscapedStateTargets: current.onlyEscapedStateTargets
+							});
+							else complete = false;
+						}
 					} catch (error) {
 						if (!isMissingPathError(error)) complete = false;
 					}
@@ -1796,32 +1823,64 @@ function applyCodexNativeSkillIsolation(config, isolation) {
 	};
 }
 //#endregion
-//#region extensions/codex/src/app-server/thread-lifecycle-errors.ts
-var CodexThreadStartRequestError = class extends Error {
-	constructor(cause) {
-		super(`thread/start: ${formatErrorMessage(cause)}`, { cause });
-		this.name = "CodexThreadStartRequestError";
-	}
-};
-var CodexThreadBindingConflictError = class extends Error {
-	constructor(threadId, operation) {
-		super(`Codex thread binding changed while ${operation}: ${threadId}`);
-		this.name = "CodexThreadBindingConflictError";
-	}
-};
-var CodexRestrictedToolSurfaceAttestationError = class extends Error {
-	constructor(cause) {
-		super("Codex restricted-tool-surface MCP attestation failed", { cause });
-		this.name = "CodexRestrictedToolSurfaceAttestationError";
-	}
-};
-var CodexThreadBindingConflictAfterCleanupError = class extends CodexThreadBindingConflictError {};
-var CodexAdoptedThreadActiveError = class extends Error {
-	constructor() {
-		super("Codex session became active in another runner; wait for it to finish before continuing");
-		this.name = "CodexAdoptedThreadActiveError";
-	}
-};
+//#region extensions/codex/src/app-server/native-tool-catalog.ts
+function hasCodexNativeToolCatalog(binding) {
+	return binding?.connectionScope === "supervision" && !binding.pendingSupervisionBranch;
+}
+/** Pinned serde omits false deferLoading; every other declaration byte remains native-owned. */
+function parseCodexNativeToolCatalog(metadata, threadId, fingerprint) {
+	const fail = () => /* @__PURE__ */ new Error("The canonical Codex native tool catalog is missing, corrupt, or changed; the thread is preserved. Reconnect and inspect its native metadata before retrying.");
+	if (!isJsonObject(metadata) || metadata.id !== threadId || !Array.isArray(metadata.dynamic_tools) || Buffer.byteLength(JSON.stringify(metadata.dynamic_tools)) > 1048576) throw fail();
+	const names = /* @__PURE__ */ new Set();
+	const namespaces = /* @__PURE__ */ new Set();
+	const validName = (name) => typeof name === "string" && /^[a-zA-Z0-9_-]{1,128}$/u.test(name);
+	const readFunction = (value) => {
+		if (!isJsonObject(value) || value.type !== "function" || !validName(value.name) || typeof value.description !== "string" || !isJsonObject(value.inputSchema) || value.deferLoading !== void 0 && typeof value.deferLoading !== "boolean" || Object.keys(value).some((key) => ![
+			"type",
+			"name",
+			"description",
+			"inputSchema",
+			"deferLoading"
+		].includes(key)) || names.has(value.name) || names.size >= 2e3) throw fail();
+		names.add(value.name);
+		return {
+			type: "function",
+			name: value.name,
+			description: value.description,
+			inputSchema: structuredClone(value.inputSchema),
+			...value.deferLoading === true ? { deferLoading: true } : {}
+		};
+	};
+	const tools = metadata.dynamic_tools.map((value) => {
+		if (!isJsonObject(value) || value.type !== "namespace") return readFunction(value);
+		if (!validName(value.name) || namespaces.has(value.name) || typeof value.description !== "string" || !Array.isArray(value.tools) || !value.tools.length || Object.keys(value).some((key) => ![
+			"type",
+			"name",
+			"description",
+			"tools"
+		].includes(key))) throw fail();
+		namespaces.add(value.name);
+		return {
+			type: "namespace",
+			name: value.name,
+			description: value.description,
+			tools: value.tools.map(readFunction)
+		};
+	});
+	if (fingerprint !== void 0 && codexDynamicToolsFingerprint(tools) !== fingerprint) throw fail();
+	return tools;
+}
+/** Existing supervised bindings identify data, never authorize an executor or a new adoption. */
+async function loadCodexNativeToolCatalog(params) {
+	const { binding, client, appServer, agentDir, assertCurrent } = params;
+	assertCurrent();
+	const home = resolveCodexAppServerLocalHomeDir(appServer.start, agentDir);
+	const actualHome = client.getRuntimeIdentity()?.codexHome;
+	if (!hasCodexNativeToolCatalog(binding) || !binding.dynamicToolsFingerprint || appServer.start.transport !== "stdio" || appServer.remoteWorkspaceRoot || !actualHome || path.resolve(actualHome) !== path.resolve(home) || binding.appServerRuntimeFingerprint !== buildCodexAppServerConnectionFingerprint(appServer, agentDir)) throw new Error("Canonical Codex declarations require the original verified local binding and selected native connection; the thread is preserved.");
+	const metadata = await readCodexClientSessionMeta(client, path.join(home, "sessions"), binding.rolloutPath, binding.threadId);
+	assertCurrent();
+	return parseCodexNativeToolCatalog(metadata, binding.threadId, binding.dynamicToolsFingerprint);
+}
 //#endregion
 //#region extensions/codex/src/app-server/managed-thread-store.ts
 const CODEX_MANAGED_THREAD_NAMESPACE = "app-server-managed-threads";
@@ -1851,6 +1910,10 @@ function managedThreadStoreKey(sourceHomeId, threadId) {
 /** Durable ownership index for Codex threads created by OpenClaw. */
 function createCodexManagedThreadStore(state) {
 	return {
+		async has(sourceHomeId, threadId) {
+			const parsed = managedThreadSchema.safeParse(state.lookup(managedThreadStoreKey(sourceHomeId, threadId)));
+			return parsed.success && parsed.data.sourceHomeId === sourceHomeId && parsed.data.threadId === threadId;
+		},
 		async mark(params) {
 			try {
 				const value = managedThreadSchema.parse({
@@ -1881,11 +1944,59 @@ function createCodexManagedThreadStore(state) {
 	};
 }
 //#endregion
+//#region extensions/codex/src/app-server/thread-mcp-attestation.ts
+async function attestCodexRestrictedToolSurfaceMcpServersDisabled(client, threadId, threadConfig, signal, expectedActiveServerNames = []) {
+	const configuredServers = threadConfig?.mcp_servers;
+	if (configuredServers !== void 0 && !isJsonObject(configuredServers)) throw new Error("Codex restricted-tool-surface thread config has invalid mcp_servers");
+	const expectedServers = /* @__PURE__ */ new Map();
+	for (const [name, serverConfig] of Object.entries(configuredServers ?? {})) {
+		if (!isJsonObject(serverConfig) || serverConfig.enabled !== false) throw new Error(`Codex restricted-tool-surface MCP server ${name} is not disabled`);
+		expectedServers.set(name, "disabled");
+	}
+	for (const name of expectedActiveServerNames) {
+		if (expectedServers.get(name) === "disabled") throw new Error(`Codex restricted-tool-surface MCP server ${name} has conflicting policy`);
+		expectedServers.set(name, "active");
+	}
+	const response = await client.request("mcpServerStatus/list", {
+		threadId,
+		detail: "toolsAndAuthOnly"
+	}, { signal });
+	if (!isJsonObject(response) || !Array.isArray(response.data)) throw new Error("Codex mcpServerStatus/list returned an invalid restricted-tool-surface attestation");
+	const observedServerNames = /* @__PURE__ */ new Set();
+	for (const status of response.data) {
+		if (!isJsonObject(status) || typeof status.name !== "string" || !isJsonObject(status.tools)) throw new Error("Codex mcpServerStatus/list returned an invalid restricted-tool-surface server");
+		if (!expectedServers.has(status.name)) throw new Error(`Codex restricted-tool-surface MCP attestation found unexpected server ${status.name}`);
+		if (observedServerNames.has(status.name)) throw new Error(`Codex restricted-tool-surface MCP attestation returned duplicate server ${status.name}`);
+		observedServerNames.add(status.name);
+		if (!Object.hasOwn(status, "serverInfo")) throw new Error(`Codex restricted-tool-surface MCP attestation returned malformed server ${status.name}`);
+		if (expectedServers.get(status.name) === "active") {
+			if (status.serverInfo === null || Object.keys(status.tools).length === 0) throw new Error(`Codex restricted-tool-surface MCP attestation found inactive admitted server ${status.name}`);
+			continue;
+		}
+		if (status.serverInfo !== null) throw new Error(`Codex restricted-tool-surface MCP attestation found active server ${status.name}`);
+		if (Object.keys(status.tools).length > 0) throw new Error(`Codex restricted-tool-surface MCP attestation found tools for server ${status.name}`);
+	}
+	for (const [expectedName, state] of expectedServers) if (!observedServerNames.has(expectedName)) throw new Error(`Codex restricted-tool-surface MCP attestation is missing ${state === "active" ? "admitted " : ""}server ${expectedName}`);
+	if (response.nextCursor !== void 0 && response.nextCursor !== null) throw new Error("Codex mcpServerStatus/list returned an invalid empty-page cursor");
+}
+//#endregion
 //#region extensions/codex/src/app-server/plugin-thread-attestation.ts
 /**
 * Confirms admitted plugin and account apps against their actual Codex thread before
 * OpenClaw commits a binding or starts a turn.
 */
+/** Every admission path checks the same surface; its lifecycle owner keeps the claim fenced. */
+async function attestCodexThreadToolSurface(params) {
+	params.assertCurrent();
+	if (params.appIds.length > 0) {
+		await params.lifecycleTiming.measure("plugin-app-attestation", () => attestCodexPluginThreadApps(params));
+		params.assertCurrent();
+	}
+	if (params.restrictedToolSurface) {
+		await params.lifecycleTiming.measure("restricted-tool-surface-mcp-attestation", () => attestCodexRestrictedToolSurfaceMcpServersDisabled(params.client, params.threadId, params.threadConfig, params.signal, params.appIds.length > 0 ? ["codex_apps"] : []));
+		params.assertCurrent();
+	}
+}
 var CodexPluginThreadAppAttestationError = class extends Error {
 	constructor(message, options) {
 		super(message, options);
@@ -1936,213 +2047,506 @@ async function discardUnattestedCodexPluginThread(params) {
 	}
 }
 //#endregion
-//#region extensions/codex/src/app-server/thread-lifecycle-result.ts
-/** Materializes the public lifecycle result after a fresh thread is durably committed. */
-function buildStartedCodexThreadBinding(input) {
-	const { context, params, response, startParams } = input;
-	return {
-		threadId: response.thread.id,
-		...input.clientId ? { clientId: input.clientId } : {},
-		cwd: params.cwd,
-		...input.rolloutPath ? { rolloutPath: input.rolloutPath } : {},
-		authProfileId: params.params.authProfileId,
-		agentWorkspaceDeveloperInstructions: params.agentWorkspaceDeveloperInstructions,
-		model: response.model ?? startParams.model ?? params.params.modelId,
-		modelProvider: response.modelProvider ?? input.startModelProvider ?? input.modelProvider,
-		dynamicToolsFingerprint: context.dynamicToolsFingerprint,
-		dynamicToolsContainDeferred: context.dynamicToolsContainDeferred,
-		nativeSkillIsolationFingerprint: context.nativeSkillIsolationFingerprint,
-		userMcpServersFingerprint: context.userMcpServersFingerprint,
-		mcpServersFingerprint: input.nextMcpServersFingerprint,
-		configuredMcpOwnershipVersion: params.configuredMcpOwnershipVersion,
-		ringZeroConfigFingerprint: context.ringZeroConfigFingerprint,
-		ringZeroClientInstanceId: context.ringZeroClientInstanceId,
-		networkProxyProfileName: params.appServer.networkProxy?.profileName,
-		networkProxyConfigFingerprint: context.networkProxyConfigFingerprint,
-		nativeHookRelayGeneration: input.finalConfigPatch.nativeHookRelayGeneration,
-		appServerRuntimeFingerprint: params.appServerRuntimeFingerprint,
-		pluginAppsFingerprint: input.pluginThreadConfig?.fingerprint,
-		pluginAppsInputFingerprint: input.pluginThreadConfig?.inputFingerprint,
-		pluginAppPolicyContext: input.pluginThreadConfig?.policyContext,
-		contextEngine: context.contextEngineBinding,
-		environmentSelectionFingerprint: context.environmentSelectionFingerprint,
-		...!context.preserveExistingBinding ? { liveThreadConfigFingerprint: fingerprintCodexThreadConfig({
-			...startParams,
-			model: response.model ?? startParams.model ?? null,
-			requestedModel: startParams.model ?? null,
-			modelProvider: input.bindingModelProvider ?? null,
-			requestedModelProvider: startParams.modelProvider ?? input.bindingModelProvider ?? null
-		}, params.params.authProfileId, context.dynamicToolsFingerprint) } : {},
-		lifecycle: {
-			action: "started",
-			...context.rotatedContextEngineBinding ? { rotatedContextEngineBinding: true } : {}
+//#region extensions/codex/src/app-server/native-hook-relay-state.ts
+const pending = /* @__PURE__ */ new Set();
+/** Owns delayed hook-relay cleanup across runtime scheduling and test teardown. */
+const nativeHookRelayUnregisterQueue = {
+	add(entry) {
+		pending.add(entry);
+	},
+	delete(entry) {
+		return pending.delete(entry);
+	},
+	flush() {
+		while (pending.size > 0) {
+			const entry = pending.values().next().value;
+			if (!entry) return;
+			clearTimeout(entry.timeout);
+			entry.unregister();
 		}
-	};
-}
+	},
+	clear() {
+		for (const entry of pending) clearTimeout(entry.timeout);
+		pending.clear();
+	}
+};
 //#endregion
-//#region extensions/codex/src/app-server/reasoning-effort.ts
-const CODEX_REASONING_EFFORTS = [
-	"minimal",
-	"low",
-	"medium",
-	"high",
-	"xhigh",
-	"max",
-	"ultra"
-];
-const LEGACY_PRO_REASONING_EFFORTS = [
-	"medium",
-	"high",
-	"xhigh"
+//#region extensions/codex/src/app-server/native-hook-relay.ts
+/**
+* Bridges Codex native hook callbacks into OpenClaw's native hook relay so
+* app-server tool events can still run OpenClaw policy and diagnostics.
+*/
+/** Codex hook events that can be registered through OpenClaw's native relay. */
+const CODEX_NATIVE_HOOK_RELAY_EVENTS = [
+	"pre_tool_use",
+	"post_tool_use",
+	"permission_request",
+	"before_agent_finalize"
 ];
-const LEGACY_PRO_MODEL_ID_RE = /^gpt-5\.[45]-pro$/u;
-const MODERN_GPT_5_MODEL_ID_RE = /^gpt-5\.(?:[3-9]|[1-9]\d)(?:$|-)/u;
-function normalizeCodexReasoningEfforts(efforts) {
-	if (!efforts) return [];
-	const supported = new Set(efforts.map((effort) => effort.trim().toLowerCase()));
-	return CODEX_REASONING_EFFORTS.filter((effort) => supported.has(effort));
-}
-/** Read reasoning metadata after the Codex app-server route has been selected. */
-function readCodexSupportedReasoningEfforts(compat) {
-	if (!compat || typeof compat !== "object" || Array.isArray(compat)) return;
-	const efforts = compat.supportedReasoningEfforts;
-	if (!Array.isArray(efforts)) return;
-	return efforts.filter((effort) => typeof effort === "string");
+const CODEX_NATIVE_HOOK_RELAY_EVENTS_WITH_APP_SERVER_APPROVALS = CODEX_NATIVE_HOOK_RELAY_EVENTS.filter((event) => event !== "permission_request");
+const CODEX_NATIVE_HOOK_RELAY_MIN_TTL_MS = 18e5;
+/** Extra relay lifetime after the expected turn budget, preventing late hook drops. */
+const CODEX_NATIVE_HOOK_RELAY_TTL_GRACE_MS = 3e5;
+const CODEX_NATIVE_HOOK_RELAY_COMMAND_MIN_PARENT_MARGIN_MS = 250;
+const CODEX_NATIVE_HOOK_RELAY_COMMAND_MAX_PARENT_MARGIN_MS = 1e3;
+const CODEX_NATIVE_HOOK_RELAY_DEFAULT_TIMEOUT_SEC = 10;
+const CODEX_NATIVE_HOOK_RELAY_UNREGISTER_GRACE_MS = 1e4;
+const CODEX_NATIVE_HOOK_RELAY_UNREGISTER_EXTRA_GRACE_MS = 5e3;
+const MAX_PENDING_DIRECT_CHILD_ADMISSIONS = 32;
+const nativeHookPolicyByClient = /* @__PURE__ */ new WeakMap();
+const CODEX_HOOK_MATCHER_NAMES_BY_TOOL_ID = {
+	exec: [
+		"Bash",
+		"exec",
+		"exec_command"
+	],
+	apply_patch: [
+		"apply_patch",
+		"Write",
+		"Edit"
+	],
+	spawn_agent: ["spawn_agent", "Agent"]
+};
+/** Enterprise managed-only policy silently drops the session-layer hooks that enforce OpenClaw. */
+async function assertCodexNativeHookRelayAllowed(client, signal) {
+	let attestation = nativeHookPolicyByClient.get(client);
+	if (!attestation) {
+		attestation = client.request("configRequirements/read", void 0, { signal }).then((response) => {
+			if (!isJsonObject(response) || !Object.hasOwn(response, "requirements")) throw new Error("Codex configRequirements/read returned an invalid hook policy response");
+			const requirements = response.requirements;
+			if (requirements === null) return;
+			if (!isJsonObject(requirements)) throw new Error("Codex configRequirements/read returned invalid hook policy requirements");
+			const managedOnly = requirements.allowManagedHooksOnly;
+			if (managedOnly !== void 0 && managedOnly !== null && typeof managedOnly !== "boolean") throw new Error("Codex configRequirements/read returned invalid managed-only hook policy");
+			if (managedOnly === true) throw new Error("Codex managed-only hooks disable the OpenClaw native hook relay; refusing unenforced execution");
+		});
+		nativeHookPolicyByClient.set(client, attestation);
+		attestation.catch(() => {
+			if (nativeHookPolicyByClient.get(client) === attestation) nativeHookPolicyByClient.delete(client);
+		});
+	}
+	await attestation;
 }
-function resolveSupportedReasoningEffort(params) {
-	const supported = normalizeCodexReasoningEfforts(params.supportedReasoningEfforts);
-	if (supported.includes(params.requested)) return params.requested;
-	const fallbackEfforts = params.requested === "ultra" ? supported : supported.filter((effort) => effort !== "ultra");
-	const requestedRank = CODEX_REASONING_EFFORTS.indexOf(params.requested);
-	return fallbackEfforts.find((effort) => CODEX_REASONING_EFFORTS.indexOf(effort) >= requestedRank) ?? fallbackEfforts.at(-1);
+/** Defers relay unregister so late native hook subprocesses can still resolve. */
+function scheduleCodexNativeHookRelayUnregister(params) {
+	let pending;
+	const unregister = () => {
+		if (!pending) return;
+		const current = pending;
+		pending = void 0;
+		if (!nativeHookRelayUnregisterQueue.delete(current)) return;
+		params.relay.unregister();
+	};
+	const timeout = setTimeout(unregister, resolveCodexNativeHookRelayUnregisterGraceMs(params.hookTimeoutSec));
+	pending = {
+		timeout,
+		unregister
+	};
+	nativeHookRelayUnregisterQueue.add(pending);
+	timeout.unref();
 }
-/** Resolve a turn effort from the selected model's provider-owned metadata. */
-function resolveCodexAppServerReasoningEffort(params) {
-	if (params.thinkLevel === "off" || params.thinkLevel === "adaptive") return null;
-	if (params.supportedReasoningEfforts) return resolveSupportedReasoningEffort({
-		requested: params.thinkLevel,
-		supportedReasoningEfforts: params.supportedReasoningEfforts
-	}) ?? null;
-	const modelId = params.modelId.trim().toLowerCase();
-	if (LEGACY_PRO_MODEL_ID_RE.test(modelId)) return resolveSupportedReasoningEffort({
-		requested: params.thinkLevel,
-		supportedReasoningEfforts: LEGACY_PRO_REASONING_EFFORTS
-	}) ?? null;
-	if (params.thinkLevel === "minimal" && MODERN_GPT_5_MODEL_ID_RE.test(modelId)) return "low";
-	if (params.thinkLevel === "minimal" || params.thinkLevel === "low" || params.thinkLevel === "medium" || params.thinkLevel === "high" || params.thinkLevel === "xhigh") return params.thinkLevel;
-	return null;
+/** Computes the delayed unregister window from Codex's hook timeout. */
+function resolveCodexNativeHookRelayUnregisterGraceMs(hookTimeoutSec) {
+	const hookTimeoutMs = finiteSecondsToTimerSafeMilliseconds(normalizeHookTimeoutSec(hookTimeoutSec)) ?? 0;
+	return Math.max(CODEX_NATIVE_HOOK_RELAY_UNREGISTER_GRACE_MS, addTimerTimeoutGraceMs(hookTimeoutMs, CODEX_NATIVE_HOOK_RELAY_UNREGISTER_EXTRA_GRACE_MS) ?? 0);
 }
-//#endregion
-//#region extensions/codex/src/app-server/thread-model-selection.ts
-const CODEX_NATIVE_PERSONALITY_NONE = "none";
-function resolveCodexBindingModelProviderFallback(params) {
-	const provider = params.provider?.trim().toLowerCase();
-	if (provider && provider !== "codex") return;
-	const currentModel = params.currentModel?.trim();
-	const bindingModel = params.bindingModel?.trim();
-	if (currentModel && bindingModel && currentModel === bindingModel && params.bindingModelProvider) return params.bindingModelProvider;
-	return hasProviderQualifiedModelRef(currentModel) ? void 0 : params.bindingModelProvider;
+/** Records a native pre-tool failure that Codex does not project as a tool item. */
+function emitCodexNativePreToolUseFailureDiagnostic(params) {
+	emitTrustedDiagnosticEvent({
+		type: "tool.execution.error",
+		...params.agentId ? { agentId: params.agentId } : {},
+		sessionId: params.sessionId,
+		...params.sessionKey ? { sessionKey: params.sessionKey } : {},
+		runId: params.runId,
+		toolName: params.failure.toolName,
+		toolCallId: params.failure.toolCallId,
+		durationMs: params.failure.durationMs,
+		errorCategory: "before_tool_call",
+		terminalReason: params.terminalReason ?? (params.signal?.aborted ? resolveCodexToolAbortTerminalReason(params.signal) : params.failure.disposition),
+		...params.sourceTimestampMs !== void 0 ? { sourceTimestampMs: params.sourceTimestampMs } : {}
+	});
 }
-function resolveCodexAppServerThreadModelSelection(params) {
-	const authProfileId = params.authProfileId ?? params.binding?.authProfileId;
-	const explicitModelProvider = resolveCodexAppServerModelProvider({
-		provider: params.provider,
-		authProfileId,
-		authProfileStore: params.authProfileStore,
-		agentDir: params.agentDir,
-		config: params.config
-	});
-	const bindingModelProvider = params.binding?.threadId ? resolveCodexBindingModelProviderFallback({
-		provider: params.provider,
-		currentModel: params.model,
-		bindingModel: params.binding.model,
-		bindingModelProvider: params.binding.modelProvider
-	}) : void 0;
-	return resolveCodexAppServerRequestModelSelection({
-		model: params.model,
-		modelProvider: explicitModelProvider ?? bindingModelProvider,
-		authProfileId,
-		authProfileStore: params.authProfileStore,
-		agentDir: params.agentDir,
-		config: params.config
-	});
-}
-function resolveCodexAppServerRequestModelSelection(params) {
-	const model = params.model.trim();
-	const modelProvider = params.modelProvider?.trim();
-	if (modelProvider) return {
-		model,
-		modelProvider
+/** Registers an OpenClaw native hook relay for a Codex app-server turn. */
+function createCodexNativeHookRelay(params) {
+	if (params.options?.enabled === false) return;
+	const directChildClaims = /* @__PURE__ */ new Map();
+	const pendingDirectChildAdmissions = /* @__PURE__ */ new Map();
+	let foregroundClosed = false;
+	let successfulYieldRetentionAuthorized = false;
+	const assertClaim = (threadId, claim) => () => directChildClaims.get(threadId) === claim;
+	const rejectPendingAdmissions = (reason) => {
+		for (const pending of pendingDirectChildAdmissions.values()) pending.reject(new Error(reason));
+		pendingDirectChildAdmissions.clear();
 	};
-	const slashIndex = model.indexOf("/");
-	if (slashIndex <= 0 || slashIndex >= model.length - 1) return { model };
-	const inferredModelProvider = resolveCodexAppServerModelProvider({
-		provider: model.slice(0, slashIndex),
-		authProfileId: params.authProfileId,
-		authProfileStore: params.authProfileStore,
-		agentDir: params.agentDir,
-		config: params.config
+	const relay = registerRetainedNativeHookRelayForBundledRuntime({
+		provider: "codex",
+		relayId: buildCodexNativeHookRelayId({
+			agentId: params.agentId,
+			sessionId: params.sessionId,
+			sessionKey: params.sessionKey
+		}),
+		...params.generation ? { generation: params.generation } : {},
+		...params.generationMismatchGraceMs ? { generationMismatchGraceMs: params.generationMismatchGraceMs } : {},
+		...params.agentId ? { agentId: params.agentId } : {},
+		sessionId: params.sessionId,
+		...params.sessionKey ? { sessionKey: params.sessionKey } : {},
+		...params.config ? { config: params.config } : {},
+		autoApproveMcpTools: params.autoApproveMcpTools,
+		projectedMcpServers: params.projectedMcpServers,
+		runId: params.runId,
+		...params.channelId ? { channelId: params.channelId } : {},
+		...params.requester ? { requester: params.requester } : {},
+		...params.approvalContext ? { approvalContext: params.approvalContext } : {},
+		allowedEvents: params.events,
+		preToolUseLoopDetection: params.loopDetectionPreToolUseRelay,
+		ttlMs: resolveCodexNativeHookRelayTtlMs({
+			explicitTtlMs: params.options?.ttlMs,
+			attemptTimeoutMs: params.attemptTimeoutMs,
+			startupTimeoutMs: params.startupTimeoutMs,
+			turnStartTimeoutMs: params.turnStartTimeoutMs
+		}),
+		signal: params.signal,
+		runBeforeToolCall: params.hostCapabilities.runBeforeToolCall,
+		assertActive: params.hostCapabilities.assertActive,
+		retention: {
+			readClaim: readCodexNativeChildThreadId,
+			shouldRetainAfterForegroundClose: () => successfulYieldRetentionAuthorized && directChildClaims.size > 0,
+			allowPreToolUse: (childThreadId) => directChildClaims.has(childThreadId),
+			awaitForegroundAdmission: (childThreadId) => {
+				if (foregroundClosed) return Promise.reject(/* @__PURE__ */ new Error("native hook relay foreground admission unavailable"));
+				const existingClaim = directChildClaims.get(childThreadId);
+				if (existingClaim) return Promise.resolve(assertClaim(childThreadId, existingClaim));
+				const existingPending = pendingDirectChildAdmissions.get(childThreadId);
+				if (existingPending) return existingPending.promise.then((claim) => assertClaim(childThreadId, claim));
+				if (pendingDirectChildAdmissions.size >= MAX_PENDING_DIRECT_CHILD_ADMISSIONS) return Promise.reject(/* @__PURE__ */ new Error("native hook relay foreground admission capacity reached"));
+				const { promise, resolve, reject } = createDeferred();
+				pendingDirectChildAdmissions.set(childThreadId, {
+					promise,
+					resolve,
+					reject
+				});
+				return promise.then((claim) => assertClaim(childThreadId, claim));
+			},
+			onDispose: () => {
+				foregroundClosed = true;
+				rejectPendingAdmissions("native hook relay registration closed");
+			}
+		},
+		onPreToolUseFailure: params.onPreToolUseFailure,
+		command: {
+			nice: 10,
+			timeoutMs: params.options?.gatewayTimeoutMs
+		}
 	});
+	const unregister = () => {
+		foregroundClosed = true;
+		rejectPendingAdmissions("native hook relay foreground closed");
+		relay.unregister();
+	};
 	return {
-		model: model.slice(slashIndex + 1).trim(),
-		...inferredModelProvider ? { modelProvider: inferredModelProvider } : {}
+		...relay,
+		unregister,
+		authorizeRetentionAfterSuccessfulYield: () => {
+			successfulYieldRetentionAuthorized = true;
+		},
+		hasClaimedDirectChild: () => directChildClaims.size > 0,
+		rejectPendingDirectChild: (threadIdInput, reason) => {
+			const threadId = threadIdInput.trim();
+			const pending = threadId ? pendingDirectChildAdmissions.get(threadId) : void 0;
+			if (!pending) return;
+			pendingDirectChildAdmissions.delete(threadId);
+			pending.reject(new Error(reason));
+		},
+		claimDirectChild: (threadIdInput) => {
+			const threadId = threadIdInput.trim();
+			if (!threadId) return () => void 0;
+			if (directChildClaims.get(threadId)) return () => void 0;
+			const claim = Symbol(threadId);
+			directChildClaims.set(threadId, claim);
+			const pending = pendingDirectChildAdmissions.get(threadId);
+			pendingDirectChildAdmissions.delete(threadId);
+			pending?.resolve(claim);
+			let released = false;
+			return () => {
+				if (released) return;
+				released = true;
+				if (directChildClaims.get(threadId) !== claim) return;
+				directChildClaims.delete(threadId);
+				if (foregroundClosed && directChildClaims.size === 0) relay.unregister();
+			};
+		}
 	};
 }
-function hasProviderQualifiedModelRef(model) {
-	const trimmed = model?.trim();
-	const slashIndex = trimmed?.indexOf("/") ?? -1;
-	return slashIndex > 0 && slashIndex < (trimmed?.length ?? 0) - 1;
+function readCodexNativeChildThreadId(rawPayload) {
+	if (!isJsonObject(rawPayload) || typeof rawPayload.agent_id !== "string") return;
+	return rawPayload.agent_id.trim() || void 0;
 }
-function resolveCodexAppServerModelProvider(params) {
-	const normalized = params.provider.trim();
-	const normalizedLower = normalized.toLowerCase();
-	if (!normalized || normalizedLower === "codex") return;
-	if (isCodexAppServerNativeAuthProfile(params) && normalizedLower === "openai") return;
-	return normalizedLower === "openai" ? "openai" : normalized;
+/** Selects the native hook events Codex should install for the current approval mode. */
+function resolveCodexNativeHookRelayEvents(params) {
+	if (params.configuredEvents?.length) return params.configuredEvents;
+	return params.appServer.approvalPolicy === "never" ? CODEX_NATIVE_HOOK_RELAY_EVENTS : CODEX_NATIVE_HOOK_RELAY_EVENTS_WITH_APP_SERVER_APPROVALS;
 }
-function resolveReasoningEffort(thinkLevel, modelId, supportedReasoningEfforts) {
-	return resolveCodexAppServerReasoningEffort({
-		thinkLevel,
-		modelId,
-		supportedReasoningEfforts
-	});
+/** Derives the native hook relay TTL from the turn budget unless explicitly configured. */
+function resolveCodexNativeHookRelayTtlMs(params) {
+	if (params.explicitTtlMs !== void 0) return params.explicitTtlMs;
+	const relayBudgetMs = params.attemptTimeoutMs + params.startupTimeoutMs + params.turnStartTimeoutMs + CODEX_NATIVE_HOOK_RELAY_TTL_GRACE_MS;
+	return Math.max(CODEX_NATIVE_HOOK_RELAY_MIN_TTL_MS, Math.floor(relayBudgetMs));
 }
-//#endregion
-//#region extensions/codex/src/app-server/project-doc-thread-config.ts
-const CODEX_NATIVE_PROJECT_DOC_MAX_BYTES = 128 * 1024;
-function buildCodexProjectDocThreadConfig(config) {
-	const defaults = { project_doc_max_bytes: CODEX_NATIVE_PROJECT_DOC_MAX_BYTES };
-	return mergeCodexThreadConfigs(defaults, config) ?? defaults;
+/** Builds a stable relay id scoped to the agent and session identity. */
+function buildCodexNativeHookRelayId(params) {
+	const hash = createHash("sha256");
+	hash.update("openclaw:codex:native-hook-relay:v1");
+	hash.update("\0");
+	hash.update(params.agentId?.trim() || "");
+	hash.update("\0");
+	hash.update(params.sessionKey?.trim() || params.sessionId);
+	return `codex-${hash.digest("hex").slice(0, 40)}`;
 }
-//#endregion
-//#region extensions/codex/src/app-server/thread-prompt.ts
-function buildDeveloperInstructions(params, options = {}) {
-	const deferredToolNames = /* @__PURE__ */ new Set();
-	let hasSkillWorkshop = false;
-	let hasSessionsSpawn = false;
-	let hasSessionsYield = false;
-	let hasSubagentsList = false;
-	let hasSessionsSend = false;
-	let hasSeenDirectNamespace = false;
-	let messageToolAvailable = options.dynamicTools ? false : params.disableMessageTool !== true;
-	for (const spec of options.dynamicTools ?? []) {
-		const isDirectNamespace = spec.type === "namespace" && !hasSeenDirectNamespace && spec.name.trim() === "openclaw_direct";
-		if (isDirectNamespace) hasSeenDirectNamespace = true;
-		for (const tool of spec.type === "namespace" ? spec.tools : [spec]) {
-			const name = tool.name.trim();
-			if (tool.deferLoading === true && name) deferredToolNames.add(name);
-			hasSkillWorkshop ||= name === SKILL_WORKSHOP_TOOL_NAME;
-			hasSessionsSpawn ||= name === "sessions_spawn";
-			hasSessionsYield ||= isDirectNamespace && name === "sessions_yield";
-			hasSubagentsList ||= name === "subagents";
-			hasSessionsSend ||= name === "sessions_send";
-			messageToolAvailable ||= name === "message";
+const CODEX_HOOK_EVENT_BY_NATIVE_EVENT = {
+	pre_tool_use: "PreToolUse",
+	post_tool_use: "PostToolUse",
+	permission_request: "PermissionRequest",
+	before_agent_finalize: "Stop"
+};
+const CODEX_HOOK_KEY_LABEL_BY_NATIVE_EVENT = {
+	pre_tool_use: "pre_tool_use",
+	post_tool_use: "post_tool_use",
+	permission_request: "permission_request",
+	before_agent_finalize: "stop"
+};
+const CODEX_SESSION_FLAGS_HOOK_SOURCE_PATHS = ["/<session-flags>/config.toml", "<session-flags>/config.toml"];
+/** Builds the Codex config overlay that installs trusted command hooks for relay events. */
+function buildCodexNativeHookRelayConfig(params) {
+	const events = params.events?.length ? params.events : CODEX_NATIVE_HOOK_RELAY_EVENTS;
+	const selectedEvents = new Set(events);
+	const config = { "features.hooks": true };
+	const hookState = {};
+	for (const event of CODEX_NATIVE_HOOK_RELAY_EVENTS) {
+		const codexEvent = CODEX_HOOK_EVENT_BY_NATIVE_EVENT[event];
+		const selected = selectedEvents.has(event);
+		const shouldRelay = params.relay.shouldRelayEvent(event);
+		if (!selected || !shouldRelay) {
+			if (selected || params.clearOmittedEvents) config[`hooks.${codexEvent}`] = [];
+			if (params.clearOmittedEvents) for (const sourcePath of CODEX_SESSION_FLAGS_HOOK_SOURCE_PATHS) hookState[`${sourcePath}:${CODEX_HOOK_KEY_LABEL_BY_NATIVE_EVENT[event]}:0:0`] = { enabled: false };
+			continue;
 		}
+		const timeout = normalizeHookTimeoutSec(params.hookTimeoutSec);
+		const command = params.relay.commandForEvent(event, { timeoutMs: resolveCodexNativeHookRelayCommandTimeoutMs(timeout) });
+		const matcher = buildCodexNativeToolMatcher(params.relay.toolMatcherForEvent(event));
+		config[`hooks.${codexEvent}`] = [{
+			...matcher ? { matcher } : {},
+			hooks: [{
+				type: "command",
+				command,
+				timeout,
+				async: false,
+				statusMessage: "OpenClaw native hook relay"
+			}]
+		}];
+		const state = {
+			enabled: true,
+			trusted_hash: codexCommandHookTrustedHash({
+				event,
+				command,
+				matcher,
+				timeout,
+				statusMessage: "OpenClaw native hook relay"
+			})
+		};
+		for (const sourcePath of CODEX_SESSION_FLAGS_HOOK_SOURCE_PATHS) hookState[`${sourcePath}:${CODEX_HOOK_KEY_LABEL_BY_NATIVE_EVENT[event]}:0:0`] = state;
 	}
-	const nativeCommandGuidance = listRegisteredPluginAgentPromptGuidance({
-		surface: "codex_app_server",
-		includeLegacyGlobalGuidance: false
-	}).join("\n");
+	config["hooks.state"] = hookState;
+	return config;
+}
+/** Builds a Codex config overlay that disables native hooks and clears hook arrays. */
+function buildCodexNativeHookRelayDisabledConfig() {
+	return {
+		"features.hooks": false,
+		"hooks.PreToolUse": [],
+		"hooks.PostToolUse": [],
+		"hooks.PermissionRequest": [],
+		"hooks.Stop": []
+	};
+}
+function normalizeHookTimeoutSec(value) {
+	return typeof value === "number" && Number.isFinite(value) && value > 0 ? Math.ceil(value) : CODEX_NATIVE_HOOK_RELAY_DEFAULT_TIMEOUT_SEC;
+}
+function resolveCodexNativeHookRelayCommandTimeoutMs(hookTimeoutSec) {
+	const parentTimeoutMs = finiteSecondsToTimerSafeMilliseconds(normalizeHookTimeoutSec(hookTimeoutSec)) ?? 5e3;
+	const parentMarginMs = Math.min(CODEX_NATIVE_HOOK_RELAY_COMMAND_MAX_PARENT_MARGIN_MS, Math.max(CODEX_NATIVE_HOOK_RELAY_COMMAND_MIN_PARENT_MARGIN_MS, Math.floor(parentTimeoutMs / 5)));
+	return Math.max(1, parentTimeoutMs - parentMarginMs);
+}
+function buildCodexNativeToolMatcher(toolNames) {
+	if (toolNames === void 0) return;
+	if (toolNames.length === 0) throw new TypeError("Codex native hook matcher requires at least one tool name");
+	const nativeNames = /* @__PURE__ */ new Set();
+	let hasCustomToolName = false;
+	for (const toolName of toolNames) {
+		const canonicalToolName = toolName.trim();
+		if (!canonicalToolName || canonicalToolName === "*") throw new TypeError("Codex native hook matcher requires canonical OpenClaw tool ids");
+		const nativeAliases = CODEX_HOOK_MATCHER_NAMES_BY_TOOL_ID[canonicalToolName];
+		if (!nativeAliases) hasCustomToolName = true;
+		for (const nativeName of nativeAliases ?? [canonicalToolName]) nativeNames.add(nativeName);
+	}
+	const sortedNames = Array.from(nativeNames).toSorted();
+	if (!hasCustomToolName && sortedNames.every((toolName) => /^[A-Za-z0-9_]+$/.test(toolName))) return sortedNames.join("|");
+	return `(?i)^(?:${sortedNames.map((toolName) => toolName.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|")})$`;
+}
+function codexCommandHookTrustedHash(params) {
+	const identity = {
+		event_name: CODEX_HOOK_KEY_LABEL_BY_NATIVE_EVENT[params.event],
+		...params.matcher ? { matcher: params.matcher } : {},
+		hooks: [{
+			async: false,
+			command: params.command,
+			statusMessage: params.statusMessage,
+			timeout: params.timeout,
+			type: "command"
+		}]
+	};
+	return `sha256:${createHash("sha256").update(JSON.stringify(sortJsonValue(identity))).digest("hex")}`;
+}
+function sortJsonValue(value) {
+	if (!value || typeof value !== "object") return value;
+	if (Array.isArray(value)) return value.map(sortJsonValue);
+	const sorted = {};
+	for (const [key, entry] of Object.entries(value).toSorted(([left], [right]) => left.localeCompare(right))) sorted[key] = sortJsonValue(entry);
+	return sorted;
+}
+//#endregion
+//#region extensions/codex/src/app-server/profiler-flag.ts
+const PROFILER_FLAGS = ["profiler", "codex.profiler"];
+/** Checks the generic and Codex-specific profiler diagnostic flags. */
+function isCodexAppServerProfilerEnabled(config, env = process.env) {
+	return PROFILER_FLAGS.some((flag) => isDiagnosticFlagEnabled(flag, config, env));
+}
+//#endregion
+//#region extensions/codex/src/app-server/mcp-tool-metadata.ts
+/** Hosted app ownership is authoritative only on metadata supplied by Codex. */
+function readCodexMcpToolConnectorId(tool) {
+	const metadata = asOptionalRecord(asOptionalRecord(tool)?.["_meta"]);
+	return normalizeOptionalString(metadata?.connector_id) ?? normalizeOptionalString(metadata?.connectorId);
+}
+/** Preserve MCP App visibility so model-only tools cannot become widget authority. */
+function readCodexMcpToolUiVisibility(tool) {
+	const metadata = asOptionalRecord(asOptionalRecord(tool)?.["_meta"]);
+	const visibility = asOptionalRecord(metadata?.ui)?.visibility;
+	if (!Array.isArray(visibility)) return;
+	return [...new Set(visibility.filter((value) => value === "app" || value === "model"))].toSorted();
+}
+//#endregion
+//#region extensions/codex/src/app-server/project-doc-thread-config.ts
+const CODEX_NATIVE_PROJECT_DOC_MAX_BYTES = 131072;
+function buildCodexProjectDocThreadConfig(config) {
+	const defaults = { project_doc_max_bytes: CODEX_NATIVE_PROJECT_DOC_MAX_BYTES };
+	return mergeCodexThreadConfigs(defaults, config) ?? defaults;
+}
+//#endregion
+//#region extensions/codex/src/app-server/thread-model-selection.ts
+const CODEX_NATIVE_PERSONALITY_NONE = "none";
+function resolveCodexBindingModelProviderFallback(params) {
+	const provider = params.provider?.trim().toLowerCase();
+	if (provider && provider !== "codex") return;
+	const currentModel = params.currentModel?.trim();
+	const bindingModel = params.bindingModel?.trim();
+	if (currentModel && bindingModel && currentModel === bindingModel && params.bindingModelProvider) return params.bindingModelProvider;
+	return hasProviderQualifiedModelRef(currentModel) ? void 0 : params.bindingModelProvider;
+}
+function resolveCodexAppServerThreadModelSelection(params) {
+	const authProfileId = params.authProfileId ?? params.binding?.authProfileId;
+	const explicitModelProvider = resolveCodexAppServerModelProvider({
+		provider: params.provider,
+		authProfileId,
+		authProfileStore: params.authProfileStore,
+		agentDir: params.agentDir,
+		config: params.config
+	});
+	const bindingModelProvider = params.binding?.threadId ? resolveCodexBindingModelProviderFallback({
+		provider: params.provider,
+		currentModel: params.model,
+		bindingModel: params.binding.model,
+		bindingModelProvider: params.binding.modelProvider
+	}) : void 0;
+	return resolveCodexAppServerRequestModelSelection({
+		model: params.model,
+		modelProvider: explicitModelProvider ?? bindingModelProvider,
+		authProfileId,
+		authProfileStore: params.authProfileStore,
+		agentDir: params.agentDir,
+		config: params.config
+	});
+}
+function resolveCodexAppServerRequestModelSelection(params) {
+	const model = params.model.trim();
+	const modelProvider = params.modelProvider?.trim();
+	if (modelProvider) return {
+		model,
+		modelProvider
+	};
+	const slashIndex = model.indexOf("/");
+	if (slashIndex <= 0 || slashIndex >= model.length - 1) return { model };
+	const inferredModelProvider = resolveCodexAppServerModelProvider({
+		provider: model.slice(0, slashIndex),
+		authProfileId: params.authProfileId,
+		authProfileStore: params.authProfileStore,
+		agentDir: params.agentDir,
+		config: params.config
+	});
+	return {
+		model: model.slice(slashIndex + 1).trim(),
+		...inferredModelProvider ? { modelProvider: inferredModelProvider } : {}
+	};
+}
+function hasProviderQualifiedModelRef(model) {
+	const trimmed = model?.trim();
+	const slashIndex = trimmed?.indexOf("/") ?? -1;
+	return slashIndex > 0 && slashIndex < (trimmed?.length ?? 0) - 1;
+}
+function resolveCodexAppServerModelProvider(params) {
+	const normalized = params.provider.trim();
+	const normalizedLower = normalized.toLowerCase();
+	if (!normalized || normalizedLower === "codex") return;
+	if (isCodexAppServerNativeAuthProfile(params) && normalizedLower === "openai") return;
+	return normalizedLower === "openai" ? "openai" : normalized;
+}
+//#endregion
+//#region extensions/codex/src/app-server/thread-prompt.ts
+function buildDeveloperInstructions(params, options = {}) {
+	const deferredToolNames = /* @__PURE__ */ new Set();
+	let secretsToolName;
+	let showWidgetToolName;
+	let dashboardToolName;
+	let portalToolName;
+	let hasSkillWorkshop = false;
+	let hasSessionsSpawn = false;
+	let hasSessionsYield = false;
+	let hasSubagentsList = false;
+	let hasSessionsSend = false;
+	let hasSeenDirectNamespace = false;
+	let messageToolAvailable = options.dynamicTools ? false : params.disableMessageTool !== true;
+	for (const spec of options.dynamicTools ?? []) {
+		const isDirectNamespace = spec.type === "namespace" && !hasSeenDirectNamespace && spec.name.trim() === "openclaw_direct";
+		if (isDirectNamespace) hasSeenDirectNamespace = true;
+		for (const tool of spec.type === "namespace" ? spec.tools : [spec]) {
+			const name = tool.name.trim();
+			const qualifiedName = spec.type === "namespace" ? `${spec.name}.${name}` : name;
+			if (tool.deferLoading === true && name) deferredToolNames.add(name);
+			if (name === "secrets" && params.disableTools !== true) secretsToolName ??= qualifiedName;
+			if (name === "show_widget") showWidgetToolName ??= qualifiedName;
+			if (name === "dashboard") dashboardToolName ??= qualifiedName;
+			if (name === "portal") portalToolName ??= qualifiedName;
+			hasSkillWorkshop ||= name === SKILL_WORKSHOP_TOOL_NAME;
+			hasSessionsSpawn ||= name === "sessions_spawn";
+			hasSessionsYield ||= isDirectNamespace && name === "sessions_yield";
+			hasSubagentsList ||= name === "subagents";
+			hasSessionsSend ||= name === "sessions_send";
+			messageToolAvailable ||= name === "message";
+		}
+	}
+	const nativeCommandGuidance = listRegisteredPluginAgentPromptGuidance({
+		surface: "codex_app_server",
+		includeLegacyGlobalGuidance: false
+	}).join("\n");
 	const delegationGuidanceAvailable = params.disableTools !== true && params.delegationCapability !== "report_only" && !isMessageOnlyCodexSourceReply(params);
 	const nativeDelegationAvailable = delegationGuidanceAvailable && !isSystemAgentOnlyCodexDynamicToolAllowlist(params.toolsAllow) && !shouldDisableCodexToolSearchForModel(params.modelId);
 	const deferredToolDiscoveryGuidance = deferredToolNames.size > 0 || nativeDelegationAvailable ? "Deferred tools may be absent from the direct tool list. Use `tool_search` when directly callable. On code-mode-only models, use `exec` instead: filter `ALL_TOOLS` by name and description, then call the matching entry through `tools`." : void 0;
@@ -2168,9 +2572,14 @@ function buildDeveloperInstructions(params, options = {}) {
 		}).join("\n") : void 0,
 		buildHarnessVisibleReplyGuidance({
 			sourceReplyDeliveryMode: params.sourceReplyDeliveryMode,
-			messageToolAvailable
+			messageToolAvailable,
+			uiPresentation: params.disableTools !== true && params.promptMode !== "minimal" && params.promptMode !== "none" ? {
+				showWidgetToolName,
+				dashboardToolName,
+				portalToolName
+			} : void 0
 		}),
-		TRANSCRIPT_CREDENTIAL_SAFETY_PROMPT,
+		buildCredentialSafetyPrompt(secretsToolName),
 		nativeCommandGuidance,
 		params.extraSystemPrompt
 	].filter((section) => typeof section === "string" && section.trim()).join("\n\n");
@@ -2364,8 +2773,31 @@ const CODEX_RING_ZERO_OVERRIDABLE_LAYER_TYPES = /* @__PURE__ */ new Set([
 	"project",
 	"sessionFlags"
 ]);
+/** Common deterministic start/resume/fork fields; no run resources or unsupported setters. */
+function buildCodexThreadConfiguration(params, options) {
+	return {
+		...options.cwd !== void 0 ? { cwd: options.cwd } : {},
+		...options.appServer.sessionRoot ? { runtimeWorkspaceRoots: [options.appServer.sessionRoot] } : {},
+		approvalPolicy: options.appServer.approvalPolicy,
+		approvalsReviewer: resolveCodexThreadApprovalsReviewer(options.appServer, options.config),
+		...codexThreadSandboxOrPermissions(options.appServer),
+		...options.appServer.serviceTier !== void 0 ? { serviceTier: options.appServer.serviceTier } : {},
+		config: buildCodexRuntimeThreadConfigForRun(params, options.config, {
+			nativeCodeModeEnabled: options.nativeCodeModeEnabled,
+			nativeProviderWebSearchSupport: options.nativeProviderWebSearchSupport,
+			nativeCodeModeOnlyEnabled: options.nativeCodeModeOnlyEnabled,
+			directOnlyToolNamespaces: resolveDirectOnlyToolNamespaces(options.dynamicTools),
+			webSearchAllowed: options.webSearchAllowed,
+			appServer: options.appServer,
+			hostSystemAgentActive: options.hostSystemAgentActive,
+			restrictedToolSurfaceInheritedMcpServerNames: options.restrictedToolSurfaceInheritedMcpServerNames,
+			shellEnvironment: options.shellEnvironment,
+			disableLoginShell: options.disableLoginShell
+		}),
+		developerInstructions: options.developerInstructions ?? buildDeveloperInstructions(params, { dynamicTools: options.dynamicTools })
+	};
+}
 function buildThreadStartParams(params, options) {
-	const ringZeroActive = (options.hostSystemAgentActive ?? isHostScopedAgentToolActive("openclaw")) && isSystemAgentOnlyCodexDynamicToolAllowlist(params.toolsAllow);
 	const resolvedModelProvider = resolveCodexAppServerModelProvider({
 		provider: params.provider,
 		authProfileId: params.authProfileId,
@@ -2384,29 +2816,11 @@ function buildThreadStartParams(params, options) {
 	return {
 		model: modelSelection.model,
 		...modelSelection.modelProvider ? { modelProvider: modelSelection.modelProvider } : {},
-		cwd: options.cwd,
-		...options.appServer.sessionRoot ? { runtimeWorkspaceRoots: [options.appServer.sessionRoot] } : {},
-		approvalPolicy: options.appServer.approvalPolicy,
-		approvalsReviewer: resolveCodexThreadApprovalsReviewer(options.appServer, options.config),
-		...codexThreadSandboxOrPermissions(options.appServer),
-		...options.appServer.serviceTier !== void 0 ? { serviceTier: options.appServer.serviceTier } : {},
+		...buildCodexThreadConfiguration(params, options),
+		...(options.hostSystemAgentActive ?? isHostScopedAgentToolActive("openclaw")) && isSystemAgentOnlyCodexDynamicToolAllowlist(params.toolsAllow) ? { baseInstructions: "" } : {},
 		personality: CODEX_NATIVE_PERSONALITY_NONE,
 		serviceName: "OpenClaw",
-		...ringZeroActive ? { baseInstructions: "" } : {},
-		config: buildCodexRuntimeThreadConfigForRun(params, options.config, {
-			nativeCodeModeEnabled: options.nativeCodeModeEnabled,
-			nativeProviderWebSearchSupport: options.nativeProviderWebSearchSupport,
-			nativeCodeModeOnlyEnabled: options.nativeCodeModeOnlyEnabled,
-			directOnlyToolNamespaces: resolveDirectOnlyToolNamespaces(options.dynamicTools),
-			webSearchAllowed: options.webSearchAllowed,
-			appServer: options.appServer,
-			hostSystemAgentActive: options.hostSystemAgentActive,
-			restrictedToolSurfaceInheritedMcpServerNames: options.restrictedToolSurfaceInheritedMcpServerNames,
-			shellEnvironment: options.shellEnvironment,
-			disableLoginShell: options.disableLoginShell
-		}),
 		...resolveCodexThreadEnvironmentSelection(options),
-		developerInstructions: options.developerInstructions ?? buildDeveloperInstructions(params, { dynamicTools: options.dynamicTools }),
 		dynamicTools: [...options.dynamicTools],
 		experimentalRawEvents: true,
 		...isIncognitoSessionKey(params.sessionKey) ? { ephemeral: true } : {}
@@ -2429,8 +2843,6 @@ function buildThreadResumeParams(params, options) {
 	});
 	return {
 		threadId: options.threadId,
-		...options.cwd ? { cwd: options.cwd } : {},
-		...options.appServer.sessionRoot ? { runtimeWorkspaceRoots: [options.appServer.sessionRoot] } : {},
 		excludeTurns: true,
 		initialTurnsPage: {
 			limit: 1,
@@ -2441,24 +2853,8 @@ function buildThreadResumeParams(params, options) {
 			model: modelSelection.model,
 			...modelSelection.modelProvider ? { modelProvider: modelSelection.modelProvider } : {}
 		} : {},
-		approvalPolicy: options.appServer.approvalPolicy,
-		approvalsReviewer: resolveCodexThreadApprovalsReviewer(options.appServer, options.config),
-		...codexThreadSandboxOrPermissions(options.appServer),
-		...options.appServer.serviceTier !== void 0 ? { serviceTier: options.appServer.serviceTier } : {},
-		personality: CODEX_NATIVE_PERSONALITY_NONE,
-		config: buildCodexRuntimeThreadConfigForRun(params, options.config, {
-			nativeCodeModeEnabled: options.nativeCodeModeEnabled,
-			nativeProviderWebSearchSupport: options.nativeProviderWebSearchSupport,
-			nativeCodeModeOnlyEnabled: options.nativeCodeModeOnlyEnabled,
-			directOnlyToolNamespaces: resolveDirectOnlyToolNamespaces(options.dynamicTools),
-			webSearchAllowed: options.webSearchAllowed,
-			appServer: options.appServer,
-			hostSystemAgentActive: options.hostSystemAgentActive,
-			restrictedToolSurfaceInheritedMcpServerNames: options.restrictedToolSurfaceInheritedMcpServerNames,
-			shellEnvironment: options.shellEnvironment,
-			disableLoginShell: options.disableLoginShell
-		}),
-		developerInstructions: options.developerInstructions ?? buildDeveloperInstructions(params, { dynamicTools: options.dynamicTools })
+		...buildCodexThreadConfiguration(params, options),
+		personality: CODEX_NATIVE_PERSONALITY_NONE
 	};
 }
 function buildCodexRuntimeThreadConfig(config, options = {}) {
@@ -2468,33 +2864,24 @@ function buildCodexRuntimeThreadConfig(config, options = {}) {
 		"features.code_mode_only": options.nativeCodeModeOnlyEnabled === true
 	};
 	if (options.nativeCodeModeEnabled === false) {
-		const disabledConfig = mergeCodexThreadConfigs(configured, CODEX_CODE_MODE_DISABLED_THREAD_CONFIG, CODEX_GOAL_CONTINUATION_DISABLED_THREAD_CONFIG, CODEX_NATIVE_UPDATE_PLAN_DISABLED_THREAD_CONFIG) ?? {
-			...CODEX_CODE_MODE_DISABLED_THREAD_CONFIG,
-			...CODEX_GOAL_CONTINUATION_DISABLED_THREAD_CONFIG,
-			...CODEX_NATIVE_UPDATE_PLAN_DISABLED_THREAD_CONFIG
-		};
+		const disabledConfig = expectDefined(mergeCodexThreadConfigs(configured, CODEX_CODE_MODE_DISABLED_THREAD_CONFIG, CODEX_GOAL_CONTINUATION_DISABLED_THREAD_CONFIG, CODEX_NATIVE_UPDATE_PLAN_DISABLED_THREAD_CONFIG), "Codex disabled code mode config");
 		delete disabledConfig["features.apply_patch_streaming_events"];
 		return disabledConfig;
 	}
-	if (options.nativeCodeModeOnlyEnabled === true) return ensureDirectOnlyToolNamespaces(mergeCodexThreadConfigs(codeModeConfig, configured, CODEX_GOAL_CONTINUATION_DISABLED_THREAD_CONFIG, CODEX_NATIVE_UPDATE_PLAN_DISABLED_THREAD_CONFIG, { "features.code_mode_only": true }) ?? {
-		...codeModeConfig,
-		...CODEX_GOAL_CONTINUATION_DISABLED_THREAD_CONFIG,
-		...CODEX_NATIVE_UPDATE_PLAN_DISABLED_THREAD_CONFIG,
-		"features.code_mode_only": true
-	}, options.directOnlyToolNamespaces);
-	return ensureDirectOnlyToolNamespaces(mergeCodexThreadConfigs(codeModeConfig, configured, CODEX_GOAL_CONTINUATION_DISABLED_THREAD_CONFIG, CODEX_NATIVE_UPDATE_PLAN_DISABLED_THREAD_CONFIG) ?? {
-		...codeModeConfig,
-		...CODEX_GOAL_CONTINUATION_DISABLED_THREAD_CONFIG,
-		...CODEX_NATIVE_UPDATE_PLAN_DISABLED_THREAD_CONFIG
-	}, options.directOnlyToolNamespaces);
+	if (options.nativeCodeModeOnlyEnabled === true) return ensureDirectOnlyToolNamespaces(expectDefined(mergeCodexThreadConfigs(codeModeConfig, configured, CODEX_GOAL_CONTINUATION_DISABLED_THREAD_CONFIG, CODEX_NATIVE_UPDATE_PLAN_DISABLED_THREAD_CONFIG, { "features.code_mode_only": true }), "Codex code mode only config"), options.directOnlyToolNamespaces);
+	return ensureDirectOnlyToolNamespaces(expectDefined(mergeCodexThreadConfigs(codeModeConfig, configured, CODEX_GOAL_CONTINUATION_DISABLED_THREAD_CONFIG, CODEX_NATIVE_UPDATE_PLAN_DISABLED_THREAD_CONFIG), "Codex code mode config"), options.directOnlyToolNamespaces);
 }
 function ensureDirectOnlyToolNamespaces(config, requiredNamespaces) {
 	if (!requiredNamespaces?.length) return config;
-	const configured = config["code_mode.direct_only_tool_namespaces"];
-	const namespaces = Array.isArray(configured) ? configured.filter((entry) => typeof entry === "string" && entry.length > 0) : [];
+	const feature = expectDefined(config["features.code_mode"], "Codex code mode config");
+	const configured = isJsonObject(feature) ? feature : { enabled: feature };
+	const namespaces = Array.isArray(configured.direct_only_tool_namespaces) ? configured.direct_only_tool_namespaces.filter((entry) => typeof entry === "string" && entry.length > 0) : [];
 	return {
 		...config,
-		"code_mode.direct_only_tool_namespaces": [.../* @__PURE__ */ new Set([...namespaces, ...requiredNamespaces])]
+		"features.code_mode": {
+			...configured,
+			direct_only_tool_namespaces: [.../* @__PURE__ */ new Set([...namespaces, ...requiredNamespaces])]
+		}
 	};
 }
 function resolveDirectOnlyToolNamespaces(dynamicTools) {
@@ -2508,10 +2895,6 @@ function buildCodexRuntimeThreadConfigForRun(params, config, options = {}) {
 	const configMcpServers = config?.mcp_servers;
 	if (restrictedToolSurface && configMcpServers !== void 0 && !isJsonObject(configMcpServers)) throw new Error("Codex restricted tool surface received invalid thread mcp_servers config");
 	const restrictedToolSurfaceMcpServerNames = [...options.restrictedToolSurfaceInheritedMcpServerNames ?? [], ...isJsonObject(configMcpServers) ? Object.keys(configMcpServers) : []];
-	const restrictedRunConfig = restrictedToolSurface && isJsonObject(configMcpServers) ? {
-		...config,
-		mcp_servers: {}
-	} : config;
 	const webSearchConfig = resolveCodexWebSearchPlan({
 		config: params.config,
 		disableTools: params.disableTools,
@@ -2519,9 +2902,9 @@ function buildCodexRuntimeThreadConfigForRun(params, config, options = {}) {
 		nativeProviderWebSearchSupport: options.nativeProviderWebSearchSupport,
 		webSearchAllowed: options.webSearchAllowed
 	}).threadConfig;
-	const baseConfig = buildCodexRuntimeThreadConfig(mergeCodexThreadConfigs(restrictedRunConfig, webSearchConfig), options);
+	const baseConfig = buildCodexRuntimeThreadConfig(mergeCodexThreadConfigs(config, webSearchConfig), options);
 	return applyCodexManagedShellEnvironment({
-		...mergeCodexThreadConfigs(baseConfig, options.appServer?.networkProxy?.configPatch, params.pluginHarnessToolPolicySafeDeniedTools?.includes("image_generate") ? { "features.image_generation": false } : void 0, shouldDisableCodexToolSearchForModel(params.modelId) ? CODEX_TOOL_SEARCH_UNSUPPORTED_THREAD_CONFIG : void 0, params.delegationCapability === "report_only" ? CODEX_DELEGATION_DISABLED_THREAD_CONFIG : void 0, messageOnlySourceReply || params.pluginHarnessToolPolicyRestricted === true ? buildRestrictedToolConfigPatch(restrictedToolSurfaceMcpServerNames) : buildCodexRingZeroThreadConfigPatch(params, options.hostSystemAgentActive, restrictedToolSurfaceMcpServerNames), restrictedTurnDisablesProjectDocs ? CODEX_NO_PROJECT_DOCS_CONFIG : void 0, params.authoredContextTokenCap === void 0 ? void 0 : { model_context_window: params.authoredContextTokenCap }) ?? baseConfig,
+		...mergeCodexThreadConfigs(baseConfig, options.appServer?.networkProxy?.configPatch, params.pluginHarnessToolPolicySafeDeniedTools?.includes("image_generate") ? { "features.image_generation": false } : void 0, shouldDisableCodexToolSearchForModel(params.modelId) ? CODEX_TOOL_SEARCH_UNSUPPORTED_THREAD_CONFIG : void 0, params.delegationCapability === "report_only" ? CODEX_DELEGATION_DISABLED_THREAD_CONFIG : void 0, messageOnlySourceReply || params.pluginHarnessToolPolicyRestricted === true ? buildRestrictedToolConfigPatch(restrictedToolSurfaceMcpServerNames, Boolean(params.scheduledRuntimeAuthority)) : buildCodexRingZeroThreadConfigPatch(params, options.hostSystemAgentActive, restrictedToolSurfaceMcpServerNames), restrictedTurnDisablesProjectDocs ? CODEX_NO_PROJECT_DOCS_CONFIG : void 0, params.authoredContextTokenCap === void 0 ? void 0 : { model_context_window: params.authoredContextTokenCap }) ?? baseConfig,
 		...params.bootstrapContextMode === "lightweight" ? CODEX_NO_PROJECT_DOCS_CONFIG : {}
 	}, options.shellEnvironment, options.disableLoginShell);
 }
@@ -2532,10 +2915,14 @@ function buildCodexRingZeroThreadConfigPatch(params, hostSystemAgentActive = isH
 		...CODEX_NO_PROJECT_DOCS_CONFIG
 	};
 }
-function buildRestrictedToolConfigPatch(inheritedMcpServerNames) {
+function buildRestrictedToolConfigPatch(inheritedMcpServerNames, scheduledAppAuthorityActive = false) {
 	const mcpServers = Object.fromEntries([...new Set(inheritedMcpServerNames)].toSorted().map((name) => [name, { enabled: false }]));
 	return {
 		...CODEX_RING_ZERO_THREAD_CONFIG,
+		...scheduledAppAuthorityActive ? {
+			"features.apps": true,
+			"orchestrator.mcp.enabled": true
+		} : {},
 		...Object.keys(mcpServers).length > 0 ? { mcp_servers: mcpServers } : {}
 	};
 }
@@ -2557,60 +2944,55 @@ async function readCodexInheritedMcpServerNames(client, cwd, signal) {
 	return Object.keys(configuredServers).toSorted();
 }
 async function assertCodexManagedRequirementsDoNotOverrideToolPolicy(client, options, signal) {
-	const response = await client.request("configRequirements/read", void 0, { signal });
-	if (!isJsonObject(response) || !Object.hasOwn(response, "requirements")) throw new Error("Codex configRequirements/read returned an invalid response");
-	if (response.requirements === null) return;
-	if (!isJsonObject(response.requirements)) throw new Error("Codex configRequirements/read returned invalid requirements");
+	const requirements = await readCodexManagedRequirements(client, signal);
+	const managedRequirementsFingerprint = buildCodexManagedRequirementsFingerprint(requirements);
+	const managedRequirementsMatch = options.allowedManagedRequirementsFingerprint !== void 0 && managedRequirementsFingerprint === options.allowedManagedRequirementsFingerprint;
+	const managedHooksAllowed = managedRequirementsMatch || options.allowConfiguredManagedHooks === true;
+	if (options.allowedManagedRequirementsFingerprint !== void 0 && !managedRequirementsMatch) throw new Error("Codex managed requirements changed since this automation was authorized; reauthorize the automation from a fresh owner turn");
+	if (requirements === null) return;
 	if (options.restrictedToolSurface) for (const key of [
 		"hooks",
 		"managedHooks",
 		"managed_hooks"
 	]) {
-		const hooks = response.requirements[key];
+		const hooks = requirements[key];
 		if (hooks === void 0 || hooks === null) continue;
 		if (!isJsonObject(hooks)) throw new Error("Codex configRequirements/read returned invalid managed hooks");
-		if (hasNonEmptyJsonValue(hooks)) throw new Error("Codex restricted tool surface cannot override managed hooks");
+		if (hasNonEmptyJsonValue(hooks) && !managedHooksAllowed) throw new Error("Codex restricted tool surface cannot override managed hooks");
 	}
 	const additionalDeniedFeatures = new Set(options.additionalDeniedFeatures);
 	for (const key of ["featureRequirements", "feature_requirements"]) {
-		const requirements = response.requirements[key];
-		if (requirements === void 0 || requirements === null) continue;
-		if (!isJsonObject(requirements)) throw new Error("Codex configRequirements/read returned invalid feature requirements");
-		for (const [feature, enabled] of Object.entries(requirements)) {
+		const featureRequirements = requirements[key];
+		if (featureRequirements === void 0 || featureRequirements === null) continue;
+		if (!isJsonObject(featureRequirements)) throw new Error("Codex configRequirements/read returned invalid feature requirements");
+		for (const [feature, enabled] of Object.entries(featureRequirements)) {
 			if (typeof enabled !== "boolean") throw new Error("Codex configRequirements/read returned invalid feature requirements");
 			const canonicalFeature = CODEX_RING_ZERO_RESTRICTED_FEATURE_ALIASES.get(feature) ?? feature;
 			const deniedByToolPolicy = options.restrictedToolSurface && CODEX_RING_ZERO_RESTRICTED_FEATURES.has(canonicalFeature) || additionalDeniedFeatures.has(canonicalFeature);
+			if (canonicalFeature === "hooks" && managedHooksAllowed) continue;
 			if (enabled && deniedByToolPolicy) throw new Error(`Codex tool policy cannot override required feature ${feature}`);
 		}
 	}
 }
-async function attestCodexRestrictedToolSurfaceMcpServersDisabled(client, threadId, threadConfig, signal) {
-	const configuredServers = threadConfig?.mcp_servers;
-	if (configuredServers !== void 0 && !isJsonObject(configuredServers)) throw new Error("Codex restricted-tool-surface thread config has invalid mcp_servers");
-	const expectedDisabledServerNames = /* @__PURE__ */ new Set();
-	for (const [name, serverConfig] of Object.entries(configuredServers ?? {})) {
-		if (!isJsonObject(serverConfig) || serverConfig.enabled !== false) throw new Error(`Codex restricted-tool-surface MCP server ${name} is not disabled`);
-		expectedDisabledServerNames.add(name);
-	}
-	const response = await client.request("mcpServerStatus/list", {
-		threadId,
-		detail: "toolsAndAuthOnly"
-	}, { signal });
-	if (!isJsonObject(response) || !Array.isArray(response.data)) throw new Error("Codex mcpServerStatus/list returned an invalid restricted-tool-surface attestation");
-	const observedDisabledServerNames = /* @__PURE__ */ new Set();
-	for (const status of response.data) {
-		if (!isJsonObject(status) || typeof status.name !== "string" || !isJsonObject(status.tools)) throw new Error("Codex mcpServerStatus/list returned an invalid restricted-tool-surface server");
-		if (!expectedDisabledServerNames.has(status.name)) throw new Error(`Codex restricted-tool-surface MCP attestation found unexpected server ${status.name}`);
-		if (observedDisabledServerNames.has(status.name)) throw new Error(`Codex restricted-tool-surface MCP attestation returned duplicate server ${status.name}`);
-		observedDisabledServerNames.add(status.name);
-		if (!Object.hasOwn(status, "serverInfo")) throw new Error(`Codex restricted-tool-surface MCP attestation returned malformed server ${status.name}`);
-		if (status.serverInfo !== null) throw new Error(`Codex restricted-tool-surface MCP attestation found active server ${status.name}`);
-		if (Object.keys(status.tools).length > 0) throw new Error(`Codex restricted-tool-surface MCP attestation found tools for server ${status.name}`);
-	}
-	for (const expectedName of expectedDisabledServerNames) if (!observedDisabledServerNames.has(expectedName)) throw new Error(`Codex restricted-tool-surface MCP attestation is missing server ${expectedName}`);
-	if (response.nextCursor !== void 0 && response.nextCursor !== null) throw new Error("Codex mcpServerStatus/list returned an invalid empty-page cursor");
+/** Hashes the exact managed requirements without retaining their hook commands or policy details. */
+function buildCodexManagedRequirementsFingerprint(requirements) {
+	const fingerprint = fingerprintJsonObject({
+		version: 1,
+		requirements
+	});
+	return crypto.createHash("sha256").update(fingerprint).digest("hex");
 }
-function hasNonEmptyJsonValue(value) {
+/** Reads and fingerprints the exact managed requirements active on this app-server. */
+async function readCodexManagedRequirementsFingerprint(client, signal) {
+	return buildCodexManagedRequirementsFingerprint(await readCodexManagedRequirements(client, signal));
+}
+async function readCodexManagedRequirements(client, signal) {
+	const response = await client.request("configRequirements/read", void 0, { signal });
+	if (!isJsonObject(response) || !Object.hasOwn(response, "requirements")) throw new Error("Codex configRequirements/read returned an invalid response");
+	if (response.requirements !== null && !isJsonObject(response.requirements)) throw new Error("Codex configRequirements/read returned invalid requirements");
+	return response.requirements;
+}
+function hasNonEmptyJsonValue(value) {
 	if (value === null || value === false || value === "") return false;
 	if (Array.isArray(value)) return value.length > 0;
 	if (typeof value === "object") return Object.values(value).some(hasNonEmptyJsonValue);
@@ -2629,1334 +3011,940 @@ function resolveCodexThreadEnvironmentSelection(options) {
 	return {};
 }
 //#endregion
-//#region extensions/codex/src/app-server/thread-lifecycle-io.ts
-function resolveManagedThreadSourceHomeId(params) {
-	const agentId = resolveSessionAgentIds$1({
-		config: params.params.config,
-		sessionKey: params.params.sessionKey,
-		agentId: params.agentId ?? params.params.agentId
-	}).sessionAgentId;
-	const agentDir = params.agentDir ?? params.params.agentDir ?? resolveAgentDir$1(params.params.config ?? {}, agentId);
-	return codexCatalogHomeId(resolveCodexAppServerLocalHomeDir(params.appServer.start, agentDir));
+//#region extensions/codex/src/app-server/scheduled-app-authority.ts
+const CODEX_SCHEDULED_APP_AUTHORITY_NAMESPACE = "codex.apps";
+const CODEX_APPS_MCP_SERVER = "codex_apps";
+const MCP_STATUS_PAGE_SIZE = 100;
+const MCP_STATUS_MAX_PAGES = 100;
+const CODEX_APP_AUTHORITY_CAPTURE_TIMEOUT_MS = 6e4;
+const CODEX_APP_AUTHORITY_CAPTURE_MIN_TIMEOUT_MS = 100;
+/** Hashes stable configured endpoint identity without retaining credentials or endpoint details. */
+function buildScheduledCodexAppServerConnectionIdentity(appServer) {
+	const start = appServer.start;
+	return crypto.createHash("sha256").update("openclaw:codex:scheduled-app-server:v1\0").update(JSON.stringify({
+		transport: start.transport,
+		command: start.command,
+		commandSource: start.commandSource ?? null,
+		args: start.args,
+		cwd: start.cwd ?? null,
+		url: start.url ?? null,
+		homeScope: start.homeScope ?? null,
+		connectionClass: appServer.connectionClass,
+		remoteWorkspaceRoot: appServer.remoteWorkspaceRoot ?? null
+	})).digest("hex");
+}
+function resolveScheduledCodexAppCreatorCaptureDecision(params) {
+	if (!params.appsMayBeVisible) return {
+		required: false,
+		supported: false
+	};
+	const unavailableReason = params.authenticatedScheduledMode ? "A scheduled Codex continuation cannot create new app-authorized automations. Recreate it from a fresh authenticated owner turn; no automation changes were saved." : params.usesSupervisionConnection ? "Codex apps are visible through a supervised connection that cannot capture creator authority. Use an isolated prepared-profile Codex creator turn; no automation changes were saved." : params.homeScope === "user" ? "Codex apps are visible through a user-home runtime that cannot capture isolated creator authority. Use an agent-scoped prepared-profile Codex creator turn; no automation changes were saved." : !params.hasPreparedAccountIdentity && !params.hasConfiguredAppServerIdentity ? "Codex app authority requires either a prepared ChatGPT profile or an isolated configured app-server identity. Reauthenticate the selected Codex profile or configured app-server, then retry; no automation changes were saved." : void 0;
+	return {
+		required: true,
+		supported: !unavailableReason,
+		...unavailableReason ? { unavailableReason } : {}
+	};
 }
-function resolveCodexThreadRolloutPath(thread) {
-	const rolloutPath = thread.path?.trim();
-	if (!rolloutPath || !path.isAbsolute(rolloutPath) || path.extname(rolloutPath) !== ".jsonl" || !path.basename(rolloutPath).includes(thread.id)) return;
-	return rolloutPath;
+function normalizeApprovalMode(value) {
+	return value === "allow" || value === "deny" || value === "auto" || value === "ask" ? value : void 0;
+}
+function normalizeAppToolApprovalMode(value) {
+	return value === "auto" || value === "prompt" || value === "writes" || value === "approve" ? value : void 0;
+}
+function defaultApprovalMode(entry) {
+	return entry.destructiveApprovalMode ?? (entry.allowDestructiveActions ? "allow" : "deny");
+}
+function parseScheduledCodexAppAuthority(authority) {
+	if (!authority || authority.runtimeId !== "codex") return;
+	if (authority.version !== 1) throw new Error("Unsupported Codex scheduled authority version; reauthorize this automation.");
+	if (authority.namespace !== CODEX_SCHEDULED_APP_AUTHORITY_NAMESPACE) throw new Error(`Unsupported Codex scheduled authority namespace ${authority.namespace}; reauthorize this automation.`);
+	const payload = asOptionalRecord(authority.payload);
+	const auth = asOptionalRecord(payload?.auth);
+	const profileId = normalizeOptionalString(auth?.profileId);
+	const connectionFingerprint = normalizeOptionalString(auth?.connectionFingerprint);
+	const managedRequirementsFingerprint = normalizeOptionalString(auth?.managedRequirementsFingerprint);
+	const accountId = normalizeOptionalString(auth?.accountId);
+	const parsedAuth = auth?.kind === "configured-app-server" && connectionFingerprint && managedRequirementsFingerprint ? {
+		kind: "configured-app-server",
+		connectionFingerprint,
+		managedRequirementsFingerprint
+	} : auth?.kind === void 0 && profileId && accountId ? {
+		profileId,
+		accountId
+	} : void 0;
+	if (payload?.version !== 1 || !parsedAuth || !Array.isArray(payload.apps)) throw new Error("Stored Codex app authority is invalid; reauthorize this automation.");
+	const seen = /* @__PURE__ */ new Set();
+	return {
+		version: 1,
+		auth: parsedAuth,
+		apps: payload.apps.map((raw) => {
+			const app = asOptionalRecord(raw);
+			const id = normalizeOptionalString(app?.id);
+			const destructiveApprovalMode = normalizeApprovalMode(app?.destructiveApprovalMode);
+			const rawTools = asOptionalRecord(app?.tools);
+			if (!id || seen.has(id) || typeof app?.allowDestructiveActions !== "boolean" || typeof app.allowOpenWorld !== "boolean" || !destructiveApprovalMode || !rawTools) throw new Error("Stored Codex app authority is invalid; reauthorize this automation.");
+			seen.add(id);
+			const tools = {};
+			for (const [name, rawMode] of Object.entries(rawTools)) {
+				const toolName = normalizeOptionalString(name);
+				const mode = normalizeAppToolApprovalMode(rawMode);
+				if (!toolName || !mode) throw new Error("Stored Codex app authority is invalid; reauthorize this automation.");
+				tools[toolName] = mode;
+			}
+			return {
+				id,
+				allowDestructiveActions: app.allowDestructiveActions,
+				allowOpenWorld: app.allowOpenWorld,
+				destructiveApprovalMode,
+				tools
+			};
+		})
+	};
 }
-async function resumeExistingCodexThread(params, context) {
-	const { binding: resumeBinding, bindingIdentity, startModelSelection, startModelProvider, userMcpServersConfigPatch, dynamicToolsFingerprint, dynamicToolsContainDeferred, webSearchThreadConfigFingerprint, nativeSkillIsolationFingerprint, userMcpServersFingerprint, ringZeroConfigFingerprint, ringZeroClientInstanceId, networkProxyConfigFingerprint, contextEngineBinding, environmentSelectionFingerprint, hostSystemAgentActive, ringZeroActive, restrictedToolSurface, restrictedToolSurfaceInheritedMcpServerNames, nativeSkillIsolation, lifecycleTiming, normalizeBindingModelProvider, throwIfAborted, clearCurrentBinding } = context;
-	let resumeReservation;
-	try {
-		const authProfileId = resumeBinding.connectionScope === "supervision" ? void 0 : params.params.authProfileId ?? resumeBinding.authProfileId;
-		const finalConfigPatch = context.prebuiltFinalConfigPatch ?? params.buildFinalConfigPatch?.({
-			action: "resume",
-			binding: resumeBinding
-		}) ?? {
-			configPatch: params.finalConfigPatch,
-			nativeHookRelayGeneration: params.nativeHookRelayGeneration
-		};
-		const pluginAppsConfigPatch = context.prebuiltPluginThreadConfig?.configPatch ?? (params.pluginThreadConfig?.enabled && resumeBinding.pluginAppPolicyContext ? buildCodexPluginAppsConfigPatchFromPolicyContext(resumeBinding.pluginAppPolicyContext) : void 0);
-		const resumeConfig = applyCodexNativeSkillIsolation(mergeCodexThreadConfigs(params.config, userMcpServersConfigPatch, pluginAppsConfigPatch, finalConfigPatch.configPatch), nativeSkillIsolation);
-		const resumeParams = lifecycleTiming.measureSync("thread-resume-params", () => buildThreadResumeParams(params.params, {
-			threadId: resumeBinding.threadId,
-			cwd: params.cwd,
-			authProfileId,
-			model: startModelSelection.model,
-			modelProvider: startModelProvider,
-			preserveNativeModel: resumeBinding.preserveNativeModel === true,
-			appServer: params.appServer,
-			dynamicTools: params.dynamicTools,
-			developerInstructions: params.developerInstructions,
-			config: resumeConfig,
-			nativeCodeModeEnabled: params.nativeCodeModeEnabled,
-			nativeProviderWebSearchSupport: params.nativeProviderWebSearchSupport,
-			nativeCodeModeOnlyEnabled: params.nativeCodeModeOnlyEnabled,
-			webSearchAllowed: params.webSearchAllowed,
-			hostSystemAgentActive,
-			restrictedToolSurfaceInheritedMcpServerNames,
-			shellEnvironment: params.shellEnvironment,
-			disableLoginShell: params.disableLoginShell
-		}));
-		const requestModelProvider = typeof resumeParams.modelProvider === "string" && resumeParams.modelProvider.trim() ? resumeParams.modelProvider : void 0;
-		throwIfAborted();
-		if (resumeBinding.preserveNativeModel === true) {
-			const current = await lifecycleTiming.measure("thread-read-adoption-status", () => params.client.request("thread/read", {
-				threadId: resumeBinding.threadId,
-				includeTurns: false
-			}, { signal: params.signal }));
-			throwIfAborted();
-			if (current.thread.status?.type === "active") throw new CodexAdoptedThreadActiveError();
-		}
-		resumeReservation = params.reserveResumeThread?.(resumeBinding.threadId);
-		const response = await lifecycleTiming.measure("thread-resume-request", () => resumeCodexAppServerThread({
-			client: params.client,
-			abandonClient: params.abandonClient ?? (() => closeCodexStartupClientBestEffort(params.client)),
-			request: resumeParams,
-			signal: params.signal
-		}));
-		if (ringZeroActive || isMessageOnlyCodexSourceReply(params.params) || params.params.pluginHarnessToolPolicyRestricted === true) try {
-			await lifecycleTiming.measure("restricted-tool-surface-mcp-attestation", () => attestCodexRestrictedToolSurfaceMcpServersDisabled(params.client, response.thread.id, resumeParams.config, params.signal));
-		} catch (error) {
-			await (params.abandonClient ?? (() => closeCodexStartupClientBestEffort(params.client)))();
-			throw new CodexRestrictedToolSurfaceAttestationError(error);
-		}
-		throwIfAborted();
-		const boundAuthProfileId = authProfileId;
-		const nextMcpServersFingerprint = params.mcpServersFingerprintEvaluated === true ? params.mcpServersFingerprint : resumeBinding.mcpServersFingerprint;
-		const resumePatch = {
-			clientId: resolveCodexAppServerClientInstanceId(params.client),
-			cwd: params.cwd,
-			rolloutPath: resolveCodexThreadRolloutPath(response.thread) ?? resumeBinding.rolloutPath,
-			authProfileId: boundAuthProfileId,
-			model: response.model ?? resumeParams.model ?? params.params.modelId,
-			preserveNativeModel: resumeBinding.preserveNativeModel === true ? true : void 0,
-			modelProvider: normalizeBindingModelProvider(boundAuthProfileId, response.modelProvider ?? requestModelProvider ?? startModelProvider),
-			dynamicToolsFingerprint,
-			dynamicToolsContainDeferred,
-			webSearchThreadConfigFingerprint,
-			nativeSkillIsolationFingerprint,
-			userMcpServersFingerprint,
-			mcpServersFingerprint: nextMcpServersFingerprint,
-			configuredMcpOwnershipVersion: params.configuredMcpOwnershipVersion,
-			ringZeroConfigFingerprint,
-			ringZeroClientInstanceId,
-			nativeToolPolicyRestricted: restrictedToolSurface ? true : void 0,
-			networkProxyProfileName: params.appServer.networkProxy?.profileName,
-			networkProxyConfigFingerprint,
-			nativeHookRelayGeneration: finalConfigPatch.nativeHookRelayGeneration ?? resumeBinding.nativeHookRelayGeneration,
-			appServerRuntimeFingerprint: resumeBinding.connectionScope === "supervision" ? buildCodexAppServerConnectionFingerprint(params.appServer, params.params.agentDir) : params.appServerRuntimeFingerprint,
-			pluginAppsFingerprint: context.prebuiltPluginThreadConfig?.fingerprint ?? resumeBinding.pluginAppsFingerprint,
-			pluginAppsInputFingerprint: context.prebuiltPluginThreadConfig?.inputFingerprint ?? resumeBinding.pluginAppsInputFingerprint,
-			pluginAppPolicyContext: context.prebuiltPluginThreadConfig?.policyContext ?? resumeBinding.pluginAppPolicyContext,
-			contextEngine: contextEngineBinding,
-			environmentSelectionFingerprint
-		};
-		if (!await lifecycleTiming.measure("thread-resume-write-binding", () => params.bindingStore.mutate(bindingIdentity, {
-			kind: "patch",
-			threadId: resumeBinding.threadId,
-			patch: resumePatch
-		}))) throw new CodexThreadBindingConflictError(resumeBinding.threadId, "committing a resumed thread");
-		if (contextEngineBinding) embeddedAgentLog.info("codex app-server wrote context-engine thread binding", {
-			sessionId: params.params.sessionId,
-			sessionKey: params.params.sessionKey,
-			threadId: response.thread.id,
-			engineId: contextEngineBinding.engineId,
-			epoch: contextEngineBinding.projection?.epoch,
-			fingerprint: contextEngineBinding.projection?.fingerprint,
-			action: "resumed"
-		});
-		lifecycleTiming.mark("thread-ready");
-		lifecycleTiming.logSummary({
-			runId: params.params.runId,
-			sessionId: params.params.sessionId,
-			sessionKey: params.params.sessionKey,
-			threadId: response.thread.id,
-			action: "resumed"
+async function readCodexScheduledAppToolsByApp(params) {
+	const toolsByApp = /* @__PURE__ */ new Map();
+	const seenCursors = /* @__PURE__ */ new Set();
+	let cursor;
+	for (let page = 0; page < MCP_STATUS_MAX_PAGES; page += 1) {
+		const response = await params.request("mcpServerStatus/list", {
+			...params.threadId ? { threadId: params.threadId } : {},
+			detail: "toolsAndAuthOnly",
+			limit: MCP_STATUS_PAGE_SIZE,
+			...cursor ? { cursor } : {}
 		});
-		const activeTurnIds = readActiveCodexTurnIdsFromResume(response);
-		return {
-			...resumeBinding,
-			threadId: response.thread.id,
-			...resumePatch,
-			liveThreadConfigFingerprint: fingerprintCodexThreadConfig({
-				...resumeParams,
-				model: resumeBinding.preserveNativeModel === true ? null : response.model ?? resumeParams.model ?? null,
-				requestedModel: resumeBinding.preserveNativeModel === true ? null : resumeParams.model ?? null,
-				modelProvider: resumeBinding.preserveNativeModel === true ? null : resumePatch.modelProvider ?? null,
-				requestedModelProvider: resumeBinding.preserveNativeModel === true ? null : resumeParams.modelProvider ?? resumePatch.modelProvider ?? null
-			}, authProfileId, dynamicToolsFingerprint),
-			lifecycle: {
-				action: "resumed",
-				...activeTurnIds.length ? { activeTurnIds } : {}
+		if (!isJsonObject(response) || !Array.isArray(response.data)) throw new Error("Codex mcpServerStatus/list returned invalid scheduled app inventory");
+		for (const status of response.data) {
+			if (!isJsonObject(status) || !isJsonObject(status.tools)) throw new Error("Codex scheduled app inventory contained an invalid server status");
+			if (status.name !== CODEX_APPS_MCP_SERVER) continue;
+			for (const [toolName, tool] of Object.entries(status.tools)) {
+				const connectorId = readCodexMcpToolConnectorId(tool);
+				if (connectorId) {
+					const tools = toolsByApp.get(connectorId) ?? /* @__PURE__ */ new Map();
+					const metadata = asOptionalRecord(tool);
+					const annotations = asOptionalRecord(metadata?.annotations);
+					tools.set(toolName, {
+						title: typeof metadata?.title === "string" ? metadata.title : void 0,
+						destructiveHint: annotations?.destructiveHint === false ? false : void 0,
+						openWorldHint: annotations?.openWorldHint === false ? false : void 0
+					});
+					toolsByApp.set(connectorId, tools);
+				}
 			}
-		};
-	} catch (error) {
-		resumeReservation?.release();
-		if (isCodexAppServerStartSelectionChangedError(error)) throw error;
-		if (error instanceof CodexRestrictedToolSurfaceAttestationError) {
-			await clearCurrentBinding("retiring a failed restricted-tool-surface attestation");
-			throw error;
 		}
-		if (error instanceof CodexAdoptedThreadActiveError) throw error;
-		if (isCodexAppServerUnsafeSubscriptionError(error)) throw error;
-		const resumeRejected = error instanceof CodexAppServerRpcError;
-		if (!await unsubscribeCodexThreadBestEffort(params.client, {
-			threadId: resumeBinding.threadId,
-			timeoutMs: 5e3
-		}) && !resumeRejected && !isCodexAppServerConnectionClosedError(error) && !params.signal?.aborted) throw new CodexAppServerUnsafeSubscriptionError("Codex thread/resume subscription cleanup failed", { cause: error });
-		if (isCodexAppServerConnectionClosedError(error) || params.signal?.aborted) throw error;
-		embeddedAgentLog.warn("codex app-server thread resume failed; starting a new thread", { error });
-		await clearCurrentBinding("rotating a stale thread binding");
+		if (response.nextCursor !== void 0 && response.nextCursor !== null && typeof response.nextCursor !== "string") throw new Error("Codex scheduled app inventory returned an invalid pagination cursor");
+		cursor = response.nextCursor;
+		if (!cursor) return toolsByApp;
+		if (seenCursors.has(cursor)) throw new Error("Codex app connector inventory repeated its pagination cursor");
+		seenCursors.add(cursor);
 	}
+	throw new Error("Codex app connector inventory exceeded its bounded page limit");
+}
+/** Reads current account policy and connector-backed tool metadata under one caller deadline. */
+async function readCurrentCodexScheduledAppPolicy(params) {
+	const [configResponse, toolsByApp] = await Promise.all([params.request("config/read", {
+		includeLayers: false,
+		...params.configCwd ? { cwd: params.configCwd } : {}
+	}), readCodexScheduledAppToolsByApp(params)]);
+	if (!isJsonObject(configResponse)) throw new Error("Codex config/read returned an invalid scheduled app policy response");
+	return {
+		config: isJsonObject(configResponse.config) ? configResponse.config : {},
+		toolsByApp
+	};
 }
-async function startFreshCodexThread(params, context) {
-	const clientId = resolveCodexAppServerClientInstanceId(params.client);
-	const { bindingIdentity, startModelSelection, startModelProvider, userMcpServersConfigPatch, dynamicToolsFingerprint, dynamicToolsContainDeferred, webSearchThreadConfigFingerprint, nativeSkillIsolationFingerprint, userMcpServersFingerprint, ringZeroConfigFingerprint, ringZeroClientInstanceId, networkProxyConfigFingerprint, contextEngineBinding, environmentSelectionFingerprint, hostSystemAgentActive, ringZeroActive, restrictedToolSurface, restrictedToolSurfaceInheritedMcpServerNames, nativeSkillIsolation, lifecycleTiming, normalizeBindingModelProvider, throwIfAborted, prebuiltPluginThreadConfig, preserveExistingBinding, rotatedContextEngineBinding, replacementPredecessor } = context;
-	const pluginThreadConfig = params.pluginThreadConfig?.enabled ? prebuiltPluginThreadConfig ?? await lifecycleTiming.measure("plugin-config-build", () => params.pluginThreadConfig?.build()) : void 0;
-	const finalConfigPatch = params.buildFinalConfigPatch?.({ action: "start" }) ?? {
-		configPatch: params.finalConfigPatch,
-		nativeHookRelayGeneration: params.nativeHookRelayGeneration
+function readCurrentToolPolicy(config, appId, toolName, metadata, fallbackApprovalMode = "auto") {
+	const apps = asOptionalRecord(config.apps);
+	const app = asOptionalRecord(apps?.[appId]);
+	const defaults = asOptionalRecord(apps?.["_default"]);
+	const tools = asOptionalRecord(app?.tools);
+	const tool = asOptionalRecord(tools?.[toolName] ?? (metadata?.title !== void 0 ? tools?.[metadata.title] : void 0));
+	const defaultToolsEnabled = app?.default_tools_enabled;
+	return {
+		enabled: (app ? app.enabled !== false : defaults?.enabled !== false) && (typeof tool?.enabled === "boolean" ? tool.enabled : typeof defaultToolsEnabled === "boolean" ? defaultToolsEnabled : appToolHintsAllowed(metadata, {
+			allowDestructiveActions: (app?.destructive_enabled ?? defaults?.destructive_enabled) !== false,
+			allowOpenWorld: (app?.open_world_enabled ?? defaults?.open_world_enabled) !== false
+		})),
+		approvalMode: normalizeAppToolApprovalMode(tool?.approval_mode) ?? normalizeAppToolApprovalMode(app?.default_tools_approval_mode) ?? normalizeAppToolApprovalMode(defaults?.default_tools_approval_mode) ?? fallbackApprovalMode
 	};
-	const config = lifecycleTiming.measureSync("merge-thread-config", () => applyCodexNativeSkillIsolation(mergeCodexThreadConfigs(params.config, userMcpServersConfigPatch, pluginThreadConfig?.configPatch, finalConfigPatch.configPatch), nativeSkillIsolation));
-	const startParams = lifecycleTiming.measureSync("thread-start-params", () => buildThreadStartParams(params.params, {
-		cwd: params.cwd,
-		dynamicTools: params.dynamicTools,
-		appServer: params.appServer,
-		developerInstructions: params.developerInstructions,
-		config,
-		nativeCodeModeEnabled: params.nativeCodeModeEnabled,
-		nativeProviderWebSearchSupport: params.nativeProviderWebSearchSupport,
-		nativeCodeModeOnlyEnabled: params.nativeCodeModeOnlyEnabled,
-		webSearchAllowed: params.webSearchAllowed,
-		environmentSelection: params.environmentSelection,
-		model: startModelSelection.model,
-		modelProvider: startModelProvider,
-		hostSystemAgentActive,
-		restrictedToolSurfaceInheritedMcpServerNames,
-		shellEnvironment: params.shellEnvironment,
-		disableLoginShell: params.disableLoginShell
-	}));
-	const requestModelProvider = typeof startParams.modelProvider === "string" && startParams.modelProvider.trim() ? startParams.modelProvider : void 0;
-	const response = assertCodexThreadStartResponse(await lifecycleTiming.measure("thread-start-request", async () => {
-		try {
-			return await params.client.request("thread/start", startParams, { signal: params.signal });
-		} catch (error) {
-			if (error instanceof CodexAppServerRpcError) throw new CodexThreadStartRequestError(error);
-			throw error;
-		}
-	}));
-	const provisionalAppIds = pluginThreadConfig?.provisionalAppIds;
-	if (provisionalAppIds?.length) try {
-		await lifecycleTiming.measure("plugin-app-attestation", () => attestCodexPluginThreadApps({
-			client: params.client,
-			threadId: response.thread.id,
-			appIds: provisionalAppIds,
+}
+function appToolHintsAllowed(tool, policy) {
+	return (policy.allowDestructiveActions || tool?.destructiveHint === false) && (policy.allowOpenWorld !== false || tool?.openWorldHint === false);
+}
+/** Captures only apps callable on the exact active Codex client/thread. */
+async function captureScheduledCodexAppAuthority(params) {
+	const requestedTimeoutMs = params.timeoutMs ?? CODEX_APP_AUTHORITY_CAPTURE_TIMEOUT_MS;
+	const timeoutMs = Math.min(CODEX_APP_AUTHORITY_CAPTURE_TIMEOUT_MS, Math.max(CODEX_APP_AUTHORITY_CAPTURE_MIN_TIMEOUT_MS, Number.isFinite(requestedTimeoutMs) ? Math.floor(requestedTimeoutMs) : CODEX_APP_AUTHORITY_CAPTURE_TIMEOUT_MS));
+	const deadlineMs = Date.now() + timeoutMs;
+	const boundedClient = { request: ((method, requestParams) => {
+		const remainingTimeoutMs = deadlineMs - Date.now();
+		if (remainingTimeoutMs <= 0) throw new CodexScheduledAppAuthorityCaptureTimeoutError();
+		return params.client.request(method, requestParams, {
+			timeoutMs: remainingTimeoutMs,
 			signal: params.signal
-		}));
+		});
+	}) };
+	let installed;
+	let currentPolicy;
+	let auth;
+	const creatorAuth = params.auth;
+	try {
+		[installed, currentPolicy, auth] = await withAbortableTimeout({
+			promise: Promise.all([
+				boundedClient.request("app/installed", {
+					threadId: params.threadId,
+					forceRefresh: false
+				}),
+				readCurrentCodexScheduledAppPolicy({
+					request: (method, requestParams) => boundedClient.request(method, requestParams),
+					threadId: params.threadId,
+					configCwd: params.configCwd
+				}),
+				creatorAuth.kind === "prepared-profile" ? Promise.resolve({
+					profileId: creatorAuth.profileId,
+					accountId: creatorAuth.accountId
+				}) : readCodexManagedRequirementsFingerprint(boundedClient, params.signal).then((managedRequirementsFingerprint) => ({
+					kind: creatorAuth.kind,
+					connectionFingerprint: creatorAuth.connectionFingerprint,
+					managedRequirementsFingerprint
+				}))
+			]),
+			timeoutMs,
+			signal: params.signal,
+			timeoutMessage: "Codex scheduled app authority capture deadline elapsed",
+			createTimeoutError: () => new CodexScheduledAppAuthorityCaptureTimeoutError()
+		});
 	} catch (error) {
-		if (!await discardUnattestedCodexPluginThread({
-			client: params.client,
-			threadId: response.thread.id,
-			ephemeral: startParams.ephemeral === true
-		})) {
-			await (params.abandonClient ?? (() => closeCodexStartupClientBestEffort(params.client)))();
-			throw new CodexAppServerUnsafeSubscriptionError("Codex plugin app attestation cleanup failed", { cause: error });
+		if (params.signal?.aborted || !(error instanceof CodexScheduledAppAuthorityCaptureTimeoutError) && !isCodexAppServerRequestTimeoutError(error)) throw error;
+		throw new Error(`Codex app authority capture exceeded its ${timeoutMs} ms total budget. No automation changes were saved; retry after Codex app inventory is responsive.`, { cause: error });
+	}
+	const callableIds = new Set(installed.apps.filter((app) => app.enabled && app.callable).map((app) => app.id));
+	const apps = Object.entries(params.policyContext.apps).filter(([id]) => callableIds.has(id) && currentPolicy.toolsByApp.has(id)).map(([id, policy]) => ({
+		id,
+		allowDestructiveActions: policy.allowDestructiveActions,
+		allowOpenWorld: policy.allowOpenWorld !== false,
+		destructiveApprovalMode: defaultApprovalMode(policy),
+		tools: Object.fromEntries([...currentPolicy.toolsByApp.get(id)?.keys() ?? []].toSorted().map((toolName) => [toolName, readCurrentToolPolicy(currentPolicy.config, id, toolName, currentPolicy.toolsByApp.get(id)?.get(toolName), appApprovalCeiling(defaultApprovalMode(policy))).approvalMode]))
+	})).toSorted((left, right) => left.id.localeCompare(right.id));
+	if (apps.length === 0) return;
+	return {
+		version: 1,
+		runtimeId: "codex",
+		namespace: CODEX_SCHEDULED_APP_AUTHORITY_NAMESPACE,
+		payload: {
+			version: 1,
+			auth,
+			apps
 		}
-		throw error;
+	};
+}
+var CodexScheduledAppAuthorityCaptureTimeoutError = class extends Error {
+	constructor() {
+		super("Codex scheduled app authority capture deadline elapsed");
+		this.name = "CodexScheduledAppAuthorityCaptureTimeoutError";
 	}
-	const rolloutPath = resolveCodexThreadRolloutPath(response.thread);
-	if (ringZeroActive || isMessageOnlyCodexSourceReply(params.params) || params.params.pluginHarnessToolPolicyRestricted === true) try {
-		await lifecycleTiming.measure("restricted-tool-surface-mcp-attestation", () => attestCodexRestrictedToolSurfaceMcpServersDisabled(params.client, response.thread.id, startParams.config, params.signal));
-	} catch (error) {
-		await (params.abandonClient ?? (() => closeCodexStartupClientBestEffort(params.client)))();
-		throw error;
+};
+const APPROVAL_RANK = {
+	deny: 0,
+	ask: 1,
+	auto: 2,
+	allow: 3
+};
+function stricterApprovalMode(left, right) {
+	return APPROVAL_RANK[left] <= APPROVAL_RANK[right] ? left : right;
+}
+function intersectToolApprovalMode(captured, current) {
+	if (captured === current) return captured;
+	if (captured === "prompt" || current === "prompt") return "prompt";
+	if (captured === "approve") return current;
+	if (current === "approve") return captured;
+	return "prompt";
+}
+function appApprovalCeiling(mode) {
+	if (mode === "allow") return "approve";
+	return mode === "ask" ? "prompt" : "auto";
+}
+function stableStringify(value) {
+	if (Array.isArray(value)) return `[${value.map(stableStringify).join(",")}]`;
+	if (value && typeof value === "object") return `{${Object.entries(value).toSorted(([left], [right]) => left.localeCompare(right)).map(([key, item]) => `${JSON.stringify(key)}:${stableStringify(item)}`).join(",")}}`;
+	return JSON.stringify(value);
+}
+/** Intersects a stored app-ID cap with current policy without admitting new apps. */
+function intersectCodexPluginThreadConfigWithScheduledAuthority(config, authority, currentPolicy = {
+	config: {},
+	toolsByApp: /* @__PURE__ */ new Map()
+}) {
+	const scheduled = parseScheduledCodexAppAuthority(authority);
+	if (!scheduled) return config;
+	const omittedAppIds = scheduled.apps.map((app) => app.id).filter((id) => {
+		const currentTools = currentPolicy.toolsByApp.get(id);
+		return !Object.hasOwn(config.policyContext.apps, id) || !currentTools || currentTools.size === 0;
+	}).toSorted();
+	if (omittedAppIds.length > 0) {
+		const visibleIds = omittedAppIds.slice(0, 10).join(", ");
+		const remaining = omittedAppIds.length - Math.min(omittedAppIds.length, 10);
+		throw new AgentHarnessPreflightError(`Scheduled Codex apps are unavailable under the current policy or account: ${visibleIds}${remaining > 0 ? ` (and ${remaining} more)` : ""}. Restore access or reauthorize the automation from a fresh authenticated Codex owner turn.`);
 	}
-	try {
-		throwIfAborted();
-	} catch (error) {
-		if (replacementPredecessor) {
-			if (!await discardUnattestedCodexPluginThread({
-				client: params.client,
-				threadId: response.thread.id,
-				ephemeral: startParams.ephemeral === true
-			})) {
-				await (params.abandonClient ?? (() => closeCodexStartupClientBestEffort(params.client)))();
-				throw new CodexAppServerUnsafeSubscriptionError("Codex successor cleanup failed after an aborted binding replacement", { cause: error });
-			}
-		}
-		throw error;
+	const capturedById = new Map(scheduled.apps.map((app) => [app.id, app]));
+	const apps = {};
+	for (const [id, current] of Object.entries(config.policyContext.apps)) {
+		const captured = capturedById.get(id);
+		if (!captured) continue;
+		apps[id] = {
+			...current,
+			allowDestructiveActions: current.allowDestructiveActions && captured.allowDestructiveActions,
+			allowOpenWorld: current.allowOpenWorld !== false && captured.allowOpenWorld,
+			destructiveApprovalMode: stricterApprovalMode(defaultApprovalMode(current), captured.destructiveApprovalMode)
+		};
 	}
-	const modelProvider = resolveCodexAppServerModelProvider({
-		provider: params.params.provider,
-		authProfileId: params.params.authProfileId,
-		authProfileStore: params.params.authProfileStore,
-		agentDir: params.params.agentDir,
-		config: params.params.config
-	});
-	const bindingModelProvider = normalizeBindingModelProvider(params.params.authProfileId, response.modelProvider ?? requestModelProvider ?? startModelProvider ?? modelProvider);
-	const nextMcpServersFingerprint = params.mcpServersFingerprintEvaluated === true ? params.mcpServersFingerprint : void 0;
-	if (!preserveExistingBinding) {
-		const nextBinding = {
-			threadId: response.thread.id,
-			...clientId ? { clientId } : {},
-			cwd: params.cwd,
-			...rolloutPath ? { rolloutPath } : {},
-			authProfileId: params.params.authProfileId,
-			agentWorkspaceDeveloperInstructions: params.agentWorkspaceDeveloperInstructions,
-			model: response.model ?? startParams.model ?? params.params.modelId,
-			modelProvider: bindingModelProvider,
-			dynamicToolsFingerprint,
-			dynamicToolsContainDeferred,
-			webSearchThreadConfigFingerprint,
-			nativeSkillIsolationFingerprint,
-			userMcpServersFingerprint,
-			mcpServersFingerprint: nextMcpServersFingerprint,
-			configuredMcpOwnershipVersion: params.configuredMcpOwnershipVersion,
-			ringZeroConfigFingerprint,
-			ringZeroClientInstanceId,
-			nativeToolPolicyRestricted: restrictedToolSurface ? true : void 0,
-			networkProxyProfileName: params.appServer.networkProxy?.profileName,
-			networkProxyConfigFingerprint,
-			nativeHookRelayGeneration: finalConfigPatch.nativeHookRelayGeneration,
-			appServerRuntimeFingerprint: params.appServerRuntimeFingerprint,
-			pluginAppsFingerprint: pluginThreadConfig?.fingerprint,
-			pluginAppsInputFingerprint: pluginThreadConfig?.inputFingerprint,
-			pluginAppPolicyContext: pluginThreadConfig?.policyContext,
-			contextEngine: contextEngineBinding,
-			environmentSelectionFingerprint
-		};
-		const cleanupUncommittedSuccessor = async (cause) => {
-			if (!await discardUnattestedCodexPluginThread({
-				client: params.client,
-				threadId: response.thread.id,
-				ephemeral: startParams.ephemeral === true
-			})) {
-				await (params.abandonClient ?? (() => closeCodexStartupClientBestEffort(params.client)))();
-				throw new CodexAppServerUnsafeSubscriptionError("Codex successor cleanup failed after a binding replacement conflict", cause === void 0 ? void 0 : { cause });
-			}
-		};
-		const managedSourceHomeId = resolveManagedThreadSourceHomeId(params);
-		await lifecycleTiming.measure("thread-start-mark-managed", () => markStartedCodexManagedThread(params.bindingStore.managedThreads, {
-			sourceHomeId: managedSourceHomeId,
-			threadId: response.thread.id,
-			...rolloutPath ? { rolloutPath } : {}
+	const policyContext = buildPluginAppPolicyContext(apps, Object.fromEntries(Object.entries(config.policyContext.pluginAppIds).map(([key, ids]) => [key, ids.filter((id) => Object.hasOwn(apps, id))]).filter(([, ids]) => ids.length > 0)));
+	const configPatch = buildCodexPluginAppsConfigPatchFromPolicyContext(policyContext);
+	const appsPatch = asOptionalRecord(configPatch.apps);
+	for (const [appId, captured] of capturedById) {
+		const appPatch = asOptionalRecord(appsPatch?.[appId]);
+		if (!appPatch || !Object.hasOwn(apps, appId)) continue;
+		const currentApp = apps[appId];
+		if (!currentApp) continue;
+		const storedAppCeiling = appApprovalCeiling(captured.destructiveApprovalMode);
+		const currentAppCeiling = appApprovalCeiling(defaultApprovalMode(currentApp));
+		const tools = currentPolicy.toolsByApp.get(appId) ?? /* @__PURE__ */ new Map();
+		appPatch.tools = Object.fromEntries([...tools.keys()].toSorted().map((toolName) => {
+			const capturedMode = captured.tools[toolName] ?? storedAppCeiling;
+			const currentToolPolicy = readCurrentToolPolicy(currentPolicy.config, appId, toolName, tools.get(toolName), currentAppCeiling);
+			return [toolName, {
+				enabled: currentToolPolicy.enabled && appToolHintsAllowed(tools.get(toolName), currentApp),
+				approval_mode: intersectToolApprovalMode(intersectToolApprovalMode(capturedMode, storedAppCeiling), intersectToolApprovalMode(currentToolPolicy.approvalMode, currentAppCeiling))
+			}];
 		}));
-		let committed;
-		try {
-			committed = await lifecycleTiming.measure("thread-start-write-binding", () => params.bindingStore.mutate(bindingIdentity, replacementPredecessor ? {
-				kind: "replace-thread",
-				expectedThreadId: replacementPredecessor.threadId,
-				binding: nextBinding
-			} : {
-				kind: "set",
-				if: { kind: "absent" },
-				binding: nextBinding
-			}));
-		} catch (error) {
-			if (replacementPredecessor) await cleanupUncommittedSuccessor(error);
-			throw error;
-		}
-		if (!committed) {
-			if (replacementPredecessor) await cleanupUncommittedSuccessor();
-			throw new CodexThreadBindingConflictError(replacementPredecessor?.threadId ?? response.thread.id, "committing a fresh thread");
-		}
-		if (contextEngineBinding) embeddedAgentLog.info("codex app-server wrote context-engine thread binding", {
-			sessionId: params.params.sessionId,
-			sessionKey: params.params.sessionKey,
-			threadId: response.thread.id,
-			engineId: contextEngineBinding.engineId,
-			epoch: contextEngineBinding.projection?.epoch,
-			fingerprint: contextEngineBinding.projection?.fingerprint,
-			action: rotatedContextEngineBinding ? "rotated" : "started"
-		});
-	}
-	lifecycleTiming.mark("thread-ready");
-	lifecycleTiming.logSummary({
-		runId: params.params.runId,
-		sessionId: params.params.sessionId,
-		sessionKey: params.params.sessionKey,
-		threadId: response.thread.id,
-		action: rotatedContextEngineBinding ? "rotated" : "started"
-	});
-	return buildStartedCodexThreadBinding({
-		bindingModelProvider,
-		clientId,
-		context,
-		finalConfigPatch,
-		nextMcpServersFingerprint,
-		params,
-		pluginThreadConfig,
-		response,
-		rolloutPath,
-		startModelProvider: requestModelProvider ?? startModelProvider,
-		startParams,
-		modelProvider
-	});
-}
-//#endregion
-//#region extensions/codex/src/app-server/dynamic-tool-response-state.ts
-/** Retains the host-owned app preview without adding it to Codex's response payload. */
-function withDynamicToolTranscriptDetails(response, details) {
-	if (details === void 0) return response;
-	Object.defineProperty(response, "transcriptDetails", {
-		configurable: true,
-		enumerable: false,
-		value: details
-	});
-	return response;
-}
-function withDynamicToolTerminalResolution(response, terminalResolution) {
-	if (terminalResolution) {
-		Object.defineProperties(response, {
-			terminalResolution: {
-				configurable: true,
-				enumerable: false,
-				value: terminalResolution
-			},
-			executionStarted: {
-				configurable: true,
-				enumerable: false,
-				value: terminalResolution.executionStarted
-			},
-			...terminalResolution.executedArguments ? { executedArguments: {
-				configurable: true,
-				enumerable: false,
-				value: terminalResolution.executedArguments
-			} } : {}
-		});
-		withDynamicToolSideEffectEvidence(response, terminalResolution.sideEffectEvidence);
-	}
-	return response;
-}
-function withDynamicToolExecutionState(response, state) {
-	Object.defineProperties(response, {
-		executedArguments: {
-			configurable: true,
-			enumerable: false,
-			value: state.executedArguments
-		},
-		executionStarted: {
-			configurable: true,
-			enumerable: false,
-			value: state.executionStarted
-		}
-	});
-	return withDynamicToolSideEffectEvidence(response, state.sideEffectEvidence === true);
-}
-function withDynamicToolSideEffectEvidence(response, sideEffectEvidence) {
-	if (!sideEffectEvidence) {
-		delete response.sideEffectEvidence;
-		return response;
 	}
-	Object.defineProperty(response, "sideEffectEvidence", {
-		configurable: true,
-		enumerable: false,
-		value: true
-	});
-	return response;
-}
-function createFailedDynamicToolResponse(message, options) {
-	const response = {
-		contentItems: [{
-			type: "inputText",
-			text: message
-		}],
-		success: false
+	const fingerprint = crypto.createHash("sha256").update(stableStringify({
+		version: 1,
+		namespace: CODEX_SCHEDULED_APP_AUTHORITY_NAMESPACE,
+		authority: scheduled,
+		inputFingerprint: config.inputFingerprint,
+		policyContext,
+		configPatch
+	})).digest("hex");
+	return {
+		...config,
+		fingerprint,
+		configPatch,
+		provisionalAppIds: Object.keys(apps).toSorted(),
+		policyContext
 	};
-	Object.defineProperties(response, {
-		diagnosticTerminalReason: {
-			configurable: true,
-			enumerable: false,
-			value: options?.terminalReason ?? "failed"
-		},
-		diagnosticTerminalType: {
-			configurable: true,
-			enumerable: false,
-			value: "error"
-		}
-	});
-	if (options?.executionStarted !== void 0) Object.defineProperty(response, "executionStarted", {
-		configurable: true,
-		enumerable: false,
-		value: options.executionStarted
-	});
-	if (options?.executedArguments !== void 0) Object.defineProperty(response, "executedArguments", {
-		configurable: true,
-		enumerable: false,
-		value: options.executedArguments
-	});
-	return withDynamicToolSideEffectEvidence(response, options?.sideEffectEvidence === true);
 }
-//#endregion
-//#region extensions/codex/src/app-server/tool-abort-terminal-reason.ts
-/** Leaf helper shared by native and dynamic tool diagnostics. */
-const CODEX_TIMEOUT_ABORT_REASONS = /* @__PURE__ */ new Set([
-	"codex_startup_timeout",
-	"turn_completion_idle_timeout",
-	"turn_progress_idle_timeout",
-	"turn_terminal_idle_timeout"
-]);
-/** Preserves timeout provenance when an enclosing run aborts an active tool. */
-function resolveCodexToolAbortTerminalReason(signal) {
-	try {
-		const reason = signal.reason;
-		if (typeof reason === "string") {
-			if (CODEX_TIMEOUT_ABORT_REASONS.has(reason)) return "timed_out";
-			return reason === "client_closed" ? "failed" : "cancelled";
-		}
-		if (reason && typeof reason === "object") {
-			const record = reason;
-			if (record.name === "TimeoutError" || record.reason === "timeout") return "timed_out";
-		}
-	} catch {
-		return "cancelled";
+/** Returns the managed-requirements identity captured for a configured app-server job. */
+function readScheduledCodexAppManagedRequirementsFingerprint(authority) {
+	const auth = parseScheduledCodexAppAuthority(authority)?.auth;
+	return auth?.kind === "configured-app-server" ? auth.managedRequirementsFingerprint : void 0;
+}
+function assertScheduledCodexAppAuthorityRuntime(connection, params) {
+	const scheduledAuth = parseScheduledCodexAppAuthority(params.scheduledRuntimeAuthority)?.auth;
+	if (!scheduledAuth) return;
+	if (params.trigger !== "cron" || connection.usesSupervisionConnection || connection.appServer.start.homeScope === "user") throw new AgentHarnessPreflightError("This automation's Codex app authority requires an isolated scheduled runtime. Reauthorize it from a supported Codex creator turn.");
+	if (scheduledAuth.kind === "configured-app-server") {
+		if (buildScheduledCodexAppServerConnectionIdentity(connection.appServer) !== scheduledAuth.connectionFingerprint) throw new AgentHarnessPreflightError("This automation was authorized for a different configured Codex app-server. Restore that connection or reauthorize the automation from a fresh owner turn.");
+		return;
 	}
-	return "cancelled";
+	const prepared = connection.startupPreparedAuth;
+	if (prepared?.kind !== "profile" || prepared.profileId !== scheduledAuth.profileId || prepared.snapshot?.loginParams.type !== "chatgptAuthTokens" || prepared.snapshot.chatgptAccountId !== scheduledAuth.accountId) throw new AgentHarnessPreflightError(`This automation was authorized for Codex profile ${scheduledAuth.profileId}, but that exact prepared account is not active. Restore the profile or reauthorize the automation from a fresh owner turn.`);
+}
+function buildLegacyScheduledCodexAppRecoveryPrompt(params) {
+	if (params.trigger !== "cron" || !params.scheduledRuntimeAuthorityRecoveryRequired || params.scheduledRuntimeAuthority) return;
+	return "Scheduled Codex app access is unavailable because this automation predates runtime-specific app authority capture. Tell the operator to recreate or reauthorize it from a fresh authenticated Codex owner turn; do not claim an app action succeeded.";
+}
+/** Makes stored-cap identity part of thread reuse admission, including cap removal. */
+function buildScheduledCodexAppAuthorityInputFingerprint(baseFingerprint, authority) {
+	const scheduled = parseScheduledCodexAppAuthority(authority);
+	if (!scheduled) return baseFingerprint;
+	return crypto.createHash("sha256").update(stableStringify({
+		version: 1,
+		namespace: CODEX_SCHEDULED_APP_AUTHORITY_NAMESPACE,
+		baseFingerprint,
+		authority: scheduled
+	})).digest("hex");
 }
 //#endregion
-//#region extensions/codex/src/app-server/dynamic-tool-execution.ts
-/**
-* Timeout, terminal-release, and diagnostic helpers for Codex dynamic tool
-* calls.
-*/
-/** Default timeout for Codex dynamic tool calls. */
-const CODEX_DYNAMIC_TOOL_TIMEOUT_MS = 9e4;
-/** Hard cap for per-call Codex dynamic tool timeout overrides. */
-const CODEX_DYNAMIC_TOOL_MAX_TIMEOUT_MS = 6e5;
-const CODEX_DYNAMIC_TOOL_TIMEOUT_SECONDS_GRACE_MS = 3e4;
-const CODEX_DYNAMIC_IMAGE_GENERATION_TOOL_TIMEOUT_MS = 12e4;
-const CODEX_DYNAMIC_COMPUTER_GATEWAY_TIMEOUT_MS = 3e4;
-const CODEX_DYNAMIC_COMPUTER_COMPLETION_GRACE_MS = 3e4;
-/** Timeout for image-understanding style dynamic tool calls. */
-const CODEX_DYNAMIC_IMAGE_TOOL_TIMEOUT_MS = 6e4;
-/** Timeout for message-delivery dynamic tool calls. */
-const CODEX_DYNAMIC_MESSAGE_TOOL_TIMEOUT_MS = 6e5;
-/** Outer default for collector waits: full swarm budget plus completion grace. */
-const CODEX_DYNAMIC_AGENTS_WAIT_TOOL_TIMEOUT_MS = 63e4;
-const LOG_FIELD_MAX_LENGTH = 160;
-function normalizeLogField(value) {
-	if (typeof value !== "string") return;
-	const normalized = value.replaceAll(String.fromCharCode(27), " ").replaceAll("\r", " ").replaceAll("\n", " ").replaceAll("	", " ").trim();
-	if (!normalized) return;
-	return normalized.length > LOG_FIELD_MAX_LENGTH ? `${truncateUtf16Safe(normalized, LOG_FIELD_MAX_LENGTH - 3)}...` : normalized;
-}
-function readNumericTimeoutMs(value) {
-	if (typeof value === "number" && Number.isFinite(value)) return Math.max(0, Math.floor(value));
-	if (typeof value === "string") {
-		const parsed = parseStrictNonNegativeInteger(value);
-		if (parsed !== void 0) return Math.max(0, Math.floor(parsed));
-	}
+//#region extensions/codex/src/app-server/thread-lifecycle-timing.ts
+const CODEX_THREAD_LIFECYCLE_TIMING_WARN_TOTAL_MS = 1e3;
+const CODEX_THREAD_LIFECYCLE_TIMING_WARN_STAGE_MS = 500;
+function shouldWarnCodexThreadLifecycleTimingSummary(summary, options = {}) {
+	const totalThresholdMs = options.totalThresholdMs ?? CODEX_THREAD_LIFECYCLE_TIMING_WARN_TOTAL_MS;
+	const stageThresholdMs = options.stageThresholdMs ?? CODEX_THREAD_LIFECYCLE_TIMING_WARN_STAGE_MS;
+	return summary.totalMs >= totalThresholdMs || summary.spans.some((span) => span.durationMs >= stageThresholdMs);
 }
-function formatDynamicToolTimeoutDetails(params) {
-	const tool = normalizeLogField(params.call.tool) ?? "unknown";
-	const baseMeta = {
-		tool: params.call.tool,
-		toolCallId: params.call.callId,
-		threadId: params.call.threadId,
-		turnId: params.call.turnId,
-		timeoutMs: params.timeoutMs,
-		timeoutKind: "codex_dynamic_tool_rpc"
-	};
-	if (tool !== "process" || !isJsonObject(params.call.arguments)) return {
-		responseMessage: `OpenClaw dynamic tool call timed out after ${params.timeoutMs}ms while running tool ${tool}.`,
-		consoleMessage: `codex dynamic tool timeout: tool=${tool} toolTimeoutMs=${params.timeoutMs}; per-tool-call watchdog, not session idle`,
-		meta: baseMeta
-	};
-	const action = normalizeLogField(params.call.arguments.action);
-	const sessionId = normalizeLogField(params.call.arguments.sessionId);
-	const requestedTimeoutMs = readNumericTimeoutMs(params.call.arguments.timeout);
-	const actionPart = action ? ` action=${action}` : "";
-	const sessionPart = sessionId ? ` sessionId=${sessionId}` : "";
-	const requestedPart = requestedTimeoutMs === void 0 ? "" : ` requestedWaitMs=${requestedTimeoutMs}`;
-	const retryHint = action === "poll" ? "; repeated lines usually mean process-poll retry churn, not model progress" : "";
-	const responseTarget = action || sessionId ? ` while waiting for process${actionPart}${sessionPart}` : " while waiting for the process tool";
-	return {
-		responseMessage: `OpenClaw dynamic tool call timed out after ${params.timeoutMs}ms${responseTarget}. This is a tool RPC timeout, not a session idle timeout.`,
-		consoleMessage: `codex process tool timeout:${actionPart}${sessionPart} toolTimeoutMs=${params.timeoutMs}${requestedPart}; per-tool-call watchdog, not session idle${retryHint}`,
-		meta: {
-			...baseMeta,
-			processAction: action,
-			processSessionId: sessionId,
-			processRequestedTimeoutMs: requestedTimeoutMs
-		}
-	};
+function formatCodexThreadLifecycleTimingSummary(params) {
+	const spans = params.summary.spans.length > 0 ? params.summary.spans.map((span) => `${span.name}:${span.durationMs}ms@${span.elapsedMs}ms`).join(",") : "none";
+	return `[trace:codex-app-server] thread lifecycle: runId=${params.runId} sessionId=${params.sessionId} sessionKey=${params.sessionKey ?? "unknown"} action=${params.action} totalMs=${params.summary.totalMs} stages=${spans}`;
 }
-/**
-* Runs a dynamic tool call with run-abort and per-call timeout handling,
-* returning a Codex protocol response instead of throwing.
-*/
-async function handleDynamicToolCallWithTimeout(params) {
-	let didNotifyAgentToolResult = false;
-	const conservativeRaceResponses = /* @__PURE__ */ new WeakSet();
-	const finalizeTerminal = (response) => {
-		const executionSnapshot = params.toolBridge.consumeToolExecutionSnapshot?.(params.call.callId);
-		const ownerKey = params.toolBridge.sideEffectOwnerKeyForTool?.(params.call.tool);
-		const observedExecutionStarted = executionSnapshot?.executionStarted ?? (conservativeRaceResponses.has(response) ? void 0 : response.executionStarted);
-		const terminalResolution = params.observeToolTerminal?.({
-			toolCallId: params.call.callId,
-			toolName: params.call.tool,
-			arguments: response.executedArguments ?? executionSnapshot?.executedArguments ?? params.call.arguments,
-			...params.toolMeta ? { meta: params.toolMeta } : {},
-			...ownerKey ? { ownerMutation: { ownerKey } } : {},
-			...observedExecutionStarted !== void 0 ? { executionStarted: observedExecutionStarted } : {},
-			outcome: response.success ? "success" : "failure",
-			...!response.success ? { failure: { error: readDynamicToolResponseText(response) } } : {}
-		});
-		return withDynamicToolTerminalResolution(response, terminalResolution);
-	};
-	const createFailedAfterPossibleDispatch = (message, terminalReason) => {
-		const response = createFailedDynamicToolResponse(message, {
-			executionStarted: true,
-			sideEffectEvidence: true,
-			terminalReason
-		});
-		conservativeRaceResponses.add(response);
-		return response;
-	};
-	const notifyAgentToolResult = (event) => {
-		if (didNotifyAgentToolResult) return;
-		didNotifyAgentToolResult = true;
-		try {
-			params.onAgentToolResult?.(event);
-		} catch (error) {
-			embeddedAgentLog.warn(`onAgentToolResult handler failed: tool=${params.call.tool} error=${String(error)}`);
-		}
+function createCodexThreadLifecycleTimingTracker(options = {}) {
+	const log = options.log ?? embeddedAgentLog;
+	if (!options.enabled && log.isEnabled?.("trace") !== true) return {
+		async measure(_name, run) {
+			return await run();
+		},
+		measureSync(_name, run) {
+			return run();
+		},
+		mark() {},
+		logSummary() {}
 	};
-	const notifyFailedToolResult = (message, terminalReason = "failed") => {
-		notifyAgentToolResult({
-			toolName: params.call.tool,
-			result: {
-				content: [{
-					type: "text",
-					text: message
-				}],
-				details: {
-					status: terminalReason,
-					error: message
-				}
-			},
-			isError: true
+	const now = options.now ?? Date.now;
+	const startedAt = now();
+	let didLog = false;
+	const spans = [];
+	const toMs = (value) => Math.max(0, Math.round(value));
+	const record = (name, spanStartedAt) => {
+		const currentAt = now();
+		spans.push({
+			name,
+			durationMs: toMs(currentAt - spanStartedAt),
+			elapsedMs: toMs(currentAt - startedAt)
 		});
 	};
-	if (params.signal.aborted) {
-		const message = "OpenClaw dynamic tool call aborted before execution.";
-		const terminalReason = resolveCodexToolAbortTerminalReason(params.signal);
-		params.onFallbackSelected?.();
-		notifyFailedToolResult(message, terminalReason);
-		return finalizeTerminal(createFailedDynamicToolResponse(message, {
-			executionStarted: false,
-			terminalReason
-		}));
-	}
-	const controller = new AbortController();
-	let timeout;
-	let timedOut = false;
-	let resolveAbort;
-	const abortFromRun = () => {
-		const message = "OpenClaw dynamic tool call aborted.";
-		const terminalReason = resolveCodexToolAbortTerminalReason(params.signal);
-		params.onFallbackSelected?.();
-		controller.abort(params.signal.reason ?? /* @__PURE__ */ new Error(message));
-		notifyFailedToolResult(message, terminalReason);
-		resolveAbort?.(createFailedAfterPossibleDispatch(message, terminalReason));
-	};
-	const abortPromise = new Promise((resolve) => {
-		resolveAbort = resolve;
-	});
-	const timeoutPromise = new Promise((resolve) => {
-		const timeoutMs = clampDynamicToolTimeoutMs(params.timeoutMs);
-		timeout = setTimeout(() => {
-			timedOut = true;
-			const timeoutDetails = formatDynamicToolTimeoutDetails({
-				call: params.call,
-				timeoutMs
-			});
-			params.onFallbackSelected?.();
-			controller.abort(new Error(timeoutDetails.responseMessage));
-			params.onTimeout?.();
-			embeddedAgentLog.warn("codex dynamic tool call timed out", {
-				...timeoutDetails.meta,
-				consoleMessage: timeoutDetails.consoleMessage
-			});
-			notifyFailedToolResult(timeoutDetails.responseMessage, "timed_out");
-			resolve(createFailedAfterPossibleDispatch(timeoutDetails.responseMessage, "timed_out"));
-		}, timeoutMs);
-		timeout.unref?.();
+	const snapshot = () => ({
+		totalMs: toMs(now() - startedAt),
+		spans: spans.slice()
 	});
-	try {
-		params.signal.addEventListener("abort", abortFromRun, { once: true });
-		if (params.signal.aborted) abortFromRun();
-		const response = await Promise.race([
-			params.toolBridge.handleToolCall(params.call, {
-				signal: controller.signal,
-				onAgentToolResult: notifyAgentToolResult,
-				toolCallOrdinal: params.toolCallOrdinal,
-				retainExecutionSnapshot: true
-			}),
-			abortPromise,
-			timeoutPromise
-		]);
-		if (!response.success && !didNotifyAgentToolResult) notifyFailedToolResult(readDynamicToolResponseText(response), response.diagnosticTerminalReason ?? "failed");
-		return finalizeTerminal(response);
-	} catch (error) {
-		const terminalReason = params.signal.aborted ? resolveCodexToolAbortTerminalReason(params.signal) : resolveToolExecutionErrorKind(error);
-		const message = formatToolExecutionErrorMessage(error, "OpenClaw dynamic tool call failed.");
-		notifyFailedToolResult(message, terminalReason);
-		return finalizeTerminal(createFailedAfterPossibleDispatch(message, terminalReason));
-	} finally {
-		if (timeout) clearTimeout(timeout);
-		params.signal.removeEventListener("abort", abortFromRun);
-		resolveAbort = void 0;
-		if (!timedOut && !controller.signal.aborted) controller.abort(/* @__PURE__ */ new Error("OpenClaw dynamic tool call finished."));
-	}
-}
-function readDynamicToolResponseText(response) {
-	return response.contentItems.flatMap((item) => item.type === "inputText" && typeof item.text === "string" ? [item.text] : []).join("\n").trim() || "OpenClaw dynamic tool call failed.";
-}
-/** Strips OpenClaw-only metadata before sending a dynamic tool response to Codex. */
-function toCodexDynamicToolProtocolResponse(response) {
 	return {
-		contentItems: response.contentItems,
-		success: response.success
+		async measure(name, run) {
+			const spanStartedAt = now();
+			try {
+				return await run();
+			} finally {
+				record(name, spanStartedAt);
+			}
+		},
+		measureSync(name, run) {
+			const spanStartedAt = now();
+			try {
+				return run();
+			} finally {
+				record(name, spanStartedAt);
+			}
+		},
+		mark(name) {
+			record(name, now());
+		},
+		logSummary(params) {
+			if (didLog) return;
+			const summary = snapshot();
+			const shouldWarn = shouldWarnCodexThreadLifecycleTimingSummary(summary, options);
+			if (!shouldWarn && !log.isEnabled?.("trace")) return;
+			didLog = true;
+			const message = formatCodexThreadLifecycleTimingSummary({
+				runId: params.runId,
+				sessionId: params.sessionId,
+				sessionKey: params.sessionKey,
+				action: params.action,
+				summary
+			});
+			const meta = {
+				runId: params.runId,
+				sessionId: params.sessionId,
+				sessionKey: params.sessionKey,
+				action: params.action,
+				threadId: params.threadId,
+				totalMs: summary.totalMs,
+				spans: summary.spans
+			};
+			if (shouldWarn) log.warn(message, meta);
+			else log.trace(message, meta);
+		}
 	};
 }
-/** Adds async-started progress details when a tool result continues out of band. */
-function toCodexDynamicToolProgressResponse(response, protocolResponse) {
-	const transcriptDetails = isJsonObject(response.transcriptDetails) ? response.transcriptDetails : void 0;
-	const mcpAppPreview = isJsonObject(transcriptDetails?.mcpAppPreview) ? transcriptDetails.mcpAppPreview : void 0;
-	const progressDetails = mcpAppPreview ? { mcpAppPreview } : void 0;
-	if (response.asyncStarted !== true && progressDetails === void 0) return protocolResponse;
-	return {
-		...protocolResponse,
-		...progressDetails ? { details: progressDetails } : {},
-		...response.asyncStarted === true ? { details: {
-			...progressDetails,
-			async: true,
-			status: "started"
-		} } : {}
-	};
+//#endregion
+//#region extensions/codex/src/app-server/thread-lifecycle-preflight.ts
+function resolveCodexThreadAgentDir(params) {
+	const agentId = resolveSessionAgentIdsStrict({
+		config: params.params.config,
+		sessionKey: params.params.sessionKey,
+		agentId: params.agentId ?? params.params.agentId
+	}).sessionAgentId;
+	return params.agentDir ?? params.params.agentDir ?? resolveAgentDir$1(params.params.config ?? {}, agentId);
 }
-/** Decides whether a terminal dynamic tool response can release the Codex turn. */
-function shouldReleaseTurnAfterTerminalDynamicTool(state) {
-	return !state.completed && !state.aborted && state.responseSuccess && !state.currentTurnHadNonTerminalDynamicToolResult && state.activeAppServerTurnRequests === 0 && state.activeTurnItemIdsCount === 0 && state.pendingOpenClawDynamicToolCompletionIdsCount === 0;
-}
-/** Returns true when a non-async result should block terminal-release shortcuts. */
-function shouldBlockTerminalReleaseForNonTerminalDynamicToolResult(response) {
-	return response.asyncStarted !== true;
-}
-/** Resolves whether terminal diagnostic state should release, wait, or stay idle. */
-function resolveTerminalDynamicToolBatchAction(state) {
-	if (state.activeAppServerTurnRequests > 0 || state.activeTurnItemIdsCount > 0 || state.pendingOpenClawDynamicToolCompletionIdsCount > 0) return "wait";
-	if (state.currentTurnHadNonTerminalDynamicToolResult) return "clear-nonterminal-batch";
-	if (state.hasPendingTerminalDynamicToolRelease) return "release-pending-terminal";
-	return "idle";
-}
-/** Returns true for diagnostic events that terminate a dynamic tool call. */
-function isDynamicToolTerminalDiagnosticEvent(event) {
-	return event.type === "tool.execution.completed" || event.type === "tool.execution.error" || event.type === "tool.execution.blocked";
-}
-/** Matches terminal diagnostics to a specific dynamic tool call id/name. */
-function isMatchingDynamicToolTerminalDiagnostic(params) {
-	if (params.event.toolCallId !== params.call.callId || params.event.toolName !== params.call.tool) return false;
-	if (params.runId !== void 0) return params.event.runId === params.runId;
-	if (params.sessionId !== void 0) return params.event.sessionId === params.sessionId;
-	if (params.sessionKey !== void 0) return params.event.sessionKey === params.sessionKey;
-	return params.event.runId === void 0 && params.event.sessionId === void 0 && params.event.sessionKey === void 0;
-}
-/** Checks pending diagnostics for a terminal event matching a tool call. */
-function hasPendingDynamicToolTerminalDiagnostic(params) {
-	return hasPendingInternalDiagnosticEvent((event) => {
-		if (!isDynamicToolTerminalDiagnosticEvent(event)) return false;
-		return isMatchingDynamicToolTerminalDiagnostic({
-			event,
-			call: params.call,
-			runId: params.runId,
-			sessionId: params.sessionId,
-			sessionKey: params.sessionKey
-		});
+async function prepareCodexThreadLifecyclePreflight(params) {
+	await assertCodexModelBackedReviewerEffectiveConfig({
+		client: params.client,
+		approvalsReviewer: params.appServer.approvalsReviewer,
+		cwd: params.cwd,
+		signal: params.signal
 	});
-}
-/** Resolves per-tool timeout, applying media/message defaults and hard caps. */
-function resolveDynamicToolCallTimeoutMs(params) {
-	if (params.call.tool === "computer") return clampDynamicToolTimeoutMs(readComputerToolTimeoutMs(params.call.arguments));
-	if (params.call.tool === "message") return CODEX_DYNAMIC_MESSAGE_TOOL_TIMEOUT_MS;
-	if (params.call.tool === "agents_wait") {
-		const requestedMs = readDynamicToolCallTimeoutMs(params.call.arguments) ?? readConfiguredDynamicToolTimeoutMs(params.call.tool, params.config) ?? CODEX_DYNAMIC_AGENTS_WAIT_TOOL_TIMEOUT_MS;
-		return Math.max(1, Math.min(63e4, Math.floor(requestedMs)));
-	}
-	return clampDynamicToolTimeoutMs(readDynamicToolCallTimeoutMs(params.call.arguments) ?? readConfiguredDynamicToolTimeoutMs(params.call.tool, params.config) ?? CODEX_DYNAMIC_TOOL_TIMEOUT_MS);
-}
-function readComputerToolTimeoutMs(value) {
-	const args = isJsonObject(value) ? value : void 0;
-	const action = typeof args?.action === "string" ? args.action : void 0;
-	const gatewayTimeoutMs = readPositiveFiniteTimeoutMs(args?.timeoutMs) ?? CODEX_DYNAMIC_COMPUTER_GATEWAY_TIMEOUT_MS;
-	const gatewayCallCount = action === "screenshot" || action === "wait" ? 3 : 4;
-	return (action === "wait" || action === "hold_key" ? Math.max(0, Number(args?.duration) || 0) * 1e3 : 0) + gatewayCallCount * gatewayTimeoutMs + CODEX_DYNAMIC_COMPUTER_COMPLETION_GRACE_MS;
-}
-function readDynamicToolCallTimeoutMs(value) {
-	if (!isJsonObject(value)) return;
-	const timeoutMs = readPositiveFiniteTimeoutMs(value.timeoutMs);
-	if (timeoutMs !== void 0) return timeoutMs;
-	const timeoutSecondsMs = readDynamicToolTimeoutSecondsAsMs(value.timeoutSeconds);
-	return timeoutSecondsMs === void 0 ? void 0 : addTimerTimeoutGraceMs(timeoutSecondsMs, CODEX_DYNAMIC_TOOL_TIMEOUT_SECONDS_GRACE_MS);
-}
-function readConfiguredDynamicToolTimeoutMs(toolName, config) {
-	if (toolName === "image_generate") {
-		const imageModel = config?.agents?.defaults?.mediaModels?.image;
-		if (!imageModel || typeof imageModel !== "object") return CODEX_DYNAMIC_IMAGE_GENERATION_TOOL_TIMEOUT_MS;
-		return readPositiveFiniteTimeoutMs(imageModel.timeoutMs) ?? CODEX_DYNAMIC_IMAGE_GENERATION_TOOL_TIMEOUT_MS;
-	}
-	if (toolName === "view_image") {
-		const candidates = (config?.tools?.media?.models ?? []).filter((entry) => !entry.capabilities || entry.capabilities.includes("image"));
-		const capabilityTimeoutMs = readTimeoutSecondsAsMs(config?.tools?.media?.image?.timeoutSeconds);
-		return Math.max(capabilityTimeoutMs ?? CODEX_DYNAMIC_IMAGE_TOOL_TIMEOUT_MS, ...candidates.map((entry) => readTimeoutSecondsAsMs(entry.timeoutSeconds) ?? capabilityTimeoutMs ?? CODEX_DYNAMIC_IMAGE_TOOL_TIMEOUT_MS));
-	}
-	if (toolName === "message") return CODEX_DYNAMIC_MESSAGE_TOOL_TIMEOUT_MS;
-}
-function readTimeoutSecondsAsMs(value) {
-	const seconds = readPositiveFiniteTimeoutMs(value);
-	return seconds === void 0 ? void 0 : seconds * 1e3;
-}
-function readDynamicToolTimeoutSecondsAsMs(value) {
-	if (typeof value !== "number" || !Number.isFinite(value) || !Number.isInteger(value) || value <= 0) return;
-	return value * 1e3;
-}
-function readPositiveFiniteTimeoutMs(value) {
-	return typeof value === "number" && Number.isFinite(value) && value > 0 ? Math.floor(value) : void 0;
-}
-function clampDynamicToolTimeoutMs(timeoutMs) {
-	return Math.max(1, Math.min(CODEX_DYNAMIC_TOOL_MAX_TIMEOUT_MS, Math.floor(timeoutMs)));
-}
-//#endregion
-//#region extensions/codex/src/app-server/native-hook-relay-state.ts
-const pending = /* @__PURE__ */ new Set();
-/** Owns delayed hook-relay cleanup across runtime scheduling and test teardown. */
-const nativeHookRelayUnregisterQueue = {
-	add(entry) {
-		pending.add(entry);
-	},
-	delete(entry) {
-		return pending.delete(entry);
-	},
-	flush() {
-		while (pending.size > 0) {
-			const entry = pending.values().next().value;
-			if (!entry) return;
-			clearTimeout(entry.timeout);
-			entry.unregister();
-		}
-	},
-	clear() {
-		for (const entry of pending) clearTimeout(entry.timeout);
-		pending.clear();
-	}
-};
-//#endregion
-//#region extensions/codex/src/app-server/native-hook-relay.ts
-/**
-* Bridges Codex native hook callbacks into OpenClaw's native hook relay so
-* app-server tool events can still run OpenClaw policy and diagnostics.
-*/
-/** Codex hook events that can be registered through OpenClaw's native relay. */
-const CODEX_NATIVE_HOOK_RELAY_EVENTS = [
-	"pre_tool_use",
-	"post_tool_use",
-	"permission_request",
-	"before_agent_finalize"
-];
-const CODEX_NATIVE_HOOK_RELAY_EVENTS_WITH_APP_SERVER_APPROVALS = CODEX_NATIVE_HOOK_RELAY_EVENTS.filter((event) => event !== "permission_request");
-const CODEX_NATIVE_HOOK_RELAY_MIN_TTL_MS = 30 * 6e4;
-/** Extra relay lifetime after the expected turn budget, preventing late hook drops. */
-const CODEX_NATIVE_HOOK_RELAY_TTL_GRACE_MS = 5 * 6e4;
-const CODEX_NATIVE_HOOK_RELAY_COMMAND_MIN_PARENT_MARGIN_MS = 250;
-const CODEX_NATIVE_HOOK_RELAY_COMMAND_MAX_PARENT_MARGIN_MS = 1e3;
-const CODEX_NATIVE_HOOK_RELAY_DEFAULT_TIMEOUT_SEC = 10;
-const CODEX_NATIVE_HOOK_RELAY_UNREGISTER_GRACE_MS = 1e4;
-const CODEX_NATIVE_HOOK_RELAY_UNREGISTER_EXTRA_GRACE_MS = 5e3;
-const MAX_PENDING_DIRECT_CHILD_ADMISSIONS = 32;
-const nativeHookPolicyByClient = /* @__PURE__ */ new WeakMap();
-const CODEX_HOOK_MATCHER_NAMES_BY_TOOL_ID = {
-	exec: [
-		"Bash",
-		"exec",
-		"exec_command"
-	],
-	apply_patch: [
-		"apply_patch",
-		"Write",
-		"Edit"
-	],
-	spawn_agent: ["spawn_agent", "Agent"]
-};
-/** Enterprise managed-only policy silently drops the session-layer hooks that enforce OpenClaw. */
-async function assertCodexNativeHookRelayAllowed(client, signal) {
-	let attestation = nativeHookPolicyByClient.get(client);
-	if (!attestation) {
-		attestation = client.request("configRequirements/read", void 0, { signal }).then((response) => {
-			if (!isJsonObject(response) || !Object.hasOwn(response, "requirements")) throw new Error("Codex configRequirements/read returned an invalid hook policy response");
-			const requirements = response.requirements;
-			if (requirements === null) return;
-			if (!isJsonObject(requirements)) throw new Error("Codex configRequirements/read returned invalid hook policy requirements");
-			const managedOnly = requirements.allowManagedHooksOnly;
-			if (managedOnly !== void 0 && managedOnly !== null && typeof managedOnly !== "boolean") throw new Error("Codex configRequirements/read returned invalid managed-only hook policy");
-			if (managedOnly === true) throw new Error("Codex managed-only hooks disable the OpenClaw native hook relay; refusing unenforced execution");
-		});
-		nativeHookPolicyByClient.set(client, attestation);
-		attestation.catch(() => {
-			if (nativeHookPolicyByClient.get(client) === attestation) nativeHookPolicyByClient.delete(client);
-		});
-	}
-	await attestation;
-}
-/** Defers relay unregister so late native hook subprocesses can still resolve. */
-function scheduleCodexNativeHookRelayUnregister(params) {
-	let pending;
-	const unregister = () => {
-		if (!pending) return;
-		const current = pending;
-		pending = void 0;
-		if (!nativeHookRelayUnregisterQueue.delete(current)) return;
-		params.relay.unregister();
-	};
-	const timeout = setTimeout(unregister, resolveCodexNativeHookRelayUnregisterGraceMs(params.hookTimeoutSec));
-	pending = {
-		timeout,
-		unregister
-	};
-	nativeHookRelayUnregisterQueue.add(pending);
-	timeout.unref();
-}
-/** Computes the delayed unregister window from Codex's hook timeout. */
-function resolveCodexNativeHookRelayUnregisterGraceMs(hookTimeoutSec) {
-	const hookTimeoutMs = finiteSecondsToTimerSafeMilliseconds(normalizeHookTimeoutSec(hookTimeoutSec)) ?? 0;
-	return Math.max(CODEX_NATIVE_HOOK_RELAY_UNREGISTER_GRACE_MS, addTimerTimeoutGraceMs(hookTimeoutMs, CODEX_NATIVE_HOOK_RELAY_UNREGISTER_EXTRA_GRACE_MS) ?? 0);
-}
-/** Records a native pre-tool failure that Codex does not project as a tool item. */
-function emitCodexNativePreToolUseFailureDiagnostic(params) {
-	emitTrustedDiagnosticEvent({
-		type: "tool.execution.error",
-		...params.agentId ? { agentId: params.agentId } : {},
-		sessionId: params.sessionId,
-		...params.sessionKey ? { sessionKey: params.sessionKey } : {},
-		runId: params.runId,
-		toolName: params.failure.toolName,
-		toolCallId: params.failure.toolCallId,
-		durationMs: params.failure.durationMs,
-		errorCategory: "before_tool_call",
-		terminalReason: params.terminalReason ?? (params.signal?.aborted ? resolveCodexToolAbortTerminalReason(params.signal) : params.failure.disposition),
-		...params.sourceTimestampMs !== void 0 ? { sourceTimestampMs: params.sourceTimestampMs } : {}
+	if (params.nativeHookRelayRequired) await assertCodexNativeHookRelayAllowed(params.client, params.signal);
+	const lifecycleTiming = createCodexThreadLifecycleTimingTracker({
+		...params.timing,
+		enabled: params.timing?.enabled ?? isCodexAppServerProfilerEnabled(params.params.config)
 	});
-}
-/** Registers an OpenClaw native hook relay for a Codex app-server turn. */
-function createCodexNativeHookRelay(params) {
-	if (params.options?.enabled === false) return;
-	const directChildClaims = /* @__PURE__ */ new Map();
-	const pendingDirectChildAdmissions = /* @__PURE__ */ new Map();
-	let foregroundClosed = false;
-	let successfulYieldRetentionAuthorized = false;
-	const assertClaim = (threadId, claim) => () => directChildClaims.get(threadId) === claim;
-	const rejectPendingAdmissions = (reason) => {
-		for (const pending of pendingDirectChildAdmissions.values()) pending.reject(new Error(reason));
-		pendingDirectChildAdmissions.clear();
-	};
-	const relay = registerRetainedNativeHookRelayForBundledRuntime({
-		provider: "codex",
-		relayId: buildCodexNativeHookRelayId({
-			agentId: params.agentId,
-			sessionId: params.sessionId,
-			sessionKey: params.sessionKey
-		}),
-		...params.generation ? { generation: params.generation } : {},
-		...params.generationMismatchGraceMs ? { generationMismatchGraceMs: params.generationMismatchGraceMs } : {},
-		...params.agentId ? { agentId: params.agentId } : {},
-		sessionId: params.sessionId,
-		...params.sessionKey ? { sessionKey: params.sessionKey } : {},
-		...params.config ? { config: params.config } : {},
-		runId: params.runId,
-		...params.channelId ? { channelId: params.channelId } : {},
-		...params.requester ? { requester: params.requester } : {},
-		...params.approvalContext ? { approvalContext: params.approvalContext } : {},
-		allowedEvents: params.events,
-		preToolUseLoopDetection: params.loopDetectionPreToolUseRelay,
-		ttlMs: resolveCodexNativeHookRelayTtlMs({
-			explicitTtlMs: params.options?.ttlMs,
-			attemptTimeoutMs: params.attemptTimeoutMs,
-			startupTimeoutMs: params.startupTimeoutMs,
-			turnStartTimeoutMs: params.turnStartTimeoutMs
-		}),
-		signal: params.signal,
-		runBeforeToolCall: params.hostCapabilities.runBeforeToolCall,
-		assertActive: params.hostCapabilities.assertActive,
-		retention: {
-			readClaim: readCodexNativeChildThreadId,
-			shouldRetainAfterForegroundClose: () => successfulYieldRetentionAuthorized && directChildClaims.size > 0,
-			allowPreToolUse: (childThreadId) => directChildClaims.has(childThreadId),
-			awaitForegroundAdmission: (childThreadId) => {
-				if (foregroundClosed) return Promise.reject(/* @__PURE__ */ new Error("native hook relay foreground admission unavailable"));
-				const existingClaim = directChildClaims.get(childThreadId);
-				if (existingClaim) return Promise.resolve(assertClaim(childThreadId, existingClaim));
-				const existingPending = pendingDirectChildAdmissions.get(childThreadId);
-				if (existingPending) return existingPending.promise.then((claim) => assertClaim(childThreadId, claim));
-				if (pendingDirectChildAdmissions.size >= MAX_PENDING_DIRECT_CHILD_ADMISSIONS) return Promise.reject(/* @__PURE__ */ new Error("native hook relay foreground admission capacity reached"));
-				const { promise, resolve, reject } = createDeferred();
-				pendingDirectChildAdmissions.set(childThreadId, {
-					promise,
-					resolve,
-					reject
-				});
-				return promise.then((claim) => assertClaim(childThreadId, claim));
-			},
-			onDispose: () => {
-				foregroundClosed = true;
-				rejectPendingAdmissions("native hook relay registration closed");
-			}
-		},
-		onPreToolUseFailure: params.onPreToolUseFailure,
-		command: {
-			nice: 10,
-			timeoutMs: params.options?.gatewayTimeoutMs
-		}
+	const legacyDynamicToolsFingerprint = lifecycleTiming.measureSync("legacy-dynamic-tools-fingerprint", () => codexLegacyDynamicToolsFingerprint(params.dynamicTools));
+	const dynamicToolsFingerprint = lifecycleTiming.measureSync("dynamic-tools-fingerprint", () => hashCodexAppServerBindingFingerprint(legacyDynamicToolsFingerprint));
+	const dynamicToolsContainDeferred = flattenCodexDynamicToolFunctions(params.dynamicTools).some((tool) => tool.deferLoading === true);
+	const webSearchThreadConfigFingerprint = fingerprintJsonObject(lifecycleTiming.measureSync("web-search-plan", () => resolveCodexWebSearchPlan({
+		config: params.params.config,
+		disableTools: params.params.disableTools,
+		nativeToolSurfaceEnabled: params.nativeCodeModeEnabled,
+		nativeProviderWebSearchSupport: params.nativeProviderWebSearchSupport,
+		webSearchAllowed: params.webSearchAllowed
+	})).threadConfig);
+	const networkProxyConfigFingerprint = params.appServer.networkProxy?.configFingerprint;
+	const contextEngineBinding = lifecycleTiming.measureSync("context-engine-binding", () => buildContextEngineBinding(params.params, params.contextEngineProjection));
+	const userMcpServersConfigPatch = params.userMcpServersEnabled === false ? void 0 : await buildCodexUserMcpServersThreadConfigPatchForRun({
+		run: params.params,
+		cwd: params.cwd,
+		agentId: params.agentId ?? params.params.agentId,
+		allowLiteralOAuthProjection: params.appServer.connectionClass !== "remote",
+		warn: (message) => embeddedAgentLog.warn(message),
+		onServerUnavailable: (serverName, error) => embeddedAgentLog.warn("skipping unavailable MCP OAuth server", {
+			serverName,
+			error: formatErrorMessage(error)
+		})
 	});
-	const unregister = () => {
-		foregroundClosed = true;
-		rejectPendingAdmissions("native hook relay foreground closed");
-		relay.unregister();
-	};
+	const nativeSkillIsolation = await lifecycleTiming.measure("native-skill-isolation", () => resolveCodexNativeSkillIsolation({
+		client: params.client,
+		codexHome: params.appServer.start.env?.CODEX_HOME,
+		cwd: params.cwd,
+		home: params.appServer.start.env?.HOME,
+		signal: params.signal,
+		userProfile: params.appServer.start.env?.USERPROFILE
+	}));
+	const nativeSkillIsolationFingerprint = nativeSkillIsolation ? fingerprintJsonObject({
+		version: 1,
+		disabledUserSkillPaths: nativeSkillIsolation.disabledUserSkillPaths
+	}) : void 0;
+	const legacyUserMcpServersFingerprint = legacyFingerprintUserMcpServersConfigPatch(userMcpServersConfigPatch);
+	const userMcpServersFingerprint = fingerprintUserMcpServersConfigPatch(userMcpServersConfigPatch);
+	const environmentSelectionFingerprint = fingerprintEnvironmentSelection(params.environmentSelection);
+	const hostSystemAgentActive = params.hostSystemAgentActive ?? isHostScopedAgentToolActive("openclaw");
+	const ringZeroActive = hostSystemAgentActive && isSystemAgentOnlyCodexDynamicToolAllowlist(params.params.toolsAllow);
+	const messageOnlySourceReply = isMessageOnlyCodexSourceReply(params.params);
+	const restrictedToolSurface = ringZeroActive || messageOnlySourceReply || params.params.pluginHarnessToolPolicyRestricted === true;
+	const allowConfiguredManagedHooks = params.params.pluginHarnessToolPolicyRestricted === true && !ringZeroActive && !messageOnlySourceReply && params.params.scheduledRuntimeAuthority === void 0;
+	const imageGenerationDenied = params.params.pluginHarnessToolPolicySafeDeniedTools?.includes("image_generate") === true;
+	if (restrictedToolSurface && params.nativeCodeModeEnabled !== false) throw new Error("Codex restricted tool surfaces require native code mode to be disabled");
+	const restrictedToolSurfaceInheritedMcpServerNames = restrictedToolSurface ? await lifecycleTiming.measure("restricted-tool-surface-mcp-config-read", () => readCodexInheritedMcpServerNames(params.client, params.cwd, params.signal)) : [];
+	if (restrictedToolSurface || imageGenerationDenied) await lifecycleTiming.measure("tool-policy-config-requirements-read", () => assertCodexManagedRequirementsDoNotOverrideToolPolicy(params.client, {
+		restrictedToolSurface,
+		additionalDeniedFeatures: imageGenerationDenied ? ["image_generation"] : void 0,
+		allowedManagedRequirementsFingerprint: readScheduledCodexAppManagedRequirementsFingerprint(params.params.scheduledRuntimeAuthority),
+		allowConfiguredManagedHooks
+	}, params.signal));
+	const ringZeroConfigFingerprint = ringZeroActive ? fingerprintJsonObject({
+		version: 1,
+		baseInstructions: "",
+		config: buildCodexRingZeroThreadConfigPatch(params.params, true, restrictedToolSurfaceInheritedMcpServerNames)
+	}) : void 0;
 	return {
-		...relay,
-		unregister,
-		authorizeRetentionAfterSuccessfulYield: () => {
-			successfulYieldRetentionAuthorized = true;
-		},
-		hasClaimedDirectChild: () => directChildClaims.size > 0,
-		rejectPendingDirectChild: (threadIdInput, reason) => {
-			const threadId = threadIdInput.trim();
-			const pending = threadId ? pendingDirectChildAdmissions.get(threadId) : void 0;
-			if (!pending) return;
-			pendingDirectChildAdmissions.delete(threadId);
-			pending.reject(new Error(reason));
-		},
-		claimDirectChild: (threadIdInput) => {
-			const threadId = threadIdInput.trim();
-			if (!threadId) return () => void 0;
-			if (directChildClaims.get(threadId)) return () => void 0;
-			const claim = Symbol(threadId);
-			directChildClaims.set(threadId, claim);
-			const pending = pendingDirectChildAdmissions.get(threadId);
-			pendingDirectChildAdmissions.delete(threadId);
-			pending?.resolve(claim);
-			let released = false;
-			return () => {
-				if (released) return;
-				released = true;
-				if (directChildClaims.get(threadId) !== claim) return;
-				directChildClaims.delete(threadId);
-				if (foregroundClosed && directChildClaims.size === 0) relay.unregister();
-			};
-		}
+		contextEngineBinding,
+		dynamicToolsContainDeferred,
+		dynamicToolsFingerprint,
+		environmentSelectionFingerprint,
+		hostSystemAgentActive,
+		legacyDynamicToolsFingerprint,
+		legacyUserMcpServersFingerprint,
+		lifecycleTiming,
+		nativeSkillIsolation,
+		nativeSkillIsolationFingerprint,
+		networkProxyConfigFingerprint,
+		ringZeroActive,
+		ringZeroClientInstanceId: ringZeroActive ? getCodexAppServerClientInstanceId(params.client) : void 0,
+		ringZeroConfigFingerprint,
+		restrictedToolSurface,
+		restrictedToolSurfaceInheritedMcpServerNames,
+		userMcpServersConfigPatch,
+		userMcpServersFingerprint,
+		webSearchThreadConfigFingerprint
 	};
 }
-function readCodexNativeChildThreadId(rawPayload) {
-	if (!isJsonObject(rawPayload) || typeof rawPayload.agent_id !== "string") return;
-	return rawPayload.agent_id.trim() || void 0;
-}
-/** Selects the native hook events Codex should install for the current approval mode. */
-function resolveCodexNativeHookRelayEvents(params) {
-	if (params.configuredEvents?.length) return params.configuredEvents;
-	return params.appServer.approvalPolicy === "never" ? CODEX_NATIVE_HOOK_RELAY_EVENTS : CODEX_NATIVE_HOOK_RELAY_EVENTS_WITH_APP_SERVER_APPROVALS;
-}
-/** Derives the native hook relay TTL from the turn budget unless explicitly configured. */
-function resolveCodexNativeHookRelayTtlMs(params) {
-	if (params.explicitTtlMs !== void 0) return params.explicitTtlMs;
-	const relayBudgetMs = params.attemptTimeoutMs + params.startupTimeoutMs + params.turnStartTimeoutMs + CODEX_NATIVE_HOOK_RELAY_TTL_GRACE_MS;
-	return Math.max(CODEX_NATIVE_HOOK_RELAY_MIN_TTL_MS, Math.floor(relayBudgetMs));
-}
-/** Builds a stable relay id scoped to the agent and session identity. */
-function buildCodexNativeHookRelayId(params) {
-	const hash = createHash("sha256");
-	hash.update("openclaw:codex:native-hook-relay:v1");
-	hash.update("\0");
-	hash.update(params.agentId?.trim() || "");
-	hash.update("\0");
-	hash.update(params.sessionKey?.trim() || params.sessionId);
-	return `codex-${hash.digest("hex").slice(0, 40)}`;
-}
-const CODEX_HOOK_EVENT_BY_NATIVE_EVENT = {
-	pre_tool_use: "PreToolUse",
-	post_tool_use: "PostToolUse",
-	permission_request: "PermissionRequest",
-	before_agent_finalize: "Stop"
-};
-const CODEX_HOOK_KEY_LABEL_BY_NATIVE_EVENT = {
-	pre_tool_use: "pre_tool_use",
-	post_tool_use: "post_tool_use",
-	permission_request: "permission_request",
-	before_agent_finalize: "stop"
-};
-const CODEX_SESSION_FLAGS_HOOK_SOURCE_PATHS = ["/<session-flags>/config.toml", "<session-flags>/config.toml"];
-/** Builds the Codex config overlay that installs trusted command hooks for relay events. */
-function buildCodexNativeHookRelayConfig(params) {
-	const events = params.events?.length ? params.events : CODEX_NATIVE_HOOK_RELAY_EVENTS;
-	const selectedEvents = new Set(events);
-	const config = { "features.hooks": true };
-	const hookState = {};
-	for (const event of CODEX_NATIVE_HOOK_RELAY_EVENTS) {
-		const codexEvent = CODEX_HOOK_EVENT_BY_NATIVE_EVENT[event];
-		const selected = selectedEvents.has(event);
-		const shouldRelay = params.relay.shouldRelayEvent(event);
-		if (!selected || !shouldRelay) {
-			if (selected || params.clearOmittedEvents) config[`hooks.${codexEvent}`] = [];
-			if (params.clearOmittedEvents) for (const sourcePath of CODEX_SESSION_FLAGS_HOOK_SOURCE_PATHS) hookState[`${sourcePath}:${CODEX_HOOK_KEY_LABEL_BY_NATIVE_EVENT[event]}:0:0`] = { enabled: false };
-			continue;
-		}
-		const timeout = normalizeHookTimeoutSec(params.hookTimeoutSec);
-		const command = params.relay.commandForEvent(event, { timeoutMs: resolveCodexNativeHookRelayCommandTimeoutMs(timeout) });
-		const matcher = buildCodexNativeToolMatcher(params.relay.toolMatcherForEvent(event));
-		config[`hooks.${codexEvent}`] = [{
-			...matcher ? { matcher } : {},
-			hooks: [{
-				type: "command",
-				command,
-				timeout,
-				async: false,
-				statusMessage: "OpenClaw native hook relay"
-			}]
-		}];
-		const state = {
-			enabled: true,
-			trusted_hash: codexCommandHookTrustedHash({
-				event,
-				command,
-				matcher,
-				timeout,
-				statusMessage: "OpenClaw native hook relay"
-			})
-		};
-		for (const sourcePath of CODEX_SESSION_FLAGS_HOOK_SOURCE_PATHS) hookState[`${sourcePath}:${CODEX_HOOK_KEY_LABEL_BY_NATIVE_EVENT[event]}:0:0`] = state;
-	}
-	config["hooks.state"] = hookState;
-	return config;
+//#endregion
+//#region extensions/codex/src/app-server/thread-lifecycle-result.ts
+function resolveCodexThreadRolloutPath(thread) {
+	const rolloutPath = thread.path?.trim();
+	if (!rolloutPath || !path.isAbsolute(rolloutPath) || path.extname(rolloutPath) !== ".jsonl" || !path.basename(rolloutPath).includes(thread.id)) return;
+	return rolloutPath;
 }
-/** Builds a Codex config overlay that disables native hooks and clears hook arrays. */
-function buildCodexNativeHookRelayDisabledConfig() {
+/** Materializes the public lifecycle result after a fresh thread is durably committed. */
+function buildStartedCodexThreadBinding(input) {
+	const { context, params, response, startParams } = input;
 	return {
-		"features.hooks": false,
-		"hooks.PreToolUse": [],
-		"hooks.PostToolUse": [],
-		"hooks.PermissionRequest": [],
-		"hooks.Stop": []
-	};
-}
-function normalizeHookTimeoutSec(value) {
-	return typeof value === "number" && Number.isFinite(value) && value > 0 ? Math.ceil(value) : CODEX_NATIVE_HOOK_RELAY_DEFAULT_TIMEOUT_SEC;
-}
-function resolveCodexNativeHookRelayCommandTimeoutMs(hookTimeoutSec) {
-	const parentTimeoutMs = finiteSecondsToTimerSafeMilliseconds(normalizeHookTimeoutSec(hookTimeoutSec)) ?? 5e3;
-	const parentMarginMs = Math.min(CODEX_NATIVE_HOOK_RELAY_COMMAND_MAX_PARENT_MARGIN_MS, Math.max(CODEX_NATIVE_HOOK_RELAY_COMMAND_MIN_PARENT_MARGIN_MS, Math.floor(parentTimeoutMs / 5)));
-	return Math.max(1, parentTimeoutMs - parentMarginMs);
-}
-function buildCodexNativeToolMatcher(toolNames) {
-	if (toolNames === void 0) return;
-	if (toolNames.length === 0) throw new TypeError("Codex native hook matcher requires at least one tool name");
-	const nativeNames = /* @__PURE__ */ new Set();
-	let hasCustomToolName = false;
-	for (const toolName of toolNames) {
-		const canonicalToolName = toolName.trim();
-		if (!canonicalToolName || canonicalToolName === "*") throw new TypeError("Codex native hook matcher requires canonical OpenClaw tool ids");
-		const nativeAliases = CODEX_HOOK_MATCHER_NAMES_BY_TOOL_ID[canonicalToolName];
-		if (!nativeAliases) hasCustomToolName = true;
-		for (const nativeName of nativeAliases ?? [canonicalToolName]) nativeNames.add(nativeName);
-	}
-	const sortedNames = Array.from(nativeNames).toSorted();
-	if (!hasCustomToolName && sortedNames.every((toolName) => /^[A-Za-z0-9_]+$/.test(toolName))) return sortedNames.join("|");
-	return `(?i)^(?:${sortedNames.map((toolName) => toolName.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|")})$`;
-}
-function codexCommandHookTrustedHash(params) {
-	const identity = {
-		event_name: CODEX_HOOK_KEY_LABEL_BY_NATIVE_EVENT[params.event],
-		...params.matcher ? { matcher: params.matcher } : {},
-		hooks: [{
-			async: false,
-			command: params.command,
-			statusMessage: params.statusMessage,
-			timeout: params.timeout,
-			type: "command"
-		}]
+		threadId: response.thread.id,
+		...input.clientId ? { clientId: input.clientId } : {},
+		cwd: params.cwd,
+		...input.rolloutPath ? { rolloutPath: input.rolloutPath } : {},
+		authProfileId: params.params.authProfileId,
+		agentWorkspaceDeveloperInstructions: params.agentWorkspaceDeveloperInstructions,
+		model: response.model ?? startParams.model ?? params.params.modelId,
+		modelProvider: response.modelProvider ?? input.startModelProvider ?? input.modelProvider,
+		dynamicToolsFingerprint: context.dynamicToolsFingerprint,
+		dynamicToolsContainDeferred: context.dynamicToolsContainDeferred,
+		nativeSkillIsolationFingerprint: context.nativeSkillIsolationFingerprint,
+		userMcpServersFingerprint: context.userMcpServersFingerprint,
+		mcpServersFingerprint: input.nextMcpServersFingerprint,
+		configuredMcpOwnershipVersion: params.configuredMcpOwnershipVersion,
+		ringZeroConfigFingerprint: context.ringZeroConfigFingerprint,
+		ringZeroClientInstanceId: context.ringZeroClientInstanceId,
+		networkProxyProfileName: params.appServer.networkProxy?.profileName,
+		networkProxyConfigFingerprint: context.networkProxyConfigFingerprint,
+		nativeHookRelayGeneration: input.finalConfigPatch.nativeHookRelayGeneration,
+		appServerRuntimeFingerprint: params.appServerRuntimeFingerprint,
+		pluginAppsFingerprint: input.pluginThreadConfig?.fingerprint,
+		pluginAppsInputFingerprint: input.pluginThreadConfig?.inputFingerprint,
+		pluginAppPolicyContext: input.pluginThreadConfig?.policyContext,
+		contextEngine: context.contextEngineBinding,
+		environmentSelectionFingerprint: context.environmentSelectionFingerprint,
+		...startParams.ephemeral ? { liveThreadEphemeralPolicy: startParams.developerInstructions } : {},
+		...!context.preserveExistingBinding ? { liveThreadConfigFingerprint: fingerprintCodexThreadConfig({
+			...startParams,
+			model: response.model ?? startParams.model ?? null,
+			requestedModel: startParams.model ?? null,
+			modelProvider: input.bindingModelProvider ?? null,
+			requestedModelProvider: startParams.modelProvider ?? input.bindingModelProvider ?? null
+		}, params.params.authProfileId, context.dynamicToolsFingerprint) } : {},
+		lifecycle: {
+			action: "started",
+			...context.rotatedContextEngineBinding ? { rotatedContextEngineBinding: true } : {}
+		}
 	};
-	return `sha256:${createHash("sha256").update(JSON.stringify(sortJsonValue(identity))).digest("hex")}`;
-}
-function sortJsonValue(value) {
-	if (!value || typeof value !== "object") return value;
-	if (Array.isArray(value)) return value.map(sortJsonValue);
-	const sorted = {};
-	for (const [key, entry] of Object.entries(value).toSorted(([left], [right]) => left.localeCompare(right))) sorted[key] = sortJsonValue(entry);
-	return sorted;
-}
-//#endregion
-//#region extensions/codex/src/app-server/profiler-flag.ts
-const PROFILER_FLAGS = ["profiler", "codex.profiler"];
-/** Checks the generic and Codex-specific profiler diagnostic flags. */
-function isCodexAppServerProfilerEnabled(config, env = process.env) {
-	return PROFILER_FLAGS.some((flag) => isDiagnosticFlagEnabled(flag, config, env));
 }
 //#endregion
-//#region extensions/codex/src/app-server/thread-lifecycle-timing.ts
-const CODEX_THREAD_LIFECYCLE_TIMING_WARN_TOTAL_MS = 1e3;
-const CODEX_THREAD_LIFECYCLE_TIMING_WARN_STAGE_MS = 500;
-function shouldWarnCodexThreadLifecycleTimingSummary(summary, options = {}) {
-	const totalThresholdMs = options.totalThresholdMs ?? CODEX_THREAD_LIFECYCLE_TIMING_WARN_TOTAL_MS;
-	const stageThresholdMs = options.stageThresholdMs ?? CODEX_THREAD_LIFECYCLE_TIMING_WARN_STAGE_MS;
-	return summary.totalMs >= totalThresholdMs || summary.spans.some((span) => span.durationMs >= stageThresholdMs);
-}
-function formatCodexThreadLifecycleTimingSummary(params) {
-	const spans = params.summary.spans.length > 0 ? params.summary.spans.map((span) => `${span.name}:${span.durationMs}ms@${span.elapsedMs}ms`).join(",") : "none";
-	return `[trace:codex-app-server] thread lifecycle: runId=${params.runId} sessionId=${params.sessionId} sessionKey=${params.sessionKey ?? "unknown"} action=${params.action} totalMs=${params.summary.totalMs} stages=${spans}`;
-}
-function createCodexThreadLifecycleTimingTracker(options = {}) {
-	const log = options.log ?? embeddedAgentLog;
-	if (!options.enabled && log.isEnabled?.("trace") !== true) return {
-		async measure(_name, run) {
-			return await run();
-		},
-		measureSync(_name, run) {
-			return run();
-		},
-		mark() {},
-		logSummary() {}
+//#region extensions/codex/src/app-server/thread-lifecycle-io.ts
+async function resumeExistingCodexThread(params, context) {
+	const { binding: resumeBinding, bindingIdentity, startModelSelection, startModelProvider, userMcpServersConfigPatch, dynamicToolsFingerprint, dynamicToolsContainDeferred, webSearchThreadConfigFingerprint, nativeSkillIsolationFingerprint, userMcpServersFingerprint, ringZeroConfigFingerprint, ringZeroClientInstanceId, networkProxyConfigFingerprint, contextEngineBinding, environmentSelectionFingerprint, hostSystemAgentActive, restrictedToolSurface, restrictedToolSurfaceInheritedMcpServerNames, nativeSkillIsolation, lifecycleTiming, normalizeBindingModelProvider, throwIfAborted, clearCurrentBinding } = context;
+	let resumeReservation;
+	let resumeResponseAccepted = false;
+	let ordinaryAppConfigChanged = false;
+	let policyOutcome = "not-written";
+	const assertHandoffCurrent = () => {
+		params.params.hostCapabilities.assertActive();
+		throwIfAborted();
+		context.assertResumeOwnership();
+		context.assertResumeConfiguration();
 	};
-	const now = options.now ?? Date.now;
-	const startedAt = now();
-	let didLog = false;
-	const spans = [];
-	const toMs = (value) => Math.max(0, Math.round(value));
-	const record = (name, spanStartedAt) => {
-		const currentAt = now();
-		spans.push({
-			name,
-			durationMs: toMs(currentAt - spanStartedAt),
-			elapsedMs: toMs(currentAt - startedAt)
+	const abandonClient = params.abandonClient ?? (() => closeCodexStartupClientBestEffort(params.client));
+	try {
+		const authProfileId = resumeBinding.connectionScope === "supervision" ? void 0 : params.params.authProfileId ?? resumeBinding.authProfileId;
+		const finalConfigPatch = context.prebuiltFinalConfigPatch ?? params.buildFinalConfigPatch?.({
+			action: "resume",
+			binding: resumeBinding
+		}) ?? {
+			configPatch: params.finalConfigPatch,
+			nativeHookRelayGeneration: params.nativeHookRelayGeneration
+		};
+		const pluginThreadConfig = context.prebuiltPluginThreadConfig ?? (params.pluginThreadConfig?.requiresCurrentPolicyCheck ? await lifecycleTiming.measure("plugin-config-build", () => params.pluginThreadConfig?.build()) : void 0);
+		const pluginAppsConfigPatch = pluginThreadConfig?.configPatch ?? (params.pluginThreadConfig?.enabled && resumeBinding.pluginAppPolicyContext ? buildCodexPluginAppsConfigPatchFromPolicyContext(resumeBinding.pluginAppPolicyContext) : void 0);
+		const resumeConfig = applyCodexNativeSkillIsolation(mergeCodexThreadConfigs(params.config, userMcpServersConfigPatch, pluginAppsConfigPatch, finalConfigPatch.configPatch), nativeSkillIsolation);
+		const resumeParams = lifecycleTiming.measureSync("thread-resume-params", () => buildThreadResumeParams(params.params, {
+			threadId: resumeBinding.threadId,
+			cwd: params.cwd,
+			authProfileId,
+			model: startModelSelection.model,
+			modelProvider: startModelProvider,
+			preserveNativeModel: resumeBinding.preserveNativeModel === true,
+			appServer: params.appServer,
+			dynamicTools: params.dynamicTools,
+			developerInstructions: params.developerInstructions,
+			config: resumeConfig,
+			nativeCodeModeEnabled: params.nativeCodeModeEnabled,
+			nativeProviderWebSearchSupport: params.nativeProviderWebSearchSupport,
+			nativeCodeModeOnlyEnabled: params.nativeCodeModeOnlyEnabled,
+			webSearchAllowed: params.webSearchAllowed,
+			hostSystemAgentActive,
+			restrictedToolSurfaceInheritedMcpServerNames,
+			shellEnvironment: params.shellEnvironment,
+			disableLoginShell: params.disableLoginShell
+		}));
+		const requestModelProvider = typeof resumeParams.modelProvider === "string" && resumeParams.modelProvider.trim() ? resumeParams.modelProvider : void 0;
+		throwIfAborted();
+		resumeReservation = params.reserveResumeThread?.(resumeBinding.threadId);
+		const response = await lifecycleTiming.measure("thread-resume-request", () => resumeCodexAppServerThread({
+			client: params.client,
+			abandonClient,
+			request: resumeParams,
+			signal: params.signal,
+			assertCurrent: context.assertResumeOwnership
+		}));
+		resumeResponseAccepted = true;
+		assertCodexThreadAcceptsDirectInput(response.thread);
+		context.assertResumeConfiguration();
+		const loadedPluginThreadConfig = await context.buildLoadedPluginThreadConfig?.(resumeBinding);
+		if (loadedPluginThreadConfig && loadedPluginThreadConfig.fingerprint !== (pluginThreadConfig?.fingerprint ?? resumeBinding.pluginAppsFingerprint)) {
+			ordinaryAppConfigChanged = resumeBinding.connectionScope !== "supervision" && !resumeBinding.pendingResumeConfiguration;
+			throw new Error("Codex thread app policy changed; a fresh thread configuration is required");
+		}
+		const provisionalAppIds = loadedPluginThreadConfig?.provisionalAppIds ?? pluginThreadConfig?.provisionalAppIds ?? [];
+		await attestCodexThreadToolSurface({
+			client: params.client,
+			threadId: response.thread.id,
+			appIds: provisionalAppIds,
+			signal: params.signal,
+			threadConfig: resumeParams.config,
+			restrictedToolSurface,
+			lifecycleTiming,
+			assertCurrent: assertHandoffCurrent
 		});
-	};
-	const snapshot = () => ({
-		totalMs: toMs(now() - startedAt),
-		spans: spans.slice()
-	});
-	return {
-		async measure(name, run) {
-			const spanStartedAt = now();
-			try {
-				return await run();
-			} finally {
-				record(name, spanStartedAt);
+		throwIfAborted();
+		await refreshCodexThreadPolicy({
+			client: params.client,
+			threadId: resumeBinding.threadId,
+			developerInstructions: resumeParams.developerInstructions,
+			timeoutMs: params.appServer.requestTimeoutMs,
+			signal: params.signal,
+			assertCurrent: assertHandoffCurrent
+		});
+		policyOutcome = "acknowledged";
+		assertHandoffCurrent();
+		const resumePatch = {
+			clientId: resolveCodexAppServerClientInstanceId(params.client),
+			pendingResumeConfiguration: void 0,
+			cwd: params.cwd,
+			rolloutPath: resolveCodexThreadRolloutPath(response.thread) ?? resumeBinding.rolloutPath,
+			authProfileId,
+			model: response.model ?? resumeParams.model ?? params.params.modelId,
+			preserveNativeModel: resumeBinding.preserveNativeModel === true ? true : void 0,
+			modelProvider: normalizeBindingModelProvider(authProfileId, response.modelProvider ?? requestModelProvider ?? startModelProvider),
+			dynamicToolsFingerprint,
+			dynamicToolsContainDeferred,
+			webSearchThreadConfigFingerprint,
+			nativeSkillIsolationFingerprint,
+			userMcpServersFingerprint,
+			mcpServersFingerprint: params.mcpServersFingerprintEvaluated === true ? params.mcpServersFingerprint : resumeBinding.mcpServersFingerprint,
+			configuredMcpOwnershipVersion: params.configuredMcpOwnershipVersion,
+			ringZeroConfigFingerprint,
+			ringZeroClientInstanceId,
+			nativeToolPolicyRestricted: restrictedToolSurface ? true : void 0,
+			networkProxyProfileName: params.appServer.networkProxy?.profileName,
+			networkProxyConfigFingerprint,
+			nativeHookRelayGeneration: finalConfigPatch.nativeHookRelayGeneration ?? resumeBinding.nativeHookRelayGeneration,
+			appServerRuntimeFingerprint: resumeBinding.connectionScope === "supervision" ? buildCodexAppServerConnectionFingerprint(params.appServer, params.params.agentDir) : params.appServerRuntimeFingerprint,
+			pluginAppsFingerprint: pluginThreadConfig?.fingerprint ?? resumeBinding.pluginAppsFingerprint,
+			pluginAppsInputFingerprint: pluginThreadConfig?.inputFingerprint ?? resumeBinding.pluginAppsInputFingerprint,
+			pluginAppPolicyContext: pluginThreadConfig?.policyContext ?? resumeBinding.pluginAppPolicyContext,
+			contextEngine: contextEngineBinding,
+			environmentSelectionFingerprint
+		};
+		if (!await lifecycleTiming.measure("thread-resume-write-binding", () => params.bindingStore.mutate(bindingIdentity, {
+			kind: "patch",
+			threadId: resumeBinding.threadId,
+			patch: resumePatch
+		}, assertHandoffCurrent))) throw new CodexThreadBindingConflictError(resumeBinding.threadId, "committing a resumed thread");
+		assertHandoffCurrent();
+		if (contextEngineBinding) embeddedAgentLog.info("codex app-server wrote context-engine thread binding", {
+			sessionId: params.params.sessionId,
+			sessionKey: params.params.sessionKey,
+			threadId: response.thread.id,
+			engineId: contextEngineBinding.engineId,
+			epoch: contextEngineBinding.projection?.epoch,
+			fingerprint: contextEngineBinding.projection?.fingerprint,
+			action: "resumed"
+		});
+		lifecycleTiming.mark("thread-ready");
+		lifecycleTiming.logSummary({
+			runId: params.params.runId,
+			sessionId: params.params.sessionId,
+			sessionKey: params.params.sessionKey,
+			threadId: response.thread.id,
+			action: "resumed"
+		});
+		const activeTurnIds = readActiveCodexTurnIdsFromResume(response);
+		return {
+			...resumeBinding,
+			threadId: response.thread.id,
+			...resumePatch,
+			liveThreadConfigFingerprint: fingerprintCodexThreadConfig({
+				...resumeParams,
+				model: resumeBinding.preserveNativeModel === true ? null : response.model ?? resumeParams.model ?? null,
+				requestedModel: resumeBinding.preserveNativeModel === true ? null : resumeParams.model ?? null,
+				modelProvider: resumeBinding.preserveNativeModel === true ? null : resumePatch.modelProvider ?? null,
+				requestedModelProvider: resumeBinding.preserveNativeModel === true ? null : resumeParams.modelProvider ?? resumePatch.modelProvider ?? null
+			}, authProfileId, dynamicToolsFingerprint),
+			lifecycle: {
+				action: "resumed",
+				...activeTurnIds.length ? { activeTurnIds } : {}
 			}
-		},
-		measureSync(name, run) {
-			const spanStartedAt = now();
-			try {
-				return run();
-			} finally {
-				record(name, spanStartedAt);
+		};
+	} catch (error) {
+		resumeReservation?.release();
+		if (!resumeResponseAccepted && (!(error instanceof CodexAppServerRpcError) || isCodexAppServerOverloadError(error))) throw error;
+		if (resumeResponseAccepted) {
+			const handoffError = error instanceof CodexThreadPolicyHandoffError || error instanceof CodexAppServerUnsafeSubscriptionError ? error : new CodexThreadPolicyHandoffError(policyOutcome, error);
+			const subscriptionReleased = await unsubscribeCodexThreadBestEffort(params.client, {
+				threadId: resumeBinding.threadId,
+				timeoutMs: CODEX_APP_SERVER_UNSUBSCRIBE_TIMEOUT_MS,
+				assertCurrent: context.assertResumeOwnership
+			}).catch(() => false);
+			if (!subscriptionReleased || handoffError instanceof CodexThreadPolicyHandoffError && handoffError.outcome === "unknown") {
+				if (resumeBinding.connectionScope === "supervision") await retireUnsafeCodexTurnClientBestEffort(params.client, "session policy handoff");
+				else try {
+					await abandonClient();
+				} catch (cause) {
+					throw new CodexThreadPolicyHandoffError(handoffError instanceof CodexThreadPolicyHandoffError ? handoffError.outcome : policyOutcome, new AggregateError([handoffError, cause], "Codex thread/resume client could not be retired"));
+				}
 			}
-		},
-		mark(name) {
-			record(name, now());
-		},
-		logSummary(params) {
-			if (didLog) return;
-			const summary = snapshot();
-			const shouldWarn = shouldWarnCodexThreadLifecycleTimingSummary(summary, options);
-			if (!shouldWarn && !log.isEnabled?.("trace")) return;
-			didLog = true;
-			const message = formatCodexThreadLifecycleTimingSummary({
-				runId: params.runId,
-				sessionId: params.sessionId,
-				sessionKey: params.sessionKey,
-				action: params.action,
-				summary
-			});
-			const meta = {
-				runId: params.runId,
-				sessionId: params.sessionId,
-				sessionKey: params.sessionKey,
-				action: params.action,
-				threadId: params.threadId,
-				totalMs: summary.totalMs,
-				spans: summary.spans
-			};
-			if (shouldWarn) log.warn(message, meta);
-			else log.trace(message, meta);
+			if (!ordinaryAppConfigChanged || !subscriptionReleased) throw handoffError;
+			assertHandoffCurrent();
+		}
+		if (resumeBinding.pendingResumeConfiguration || resumeBinding.connectionScope === "supervision" || params.signal?.aborted) throw error;
+		embeddedAgentLog.warn("codex app-server thread resume failed; starting a new thread", { error });
+		await clearCurrentBinding("rotating a stale thread binding");
+	}
+}
+async function startFreshCodexThread(params, context) {
+	const clientId = resolveCodexAppServerClientInstanceId(params.client);
+	const { bindingIdentity, startModelSelection, startModelProvider, userMcpServersConfigPatch, dynamicToolsFingerprint, dynamicToolsContainDeferred, webSearchThreadConfigFingerprint, nativeSkillIsolationFingerprint, userMcpServersFingerprint, ringZeroConfigFingerprint, ringZeroClientInstanceId, networkProxyConfigFingerprint, contextEngineBinding, environmentSelectionFingerprint, hostSystemAgentActive, restrictedToolSurface, restrictedToolSurfaceInheritedMcpServerNames, nativeSkillIsolation, lifecycleTiming, normalizeBindingModelProvider, throwIfAborted, prebuiltPluginThreadConfig, preserveExistingBinding, rotatedContextEngineBinding, replacementPredecessor } = context;
+	const pluginThreadConfig = params.pluginThreadConfig?.enabled ? prebuiltPluginThreadConfig ?? await lifecycleTiming.measure("plugin-config-build", () => params.pluginThreadConfig?.build()) : void 0;
+	const finalConfigPatch = params.buildFinalConfigPatch?.({ action: "start" }) ?? {
+		configPatch: params.finalConfigPatch,
+		nativeHookRelayGeneration: params.nativeHookRelayGeneration
+	};
+	const config = lifecycleTiming.measureSync("merge-thread-config", () => applyCodexNativeSkillIsolation(mergeCodexThreadConfigs(params.config, userMcpServersConfigPatch, pluginThreadConfig?.configPatch, finalConfigPatch.configPatch), nativeSkillIsolation));
+	const startParams = lifecycleTiming.measureSync("thread-start-params", () => buildThreadStartParams(params.params, {
+		cwd: params.cwd,
+		dynamicTools: params.dynamicTools,
+		appServer: params.appServer,
+		developerInstructions: params.developerInstructions,
+		config,
+		nativeCodeModeEnabled: params.nativeCodeModeEnabled,
+		nativeProviderWebSearchSupport: params.nativeProviderWebSearchSupport,
+		nativeCodeModeOnlyEnabled: params.nativeCodeModeOnlyEnabled,
+		webSearchAllowed: params.webSearchAllowed,
+		environmentSelection: params.environmentSelection,
+		model: startModelSelection.model,
+		modelProvider: startModelProvider,
+		hostSystemAgentActive,
+		restrictedToolSurfaceInheritedMcpServerNames,
+		shellEnvironment: params.shellEnvironment,
+		disableLoginShell: params.disableLoginShell
+	}));
+	const requestModelProvider = typeof startParams.modelProvider === "string" && startParams.modelProvider.trim() ? startParams.modelProvider : void 0;
+	const threadStartResponse = await lifecycleTiming.measure("thread-start-request", async () => {
+		try {
+			return await params.client.request("thread/start", startParams, { signal: params.signal });
+		} catch (error) {
+			if (error instanceof CodexAppServerRpcError) throw new CodexThreadStartRequestError(error);
+			throw error;
 		}
+	});
+	const response = assertCodexThreadStartResponse(threadStartResponse);
+	const provisionalAppIds = pluginThreadConfig?.provisionalAppIds;
+	const assertCurrent = () => {
+		throwIfAborted();
+		params.params.hostCapabilities.assertActive();
 	};
-}
-//#endregion
-//#region extensions/codex/src/app-server/thread-lifecycle-preflight.ts
-async function prepareCodexThreadLifecyclePreflight(params) {
-	await assertCodexModelBackedReviewerEffectiveConfig({
-		client: params.client,
-		approvalsReviewer: params.appServer.approvalsReviewer,
-		cwd: params.cwd,
-		signal: params.signal
+	const rejectUncommittedThread = async (cause) => {
+		if (!await discardUnattestedCodexPluginThread({
+			client: params.client,
+			threadId: response.thread.id,
+			ephemeral: startParams.ephemeral === true
+		})) {
+			await (params.abandonClient ?? (() => closeCodexStartupClientBestEffort(params.client)))();
+			throw new CodexAppServerUnsafeSubscriptionError("Codex uncommitted thread cleanup failed", { cause });
+		}
+		throw cause;
+	};
+	try {
+		await attestCodexThreadToolSurface({
+			client: params.client,
+			threadId: response.thread.id,
+			appIds: provisionalAppIds ?? [],
+			signal: params.signal,
+			threadConfig: startParams.config,
+			restrictedToolSurface,
+			lifecycleTiming,
+			assertCurrent
+		});
+		assertCurrent();
+	} catch (error) {
+		return await rejectUncommittedThread(error);
+	}
+	const rolloutPath = resolveCodexThreadRolloutPath(response.thread);
+	const modelProvider = resolveCodexAppServerModelProvider({
+		provider: params.params.provider,
+		authProfileId: params.params.authProfileId,
+		authProfileStore: params.params.authProfileStore,
+		agentDir: params.params.agentDir,
+		config: params.params.config
 	});
-	if (params.nativeHookRelayRequired) await assertCodexNativeHookRelayAllowed(params.client, params.signal);
-	const lifecycleTiming = createCodexThreadLifecycleTimingTracker({
-		...params.timing,
-		enabled: params.timing?.enabled ?? isCodexAppServerProfilerEnabled(params.params.config)
+	const bindingModelProvider = normalizeBindingModelProvider(params.params.authProfileId, response.modelProvider ?? requestModelProvider ?? startModelProvider ?? modelProvider);
+	const nextMcpServersFingerprint = params.mcpServersFingerprintEvaluated === true ? params.mcpServersFingerprint : void 0;
+	if (!preserveExistingBinding) {
+		const nextBinding = {
+			threadId: response.thread.id,
+			...clientId ? { clientId } : {},
+			cwd: params.cwd,
+			...rolloutPath ? { rolloutPath } : {},
+			authProfileId: params.params.authProfileId,
+			agentWorkspaceDeveloperInstructions: params.agentWorkspaceDeveloperInstructions,
+			model: response.model ?? startParams.model ?? params.params.modelId,
+			modelProvider: bindingModelProvider,
+			dynamicToolsFingerprint,
+			dynamicToolsContainDeferred,
+			webSearchThreadConfigFingerprint,
+			nativeSkillIsolationFingerprint,
+			userMcpServersFingerprint,
+			mcpServersFingerprint: nextMcpServersFingerprint,
+			configuredMcpOwnershipVersion: params.configuredMcpOwnershipVersion,
+			ringZeroConfigFingerprint,
+			ringZeroClientInstanceId,
+			nativeToolPolicyRestricted: restrictedToolSurface ? true : void 0,
+			networkProxyProfileName: params.appServer.networkProxy?.profileName,
+			networkProxyConfigFingerprint,
+			nativeHookRelayGeneration: finalConfigPatch.nativeHookRelayGeneration,
+			appServerRuntimeFingerprint: params.appServerRuntimeFingerprint,
+			pluginAppsFingerprint: pluginThreadConfig?.fingerprint,
+			pluginAppsInputFingerprint: pluginThreadConfig?.inputFingerprint,
+			pluginAppPolicyContext: pluginThreadConfig?.policyContext,
+			contextEngine: contextEngineBinding,
+			environmentSelectionFingerprint
+		};
+		const managedSourceHomeId = codexCatalogHomeId(resolveCodexAppServerLocalHomeDir(params.appServer.start, resolveCodexThreadAgentDir(params)));
+		let committed;
+		try {
+			await lifecycleTiming.measure("thread-start-mark-managed", () => markStartedCodexManagedThread(params.bindingStore.managedThreads, {
+				sourceHomeId: managedSourceHomeId,
+				threadId: response.thread.id,
+				...rolloutPath ? { rolloutPath } : {}
+			}));
+			committed = await lifecycleTiming.measure("thread-start-write-binding", () => params.bindingStore.mutate(bindingIdentity, replacementPredecessor ? {
+				kind: "replace-thread",
+				expectedThreadId: replacementPredecessor.threadId,
+				binding: nextBinding
+			} : {
+				kind: "set",
+				if: { kind: "absent" },
+				binding: nextBinding
+			}, assertCurrent));
+		} catch (error) {
+			return await rejectUncommittedThread(error);
+		}
+		if (!committed) return await rejectUncommittedThread(new CodexThreadBindingConflictError(replacementPredecessor?.threadId ?? response.thread.id, "committing a fresh thread"));
+		if (contextEngineBinding) embeddedAgentLog.info("codex app-server wrote context-engine thread binding", {
+			sessionId: params.params.sessionId,
+			sessionKey: params.params.sessionKey,
+			threadId: response.thread.id,
+			engineId: contextEngineBinding.engineId,
+			epoch: contextEngineBinding.projection?.epoch,
+			fingerprint: contextEngineBinding.projection?.fingerprint,
+			action: rotatedContextEngineBinding ? "rotated" : "started"
+		});
+	}
+	lifecycleTiming.mark("thread-ready");
+	lifecycleTiming.logSummary({
+		runId: params.params.runId,
+		sessionId: params.params.sessionId,
+		sessionKey: params.params.sessionKey,
+		threadId: response.thread.id,
+		action: rotatedContextEngineBinding ? "rotated" : "started"
 	});
-	const legacyDynamicToolsFingerprint = lifecycleTiming.measureSync("legacy-dynamic-tools-fingerprint", () => codexLegacyDynamicToolsFingerprint(params.dynamicTools));
-	const dynamicToolsFingerprint = lifecycleTiming.measureSync("dynamic-tools-fingerprint", () => hashCodexAppServerBindingFingerprint(legacyDynamicToolsFingerprint));
-	const dynamicToolsContainDeferred = flattenCodexDynamicToolFunctions(params.dynamicTools).some((tool) => tool.deferLoading === true);
-	const webSearchThreadConfigFingerprint = fingerprintJsonObject(lifecycleTiming.measureSync("web-search-plan", () => resolveCodexWebSearchPlan({
-		config: params.params.config,
-		disableTools: params.params.disableTools,
-		nativeToolSurfaceEnabled: params.nativeCodeModeEnabled,
-		nativeProviderWebSearchSupport: params.nativeProviderWebSearchSupport,
-		webSearchAllowed: params.webSearchAllowed
-	})).threadConfig);
-	const networkProxyConfigFingerprint = params.appServer.networkProxy?.configFingerprint;
-	const contextEngineBinding = lifecycleTiming.measureSync("context-engine-binding", () => buildContextEngineBinding(params.params, params.contextEngineProjection));
-	const userMcpServersConfigPatch = params.userMcpServersEnabled === false ? void 0 : await buildCodexUserMcpServersThreadConfigPatchForRuntime(params.params.config, {
-		agentId: params.agentId ?? params.params.agentId,
-		agentDir: params.params.agentDir,
-		allowLiteralOAuthProjection: params.appServer.connectionClass !== "remote",
-		toolOverrides: params.params.toolOverrides,
-		onServerUnavailable: (serverName, error) => embeddedAgentLog.warn("skipping unavailable MCP OAuth server", {
-			serverName,
-			error: formatErrorMessage(error)
-		})
+	return buildStartedCodexThreadBinding({
+		bindingModelProvider,
+		clientId,
+		context,
+		finalConfigPatch,
+		nextMcpServersFingerprint,
+		params,
+		pluginThreadConfig,
+		response,
+		rolloutPath,
+		startModelProvider: requestModelProvider ?? startModelProvider,
+		startParams,
+		modelProvider
 	});
-	const nativeSkillIsolation = await lifecycleTiming.measure("native-skill-isolation", () => resolveCodexNativeSkillIsolation({
-		client: params.client,
-		codexHome: params.appServer.start.env?.CODEX_HOME,
-		cwd: params.cwd,
-		home: params.appServer.start.env?.HOME,
-		signal: params.signal,
-		userProfile: params.appServer.start.env?.USERPROFILE
-	}));
-	const nativeSkillIsolationFingerprint = nativeSkillIsolation ? fingerprintJsonObject({
-		version: 1,
-		disabledUserSkillPaths: nativeSkillIsolation.disabledUserSkillPaths
-	}) : void 0;
-	const legacyUserMcpServersFingerprint = legacyFingerprintUserMcpServersConfigPatch(userMcpServersConfigPatch);
-	const userMcpServersFingerprint = fingerprintUserMcpServersConfigPatch(userMcpServersConfigPatch);
-	const environmentSelectionFingerprint = fingerprintEnvironmentSelection(params.environmentSelection);
-	const hostSystemAgentActive = params.hostSystemAgentActive ?? isHostScopedAgentToolActive("openclaw");
-	const ringZeroActive = hostSystemAgentActive && isSystemAgentOnlyCodexDynamicToolAllowlist(params.params.toolsAllow);
-	const messageOnlySourceReply = isMessageOnlyCodexSourceReply(params.params);
-	const restrictedToolSurface = ringZeroActive || messageOnlySourceReply || params.params.pluginHarnessToolPolicyRestricted === true;
-	const imageGenerationDenied = params.params.pluginHarnessToolPolicySafeDeniedTools?.includes("image_generate") === true;
-	if (restrictedToolSurface && params.nativeCodeModeEnabled !== false) throw new Error("Codex restricted tool surfaces require native code mode to be disabled");
-	const restrictedToolSurfaceInheritedMcpServerNames = restrictedToolSurface ? await lifecycleTiming.measure("restricted-tool-surface-mcp-config-read", () => readCodexInheritedMcpServerNames(params.client, params.cwd, params.signal)) : [];
-	if (restrictedToolSurface || imageGenerationDenied) await lifecycleTiming.measure("tool-policy-config-requirements-read", () => assertCodexManagedRequirementsDoNotOverrideToolPolicy(params.client, {
-		restrictedToolSurface,
-		additionalDeniedFeatures: imageGenerationDenied ? ["image_generation"] : void 0
-	}, params.signal));
-	const ringZeroConfigFingerprint = ringZeroActive ? fingerprintJsonObject({
-		version: 1,
-		baseInstructions: "",
-		config: buildCodexRingZeroThreadConfigPatch(params.params, true, restrictedToolSurfaceInheritedMcpServerNames)
-	}) : void 0;
-	return {
-		contextEngineBinding,
-		dynamicToolsContainDeferred,
-		dynamicToolsFingerprint,
-		environmentSelectionFingerprint,
-		hostSystemAgentActive,
-		legacyDynamicToolsFingerprint,
-		legacyUserMcpServersFingerprint,
-		lifecycleTiming,
-		nativeSkillIsolation,
-		nativeSkillIsolationFingerprint,
-		networkProxyConfigFingerprint,
-		ringZeroActive,
-		ringZeroClientInstanceId: ringZeroActive ? getCodexAppServerClientInstanceId(params.client) : void 0,
-		ringZeroConfigFingerprint,
-		restrictedToolSurface,
-		restrictedToolSurfaceInheritedMcpServerNames,
-		userMcpServersConfigPatch,
-		userMcpServersFingerprint,
-		webSearchThreadConfigFingerprint
-	};
 }
 //#endregion
 //#region extensions/codex/src/app-server/thread-lifecycle-warm.ts
@@ -3973,66 +3961,150 @@ function throwIfCodexThreadLifecycleAborted(signal) {
 async function releaseCodexConsumedLiveThread(options) {
 	if (await options.lifecycleTiming.measure("retained-thread-unsubscribe", () => unsubscribeCodexThreadBestEffort(options.client, {
 		threadId: options.threadId,
-		timeoutMs: 5e3
+		timeoutMs: 5e3,
+		assertCurrent: options.assertCurrent
 	}))) return;
+	return await abandonCodexLiveThreadRelease(options, options.cause);
+}
+async function abandonCodexLiveThreadRelease(options, cause) {
+	options.assertCurrent?.();
 	await (options.abandonClient ?? (() => closeCodexStartupClientBestEffort(options.client)))();
-	throw new CodexAppServerUnsafeSubscriptionError(`Codex retained thread subscription could not be released: ${options.threadId}`, options.cause !== void 0 ? { cause: options.cause } : void 0);
+	throw new CodexAppServerUnsafeSubscriptionError(`Codex retained thread subscription could not be released: ${options.threadId}`, cause !== void 0 ? { cause } : void 0);
 }
-/** Transfers retained-slot ownership before unconditionally releasing it. */
+/** Releases through the retained owner, preserving its guarded callback and rollback. */
 async function releaseCodexRetainedLiveThread(options) {
-	if (await consumeCodexAppServerLiveThread(options.client, options.threadId)) await releaseCodexConsumedLiveThread(options);
+	try {
+		return await options.lifecycleTiming.measure("retained-thread-unsubscribe", () => releaseCodexAppServerLiveThread(options.client, options.threadId, options.assertCurrent));
+	} catch (error) {
+		if (isCodexAppServerUnsafeSubscriptionError(error)) throw error;
+		return await abandonCodexLiveThreadRelease(options, error);
+	}
+}
+/** Release follows the physical owner across connection rotation, never a copied thread id. */
+async function releaseCodexBoundLiveThread(options) {
+	const changedClient = options.ownerClientId && options.ownerClientId !== options.clientId;
+	const previous = changedClient ? retainSharedCodexAppServerClientByInstanceId(options.ownerClientId) : void 0;
+	if (changedClient && !previous) return false;
+	try {
+		const client = previous?.client ?? options.client;
+		const assertPrevious = previous && options.assertCurrent ? captureCodexAppServerClientLifetime(client, "connection") : void 0;
+		if (isCodexAppServerLiveThreadClaimed(client, options.threadId)) throw new Error(`Codex thread ${options.threadId} is claimed by active work; stop it first.`);
+		return await releaseCodexRetainedLiveThread({
+			...options,
+			client,
+			abandonClient: previous ? void 0 : options.abandonClient,
+			assertCurrent: options.assertCurrent ? () => {
+				options.assertCurrent?.();
+				assertPrevious?.();
+			} : void 0
+		});
+	} finally {
+		previous?.release();
+	}
 }
 /** Reuses one safely owned, fully matching subscription on its original client. */
 async function tryReuseCodexLiveThread(options) {
-	const { params, binding, bindingIdentity, clientId, dynamicToolsFingerprint, environmentSelectionFingerprint, hostSystemAgentActive, lifecycleTiming, nativeSkillIsolation, releaseConsumedThread, ringZeroActive, restrictedToolSurfaceInheritedMcpServerNames, startModelProvider, startModelSelection, throwIfAborted, userMcpServersConfigPatch } = options;
-	if (!binding.clientId || binding.clientId !== clientId || binding.preserveNativeModel === true || binding.connectionScope === "supervision" || ringZeroActive) return {};
-	const prebuiltFinalConfigPatch = params.buildFinalConfigPatch?.({
-		action: "resume",
-		binding
-	}) ?? {
-		configPatch: params.finalConfigPatch,
-		nativeHookRelayGeneration: params.nativeHookRelayGeneration
-	};
-	const pluginAppsConfigPatch = params.pluginThreadConfig?.enabled && binding.pluginAppPolicyContext ? buildCodexPluginAppsConfigPatchFromPolicyContext(binding.pluginAppPolicyContext) : void 0;
-	const resumeAuthProfileId = params.params.authProfileId ?? binding.authProfileId;
-	const resumeConfig = mergeCodexThreadConfigs(params.config, userMcpServersConfigPatch, pluginAppsConfigPatch, prebuiltFinalConfigPatch.configPatch);
-	const resumeParams = lifecycleTiming.measureSync("warm-thread-resume-params", () => buildThreadResumeParams(params.params, {
-		threadId: binding.threadId,
-		cwd: params.cwd,
-		authProfileId: resumeAuthProfileId,
-		model: startModelSelection.model,
-		modelProvider: startModelProvider,
-		preserveNativeModel: false,
-		appServer: params.appServer,
-		dynamicTools: params.dynamicTools,
-		developerInstructions: params.developerInstructions,
-		config: applyCodexNativeSkillIsolation(resumeConfig, nativeSkillIsolation),
-		nativeCodeModeEnabled: params.nativeCodeModeEnabled,
-		nativeProviderWebSearchSupport: params.nativeProviderWebSearchSupport,
-		nativeCodeModeOnlyEnabled: params.nativeCodeModeOnlyEnabled,
-		webSearchAllowed: params.webSearchAllowed,
-		hostSystemAgentActive,
-		restrictedToolSurfaceInheritedMcpServerNames,
-		shellEnvironment: params.shellEnvironment,
-		disableLoginShell: params.disableLoginShell
-	}));
-	const liveThreadConfigFingerprint = fingerprintCodexThreadConfig({
-		...resumeParams,
-		model: binding.model ?? resumeParams.model ?? null,
-		requestedModel: resumeParams.model ?? null,
-		modelProvider: binding.modelProvider ?? resumeParams.modelProvider ?? null,
-		requestedModelProvider: resumeParams.modelProvider ?? binding.modelProvider ?? null
-	}, resumeAuthProfileId, dynamicToolsFingerprint);
-	const retainedThread = await consumeCodexAppServerLiveThread(params.client, binding.threadId, liveThreadConfigFingerprint);
-	if (!retainedThread) {
-		const incompatibleOwnership = await consumeCodexAppServerLiveThread(params.client, binding.threadId);
-		if (incompatibleOwnership) await incompatibleOwnership.release(binding.threadId);
-		return { prebuiltFinalConfigPatch };
+	const { params, binding, bindingIdentity, clientId, dynamicToolsFingerprint, environmentSelectionFingerprint, hostSystemAgentActive, lifecycleTiming, nativeSkillIsolation, ringZeroActive, restrictedToolSurface, restrictedToolSurfaceInheritedMcpServerNames, startModelProvider, startModelSelection, throwIfAborted, userMcpServersConfigPatch } = options;
+	const incognito = isIncognitoSessionKey(params.params.sessionKey);
+	if (incognito && (binding.preserveNativeModel || binding.connectionScope === "supervision")) {
+		if (binding.clientId === clientId && binding.clientId && ((await options.buildLoadedPluginThreadConfig(binding))?.fingerprint ?? binding.pluginAppsFingerprint) === binding.pluginAppsFingerprint) {
+			params.buildFinalConfigPatch?.({
+				action: "resume",
+				binding
+			});
+			throwIfAborted();
+			return {
+				kind: "ready",
+				binding: {
+					...binding,
+					lifecycle: { action: "resumed" }
+				}
+			};
+		}
+		return { kind: "rotate" };
 	}
+	if (!binding.clientId || binding.clientId !== clientId || binding.preserveNativeModel === true || binding.connectionScope === "supervision" || ringZeroActive && !incognito) return { kind: "resume" };
+	const retainedThread = await consumeCodexAppServerLiveThread(params.client, binding.threadId);
+	if (!retainedThread) return { kind: "resume" };
+	const assertWarmOwner = () => {
+		throwIfAborted();
+		if (!isCodexAppServerClientRuntimeLive(params.client)) throw params.client.getCloseError() ?? /* @__PURE__ */ new Error("codex app-server client is closed");
+		try {
+			retainedThread.assertCurrent();
+			params.params.hostCapabilities.assertActive();
+		} catch (cause) {
+			throw new AgentHarnessPreflightError("Codex warm thread ownership changed before this turn could run. No turn was sent; reconnect before continuing, or start a new conversation if the original thread was closed.", { cause });
+		}
+	};
+	let ownershipTransferred = false;
+	let preserveSubscription = false;
 	try {
+		assertWarmOwner();
+		const pluginThreadConfig = await options.buildLoadedPluginThreadConfig(binding);
+		assertWarmOwner();
+		if (pluginThreadConfig && pluginThreadConfig.fingerprint !== binding.pluginAppsFingerprint) return { kind: "rotate" };
+		const prebuiltFinalConfigPatch = params.buildFinalConfigPatch?.({
+			action: "resume",
+			binding
+		}) ?? {
+			configPatch: params.finalConfigPatch,
+			nativeHookRelayGeneration: params.nativeHookRelayGeneration
+		};
+		const pluginAppsConfigPatch = pluginThreadConfig?.configPatch ?? (params.pluginThreadConfig?.enabled && binding.pluginAppPolicyContext ? buildCodexPluginAppsConfigPatchFromPolicyContext(binding.pluginAppPolicyContext) : void 0);
+		const resumeAuthProfileId = params.params.authProfileId ?? binding.authProfileId;
+		const resumeConfig = mergeCodexThreadConfigs(params.config, userMcpServersConfigPatch, pluginAppsConfigPatch, prebuiltFinalConfigPatch.configPatch);
+		const resumeParams = lifecycleTiming.measureSync("warm-thread-resume-params", () => buildThreadResumeParams(params.params, {
+			threadId: binding.threadId,
+			cwd: params.cwd,
+			authProfileId: resumeAuthProfileId,
+			model: startModelSelection.model,
+			modelProvider: startModelProvider,
+			preserveNativeModel: false,
+			appServer: params.appServer,
+			dynamicTools: params.dynamicTools,
+			developerInstructions: params.developerInstructions,
+			config: applyCodexNativeSkillIsolation(resumeConfig, nativeSkillIsolation),
+			nativeCodeModeEnabled: params.nativeCodeModeEnabled,
+			nativeProviderWebSearchSupport: params.nativeProviderWebSearchSupport,
+			nativeCodeModeOnlyEnabled: params.nativeCodeModeOnlyEnabled,
+			webSearchAllowed: params.webSearchAllowed,
+			hostSystemAgentActive,
+			restrictedToolSurfaceInheritedMcpServerNames,
+			shellEnvironment: params.shellEnvironment,
+			disableLoginShell: params.disableLoginShell
+		}));
+		const liveThreadConfigFingerprint = incognito ? retainedThread.configFingerprint : fingerprintCodexThreadConfig({
+			...resumeParams,
+			model: binding.model ?? resumeParams.model ?? null,
+			requestedModel: resumeParams.model ?? null,
+			modelProvider: binding.modelProvider ?? resumeParams.modelProvider ?? null,
+			requestedModelProvider: resumeParams.modelProvider ?? binding.modelProvider ?? null
+		}, resumeAuthProfileId, dynamicToolsFingerprint);
+		if (incognito && retainedThread.ephemeralPolicy !== resumeParams.developerInstructions) {
+			preserveSubscription = true;
+			throw new CodexIncognitoPolicyChangeError();
+		}
+		if (!incognito && retainedThread.configFingerprint !== liveThreadConfigFingerprint) {
+			preserveSubscription = true;
+			return {
+				kind: "resume",
+				prebuiltFinalConfigPatch
+			};
+		}
+		await attestCodexThreadToolSurface({
+			client: params.client,
+			threadId: binding.threadId,
+			appIds: pluginThreadConfig?.provisionalAppIds ?? [],
+			signal: params.signal,
+			threadConfig: resumeParams.config,
+			restrictedToolSurface,
+			lifecycleTiming,
+			assertCurrent: assertWarmOwner
+		});
+		assertWarmOwner();
 		const nativeHookRelayGeneration = prebuiltFinalConfigPatch.nativeHookRelayGeneration ?? binding.nativeHookRelayGeneration;
 		const model = startModelSelection.model;
-		if (!await lifecycleTiming.measure("warm-thread-write-binding", () => params.bindingStore.mutate(bindingIdentity, {
+		if (!(incognito || await lifecycleTiming.measure("warm-thread-write-binding", () => params.bindingStore.mutate(bindingIdentity, {
 			kind: "patch",
 			threadId: binding.threadId,
 			patch: {
@@ -4041,8 +4113,8 @@ async function tryReuseCodexLiveThread(options) {
 				nativeHookRelayGeneration,
 				environmentSelectionFingerprint
 			}
-		}))) throw new CodexThreadBindingConflictError(binding.threadId, "committing a reused thread");
-		throwIfAborted();
+		}, assertWarmOwner)))) throw new CodexThreadBindingConflictError(binding.threadId, "committing a reused thread");
+		assertWarmOwner();
 		lifecycleTiming.mark("thread-ready");
 		lifecycleTiming.logSummary({
 			runId: params.params.runId,
@@ -4051,25 +4123,188 @@ async function tryReuseCodexLiveThread(options) {
 			threadId: binding.threadId,
 			action: "resumed"
 		});
+		ownershipTransferred = true;
 		return {
+			kind: "ready",
 			binding: {
 				...binding,
-				cwd: params.cwd,
-				model,
-				nativeHookRelayGeneration,
-				environmentSelectionFingerprint,
+				...!incognito ? {
+					cwd: params.cwd,
+					model,
+					nativeHookRelayGeneration,
+					environmentSelectionFingerprint
+				} : {},
 				liveThreadConfigFingerprint,
+				liveThreadEphemeralPolicy: retainedThread.ephemeralPolicy,
 				liveThreadOwnership: retainedThread,
-				...retainedThread.serviceTier && resumeParams.serviceTier === void 0 ? { clearInheritedServiceTier: true } : {},
+				...!incognito && retainedThread.serviceTier && resumeParams.serviceTier === void 0 ? { clearInheritedServiceTier: true } : {},
 				lifecycle: { action: "resumed" }
-			},
-			prebuiltFinalConfigPatch
+			}
+		};
+	} finally {
+		if (!ownershipTransferred) {
+			let failure;
+			try {
+				if (preserveSubscription) {
+					if (!await retainCodexAppServerBindingSubscription(params.client, binding.threadId, retainedThread)) failure = { cause: /* @__PURE__ */ new Error("Codex live thread ownership could not be returned to its session") };
+				} else await retainedThread.release(binding.threadId);
+			} catch (cause) {
+				failure = { cause };
+			}
+			if (failure) await abandonCodexLiveThreadRelease({
+				client: params.client,
+				abandonClient: params.abandonClient,
+				lifecycleTiming,
+				threadId: binding.threadId
+			}, failure.cause);
+		}
+	}
+}
+//#endregion
+//#region extensions/codex/src/app-server/thread-lifecycle-adoption.ts
+/** Passive refusal must precede releasing or acquiring any native subscription. */
+async function assertAdoptedCodexThreadResumeAllowed(params, threadId, context) {
+	const { thread } = await context.lifecycleTiming.measure("thread-read-adoption-status", () => params.client.request("thread/read", {
+		threadId,
+		includeTurns: false
+	}, { signal: params.signal }));
+	context.throwIfAborted();
+	assertCodexThreadAcceptsDirectInput(thread);
+	if (thread.status?.type === "active") throw new CodexAdoptedThreadActiveError();
+	if (thread.id !== threadId) throw new Error("Codex returned another thread during adoption status read");
+	return thread;
+}
+/** All bound preparation follows attach's native-queue-before-binding-lease order. */
+async function withCodexThreadLifecycleBinding(params, run) {
+	const identity = sessionBindingIdentity({
+		sessionId: params.params.sessionId,
+		sessionKey: params.params.sessionKey,
+		agentId: params.agentId ?? params.params.agentId,
+		config: params.params.config
+	});
+	const snapshot = await params.bindingStore.read(identity);
+	const runWithLease = () => params.bindingStore.withLease(identity, async () => {
+		const binding = await params.bindingStore.read(identity);
+		if (binding?.threadId !== snapshot?.threadId || binding?.clientId !== snapshot?.clientId) throw new CodexThreadBindingConflictError(binding?.threadId ?? snapshot?.threadId ?? params.params.sessionId, "acquiring thread lifecycle ownership");
+		params.params.hostCapabilities.assertActive();
+		params.signal?.throwIfAborted();
+		return await run(identity, binding);
+	});
+	return snapshot?.pendingResumeConfiguration ? await withExclusiveCodexAppServerThread({
+		bindingStore: params.bindingStore,
+		identity,
+		threadId: snapshot.threadId,
+		run: runWithLease
+	}) : snapshot ? await withCodexAppServerThreadMutation(snapshot.threadId, runWithLease) : await runWithLease();
+}
+/** Completes manual attachment only under the native queue and exact binding lease. */
+async function resumePendingCodexThread(params, context) {
+	const { binding, contextEngineBinding, lifecycleTiming, restrictedToolSurface } = context;
+	if (isIncognitoSessionKey(params.params.sessionKey) || context.transientRestriction || !restrictedToolSurface && binding.nativeToolPolicyRestricted === true || (contextEngineBinding ? !isContextEngineBindingCompatible(binding.contextEngine, contextEngineBinding) : binding.contextEngine !== void 0) || shouldRotateCodexGpt56MultiAgentBinding({
+		bindingModel: binding.model,
+		requestedModel: params.params.modelId
+	})) throw new Error(`Cannot configure resumed Codex thread ${binding.threadId} under a transient or incompatible session policy. The thread is preserved; retry from its normal session or use /new for the current policy.`);
+	const prebuiltPluginThreadConfig = params.pluginThreadConfig?.enabled ? await lifecycleTiming.measure("plugin-config-build", () => params.pluginThreadConfig?.build()) : void 0;
+	const clientId = resolveCodexAppServerClientInstanceId(params.client);
+	const configuration = await preparePendingCodexThreadResume(params, binding, context.dynamicToolsFingerprint, async (assertCurrent) => {
+		const released = await context.releaseRetainedThread(binding.threadId, assertCurrent);
+		assertCurrent();
+		if (!released || binding.clientId && binding.clientId !== clientId) await releaseCodexConsumedLiveThread({
+			client: params.client,
+			abandonClient: params.abandonClient,
+			lifecycleTiming,
+			threadId: binding.threadId,
+			assertCurrent
+		});
+	});
+	try {
+		const resumed = await resumeExistingCodexThread(params, {
+			...context,
+			prebuiltPluginThreadConfig,
+			assertResumeConfiguration: configuration.assertConfigured,
+			assertResumeOwnership: configuration.assertCurrent
+		});
+		if (!resumed) throw new Error(`Codex did not configure resumed thread ${binding.threadId}.`);
+		return resumed;
+	} finally {
+		configuration.dispose();
+	}
+}
+/** Manual attachment is intent, never evidence that loaded native overrides took effect. */
+async function preparePendingCodexThreadResume(params, binding, dynamicToolsFingerprint, releaseSubscription) {
+	const fail = (reason) => /* @__PURE__ */ new Error(`Cannot configure resumed Codex thread ${binding.threadId}: ${reason}. The thread is preserved; continue it in native Codex or use /new for the current OpenClaw tools.`);
+	const agentDir = resolveCodexThreadAgentDir(params);
+	const localHome = resolveCodexAppServerLocalHomeDir(params.appServer.start, agentDir);
+	if (params.appServer.start.transport !== "stdio" || params.appServer.start.homeScope === "user" || path.resolve(localHome) !== resolveCodexAppServerHomeDir(agentDir) || binding.connectionScope === "supervision" || binding.preserveNativeModel === true) throw fail("configuration adoption requires an OpenClaw-owned local Codex home");
+	if (isCodexAppServerLiveThreadClaimed(params.client, binding.threadId)) throw fail("the thread is claimed by active work; stop that run before resuming");
+	const assertClient = captureCodexAppServerClientLifetime(params.client, "native-process");
+	const assertCurrent = () => {
+		params.params.hostCapabilities.assertActive();
+		params.signal?.throwIfAborted();
+		assertClient();
+		if (isCodexAppServerLiveThreadClaimed(params.client, binding.threadId)) throw new CodexAdoptedThreadActiveError();
+	};
+	assertCurrent();
+	const { thread } = await params.client.request("thread/read", {
+		threadId: binding.threadId,
+		includeTurns: false
+	}, { signal: params.signal });
+	assertCurrent();
+	const statusType = thread.status?.type;
+	if (thread.id !== binding.threadId || statusType !== "idle" && statusType !== "notLoaded") throw fail("the native thread is not idle; wait for its current run to finish");
+	assertCodexThreadAcceptsDirectInput(thread);
+	const observation = observeCodexThreadConfiguration(params, thread, assertCurrent);
+	const dispose = observation.dispose;
+	try {
+		const rolloutPath = thread.path ?? binding.rolloutPath;
+		const metadata = rolloutPath ? await readCodexSessionMeta(path.join(localHome, "sessions"), rolloutPath, binding.threadId) : void 0;
+		if (!metadata) throw fail("its native tool catalog could not be read from the selected Codex home");
+		const recordedTools = metadata.dynamic_tools ?? [];
+		if (!Array.isArray(recordedTools) || codexDynamicToolsFingerprint(recordedTools) !== dynamicToolsFingerprint) throw fail("its immutable native tool catalog does not match the current OpenClaw tools");
+		assertCurrent();
+		await releaseSubscription(assertCurrent);
+		assertCurrent();
+		return {
+			assertConfigured: observation.assertConfigured,
+			assertCurrent,
+			dispose
 		};
 	} catch (error) {
-		await releaseConsumedThread(binding.threadId, error);
+		dispose();
 		throw error;
 	}
 }
+/** Observe teardown before release; a successful resume alone can acknowledge ignored overrides. */
+async function prepareCodexThreadResume(params, binding, context) {
+	const assertClient = captureCodexAppServerClientLifetime(params.client, binding.connectionScope === "supervision" ? "connection" : "native-process");
+	const assertCurrent = () => {
+		params.params.hostCapabilities.assertActive();
+		params.signal?.throwIfAborted();
+		assertClient();
+		if (isCodexAppServerLiveThreadClaimed(params.client, binding.threadId)) throw new CodexAdoptedThreadActiveError();
+	};
+	assertCurrent();
+	const thread = await assertAdoptedCodexThreadResumeAllowed(params, binding.threadId, context);
+	assertCurrent();
+	assertCodexSupervisionThreadLineage(binding, thread);
+	return {
+		...observeCodexThreadConfiguration(params, thread, assertCurrent),
+		assertCurrent
+	};
+}
+function observeCodexThreadConfiguration(params, thread, assertCurrent) {
+	if (thread.status?.type !== "idle" && thread.status?.type !== "notLoaded") throw new CodexAdoptedThreadActiveError();
+	let unloaded = thread.status.type === "notLoaded";
+	return {
+		dispose: params.client.addNotificationHandler((notification) => {
+			if (notification.method === "thread/status/changed" && isJsonObject(notification.params) && notification.params.threadId === thread.id && isJsonObject(notification.params.status) && notification.params.status.type === "notLoaded") unloaded = true;
+		}),
+		assertConfigured: () => {
+			assertCurrent();
+			if (!unloaded) throw new Error("Codex did not confirm unloading its previous configuration. The thread is preserved; stop competing native work and reconnect before retrying.");
+		}
+	};
+}
 //#endregion
 //#region extensions/codex/src/app-server/thread-supervision.ts
 async function materializePendingSupervisionBranch(params) {
@@ -4094,6 +4329,32 @@ async function materializePendingSupervisionBranch(params) {
 	});
 	let bindingCommitted = false;
 	let provisionalCleanupSafe = true;
+	let cleanupExpected = pending;
+	const trackPendingSupervisionArtifacts = async (cleanupThreadIds) => {
+		const expected = pending;
+		pending = withPendingSupervisionCleanup(pending, cleanupThreadIds);
+		let updated;
+		try {
+			updated = await params.bindingStore.mutate(params.bindingIdentity, {
+				kind: "patch-pending-supervision-branch",
+				expected,
+				pending
+			});
+		} catch (error) {
+			try {
+				const current = await params.bindingStore.read(params.bindingIdentity);
+				if (matchesPendingSupervisionState(current, pending)) cleanupExpected = pending;
+				else if (matchesPendingSupervisionState(current, expected)) cleanupExpected = expected;
+				else throw new CodexThreadBindingConflictError(pending.sourceThreadId, "verifying supervised Codex cleanup tracking");
+			} catch (verificationError) {
+				provisionalCleanupSafe = false;
+				throw new CodexAppServerUnsafeSubscriptionError(`Codex supervised branch cleanup tracking could not be verified: ${cleanupThreadIds.join(", ")}`, { cause: new AggregateError([error, verificationError], void 0, { cause: error }) });
+			}
+			throw error;
+		}
+		cleanupExpected = updated ? pending : void 0;
+		if (!updated) throw new CodexThreadBindingConflictError(pending.sourceThreadId, "tracking supervised Codex branch cleanup");
+	};
 	try {
 		const probeParams = buildPendingSupervisionProbeForkParams(params, pending);
 		const rawProbeResponse = await params.lifecycleTiming.measure("supervision-model-probe-fork", async () => {
@@ -4109,10 +4370,17 @@ async function materializePendingSupervisionBranch(params) {
 			sourceThreadId: pending.sourceThreadId,
 			role: "model probe"
 		});
-		pending = await trackPendingSupervisionArtifacts(params, pending, [probeThreadId]);
+		let probeResponse;
+		try {
+			params.throwIfAborted();
+			probeResponse = assertCodexThreadForkResponse(rawProbeResponse);
+			if (params.restrictedToolSurface) await params.lifecycleTiming.measure("restricted-tool-surface-mcp-attestation", () => attestCodexRestrictedToolSurfaceMcpServersDisabled(params.client, probeThreadId, probeParams.config ?? void 0, params.signal));
+		} finally {
+			await unsubscribeCodexAppServerLiveThread(params.client, probeThreadId, CODEX_APP_SERVER_UNSUBSCRIBE_TIMEOUT_MS).catch((cause) => {
+				throw new CodexAppServerUnsafeSubscriptionError(`Codex model probe subscription could not be released: ${probeThreadId}`, { cause });
+			});
+		}
 		params.throwIfAborted();
-		const probeResponse = assertCodexThreadForkResponse(rawProbeResponse);
-		if (params.restrictedToolSurface) await params.lifecycleTiming.measure("restricted-tool-surface-mcp-attestation", () => attestCodexRestrictedToolSurfaceMcpServersDisabled(params.client, probeThreadId, probeParams.config ?? void 0, params.signal));
 		const nativeModel = requireNonBlankSupervisionValue(probeResponse.model, "native model");
 		const nativeModelProvider = requireNativeSupervisionModelProvider({
 			responseModelProvider: probeResponse.modelProvider,
@@ -4158,7 +4426,7 @@ async function materializePendingSupervisionBranch(params) {
 			otherThreadId: probeThreadId,
 			role: "canonical branch"
 		});
-		pending = await trackPendingSupervisionArtifacts(params, pending, [probeThreadId, finalThreadId]);
+		await trackPendingSupervisionArtifacts([finalThreadId]);
 		params.throwIfAborted();
 		assertExactSupervisionModelSelection(assertCodexThreadStartResponse(rawStartResponse), {
 			model: nativeModel,
@@ -4178,11 +4446,11 @@ async function materializePendingSupervisionBranch(params) {
 				client: params.client,
 				threadId: finalThreadId,
 				ephemeral: startParams.ephemeral === true
-			}) || !await archiveSupervisionArtifact(params.client, probeThreadId)) {
+			})) {
 				provisionalCleanupSafe = false;
 				throw new CodexAppServerUnsafeSubscriptionError("Codex supervised plugin app attestation cleanup failed", { cause: error });
 			}
-			pending = await trackPendingSupervisionArtifacts(params, pending, []);
+			await trackPendingSupervisionArtifacts([]);
 			throw error;
 		}
 		if (history.responseItems.length > 0) {
@@ -4192,8 +4460,6 @@ async function materializePendingSupervisionBranch(params) {
 			}, { signal: params.signal }));
 			params.throwIfAborted();
 		}
-		if (!await archiveSupervisionArtifact(params.client, probeThreadId)) throw new Error(`Failed to archive temporary Codex model probe: ${probeThreadId}`);
-		pending = await trackPendingSupervisionArtifacts(params, pending, [finalThreadId]);
 		const historyCoveredThrough = (/* @__PURE__ */ new Date()).toISOString();
 		const bindingModelProvider = params.normalizeBindingModelProvider(params.attempt.authProfileId, nativeModelProvider);
 		let committed = false;
@@ -4255,31 +4521,28 @@ async function materializePendingSupervisionBranch(params) {
 		};
 	} catch (error) {
 		if (bindingCommitted) throw error;
-		if (error instanceof CodexThreadBindingConflictAfterCleanupError) throw error;
 		if (!provisionalCleanupSafe) {
 			await params.abandonClient();
 			throw error;
 		}
 		const cleanup = await cleanPendingSupervisionArtifacts(params.client, pending);
+		const nextPending = withPendingSupervisionCleanup(pending, cleanup.remaining);
 		let cleanupStateError;
-		if (cleanup.remaining.length !== (pending.cleanupThreadIds?.length ?? 0)) {
-			const nextPending = withPendingSupervisionCleanup(pending, cleanup.remaining);
-			try {
-				if (await params.bindingStore.mutate(params.bindingIdentity, {
-					kind: "patch-pending-supervision-branch",
-					expected: pending,
-					pending: nextPending
-				})) pending = nextPending;
-			} catch (stateError) {
-				cleanupStateError = stateError;
-			}
+		if (cleanupExpected && !isDeepStrictEqual(cleanupExpected, nextPending)) try {
+			await params.bindingStore.mutate(params.bindingIdentity, {
+				kind: "patch-pending-supervision-branch",
+				expected: cleanupExpected,
+				pending: nextPending
+			});
+		} catch (stateError) {
+			cleanupStateError = stateError;
 		}
 		const unsafeCleanup = cleanup.remaining.length > 0 || isCodexAppServerUnsafeSubscriptionError(error);
 		if (unsafeCleanup) await params.abandonClient();
 		if (cleanupStateError) {
-			const cause = new AggregateError([error, cleanupStateError]);
+			const cause = new AggregateError([error, cleanupStateError], "Codex supervised branch cleanup state could not be recorded", { cause: error });
 			if (unsafeCleanup) throw new CodexAppServerUnsafeSubscriptionError("Codex supervised branch cleanup state could not be recorded", { cause });
-			throw new AggregateError([error, cleanupStateError], "Codex supervised branch cleanup state could not be recorded", { cause: error });
+			throw cause;
 		}
 		if (cleanup.remaining.length > 0) throw new CodexAppServerUnsafeSubscriptionError(`Codex supervised branch cleanup remains pending: ${cleanup.remaining.join(", ")}`, { cause: error });
 		throw error;
@@ -4307,7 +4570,7 @@ function buildPendingSupervisionProbeForkParams(params, pending) {
 		...params.appServer.serviceTier !== void 0 ? { serviceTier: params.appServer.serviceTier } : {},
 		config: runtimeConfig,
 		developerInstructions: params.developerInstructions ?? buildDeveloperInstructions(params.attempt, { dynamicTools: params.dynamicTools }),
-		ephemeral: isIncognitoSessionKey(params.attempt.sessionKey),
+		ephemeral: true,
 		threadSource: "appServer",
 		excludeTurns: true
 	};
@@ -4349,10 +4612,8 @@ function requireDistinctSupervisionThreadId(params) {
 	return threadId;
 }
 function readSupervisionResponseThreadId(value) {
-	if (!value || typeof value !== "object" || Array.isArray(value)) return;
-	const thread = value.thread;
-	if (!thread || typeof thread !== "object" || Array.isArray(thread)) return;
-	return thread.id;
+	const thread = isRecord(value) ? value.thread : void 0;
+	return isRecord(thread) ? thread.id : void 0;
 }
 async function recoverPendingSupervisionArtifacts(params, pending) {
 	if (!pending.cleanupThreadIds?.length) return pending;
@@ -4375,20 +4636,6 @@ async function recoverPendingSupervisionArtifacts(params, pending) {
 	})) throw new CodexThreadBindingConflictError(pending.sourceThreadId, "recovering a supervised Codex branch");
 	return next;
 }
-async function trackPendingSupervisionArtifacts(params, pending, cleanupThreadIds) {
-	const next = withPendingSupervisionCleanup(pending, cleanupThreadIds);
-	if (!await params.bindingStore.mutate(params.bindingIdentity, {
-		kind: "patch-pending-supervision-branch",
-		expected: pending,
-		pending: next
-	})) {
-		const cleanupFailed = [];
-		for (const threadId of cleanupThreadIds) if (!await archiveSupervisionArtifact(params.client, threadId)) cleanupFailed.push(threadId);
-		if (cleanupFailed.length > 0) throw new CodexAppServerUnsafeSubscriptionError(`Codex supervised branch CAS cleanup failed: ${cleanupFailed.join(", ")}`);
-		throw new CodexThreadBindingConflictAfterCleanupError(pending.sourceThreadId, "tracking supervised Codex branch cleanup");
-	}
-	return next;
-}
 function withPendingSupervisionCleanup(pending, cleanupThreadIds) {
 	return {
 		sourceThreadId: pending.sourceThreadId,
@@ -4425,15 +4672,23 @@ async function archiveSupervisionArtifact(client, threadId) {
 async function startOrResumeThread(params) {
 	const incognito = isIncognitoSessionKey(params.params.sessionKey);
 	const clientId = resolveCodexAppServerClientInstanceId(params.client);
-	const bindingIdentity = sessionBindingIdentity({
-		sessionId: params.params.sessionId,
-		sessionKey: params.params.sessionKey,
-		agentId: params.agentId ?? params.params.agentId,
-		config: params.params.config
-	});
-	return await params.bindingStore.withLease(bindingIdentity, async () => {
-		const { contextEngineBinding, dynamicToolsContainDeferred, dynamicToolsFingerprint, environmentSelectionFingerprint, hostSystemAgentActive, legacyDynamicToolsFingerprint, legacyUserMcpServersFingerprint, lifecycleTiming, nativeSkillIsolation, nativeSkillIsolationFingerprint, networkProxyConfigFingerprint, ringZeroActive, ringZeroClientInstanceId, ringZeroConfigFingerprint, restrictedToolSurface, restrictedToolSurfaceInheritedMcpServerNames, userMcpServersConfigPatch, userMcpServersFingerprint, webSearchThreadConfigFingerprint } = await prepareCodexThreadLifecyclePreflight(params);
-		let binding = await lifecycleTiming.measure("read-binding", () => params.bindingStore.read(bindingIdentity));
+	return await withCodexThreadLifecycleBinding(params, async (bindingIdentity, currentBinding) => {
+		let binding = currentBinding;
+		if (hasCodexNativeToolCatalog(binding)) {
+			const nativeCatalog = await loadCodexNativeToolCatalog({
+				client: params.client,
+				binding,
+				appServer: params.appServer,
+				agentDir: resolveCodexThreadAgentDir(params),
+				assertCurrent: () => {
+					params.signal?.throwIfAborted();
+					params.params.hostCapabilities.assertActive();
+				}
+			});
+			if (!isDeepStrictEqual(params.dynamicTools, nativeCatalog)) throw new Error("Canonical Codex declarations changed after tool preparation; retry the turn on its preserved native thread.");
+		}
+		const preflight = await prepareCodexThreadLifecyclePreflight(params);
+		const { contextEngineBinding, dynamicToolsContainDeferred, dynamicToolsFingerprint, environmentSelectionFingerprint, hostSystemAgentActive, legacyDynamicToolsFingerprint, legacyUserMcpServersFingerprint, lifecycleTiming, nativeSkillIsolation, nativeSkillIsolationFingerprint, networkProxyConfigFingerprint, ringZeroActive, ringZeroClientInstanceId, ringZeroConfigFingerprint, restrictedToolSurface, restrictedToolSurfaceInheritedMcpServerNames, userMcpServersConfigPatch, userMcpServersFingerprint, webSearchThreadConfigFingerprint } = preflight;
 		let replacementPredecessor;
 		const initialBoundThreadId = binding?.threadId;
 		const initialBoundClientId = binding?.clientId;
@@ -4445,28 +4700,15 @@ async function startOrResumeThread(params) {
 			config: params.params.config
 		});
 		const throwIfAborted = () => throwIfCodexThreadLifecycleAborted(params.signal);
-		const releaseRetainedThread = async (threadId, ownerClientId = initialBoundClientId) => {
-			if (ownerClientId && ownerClientId !== clientId) {
-				const previousClient = retainSharedCodexAppServerClientByInstanceId(ownerClientId);
-				if (!previousClient) return;
-				try {
-					await releaseCodexRetainedLiveThread({
-						client: previousClient.client,
-						lifecycleTiming,
-						threadId
-					});
-				} finally {
-					previousClient.release();
-				}
-				return;
-			}
-			await releaseCodexRetainedLiveThread({
-				client: params.client,
-				abandonClient: params.abandonClient,
-				lifecycleTiming,
-				threadId
-			});
-		};
+		const releaseRetainedThread = (threadId, ownerClientId = initialBoundClientId, assertCurrent) => releaseCodexBoundLiveThread({
+			client: params.client,
+			clientId,
+			ownerClientId,
+			abandonClient: params.abandonClient,
+			lifecycleTiming,
+			threadId,
+			assertCurrent
+		});
 		if (!binding && bindingIdentity.kind === "session" && bindingIdentity.sessionKey) {
 			if (!await lifecycleTiming.measure("reclaim-binding-generation", () => reclaimCurrentCodexSessionGeneration({
 				bindingStore: params.bindingStore,
@@ -4546,6 +4788,36 @@ async function startOrResumeThread(params) {
 			})) throw new CodexThreadBindingConflictError(current.threadId, operation);
 			binding = void 0;
 		};
+		const resolveRequestContext = () => {
+			const startModelSelection = resolveCodexAppServerThreadModelSelection({
+				provider: params.params.provider,
+				model: params.runtimeModelId ?? params.params.modelId,
+				binding,
+				authProfileId: params.params.authProfileId,
+				authProfileStore: params.params.authProfileStore,
+				agentDir: params.params.agentDir,
+				config: params.params.config
+			});
+			return {
+				...preflight,
+				bindingIdentity,
+				startModelSelection,
+				startModelProvider: startModelSelection.modelProvider,
+				normalizeBindingModelProvider,
+				throwIfAborted
+			};
+		};
+		const transientDelegationRestriction = params.params.delegationCapability === "report_only";
+		const persistentWebSearchRestriction = params.webSearchAllowed === false && params.persistentWebSearchAllowed === false;
+		const transientNativeToolRestriction = params.nativeCodeModeEnabled === false && !persistentWebSearchRestriction;
+		const transientWebSearchRestriction = isTransientWebSearchRestriction(params);
+		if (binding?.pendingResumeConfiguration) return await resumePendingCodexThread(params, {
+			...resolveRequestContext(),
+			binding,
+			clearCurrentBinding,
+			releaseRetainedThread: (threadId, assertCurrent) => releaseRetainedThread(threadId, initialBoundClientId, assertCurrent),
+			transientRestriction: transientDelegationRestriction || transientNativeToolRestriction || transientWebSearchRestriction
+		});
 		if (binding?.threadId && !restrictedToolSurface && binding.nativeToolPolicyRestricted === true) await clearCurrentBinding("rotating a host-policy-restricted thread binding");
 		if (binding?.threadId && binding.nativeSkillIsolationFingerprint !== nativeSkillIsolationFingerprint) {
 			embeddedAgentLog.debug("codex app-server native skill isolation changed; starting a new thread", { threadId: binding.threadId });
@@ -4579,24 +4851,30 @@ async function startOrResumeThread(params) {
 			await clearCurrentBinding("rotating a GPT-5.6 multi-agent thread binding");
 			binding = void 0;
 		}
-		const startModelSelection = resolveCodexAppServerThreadModelSelection({
-			provider: params.params.provider,
-			model: params.runtimeModelId ?? params.params.modelId,
-			binding,
-			authProfileId: params.params.authProfileId,
-			authProfileStore: params.params.authProfileStore,
-			agentDir: params.params.agentDir,
-			config: params.params.config
-		});
-		const startModelProvider = startModelSelection.modelProvider;
-		const transientDelegationRestriction = params.params.delegationCapability === "report_only";
+		const requestContext = resolveRequestContext();
 		let preserveExistingBinding = transientDelegationRestriction || !ringZeroActive && params.nativeProviderWebSearchSupport === "unknown" && !binding?.threadId;
 		let rotatedContextEngineBinding = false;
 		let prebuiltPluginThreadConfig;
+		const buildLoadedPluginThreadConfig = async (current) => {
+			if (!params.pluginThreadConfig?.requiresCurrentPolicyCheck && !shouldRecheckRecoverablePluginBinding({
+				binding: current,
+				pluginThreadConfig: params.pluginThreadConfig
+			})) return;
+			try {
+				prebuiltPluginThreadConfig = await lifecycleTiming.measure("plugin-config-recovery", () => params.pluginThreadConfig?.build({ threadId: current.threadId }));
+			} catch (error) {
+				throwIfAborted();
+				if (params.pluginThreadConfig?.requiresCurrentPolicyCheck) throw error;
+				embeddedAgentLog.warn("codex app-server plugin app config recovery check failed", {
+					error,
+					threadId: current.threadId
+				});
+				return;
+			}
+			throwIfAborted();
+			return prebuiltPluginThreadConfig;
+		};
 		const webSearchBindingChanged = binding?.threadId && binding.webSearchThreadConfigFingerprint !== webSearchThreadConfigFingerprint;
-		const persistentWebSearchRestriction = params.webSearchAllowed === false && params.persistentWebSearchAllowed === false;
-		const transientNativeToolRestriction = params.nativeCodeModeEnabled === false && !persistentWebSearchRestriction;
-		const transientWebSearchRestriction = isTransientWebSearchRestriction(params);
 		const explicitTransientWebSearchRestriction = params.webSearchAllowed === false && params.persistentWebSearchAllowed !== false && transientWebSearchRestriction;
 		const unknownProviderWebSearchSupport = params.nativeProviderWebSearchSupport === "unknown";
 		if (binding?.threadId && (params.configuredMcpOwnershipVersion === 1 && (binding.configuredMcpOwnershipVersion !== 1 || binding.dynamicToolsFingerprint === void 0 || binding.mcpServersFingerprint !== void 0 || binding.userMcpServersFingerprint !== void 0) || params.configuredMcpOwnershipVersion !== 1 && binding.configuredMcpOwnershipVersion === 1) && binding?.threadId) {
@@ -4674,28 +4952,13 @@ async function startOrResumeThread(params) {
 			binding = void 0;
 		}
 		if (binding?.threadId) {
-			let pluginBindingStale = isCodexPluginThreadBindingStale({
+			if (isCodexPluginThreadBindingStale({
 				codexPluginsEnabled: params.pluginThreadConfig?.enabled ?? false,
 				bindingFingerprint: binding.pluginAppsFingerprint,
 				bindingInputFingerprint: binding.pluginAppsInputFingerprint,
 				currentInputFingerprint: params.pluginThreadConfig?.inputFingerprint,
 				hasBindingPolicyContext: Boolean(binding.pluginAppPolicyContext)
-			});
-			if (!pluginBindingStale && (params.pluginThreadConfig?.requiresCurrentPolicyCheck || shouldRecheckRecoverablePluginBinding({
-				binding,
-				pluginThreadConfig: params.pluginThreadConfig
-			}))) try {
-				const bindingThreadId = binding.threadId;
-				prebuiltPluginThreadConfig = await lifecycleTiming.measure("plugin-config-recovery", () => params.pluginThreadConfig?.build({ threadId: bindingThreadId }));
-				pluginBindingStale = prebuiltPluginThreadConfig?.fingerprint !== binding.pluginAppsFingerprint;
-			} catch (error) {
-				if (params.pluginThreadConfig?.requiresCurrentPolicyCheck) throw error;
-				embeddedAgentLog.warn("codex app-server plugin app config recovery check failed", {
-					error,
-					threadId: binding.threadId
-				});
-			}
-			if (pluginBindingStale) {
+			})) {
 				embeddedAgentLog.debug("codex app-server plugin app config changed; starting a new thread", { threadId: binding.threadId });
 				await clearCurrentBinding("rotating a stale thread binding");
 				binding = void 0;
@@ -4708,120 +4971,55 @@ async function startOrResumeThread(params) {
 				binding = void 0;
 			}
 		}
-		if (binding?.threadId) if (binding.dynamicToolsFingerprint && !areDynamicToolFingerprintsCompatible(binding.dynamicToolsFingerprint, dynamicToolsFingerprint, legacyDynamicToolsFingerprint)) {
-			assertCodexBindingMayBeReplaced(binding, "changing the dynamic tool catalog");
-			preserveExistingBinding = shouldStartTransientNoToolThread({
-				previous: binding.dynamicToolsFingerprint,
-				nextHasDynamicTools: params.dynamicTools.length > 0
-			});
-			if (preserveExistingBinding) embeddedAgentLog.debug("codex app-server dynamic tools unavailable for turn; starting transient thread", { threadId: binding.threadId });
-			else {
-				embeddedAgentLog.debug("codex app-server dynamic tool catalog changed; starting a new thread", { threadId: binding.threadId });
-				await clearCurrentBinding("rotating a stale thread binding");
-			}
-		} else if (incognito) {
-			if (binding.clientId && binding.clientId === clientId) {
-				params.buildFinalConfigPatch?.({
-					action: "resume",
-					binding
+		if (binding?.threadId) {
+			if (binding.dynamicToolsFingerprint && !areDynamicToolFingerprintsCompatible(binding.dynamicToolsFingerprint, dynamicToolsFingerprint, legacyDynamicToolsFingerprint)) {
+				assertCodexBindingMayBeReplaced(binding, "changing the dynamic tool catalog");
+				preserveExistingBinding = shouldStartTransientNoToolThread({
+					previous: binding.dynamicToolsFingerprint,
+					nextHasDynamicTools: params.dynamicTools.length > 0
 				});
-				throwIfAborted();
-				lifecycleTiming.mark("thread-ready");
-				lifecycleTiming.logSummary({
-					runId: params.params.runId,
-					sessionId: params.params.sessionId,
-					sessionKey: params.params.sessionKey,
-					threadId: binding.threadId,
-					action: "resumed"
+				if (preserveExistingBinding) embeddedAgentLog.debug("codex app-server dynamic tools unavailable for turn; starting transient thread", { threadId: binding.threadId });
+				else {
+					embeddedAgentLog.debug("codex app-server dynamic tool catalog changed; starting a new thread", { threadId: binding.threadId });
+					await clearCurrentBinding("rotating a stale thread binding");
+				}
+			} else {
+				const warmReuse = await tryReuseCodexLiveThread({
+					...requestContext,
+					params,
+					binding,
+					clientId,
+					buildLoadedPluginThreadConfig
 				});
-				return {
-					...binding,
-					lifecycle: { action: "resumed" }
-				};
+				if (warmReuse.kind === "ready") return warmReuse.binding;
+				if (incognito || warmReuse.kind === "rotate") {
+					throwIfAborted();
+					await clearCurrentBinding(incognito ? "rotating an unavailable ephemeral thread binding" : "rotating a stale plugin app binding");
+				} else {
+					const configuration = await prepareCodexThreadResume(params, binding, requestContext);
+					try {
+						await releaseRetainedThread(binding.threadId, binding.clientId, configuration.assertCurrent);
+						configuration.assertCurrent();
+						const resumed = await resumeExistingCodexThread(params, {
+							...requestContext,
+							binding,
+							clearCurrentBinding,
+							prebuiltFinalConfigPatch: warmReuse.prebuiltFinalConfigPatch,
+							prebuiltPluginThreadConfig,
+							buildLoadedPluginThreadConfig,
+							assertResumeOwnership: configuration.assertCurrent,
+							assertResumeConfiguration: configuration.assertConfigured
+						});
+						if (resumed) return resumed;
+					} finally {
+						configuration.dispose();
+					}
+				}
 			}
-			await clearCurrentBinding("rotating an unavailable ephemeral thread binding");
-			binding = void 0;
-		} else {
-			const warmReuse = await tryReuseCodexLiveThread({
-				params,
-				binding,
-				bindingIdentity,
-				clientId,
-				dynamicToolsFingerprint,
-				environmentSelectionFingerprint,
-				hostSystemAgentActive,
-				lifecycleTiming,
-				nativeSkillIsolation,
-				releaseConsumedThread: (threadId, cause) => releaseCodexConsumedLiveThread({
-					client: params.client,
-					abandonClient: params.abandonClient,
-					lifecycleTiming,
-					threadId,
-					cause
-				}),
-				ringZeroActive,
-				restrictedToolSurfaceInheritedMcpServerNames,
-				startModelProvider,
-				startModelSelection,
-				throwIfAborted,
-				userMcpServersConfigPatch
-			});
-			if (warmReuse.binding) return warmReuse.binding;
-			await releaseRetainedThread(binding.threadId);
-			const resumed = await resumeExistingCodexThread(params, {
-				binding,
-				bindingIdentity,
-				startModelSelection,
-				startModelProvider,
-				userMcpServersConfigPatch,
-				dynamicToolsFingerprint,
-				dynamicToolsContainDeferred,
-				webSearchThreadConfigFingerprint,
-				nativeSkillIsolationFingerprint,
-				userMcpServersFingerprint,
-				ringZeroConfigFingerprint,
-				ringZeroClientInstanceId,
-				networkProxyConfigFingerprint,
-				contextEngineBinding,
-				environmentSelectionFingerprint,
-				hostSystemAgentActive,
-				ringZeroActive,
-				restrictedToolSurface,
-				restrictedToolSurfaceInheritedMcpServerNames,
-				nativeSkillIsolation,
-				lifecycleTiming,
-				normalizeBindingModelProvider,
-				throwIfAborted,
-				clearCurrentBinding,
-				prebuiltFinalConfigPatch: warmReuse.prebuiltFinalConfigPatch,
-				prebuiltPluginThreadConfig
-			});
-			if (resumed) return resumed;
 		}
 		if (initialBoundThreadId && !preserveExistingBinding && !replacementPredecessor) await releaseRetainedThread(initialBoundThreadId);
 		const started = await startFreshCodexThread(params, {
-			bindingIdentity,
-			startModelSelection,
-			startModelProvider,
-			userMcpServersConfigPatch,
-			dynamicToolsFingerprint,
-			dynamicToolsContainDeferred,
-			webSearchThreadConfigFingerprint,
-			nativeSkillIsolationFingerprint,
-			userMcpServersFingerprint,
-			ringZeroConfigFingerprint,
-			ringZeroClientInstanceId,
-			networkProxyConfigFingerprint,
-			contextEngineBinding,
-			environmentSelectionFingerprint,
-			hostSystemAgentActive,
-			ringZeroActive,
-			restrictedToolSurface,
-			restrictedToolSurfaceInheritedMcpServerNames,
-			nativeSkillIsolation,
-			lifecycleTiming,
-			normalizeBindingModelProvider,
-			throwIfAborted,
+			...requestContext,
 			prebuiltPluginThreadConfig,
 			preserveExistingBinding,
 			rotatedContextEngineBinding,
@@ -4832,6 +5030,54 @@ async function startOrResumeThread(params) {
 	});
 }
 //#endregion
+//#region extensions/codex/src/app-server/reasoning-effort.ts
+const CODEX_REASONING_EFFORTS = [
+	"minimal",
+	"low",
+	"medium",
+	"high",
+	"xhigh",
+	"max"
+];
+const LEGACY_PRO_REASONING_EFFORTS = [
+	"medium",
+	"high",
+	"xhigh"
+];
+const LEGACY_PRO_MODEL_ID_RE = /^gpt-5\.[45]-pro$/u;
+const MODERN_GPT_5_MODEL_ID_RE = /^gpt-5\.(?:[3-9]|[1-9]\d)(?:$|-)/u;
+/** Read reasoning metadata after the Codex app-server route has been selected. */
+function readCodexSupportedReasoningEfforts(compat) {
+	if (!compat || typeof compat !== "object" || Array.isArray(compat)) return;
+	const efforts = compat.supportedReasoningEfforts;
+	if (!Array.isArray(efforts)) return;
+	return efforts.filter((effort) => typeof effort === "string");
+}
+function resolveSupportedReasoningEffort(params) {
+	const declared = new Set(params.supportedReasoningEfforts.map((effort) => effort.trim().toLowerCase()));
+	const supported = CODEX_REASONING_EFFORTS.filter((effort) => declared.has(effort));
+	if (supported.includes(params.requested)) return params.requested;
+	const requestedRank = CODEX_REASONING_EFFORTS.indexOf(params.requested);
+	return supported.find((effort) => CODEX_REASONING_EFFORTS.indexOf(effort) >= requestedRank) ?? supported.at(-1);
+}
+function resolveCodexAppServerReasoningEffort(params) {
+	if (params.thinkLevel === "ultra") return "ultra";
+	if (params.thinkLevel === "off") return params.supportedReasoningEfforts?.includes("none") ? "none" : null;
+	if (params.thinkLevel === "adaptive") return null;
+	if (params.supportedReasoningEfforts) return resolveSupportedReasoningEffort({
+		requested: params.thinkLevel,
+		supportedReasoningEfforts: params.supportedReasoningEfforts
+	}) ?? null;
+	const modelId = params.modelId.trim().toLowerCase();
+	if (LEGACY_PRO_MODEL_ID_RE.test(modelId)) return resolveSupportedReasoningEffort({
+		requested: params.thinkLevel,
+		supportedReasoningEfforts: LEGACY_PRO_REASONING_EFFORTS
+	}) ?? null;
+	if (params.thinkLevel === "minimal" && MODERN_GPT_5_MODEL_ID_RE.test(modelId)) return "low";
+	if (params.thinkLevel === "minimal" || params.thinkLevel === "low" || params.thinkLevel === "medium" || params.thinkLevel === "high" || params.thinkLevel === "xhigh") return params.thinkLevel;
+	return null;
+}
+//#endregion
 //#region extensions/codex/src/app-server/user-input.ts
 /** Builds ordered Codex user input for both new turns and same-turn steering. */
 function buildCodexUserInput(text, images) {
@@ -4884,12 +5130,29 @@ function buildTurnStartParams(params, options) {
 		agentDir: params.agentDir,
 		config: params.config
 	});
+	const collaborationMode = modelSelection ? buildTurnCollaborationMode(params, {
+		model: modelSelection.model,
+		turnScopedDeveloperInstructions: options.turnScopedDeveloperInstructions,
+		skillsCollaborationInstructions: options.skillsCollaborationInstructions,
+		memoryCollaborationInstructions: options.memoryCollaborationInstructions
+	}) : void 0;
 	const useThreadPermissionProfile = options.appServer.networkProxy && !options.sandboxPolicy;
 	const currentSenderContext = params.trigger === "user" ? buildCodexCurrentSenderContextValue(params) : void 0;
-	const additionalContext = currentSenderContext ? { openclaw_current_sender: {
-		kind: "untrusted",
-		value: currentSenderContext
-	} } : void 0;
+	let additionalContext = buildCodexTemporalAdditionalContext(params, { sessionStatusAvailable: options.sessionStatusAvailable === true });
+	if (currentSenderContext) additionalContext = {
+		...additionalContext,
+		openclaw_current_sender: {
+			kind: "untrusted",
+			value: currentSenderContext
+		}
+	};
+	if (params.permissionChange?.notice) additionalContext = {
+		...additionalContext,
+		openclaw_permission_change: {
+			kind: "application",
+			value: params.permissionChange.notice
+		}
+	};
 	return {
 		threadId: options.threadId,
 		input: [...buildCodexUserInput(options.promptText ?? params.prompt, params.images), ...options.explicitSkillInputs ?? []],
@@ -4904,23 +5167,33 @@ function buildTurnStartParams(params, options) {
 			personality: CODEX_NATIVE_PERSONALITY_NONE
 		} : {},
 		...options.appServer.serviceTier !== void 0 ? { serviceTier: options.appServer.serviceTier } : options.clearInheritedServiceTier ? { serviceTier: null } : {},
-		...modelSelection ? { effort: resolveReasoningEffort(params.thinkLevel, modelSelection.model, readCodexSupportedReasoningEfforts(params.model?.compat)) } : {},
-		...options.environmentSelection ? { environments: options.environmentSelection } : {},
-		...modelSelection ? { collaborationMode: buildTurnCollaborationMode(params, {
-			model: modelSelection.model,
-			turnScopedDeveloperInstructions: options.turnScopedDeveloperInstructions,
-			skillsCollaborationInstructions: options.skillsCollaborationInstructions,
-			memoryCollaborationInstructions: options.memoryCollaborationInstructions
-		}) } : {}
+		...collaborationMode ? {
+			effort: collaborationMode.settings.reasoning_effort,
+			collaborationMode
+		} : {},
+		...options.environmentSelection ? { environments: options.environmentSelection } : {}
 	};
 }
+function buildCodexTemporalAdditionalContext(params, options) {
+	return { openclaw_temporal_context: {
+		kind: "application",
+		value: buildTemporalContextText({
+			configuredTimezone: params.config?.agents?.defaults?.userTimezone,
+			sessionStatusAvailable: options.sessionStatusAvailable
+		})
+	} };
+}
 function buildTurnCollaborationMode(params, options = {}) {
 	const model = options.model ?? params.modelId;
 	return {
 		mode: "default",
 		settings: {
 			model,
-			reasoning_effort: resolveReasoningEffort(params.thinkLevel, model, readCodexSupportedReasoningEfforts(params.model?.compat)),
+			reasoning_effort: resolveCodexAppServerReasoningEffort({
+				thinkLevel: params.thinkLevel,
+				modelId: model,
+				supportedReasoningEfforts: readCodexSupportedReasoningEfforts(params.model?.compat)
+			}),
 			developer_instructions: buildTurnScopedCollaborationInstructions(params, options)
 		}
 	};
@@ -4958,4 +5231,4 @@ function joinPresentSections(...sections) {
 	return sections.filter((section) => Boolean(section?.trim())).join("\n\n");
 }
 //#endregion
-export { isForcedPrivateQaCodexRuntime as $, attestCodexRestrictedToolSurfaceMcpServersDisabled as A, resolveCodexAppServerRequestModelSelection as B, toCodexDynamicToolProgressResponse as C, refreshCodexPluginRuntimeState as Ct, withDynamicToolExecutionState as D, resolveRecoverableCodexPluginConfigKeys as Dt, createFailedDynamicToolResponse as E, pluginReadParams as Et, resolveCodexWebSearchPlan as F, CODEX_MANAGED_THREAD_MAX_ENTRIES as G, resolveCodexBindingModelProviderFallback as H, buildDeveloperInstructions as I, areCodexDynamicToolFingerprintsCompatible as J, CODEX_MANAGED_THREAD_NAMESPACE as K, buildCodexProjectDocThreadConfig as L, buildCodexRuntimeThreadConfig as M, readCodexInheritedMcpServerNames as N, withDynamicToolTranscriptDetails as O, buildCodexNativeWebSearchThreadConfig as P, filterCodexDynamicToolsForDisabledNativeSurface as Q, CODEX_NATIVE_PERSONALITY_NONE as R, shouldReleaseTurnAfterTerminalDynamicTool as S, ensureCodexPluginActivation as St, resolveCodexToolAbortTerminalReason as T, isOpenAiCuratedMarketplaceName as Tt, resolveReasoningEffort as U, resolveCodexAppServerThreadModelSelection as V, readCodexSupportedReasoningEfforts as W, codexLegacyDynamicToolsFingerprint as X, codexDynamicToolsFingerprint as Y, filterCodexDynamicTools as Z, isDynamicToolTerminalDiagnosticEvent as _, buildCodexPluginThreadConfigTimeoutFallback as _t, isCodexAppServerProfilerEnabled as a, buildContextEngineBinding as at, resolveTerminalDynamicToolBatchAction as b, mergeCodexThreadConfigs as bt, buildCodexNativeHookRelayConfig as c, fitCodexProjectedContextForTurnStart as ct, emitCodexNativePreToolUseFailureDiagnostic as d, resolveCodexContextEngineProjectionMaxChars as dt, isMessageOnlyCodexSourceReply as et, resolveCodexNativeHookRelayEvents as f, resolveCodexContextEngineProjectionReserveTokens as ft, hasPendingDynamicToolTerminalDiagnostic as g, buildCodexPluginThreadConfigInputFingerprint as gt, handleDynamicToolCallWithTimeout as h, buildCodexPluginThreadConfig as ht, startOrResumeThread as i, resolveCodexDynamicToolsLoadingForRuntime as it, buildCodexRingZeroThreadConfigPatch as j, assertCodexManagedRequirementsDoNotOverrideToolPolicy as k, buildCodexNativeHookRelayDisabledConfig as l, neutralizeCodexExplicitMentionSigils as lt, scheduleCodexNativeHookRelayUnregister as m, buildCodexPluginAppsConfigPatchFromPolicyContext as mt, buildTurnStartParams as n, normalizeCodexDynamicToolName as nt, CODEX_NATIVE_HOOK_RELAY_EVENTS as o, isContextEngineBindingCompatible as ot, resolveCodexNativeHookRelayTtlMs as p, resolveCodexContinuityProjectionMaxChars as pt, createCodexManagedThreadStore as q, buildCodexUserInput as r, resolveCodexDynamicToolsLoading as rt, CODEX_NATIVE_HOOK_RELAY_TTL_GRACE_MS as s, buildCodexContinuityCalibration as st, buildTurnCollaborationMode as t, isSystemAgentOnlyCodexDynamicToolAllowlist as tt, createCodexNativeHookRelay as u, projectContextEngineAssemblyForCodex as ut, isMatchingDynamicToolTerminalDiagnostic as v, buildDisabledAppsConfigPatch as vt, toCodexDynamicToolProtocolResponse as w, isOpenAiCuratedMarketplace as wt, shouldBlockTerminalReleaseForNonTerminalDynamicToolResult as x, shouldBuildCodexPluginThreadConfig as xt, resolveDynamicToolCallTimeoutMs as y, buildPluginAppPolicyContext as yt, resolveCodexAppServerModelProvider as z };
+export { resolveCodexNativeSkillIsolation as $, readCodexMcpToolConnectorId as A, refreshCodexPluginRuntimeState as At, emitCodexNativePreToolUseFailureDiagnostic as B, buildDeveloperInstructions as C, buildCodexPluginThreadConfig as Ct, resolveCodexAppServerThreadModelSelection as D, mergeCodexThreadConfigs as Dt, resolveCodexAppServerRequestModelSelection as E, buildDisabledAppsConfigPatch as Et, assertCodexNativeHookRelayAllowed as F, attestCodexRestrictedToolSurfaceMcpServersDisabled as G, resolveCodexNativeHookRelayTtlMs as H, buildCodexNativeHookRelayConfig as I, createCodexManagedThreadStore as J, CODEX_MANAGED_THREAD_MAX_ENTRIES as K, buildCodexNativeHookRelayDisabledConfig as L, isCodexAppServerProfilerEnabled as M, isOpenAiCuratedMarketplaceName as Mt, CODEX_NATIVE_HOOK_RELAY_EVENTS as N, pluginReadParams as Nt, resolveCodexBindingModelProviderFallback as O, shouldBuildCodexPluginThreadConfig as Ot, CODEX_NATIVE_HOOK_RELAY_TTL_GRACE_MS as P, resolveRecoverableCodexPluginConfigKeys as Pt, applyCodexNativeSkillIsolation as Q, buildCodexNativeHookRelayId as R, resolveCodexWebSearchPlan as S, buildCodexPluginAppsConfigPatchFromPolicyContext as St, resolveCodexAppServerModelProvider as T, buildCodexPluginThreadConfigTimeoutFallback as Tt, scheduleCodexNativeHookRelayUnregister as U, resolveCodexNativeHookRelayEvents as V, attestCodexPluginThreadApps as W, loadCodexNativeToolCatalog as X, hasCodexNativeToolCatalog as Y, parseCodexNativeToolCatalog as Z, buildCodexRingZeroThreadConfigPatch as _, neutralizeCodexExplicitMentionSigils as _t, readCodexSupportedReasoningEfforts as a, filterCodexDynamicTools as at, readCodexInheritedMcpServerNames as b, resolveCodexContextEngineProjectionReserveTokens as bt, assertScheduledCodexAppAuthorityRuntime as c, isMessageOnlyCodexSourceReply as ct, buildScheduledCodexAppServerConnectionIdentity as d, resolveCodexDynamicToolsLoading as dt, areCodexDynamicToolFingerprintsCompatible as et, captureScheduledCodexAppAuthority as f, resolveCodexDynamicToolsLoadingForRuntime as ft, assertCodexManagedRequirementsDoNotOverrideToolPolicy as g, fitCodexProjectedContextForTurnStart as gt, resolveScheduledCodexAppCreatorCaptureDecision as h, buildCodexContinuityCalibration as ht, buildCodexUserInput as i, fingerprintUserMcpServersConfigPatch as it, readCodexMcpToolUiVisibility as j, isOpenAiCuratedMarketplace as jt, buildCodexProjectDocThreadConfig as k, ensureCodexPluginActivation as kt, buildLegacyScheduledCodexAppRecoveryPrompt as l, isSystemAgentOnlyCodexDynamicToolAllowlist as lt, readCurrentCodexScheduledAppPolicy as m, isContextEngineBindingCompatible as mt, buildTurnCollaborationMode as n, codexLegacyDynamicToolsFingerprint as nt, resolveCodexAppServerReasoningEffort as o, filterCodexDynamicToolsForDisabledNativeSurface as ot, intersectCodexPluginThreadConfigWithScheduledAuthority as p, buildContextEngineBinding as pt, CODEX_MANAGED_THREAD_NAMESPACE as q, buildTurnStartParams as r, fingerprintJsonObject as rt, startOrResumeThread as s, isForcedPrivateQaCodexRuntime as st, buildCodexTemporalAdditionalContext as t, codexDynamicToolsFingerprint as tt, buildScheduledCodexAppAuthorityInputFingerprint as u, normalizeCodexDynamicToolName as ut, buildCodexRuntimeThreadConfig as v, projectContextEngineAssemblyForCodex as vt, CODEX_NATIVE_PERSONALITY_NONE as w, buildCodexPluginThreadConfigInputFingerprint as wt, buildCodexNativeWebSearchThreadConfig as x, resolveCodexContinuityProjectionMaxChars as xt, buildCodexThreadConfiguration as y, resolveCodexContextEngineProjectionMaxChars as yt, createCodexNativeHookRelay as z };