@openclaw/codex 2026.9.1-beta.1 → 2026.9.1

package/dist/{dynamic-tools-Dnlfa--w.js → dynamic-tools-BU9tmlYm.js}

@@ -1,41 +1,45 @@
-import { h as readCodexPluginConfig, p as isCodexRemoteExecPlacementSandbox } from "./config-giW8X0QA.js";
-import { K as createCodexElicitationResponse, gt as CODEX_OPENCLAW_DIRECT_DYNAMIC_TOOL_NAMESPACE, p as releaseLeasedSharedCodexAppServerClient, vt as isJsonObject } from "./shared-client-DKz23hHY.js";
-import { E as itemStatus, F as readItem, b as auditNativeToolUnfinishedStatus, h as isCodexNotificationForTurn, v as auditNativeToolName, y as auditNativeToolTerminalStatus } from "./attempt-client-cleanup-bfsmcQ6m.js";
-import { l as readCodexTurn } from "./protocol-validators-VeJxxJ0U.js";
-import { $ as isForcedPrivateQaCodexRuntime, D as withDynamicToolExecutionState, E as createFailedDynamicToolResponse, F as resolveCodexWebSearchPlan, O as withDynamicToolTranscriptDetails, Q as filterCodexDynamicToolsForDisabledNativeSurface, T as resolveCodexToolAbortTerminalReason, Z as filterCodexDynamicTools, d as emitCodexNativePreToolUseFailureDiagnostic, nt as normalizeCodexDynamicToolName, tt as isSystemAgentOnlyCodexDynamicToolAllowlist } from "./thread-lifecycle-L7oEkTlq.js";
+import { $t as isJsonObject, Qt as flattenCodexDynamicToolFunctions, Zt as CODEX_OPENCLAW_DIRECT_DYNAMIC_TOOL_NAMESPACE, _t as resolveCodexToolAbortTerminalReason, bt as withDynamicToolTranscriptDetails, it as readCodexTurn, ot as createCodexElicitationResponse, vt as createFailedDynamicToolResponse, yt as withDynamicToolExecutionState } from "./shared-client-DxcfF9KX.js";
+import { E as readCodexPluginConfig, w as isCodexRemoteExecPlacementSandbox } from "./config-BhmfC1s6.js";
+import { E as itemStatus, I as readItem, b as auditNativeToolUnfinishedStatus, h as isCodexNotificationForTurn, v as auditNativeToolName, y as auditNativeToolTerminalStatus } from "./attempt-client-cleanup-DYHcRQAa.js";
+import { B as emitCodexNativePreToolUseFailureDiagnostic, S as resolveCodexWebSearchPlan, at as filterCodexDynamicTools, lt as isSystemAgentOnlyCodexDynamicToolAllowlist, ot as filterCodexDynamicToolsForDisabledNativeSurface, st as isForcedPrivateQaCodexRuntime, ut as normalizeCodexDynamicToolName } from "./thread-lifecycle-DAcEJ_Om.js";
+import { l as resolveCodexNativeExecutionPolicy, u as resolveCodexNodeExecToolOverrides } from "./request-DYAI5FQE.js";
 import { r as sanitizeInlineImageDataUrl, t as invalidInlineImageText } from "./image-payload-sanitizer-CnfoUPCE.js";
-import { r as formatCodexDisplayText } from "./command-formatters-DEsIufkt.js";
-import { a as resolveCodexNodeExecToolOverrides, i as resolveCodexNativeExecutionPolicy } from "./sandbox-guard-kuWTn9C5.js";
-import { a as sanitizeCodexApprovalVisibleText, c as waitForPluginApprovalDecision, i as requestPluginApproval, n as codexApprovalTimeoutText, o as stripDanglingCodexApprovalTerminalSequence, r as mapExecDecisionToOutcome, s as truncateCodexApprovalDisplayText, t as approvalRequestExplicitlyUnavailable } from "./plugin-approval-roundtrip-bUm777tR.js";
+import { a as formatCodexDisplayText } from "./command-formatters-CLHhEB1Q.js";
+import { a as requestPluginApprovalOutcome, c as truncateCodexApprovalDisplayText, i as requestPluginApproval, l as waitForPluginApprovalDecision, n as codexApprovalTimeoutText, o as sanitizeCodexApprovalVisibleText, r as mapExecDecisionToOutcome, s as stripDanglingCodexApprovalTerminalSequence, t as approvalRequestExplicitlyUnavailable } from "./plugin-approval-roundtrip-CNe-Xrjx.js";
+import { a as CODEX_NODE_EXEC_DYNAMIC_TOOL_NAME, c as createNodeExecAliasDynamicTool, i as CODEX_GATEWAY_PROCESS_DYNAMIC_TOOL_NAME, l as isCodexDynamicToolExcluded, o as createGatewayExecProjection, r as CODEX_GATEWAY_EXEC_DYNAMIC_TOOL_NAME, s as createGatewayProcessProjection } from "./provider-capabilities-DW5p4k9w.js";
 import { asNonArrayRecord, asOptionalRecord, isRecord, normalizeOptionalString, normalizeTrimmedStringList, readStringField } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { validateJsonSchemaValue } from "openclaw/plugin-sdk/json-schema-runtime";
 import path, { posix } from "node:path";
 import { createDeferred } from "openclaw/plugin-sdk/extension-shared";
 import { asDateTimestampMs } from "openclaw/plugin-sdk/number-runtime";
 import { HEARTBEAT_RESPONSE_TOOL_NAME, buildAgentHookContextChannelFields, buildEmbeddedAttemptToolRunContext, consumeAdjustedParamsForToolCall, consumePreExecutionBlockedToolCall, createAgentToolResultMiddlewareRunner, createCodexAppServerToolResultExtensionRunner, embeddedAgentLog, extractMessagingToolSend, extractMessagingToolSendResult, extractToolResultMediaArtifact, filterProviderNormalizableTools, filterToolResultMediaUrls, finalizeToolTerminalPresentation, formatApprovalDisplayPath, formatToolExecutionErrorMessage, getBeforeToolCallFailureDisposition, getChannelAgentToolMeta, getPluginToolMeta, getPluginToolSideEffectOwnerKey, hasNativeHookRelayInvocation, invokeNativeHookRelay, isDeliveredMessageToolOnlySourceReplyResult, isDeliveredMessagingToolResult, isHostScopedAgentToolActive, isMessagingTool, isMessagingToolSendAction, isReplaySafeToolCall, isSubagentSessionKey, isToolResultError, isToolWrappedWithBeforeToolCallHook, normalizeAgentRuntimeTools, normalizeHeartbeatToolResponse, projectRuntimeToolInputSchema, resolveAttemptSpawnWorkspaceDir, resolveModelAuthMode, resolveNativeHookRelayDeferredToolApproval, resolveToolExecutionErrorKind, resolveToolResultFailureKind, runAgentHarnessAfterToolCallHook, sanitizeToolResult, setBeforeToolCallDiagnosticsEnabled, supportsModelTools, wrapToolWithBeforeToolCallHook } from "openclaw/plugin-sdk/agent-harness-runtime";
+import { isPathStrictlyInside, root } from "openclaw/plugin-sdk/file-access-runtime";
 import { createHash, randomUUID } from "node:crypto";
 import { resolveAgentDir as resolveAgentDir$1 } from "openclaw/plugin-sdk/agent-runtime";
 import { formatErrorMessage as formatErrorMessage$1, redactSensitiveText } from "openclaw/plugin-sdk/security-runtime";
 import { killProcessTree } from "openclaw/plugin-sdk/process-runtime";
 import { SsrFBlockedError, isBlockedHostnameOrIp } from "openclaw/plugin-sdk/ssrf-runtime";
 import { spawn } from "node:child_process";
+import { once } from "node:events";
 import { coerceErrorMessage } from "openclaw/plugin-sdk/error-runtime";
 import { DEFAULT_MAX_LIVE_TOOL_RESULT_CHARS, estimateToolResultTextChars, resolveLiveToolResultMaxChars, sliceToolResultTextToBudget, sliceUtf16Safe, truncateUtf16Safe } from "openclaw/plugin-sdk/text-utility-runtime";
-import { once } from "node:events";
+import { emitTrustedDiagnosticEvent } from "openclaw/plugin-sdk/diagnostic-runtime";
 import { isIP } from "node:net";
 import { WebSocketServer } from "ws";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { expectDefined } from "openclaw/plugin-sdk/expect-runtime";
 import { redactToolPayloadText } from "openclaw/plugin-sdk/logging-core";
-import { isPathStrictlyInside, root } from "openclaw/plugin-sdk/file-access-runtime";
-import { runWithCronCreatorAuthorityCapabilityResolver } from "openclaw/plugin-sdk/codex-mcp-projection";
-import { emitTrustedDiagnosticEvent } from "openclaw/plugin-sdk/diagnostic-runtime";
+import { formatMcpCodexApprovalRemedy, requiresMcpCodexToolApproval, resolveCodexScheduledToolProjectionFactory, resolveProjectedMcpCodexToolApprovalMode, runWithCronCreatorAuthorityCapabilityResolver } from "openclaw/plugin-sdk/codex-mcp-projection";
 import { buildRemoteCommand, isToolAllowed, sanitizeEnvVars } from "openclaw/plugin-sdk/sandbox";
 import { saveMediaBuffer } from "openclaw/plugin-sdk/media-store";
 import { getMediaDir } from "openclaw/plugin-sdk/media-runtime";
-import { normalizeOpenAIToolSchemas } from "openclaw/plugin-sdk/provider-tools";
+import { consumeTrustedToolNoStartError, getCoreTtsToolResultMediaUrls } from "openclaw/plugin-sdk/agent-harness-tool-runtime";
+import { normalizeOpenAIStrictCompatSchema } from "openclaw/plugin-sdk/provider-tools";
 //#region extensions/codex/src/app-server/event-projector-native-tool-lifecycle.ts
-/** Projects metadata-only lifecycle diagnostics for native tool items. */
+function isMcpToolCallItemNotification(method, params) {
+	return (method === "item/started" || method === "item/completed") && isJsonObject(params.item) && params.item.type === "mcpToolCall";
+}
+/** Owns native item lifetimes for diagnostics and MCP approval correlation. */
 var CodexNativeToolLifecycleProjector = class {
 	constructor(context, threadId, turnId, options = {}) {
 		this.context = context;
@@ -49,13 +53,39 @@ var CodexNativeToolLifecycleProjector = class {
 		this.approvalFailureDispositionByItem = /* @__PURE__ */ new Map();
 		this.preToolUseFailureByItem = /* @__PURE__ */ new Map();
 		this.finalized = false;
+		this.turnCompleted = false;
+		this.pendingMcpNotifications = 0;
+	}
+	getActiveMcpToolCall(serverName) {
+		if (this.finalized || this.turnCompleted || this.pendingMcpNotifications > 0 || this.options.runAbortSignal?.aborted) return;
+		let candidate;
+		for (const { mcpToolCall } of this.activeItems.values()) {
+			if (mcpToolCall?.server !== serverName) continue;
+			if (candidate) return;
+			candidate = mcpToolCall;
+		}
+		if (!candidate || candidate.status !== "inProgress" || typeof candidate.server !== "string" || !candidate.server.trim() || typeof candidate.tool !== "string" || !candidate.tool.trim() || candidate.arguments === void 0 || candidate.appContext != null || candidate.pluginId != null) return;
+		return {
+			id: candidate.id,
+			server: candidate.server,
+			tool: candidate.tool,
+			arguments: candidate.arguments
+		};
+	}
+	recordMcpToolCallReceipt(notification) {
+		const params = isJsonObject(notification.params) ? notification.params : void 0;
+		if (!params || !isCodexNotificationForTurn(params, this.threadId, this.turnId)) return;
+		if (isMcpToolCallItemNotification(notification.method, params)) this.pendingMcpNotifications += 1;
+		else if (notification.method === "turn/completed" && readCodexTurn(params.turn)?.id === this.turnId) this.turnCompleted = true;
 	}
 	handleNotification(notification) {
 		const params = isJsonObject(notification.params) ? notification.params : void 0;
 		if (!params || !isCodexNotificationForTurn(params, this.threadId, this.turnId)) return;
+		if (this.pendingMcpNotifications > 0 && isMcpToolCallItemNotification(notification.method, params)) this.pendingMcpNotifications -= 1;
 		if (notification.method === "turn/completed") {
 			const turn = readCodexTurn(params.turn);
 			if (!turn || turn.id !== this.turnId) return;
+			this.turnCompleted = true;
 			for (const item of turn.items ?? []) this.recordSnapshotItem(item);
 			return;
 		}
@@ -74,10 +104,10 @@ var CodexNativeToolLifecycleProjector = class {
 		});
 	}
 	recordItem(params) {
-		const toolName = auditNativeToolName(params.item);
+		const toolName = auditNativeToolName(params.item) ?? (params.item.type === "mcpToolCall" ? params.item.type : void 0);
 		if (!toolName || this.completedItemIds.has(params.item.id)) return;
 		if (params.phase === "start") {
-			this.recordStarted(params.item.id, toolName, auditNativeToolUnfinishedStatus(params.item), params.sourceTimestampMs);
+			this.recordStarted(params.item.id, toolName, auditNativeToolUnfinishedStatus(params.item), params.sourceTimestampMs, params.item.type === "mcpToolCall" ? params.item : void 0);
 			return;
 		}
 		if (params.item.type === "webSearch") {
@@ -203,12 +233,13 @@ var CodexNativeToolLifecycleProjector = class {
 			item
 		});
 	}
-	recordStarted(toolCallId, toolName, unfinishedStatus, sourceTimestampMs) {
+	recordStarted(toolCallId, toolName, unfinishedStatus, sourceTimestampMs, mcpToolCall) {
 		if (this.activeItems.has(toolCallId)) return;
 		this.startedAtByItem.set(toolCallId, sourceTimestampMs ?? Date.now());
 		this.activeItems.set(toolCallId, {
 			toolName,
-			unfinishedStatus
+			unfinishedStatus,
+			mcpToolCall
 		});
 		emitTrustedDiagnosticEvent({
 			type: "tool.execution.started",
@@ -278,10 +309,10 @@ function joinRemoteWorkspacePath(remoteRoot, suffix) {
 //#endregion
 //#region extensions/codex/src/app-server/remote-workspace-media.ts
 const REMOTE_WORKSPACE_MEDIA_TIMEOUT_MS = 6e4;
-const REMOTE_WORKSPACE_MEDIA_MAX_BYTES = 64 * 1024 * 1024;
+const REMOTE_WORKSPACE_MEDIA_MAX_BYTES = 67108864;
 const REMOTE_WORKSPACE_MEDIA_MAX_ATTACHMENTS = 16;
-const CODEX_REMOTE_MEDIA_CHUNK_BYTES = 512 * 1024;
-const CODEX_REMOTE_COMMAND_DEFAULT_OUTPUT_BYTES = 1024 * 1024;
+const CODEX_REMOTE_MEDIA_CHUNK_BYTES = 524288;
+const CODEX_REMOTE_COMMAND_DEFAULT_OUTPUT_BYTES = 1048576;
 const CODEX_BOUNDED_REMOTE_FILE_READER = [
 	"try{",
 	"const fs=require(\"node:fs\");",
@@ -543,90 +574,6 @@ function mapMessageMediaValues(args, mapValue) {
 /** Mutable dependency seam shared by dynamic-tool construction and its behavioral tests. */
 const dynamicToolBuildState = {};
 //#endregion
-//#region extensions/codex/src/app-server/shell-dynamic-tools.ts
-const CODEX_NODE_EXEC_DYNAMIC_TOOL_NAME = "node_exec";
-const CODEX_GATEWAY_EXEC_DYNAMIC_TOOL_NAME = "gateway_exec";
-const CODEX_GATEWAY_PROCESS_DYNAMIC_TOOL_NAME = "gateway_process";
-const CODEX_EXEC_POLICY_PARAMETER_NAMES = /* @__PURE__ */ new Set([
-	"host",
-	"security",
-	"ask"
-]);
-const CODEX_NODE_EXEC_PARAMETER_NAMES = /* @__PURE__ */ new Set([
-	"command",
-	"workdir",
-	"env",
-	"timeoutSeconds",
-	"node"
-]);
-const PROCESS_FOLLOWUP_TEXT = "Use process (list/poll/log/write/send-keys/submit/paste/kill/clear/remove) for follow-up.";
-/** Returns true when plugin config explicitly removes any named dynamic tool. */
-function isCodexDynamicToolExcluded(config, names) {
-	const normalizedNames = new Set(names.map((name) => normalizeCodexDynamicToolName(name)));
-	return (config.codexDynamicToolsExclude ?? []).some((name) => normalizedNames.has(normalizeCodexDynamicToolName(name)));
-}
-function createExecAliasDynamicTool(execTool, params) {
-	const pinnedNode = params.host === "node" ? params.node?.trim() : void 0;
-	const nodeAlias = params.host === "node";
-	const gatewayProcessAliasAvailable = params.host === "gateway" && params.processAliasAvailable;
-	const name = nodeAlias ? CODEX_NODE_EXEC_DYNAMIC_TOOL_NAME : CODEX_GATEWAY_EXEC_DYNAMIC_TOOL_NAME;
-	const description = nodeAlias ? pinnedNode ? "Run a shell command to completion on the OpenClaw configured remote node for this session. This tool always uses OpenClaw host=node internally and follows the existing node exec approval and allowlist policy. Remote-node background follow-up is unavailable. Use Codex's native shell for local app-server work." : "Run a shell command to completion on an OpenClaw remote node. Select the node by name or id when multiple nodes are available. This tool always uses OpenClaw host=node internally and follows the existing node exec approval and allowlist policy. Remote-node background follow-up is unavailable. Use Codex's native shell for local app-server work." : "Run a shell command through OpenClaw on the Gateway host for OpenClaw-managed Gateway environment access, including Secret Store agent-readable environment values and protected egress sentinels. Native Codex shell remains preferred for ordinary local work. This tool always uses OpenClaw host=gateway internally and follows Gateway exec approval and allowlist policy.";
-	const followupText = nodeAlias ? "Remote-node background follow-up is unavailable. Wait for the command to complete." : gatewayProcessAliasAvailable ? "Use gateway_process (list/poll/log/write/send-keys/submit/paste/kill/clear/remove) for follow-up." : "Background session follow-up is unavailable because gateway_process is not exposed. Rerun without background=true and set yieldMs high enough to wait for completion.";
-	return {
-		...execTool,
-		name,
-		description,
-		parameters: hideExecDynamicToolParameters(execTool.parameters, !nodeAlias || Boolean(pinnedNode), nodeAlias),
-		execute: async (toolCallId, args, signal, onUpdate) => {
-			const result = await execTool.execute(toolCallId, pinExecDynamicToolArgs(args, params, pinnedNode), signal, onUpdate);
-			return {
-				...result,
-				content: result.content.map((item) => item.type === "text" ? Object.assign({}, item, { text: item.text.replace(PROCESS_FOLLOWUP_TEXT, followupText) }) : item)
-			};
-		}
-	};
-}
-function createGatewayProcessAliasDynamicTool(processTool) {
-	return {
-		...processTool,
-		name: CODEX_GATEWAY_PROCESS_DYNAMIC_TOOL_NAME,
-		description: "Manage background shell sessions in the existing per-session OpenClaw process scope: list, poll, log, write, send-keys, submit, paste, kill, clear, or remove. Use for gateway_exec follow-up; use native Codex shell session handling for ordinary local work."
-	};
-}
-function pinExecDynamicToolArgs(args, params, configuredNode) {
-	const { host: _host, security: _security, ask: _ask, node: requestedNode, ...rest } = normalizeExecDynamicToolArgs(args);
-	if (params.host === "gateway") return {
-		...rest,
-		host: params.host,
-		...params.ask ? { ask: params.ask } : {}
-	};
-	const nodeArgs = Object.fromEntries(Object.entries(rest).filter(([name]) => CODEX_NODE_EXEC_PARAMETER_NAMES.has(name)));
-	const node = configuredNode ?? (typeof requestedNode === "string" ? requestedNode.trim() : "");
-	return {
-		...nodeArgs,
-		host: params.host,
-		...node ? { node } : {}
-	};
-}
-function normalizeExecDynamicToolArgs(args) {
-	return args && typeof args === "object" && !Array.isArray(args) ? args : {};
-}
-function hideExecDynamicToolParameters(parameters, hideNode, nodeOnly) {
-	if (!parameters || typeof parameters !== "object" || Array.isArray(parameters)) return parameters;
-	const schema = parameters;
-	const rawProperties = schema.properties;
-	if (!rawProperties || typeof rawProperties !== "object" || Array.isArray(rawProperties)) return parameters;
-	const includeParameter = (name) => nodeOnly ? CODEX_NODE_EXEC_PARAMETER_NAMES.has(name) && !(hideNode && name === "node") : !CODEX_EXEC_POLICY_PARAMETER_NAMES.has(normalizeCodexDynamicToolName(name)) && !(hideNode && normalizeCodexDynamicToolName(name) === "node");
-	const nextProperties = Object.fromEntries(Object.entries(rawProperties).filter(([name]) => includeParameter(name)));
-	const rawRequired = schema.required;
-	const nextRequired = Array.isArray(rawRequired) ? rawRequired.filter((name) => typeof name !== "string" || includeParameter(name)) : rawRequired;
-	return {
-		...schema,
-		properties: nextProperties,
-		...Array.isArray(rawRequired) ? { required: nextRequired } : {}
-	};
-}
-//#endregion
 //#region extensions/codex/src/app-server/vision-tools.ts
 /**
 * Codex's enabled native surface includes its stable view_image loader. Keep
@@ -652,6 +599,15 @@ const CODEX_NATIVE_SANDBOX_TOOL_REQUIREMENTS = [
 	"apply_patch"
 ];
 const CODEX_MEMORY_FLUSH_DYNAMIC_TOOL_ALLOW = /* @__PURE__ */ new Set(["read", "write"]);
+const CODEX_DISABLED_NATIVE_SHELL_DYNAMIC_TOOLS = /* @__PURE__ */ new Set([
+	"exec",
+	"process",
+	"sandbox_exec",
+	"sandbox_process",
+	CODEX_GATEWAY_EXEC_DYNAMIC_TOOL_NAME,
+	CODEX_GATEWAY_PROCESS_DYNAMIC_TOOL_NAME,
+	CODEX_NODE_EXEC_DYNAMIC_TOOL_NAME
+]);
 /** Keeps node filesystem and process ownership on its native exec-server. */
 function resolveCodexNodePlacementToolConstructionPlan(sandbox, nativeToolSurfaceEnabled) {
 	if (!isCodexRemoteExecPlacementSandbox(sandbox) || sandbox?.backendId !== "node" || !("placementNodeId" in sandbox) || typeof sandbox.placementNodeId !== "string" || !sandbox.placementNodeId) return;
@@ -669,13 +625,6 @@ function preserveRingZeroSystemAgentTool(allTools, filteredTools) {
 	if (!openclaw) return filteredTools;
 	return [openclaw, ...filteredTools.filter((tool) => tool.name !== "openclaw")];
 }
-/** Splits sandbox and run session keys so tool calls can bind to both scopes when needed. */
-function resolveOpenClawCodingToolsSessionKeys(params, sandboxSessionKey) {
-	return {
-		sessionKey: sandboxSessionKey,
-		runSessionKey: params.sessionKey && params.sessionKey !== sandboxSessionKey ? params.sessionKey : void 0
-	};
-}
 /** Returns the canonical channel used for Codex message routing and receipts. */
 function resolveCodexMessageToolProvider(params) {
 	return params.messageChannel ?? params.messageProvider;
@@ -740,6 +689,10 @@ async function buildDynamicTools(input) {
 		...params,
 		disableMessageTool: false
 	} : params;
+	const toolRunContext = buildEmbeddedAttemptToolRunContext({
+		...params,
+		forceMessageTool: shouldForceMessageTool(messagePolicyParams)
+	});
 	if (params.disableTools) {
 		input.onWebSearchPolicyResolved?.(false);
 		return [];
@@ -753,11 +706,11 @@ async function buildDynamicTools(input) {
 	const modelHasVision = params.model.input?.includes("image") ?? false;
 	const agentDir = params.agentDir ?? resolveAgentDir$1(params.config ?? {}, input.sessionAgentId);
 	const injectedOpenClawCodingToolsFactory = dynamicToolBuildState.openClawCodingToolsFactory;
-	let agentHarnessModule;
-	const loadAgentHarnessModule = async () => agentHarnessModule ??= await import("openclaw/plugin-sdk/agent-harness");
-	toolBuildStages.mark("load-agent-harness-tools");
-	const sessionKeys = resolveOpenClawCodingToolsSessionKeys(params, input.sandboxSessionKey);
-	const nativeExecutionPolicy = resolveCodexNativeExecutionPolicyForDynamicTools(input);
+	const nativeExecutionPolicy = resolveCodexNativeExecutionPolicyForRun(params, {
+		agentId: input.policyAgentId,
+		runtimeSessionKey: input.sandboxSessionKey,
+		sandbox: input.sandbox
+	});
 	const webSearchPlan = resolveCodexWebSearchPlan({
 		config: params.config,
 		disableTools: params.disableTools,
@@ -765,109 +718,114 @@ async function buildDynamicTools(input) {
 		nativeProviderWebSearchSupport: input.nativeProviderWebSearchSupport
 	});
 	const webFetchHostnameAllowlistRef = {};
-	const buildOpenClawCodingTools = () => {
-		const toolConstructionPlan = resolveCodexNodePlacementToolConstructionPlan(input.sandbox, input.nativeToolSurfaceEnabled);
-		const options = {
-			agentId: input.sessionAgentId,
-			...buildEmbeddedAttemptToolRunContext(params),
-			exec: {
-				...params.execOverrides,
-				...input.sessionPermissionPolicy ? { mode: input.sessionPermissionPolicy.execMode } : {},
-				...resolveCodexNodeExecToolOverrides(nativeExecutionPolicy),
-				config: params.config,
-				elevated: params.bashElevated
-			},
-			sessionPermissionPolicy: input.sessionPermissionPolicy ? {
-				mode: input.sessionPermissionPolicy.mode,
-				root: input.sessionPermissionPolicy.root
-			} : void 0,
-			sandbox: input.sandbox,
-			...toolConstructionPlan ? { toolConstructionPlan } : {},
-			messageProvider: resolveCodexMessageToolProvider(params),
-			toolPolicyMessageProvider: params.messageProvider ?? params.messageChannel,
-			clientCaps: params.clientCaps,
-			chatType: params.chatType,
-			agentAccountId: params.agentAccountId,
-			messageTo: params.messageTo,
-			messageThreadId: params.messageThreadId,
-			nativeChannelId: params.chatId,
-			messageActionTurnCapability: params.messageActionTurnCapability,
-			groupId: params.groupId,
-			groupChannel: params.groupChannel,
-			groupSpace: params.groupSpace,
-			spawnedBy: params.spawnedBy,
-			senderId: params.senderId,
-			senderName: params.senderName,
-			senderUsername: params.senderUsername,
-			senderE164: params.senderE164,
-			senderIsOwner: params.senderIsOwner,
-			inputProvenance: params.inputProvenance,
-			trustedInternalHandoff: params.trustedInternalHandoff,
-			scheduledToolPolicy: params.scheduledToolPolicy,
-			allowGatewaySubagentBinding: params.allowGatewaySubagentBinding || isForcedPrivateQaCodexRuntime(),
-			...sessionKeys,
-			sessionId: params.sessionId,
-			runId: params.runId,
-			approvalReviewerDeviceId: params.approvalReviewerDeviceId,
-			agentDir,
-			preparedModelRuntime: params.preparedModelRuntime,
-			cwd: input.effectiveCwd ?? input.effectiveWorkspace,
-			workspaceDir: input.effectiveWorkspace,
-			spawnWorkspaceDir: input.effectiveCwd && input.effectiveCwd !== input.effectiveWorkspace ? input.resolvedWorkspace : resolveAttemptSpawnWorkspaceDir({
-				sandbox: input.sandbox,
-				resolvedWorkspace: input.resolvedWorkspace
-			}),
+	const toolConstructionPlan = resolveCodexNodePlacementToolConstructionPlan(input.sandbox, input.nativeToolSurfaceEnabled);
+	const options = {
+		agentId: input.sessionAgentId,
+		policyAgentId: input.policyAgentId,
+		...toolRunContext,
+		exec: {
+			...params.execOverrides,
+			...input.sessionPermissionPolicy ? { mode: input.sessionPermissionPolicy.execMode } : {},
+			...resolveCodexNodeExecToolOverrides(nativeExecutionPolicy),
 			config: params.config,
-			githubPublicationAvailable: params.githubPublicationAvailable,
-			authProfileStore: params.toolAuthProfileStore ?? params.authProfileStore,
-			abortSignal: input.runAbortController.signal,
-			emitBeforeToolCallDiagnostics: false,
-			modelProvider: params.model.provider,
-			modelId: params.modelId,
-			modelCompat: params.model.compat && typeof params.model.compat === "object" ? params.model.compat : void 0,
-			modelApi: params.model.api,
-			modelContextWindowTokens: params.model.contextWindow,
-			delegationCapability: params.delegationCapability,
-			modelAuthMode: resolveModelAuthMode(params.model.provider, params.config, params.toolAuthProfileStore ?? params.authProfileStore, { workspaceDir: input.effectiveWorkspace }),
-			suppressManagedWebSearch: false,
-			webFetchHostnameAllowlistRef,
-			currentChannelId: params.currentChannelId,
-			currentMessagingTarget: params.currentMessagingTarget,
-			hookChannelId: resolveCodexAppServerHookChannelId(params, input.sandboxSessionKey),
-			currentThreadTs: params.currentThreadTs,
-			currentMessageId: params.currentMessageId,
-			replyToMode: params.replyToMode,
-			hasRepliedRef: params.hasRepliedRef,
-			modelHasVision,
-			computerContextEpoch: input.computerContextEpoch,
-			requireExplicitMessageTarget: params.requireExplicitMessageTarget ?? isSubagentSessionKey(params.sessionKey),
-			sourceReplyDeliveryMode: params.sourceReplyDeliveryMode,
-			taskSuggestionDeliveryMode: params.taskSuggestionDeliveryMode,
-			disableMessageTool: input.ignoreDisableMessageTool ? false : params.disableMessageTool,
-			forceMessageTool: shouldForceMessageTool(messagePolicyParams),
-			enableHeartbeatTool: params.trigger === "heartbeat" || input.forceHeartbeatTool === true,
-			forceHeartbeatTool: params.trigger === "heartbeat" || input.forceHeartbeatTool === true,
-			onYield: (message, acknowledgment) => {
-				input.onYieldDetected(acknowledgment);
-				input.onCodexAppServerEvent?.({
-					stream: "codex_app_server.tool",
-					data: {
-						name: "sessions_yield",
-						message
-					}
-				});
-			},
-			claimYieldCompletion: input.claimYieldCompletion,
-			recordToolPrepStage: (name) => {
-				toolBuildStages.mark(name);
-			},
-			onToolOutcome: params.onToolOutcome,
-			isTurnTainted: params.isTurnTainted,
-			allocateToolOutcomeOrdinal: params.allocateToolOutcomeOrdinal,
-			cronCreatorToolAllowlistRef: input.cronCreatorToolAllowlistRef,
-			cronCreatorToolAllowlistCaptureRef: input.cronCreatorToolAllowlistCaptureRef,
-			cronCreatorAuthorityUnavailableReason: input.cronCreatorAuthorityUnavailableReason
-		};
+			elevated: params.bashElevated
+		},
+		sessionPermissionPolicy: input.sessionPermissionPolicy ? {
+			mode: input.sessionPermissionPolicy.mode,
+			root: input.sessionPermissionPolicy.root
+		} : void 0,
+		sandbox: input.sandbox,
+		...toolConstructionPlan ? { toolConstructionPlan } : {},
+		messageProvider: resolveCodexMessageToolProvider(params),
+		toolPolicyMessageProvider: params.messageProvider ?? params.messageChannel,
+		clientCaps: params.clientCaps,
+		chatType: params.chatType,
+		agentAccountId: params.agentAccountId,
+		messageTo: params.messageTo,
+		messageThreadId: params.messageThreadId,
+		nativeChannelId: params.chatId,
+		messageActionTurnCapability: params.messageActionTurnCapability,
+		groupId: params.groupId,
+		groupChannel: params.groupChannel,
+		groupSpace: params.groupSpace,
+		spawnedBy: params.spawnedBy,
+		senderId: params.senderId,
+		senderName: params.senderName,
+		senderUsername: params.senderUsername,
+		senderE164: params.senderE164,
+		senderIsOwner: params.senderIsOwner,
+		inputProvenance: params.inputProvenance,
+		trustedInternalHandoff: params.trustedInternalHandoff,
+		scheduledToolPolicy: params.scheduledToolPolicy,
+		allowGatewaySubagentBinding: params.allowGatewaySubagentBinding || isForcedPrivateQaCodexRuntime(),
+		sessionKey: input.sandboxSessionKey,
+		runSessionKey: params.sessionKey && params.sessionKey !== input.sandboxSessionKey ? params.sessionKey : void 0,
+		sessionId: params.sessionId,
+		runId: params.runId,
+		approvalReviewerDeviceId: params.approvalReviewerDeviceId,
+		agentDir,
+		preparedModelRuntime: params.preparedModelRuntime,
+		cwd: input.effectiveCwd ?? input.effectiveWorkspace,
+		workspaceDir: input.effectiveWorkspace,
+		spawnWorkspaceDir: input.effectiveCwd && input.effectiveCwd !== input.effectiveWorkspace ? input.resolvedWorkspace : resolveAttemptSpawnWorkspaceDir({
+			sandbox: input.sandbox,
+			resolvedWorkspace: input.resolvedWorkspace
+		}),
+		config: params.config,
+		skillsSnapshot: params.skillsSnapshot,
+		...params.skillLibraryAuthoring ? { skillWorkshop: { libraryAuthoring: params.skillLibraryAuthoring } } : {},
+		githubPublicationAvailable: params.githubPublicationAvailable,
+		authProfileStore: params.toolAuthProfileStore ?? params.authProfileStore,
+		abortSignal: input.runAbortController.signal,
+		emitBeforeToolCallDiagnostics: false,
+		modelProvider: params.model.provider,
+		modelId: params.modelId,
+		modelCompat: params.model.compat && typeof params.model.compat === "object" ? params.model.compat : void 0,
+		modelApi: params.model.api,
+		modelContextWindowTokens: params.model.contextWindow,
+		delegationCapability: params.delegationCapability,
+		modelAuthMode: resolveModelAuthMode(params.model.provider, params.config, params.toolAuthProfileStore ?? params.authProfileStore, { workspaceDir: input.effectiveWorkspace }),
+		suppressManagedWebSearch: false,
+		webFetchHostnameAllowlistRef,
+		currentChannelId: params.currentChannelId,
+		currentMessagingTarget: params.currentMessagingTarget,
+		hookChannelId: resolveCodexAppServerHookChannelId(params, input.sandboxSessionKey),
+		currentThreadTs: params.currentThreadTs,
+		currentMessageId: params.currentMessageId,
+		replyToMode: params.replyToMode,
+		hasRepliedRef: params.hasRepliedRef,
+		modelHasVision,
+		computerContextEpoch: input.computerContextEpoch,
+		registerRunCleanup: input.registerRunCleanup,
+		requireExplicitMessageTarget: params.requireExplicitMessageTarget ?? isSubagentSessionKey(params.sessionKey),
+		sourceReplyDeliveryMode: params.sourceReplyDeliveryMode,
+		taskSuggestionDeliveryMode: params.taskSuggestionDeliveryMode,
+		disableMessageTool: input.ignoreDisableMessageTool ? false : params.disableMessageTool,
+		forceMessageTool: shouldForceMessageTool(messagePolicyParams),
+		enableHeartbeatTool: params.trigger === "heartbeat" || input.forceHeartbeatTool === true,
+		forceHeartbeatTool: params.trigger === "heartbeat" || input.forceHeartbeatTool === true,
+		onYield: (message, acknowledgment) => {
+			input.onYieldDetected(acknowledgment);
+			input.onCodexAppServerEvent?.({
+				stream: "codex_app_server.tool",
+				data: {
+					name: "sessions_yield",
+					message
+				}
+			});
+		},
+		claimYieldCompletion: input.claimYieldCompletion,
+		recordToolPrepStage: (name) => {
+			toolBuildStages.mark(name);
+		},
+		onToolOutcome: params.onToolOutcome,
+		isTurnTainted: params.isTurnTainted,
+		allocateToolOutcomeOrdinal: params.allocateToolOutcomeOrdinal,
+		cronCreatorToolAllowlistRef: input.cronCreatorToolAllowlistRef,
+		cronCreatorToolAllowlistCaptureRef: input.cronCreatorToolAllowlistCaptureRef,
+		cronCreatorAuthorityUnavailableReason: input.cronCreatorAuthorityUnavailableReason
+	};
+	const buildOpenClawCodingTools = () => {
 		const bindingOptions = { cwd: input.effectiveCwd ?? input.effectiveWorkspace };
 		if (injectedOpenClawCodingToolsFactory) return params.hostCapabilities.bindToolSurface(injectedOpenClawCodingToolsFactory(options), bindingOptions);
 		const createToolSurface = params.hostCapabilities.createToolSurface;
@@ -887,7 +845,7 @@ async function buildDynamicTools(input) {
 	const readableAllTools = [...readableAllToolProjection.tools];
 	const normallyProfiledTools = input.nativeToolSurfaceEnabled === false ? filterCodexDynamicToolsForDisabledNativeSurface(readableAllTools, input.pluginConfig, { preserveShell: shouldKeepOpenClawShellDynamicTools(input, nativeExecutionPolicy) }) : filterCodexDynamicTools(readableAllTools, input.pluginConfig);
 	const profileFilteredTools = (input.isHostScopedToolActive?.("openclaw") ?? isHostScopedAgentToolActive("openclaw")) && isSystemAgentOnlyCodexDynamicToolAllowlist(params.toolsAllow) ? preserveRingZeroSystemAgentTool(readableAllTools, normallyProfiledTools) : normallyProfiledTools;
-	const codexFilteredTools = addNodeShellDynamicToolsIfNeeded(addGatewayShellDynamicToolsIfAvailable(addSandboxShellDynamicToolsIfAvailable(isCodexMemoryFlushRun(params) ? filterCodexMemoryFlushDynamicTools(readableAllTools) : profileFilteredTools, readableAllTools, input), readableAllTools, input, nativeExecutionPolicy), readableAllTools, input, nativeExecutionPolicy);
+	const codexFilteredTools = await addNodeShellDynamicToolsIfNeeded(addGatewayShellDynamicToolsIfAvailable(addSandboxShellDynamicToolsIfAvailable(isCodexMemoryFlushRun(params) ? filterCodexMemoryFlushDynamicTools(readableAllTools) : profileFilteredTools, readableAllTools, input, nativeExecutionPolicy), readableAllTools, input, nativeExecutionPolicy), readableAllTools, input, nativeExecutionPolicy);
 	toolBuildStages.mark("codex-filtering");
 	const visionFilteredTools = filterCodexVisionTools(codexFilteredTools, {
 		modelHasVision,
@@ -896,33 +854,33 @@ async function buildDynamicTools(input) {
 	toolBuildStages.mark("vision-filtering");
 	const webSearchPresent = visionFilteredTools.some((tool) => tool.name === "web_search");
 	const persistentCodexWebSearchSurface = params.config?.tools?.web?.search?.enabled !== false && !(input.pluginConfig.codexDynamicToolsExclude ?? []).some((name) => normalizeCodexDynamicToolName(name) === "web_search");
-	const webSearchPolicy = webSearchPresent || persistentCodexWebSearchSurface ? (await loadAgentHarnessModule()).resolveWebSearchToolPolicy({
-		config: params.config,
-		modelProvider: params.model.provider,
-		modelId: params.modelId,
-		agentId: input.sessionAgentId,
-		sessionKey: input.sandboxSessionKey,
-		sandboxToolPolicy: input.sandbox?.tools,
-		messageProvider: resolveCodexMessageToolProvider(params),
-		agentAccountId: params.agentAccountId,
-		groupId: params.groupId,
-		groupChannel: params.groupChannel,
-		groupSpace: params.groupSpace,
-		spawnedBy: params.spawnedBy,
-		senderId: params.senderId,
-		senderName: params.senderName,
-		senderUsername: params.senderUsername,
-		senderE164: params.senderE164,
-		inputProvenance: params.inputProvenance,
-		trustedInternalHandoff: params.trustedInternalHandoff,
-		scheduledToolPolicy: params.scheduledToolPolicy
-	}) : {
-		allowed: false,
-		persistentAllowed: false
-	};
-	const transientWebSearchRestriction = !webSearchPolicy.allowed && webSearchPolicy.persistentAllowed || isCodexMemoryFlushRun(params);
-	input.onPersistentWebSearchPolicyResolved?.(webSearchPresent || persistentCodexWebSearchSurface && transientWebSearchRestriction && webSearchPolicy.persistentAllowed);
-	const filteredTools = filterCodexDynamicToolsForAllowlist(visionFilteredTools, includeForcedCodexDynamicToolAllow(params.toolsAllow, messagePolicyParams));
+	let persistentWebSearchAllowed = webSearchPresent;
+	if (input.onPersistentWebSearchPolicyResolved && !webSearchPresent && persistentCodexWebSearchSurface) {
+		const webSearchPolicy = (await import("openclaw/plugin-sdk/agent-harness")).resolveWebSearchToolPolicy({
+			config: params.config,
+			modelProvider: params.model.provider,
+			modelId: params.modelId,
+			agentId: input.policyAgentId,
+			sessionKey: input.sandboxSessionKey,
+			sandboxToolPolicy: input.sandbox?.tools,
+			messageProvider: resolveCodexMessageToolProvider(params),
+			agentAccountId: params.agentAccountId,
+			groupId: params.groupId,
+			groupChannel: params.groupChannel,
+			groupSpace: params.groupSpace,
+			spawnedBy: params.spawnedBy,
+			senderId: params.senderId,
+			senderName: params.senderName,
+			senderUsername: params.senderUsername,
+			senderE164: params.senderE164,
+			inputProvenance: params.inputProvenance,
+			trustedInternalHandoff: params.trustedInternalHandoff,
+			scheduledToolPolicy: params.scheduledToolPolicy
+		});
+		persistentWebSearchAllowed = webSearchPolicy.persistentAllowed && (!webSearchPolicy.allowed || isCodexMemoryFlushRun(params));
+	}
+	input.onPersistentWebSearchPolicyResolved?.(persistentWebSearchAllowed);
+	const filteredTools = filterCodexDynamicToolsForAllowlist(visionFilteredTools, toolRunContext.runtimeToolAllowlist);
 	toolBuildStages.mark("allowlist-filter");
 	const normalizedTools = normalizeAgentRuntimeTools({
 		runtimePlan: input.ignoreRuntimePlan ? void 0 : params.runtimePlan,
@@ -941,7 +899,7 @@ async function buildDynamicTools(input) {
 	const webSearchAllowed = normalizedTools.some((tool) => tool.name === "web_search");
 	webFetchHostnameAllowlistRef.value = webSearchAllowed ? webSearchPlan.webFetchHostnameAllowlist : void 0;
 	input.onWebSearchPolicyResolved?.(webSearchAllowed);
-	const exposedTools = webSearchPlan.suppressManagedWebSearch ? normalizedTools.filter((tool) => tool.name !== "web_search") : normalizedTools;
+	const exposedTools = placeDisabledNativeShellToolsInDirectNamespace(webSearchPlan.suppressManagedWebSearch ? normalizedTools.filter((tool) => tool.name !== "web_search") : normalizedTools, input.nativeToolSurfaceEnabled);
 	if (preNormalizationDiagnostics.length > 0) embeddedAgentLog.warn(`codex app-server quarantined ${preNormalizationDiagnostics.length} unsupported runtime tool schema${preNormalizationDiagnostics.length === 1 ? "" : "s"} before dynamic tool registration`, {
 		runId: params.runId,
 		sessionId: params.sessionId,
@@ -983,49 +941,39 @@ function addGatewayShellDynamicToolsIfAvailable(filteredTools, allTools, input,
 	if (!execTool || execExcluded || existingNames.has("gateway_exec")) return filteredTools;
 	const processExcluded = isCodexDynamicToolExcluded(input.pluginConfig, ["process", CODEX_GATEWAY_PROCESS_DYNAMIC_TOOL_NAME]);
 	const processAliasAvailable = Boolean(processTool && !processExcluded && !existingNames.has("gateway_process"));
-	const toolsToAppend = [createExecAliasDynamicTool(execTool, {
-		host: "gateway",
+	const createProjection = resolveCodexScheduledToolProjectionFactory(input.params.hostCapabilities);
+	if (!createProjection) return filteredTools;
+	const toolsToAppend = [createGatewayExecProjection(createProjection, execTool, {
 		processAliasAvailable,
 		...input.sessionPermissionPolicy?.mode === "guarded" ? { ask: "always" } : {}
 	})];
-	if (processAliasAvailable && processTool) toolsToAppend.push(createGatewayProcessAliasDynamicTool(processTool));
+	if (processAliasAvailable && processTool) toolsToAppend.push(createGatewayProcessProjection(createProjection, processTool));
 	return [...filteredTools, ...toolsToAppend];
 }
-/** Preserves delivery-critical tools when a narrow allowlist would otherwise hide them. */
-function includeForcedCodexDynamicToolAllow(toolsAllow, params) {
-	if (toolsAllow === void 0 || hasWildcardCodexToolsAllow(toolsAllow)) return toolsAllow;
-	const forcedToolNames = shouldForceMessageTool(params) ? ["message"] : [];
-	if (forcedToolNames.length === 0) return toolsAllow;
-	if (toolsAllow.length === 0) return forcedToolNames;
-	const normalized = new Set(toolsAllow.map((name) => normalizeCodexDynamicToolName(name)));
-	const missingToolNames = forcedToolNames.filter((toolName) => !normalized.has(normalizeCodexDynamicToolName(toolName)));
-	return missingToolNames.length === 0 ? toolsAllow : [...toolsAllow, ...missingToolNames];
-}
 /** Decides whether Codex native code mode can own shell/file tools for this turn. */
 function shouldEnableCodexAppServerNativeToolSurface(params, sandbox, options = {}) {
 	if (params.pluginHarnessToolPolicyRestricted === true) return false;
 	if (isCodexMemoryFlushRun(params)) return false;
 	if (params.disableTools) return false;
-	if (isCodexNativeExecutionBlockedByNodeExecHost(params, {
+	if (!resolveCodexNativeExecutionPolicyForRun(params, {
 		agentId: options.agentId,
 		runtimeSessionKey: options.runtimeSessionKey,
 		sandbox
-	})) return false;
-	const toolsAllow = includeForcedCodexDynamicToolAllow(params.toolsAllow, params);
+	}).nativeToolSurfaceAllowed) return false;
+	const toolsAllow = params.toolsAllow;
 	if (toolsAllow === void 0) return canCodexAppServerNativeToolSurfaceHonorSandbox(sandbox, options);
 	return hasWildcardCodexToolsAllow(toolsAllow) && canCodexAppServerNativeToolSurfaceHonorSandbox(sandbox, options);
 }
-/** Returns true when OpenClaw policy requires the Node-owned exec/process tools instead. */
-function isCodexNativeExecutionBlockedByNodeExecHost(params, options = {}) {
-	return !resolveCodexNativeExecutionPolicy({
+function resolveCodexNativeExecutionPolicyForRun(params, options = {}) {
+	return resolveCodexNativeExecutionPolicy({
 		config: params.config,
 		sessionKey: resolveCodexRuntimePolicySessionKey(params, options.runtimeSessionKey),
 		sessionId: params.sessionId,
 		agentId: options.agentId,
 		execOverrides: params.execOverrides,
-		sandboxAvailable: options.sandbox?.enabled,
+		sandboxAvailable: options.sandbox === null ? false : options.sandbox?.enabled,
 		readRuntimeSessionEntry: true
-	}).nativeToolSurfaceAllowed;
+	});
 }
 function resolveCodexRuntimePolicySessionKey(params, runtimeSessionKey) {
 	return runtimeSessionKey?.trim() || params.sandboxSessionKey?.trim() || params.sessionKey?.trim() || params.sessionId;
@@ -1088,8 +1036,8 @@ function disableCodexPluginThreadConfig(pluginConfig) {
 	};
 }
 /** Adds sandbox_exec/process aliases when native Code Mode cannot directly honor the sandbox. */
-function addSandboxShellDynamicToolsIfAvailable(filteredTools, allTools, input) {
-	if (!shouldExposeSandboxExecDynamicTool(input) || isSandboxShellDynamicToolExcluded(input.pluginConfig)) return filteredTools;
+function addSandboxShellDynamicToolsIfAvailable(filteredTools, allTools, input, executionPolicy) {
+	if (isCodexMemoryFlushRun(input.params) || !executionPolicy.nativeToolSurfaceAllowed || !input.sandbox?.enabled || !input.sandbox.backendId.trim() || input.nativeToolSurfaceEnabled !== false || isSandboxShellDynamicToolExcluded(input.pluginConfig)) return filteredTools;
 	const execTool = allTools.find((tool) => normalizeCodexDynamicToolName(tool.name) === "exec");
 	const processTool = allTools.find((tool) => normalizeCodexDynamicToolName(tool.name) === "process");
 	if (!execTool || !processTool) return filteredTools;
@@ -1116,16 +1064,6 @@ function addSandboxShellDynamicToolsIfAvailable(filteredTools, allTools, input)
 		sandboxProcessTool
 	];
 }
-function shouldExposeSandboxExecDynamicTool(input) {
-	if (isCodexMemoryFlushRun(input.params)) return false;
-	if (isCodexNativeExecutionBlockedByNodeExecHost(input.params, {
-		agentId: input.sessionAgentId,
-		runtimeSessionKey: input.sandboxSessionKey,
-		sandbox: input.sandbox
-	})) return false;
-	const backendId = input.sandbox?.enabled ? input.sandbox.backendId.trim().toLowerCase() : "";
-	return Boolean(backendId && input.nativeToolSurfaceEnabled === false);
-}
 function isSandboxShellDynamicToolExcluded(config) {
 	return isCodexDynamicToolExcluded(config, [
 		"exec",
@@ -1134,32 +1072,24 @@ function isSandboxShellDynamicToolExcluded(config) {
 		"sandbox_process"
 	]);
 }
-function addNodeShellDynamicToolsIfNeeded(filteredTools, allTools, input, nodePolicy) {
+async function addNodeShellDynamicToolsIfNeeded(filteredTools, allTools, input, nodePolicy) {
 	if (isCodexMemoryFlushRun(input.params)) return filteredTools;
 	const nodeExecIsDefault = nodePolicy.effectiveExecHost === "node";
 	const nodeExecAvailableFromAuto = nodePolicy.requestedExecHost === "auto" && nodePolicy.effectiveExecHost === "gateway";
 	if (!nodeExecIsDefault && !nodeExecAvailableFromAuto) return filteredTools;
 	const execTool = allTools.find((tool) => normalizeCodexDynamicToolName(tool.name) === "exec");
-	if (!execTool) return filteredTools;
-	if (!isCodexDynamicToolExcluded(input.pluginConfig, ["exec", "node_exec"]) && !filteredTools.some((tool) => normalizeCodexDynamicToolName(tool.name) === "node_exec")) return [...filteredTools, createExecAliasDynamicTool(execTool, {
-		host: "node",
-		node: nodePolicy.node
-	})];
-	return filteredTools;
+	if (!execTool || isCodexDynamicToolExcluded(input.pluginConfig, ["exec", "node_exec"]) || filteredTools.some((tool) => normalizeCodexDynamicToolName(tool.name) === "node_exec")) return filteredTools;
+	const nodeExec = await createNodeExecAliasDynamicTool(execTool, nodePolicy.node, input.runAbortController.signal, input.nodeExecAvailability);
+	return nodeExec ? [...filteredTools, nodeExec] : filteredTools;
 }
 function shouldKeepOpenClawShellDynamicTools(input, nodePolicy) {
 	return !isCodexMemoryFlushRun(input.params) && input.nativeToolSurfaceEnabled === false && input.sandbox?.enabled !== true && nodePolicy.effectiveExecHost !== "node";
 }
-function resolveCodexNativeExecutionPolicyForDynamicTools(input) {
-	return resolveCodexNativeExecutionPolicy({
-		config: input.params.config,
-		sessionKey: resolveCodexRuntimePolicySessionKey(input.params, input.sandboxSessionKey),
-		sessionId: input.params.sessionId,
-		agentId: input.sessionAgentId,
-		execOverrides: input.params.execOverrides,
-		sandboxAvailable: input.sandbox?.enabled,
-		readRuntimeSessionEntry: true
-	});
+/** Keeps replacement shell tools direct even when model metadata mandates Codex Code Mode. */
+function placeDisabledNativeShellToolsInDirectNamespace(tools, nativeToolSurfaceEnabled) {
+	if (nativeToolSurfaceEnabled !== false) return tools;
+	for (const tool of tools) if (CODEX_DISABLED_NATIVE_SHELL_DYNAMIC_TOOLS.has(normalizeCodexDynamicToolName(tool.name))) tool.catalogMode = "direct-only";
+	return tools;
 }
 /** Applies a normalized tool allowlist while preserving shell aliases for exec/process. */
 function filterCodexDynamicToolsForAllowlist(tools, toolsAllow) {
@@ -1182,9 +1112,9 @@ function shouldForceMessageTool(params) {
 }
 //#endregion
 //#region extensions/codex/src/app-server/sandbox-exec-server-node-relay.ts
-const CODEX_NODE_EXEC_SERVER_MAX_MESSAGE_BYTES$1 = 64 * 1024 * 1024;
+const CODEX_NODE_EXEC_SERVER_MAX_MESSAGE_BYTES$1 = 67108864;
 const CODEX_NODE_EXEC_SERVER_MAX_FAILURE_DETAIL_CHARS = 240;
-const CODEX_NODE_HTTP_CREDENTIAL_BODY_MAX_BYTES = 1024 * 1024;
+const CODEX_NODE_HTTP_CREDENTIAL_BODY_MAX_BYTES = 1048576;
 const CODEX_NODE_HTTP_CREDENTIAL_SCAN_MAX_FIELDS = 256;
 const CODEX_NODE_HTTP_CREDENTIAL_SCAN_MAX_DEPTH = 8;
 const CODEX_NODE_HTTP_CREDENTIAL_HEADER_NAMES = /* @__PURE__ */ new Set([
@@ -1824,10 +1754,10 @@ function joinSandboxChildPath(parent, child) {
 * Implements filesystem JSON-RPC handlers for the Codex sandbox exec-server
 * with OpenClaw sandbox policy checks before every bridge operation.
 */
-const CODEX_SANDBOX_EXEC_SERVER_MAX_READ_FILE_BYTES = 512 * 1024 * 1024;
+const CODEX_SANDBOX_EXEC_SERVER_MAX_READ_FILE_BYTES = 536870912;
 const CODEX_SANDBOX_EXEC_SERVER_MAX_OPEN_FILE_READS = 128;
-const CODEX_SANDBOX_EXEC_SERVER_MAX_BUFFERED_FILE_READ_BYTES = 64 * 1024 * 1024;
-const CODEX_SANDBOX_EXEC_SERVER_MAX_READ_BLOCK_BYTES = 1024 * 1024;
+const CODEX_SANDBOX_EXEC_SERVER_MAX_BUFFERED_FILE_READ_BYTES = 67108864;
+const CODEX_SANDBOX_EXEC_SERVER_MAX_READ_BLOCK_BYTES = 1048576;
 const CODEX_SANDBOX_EXEC_SERVER_MAX_FILE_READ_HANDLE_ID_BYTES = 32;
 /** Opens a policy-checked sandbox file under a bounded, connection-owned handle. */
 async function openFile(execServer, handles, params) {
@@ -2231,7 +2161,7 @@ function delay(ms) {
 * access through the active OpenClaw sandbox backend.
 */
 /** Maximum JSON-line size accepted from the streaming HTTP helper process. */
-const SANDBOX_HTTP_STREAM_LINE_MAX_CHARS = 256 * 1024;
+const SANDBOX_HTTP_STREAM_LINE_MAX_CHARS = 262144;
 /** Handles one sandbox HTTP JSON-RPC request, optionally streaming response body deltas. */
 async function httpRequest(execServer, notifications, params) {
 	const record = requireObject(params, "http/request params");
@@ -2543,6 +2473,9 @@ def assert_url_allowed(url):
     PINNED_ADDRESSES[hostname] = sorted(addresses)
 
 class GuardedRedirectHandler(urllib.request.HTTPRedirectHandler):
+    # Python 3.9 lacks the 308 dispatch alias; use the same guarded redirect path.
+    http_error_308 = urllib.request.HTTPRedirectHandler.http_error_302
+
     def __init__(self, redirect_policy):
         self.redirect_policy = redirect_policy
 
@@ -2656,7 +2589,7 @@ python3 "$tmp"
 * termination for Codex sandbox exec-server process RPCs.
 */
 const ENV_KEY_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
-const RETAINED_PROCESS_OUTPUT_BYTES = 1024 * 1024;
+const RETAINED_PROCESS_OUTPUT_BYTES = 1048576;
 const CLOSED_PROCESS_EVICTION_MS = 6e4;
 /** Starts a sandbox-backed process and registers it in the connection-local process table. */
 async function startProcess(execServer, processes, notify, params) {
@@ -2913,10 +2846,11 @@ function readEnv(value) {
 	return env;
 }
 function readProcessEnv(record) {
-	return sanitizeEnvVars({
+	const requestedEnv = {
 		...buildEnvFromPolicy(record.envPolicy),
 		...readEnv(record.env)
-	}).allowed;
+	};
+	return sanitizeEnvVars(requestedEnv).allowed;
 }
 function buildEnvFromPolicy(value) {
 	if (!value || typeof value !== "object" || Array.isArray(value)) return {};
@@ -3031,8 +2965,8 @@ var CodexSandboxExecSession = class {
 * Hosts the local OpenClaw sandbox exec-server that Codex app-server native
 * execution can register as an external environment.
 */
-const CODEX_SANDBOX_EXEC_SERVER_MAX_INBOUND_MESSAGE_BYTES = 100 * 1024 * 1024;
-const CODEX_NODE_EXEC_SERVER_MAX_MESSAGE_BYTES = 64 * 1024 * 1024;
+const CODEX_SANDBOX_EXEC_SERVER_MAX_INBOUND_MESSAGE_BYTES = 104857600;
+const CODEX_NODE_EXEC_SERVER_MAX_MESSAGE_BYTES = 67108864;
 const codexNodeExecServerLeases = /* @__PURE__ */ new WeakMap();
 /** Starts or reuses a sandbox exec-server and registers it with Codex app-server. */
 async function ensureCodexSandboxExecServerEnvironment(params) {
@@ -3323,52 +3257,6 @@ async function handleMessage(session, data) {
 	await session.handleRequest(parseRequest(buffer.toString("utf8")));
 }
 //#endregion
-//#region extensions/codex/src/app-server/provider-capabilities.ts
-function resolveOverriddenProviderWebSearchSupport(modelProviderOverride) {
-	const provider = modelProviderOverride?.trim().toLowerCase();
-	if (!provider) return;
-	return provider === "openai" ? "supported" : "unsupported";
-}
-async function readConfiguredProviderWebSearchSupport(params) {
-	return (await params.client.request("modelProvider/capabilities/read", {}, {
-		timeoutMs: params.timeoutMs,
-		signal: params.signal
-	})).webSearch ? "supported" : "unsupported";
-}
-async function resolveCodexProviderWebSearchSupportForClient(params) {
-	const overrideSupport = resolveOverriddenProviderWebSearchSupport(params.modelProviderOverride);
-	if (overrideSupport) return overrideSupport;
-	try {
-		return await readConfiguredProviderWebSearchSupport(params);
-	} catch {
-		return "unknown";
-	}
-}
-async function resolveCodexProviderWebSearchSupport(params) {
-	const overrideSupport = resolveOverriddenProviderWebSearchSupport(params.modelProviderOverride);
-	if (overrideSupport) return overrideSupport;
-	let client;
-	try {
-		client = await params.clientFactory({
-			startOptions: params.appServer.start,
-			...params.preparedAuth ? { preparedAuth: params.preparedAuth } : { authProfileId: params.authProfileId },
-			agentDir: params.agentDir,
-			config: params.config,
-			timeoutMs: params.appServer.requestTimeoutMs
-		});
-		return await resolveCodexProviderWebSearchSupportForClient({
-			client,
-			timeoutMs: params.appServer.requestTimeoutMs,
-			modelProviderOverride: params.modelProviderOverride,
-			signal: params.signal
-		});
-	} catch {
-		return "unknown";
-	} finally {
-		if (client) releaseLeasedSharedCodexAppServerClient(client);
-	}
-}
-//#endregion
 //#region extensions/codex/src/app-server/approval-bridge.ts
 /**
 * Bridges Codex app-server approval requests into OpenClaw policy hooks and
@@ -3413,6 +3301,8 @@ async function handleCodexAppServerApprovalRequest(params) {
 			resolvedOutcome = "approved-once";
 			resolvedMessage = "Codex app-server approval granted for this byte-bound command only.";
 		}
+		params.signal?.throwIfAborted();
+		if (resolvedOutcome !== "denied") params.paramsForRun.hostCapabilities.assertActive();
 		emitApprovalEvent(params.paramsForRun, {
 			phase: "resolved",
 			kind: context.kind,
@@ -3451,6 +3341,7 @@ async function handleCodexAppServerApprovalRequest(params) {
 			autoApprove: params.autoApprove,
 			signal: params.signal
 		});
+		params.signal?.throwIfAborted();
 		if (policyOutcome?.outcome === "denied") {
 			recordNativeToolFailureDisposition(params, context, policyOutcome.failureDisposition);
 			return await resolvePolicyApproval("denied", policyOutcome.reason);
@@ -3459,6 +3350,7 @@ async function handleCodexAppServerApprovalRequest(params) {
 		if (CONCRETE_TOOL_AUTO_APPROVAL_METHODS.has(params.method) && !readNetworkApprovalContext(requestParams) && params.autoApprove === true) return await resolvePolicyApproval("approved-session", "Codex app-server approval auto-approved by runtime policy.");
 		const requestResult = await requestPluginApproval({
 			hostCapabilities: params.paramsForRun.hostCapabilities,
+			signal: params.signal,
 			title: context.title,
 			description: context.description,
 			severity: context.severity,
@@ -3972,7 +3864,8 @@ function summarizeNetworkPolicyAmendments(value) {
 function sanitizePermissionHostValue(value) {
 	const withoutScheme = sanitizePermissionScalar(value).toLowerCase().replace(/^[a-z][a-z0-9+.-]*:\/\//, "");
 	const authority = withoutScheme.split(/[/?#]/, 1)[0] ?? withoutScheme;
-	return truncateCodexApprovalDisplayText(authority.includes("@") ? authority.slice(authority.lastIndexOf("@") + 1) : authority, PERMISSION_VALUE_MAX_LENGTH);
+	const withoutUserInfo = authority.includes("@") ? authority.slice(authority.lastIndexOf("@") + 1) : authority;
+	return truncateCodexApprovalDisplayText(withoutUserInfo, PERMISSION_VALUE_MAX_LENGTH);
 }
 function sanitizePermissionPathValue(value) {
 	return truncateCodexApprovalDisplayText(formatApprovalDisplayPath(sanitizePermissionScalar(value)), PERMISSION_VALUE_MAX_LENGTH);
@@ -4101,7 +3994,8 @@ function appendPreviewPart(source, part, separator) {
 }
 function sanitizeApprovalPreview(source, maxLength) {
 	if (!source || !source.value) return { omitted: false };
-	const sanitized = sanitizeCodexApprovalVisibleText(stripDanglingCodexApprovalTerminalSequence(source.value));
+	const rawPreview = stripDanglingCodexApprovalTerminalSequence(source.value);
+	const sanitized = sanitizeCodexApprovalVisibleText(rawPreview);
 	if (!sanitized) return { omitted: true };
 	return {
 		text: formatCodexDisplayText(truncateCodexApprovalDisplayText(sanitized, maxLength)),
@@ -4246,6 +4140,7 @@ async function routeCodexAppServerElicitationRequest(params) {
 	const requestTurnId = requestParams.turnId;
 	if (requestTurnId !== null && requestTurnId !== void 0 && requestTurnId !== params.turnId) return { kind: "not-mine" };
 	if (!((isJsonObject(requestParams["_meta"]) ? requestParams["_meta"] : void 0)?.[MCP_TOOL_APPROVAL_KIND_KEY] === MCP_TOOL_APPROVAL_KIND || params.computerUseMcpServerName !== void 0 && readNonBlankStringField(requestParams, "serverName") === params.computerUseMcpServerName)) return { kind: "not-mine" };
+	if (params.signal?.aborted) return handled(createCodexElicitationResponse("cancel"));
 	const pluginResolution = resolvePluginElicitation({
 		requestParams,
 		pluginAppPolicyContext: params.pluginAppPolicyContext
@@ -4270,16 +4165,63 @@ async function routeCodexAppServerElicitationRequest(params) {
 			signal: params.signal
 		}));
 	}
-	const approvalPrompt = readComputerUseApprovalElicitation(requestParams, params.computerUseMcpServerName) ?? readBridgeableApprovalElicitation(requestParams);
+	const computerUsePrompt = readComputerUseApprovalElicitation(requestParams, params.computerUseMcpServerName);
+	const approvalPrompt = computerUsePrompt ?? readBridgeableApprovalElicitation(requestParams);
 	if (!approvalPrompt) return handled(createCodexElicitationResponse("decline"));
+	let persistence;
+	if (!computerUsePrompt) {
+		const serverName = readNonBlankStringField(requestParams, "serverName");
+		const server = serverName ? params.paramsForRun.config?.mcp?.servers?.[serverName] : void 0;
+		const mode = serverName ? resolveProjectedMcpCodexToolApprovalMode(serverName, server ?? {}, params.projectedMcpServers?.[serverName]) : void 0;
+		if (!requiresMcpCodexToolApproval({
+			mode,
+			fullPermission: params.autoApproveMcpTools
+		})) {
+			params.paramsForRun.hostCapabilities.assertActive();
+			return handled(buildElicitationResponse(approvalPrompt, "approved-once"));
+		}
+		if (mode === "prompt") approvalPrompt.allowedDecisions = ["allow-once", "deny"];
+		else if (serverName && serverName !== CODEX_APPS_SERVER_NAME && Object.hasOwn(params.paramsForRun.config?.mcp?.servers ?? {}, serverName) && requestTurnId === params.turnId && readPersistHints(approvalPrompt.meta, "explicit").includes("always")) {
+			const resolveItem = () => {
+				const item = params.getActiveMcpToolCall?.(serverName);
+				return item?.server === serverName && matchesMcpApprovalDisplay(item, approvalPrompt.meta) ? item : void 0;
+			};
+			const item = resolveItem();
+			if (item) persistence = {
+				mcpTool: {
+					server: serverName,
+					tool: item.tool
+				},
+				toolCallId: item.id,
+				isMcpToolApprovalActive: () => {
+					const current = resolveItem();
+					return current?.id === item.id && current.tool === item.tool;
+				}
+			};
+		}
+	}
 	return handled(buildElicitationResponse(approvalPrompt, await requestPluginApprovalOutcome({
-		paramsForRun: params.paramsForRun,
+		hostCapabilities: params.paramsForRun.hostCapabilities,
 		title: approvalPrompt.title,
 		description: approvalPrompt.description,
 		allowedDecisions: approvalPrompt.allowedDecisions,
+		toolName: "codex_mcp_tool_approval",
+		...persistence,
 		signal: params.signal
 	})));
 }
+function matchesMcpApprovalDisplay(item, meta) {
+	if (!Object.hasOwn(meta, MCP_TOOL_APPROVAL_TOOL_PARAMS_DISPLAY_KEY)) return true;
+	const display = meta[MCP_TOOL_APPROVAL_TOOL_PARAMS_DISPLAY_KEY];
+	if (!Array.isArray(display)) return false;
+	const args = item.arguments;
+	return display.every((param) => {
+		if (!isJsonObject(param) || typeof param.name !== "string" || !isJsonObject(args)) return false;
+		if (!Object.hasOwn(args, param.name)) return false;
+		const value = args[param.name];
+		return typeof param.value !== "string" || param.value === (typeof value === "string" ? value : JSON.stringify(value));
+	});
+}
 function handled(response) {
 	return {
 		kind: "handled",
@@ -4395,14 +4337,14 @@ async function buildPluginPolicyElicitationResponse(params) {
 	const response = buildElicitationResponse(approvalPrompt, "approved-once");
 	if (response.action === "accept") {
 		if (mode === "allow") return response;
-		const outcome = await requestPluginApprovalOutcome({
-			paramsForRun: params.paramsForRun,
+		return buildElicitationResponse(approvalPrompt, await requestPluginApprovalOutcome({
+			hostCapabilities: params.paramsForRun.hostCapabilities,
 			title: approvalPrompt.title,
 			description: approvalPrompt.description,
 			allowedDecisions: allowedPluginPolicyApprovalDecisions(mode, approvalPrompt),
+			toolName: "codex_mcp_tool_approval",
 			signal: params.signal
-		});
-		return buildElicitationResponse(approvalPrompt, mode === "ask" && outcome === "approved-session" ? "approved-once" : outcome);
+		}));
 	}
 	logPluginElicitationDecline("unmappable_schema", params.requestParams);
 	return createCodexElicitationResponse("decline");
@@ -4437,15 +4379,16 @@ function readPluginApprovalElicitation(entry, requestParams) {
 		allowedDecisions: buildApprovalAllowedDecisions(requestedSchema, meta)
 	};
 }
-function buildApprovalAllowedDecisions(requestedSchema, meta) {
-	return canMapPersistentApproval(requestedSchema, meta) ? [
+function buildApprovalAllowedDecisions(requestedSchema, meta, allowSession = false) {
+	return canMapPersistentApproval(requestedSchema, meta, allowSession) ? [
 		"allow-once",
 		"allow-always",
 		"deny"
 	] : ["allow-once", "deny"];
 }
-function canMapPersistentApproval(requestedSchema, meta) {
+function canMapPersistentApproval(requestedSchema, meta, allowSession) {
 	const persistHints = readPersistHints(meta, "explicit");
+	if (allowSession) return choosePersistHint(persistHints) !== void 0;
 	if (persistHints.length > 0) return persistHints.includes("always");
 	const properties = isJsonObject(requestedSchema.properties) ? requestedSchema.properties : {};
 	return Object.entries(properties).some(([name, value]) => {
@@ -4470,16 +4413,20 @@ function readBridgeableApprovalElicitation(requestParams) {
 	const requestedSchema = requestParams.requestedSchema;
 	if (readNonBlankStringField(requestedSchema, "type") !== "object" || !isJsonObject(requestedSchema.properties)) return;
 	const title = sanitizeDisplayText(readNonBlankStringField(requestParams, "message") ?? "") || "Codex MCP tool approval";
+	const serverName = readNonBlankStringField(requestParams, "serverName");
 	return {
 		title,
 		description: buildApprovalDescription({
 			title,
 			meta: requestParams["_meta"],
 			requestedSchema,
-			serverName: sanitizeOptionalDisplayText(readNonBlankStringField(requestParams, "serverName"))
+			serverName: sanitizeOptionalDisplayText(serverName),
+			remedy: serverName ? formatMcpCodexApprovalRemedy(serverName) : void 0
 		}),
 		requestedSchema,
-		meta: requestParams["_meta"]
+		meta: requestParams["_meta"],
+		persistHintsMode: "explicit",
+		allowedDecisions: buildApprovalAllowedDecisions(requestedSchema, requestParams["_meta"], true)
 	};
 }
 function readComputerUseApprovalElicitation(requestParams, expectedServerName) {
@@ -4509,6 +4456,7 @@ function buildApprovalDescription(params) {
 		connectorName && `App: ${connectorName}`,
 		toolTitle && `Tool: ${toolTitle}`,
 		params.serverName && `MCP server: ${params.serverName}`,
+		params.remedy,
 		toolDescription
 	].filter((line) => Boolean(line));
 	const paramLines = readDisplayParamLines(params.meta);
@@ -4544,7 +4492,8 @@ function readDisplayParamLines(meta) {
 	return remaining > 0 ? [...lines, `- Additional parameters: ${remaining} more`] : lines;
 }
 function formatDisplayParamValue(value) {
-	return truncateCodexApprovalDisplayText(sanitizeDisplayText(typeof value === "string" ? value : formatDisplayJsonValue(value ?? null)), MAX_DISPLAY_PARAM_VALUE_LENGTH);
+	const formatted = typeof value === "string" ? value : formatDisplayJsonValue(value ?? null);
+	return truncateCodexApprovalDisplayText(sanitizeDisplayText(formatted), MAX_DISPLAY_PARAM_VALUE_LENGTH);
 }
 function formatDisplayJsonValue(value, depth = MAX_DISPLAY_VALUE_DEPTH) {
 	if (value === null) return "null";
@@ -4588,35 +4537,10 @@ function sanitizeDisplayText(value) {
 	const escaped = sanitized ? formatCodexDisplayText(sanitized) : "";
 	return clipped && escaped ? `${escaped}...` : escaped;
 }
-async function requestPluginApprovalOutcome(params) {
-	try {
-		const requestResult = await requestPluginApproval({
-			hostCapabilities: params.paramsForRun.hostCapabilities,
-			title: params.title,
-			description: params.description,
-			severity: "warning",
-			toolName: "codex_mcp_tool_approval",
-			allowedDecisions: params.allowedDecisions
-		});
-		const approvalId = requestResult?.id;
-		if (!approvalId) return "unavailable";
-		const approvalResult = approvalRequestExplicitlyUnavailable(requestResult) ? void 0 : await waitForPluginApprovalDecision({
-			hostCapabilities: params.paramsForRun.hostCapabilities,
-			approvalId,
-			signal: params.signal
-		});
-		if (params.signal?.aborted) return "cancelled";
-		if (approvalResult?.terminalReason === "timeout") return "timed-out";
-		return mapExecDecisionToOutcome(approvalResult?.decision);
-	} catch {
-		return params.signal?.aborted ? "cancelled" : "denied";
-	}
-}
 function buildElicitationResponse(approvalPrompt, outcome) {
 	const { requestedSchema, meta } = approvalPrompt;
 	if (outcome === "cancelled") return createCodexElicitationResponse("cancel");
-	if (outcome === "timed-out") return createCodexElicitationResponse("decline", null, { message: codexApprovalTimeoutText("other") });
-	if (outcome === "denied" || outcome === "unavailable") return createCodexElicitationResponse("decline");
+	if (outcome === "timed-out" || outcome === "denied" || outcome === "unavailable") return createCodexElicitationResponse("decline");
 	const content = buildAcceptedContent(approvalPrompt, outcome);
 	if (!content && !hasNoSchemaProperties(requestedSchema)) {
 		embeddedAgentLog.warn("codex MCP approval elicitation approved without a mappable response", {
@@ -4643,7 +4567,7 @@ function buildAcceptedContent(approvalPrompt, outcome) {
 			schema,
 			required: required.has(name)
 		};
-		const next = readApprovalFieldValue(property, outcome) ?? readPersistFieldValue(property, meta, outcome, approvalPrompt.persistHintsMode ?? "legacy") ?? readFallbackFieldValue(property, outcome);
+		const next = readApprovalFieldValue(property, outcome, choosePersistHint(readPersistHints(meta, approvalPrompt.persistHintsMode))) ?? readPersistFieldValue(property, meta, outcome, approvalPrompt.persistHintsMode ?? "legacy") ?? readFallbackFieldValue(property, outcome);
 		if (next === void 0) {
 			if (isApprovalField(property)) sawApprovalField = true;
 			if (property.required) return;
@@ -4654,15 +4578,14 @@ function buildAcceptedContent(approvalPrompt, outcome) {
 	}
 	return sawApprovalField ? content : void 0;
 }
-function readApprovalFieldValue(property, outcome) {
+function readApprovalFieldValue(property, outcome, persist) {
 	if (!isApprovalField(property)) return;
 	if (readNonBlankStringField(property.schema, "type") === "boolean") return true;
 	const options = readEnumOptions(property.schema);
 	if (options.length === 0) return;
-	const sessionChoice = options.find((option) => isSessionApprovalOption(option));
 	const acceptChoice = options.find((option) => isPositiveApprovalOption(option));
-	if (outcome === "approved-session") return sessionChoice?.value ?? acceptChoice?.value;
-	return acceptChoice?.value ?? sessionChoice?.value;
+	if (outcome === "approved-session") return options.find((option) => isPersistentApprovalOption(option, persist))?.value ?? acceptChoice?.value;
+	return acceptChoice?.value;
 }
 function readPersistFieldValue(property, meta, outcome, persistHintsMode) {
 	if (!isPersistField(property) || outcome !== "approved-session") return;
@@ -4741,9 +4664,9 @@ function isPositiveApprovalOption(option) {
 	const haystack = `${option.value} ${option.label}`.toLowerCase();
 	return /\b(allow|approve|accept|yes|continue|proceed|true)\b/.test(haystack);
 }
-function isSessionApprovalOption(option) {
+function isPersistentApprovalOption(option, persist) {
 	const haystack = `${option.value} ${option.label}`.toLowerCase();
-	return /\b(session|always|persistent)\b/.test(haystack) && /\b(allow|approve|accept)\b/.test(haystack);
+	return (persist === "always" ? /\b(always|persistent)\b|\bdon't ask me again\b/.test(haystack) : persist === "session" && /\bsession\b/.test(haystack)) && /\b(allow|approve|accept)\b/.test(haystack);
 }
 function readNonBlankStringField(record, key) {
 	const value = record?.[key];
@@ -4756,57 +4679,242 @@ function readFirstString$1(record, keys) {
 	}
 }
 //#endregion
-//#region extensions/codex/src/app-server/dynamic-tools.ts
-/**
-* Bridges OpenClaw runtime tools into Codex app-server dynamic tool specs and
-* tool-call responses.
-*/
-const INTERNAL_TOOL_EXECUTION_VALIDATION = Symbol.for("openclaw.internalToolExecutionValidation");
-const MAX_CODEX_DYNAMIC_TOOL_VALIDATION_ERRORS = 4;
-const MAX_CODEX_DYNAMIC_TOOL_VALIDATION_ERROR_CHARS = 160;
-const CODEX_DYNAMIC_TOOL_VALIDATION_TRUNCATED_SUFFIX = " [detail truncated]";
-function shouldValidateCodexDynamicToolInput(tool) {
-	return getPluginToolMeta(tool)?.mcp?.operation !== "tool";
-}
-function assertCodexDynamicToolInputMatchesSchema(params) {
-	const validation = validateJsonSchemaValue({
-		schema: params.schema,
-		cacheKey: `codex-dynamic-tool-input:${params.toolName}:${JSON.stringify(params.schema)}`,
-		value: params.value
-	});
-	if (validation.ok) return;
-	const visibleErrors = validation.errors.slice(0, MAX_CODEX_DYNAMIC_TOOL_VALIDATION_ERRORS);
-	const details = visibleErrors.map((error) => {
-		if (error.text.length <= MAX_CODEX_DYNAMIC_TOOL_VALIDATION_ERROR_CHARS) return error.text;
-		return `${error.text.slice(0, MAX_CODEX_DYNAMIC_TOOL_VALIDATION_ERROR_CHARS - 19)}${CODEX_DYNAMIC_TOOL_VALIDATION_TRUNCATED_SUFFIX}`;
-	}).join("; ");
-	const omitted = validation.errors.length - visibleErrors.length;
-	const omittedSuffix = omitted > 0 ? `; ${omitted} more violation(s) omitted` : "";
-	throw new Error(`Invalid arguments for tool "${params.toolName}": ${details}${omittedSuffix}.`);
-}
-function createCodexDynamicToolValidationControl(params) {
-	return {
-		[INTERNAL_TOOL_EXECUTION_VALIDATION]: true,
-		toolCallId: params.toolCallId,
-		validate: params.validate
-	};
-}
-function applyCurrentMessageProvider(toolName, args, currentProvider) {
-	const hasProvider = typeof args.provider === "string" && args.provider.trim().length > 0 ? true : typeof args.channel === "string" && args.channel.trim().length > 0;
-	const provider = currentProvider?.trim();
-	if (toolName !== "message" || hasProvider || !provider) return args;
-	return {
-		...args,
-		provider
-	};
-}
-function normalizeRouteToken(value) {
-	if (typeof value === "number") return Number.isFinite(value) ? String(value) : void 0;
-	const normalized = value?.trim().toLowerCase();
-	return normalized ? normalized : void 0;
-}
-function sourceRouteTokens(hookContext) {
-	const tokens = /* @__PURE__ */ new Set();
+//#region extensions/codex/src/app-server/dynamic-tool-catalog.ts
+/** Namespace attached to OpenClaw-owned dynamic tools exposed to Codex. */
+const CODEX_OPENCLAW_DYNAMIC_TOOL_NAMESPACE = "openclaw";
+const CODEX_DYNAMIC_TOOL_NAME_MAX_CHARS = 128;
+const CODEX_DYNAMIC_TOOL_NAME_PATTERN = /^[a-zA-Z0-9_-]+$/u;
+const ALWAYS_DIRECT_DYNAMIC_TOOL_NAMES = /* @__PURE__ */ new Set([
+	"agents_list",
+	"progress_card",
+	"sessions_spawn",
+	"sessions_yield"
+]);
+function createCodexDynamicToolSpecs(params) {
+	const directToolNames = /* @__PURE__ */ new Set([...ALWAYS_DIRECT_DYNAMIC_TOOL_NAMES, ...params.directToolNames ?? []]);
+	const specs = [];
+	const namespaceTools = [];
+	const directOnlyNamespaceTools = [];
+	const entries = params.loading === "direct" ? params.entries : params.entries.toSorted((left, right) => left.name.localeCompare(right.name));
+	for (const entry of entries) {
+		const functionSpec = createCodexDynamicToolFunctionSpec({ entry });
+		if (entry.name === "openclaw" && directToolNames.has(entry.name)) {
+			specs.push(functionSpec);
+			continue;
+		}
+		if (entry.tool.catalogMode === "direct-only") {
+			directOnlyNamespaceTools.push(functionSpec);
+			continue;
+		}
+		if (params.loading === "direct" || directToolNames.has(entry.name)) {
+			specs.push(functionSpec);
+			continue;
+		}
+		namespaceTools.push({
+			...functionSpec,
+			deferLoading: true
+		});
+	}
+	if (namespaceTools.length > 0) specs.push({
+		type: "namespace",
+		name: CODEX_OPENCLAW_DYNAMIC_TOOL_NAMESPACE,
+		description: "",
+		tools: namespaceTools
+	});
+	if (directOnlyNamespaceTools.length > 0) specs.push({
+		type: "namespace",
+		name: CODEX_OPENCLAW_DIRECT_DYNAMIC_TOOL_NAMESPACE,
+		description: "",
+		tools: directOnlyNamespaceTools
+	});
+	return specs;
+}
+function createCodexDynamicToolFunctionSpec(params) {
+	return {
+		type: "function",
+		name: params.entry.name,
+		description: params.entry.description,
+		inputSchema: params.entry.inputSchema
+	};
+}
+function projectCodexDynamicTools(tools) {
+	const projectedTools = [];
+	const quarantinedTools = [];
+	let length;
+	try {
+		length = tools.length;
+	} catch {
+		return {
+			tools: [],
+			quarantinedTools: [{
+				tool: "tool[0]",
+				violations: ["tool[0] is unreadable"]
+			}]
+		};
+	}
+	for (let toolIndex = 0; toolIndex < length; toolIndex += 1) {
+		let tool;
+		try {
+			tool = tools[toolIndex];
+		} catch {
+			quarantinedTools.push({
+				tool: `tool[${toolIndex}]`,
+				violations: [`tool[${toolIndex}] is unreadable`]
+			});
+			continue;
+		}
+		const descriptor = readCodexDynamicToolDescriptor(tool, toolIndex);
+		if (!descriptor.ok) {
+			quarantinedTools.push(descriptor.diagnostic);
+			continue;
+		}
+		const normalizedParameters = normalizeOpenAIStrictCompatSchema(descriptor.parameters);
+		const projection = projectRuntimeToolInputSchema(normalizedParameters ?? descriptor.parameters, `${descriptor.name}.inputSchema`);
+		if (projection.violations.length > 0) {
+			quarantinedTools.push({
+				tool: descriptor.name,
+				violations: projection.violations
+			});
+			continue;
+		}
+		if (!isRecord(projection.schema)) {
+			quarantinedTools.push({
+				tool: descriptor.name,
+				violations: [`${descriptor.name}.inputSchema must be a JSON object schema`]
+			});
+			continue;
+		}
+		projectedTools.push({
+			tool,
+			name: descriptor.name,
+			description: descriptor.description,
+			inputSchema: projection.schema
+		});
+	}
+	return {
+		tools: projectedTools,
+		quarantinedTools
+	};
+}
+function readCodexDynamicToolDescriptor(tool, toolIndex) {
+	const fallbackName = `tool[${toolIndex}]`;
+	let name;
+	try {
+		const rawName = tool.name;
+		if (typeof rawName !== "string" || !rawName) return {
+			ok: false,
+			diagnostic: {
+				tool: fallbackName,
+				violations: [`${fallbackName}.name must be a non-empty string`]
+			}
+		};
+		const trimmedName = rawName.trim();
+		let nameViolation;
+		if (!trimmedName) nameViolation = `${rawName}.name must not be empty`;
+		else if (trimmedName !== rawName) nameViolation = `${rawName}.name must not have leading or trailing whitespace`;
+		else if (!CODEX_DYNAMIC_TOOL_NAME_PATTERN.test(rawName)) nameViolation = `${rawName}.name must match ^[a-zA-Z0-9_-]+$`;
+		else if (rawName.length > CODEX_DYNAMIC_TOOL_NAME_MAX_CHARS) nameViolation = `${rawName}.name must be at most ${CODEX_DYNAMIC_TOOL_NAME_MAX_CHARS} characters`;
+		else if (rawName === "mcp" || rawName.startsWith("mcp__")) nameViolation = `${rawName}.name is reserved by Codex app-server`;
+		if (nameViolation) return {
+			ok: false,
+			diagnostic: {
+				tool: rawName,
+				violations: [nameViolation]
+			}
+		};
+		name = rawName;
+	} catch {
+		return {
+			ok: false,
+			diagnostic: {
+				tool: fallbackName,
+				violations: [`${fallbackName}.name is unreadable`]
+			}
+		};
+	}
+	let description;
+	try {
+		description = typeof tool.description === "string" ? tool.description : "";
+	} catch {
+		return {
+			ok: false,
+			diagnostic: {
+				tool: name,
+				violations: [`${name}.description is unreadable`]
+			}
+		};
+	}
+	let parameters;
+	try {
+		parameters = tool.parameters;
+	} catch {
+		return {
+			ok: false,
+			diagnostic: {
+				tool: name,
+				violations: [`${name}.inputSchema is unreadable`]
+			}
+		};
+	}
+	return {
+		ok: true,
+		name,
+		description,
+		parameters
+	};
+}
+//#endregion
+//#region extensions/codex/src/app-server/dynamic-tools.ts
+/**
+* Bridges OpenClaw runtime tools into Codex app-server dynamic tool specs and
+* tool-call responses.
+*/
+const INTERNAL_TOOL_EXECUTION_VALIDATION = Symbol.for("openclaw.internalToolExecutionValidation");
+const MAX_CODEX_DYNAMIC_TOOL_VALIDATION_ERRORS = 4;
+const MAX_CODEX_DYNAMIC_TOOL_VALIDATION_ERROR_CHARS = 160;
+const CODEX_DYNAMIC_TOOL_VALIDATION_TRUNCATED_SUFFIX = " [detail truncated]";
+function shouldValidateCodexDynamicToolInput(tool) {
+	return getPluginToolMeta(tool)?.mcp?.operation !== "tool";
+}
+function assertCodexDynamicToolInputMatchesSchema(params) {
+	const validation = validateJsonSchemaValue({
+		schema: params.schema,
+		cacheKey: `codex-dynamic-tool-input:${params.toolName}:${JSON.stringify(params.schema)}`,
+		value: params.value
+	});
+	if (validation.ok) return;
+	const visibleErrors = validation.errors.slice(0, MAX_CODEX_DYNAMIC_TOOL_VALIDATION_ERRORS);
+	const details = visibleErrors.map((error) => {
+		if (error.text.length <= MAX_CODEX_DYNAMIC_TOOL_VALIDATION_ERROR_CHARS) return error.text;
+		return `${error.text.slice(0, 141)}${CODEX_DYNAMIC_TOOL_VALIDATION_TRUNCATED_SUFFIX}`;
+	}).join("; ");
+	const omitted = validation.errors.length - visibleErrors.length;
+	const omittedSuffix = omitted > 0 ? `; ${omitted} more violation(s) omitted` : "";
+	throw new Error(`Invalid arguments for tool "${params.toolName}": ${details}${omittedSuffix}.`);
+}
+function createCodexDynamicToolValidationControl(params) {
+	return {
+		[INTERNAL_TOOL_EXECUTION_VALIDATION]: true,
+		toolCallId: params.toolCallId,
+		validate: params.validate
+	};
+}
+function applyCurrentMessageProvider(toolName, args, currentProvider) {
+	const hasProvider = typeof args.provider === "string" && args.provider.trim().length > 0 ? true : typeof args.channel === "string" && args.channel.trim().length > 0;
+	const provider = currentProvider?.trim();
+	if (toolName !== "message" || hasProvider || !provider) return args;
+	return {
+		...args,
+		provider
+	};
+}
+function normalizeRouteToken(value) {
+	if (typeof value === "number") return Number.isFinite(value) ? String(value) : void 0;
+	const normalized = value?.trim().toLowerCase();
+	return normalized ? normalized : void 0;
+}
+function sourceRouteTokens(hookContext) {
+	const tokens = /* @__PURE__ */ new Set();
 	const currentTarget = normalizeRouteToken(hookContext?.currentMessagingTarget);
 	const currentChannel = normalizeRouteToken(hookContext?.currentChannelId);
 	const currentProvider = normalizeRouteToken(hookContext?.currentChannelProvider);
@@ -4919,15 +5027,6 @@ function normalizeAcceptedSessionSpawn(result) {
 		childSessionKey
 	} : null;
 }
-/** Namespace attached to OpenClaw-owned dynamic tools exposed to Codex. */
-const CODEX_OPENCLAW_DYNAMIC_TOOL_NAMESPACE = "openclaw";
-const CODEX_DYNAMIC_TOOL_NAME_MAX_CHARS = 128;
-const CODEX_DYNAMIC_TOOL_NAME_PATTERN = /^[a-zA-Z0-9_-]+$/u;
-const ALWAYS_DIRECT_DYNAMIC_TOOL_NAMES = /* @__PURE__ */ new Set([
-	"agents_list",
-	"sessions_spawn",
-	"sessions_yield"
-]);
 const EXPLICIT_MESSAGE_PROVIDER_KEYS = ["channel", "provider"];
 const EXPLICIT_MESSAGE_TARGET_KEYS = [
 	"target",
@@ -4967,11 +5066,13 @@ function createCodexDynamicToolBridge(params) {
 	const toolResultMaxChars = typeof contextWindowTokens === "number" && Number.isFinite(contextWindowTokens) && contextWindowTokens > 0 ? Math.max(1, resolveLiveToolResultMaxChars({ contextWindowTokens })) : DEFAULT_MAX_LIVE_TOOL_RESULT_CHARS;
 	const availableProjection = projectCodexExecutableDynamicToolSurface(params.tools, params.hookContext);
 	const registeredProjection = params.registeredTools ? projectCodexDynamicTools(params.registeredTools) : availableProjection;
-	const availableTools = availableProjection.tools;
+	const inheritedSpecs = params.registeredSpecs ? structuredClone([...params.registeredSpecs]) : void 0;
+	const inheritedNames = inheritedSpecs ? new Set(flattenCodexDynamicToolFunctions(inheritedSpecs).map((tool) => tool.name)) : void 0;
+	const availableTools = availableProjection.tools.filter((entry) => !inheritedNames || inheritedNames.has(entry.name));
 	const quarantinedAvailableToolNames = new Set(availableProjection.quarantinedTools.map((tool) => tool.tool));
 	const registeredSpecTools = (params.registeredTools ? registeredProjection.tools : availableTools).filter((entry) => !quarantinedAvailableToolNames.has(entry.name));
 	const toolMap = new Map(availableTools.map((entry) => [entry.name, entry]));
-	const registeredToolNames = new Set(registeredSpecTools.map((entry) => entry.name));
+	const registeredToolNames = inheritedNames ?? new Set(registeredSpecTools.map((entry) => entry.name));
 	const quarantinedTools = dedupeQuarantinedDynamicTools([...availableProjection.quarantinedTools, ...registeredProjection.quarantinedTools]);
 	warnQuarantinedDynamicTools({
 		tools: quarantinedTools,
@@ -4987,6 +5088,8 @@ function createCodexDynamicToolBridge(params) {
 		messagingToolSentTargets: [],
 		messagingToolSourceReplyPayloads: [],
 		toolMediaUrls: [],
+		toolAutoDeliveryMediaUrls: [],
+		coreTtsToolResults: [],
 		toolAudioAsVoice: false,
 		acceptedSessionSpawns: [],
 		quarantinedTools
@@ -5002,16 +5105,23 @@ function createCodexDynamicToolBridge(params) {
 	};
 	const legacyExtensionRunner = createCodexAppServerToolResultExtensionRunner(toolResultHookContext);
 	const executionSnapshotStates = /* @__PURE__ */ new Map();
-	const directToolNames = /* @__PURE__ */ new Set([...ALWAYS_DIRECT_DYNAMIC_TOOL_NAMES, ...params.directToolNames ?? []]);
+	const directToolNames = params.directToolNames;
 	let readRemoteWorkspaceFile;
 	return {
 		availableTools: availableTools.map((entry) => entry.tool),
-		availableSpecs: createCodexDynamicToolSpecs({
+		availableSpecs: inheritedSpecs ? inheritedSpecs.flatMap((spec) => {
+			if (spec.type === "function") return toolMap.has(spec.name) ? [spec] : [];
+			const tools = spec.tools.filter((tool) => toolMap.has(tool.name));
+			return tools.length ? [{
+				...spec,
+				tools
+			}] : [];
+		}) : createCodexDynamicToolSpecs({
 			entries: availableTools,
 			loading: params.loading ?? "searchable",
 			directToolNames
 		}),
-		specs: createCodexDynamicToolSpecs({
+		specs: inheritedSpecs ?? createCodexDynamicToolSpecs({
 			entries: registeredSpecTools,
 			loading: params.loading ?? "searchable",
 			directToolNames
@@ -5200,13 +5310,17 @@ function createCodexDynamicToolBridge(params) {
 				const toolConfirmedSourceReply = params.hookContext?.sourceReplyDeliveryMode === "message_tool_only" && toolName === "message" && !resultIsError && (rawResult.terminate === true || result.terminate === true);
 				const confirmedSourceReply = params.hookContext?.sourceReplyDeliveryMode === "message_tool_only" && toolName === "message" && (toolConfirmedSourceReply || deliveredSourceReply || receiptConfirmedSourceReply);
 				const sourceReplyFinal = confirmedSourceReply ? executedArgs.final !== false : void 0;
+				const autoDeliveryTtsMediaUrls = getCoreTtsToolResultMediaUrls(rawResult);
 				collectToolTelemetry({
 					toolName,
 					args: executedArgs,
 					result,
 					mediaTrustResult: telemetryRawResult,
 					telemetry,
+					signal,
 					isError: resultIsError,
+					autoDeliveryTtsMediaUrls,
+					coreTtsToolResult: autoDeliveryTtsMediaUrls?.length ? rawResult : void 0,
 					messagingTarget: confirmedMessagingTarget,
 					sourceReplyFinal
 				});
@@ -5222,6 +5336,8 @@ function createCodexDynamicToolBridge(params) {
 					sideEffectEvidence: !replaySafe
 				});
 			} catch (error) {
+				const trustedNoStart = consumeTrustedToolNoStartError(error);
+				executionPrevented ||= trustedNoStart;
 				captureExecutionBoundary();
 				if (toolName === "computer" && params.computerContextEpoch?.frameToolCallId === call.callId) invalidateComputerFrame(params.computerContextEpoch);
 				const executionDisposition = getBeforeToolCallFailureDisposition(error) ?? (signal.aborted ? resolveCodexToolAbortTerminalReason(signal) : resolveToolExecutionErrorKind(error));
@@ -5238,13 +5354,6 @@ function createCodexDynamicToolBridge(params) {
 					toolCallOrdinal: options?.toolCallOrdinal
 				});
 				notifyAgentToolResult(options?.onAgentToolResult, toolName, failedResult, true);
-				collectToolTelemetry({
-					toolName,
-					args: executedArgs,
-					result: void 0,
-					telemetry,
-					isError: true
-				});
 				runAgentHarnessAfterToolCallHook({
 					toolName,
 					toolCallId: call.callId,
@@ -5339,182 +5448,6 @@ function wrapProjectedCodexDynamicTools(tools, hookContext) {
 		quarantinedTools
 	};
 }
-function createCodexDynamicToolSpecs(params) {
-	const specs = [];
-	const namespaceTools = [];
-	const directOnlyNamespaceTools = [];
-	const entries = params.loading === "direct" ? params.entries : params.entries.toSorted((left, right) => left.name.localeCompare(right.name));
-	for (const entry of entries) {
-		const functionSpec = createCodexDynamicToolFunctionSpec({ entry });
-		if (entry.name === "openclaw" && params.directToolNames.has(entry.name)) {
-			specs.push(functionSpec);
-			continue;
-		}
-		if (entry.tool.catalogMode === "direct-only") {
-			directOnlyNamespaceTools.push(functionSpec);
-			continue;
-		}
-		if (params.loading === "direct" || params.directToolNames.has(entry.name)) {
-			specs.push(functionSpec);
-			continue;
-		}
-		namespaceTools.push({
-			...functionSpec,
-			deferLoading: true
-		});
-	}
-	if (namespaceTools.length > 0) specs.push({
-		type: "namespace",
-		name: CODEX_OPENCLAW_DYNAMIC_TOOL_NAMESPACE,
-		description: "",
-		tools: namespaceTools
-	});
-	if (directOnlyNamespaceTools.length > 0) specs.push({
-		type: "namespace",
-		name: CODEX_OPENCLAW_DIRECT_DYNAMIC_TOOL_NAMESPACE,
-		description: "",
-		tools: directOnlyNamespaceTools
-	});
-	return specs;
-}
-function createCodexDynamicToolFunctionSpec(params) {
-	return {
-		type: "function",
-		name: params.entry.name,
-		description: params.entry.description,
-		inputSchema: params.entry.inputSchema
-	};
-}
-function projectCodexDynamicTools(tools) {
-	const projectedTools = [];
-	const quarantinedTools = [];
-	let length;
-	try {
-		length = tools.length;
-	} catch {
-		return {
-			tools: [],
-			quarantinedTools: [{
-				tool: "tool[0]",
-				violations: ["tool[0] is unreadable"]
-			}]
-		};
-	}
-	for (let toolIndex = 0; toolIndex < length; toolIndex += 1) {
-		let tool;
-		try {
-			tool = tools[toolIndex];
-		} catch {
-			quarantinedTools.push({
-				tool: `tool[${toolIndex}]`,
-				violations: [`tool[${toolIndex}] is unreadable`]
-			});
-			continue;
-		}
-		const descriptor = readCodexDynamicToolDescriptor(tool, toolIndex);
-		if (!descriptor.ok) {
-			quarantinedTools.push(descriptor.diagnostic);
-			continue;
-		}
-		const normalizedParameters = normalizeOpenAIToolSchemas({
-			provider: "openai",
-			modelApi: "openai-chatgpt-responses",
-			tools: [{ parameters: descriptor.parameters }]
-		})[0]?.parameters;
-		const projection = projectRuntimeToolInputSchema(normalizedParameters ?? descriptor.parameters, `${descriptor.name}.inputSchema`);
-		if (projection.violations.length > 0) {
-			quarantinedTools.push({
-				tool: descriptor.name,
-				violations: projection.violations
-			});
-			continue;
-		}
-		if (!isRecord(projection.schema)) {
-			quarantinedTools.push({
-				tool: descriptor.name,
-				violations: [`${descriptor.name}.inputSchema must be a JSON object schema`]
-			});
-			continue;
-		}
-		projectedTools.push({
-			tool,
-			name: descriptor.name,
-			description: descriptor.description,
-			inputSchema: projection.schema
-		});
-	}
-	return {
-		tools: projectedTools,
-		quarantinedTools
-	};
-}
-function readCodexDynamicToolDescriptor(tool, toolIndex) {
-	const fallbackName = `tool[${toolIndex}]`;
-	let name;
-	try {
-		const rawName = tool.name;
-		if (typeof rawName !== "string" || !rawName) return {
-			ok: false,
-			diagnostic: {
-				tool: fallbackName,
-				violations: [`${fallbackName}.name must be a non-empty string`]
-			}
-		};
-		const trimmedName = rawName.trim();
-		let nameViolation;
-		if (!trimmedName) nameViolation = `${rawName}.name must not be empty`;
-		else if (trimmedName !== rawName) nameViolation = `${rawName}.name must not have leading or trailing whitespace`;
-		else if (!CODEX_DYNAMIC_TOOL_NAME_PATTERN.test(rawName)) nameViolation = `${rawName}.name must match ^[a-zA-Z0-9_-]+$`;
-		else if (rawName.length > CODEX_DYNAMIC_TOOL_NAME_MAX_CHARS) nameViolation = `${rawName}.name must be at most ${CODEX_DYNAMIC_TOOL_NAME_MAX_CHARS} characters`;
-		else if (rawName === "mcp" || rawName.startsWith("mcp__")) nameViolation = `${rawName}.name is reserved by Codex app-server`;
-		if (nameViolation) return {
-			ok: false,
-			diagnostic: {
-				tool: rawName,
-				violations: [nameViolation]
-			}
-		};
-		name = rawName;
-	} catch {
-		return {
-			ok: false,
-			diagnostic: {
-				tool: fallbackName,
-				violations: [`${fallbackName}.name is unreadable`]
-			}
-		};
-	}
-	let description;
-	try {
-		description = typeof tool.description === "string" ? tool.description : "";
-	} catch {
-		return {
-			ok: false,
-			diagnostic: {
-				tool: name,
-				violations: [`${name}.description is unreadable`]
-			}
-		};
-	}
-	let parameters;
-	try {
-		parameters = tool.parameters;
-	} catch {
-		return {
-			ok: false,
-			diagnostic: {
-				tool: name,
-				violations: [`${name}.inputSchema is unreadable`]
-			}
-		};
-	}
-	return {
-		ok: true,
-		name,
-		description,
-		parameters
-	};
-}
 function warnQuarantinedDynamicTools(params) {
 	if (params.tools.length === 0) return;
 	const unique = /* @__PURE__ */ new Map();
@@ -5569,15 +5502,26 @@ function collectToolTelemetry(params) {
 		const response = normalizeHeartbeatToolResponse(params.result?.details);
 		if (response) params.telemetry.heartbeatToolResponse = response;
 	}
-	if (!params.isError && params.result) {
+	if (params.result && !params.signal.aborted) {
 		const media = extractToolResultMediaArtifact(params.result);
 		if (media) {
 			const mediaUrls = filterToolResultMediaUrls(params.toolName, media.mediaUrls, params.mediaTrustResult ?? params.result);
 			const seen = new Set(params.telemetry.toolMediaUrls);
-			for (const mediaUrl of mediaUrls) if (!seen.has(mediaUrl)) {
-				seen.add(mediaUrl);
-				params.telemetry.toolMediaUrls.push(mediaUrl);
+			const autoDeliveryMediaUrls = new Set(params.telemetry.toolAutoDeliveryMediaUrls);
+			const rawAutoDeliveryMediaUrls = new Set(params.autoDeliveryTtsMediaUrls);
+			let retainsCoreTtsMedia = false;
+			for (const mediaUrl of mediaUrls) {
+				if (!seen.has(mediaUrl)) {
+					seen.add(mediaUrl);
+					params.telemetry.toolMediaUrls.push(mediaUrl);
+				}
+				if (rawAutoDeliveryMediaUrls.has(mediaUrl)) {
+					autoDeliveryMediaUrls.add(mediaUrl);
+					retainsCoreTtsMedia = true;
+				} else autoDeliveryMediaUrls.delete(mediaUrl);
 			}
+			params.telemetry.toolAutoDeliveryMediaUrls = [...autoDeliveryMediaUrls];
+			if (retainsCoreTtsMedia && params.coreTtsToolResult && !params.telemetry.coreTtsToolResults.includes(params.coreTtsToolResult)) params.telemetry.coreTtsToolResults.push(params.coreTtsToolResult);
 			if (media.audioAsVoice) params.telemetry.toolAudioAsVoice = true;
 		}
 	}
@@ -5814,4 +5758,4 @@ function isCronAddAction(args) {
 	return typeof action === "string" && action.trim().toLowerCase() === "add";
 }
 //#endregion
-export { shouldRequireCodexSandboxExecServerEnvironment as C, CodexNativeToolLifecycleProjector as D, readBoundedCodexRemoteWorkspaceFile as E, shouldEnableCodexAppServerNativeToolSurface as S, filterCodexVisionTools as T, resolveCodexAppServerHookChannelId as _, emitDynamicToolStartedDiagnostic as a, resolveCodexNodePlacementToolConstructionPlan as b, resolveCodexProviderWebSearchSupport as c, releaseCodexSandboxExecServerEnvironment as d, buildDynamicTools as f, resolveCodexAppServerExecutionCwd as g, formatCodexDynamicToolBuildStageSummary as h, emitDynamicToolErrorDiagnostic as i, resolveCodexProviderWebSearchSupportForClient as l, disableCodexPluginThreadConfig as m, projectCodexExecutableDynamicTools as n, emitDynamicToolTerminalDiagnostic as o, createCodexDynamicToolBuildStageTracker as p, routeCodexAppServerElicitationRequest as r, handleCodexAppServerApprovalRequest as s, createCodexDynamicToolBridge as t, ensureCodexSandboxExecServerEnvironment as u, resolveCodexExternalSandboxPolicyForOpenClawSandbox as v, shouldWarnCodexDynamicToolBuildStageSummary as w, resolveCodexSandboxEnvironmentSelection as x, resolveCodexMessageToolProvider as y };
+export { filterCodexVisionTools as C, shouldWarnCodexDynamicToolBuildStageSummary as S, CodexNativeToolLifecycleProjector as T, resolveCodexMessageToolProvider as _, emitDynamicToolStartedDiagnostic as a, shouldEnableCodexAppServerNativeToolSurface as b, ensureCodexSandboxExecServerEnvironment as c, createCodexDynamicToolBuildStageTracker as d, disableCodexPluginThreadConfig as f, resolveCodexExternalSandboxPolicyForOpenClawSandbox as g, resolveCodexAppServerHookChannelId as h, emitDynamicToolErrorDiagnostic as i, releaseCodexSandboxExecServerEnvironment as l, resolveCodexAppServerExecutionCwd as m, projectCodexExecutableDynamicTools as n, emitDynamicToolTerminalDiagnostic as o, formatCodexDynamicToolBuildStageSummary as p, routeCodexAppServerElicitationRequest as r, handleCodexAppServerApprovalRequest as s, createCodexDynamicToolBridge as t, buildDynamicTools as u, resolveCodexNodePlacementToolConstructionPlan as v, readBoundedCodexRemoteWorkspaceFile as w, shouldRequireCodexSandboxExecServerEnvironment as x, resolveCodexSandboxEnvironmentSelection as y };