@openclaw/codex 2026.9.1-beta.1 → 2026.9.2

package/dist/{side-question-DjA_jsNe.js → side-question-B6DWAw1A.js}

@@ -1,19 +1,23 @@
-import { C as resolveCodexModelBackedReviewerPolicyContext, D as readCodexRequirementsToml, f as isCodexPairedNodeRemoteExecPlacementSandbox, h as readCodexPluginConfig, j as resolveOpenClawExecPolicyForCodexAppServer, m as isCodexSandboxExecServerEnabled, p as isCodexRemoteExecPlacementSandbox, r as resolveCodexAppServerHomeScope, u as shouldAutoApproveCodexAppServerApprovals, x as canUseCodexModelBackedApprovalsReviewerForModel } from "./config-giW8X0QA.js";
-import { F as isCodexAppServerApprovalRequest, K as createCodexElicitationResponse, R as isCodexAppServerIndeterminateRequestCancellationError, Y as ensureCodexAppServerClientRuntime, at as readRecentCodexRateLimits, f as releaseCodexAppServerClientLease, o as getLeasedSharedCodexAppServerClient, pt as resolveCodexAppServerPreparedAuthHandoff, vt as isJsonObject, x as withLeasedCodexAppServerClientStartSelectionRetry } from "./shared-client-DKz23hHY.js";
-import { d as sessionBindingIdentity } from "./session-binding-Bcynfd-_.js";
-import { d as unsubscribeCodexThreadBestEffort, h as isCodexNotificationForTurn, s as isCodexAlreadyTerminalInterruptError, u as retireUnsafeCodexTurnClientBestEffort } from "./attempt-client-cleanup-bfsmcQ6m.js";
-import { l as readCodexTurn, o as assertCodexTurnStartResponse, r as assertCodexThreadForkResponse, s as readCodexDynamicToolCallParams } from "./protocol-validators-VeJxxJ0U.js";
-import { B as resolveCodexAppServerRequestModelSelection, F as resolveCodexWebSearchPlan, H as resolveCodexBindingModelProviderFallback, M as buildCodexRuntimeThreadConfig, R as CODEX_NATIVE_PERSONALITY_NONE, T as resolveCodexToolAbortTerminalReason, U as resolveReasoningEffort, W as readCodexSupportedReasoningEfforts, Z as filterCodexDynamicTools, bt as mergeCodexThreadConfigs, c as buildCodexNativeHookRelayConfig, d as emitCodexNativePreToolUseFailureDiagnostic, h as handleDynamicToolCallWithTimeout, l as buildCodexNativeHookRelayDisabledConfig, mt as buildCodexPluginAppsConfigPatchFromPolicyContext, o as CODEX_NATIVE_HOOK_RELAY_EVENTS, rt as resolveCodexDynamicToolsLoading, y as resolveDynamicToolCallTimeoutMs, z as resolveCodexAppServerModelProvider } from "./thread-lifecycle-L7oEkTlq.js";
-import { n as formatCodexUsageLimitErrorMessage } from "./rate-limits-C5_D8Gmb.js";
-import { a as resolveCodexAppServerForModelProvider, i as resolveCodexSessionPermissionCwd, n as applyCodexSessionPermissionPolicy, r as resolveCodexEffectiveSessionPermissionPolicy, t as CODEX_SESSION_PERMISSION_EXEC_MODES } from "./session-permission-policy-BrNH1bjy.js";
-import { n as resolveCodexNativeExecutionBlock } from "./sandbox-guard-kuWTn9C5.js";
-import { n as resolveCodexBindingAppServerConnection, t as requireCodexSupervisionModelSelection } from "./binding-connection-BMvPX73o.js";
-import { C as shouldRequireCodexSandboxExecServerEnvironment, D as CodexNativeToolLifecycleProjector, S as shouldEnableCodexAppServerNativeToolSurface, T as filterCodexVisionTools, a as emitDynamicToolStartedDiagnostic, b as resolveCodexNodePlacementToolConstructionPlan, d as releaseCodexSandboxExecServerEnvironment, i as emitDynamicToolErrorDiagnostic, l as resolveCodexProviderWebSearchSupportForClient, o as emitDynamicToolTerminalDiagnostic, r as routeCodexAppServerElicitationRequest, s as handleCodexAppServerApprovalRequest, t as createCodexDynamicToolBridge, u as ensureCodexSandboxExecServerEnvironment, v as resolveCodexExternalSandboxPolicyForOpenClawSandbox, x as resolveCodexSandboxEnvironmentSelection, y as resolveCodexMessageToolProvider } from "./dynamic-tools-Dnlfa--w.js";
+import { l as sessionBindingIdentity } from "./session-binding-record-CyaXZvTe.js";
+import { A as resolveOpenClawExecPolicyForCodexAppServer, B as isJsonObject, D as isCodexSandboxExecServerEnabled, E as isCodexRemoteExecPlacementSandbox, O as readCodexPluginConfig, T as isCodexPairedNodeRemoteExecPlacementSandbox, d as shouldAutoApproveCodexAppServerApprovals, f as withMcpElicitationsApprovalPolicy, h as resolveCodexModelBackedReviewerPolicyContext, l as hasCodexMcpToolApprovalOverrides, m as canUseCodexModelBackedApprovalsReviewerForModel, r as resolveCodexAppServerHomeScope, y as readCodexRequirementsToml } from "./config-CyapYSji.js";
+import { B as isCodexAppServerIndeterminateRequestCancellationError, C as withLeasedCodexAppServerClientStartSelectionRetry, Kt as resolveCodexAppServerPreparedAuthHandoff, L as isCodexAppServerApprovalRequest, Lt as readRecentCodexRateLimits, Tt as ensureCodexAppServerClientRuntime, c as getLeasedSharedCodexAppServerClient, ct as createCodexElicitationResponse, et as assertCodexThreadForkResponse, it as readCodexDynamicToolCallParams, lt as handleDynamicToolCallWithTimeout, m as releaseCodexAppServerClientLease, ot as readCodexTurn, pt as resolveDynamicToolCallTimeoutMs, rt as assertCodexTurnStartResponse, yt as resolveCodexToolAbortTerminalReason } from "./shared-client-CKhX2kFt.js";
+import { l as resolveCodexSessionBinding } from "./session-binding-4Ki04sW-.js";
+import { d as unsubscribeCodexThreadBestEffort, h as isCodexNotificationForTurn, l as retireUnsafeCodexTurnClientBestEffort, o as interruptCodexTurnAndWaitBestEffort } from "./attempt-client-cleanup-Bp1ZOnk2.js";
+import { B as emitCodexNativePreToolUseFailureDiagnostic, Dt as refreshCodexPluginAppApprovalPolicy, E as resolveCodexAppServerRequestModelSelection, Et as mergeCodexThreadConfigs, I as buildCodexNativeHookRelayConfig, L as buildCodexNativeHookRelayDisabledConfig, N as CODEX_NATIVE_HOOK_RELAY_EVENTS, O as resolveCodexBindingModelProviderFallback, S as resolveCodexWebSearchPlan, T as resolveCodexAppServerModelProvider, a as readCodexSupportedReasoningEfforts, at as filterCodexDynamicTools, dt as resolveCodexDynamicToolsLoading, o as resolveCodexAppServerReasoningEffort, t as buildCodexTemporalAdditionalContext, v as buildCodexRuntimeThreadConfig, w as CODEX_NATIVE_PERSONALITY_NONE } from "./thread-lifecycle-DPK30jad.js";
+import { i as refreshCodexThreadPolicy, n as CodexThreadPolicyHandoffError, o as requireCodexSupervisionModelSelection, r as assertCodexSupervisionThreadLineage, s as resolveCodexBindingAppServerConnection } from "./thread-policy-CTalhWFy.js";
+import { s as resolveCodexNativeExecutionBlock } from "./request-C8H22rPi.js";
+import { n as formatCodexUsageLimitErrorMessage } from "./rate-limits-Fx_l4eNa.js";
+import { a as resolveCodexAppServerForModelProvider, i as resolveCodexSessionPermissionCwd, n as applyCodexSessionPermissionPolicy, r as resolveCodexEffectiveSessionPermissionPolicy, t as CODEX_SESSION_PERMISSION_EXEC_MODES } from "./session-permission-policy-BaueHmSj.js";
+import { C as shouldRequireCodexSandboxExecServerEnvironment, S as shouldEnableCodexAppServerNativeToolSurface, T as filterCodexVisionTools, a as emitDynamicToolStartedDiagnostic, b as resolveCodexNodePlacementToolConstructionPlan, c as ensureCodexSandboxExecServerEnvironment, d as CodexNativeToolLifecycleProjector, i as emitDynamicToolErrorDiagnostic, l as releaseCodexSandboxExecServerEnvironment, o as emitDynamicToolTerminalDiagnostic, r as routeCodexAppServerElicitationRequest, s as handleCodexAppServerApprovalRequest, t as createCodexDynamicToolBridge, v as resolveCodexExternalSandboxPolicyForOpenClawSandbox, x as resolveCodexSandboxEnvironmentSelection, y as resolveCodexMessageToolProvider } from "./dynamic-tools-BwpvTxaX.js";
+import { n as resolveCodexProviderWebSearchSupportForClient } from "./provider-capabilities-BpG9Ltc5.js";
 import { readStringField } from "openclaw/plugin-sdk/string-coerce-runtime";
-import { buildAgentHookContextChannelFields, embeddedAgentLog, formatErrorMessage, registerNativeHookRelay, resolveAgentDir, resolveAttemptSpawnWorkspaceDir, resolveModelAuthMode, resolveSandboxContext, resolveSessionAgentIds, supportsModelTools } from "openclaw/plugin-sdk/agent-harness-runtime";
 import { randomUUID } from "node:crypto";
+import { resolveSessionAgentIdsStrict } from "openclaw/plugin-sdk/agent-scope-runtime";
+import { buildAgentHookContextChannelFields, embeddedAgentLog, formatErrorMessage, registerNativeHookRelay, resolveAgentDir as resolveAgentDir$1, resolveAttemptSpawnWorkspaceDir, resolveModelAuthMode, resolveSandboxContext, supportsModelTools } from "openclaw/plugin-sdk/agent-harness-runtime";
+import { isDeepStrictEqual } from "node:util";
 import { resolveAgentWorkspaceDir } from "openclaw/plugin-sdk/agent-runtime";
 import { loadExecApprovals } from "openclaw/plugin-sdk/exec-approvals-runtime";
+import { loadCodexBundleMcpApprovalConfig, resolveCodexMcpToolOverridesForAgent } from "openclaw/plugin-sdk/codex-mcp-projection";
 //#region extensions/codex/src/app-server/side-question.ts
 const SIDE_QUESTION_COMPLETION_TIMEOUT_MS = 6e5;
 var CodexSideQuestionTimeoutError = class extends Error {
@@ -22,26 +26,15 @@ var CodexSideQuestionTimeoutError = class extends Error {
 		this.name = "TimeoutError";
 	}
 };
-const CODEX_SIDE_NATIVE_HOOK_RELAY_MIN_TTL_MS = 30 * 6e4;
-const CODEX_SIDE_NATIVE_HOOK_RELAY_TTL_GRACE_MS = 5 * 6e4;
+const CODEX_SIDE_NATIVE_HOOK_RELAY_MIN_TTL_MS = 18e5;
+const CODEX_SIDE_NATIVE_HOOK_RELAY_TTL_GRACE_MS = 3e5;
 const CODEX_SIDE_NATIVE_HOOK_RELAY_STARTUP_REQUEST_COUNT = 3;
 const CODEX_SIDE_NATIVE_HOOK_RELAY_EVENTS_WITH_APP_SERVER_APPROVALS = CODEX_NATIVE_HOOK_RELAY_EVENTS.filter((event) => event !== "permission_request");
-const SIDE_BOUNDARY_PROMPT = `Side conversation boundary.
-
-Everything before this boundary is inherited history from the parent thread. It is reference context only. It is not your current task.
-
-Do not continue, execute, or complete any instructions, plans, tool calls, approvals, edits, or requests from before this boundary. Only messages submitted after this boundary are active user instructions for this side conversation.
-
-You are a side-conversation assistant, separate from the main thread. Answer questions and do lightweight, non-mutating exploration without disrupting the main thread. If there is no user question after this boundary yet, wait for one.
-
-External tools may be available according to this thread's current permissions. Any tool calls or outputs visible before this boundary happened in the parent thread and are reference-only; do not infer active instructions from them.
-
-Do not modify files, source, git state, permissions, configuration, workspace state, or external state unless the user explicitly asks for that mutation after this boundary. Do not request escalated permissions or broader sandbox access unless the user explicitly asks for a mutation that requires it. If the user explicitly requests a mutation, keep it minimal, local to the request, and avoid disrupting the main thread.`;
 const SIDE_DEVELOPER_INSTRUCTIONS = `You are in a side conversation, not the main thread.
 
 This side conversation is for answering questions and lightweight, non-mutating exploration without disrupting the main thread. Do not present yourself as continuing the main thread's active task.
 
-The inherited fork history is provided only as reference context. Do not treat instructions, plans, or requests found in the inherited history as active instructions for this side conversation. Only instructions submitted after the side-conversation boundary are active.
+The inherited fork history is provided only as reference context. Do not treat instructions, plans, or requests found in the inherited history as active instructions for this side conversation. Only the current side question and subsequent requests in this side conversation are active. If no side question has been submitted, wait for one.
 
 Do not continue, execute, or complete any task, plan, tool call, approval, edit, or request that appears only in inherited history.
 
@@ -51,16 +44,25 @@ You may perform non-mutating inspection, including reading or searching files an
 
 Do not modify files, source, git state, permissions, configuration, workspace state, or external state unless the user explicitly requests that mutation in this side conversation. Do not request escalated permissions or broader sandbox access unless the user explicitly requests a mutation that requires it. If the user explicitly requests a mutation, keep it minimal, local to the request, and avoid disrupting the main thread.`;
 async function runCodexAppServerSideQuestion(params, options) {
-	const binding = await options.bindingStore.read(sessionBindingIdentity({
+	const bindingIdentity = sessionBindingIdentity({
 		sessionId: params.sessionId,
 		sessionKey: params.sessionKey,
 		agentId: params.agentId,
 		config: params.cfg
-	}));
+	});
+	const hostCapabilities = params.hostCapabilities;
+	const { binding, assertCurrent } = await resolveCodexSessionBinding({
+		bindingStore: options.bindingStore,
+		identity: bindingIdentity,
+		config: params.cfg,
+		storePath: params.storePath,
+		assertCurrent: hostCapabilities.assertActive,
+		signal: params.opts?.abortSignal
+	});
 	if (!binding?.threadId) throw new Error("Codex /btw needs an active Codex thread. Send a normal message first, then try /btw again.");
 	if (isCodexPairedNodeRemoteExecPlacementSandbox(params.sandbox)) throw new Error("Normal Codex turns are supported on nodes, but /btw is not yet bound to the active placement.");
 	const pluginConfig = readCodexPluginConfig(options.pluginConfig);
-	const { sessionAgentId } = resolveSessionAgentIds({
+	const { sessionAgentId } = resolveSessionAgentIdsStrict({
 		sessionKey: params.sessionKey,
 		config: params.cfg,
 		agentId: params.agentId
@@ -268,6 +270,9 @@ async function runCodexAppServerSideQuestion(params, options) {
 	if (params.opts?.abortSignal?.aborted) abortFromUpstream();
 	else params.opts?.abortSignal?.addEventListener("abort", abortFromUpstream, { once: true });
 	let childThreadId;
+	let pluginAppPolicyContext = binding.pluginAppPolicyContext;
+	let childClient;
+	let policyWriteUncertain = false;
 	let turnId;
 	let sandboxEnvironment;
 	let sandboxEnvironmentClient;
@@ -284,6 +289,7 @@ async function runCodexAppServerSideQuestion(params, options) {
 	const ensureSandboxEnvironment = async (targetClient) => {
 		if (!sandboxEnvironmentRequired || sandboxEnvironmentClient === targetClient) return;
 		await releaseSandboxEnvironment();
+		assertCurrent();
 		const environment = await ensureCodexSandboxExecServerEnvironment({
 			client: targetClient,
 			sandbox: params.sandbox ?? null,
@@ -302,7 +308,17 @@ async function runCodexAppServerSideQuestion(params, options) {
 		sandboxEnvironmentClient = targetClient;
 	};
 	try {
-		const approvalPolicy = appServer.approvalPolicy;
+		assertCurrent();
+		const autoApproveMcpTools = shouldAutoApproveCodexAppServerApprovals(appServer);
+		const projectedMcpServers = loadCodexBundleMcpApprovalConfig({
+			workspaceDir: agentWorkspaceDir,
+			cfg: params.cfg,
+			toolOverrides: resolveCodexMcpToolOverridesForAgent(params.cfg, {
+				agentId: sessionAgentId,
+				toolOverrides: params.sessionEntry.toolOverrides
+			})
+		});
+		const approvalPolicy = hasCodexMcpToolApprovalOverrides(params.cfg?.mcp?.servers, Object.keys(projectedMcpServers), projectedMcpServers) ? withMcpElicitationsApprovalPolicy(appServer.approvalPolicy) : appServer.approvalPolicy;
 		const sandbox = appServer.sandbox;
 		const { toolBridge, webSearchPlan } = await createCodexSideToolBridge({
 			params: effectiveParams,
@@ -340,7 +356,10 @@ async function runCodexAppServerSideQuestion(params, options) {
 					paramsForRun: sideRunParams,
 					threadId: childThreadId,
 					turnId,
-					pluginAppPolicyContext: binding.pluginAppPolicyContext,
+					autoApproveMcpTools,
+					projectedMcpServers,
+					getActiveMcpToolCall: (serverName) => nativeToolLifecycleProjector?.getActiveMcpToolCall(serverName),
+					pluginAppPolicyContext,
 					signal: runAbortController.signal
 				});
 				return approvalResult.kind === "handled" ? approvalResult.response : createCodexElicitationResponse("decline", null, { message: "OpenClaw Codex side questions do not support interactive MCP input." });
@@ -353,11 +372,7 @@ async function runCodexAppServerSideQuestion(params, options) {
 				threadId: childThreadId,
 				turnId,
 				nativeHookRelay,
-				autoApprove: shouldAutoApproveCodexAppServerApprovals({
-					approvalPolicy,
-					networkProxy: appServer.networkProxy,
-					sandbox
-				}),
+				autoApprove: autoApproveMcpTools,
 				signal: runAbortController.signal,
 				onNativeToolFailureDisposition: (itemId, disposition) => nativeToolLifecycleProjector?.recordApprovalFailureDisposition(itemId, disposition)
 			});
@@ -423,7 +438,7 @@ async function runCodexAppServerSideQuestion(params, options) {
 		const serviceTier = binding.serviceTier ?? appServer.serviceTier;
 		const nativeHookRelayEvents = resolveCodexSideNativeHookRelayEvents({
 			configuredEvents: options.nativeHookRelay?.events,
-			approvalPolicy
+			approvalPolicy: appServer.approvalPolicy
 		});
 		nativeHookRelay = options.nativeHookRelay ? registerCodexSideNativeHookRelay({
 			options: options.nativeHookRelay,
@@ -432,6 +447,8 @@ async function runCodexAppServerSideQuestion(params, options) {
 			sessionId: params.sessionId,
 			sessionKey: params.sessionKey,
 			config: params.cfg,
+			autoApproveMcpTools,
+			projectedMcpServers,
 			runId: sideRunParams.runId,
 			channelId: buildAgentHookContextChannelFields({
 				sessionKey: params.sessionKey,
@@ -440,10 +457,11 @@ async function runCodexAppServerSideQuestion(params, options) {
 				currentChannelId: params.currentChannelId
 			}).channelId,
 			requestTimeoutMs: appServer.requestTimeoutMs,
-			completionTimeoutMs: Math.max(appServer.turnCompletionIdleTimeoutMs, SIDE_QUESTION_COMPLETION_TIMEOUT_MS),
+			completionTimeoutMs: SIDE_QUESTION_COMPLETION_TIMEOUT_MS,
 			loopDetectionPreToolUseRelay: appServer.loopDetectionPreToolUseRelay,
 			signal: runAbortController.signal,
 			hostCapabilities: sideRunParams.hostCapabilities,
+			assertCurrent,
 			onPreToolUseFailure: (failure) => {
 				if (nativePreToolUseFailureFallbackActive) emitNativePreToolUseFailure(failure);
 				else if (nativeToolLifecycleProjector) nativeToolLifecycleProjector.recordPreToolUseFailure(failure, nativeToolRunWasAbortedBeforeCleanup);
@@ -460,15 +478,55 @@ async function runCodexAppServerSideQuestion(params, options) {
 			nativeCodeModeEnabled: nativeToolSurfaceEnabled,
 			nativeCodeModeOnlyEnabled: appServer.codeModeOnly
 		});
-		const threadConfig = mergeCodexThreadConfigs(nativeHookRelayConfig, runtimeThreadConfig, binding.pluginAppPolicyContext ? buildCodexPluginAppsConfigPatchFromPolicyContext(binding.pluginAppPolicyContext) : void 0, appServer.networkProxy?.configPatch) ?? runtimeThreadConfig;
-		const forkResponse = assertCodexThreadForkResponse(await withLeasedCodexAppServerClientStartSelectionRetry({
+		const sideThreadId = await withLeasedCodexAppServerClientStartSelectionRetry({
 			lease: clientLease,
 			options: clientOptions,
 			signal: runAbortController.signal,
-			run: async (forkClient, requestOptions) => {
+			run: async (forkClient, requestOptions) => options.bindingStore.withLease(bindingIdentity, async () => {
+				const assertCurrentBinding = () => {
+					assertCurrent();
+					runAbortController.signal.throwIfAborted();
+					if (!isDeepStrictEqual(options.bindingStore.read(bindingIdentity), binding)) throw new Error("Codex side-question binding changed before fork");
+				};
+				const currentRequestOptions = () => {
+					const scoped = requestOptions();
+					return {
+						...scoped,
+						assertCurrent: () => {
+							scoped.assertCurrent();
+							assertCurrentBinding();
+						}
+					};
+				};
+				assertCurrentBinding();
+				if (binding.connectionScope === "supervision") {
+					const { thread } = await forkClient.request("thread/read", {
+						threadId: binding.threadId,
+						includeTurns: false
+					}, currentRequestOptions());
+					assertCurrentBinding();
+					assertCodexSupervisionThreadLineage(binding, thread);
+				}
 				await ensureSandboxEnvironment(forkClient);
+				assertCurrentBinding();
 				const executionCwd = sandboxEnvironment?.cwd ?? cwd;
-				return await forkCodexSideThread(forkClient, {
+				let pluginAppsConfigPatch;
+				if (binding.pluginAppPolicyContext) {
+					const refreshed = await refreshCodexPluginAppApprovalPolicy({
+						policyContext: binding.pluginAppPolicyContext,
+						configCwd: executionCwd,
+						request: (method, requestParams) => {
+							assertCurrentBinding();
+							return forkClient.request(method, requestParams, currentRequestOptions());
+						}
+					}).finally(assertCurrentBinding);
+					pluginAppPolicyContext = refreshed.policyContext;
+					pluginAppsConfigPatch = refreshed.configPatch;
+					for (const diagnostic of refreshed.diagnostics) embeddedAgentLog.warn(diagnostic.message);
+				}
+				assertCurrentBinding();
+				const threadConfig = mergeCodexThreadConfigs(nativeHookRelayConfig, runtimeThreadConfig, pluginAppsConfigPatch, appServer.networkProxy?.configPatch) ?? runtimeThreadConfig;
+				const response = assertCodexThreadForkResponse(await forkCodexSideThread(forkClient, {
 					threadId: binding.threadId,
 					model: modelSelection.model,
 					...modelSelection.modelProvider ? { modelProvider: modelSelection.modelProvider } : {},
@@ -481,28 +539,52 @@ async function runCodexAppServerSideQuestion(params, options) {
 					config: threadConfig,
 					developerInstructions: SIDE_DEVELOPER_INSTRUCTIONS,
 					ephemeral: true,
+					excludeTurns: true,
 					threadSource: "user"
-				}, requestOptions);
-			},
+				}, currentRequestOptions()));
+				if (!response.thread.id.trim() || response.thread.id === binding.threadId) {
+					await retireUnsafeCodexTurnClientBestEffort(forkClient, "unsafe side child identity");
+					throw new Error("Codex side fork returned an unsafe child identity");
+				}
+				childThreadId = response.thread.id;
+				childClient = forkClient;
+				try {
+					assertCurrentBinding();
+					if (supervisionModelSelection && (response.model !== supervisionModelSelection.model || response.modelProvider !== supervisionModelSelection.modelProvider)) throw new Error("Codex supervised side thread did not preserve its native model and provider");
+					const scoped = requestOptions();
+					await refreshCodexThreadPolicy({
+						client: forkClient,
+						threadId: childThreadId,
+						developerInstructions: SIDE_DEVELOPER_INSTRUCTIONS,
+						...scoped,
+						signal: runAbortController.signal,
+						assertCurrent: () => {
+							assertCurrent();
+							runAbortController.signal.throwIfAborted();
+							scoped.assertCurrent();
+						}
+					});
+				} catch (error) {
+					policyWriteUncertain = error instanceof CodexThreadPolicyHandoffError && error.outcome === "unknown";
+					throw error instanceof CodexThreadPolicyHandoffError ? error : new CodexThreadPolicyHandoffError("not-written", error);
+				}
+				return response.thread.id;
+			}),
 			onClientChange: rebindClientHandlers
-		}));
-		childThreadId = forkResponse.thread.id;
-		if (supervisionModelSelection && (forkResponse.model !== supervisionModelSelection.model || forkResponse.modelProvider !== supervisionModelSelection.modelProvider)) throw new Error("Codex supervised side thread did not preserve its native model and provider");
-		await client.request("thread/inject_items", {
-			threadId: childThreadId,
-			items: [sideBoundaryPromptItem()]
-		}, {
-			timeoutMs: appServer.requestTimeoutMs,
-			signal: runAbortController.signal
 		});
-		const effort = usesSupervisionConnection ? void 0 : resolveReasoningEffort(params.resolvedThinkLevel ?? "off", modelSelection.model, readCodexSupportedReasoningEfforts(params.runtimeModel?.compat));
+		const effort = usesSupervisionConnection ? void 0 : resolveCodexAppServerReasoningEffort({
+			thinkLevel: params.resolvedThinkLevel ?? "off",
+			modelId: modelSelection.model,
+			supportedReasoningEfforts: readCodexSupportedReasoningEfforts(params.runtimeModel?.compat)
+		});
 		turnId = assertCodexTurnStartResponse(await client.request("turn/start", {
-			threadId: childThreadId,
+			threadId: sideThreadId,
 			input: [{
 				type: "text",
 				text: params.question.trim(),
 				text_elements: []
 			}],
+			additionalContext: buildCodexTemporalAdditionalContext(sideRunParams, { sessionStatusAvailable: toolBridge.availableTools.some((tool) => tool.name === "session_status") }),
 			...sandboxEnvironment ? {
 				cwd: sandboxEnvironment.cwd,
 				sandboxPolicy: resolveCodexExternalSandboxPolicyForOpenClawSandbox(params.sandbox ?? void 0),
@@ -524,16 +606,18 @@ async function runCodexAppServerSideQuestion(params, options) {
 			}
 		}, {
 			timeoutMs: appServer.requestTimeoutMs,
-			signal: runAbortController.signal
+			signal: runAbortController.signal,
+			assertCurrent
 		}).catch((error) => {
 			if (isCodexAppServerIndeterminateRequestCancellationError(error)) turnId = "";
 			throw error;
 		})).turn.id;
-		collector.setTurn(childThreadId, turnId);
+		assertCurrent();
+		collector.setTurn(sideThreadId, turnId);
 		nativeToolLifecycleProjector = new CodexNativeToolLifecycleProjector({
 			...sideRunParams,
 			agentId: sessionAgentId
-		}, childThreadId, turnId, { runAbortSignal: runAbortController.signal });
+		}, sideThreadId, turnId, { runAbortSignal: runAbortController.signal });
 		for (const failure of pendingNativePreToolUseFailures) nativeToolLifecycleProjector.recordPreToolUseFailure(failure);
 		pendingNativePreToolUseFailures.length = 0;
 		for (const notification of pendingNativeToolNotifications) nativeToolLifecycleProjector.handleNotification(notification);
@@ -542,13 +626,14 @@ async function runCodexAppServerSideQuestion(params, options) {
 		try {
 			text = await collector.wait({
 				signal: runAbortController.signal,
-				timeoutMs: Math.max(appServer.turnCompletionIdleTimeoutMs, SIDE_QUESTION_COMPLETION_TIMEOUT_MS)
+				timeoutMs: SIDE_QUESTION_COMPLETION_TIMEOUT_MS
 			});
 		} catch (error) {
 			if (error instanceof CodexSideQuestionTimeoutError && !runAbortController.signal.aborted) runAbortController.abort(error);
 			throw error;
 		}
 		const trimmed = text.trim();
+		assertCurrent();
 		if (!trimmed) throw new Error("Codex /btw completed without an answer.");
 		return { text: trimmed };
 	} finally {
@@ -560,13 +645,14 @@ async function runCodexAppServerSideQuestion(params, options) {
 			if (!runAbortController.signal.aborted) runAbortController.abort("codex_side_question_finished");
 			await Promise.allSettled(activeDynamicToolCalls);
 			try {
-				await cleanupCodexSideThread(client, {
+				await cleanupCodexSideThread(childClient ?? client, {
 					threadId: childThreadId,
 					turnId,
 					interrupt: !collector.completed,
 					timeoutMs: appServer.requestTimeoutMs
 				});
 			} finally {
+				if (policyWriteUncertain && childClient) await retireUnsafeCodexTurnClientBestEffort(childClient, "side policy handoff");
 				removeNotificationHandler();
 				try {
 					nativeToolLifecycleProjector?.finalizeActive(runWasAbortedBeforeCleanup);
@@ -597,6 +683,8 @@ function registerCodexSideNativeHookRelay(params) {
 		sessionId: params.sessionId,
 		...params.sessionKey ? { sessionKey: params.sessionKey } : {},
 		...params.config ? { config: params.config } : {},
+		autoApproveMcpTools: params.autoApproveMcpTools,
+		projectedMcpServers: params.projectedMcpServers,
 		runId: params.runId,
 		...params.channelId ? { channelId: params.channelId } : {},
 		allowedEvents: params.events,
@@ -608,7 +696,7 @@ function registerCodexSideNativeHookRelay(params) {
 		}),
 		signal: params.signal,
 		runBeforeToolCall: params.hostCapabilities.runBeforeToolCall,
-		assertActive: params.hostCapabilities.assertActive,
+		assertActive: params.assertCurrent,
 		onPreToolUseFailure: params.onPreToolUseFailure,
 		command: { timeoutMs: params.options.gatewayTimeoutMs }
 	});
@@ -694,15 +782,23 @@ async function createCodexSideToolBridge(input) {
 			workspaceDir: input.cwd
 		});
 		const toolConstructionPlan = resolveCodexNodePlacementToolConstructionPlan(sandbox, input.nativeToolSurfaceEnabled);
-		tools = filterCodexVisionTools(filterCodexDynamicTools(createOpenClawCodingTools({
+		const publishSideToolResult = input.params.opts?.onToolResult;
+		const questionPrompt = publishSideToolResult ? {
+			send: async (payload) => {
+				await publishSideToolResult(payload);
+			},
+			...input.params.messageChannel ? { messageChannel: input.params.messageChannel } : {}
+		} : void 0;
+		const allTools = createOpenClawCodingTools({
 			agentId: input.sessionAgentId,
+			requesterThinkingLevel: input.params.resolvedThinkLevel ?? "off",
 			sessionKey: sandboxSessionKey,
 			runSessionKey: input.params.sessionKey && input.params.sessionKey !== sandboxSessionKey ? input.params.sessionKey : void 0,
 			sessionId: input.params.sessionId,
 			exec: input.sessionPermissionPolicy && { mode: input.sessionPermissionPolicy.execMode },
 			sessionPermissionPolicy: input.sessionPermissionPolicy,
 			runId: input.runId,
-			agentDir: input.params.agentDir ?? resolveAgentDir(input.params.cfg ?? {}, input.sessionAgentId),
+			agentDir: input.params.agentDir ?? resolveAgentDir$1(input.params.cfg ?? {}, input.sessionAgentId),
 			workspaceDir: input.cwd,
 			spawnWorkspaceDir: resolveAttemptSpawnWorkspaceDir({
 				sandbox,
@@ -748,10 +844,13 @@ async function createCodexSideToolBridge(input) {
 			}).channelId,
 			sandbox,
 			...toolConstructionPlan ? { toolConstructionPlan } : {},
+			...questionPrompt ? { questionPrompt } : {},
 			emitBeforeToolCallDiagnostics: false,
 			modelHasVision: runtimeModel.input?.includes("image") ?? false,
 			requireExplicitMessageTarget: true
-		}), input.pluginConfig), {
+		});
+		const codexFilteredTools = filterCodexDynamicTools(allTools, input.pluginConfig);
+		tools = filterCodexVisionTools(codexFilteredTools, {
 			modelHasVision: runtimeModel.input?.includes("image") ?? false,
 			nativeImageInspectionEnabled: input.nativeToolSurfaceEnabled
 		});
@@ -811,26 +910,14 @@ function isMissingCodexParentThreadError(error) {
 	const message = formatErrorMessage(error);
 	return message.includes("no rollout found for thread id") || message.includes("includeTurns is unavailable before first user message");
 }
-function sideBoundaryPromptItem() {
-	return {
-		type: "message",
-		role: "user",
-		content: [{
-			type: "input_text",
-			text: SIDE_BOUNDARY_PROMPT
-		}]
-	};
-}
 async function cleanupCodexSideThread(client, params) {
 	if (!params.threadId) return;
-	if (params.interrupt && params.turnId !== void 0) try {
-		await client.request("turn/interrupt", {
+	if (params.interrupt && params.turnId !== void 0) {
+		if (!await interruptCodexTurnAndWaitBestEffort(client, {
 			threadId: params.threadId,
-			turnId: params.turnId
-		}, { timeoutMs: params.timeoutMs });
-	} catch (error) {
-		if (!isCodexAlreadyTerminalInterruptError(error)) {
-			embeddedAgentLog.debug("codex /btw side thread interrupt cleanup failed", { error });
+			turnId: params.turnId,
+			timeoutMs: params.timeoutMs
+		})) {
 			await retireUnsafeCodexTurnClientBestEffort(client, "side turn interrupt");
 			return;
 		}