@openclaw/codex 2026.9.1-beta.1 → 2026.9.2

package/dist/{dynamic-tools-Dnlfa--w.js → dynamic-tools-BwpvTxaX.js}

@@ -1,232 +1,43 @@
-import { h as readCodexPluginConfig, p as isCodexRemoteExecPlacementSandbox } from "./config-giW8X0QA.js";
-import { K as createCodexElicitationResponse, gt as CODEX_OPENCLAW_DIRECT_DYNAMIC_TOOL_NAMESPACE, p as releaseLeasedSharedCodexAppServerClient, vt as isJsonObject } from "./shared-client-DKz23hHY.js";
-import { E as itemStatus, F as readItem, b as auditNativeToolUnfinishedStatus, h as isCodexNotificationForTurn, v as auditNativeToolName, y as auditNativeToolTerminalStatus } from "./attempt-client-cleanup-bfsmcQ6m.js";
-import { l as readCodexTurn } from "./protocol-validators-VeJxxJ0U.js";
-import { $ as isForcedPrivateQaCodexRuntime, D as withDynamicToolExecutionState, E as createFailedDynamicToolResponse, F as resolveCodexWebSearchPlan, O as withDynamicToolTranscriptDetails, Q as filterCodexDynamicToolsForDisabledNativeSurface, T as resolveCodexToolAbortTerminalReason, Z as filterCodexDynamicTools, d as emitCodexNativePreToolUseFailureDiagnostic, nt as normalizeCodexDynamicToolName, tt as isSystemAgentOnlyCodexDynamicToolAllowlist } from "./thread-lifecycle-L7oEkTlq.js";
-import { r as sanitizeInlineImageDataUrl, t as invalidInlineImageText } from "./image-payload-sanitizer-CnfoUPCE.js";
-import { r as formatCodexDisplayText } from "./command-formatters-DEsIufkt.js";
-import { a as resolveCodexNodeExecToolOverrides, i as resolveCodexNativeExecutionPolicy } from "./sandbox-guard-kuWTn9C5.js";
-import { a as sanitizeCodexApprovalVisibleText, c as waitForPluginApprovalDecision, i as requestPluginApproval, n as codexApprovalTimeoutText, o as stripDanglingCodexApprovalTerminalSequence, r as mapExecDecisionToOutcome, s as truncateCodexApprovalDisplayText, t as approvalRequestExplicitlyUnavailable } from "./plugin-approval-roundtrip-bUm777tR.js";
+import { B as isJsonObject, E as isCodexRemoteExecPlacementSandbox, O as readCodexPluginConfig, R as CODEX_OPENCLAW_DIRECT_DYNAMIC_TOOL_NAMESPACE, z as flattenCodexDynamicToolFunctions } from "./config-CyapYSji.js";
+import { St as withDynamicToolTranscriptDetails, bt as createFailedDynamicToolResponse, ct as createCodexElicitationResponse, ot as readCodexTurn, xt as withDynamicToolExecutionState, yt as resolveCodexToolAbortTerminalReason } from "./shared-client-CKhX2kFt.js";
+import { E as itemStatus, L as readItem, T as itemName, b as auditNativeToolUnfinishedStatus, h as isCodexNotificationForTurn, k as shouldClearTerminalPresentationForNativeItem, v as auditNativeToolName, y as auditNativeToolTerminalStatus } from "./attempt-client-cleanup-Bp1ZOnk2.js";
+import { B as emitCodexNativePreToolUseFailureDiagnostic, S as resolveCodexWebSearchPlan, at as filterCodexDynamicTools, lt as isSystemAgentOnlyCodexDynamicToolAllowlist, ot as filterCodexDynamicToolsForDisabledNativeSurface, st as isForcedPrivateQaCodexRuntime, ut as normalizeCodexDynamicToolName } from "./thread-lifecycle-DPK30jad.js";
+import { l as resolveCodexNativeExecutionPolicy, u as resolveCodexNodeExecToolOverrides } from "./request-C8H22rPi.js";
+import { r as sanitizeInlineImageDataUrl, t as invalidInlineImageText } from "./image-payload-sanitizer-tupAr-2o.js";
+import { a as formatCodexDisplayText } from "./command-formatters-DSbGMXA0.js";
+import { a as CODEX_NODE_EXEC_DYNAMIC_TOOL_NAME, c as createNodeExecAliasDynamicTool, i as CODEX_GATEWAY_PROCESS_DYNAMIC_TOOL_NAME, l as isCodexDynamicToolExcluded, o as createGatewayExecProjection, r as CODEX_GATEWAY_EXEC_DYNAMIC_TOOL_NAME, s as createGatewayProcessProjection } from "./provider-capabilities-BpG9Ltc5.js";
+import { a as requestPluginApprovalOutcome, c as truncateCodexApprovalDisplayText, i as requestPluginApproval, l as waitForPluginApprovalDecision, n as codexApprovalTimeoutText, o as sanitizeCodexApprovalVisibleText, r as mapExecDecisionToOutcome, s as stripDanglingCodexApprovalTerminalSequence, t as approvalRequestExplicitlyUnavailable } from "./plugin-approval-roundtrip-aQVdyL5g.js";
 import { asNonArrayRecord, asOptionalRecord, isRecord, normalizeOptionalString, normalizeTrimmedStringList, readStringField } from "openclaw/plugin-sdk/string-coerce-runtime";
+import { createHash, randomUUID } from "node:crypto";
+import { asDateTimestampMs } from "openclaw/plugin-sdk/number-runtime";
+import { killProcessTree } from "openclaw/plugin-sdk/process-runtime";
 import { validateJsonSchemaValue } from "openclaw/plugin-sdk/json-schema-runtime";
 import path, { posix } from "node:path";
 import { createDeferred } from "openclaw/plugin-sdk/extension-shared";
-import { asDateTimestampMs } from "openclaw/plugin-sdk/number-runtime";
-import { HEARTBEAT_RESPONSE_TOOL_NAME, buildAgentHookContextChannelFields, buildEmbeddedAttemptToolRunContext, consumeAdjustedParamsForToolCall, consumePreExecutionBlockedToolCall, createAgentToolResultMiddlewareRunner, createCodexAppServerToolResultExtensionRunner, embeddedAgentLog, extractMessagingToolSend, extractMessagingToolSendResult, extractToolResultMediaArtifact, filterProviderNormalizableTools, filterToolResultMediaUrls, finalizeToolTerminalPresentation, formatApprovalDisplayPath, formatToolExecutionErrorMessage, getBeforeToolCallFailureDisposition, getChannelAgentToolMeta, getPluginToolMeta, getPluginToolSideEffectOwnerKey, hasNativeHookRelayInvocation, invokeNativeHookRelay, isDeliveredMessageToolOnlySourceReplyResult, isDeliveredMessagingToolResult, isHostScopedAgentToolActive, isMessagingTool, isMessagingToolSendAction, isReplaySafeToolCall, isSubagentSessionKey, isToolResultError, isToolWrappedWithBeforeToolCallHook, normalizeAgentRuntimeTools, normalizeHeartbeatToolResponse, projectRuntimeToolInputSchema, resolveAttemptSpawnWorkspaceDir, resolveModelAuthMode, resolveNativeHookRelayDeferredToolApproval, resolveToolExecutionErrorKind, resolveToolResultFailureKind, runAgentHarnessAfterToolCallHook, sanitizeToolResult, setBeforeToolCallDiagnosticsEnabled, supportsModelTools, wrapToolWithBeforeToolCallHook } from "openclaw/plugin-sdk/agent-harness-runtime";
-import { createHash, randomUUID } from "node:crypto";
+import { HEARTBEAT_RESPONSE_TOOL_NAME, buildAgentHookContextChannelFields, buildEmbeddedAttemptToolRunContext, consumeAdjustedParamsForToolCall, consumePreExecutionBlockedToolCall, createAgentToolResultMiddlewareRunner, createCodexAppServerToolResultExtensionRunner, embeddedAgentLog, extractMessagingToolSend, extractMessagingToolSendResult, extractToolResultMediaArtifact, filterProviderNormalizableTools, filterToolResultMediaUrls, finalizeAgentToolAvailability, finalizeToolTerminalPresentation, formatApprovalDisplayPath, formatToolExecutionErrorMessage, getBeforeToolCallFailureDisposition, getChannelAgentToolMeta, getPluginToolMeta, getPluginToolSideEffectOwnerKey, hasNativeHookRelayInvocation, invokeNativeHookRelay, isDeliveredMessageToolOnlySourceReplyResult, isDeliveredMessagingToolResult, isHostScopedAgentToolActive, isMessagingTool, isMessagingToolSendAction, isReplaySafeToolCall, isSubagentSessionKey, isToolResultError, isToolWrappedWithBeforeToolCallHook, normalizeAgentRuntimeTools, normalizeHeartbeatToolResponse, projectRuntimeToolInputSchema, resolveAttemptSpawnWorkspaceDir, resolveModelAuthMode, resolveNativeHookRelayDeferredToolApproval, resolveToolExecutionErrorKind, resolveToolResultFailureKind, runAgentHarnessAfterToolCallHook, sanitizeToolResult, setBeforeToolCallDiagnosticsEnabled, supportsModelTools, wrapToolWithBeforeToolCallHook } from "openclaw/plugin-sdk/agent-harness-runtime";
+import { isPathStrictlyInside, root } from "openclaw/plugin-sdk/file-access-runtime";
 import { resolveAgentDir as resolveAgentDir$1 } from "openclaw/plugin-sdk/agent-runtime";
 import { formatErrorMessage as formatErrorMessage$1, redactSensitiveText } from "openclaw/plugin-sdk/security-runtime";
-import { killProcessTree } from "openclaw/plugin-sdk/process-runtime";
 import { SsrFBlockedError, isBlockedHostnameOrIp } from "openclaw/plugin-sdk/ssrf-runtime";
 import { spawn } from "node:child_process";
+import { once } from "node:events";
 import { coerceErrorMessage } from "openclaw/plugin-sdk/error-runtime";
 import { DEFAULT_MAX_LIVE_TOOL_RESULT_CHARS, estimateToolResultTextChars, resolveLiveToolResultMaxChars, sliceToolResultTextToBudget, sliceUtf16Safe, truncateUtf16Safe } from "openclaw/plugin-sdk/text-utility-runtime";
-import { once } from "node:events";
+import { emitTrustedDiagnosticEvent } from "openclaw/plugin-sdk/diagnostic-runtime";
 import { isIP } from "node:net";
 import { WebSocketServer } from "ws";
-import { fileURLToPath, pathToFileURL } from "node:url";
 import { expectDefined } from "openclaw/plugin-sdk/expect-runtime";
 import { redactToolPayloadText } from "openclaw/plugin-sdk/logging-core";
-import { isPathStrictlyInside, root } from "openclaw/plugin-sdk/file-access-runtime";
-import { runWithCronCreatorAuthorityCapabilityResolver } from "openclaw/plugin-sdk/codex-mcp-projection";
-import { emitTrustedDiagnosticEvent } from "openclaw/plugin-sdk/diagnostic-runtime";
+import { formatMcpCodexApprovalRemedy, requiresMcpCodexToolApproval, resolveCodexScheduledToolProjectionFactory, resolveProjectedMcpCodexToolApprovalMode, runWithCronCreatorAuthorityCapabilityResolver } from "openclaw/plugin-sdk/codex-mcp-projection";
 import { buildRemoteCommand, isToolAllowed, sanitizeEnvVars } from "openclaw/plugin-sdk/sandbox";
+import { fileURLToPath, pathToFileURL } from "node:url";
 import { saveMediaBuffer } from "openclaw/plugin-sdk/media-store";
 import { getMediaDir } from "openclaw/plugin-sdk/media-runtime";
-import { normalizeOpenAIToolSchemas } from "openclaw/plugin-sdk/provider-tools";
-//#region extensions/codex/src/app-server/event-projector-native-tool-lifecycle.ts
-/** Projects metadata-only lifecycle diagnostics for native tool items. */
-var CodexNativeToolLifecycleProjector = class {
-	constructor(context, threadId, turnId, options = {}) {
-		this.context = context;
-		this.threadId = threadId;
-		this.turnId = turnId;
-		this.options = options;
-		this.startedAtByItem = /* @__PURE__ */ new Map();
-		this.activeItems = /* @__PURE__ */ new Map();
-		this.webSearchCompletionByItem = /* @__PURE__ */ new Map();
-		this.completedItemIds = /* @__PURE__ */ new Set();
-		this.approvalFailureDispositionByItem = /* @__PURE__ */ new Map();
-		this.preToolUseFailureByItem = /* @__PURE__ */ new Map();
-		this.finalized = false;
-	}
-	handleNotification(notification) {
-		const params = isJsonObject(notification.params) ? notification.params : void 0;
-		if (!params || !isCodexNotificationForTurn(params, this.threadId, this.turnId)) return;
-		if (notification.method === "turn/completed") {
-			const turn = readCodexTurn(params.turn);
-			if (!turn || turn.id !== this.turnId) return;
-			for (const item of turn.items ?? []) this.recordSnapshotItem(item);
-			return;
-		}
-		if (notification.method === "rawResponseItem/completed") {
-			const item = isJsonObject(params.item) ? params.item : void 0;
-			if (item) this.recordRawWebSearchResult(item);
-			return;
-		}
-		if (notification.method !== "item/started" && notification.method !== "item/completed") return;
-		const item = readItem(params.item);
-		if (!item) return;
-		this.recordItem({
-			phase: notification.method === "item/started" ? "start" : "result",
-			item,
-			sourceTimestampMs: asDateTimestampMs(notification.method === "item/started" ? params.startedAtMs : params.completedAtMs)
-		});
-	}
-	recordItem(params) {
-		const toolName = auditNativeToolName(params.item);
-		if (!toolName || this.completedItemIds.has(params.item.id)) return;
-		if (params.phase === "start") {
-			this.recordStarted(params.item.id, toolName, auditNativeToolUnfinishedStatus(params.item), params.sourceTimestampMs);
-			return;
-		}
-		if (params.item.type === "webSearch") {
-			this.webSearchCompletionByItem.set(params.item.id, {
-				runWasAborted: this.options.runAbortSignal?.aborted === true,
-				sourceTimestampMs: params.sourceTimestampMs
-			});
-			return;
-		}
-		const itemDurationMs = typeof params.item.durationMs === "number" ? params.item.durationMs : void 0;
-		this.recordTerminal(params.item.id, toolName, auditNativeToolTerminalStatus(params.item), {
-			itemDurationMs,
-			sourceTimestampMs: params.sourceTimestampMs
-		});
-	}
-	recordApprovalFailureDisposition(toolCallId, disposition) {
-		if (!this.completedItemIds.has(toolCallId)) this.approvalFailureDispositionByItem.set(toolCallId, disposition);
-	}
-	recordPreToolUseFailure(failure, runWasAborted = this.options.runAbortSignal?.aborted === true) {
-		if (this.completedItemIds.has(failure.toolCallId)) return;
-		const record = {
-			failure,
-			terminalReason: runWasAborted && this.options.runAbortSignal ? resolveCodexToolAbortTerminalReason(this.options.runAbortSignal) : failure.disposition
-		};
-		if (this.finalized) {
-			this.completedItemIds.add(failure.toolCallId);
-			this.emitPreToolUseFailure(record, failure.toolName, failure.durationMs);
-			return;
-		}
-		this.preToolUseFailureByItem.set(failure.toolCallId, record);
-	}
-	recordRawWebSearchResult(item) {
-		if (readStringField(item, "type") !== "web_search_call") return;
-		const toolCallId = readStringField(item, "id");
-		if (!toolCallId || this.completedItemIds.has(toolCallId)) return;
-		const toolName = "web_search";
-		this.recordStarted(toolCallId, toolName, "unknown");
-		const rawStatus = readStringField(item, "status");
-		if (rawStatus === "in_progress" || rawStatus === "running") return;
-		const status = rawStatus === "completed" ? "completed" : rawStatus === "cancelled" ? "cancelled" : rawStatus === "failed" || rawStatus === "error" || rawStatus === "incomplete" ? "failed" : "unknown";
-		this.recordTerminal(toolCallId, toolName, status, { sourceTimestampMs: this.webSearchCompletionByItem.get(toolCallId)?.sourceTimestampMs });
-	}
-	recordTerminal(toolCallId, toolName, status, options = {}) {
-		const runWasAborted = options.runWasAborted ?? this.options.runAbortSignal?.aborted === true;
-		const preToolUseFailure = this.preToolUseFailureByItem.get(toolCallId);
-		this.preToolUseFailureByItem.delete(toolCallId);
-		const approvalFailureDisposition = this.approvalFailureDispositionByItem.get(toolCallId);
-		this.approvalFailureDispositionByItem.delete(toolCallId);
-		this.completedItemIds.add(toolCallId);
-		this.activeItems.delete(toolCallId);
-		this.webSearchCompletionByItem.delete(toolCallId);
-		const startedAt = this.startedAtByItem.get(toolCallId);
-		this.startedAtByItem.delete(toolCallId);
-		const endedAt = options.sourceTimestampMs ?? Date.now();
-		const durationMs = options.itemDurationMs ?? (startedAt === void 0 ? 0 : Math.max(0, endedAt - startedAt));
-		if (preToolUseFailure) {
-			this.emitPreToolUseFailure(preToolUseFailure, toolName, durationMs, options.sourceTimestampMs);
-			return;
-		}
-		const terminalEvent = approvalFailureDisposition ? {
-			type: "tool.execution.error",
-			durationMs,
-			errorCategory: "codex_native_tool_approval",
-			terminalReason: approvalFailureDisposition
-		} : status === "blocked" ? {
-			type: "tool.execution.blocked",
-			reason: "codex_native_tool_blocked",
-			deniedReason: "codex_native_tool_blocked"
-		} : status === "failed" || status === "cancelled" || status === "unknown" ? {
-			type: "tool.execution.error",
-			durationMs,
-			errorCategory: status === "unknown" ? "codex_native_tool_outcome_unknown" : status === "cancelled" ? "aborted" : "codex_native_tool_error",
-			...status === "unknown" ? { errorCode: "tool_outcome_unknown" } : {},
-			terminalReason: status === "unknown" ? "failed" : runWasAborted && this.options.runAbortSignal ? resolveCodexToolAbortTerminalReason(this.options.runAbortSignal) : status === "cancelled" ? "cancelled" : "failed"
-		} : {
-			type: "tool.execution.completed",
-			durationMs
-		};
-		emitTrustedDiagnosticEvent({
-			...this.buildBase(toolCallId, toolName),
-			...terminalEvent,
-			...options.sourceTimestampMs !== void 0 ? { sourceTimestampMs: options.sourceTimestampMs } : {}
-		});
-	}
-	finalizeActive(runWasAborted = this.options.runAbortSignal?.aborted === true) {
-		this.finalized = true;
-		for (const [toolCallId, { toolName, unfinishedStatus }] of this.activeItems) {
-			const webSearchCompletion = this.webSearchCompletionByItem.get(toolCallId);
-			const itemRunWasAborted = webSearchCompletion ? webSearchCompletion.runWasAborted : runWasAborted;
-			this.recordTerminal(toolCallId, toolName, unfinishedStatus, {
-				runWasAborted: itemRunWasAborted,
-				sourceTimestampMs: webSearchCompletion?.sourceTimestampMs
-			});
-		}
-		for (const [toolCallId, record] of this.preToolUseFailureByItem) if (!this.completedItemIds.has(toolCallId)) this.recordTerminal(toolCallId, record.failure.toolName, "failed", { itemDurationMs: record.failure.durationMs });
-		this.activeItems.clear();
-		this.webSearchCompletionByItem.clear();
-		this.approvalFailureDispositionByItem.clear();
-		this.preToolUseFailureByItem.clear();
-	}
-	emitPreToolUseFailure(record, toolName, durationMs, sourceTimestampMs) {
-		emitCodexNativePreToolUseFailureDiagnostic({
-			agentId: this.context.agentId,
-			sessionId: this.context.sessionId,
-			sessionKey: this.context.sessionKey,
-			runId: this.context.runId,
-			failure: {
-				...record.failure,
-				toolName,
-				durationMs
-			},
-			terminalReason: record.terminalReason,
-			sourceTimestampMs
-		});
-	}
-	recordSnapshotItem(item) {
-		if (!auditNativeToolName(item) || this.completedItemIds.has(item.id) || itemStatus(item) === "running") return;
-		const toolName = auditNativeToolName(item);
-		if (!toolName) return;
-		this.recordStarted(item.id, toolName, auditNativeToolUnfinishedStatus(item));
-		this.recordItem({
-			phase: "result",
-			item
-		});
-	}
-	recordStarted(toolCallId, toolName, unfinishedStatus, sourceTimestampMs) {
-		if (this.activeItems.has(toolCallId)) return;
-		this.startedAtByItem.set(toolCallId, sourceTimestampMs ?? Date.now());
-		this.activeItems.set(toolCallId, {
-			toolName,
-			unfinishedStatus
-		});
-		emitTrustedDiagnosticEvent({
-			type: "tool.execution.started",
-			...this.buildBase(toolCallId, toolName),
-			...sourceTimestampMs !== void 0 ? { sourceTimestampMs } : {}
-		});
-	}
-	buildBase(toolCallId, toolName) {
-		return {
-			agentId: this.context.agentId,
-			runId: this.context.runId,
-			sessionId: this.context.sessionId,
-			sessionKey: this.context.sessionKey,
-			toolName,
-			toolCallId
-		};
-	}
-};
+import { consumeTrustedToolNoStartError, copyInternalToolResultState, getCoreTtsToolResultMediaUrls } from "openclaw/plugin-sdk/agent-harness-tool-runtime";
+import { normalizeOpenAIStrictCompatSchema } from "openclaw/plugin-sdk/provider-tools";
+//#region extensions/codex/src/app-server/dynamic-tool-build-state.ts
+/** Mutable dependency seam shared by dynamic-tool construction and its behavioral tests. */
+const dynamicToolBuildState = {};
 //#endregion
 //#region extensions/codex/src/app-server/remote-workspace-path.ts
 /** Projects a gateway workspace path into the remote Codex execution workspace. */
@@ -276,357 +87,6 @@ function joinRemoteWorkspacePath(remoteRoot, suffix) {
 	return remoteRoot.endsWith("/") ? `${remoteRoot}${suffix}` : `${remoteRoot}/${suffix}`;
 }
 //#endregion
-//#region extensions/codex/src/app-server/remote-workspace-media.ts
-const REMOTE_WORKSPACE_MEDIA_TIMEOUT_MS = 6e4;
-const REMOTE_WORKSPACE_MEDIA_MAX_BYTES = 64 * 1024 * 1024;
-const REMOTE_WORKSPACE_MEDIA_MAX_ATTACHMENTS = 16;
-const CODEX_REMOTE_MEDIA_CHUNK_BYTES = 512 * 1024;
-const CODEX_REMOTE_COMMAND_DEFAULT_OUTPUT_BYTES = 1024 * 1024;
-const CODEX_BOUNDED_REMOTE_FILE_READER = [
-	"try{",
-	"const fs=require(\"node:fs\");",
-	"const path=require(\"node:path\");",
-	"const file=process.argv[1];",
-	"const max=Number(process.argv[2]);",
-	"const offset=Number(process.argv[3]);",
-	"const chunk=Number(process.argv[4]);",
-	"const workspace=process.argv[5];",
-	"if(!Number.isSafeInteger(max)||max<0)throw Error(\"invalid media byte limit\");",
-	"if(!Number.isSafeInteger(offset)||offset<0||!Number.isSafeInteger(chunk)||chunk<=0)throw Error(\"invalid media chunk\");",
-	"if(fs.lstatSync(file).isSymbolicLink())throw Error(\"symbolic links are not allowed\");",
-	"const noFollow=fs.constants.O_NOFOLLOW??0;",
-	"const fd=fs.openSync(file,fs.constants.O_RDONLY|noFollow);",
-	"try{",
-	"const before=fs.fstatSync(fd);",
-	"if(!before.isFile())throw Error(\"not a regular file\");",
-	"if(workspace){",
-	"const descriptor=process.platform===\"linux\"?fs.realpathSync(`/proc/self/fd/${fd}`):fs.realpathSync(file);",
-	"const relative=path.relative(fs.realpathSync(workspace),descriptor);",
-	"if(!relative||relative===\"..\"||relative.startsWith(`..${path.sep}`)||path.isAbsolute(relative))throw Error(\"file escapes remote workspace\");",
-	"const verified=fs.statSync(descriptor);",
-	"if(verified.dev!==before.dev||verified.ino!==before.ino)throw Error(\"file changed while being opened\");",
-	"}",
-	"if(before.size>max)throw Error(`file exceeds limit of ${max} bytes`);",
-	"if(offset>before.size)throw Error(\"file changed while being read\");",
-	"const expected=Math.min(chunk,before.size-offset);",
-	"const buffer=Buffer.allocUnsafe(expected);",
-	"let total=0;",
-	"while(total<buffer.length){",
-	"const count=fs.readSync(fd,buffer,total,buffer.length-total,offset+total);",
-	"if(count===0)break;total+=count;",
-	"}",
-	"if(total!==expected)throw Error(\"file changed while being read\");",
-	"const after=fs.fstatSync(fd);",
-	"const revision=stat=>[stat.dev,stat.ino,stat.size,stat.mtimeMs,stat.ctimeMs].join(\":\");",
-	"if(!after.isFile()||revision(after)!==revision(before))throw Error(\"file changed while being read\");",
-	"process.stdout.write(JSON.stringify({dataBase64:buffer.toString(\"base64\"),size:before.size,revision:revision(before)}));",
-	"}finally{fs.closeSync(fd)}",
-	"}catch(error){process.stderr.write(error instanceof Error?error.message:String(error));process.exitCode=1}"
-].join("");
-const MESSAGE_MEDIA_KEYS = [
-	"media",
-	"mediaUrl",
-	"media_url",
-	"path",
-	"filePath",
-	"fileUrl",
-	"imageUrl",
-	"image_url"
-];
-const MESSAGE_MEDIA_ARRAY_KEYS = [
-	"mediaUrls",
-	"media_urls",
-	"imageUrls",
-	"image_urls"
-];
-const ATTACHMENT_MEDIA_KEYS = [
-	"media",
-	"mediaUrl",
-	"path",
-	"filePath",
-	"fileUrl",
-	"url"
-];
-/** Reads actual remote bytes with a cap enforced by Codex before transport. */
-async function readBoundedCodexRemoteWorkspaceFile(params) {
-	if (!Number.isSafeInteger(params.maxBytes) || params.maxBytes < 0) throw new Error("Codex remote workspace upload requires a valid media byte limit.");
-	params.signal?.throwIfAborted();
-	const chunks = [];
-	let offset = 0;
-	let expectedSize;
-	let expectedRevision;
-	const startedAt = Date.now();
-	do {
-		params.signal?.throwIfAborted();
-		const timeoutMs = params.timeoutMs === void 0 ? void 0 : params.timeoutMs - (Date.now() - startedAt);
-		if (timeoutMs !== void 0 && timeoutMs <= 0) throw new Error("Codex remote workspace file transfer timed out.");
-		let response;
-		try {
-			response = await params.client.request("command/exec", {
-				command: [
-					"node",
-					"-e",
-					CODEX_BOUNDED_REMOTE_FILE_READER,
-					"--",
-					params.path,
-					String(params.maxBytes),
-					String(offset),
-					String(CODEX_REMOTE_MEDIA_CHUNK_BYTES),
-					...params.workspaceRoot ? [params.workspaceRoot] : []
-				],
-				env: {
-					NODE_OPTIONS: null,
-					NODE_PATH: null
-				},
-				...timeoutMs === void 0 ? {} : { timeoutMs }
-			}, {
-				signal: params.signal,
-				timeoutMs
-			});
-		} catch (error) {
-			if (error instanceof Error && /failed to spawn|executable.*not found|\bENOENT\b/iu.test(error.message)) throw new Error("Codex remote workspace file transfer requires Node.js on the remote app-server host.", { cause: error });
-			throw error;
-		}
-		if (!response || response.exitCode !== 0) {
-			const detail = typeof response?.stderr === "string" ? response.stderr.trim() : "";
-			throw new Error(`Codex remote workspace artifact could not be read: ${params.path}${detail ? `: ${detail}` : ""}`);
-		}
-		if (typeof response.stdout !== "string" || response.stdout.length > CODEX_REMOTE_COMMAND_DEFAULT_OUTPUT_BYTES) throw new Error("Codex remote workspace artifact exceeded the native command output cap.");
-		let payload;
-		try {
-			payload = JSON.parse(response.stdout);
-		} catch {
-			throw new Error("Codex remote workspace artifact returned invalid chunk data.");
-		}
-		if (!payload || typeof payload !== "object" || Array.isArray(payload)) throw new Error("Codex remote workspace artifact returned invalid chunk data.");
-		const chunk = payload;
-		if (typeof chunk.dataBase64 !== "string" || !Number.isSafeInteger(chunk.size) || chunk.size < 0 || chunk.size > params.maxBytes || typeof chunk.revision !== "string" || !chunk.revision) throw new Error("Codex remote workspace artifact returned invalid or oversized chunk data.");
-		if (expectedSize === void 0) {
-			expectedSize = chunk.size;
-			expectedRevision = chunk.revision;
-		}
-		if (chunk.size !== expectedSize || chunk.revision !== expectedRevision) throw new Error("Codex remote workspace artifact changed during chunked transfer.");
-		const remainingBytes = expectedSize - offset;
-		const expectedChunkBytes = Math.min(CODEX_REMOTE_MEDIA_CHUNK_BYTES, remainingBytes);
-		if (chunk.dataBase64.length > Math.ceil(expectedChunkBytes / 3) * 4) throw new Error("Codex remote workspace artifact returned oversized chunk data.");
-		const buffer = Buffer.from(chunk.dataBase64, "base64");
-		if (buffer.byteLength !== expectedChunkBytes || buffer.toString("base64") !== chunk.dataBase64) throw new Error("Codex remote workspace artifact returned invalid chunk data.");
-		chunks.push(buffer);
-		offset += buffer.byteLength;
-	} while (offset < (expectedSize ?? 0));
-	return { dataBase64: Buffer.concat(chunks, offset).toString("base64") };
-}
-/** Stages authoritative bounded remote bytes into immutable Gateway-owned media. */
-async function prepareCodexRemoteWorkspaceMessageMedia(params) {
-	const { localWorkspaceRoot, remoteWorkspaceRoot } = params;
-	if (!localWorkspaceRoot || !remoteWorkspaceRoot) return params.args;
-	const remotePathsByLocalPath = /* @__PURE__ */ new Map();
-	const gatewayManagedPaths = /* @__PURE__ */ new Set();
-	const gatewayMediaRoot = getMediaDir();
-	let attachmentEntries = 0;
-	const mapMediaPath = (value) => {
-		if (typeof value !== "string") return value;
-		if (path.isAbsolute(value) && isPathStrictlyInside(gatewayMediaRoot, value)) {
-			attachmentEntries += 1;
-			gatewayManagedPaths.add(value);
-			return value;
-		}
-		const mapped = mapCodexAppServerLocalWorkspacePath({
-			value,
-			localWorkspaceRoot,
-			remoteWorkspaceRoot
-		});
-		if (value.trim() && !isCodexPassThroughMediaSource(value)) {
-			attachmentEntries += 1;
-			remotePathsByLocalPath.set(mapped, mapCodexAppServerRemoteWorkspacePath({
-				value: mapped,
-				localWorkspaceRoot,
-				remoteWorkspaceRoot
-			}));
-		}
-		return mapped;
-	};
-	let mappedArgs = params.args;
-	const setMappedValue = (key, value) => {
-		if (value === params.args[key]) return;
-		if (mappedArgs === params.args) mappedArgs = { ...params.args };
-		mappedArgs[key] = value;
-	};
-	for (const key of MESSAGE_MEDIA_KEYS) setMappedValue(key, mapMediaPath(params.args[key]));
-	for (const key of MESSAGE_MEDIA_ARRAY_KEYS) {
-		const value = params.args[key];
-		if (Array.isArray(value)) {
-			const mapped = value.map(mapMediaPath);
-			if (mapped.some((entry, index) => entry !== value[index])) setMappedValue(key, mapped);
-		}
-	}
-	if (Array.isArray(params.args.attachments)) {
-		const attachments = params.args.attachments;
-		const mapped = attachments.map((attachment) => {
-			if (!attachment || typeof attachment !== "object" || Array.isArray(attachment)) return attachment;
-			const record = attachment;
-			let mappedAttachment = record;
-			for (const key of ATTACHMENT_MEDIA_KEYS) {
-				const value = mapMediaPath(record[key]);
-				if (value !== record[key]) {
-					if (mappedAttachment === record) mappedAttachment = { ...record };
-					mappedAttachment[key] = value;
-				}
-			}
-			return mappedAttachment;
-		});
-		if (mapped.some((attachment, index) => attachment !== attachments[index])) setMappedValue("attachments", mapped);
-	}
-	if (attachmentEntries > REMOTE_WORKSPACE_MEDIA_MAX_ATTACHMENTS) throw new Error(`Codex remote workspace upload exceeds the ${REMOTE_WORKSPACE_MEDIA_MAX_ATTACHMENTS}-attachment limit.`);
-	for (const managedPath of gatewayManagedPaths) await assertGatewayManagedMediaPath(managedPath, gatewayMediaRoot);
-	if (remotePathsByLocalPath.size === 0) return mappedArgs;
-	const readRemoteFile = params.readRemoteFile;
-	if (!readRemoteFile) throw new Error("Codex remote workspace file transfer requires an active app-server client.");
-	const maxBytes = params.maxBytes ?? REMOTE_WORKSPACE_MEDIA_MAX_BYTES;
-	const timeoutMs = params.timeoutMs ?? REMOTE_WORKSPACE_MEDIA_TIMEOUT_MS;
-	const deadline = Date.now() + timeoutMs;
-	const stagedPaths = /* @__PURE__ */ new Map();
-	let totalBytes = 0;
-	for (const [localPath, remotePath] of remotePathsByLocalPath) {
-		params.signal?.throwIfAborted();
-		const remainingBytes = maxBytes - totalBytes;
-		const remainingMs = deadline - Date.now();
-		if (remainingMs <= 0) throw new Error("Codex remote workspace attachment batch timed out.");
-		const response = await readRemoteFile({
-			path: remotePath,
-			maxBytes: remainingBytes,
-			workspaceRoot: remoteWorkspaceRoot,
-			signal: params.signal,
-			timeoutMs: remainingMs
-		});
-		if (!response || typeof response.dataBase64 !== "string") throw new Error(`Codex remote workspace artifact returned no file data: ${remotePath}`);
-		if (response.dataBase64.length > Math.ceil(remainingBytes / 3) * 4) throw new Error(`Codex remote workspace artifact exceeds the limit of ${remainingBytes} bytes.`);
-		const remoteBuffer = Buffer.from(response.dataBase64, "base64");
-		if (remoteBuffer.byteLength > remainingBytes || remoteBuffer.toString("base64") !== response.dataBase64) throw new Error(`Codex remote workspace artifact returned invalid or oversized file data: ${remotePath}`);
-		totalBytes += remoteBuffer.byteLength;
-		const saved = await saveMediaBuffer(remoteBuffer, void 0, "outbound", maxBytes, path.basename(remotePath));
-		stagedPaths.set(localPath, saved.path);
-	}
-	return mapMessageMediaValues(mappedArgs, (value) => stagedPaths.get(value) ?? value);
-}
-async function assertGatewayManagedMediaPath(value, mediaRoot) {
-	const opened = await (await root(mediaRoot, { symlinks: "reject" })).open(path.relative(mediaRoot, value), { symlinks: "reject" });
-	try {
-		if (!(await opened.handle.stat()).isFile()) throw new Error(`Codex Gateway-managed media is not a regular file: ${value}`);
-	} finally {
-		await opened[Symbol.asyncDispose]();
-	}
-}
-function mapMessageMediaValues(args, mapValue) {
-	const mapped = { ...args };
-	for (const key of MESSAGE_MEDIA_KEYS) {
-		const value = mapped[key];
-		if (typeof value === "string") mapped[key] = mapValue(value);
-	}
-	for (const key of MESSAGE_MEDIA_ARRAY_KEYS) {
-		const value = mapped[key];
-		if (Array.isArray(value)) mapped[key] = value.map((entry) => typeof entry === "string" ? mapValue(entry) : entry);
-	}
-	if (Array.isArray(mapped.attachments)) mapped.attachments = mapped.attachments.map((attachment) => {
-		if (!attachment || typeof attachment !== "object" || Array.isArray(attachment)) return attachment;
-		const record = { ...attachment };
-		for (const key of ATTACHMENT_MEDIA_KEYS) {
-			const value = record[key];
-			if (typeof value === "string") record[key] = mapValue(value);
-		}
-		return record;
-	});
-	return mapped;
-}
-//#endregion
-//#region extensions/codex/src/app-server/dynamic-tool-build-state.ts
-/** Mutable dependency seam shared by dynamic-tool construction and its behavioral tests. */
-const dynamicToolBuildState = {};
-//#endregion
-//#region extensions/codex/src/app-server/shell-dynamic-tools.ts
-const CODEX_NODE_EXEC_DYNAMIC_TOOL_NAME = "node_exec";
-const CODEX_GATEWAY_EXEC_DYNAMIC_TOOL_NAME = "gateway_exec";
-const CODEX_GATEWAY_PROCESS_DYNAMIC_TOOL_NAME = "gateway_process";
-const CODEX_EXEC_POLICY_PARAMETER_NAMES = /* @__PURE__ */ new Set([
-	"host",
-	"security",
-	"ask"
-]);
-const CODEX_NODE_EXEC_PARAMETER_NAMES = /* @__PURE__ */ new Set([
-	"command",
-	"workdir",
-	"env",
-	"timeoutSeconds",
-	"node"
-]);
-const PROCESS_FOLLOWUP_TEXT = "Use process (list/poll/log/write/send-keys/submit/paste/kill/clear/remove) for follow-up.";
-/** Returns true when plugin config explicitly removes any named dynamic tool. */
-function isCodexDynamicToolExcluded(config, names) {
-	const normalizedNames = new Set(names.map((name) => normalizeCodexDynamicToolName(name)));
-	return (config.codexDynamicToolsExclude ?? []).some((name) => normalizedNames.has(normalizeCodexDynamicToolName(name)));
-}
-function createExecAliasDynamicTool(execTool, params) {
-	const pinnedNode = params.host === "node" ? params.node?.trim() : void 0;
-	const nodeAlias = params.host === "node";
-	const gatewayProcessAliasAvailable = params.host === "gateway" && params.processAliasAvailable;
-	const name = nodeAlias ? CODEX_NODE_EXEC_DYNAMIC_TOOL_NAME : CODEX_GATEWAY_EXEC_DYNAMIC_TOOL_NAME;
-	const description = nodeAlias ? pinnedNode ? "Run a shell command to completion on the OpenClaw configured remote node for this session. This tool always uses OpenClaw host=node internally and follows the existing node exec approval and allowlist policy. Remote-node background follow-up is unavailable. Use Codex's native shell for local app-server work." : "Run a shell command to completion on an OpenClaw remote node. Select the node by name or id when multiple nodes are available. This tool always uses OpenClaw host=node internally and follows the existing node exec approval and allowlist policy. Remote-node background follow-up is unavailable. Use Codex's native shell for local app-server work." : "Run a shell command through OpenClaw on the Gateway host for OpenClaw-managed Gateway environment access, including Secret Store agent-readable environment values and protected egress sentinels. Native Codex shell remains preferred for ordinary local work. This tool always uses OpenClaw host=gateway internally and follows Gateway exec approval and allowlist policy.";
-	const followupText = nodeAlias ? "Remote-node background follow-up is unavailable. Wait for the command to complete." : gatewayProcessAliasAvailable ? "Use gateway_process (list/poll/log/write/send-keys/submit/paste/kill/clear/remove) for follow-up." : "Background session follow-up is unavailable because gateway_process is not exposed. Rerun without background=true and set yieldMs high enough to wait for completion.";
-	return {
-		...execTool,
-		name,
-		description,
-		parameters: hideExecDynamicToolParameters(execTool.parameters, !nodeAlias || Boolean(pinnedNode), nodeAlias),
-		execute: async (toolCallId, args, signal, onUpdate) => {
-			const result = await execTool.execute(toolCallId, pinExecDynamicToolArgs(args, params, pinnedNode), signal, onUpdate);
-			return {
-				...result,
-				content: result.content.map((item) => item.type === "text" ? Object.assign({}, item, { text: item.text.replace(PROCESS_FOLLOWUP_TEXT, followupText) }) : item)
-			};
-		}
-	};
-}
-function createGatewayProcessAliasDynamicTool(processTool) {
-	return {
-		...processTool,
-		name: CODEX_GATEWAY_PROCESS_DYNAMIC_TOOL_NAME,
-		description: "Manage background shell sessions in the existing per-session OpenClaw process scope: list, poll, log, write, send-keys, submit, paste, kill, clear, or remove. Use for gateway_exec follow-up; use native Codex shell session handling for ordinary local work."
-	};
-}
-function pinExecDynamicToolArgs(args, params, configuredNode) {
-	const { host: _host, security: _security, ask: _ask, node: requestedNode, ...rest } = normalizeExecDynamicToolArgs(args);
-	if (params.host === "gateway") return {
-		...rest,
-		host: params.host,
-		...params.ask ? { ask: params.ask } : {}
-	};
-	const nodeArgs = Object.fromEntries(Object.entries(rest).filter(([name]) => CODEX_NODE_EXEC_PARAMETER_NAMES.has(name)));
-	const node = configuredNode ?? (typeof requestedNode === "string" ? requestedNode.trim() : "");
-	return {
-		...nodeArgs,
-		host: params.host,
-		...node ? { node } : {}
-	};
-}
-function normalizeExecDynamicToolArgs(args) {
-	return args && typeof args === "object" && !Array.isArray(args) ? args : {};
-}
-function hideExecDynamicToolParameters(parameters, hideNode, nodeOnly) {
-	if (!parameters || typeof parameters !== "object" || Array.isArray(parameters)) return parameters;
-	const schema = parameters;
-	const rawProperties = schema.properties;
-	if (!rawProperties || typeof rawProperties !== "object" || Array.isArray(rawProperties)) return parameters;
-	const includeParameter = (name) => nodeOnly ? CODEX_NODE_EXEC_PARAMETER_NAMES.has(name) && !(hideNode && name === "node") : !CODEX_EXEC_POLICY_PARAMETER_NAMES.has(normalizeCodexDynamicToolName(name)) && !(hideNode && normalizeCodexDynamicToolName(name) === "node");
-	const nextProperties = Object.fromEntries(Object.entries(rawProperties).filter(([name]) => includeParameter(name)));
-	const rawRequired = schema.required;
-	const nextRequired = Array.isArray(rawRequired) ? rawRequired.filter((name) => typeof name !== "string" || includeParameter(name)) : rawRequired;
-	return {
-		...schema,
-		properties: nextProperties,
-		...Array.isArray(rawRequired) ? { required: nextRequired } : {}
-	};
-}
-//#endregion
 //#region extensions/codex/src/app-server/vision-tools.ts
 /**
 * Codex's enabled native surface includes its stable view_image loader. Keep
@@ -652,6 +112,15 @@ const CODEX_NATIVE_SANDBOX_TOOL_REQUIREMENTS = [
 	"apply_patch"
 ];
 const CODEX_MEMORY_FLUSH_DYNAMIC_TOOL_ALLOW = /* @__PURE__ */ new Set(["read", "write"]);
+const CODEX_DISABLED_NATIVE_SHELL_DYNAMIC_TOOLS = /* @__PURE__ */ new Set([
+	"exec",
+	"process",
+	"sandbox_exec",
+	"sandbox_process",
+	CODEX_GATEWAY_EXEC_DYNAMIC_TOOL_NAME,
+	CODEX_GATEWAY_PROCESS_DYNAMIC_TOOL_NAME,
+	CODEX_NODE_EXEC_DYNAMIC_TOOL_NAME
+]);
 /** Keeps node filesystem and process ownership on its native exec-server. */
 function resolveCodexNodePlacementToolConstructionPlan(sandbox, nativeToolSurfaceEnabled) {
 	if (!isCodexRemoteExecPlacementSandbox(sandbox) || sandbox?.backendId !== "node" || !("placementNodeId" in sandbox) || typeof sandbox.placementNodeId !== "string" || !sandbox.placementNodeId) return;
@@ -669,13 +138,6 @@ function preserveRingZeroSystemAgentTool(allTools, filteredTools) {
 	if (!openclaw) return filteredTools;
 	return [openclaw, ...filteredTools.filter((tool) => tool.name !== "openclaw")];
 }
-/** Splits sandbox and run session keys so tool calls can bind to both scopes when needed. */
-function resolveOpenClawCodingToolsSessionKeys(params, sandboxSessionKey) {
-	return {
-		sessionKey: sandboxSessionKey,
-		runSessionKey: params.sessionKey && params.sessionKey !== sandboxSessionKey ? params.sessionKey : void 0
-	};
-}
 /** Returns the canonical channel used for Codex message routing and receipts. */
 function resolveCodexMessageToolProvider(params) {
 	return params.messageChannel ?? params.messageProvider;
@@ -692,17 +154,8 @@ function resolveCodexAppServerHookChannelId(params, sandboxSessionKey) {
 }
 const CODEX_DYNAMIC_TOOL_BUILD_WARN_TOTAL_MS = 1e3;
 const CODEX_DYNAMIC_TOOL_BUILD_WARN_STAGE_MS = 500;
-/** Creates cheap optional timing instrumentation for the dynamic-tool hot path. */
-function createCodexDynamicToolBuildStageTracker(options = {}) {
-	if (!options.enabled) return {
-		mark() {},
-		snapshot() {
-			return {
-				totalMs: 0,
-				stages: []
-			};
-		}
-	};
+/** Captures bounded preparation stages before a slow turn needs diagnosis. */
+function createCodexDynamicToolBuildStageTracker() {
 	const startedAt = Date.now();
 	let previousAt = startedAt;
 	const stages = [];
@@ -726,8 +179,10 @@ function createCodexDynamicToolBuildStageTracker(options = {}) {
 	};
 }
 /** Returns true when dynamic-tool construction is slow enough to warrant a warning log. */
-function shouldWarnCodexDynamicToolBuildStageSummary(summary) {
-	return summary.totalMs >= CODEX_DYNAMIC_TOOL_BUILD_WARN_TOTAL_MS || summary.stages.some((stage) => stage.durationMs >= CODEX_DYNAMIC_TOOL_BUILD_WARN_STAGE_MS);
+function shouldWarnCodexDynamicToolBuildStageSummary(summary, profilerEnabled = false) {
+	const totalWarnMs = profilerEnabled ? CODEX_DYNAMIC_TOOL_BUILD_WARN_TOTAL_MS : 1e4;
+	const stageWarnMs = profilerEnabled ? CODEX_DYNAMIC_TOOL_BUILD_WARN_STAGE_MS : 5e3;
+	return summary.totalMs >= totalWarnMs || summary.stages.some((stage) => stage.durationMs >= stageWarnMs);
 }
 /** Formats per-stage timings into the compact form used by Codex app-server logs. */
 function formatCodexDynamicToolBuildStageSummary(summary) {
@@ -740,6 +195,10 @@ async function buildDynamicTools(input) {
 		...params,
 		disableMessageTool: false
 	} : params;
+	const toolRunContext = buildEmbeddedAttemptToolRunContext({
+		...params,
+		forceMessageTool: shouldForceMessageTool(messagePolicyParams)
+	});
 	if (params.disableTools) {
 		input.onWebSearchPolicyResolved?.(false);
 		return [];
@@ -749,15 +208,15 @@ async function buildDynamicTools(input) {
 		input.onWebSearchPolicyResolved?.(false);
 		return [];
 	}
-	const toolBuildStages = createCodexDynamicToolBuildStageTracker({ enabled: input.profilerEnabled });
+	const toolBuildStages = createCodexDynamicToolBuildStageTracker();
 	const modelHasVision = params.model.input?.includes("image") ?? false;
 	const agentDir = params.agentDir ?? resolveAgentDir$1(params.config ?? {}, input.sessionAgentId);
 	const injectedOpenClawCodingToolsFactory = dynamicToolBuildState.openClawCodingToolsFactory;
-	let agentHarnessModule;
-	const loadAgentHarnessModule = async () => agentHarnessModule ??= await import("openclaw/plugin-sdk/agent-harness");
-	toolBuildStages.mark("load-agent-harness-tools");
-	const sessionKeys = resolveOpenClawCodingToolsSessionKeys(params, input.sandboxSessionKey);
-	const nativeExecutionPolicy = resolveCodexNativeExecutionPolicyForDynamicTools(input);
+	const nativeExecutionPolicy = resolveCodexNativeExecutionPolicyForRun(params, {
+		agentId: input.policyAgentId,
+		runtimeSessionKey: input.sandboxSessionKey,
+		sandbox: input.sandbox
+	});
 	const webSearchPlan = resolveCodexWebSearchPlan({
 		config: params.config,
 		disableTools: params.disableTools,
@@ -765,109 +224,118 @@ async function buildDynamicTools(input) {
 		nativeProviderWebSearchSupport: input.nativeProviderWebSearchSupport
 	});
 	const webFetchHostnameAllowlistRef = {};
-	const buildOpenClawCodingTools = () => {
-		const toolConstructionPlan = resolveCodexNodePlacementToolConstructionPlan(input.sandbox, input.nativeToolSurfaceEnabled);
-		const options = {
-			agentId: input.sessionAgentId,
-			...buildEmbeddedAttemptToolRunContext(params),
-			exec: {
-				...params.execOverrides,
-				...input.sessionPermissionPolicy ? { mode: input.sessionPermissionPolicy.execMode } : {},
-				...resolveCodexNodeExecToolOverrides(nativeExecutionPolicy),
-				config: params.config,
-				elevated: params.bashElevated
-			},
-			sessionPermissionPolicy: input.sessionPermissionPolicy ? {
-				mode: input.sessionPermissionPolicy.mode,
-				root: input.sessionPermissionPolicy.root
-			} : void 0,
-			sandbox: input.sandbox,
-			...toolConstructionPlan ? { toolConstructionPlan } : {},
-			messageProvider: resolveCodexMessageToolProvider(params),
-			toolPolicyMessageProvider: params.messageProvider ?? params.messageChannel,
-			clientCaps: params.clientCaps,
-			chatType: params.chatType,
-			agentAccountId: params.agentAccountId,
-			messageTo: params.messageTo,
-			messageThreadId: params.messageThreadId,
-			nativeChannelId: params.chatId,
-			messageActionTurnCapability: params.messageActionTurnCapability,
-			groupId: params.groupId,
-			groupChannel: params.groupChannel,
-			groupSpace: params.groupSpace,
-			spawnedBy: params.spawnedBy,
-			senderId: params.senderId,
-			senderName: params.senderName,
-			senderUsername: params.senderUsername,
-			senderE164: params.senderE164,
-			senderIsOwner: params.senderIsOwner,
-			inputProvenance: params.inputProvenance,
-			trustedInternalHandoff: params.trustedInternalHandoff,
-			scheduledToolPolicy: params.scheduledToolPolicy,
-			allowGatewaySubagentBinding: params.allowGatewaySubagentBinding || isForcedPrivateQaCodexRuntime(),
-			...sessionKeys,
-			sessionId: params.sessionId,
-			runId: params.runId,
-			approvalReviewerDeviceId: params.approvalReviewerDeviceId,
-			agentDir,
-			preparedModelRuntime: params.preparedModelRuntime,
-			cwd: input.effectiveCwd ?? input.effectiveWorkspace,
-			workspaceDir: input.effectiveWorkspace,
-			spawnWorkspaceDir: input.effectiveCwd && input.effectiveCwd !== input.effectiveWorkspace ? input.resolvedWorkspace : resolveAttemptSpawnWorkspaceDir({
-				sandbox: input.sandbox,
-				resolvedWorkspace: input.resolvedWorkspace
-			}),
+	const toolConstructionPlan = resolveCodexNodePlacementToolConstructionPlan(input.sandbox, input.nativeToolSurfaceEnabled);
+	const options = {
+		agentId: input.sessionAgentId,
+		policyAgentId: input.policyAgentId,
+		...toolRunContext,
+		exec: {
+			...params.execOverrides,
+			...input.sessionPermissionPolicy ? { mode: input.sessionPermissionPolicy.execMode } : {},
+			...resolveCodexNodeExecToolOverrides(nativeExecutionPolicy),
 			config: params.config,
-			githubPublicationAvailable: params.githubPublicationAvailable,
-			authProfileStore: params.toolAuthProfileStore ?? params.authProfileStore,
-			abortSignal: input.runAbortController.signal,
-			emitBeforeToolCallDiagnostics: false,
-			modelProvider: params.model.provider,
-			modelId: params.modelId,
-			modelCompat: params.model.compat && typeof params.model.compat === "object" ? params.model.compat : void 0,
-			modelApi: params.model.api,
-			modelContextWindowTokens: params.model.contextWindow,
-			delegationCapability: params.delegationCapability,
-			modelAuthMode: resolveModelAuthMode(params.model.provider, params.config, params.toolAuthProfileStore ?? params.authProfileStore, { workspaceDir: input.effectiveWorkspace }),
-			suppressManagedWebSearch: false,
-			webFetchHostnameAllowlistRef,
-			currentChannelId: params.currentChannelId,
-			currentMessagingTarget: params.currentMessagingTarget,
-			hookChannelId: resolveCodexAppServerHookChannelId(params, input.sandboxSessionKey),
-			currentThreadTs: params.currentThreadTs,
-			currentMessageId: params.currentMessageId,
-			replyToMode: params.replyToMode,
-			hasRepliedRef: params.hasRepliedRef,
-			modelHasVision,
-			computerContextEpoch: input.computerContextEpoch,
-			requireExplicitMessageTarget: params.requireExplicitMessageTarget ?? isSubagentSessionKey(params.sessionKey),
-			sourceReplyDeliveryMode: params.sourceReplyDeliveryMode,
-			taskSuggestionDeliveryMode: params.taskSuggestionDeliveryMode,
-			disableMessageTool: input.ignoreDisableMessageTool ? false : params.disableMessageTool,
-			forceMessageTool: shouldForceMessageTool(messagePolicyParams),
-			enableHeartbeatTool: params.trigger === "heartbeat" || input.forceHeartbeatTool === true,
-			forceHeartbeatTool: params.trigger === "heartbeat" || input.forceHeartbeatTool === true,
-			onYield: (message, acknowledgment) => {
-				input.onYieldDetected(acknowledgment);
-				input.onCodexAppServerEvent?.({
-					stream: "codex_app_server.tool",
-					data: {
-						name: "sessions_yield",
-						message
-					}
-				});
-			},
-			claimYieldCompletion: input.claimYieldCompletion,
-			recordToolPrepStage: (name) => {
-				toolBuildStages.mark(name);
-			},
-			onToolOutcome: params.onToolOutcome,
-			isTurnTainted: params.isTurnTainted,
-			allocateToolOutcomeOrdinal: params.allocateToolOutcomeOrdinal,
-			cronCreatorToolAllowlistRef: input.cronCreatorToolAllowlistRef,
-			cronCreatorToolAllowlistCaptureRef: input.cronCreatorToolAllowlistCaptureRef,
-			cronCreatorAuthorityUnavailableReason: input.cronCreatorAuthorityUnavailableReason
-		};
+			elevated: params.bashElevated
+		},
+		sessionPermissionPolicy: input.sessionPermissionPolicy ? {
+			mode: input.sessionPermissionPolicy.mode,
+			root: input.sessionPermissionPolicy.root
+		} : void 0,
+		sandbox: input.sandbox,
+		...toolConstructionPlan ? { toolConstructionPlan } : {},
+		messageProvider: resolveCodexMessageToolProvider(params),
+		toolPolicyMessageProvider: params.messageProvider ?? params.messageChannel,
+		...params.onToolResult ? { questionPrompt: {
+			send: params.onToolResult,
+			...params.messageChannel ? { messageChannel: params.messageChannel } : {}
+		} } : {},
+		clientCaps: params.clientCaps,
+		chatType: params.chatType,
+		agentAccountId: params.agentAccountId,
+		messageTo: params.messageTo,
+		messageThreadId: params.messageThreadId,
+		nativeChannelId: params.chatId,
+		messageActionTurnCapability: params.messageActionTurnCapability,
+		groupId: params.groupId,
+		groupChannel: params.groupChannel,
+		groupSpace: params.groupSpace,
+		spawnedBy: params.spawnedBy,
+		senderId: params.senderId,
+		senderName: params.senderName,
+		senderUsername: params.senderUsername,
+		senderE164: params.senderE164,
+		senderIsOwner: params.senderIsOwner,
+		inputProvenance: params.inputProvenance,
+		trustedInternalHandoff: params.trustedInternalHandoff,
+		scheduledToolPolicy: params.scheduledToolPolicy,
+		allowGatewaySubagentBinding: params.allowGatewaySubagentBinding || isForcedPrivateQaCodexRuntime(),
+		sessionKey: input.sandboxSessionKey,
+		runSessionKey: params.sessionKey && params.sessionKey !== input.sandboxSessionKey ? params.sessionKey : void 0,
+		sessionId: params.sessionId,
+		runId: params.runId,
+		approvalReviewerDeviceId: params.approvalReviewerDeviceId,
+		agentDir,
+		preparedModelRuntime: params.preparedModelRuntime,
+		cwd: input.effectiveCwd ?? input.effectiveWorkspace,
+		workspaceDir: input.effectiveWorkspace,
+		spawnWorkspaceDir: input.effectiveCwd && input.effectiveCwd !== input.effectiveWorkspace ? input.resolvedWorkspace : resolveAttemptSpawnWorkspaceDir({
+			sandbox: input.sandbox,
+			resolvedWorkspace: input.resolvedWorkspace
+		}),
+		config: params.config,
+		skillsSnapshot: params.skillsSnapshot,
+		...params.skillLibraryAuthoring ? { skillWorkshop: { libraryAuthoring: params.skillLibraryAuthoring } } : {},
+		githubPublicationAvailable: params.githubPublicationAvailable,
+		authProfileStore: params.toolAuthProfileStore ?? params.authProfileStore,
+		abortSignal: input.runAbortController.signal,
+		emitBeforeToolCallDiagnostics: false,
+		modelProvider: params.model.provider,
+		modelId: params.modelId,
+		modelCompat: params.model.compat && typeof params.model.compat === "object" ? params.model.compat : void 0,
+		modelApi: params.model.api,
+		modelContextWindowTokens: params.model.contextWindow,
+		delegationCapability: params.delegationCapability,
+		modelAuthMode: resolveModelAuthMode(params.model.provider, params.config, params.toolAuthProfileStore ?? params.authProfileStore, { workspaceDir: input.effectiveWorkspace }),
+		suppressManagedWebSearch: false,
+		webFetchHostnameAllowlistRef,
+		currentChannelId: params.currentChannelId,
+		currentMessagingTarget: params.currentMessagingTarget,
+		hookChannelId: resolveCodexAppServerHookChannelId(params, input.sandboxSessionKey),
+		currentThreadTs: params.currentThreadTs,
+		currentMessageId: params.currentMessageId,
+		replyToMode: params.replyToMode,
+		hasRepliedRef: params.hasRepliedRef,
+		modelHasVision,
+		computerContextEpoch: input.computerContextEpoch,
+		registerRunCleanup: input.registerRunCleanup,
+		requireExplicitMessageTarget: params.requireExplicitMessageTarget ?? isSubagentSessionKey(params.sessionKey),
+		sourceReplyDeliveryMode: params.sourceReplyDeliveryMode,
+		taskSuggestionDeliveryMode: params.taskSuggestionDeliveryMode,
+		disableMessageTool: input.ignoreDisableMessageTool ? false : params.disableMessageTool,
+		forceMessageTool: shouldForceMessageTool(messagePolicyParams),
+		enableHeartbeatTool: params.trigger === "heartbeat" || input.forceHeartbeatTool === true,
+		forceHeartbeatTool: params.trigger === "heartbeat" || input.forceHeartbeatTool === true,
+		onYield: (message, acknowledgment) => {
+			input.onYieldDetected(acknowledgment);
+			input.onCodexAppServerEvent?.({
+				stream: "codex_app_server.tool",
+				data: {
+					name: "sessions_yield",
+					message
+				}
+			});
+		},
+		claimYieldCompletion: input.claimYieldCompletion,
+		recordToolPrepStage: (name) => {
+			toolBuildStages.mark(name);
+		},
+		onToolOutcome: params.onToolOutcome,
+		isTurnTainted: params.isTurnTainted,
+		allocateToolOutcomeOrdinal: params.allocateToolOutcomeOrdinal,
+		cronCreatorToolAllowlistRef: input.cronCreatorToolAllowlistRef,
+		cronCreatorToolAllowlistCaptureRef: input.cronCreatorToolAllowlistCaptureRef,
+		cronCreatorAuthorityUnavailableReason: input.cronCreatorAuthorityUnavailableReason
+	};
+	const buildOpenClawCodingTools = () => {
 		const bindingOptions = { cwd: input.effectiveCwd ?? input.effectiveWorkspace };
 		if (injectedOpenClawCodingToolsFactory) return params.hostCapabilities.bindToolSurface(injectedOpenClawCodingToolsFactory(options), bindingOptions);
 		const createToolSurface = params.hostCapabilities.createToolSurface;
@@ -887,7 +355,7 @@ async function buildDynamicTools(input) {
 	const readableAllTools = [...readableAllToolProjection.tools];
 	const normallyProfiledTools = input.nativeToolSurfaceEnabled === false ? filterCodexDynamicToolsForDisabledNativeSurface(readableAllTools, input.pluginConfig, { preserveShell: shouldKeepOpenClawShellDynamicTools(input, nativeExecutionPolicy) }) : filterCodexDynamicTools(readableAllTools, input.pluginConfig);
 	const profileFilteredTools = (input.isHostScopedToolActive?.("openclaw") ?? isHostScopedAgentToolActive("openclaw")) && isSystemAgentOnlyCodexDynamicToolAllowlist(params.toolsAllow) ? preserveRingZeroSystemAgentTool(readableAllTools, normallyProfiledTools) : normallyProfiledTools;
-	const codexFilteredTools = addNodeShellDynamicToolsIfNeeded(addGatewayShellDynamicToolsIfAvailable(addSandboxShellDynamicToolsIfAvailable(isCodexMemoryFlushRun(params) ? filterCodexMemoryFlushDynamicTools(readableAllTools) : profileFilteredTools, readableAllTools, input), readableAllTools, input, nativeExecutionPolicy), readableAllTools, input, nativeExecutionPolicy);
+	const codexFilteredTools = await addNodeShellDynamicToolsIfNeeded(addGatewayShellDynamicToolsIfAvailable(addSandboxShellDynamicToolsIfAvailable(isCodexMemoryFlushRun(params) ? filterCodexMemoryFlushDynamicTools(readableAllTools) : profileFilteredTools, readableAllTools, input, nativeExecutionPolicy), readableAllTools, input, nativeExecutionPolicy), readableAllTools, input, nativeExecutionPolicy);
 	toolBuildStages.mark("codex-filtering");
 	const visionFilteredTools = filterCodexVisionTools(codexFilteredTools, {
 		modelHasVision,
@@ -896,33 +364,33 @@ async function buildDynamicTools(input) {
 	toolBuildStages.mark("vision-filtering");
 	const webSearchPresent = visionFilteredTools.some((tool) => tool.name === "web_search");
 	const persistentCodexWebSearchSurface = params.config?.tools?.web?.search?.enabled !== false && !(input.pluginConfig.codexDynamicToolsExclude ?? []).some((name) => normalizeCodexDynamicToolName(name) === "web_search");
-	const webSearchPolicy = webSearchPresent || persistentCodexWebSearchSurface ? (await loadAgentHarnessModule()).resolveWebSearchToolPolicy({
-		config: params.config,
-		modelProvider: params.model.provider,
-		modelId: params.modelId,
-		agentId: input.sessionAgentId,
-		sessionKey: input.sandboxSessionKey,
-		sandboxToolPolicy: input.sandbox?.tools,
-		messageProvider: resolveCodexMessageToolProvider(params),
-		agentAccountId: params.agentAccountId,
-		groupId: params.groupId,
-		groupChannel: params.groupChannel,
-		groupSpace: params.groupSpace,
-		spawnedBy: params.spawnedBy,
-		senderId: params.senderId,
-		senderName: params.senderName,
-		senderUsername: params.senderUsername,
-		senderE164: params.senderE164,
-		inputProvenance: params.inputProvenance,
-		trustedInternalHandoff: params.trustedInternalHandoff,
-		scheduledToolPolicy: params.scheduledToolPolicy
-	}) : {
-		allowed: false,
-		persistentAllowed: false
-	};
-	const transientWebSearchRestriction = !webSearchPolicy.allowed && webSearchPolicy.persistentAllowed || isCodexMemoryFlushRun(params);
-	input.onPersistentWebSearchPolicyResolved?.(webSearchPresent || persistentCodexWebSearchSurface && transientWebSearchRestriction && webSearchPolicy.persistentAllowed);
-	const filteredTools = filterCodexDynamicToolsForAllowlist(visionFilteredTools, includeForcedCodexDynamicToolAllow(params.toolsAllow, messagePolicyParams));
+	let persistentWebSearchAllowed = webSearchPresent;
+	if (input.onPersistentWebSearchPolicyResolved && !webSearchPresent && persistentCodexWebSearchSurface) {
+		const webSearchPolicy = (await import("openclaw/plugin-sdk/agent-harness")).resolveWebSearchToolPolicy({
+			config: params.config,
+			modelProvider: params.model.provider,
+			modelId: params.modelId,
+			agentId: input.policyAgentId,
+			sessionKey: input.sandboxSessionKey,
+			sandboxToolPolicy: input.sandbox?.tools,
+			messageProvider: resolveCodexMessageToolProvider(params),
+			agentAccountId: params.agentAccountId,
+			groupId: params.groupId,
+			groupChannel: params.groupChannel,
+			groupSpace: params.groupSpace,
+			spawnedBy: params.spawnedBy,
+			senderId: params.senderId,
+			senderName: params.senderName,
+			senderUsername: params.senderUsername,
+			senderE164: params.senderE164,
+			inputProvenance: params.inputProvenance,
+			trustedInternalHandoff: params.trustedInternalHandoff,
+			scheduledToolPolicy: params.scheduledToolPolicy
+		});
+		persistentWebSearchAllowed = webSearchPolicy.persistentAllowed && (!webSearchPolicy.allowed || isCodexMemoryFlushRun(params));
+	}
+	input.onPersistentWebSearchPolicyResolved?.(persistentWebSearchAllowed);
+	const filteredTools = filterCodexDynamicToolsForAllowlist(visionFilteredTools, toolRunContext.runtimeToolAllowlist);
 	toolBuildStages.mark("allowlist-filter");
 	const normalizedTools = normalizeAgentRuntimeTools({
 		runtimePlan: input.ignoreRuntimePlan ? void 0 : params.runtimePlan,
@@ -941,7 +409,7 @@ async function buildDynamicTools(input) {
 	const webSearchAllowed = normalizedTools.some((tool) => tool.name === "web_search");
 	webFetchHostnameAllowlistRef.value = webSearchAllowed ? webSearchPlan.webFetchHostnameAllowlist : void 0;
 	input.onWebSearchPolicyResolved?.(webSearchAllowed);
-	const exposedTools = webSearchPlan.suppressManagedWebSearch ? normalizedTools.filter((tool) => tool.name !== "web_search") : normalizedTools;
+	const exposedTools = placeDisabledNativeShellToolsInDirectNamespace(webSearchPlan.suppressManagedWebSearch ? normalizedTools.filter((tool) => tool.name !== "web_search") : normalizedTools, input.nativeToolSurfaceEnabled);
 	if (preNormalizationDiagnostics.length > 0) embeddedAgentLog.warn(`codex app-server quarantined ${preNormalizationDiagnostics.length} unsupported runtime tool schema${preNormalizationDiagnostics.length === 1 ? "" : "s"} before dynamic tool registration`, {
 		runId: params.runId,
 		sessionId: params.sessionId,
@@ -953,7 +421,7 @@ async function buildDynamicTools(input) {
 		}))
 	});
 	const summary = toolBuildStages.snapshot();
-	if (shouldWarnCodexDynamicToolBuildStageSummary(summary)) {
+	if (shouldWarnCodexDynamicToolBuildStageSummary(summary, input.profilerEnabled)) {
 		const phase = input.forceHeartbeatTool ? "registered-tools" : "runtime-tools";
 		embeddedAgentLog.warn(`codex app-server dynamic tool build timings runId=${params.runId} sessionId=${params.sessionId} phase=${phase} totalMs=${summary.totalMs} stages=${formatCodexDynamicToolBuildStageSummary(summary)}`, {
 			runId: params.runId,
@@ -983,49 +451,39 @@ function addGatewayShellDynamicToolsIfAvailable(filteredTools, allTools, input,
 	if (!execTool || execExcluded || existingNames.has("gateway_exec")) return filteredTools;
 	const processExcluded = isCodexDynamicToolExcluded(input.pluginConfig, ["process", CODEX_GATEWAY_PROCESS_DYNAMIC_TOOL_NAME]);
 	const processAliasAvailable = Boolean(processTool && !processExcluded && !existingNames.has("gateway_process"));
-	const toolsToAppend = [createExecAliasDynamicTool(execTool, {
-		host: "gateway",
+	const createProjection = resolveCodexScheduledToolProjectionFactory(input.params.hostCapabilities);
+	if (!createProjection) return filteredTools;
+	const toolsToAppend = [createGatewayExecProjection(createProjection, execTool, {
 		processAliasAvailable,
 		...input.sessionPermissionPolicy?.mode === "guarded" ? { ask: "always" } : {}
 	})];
-	if (processAliasAvailable && processTool) toolsToAppend.push(createGatewayProcessAliasDynamicTool(processTool));
+	if (processAliasAvailable && processTool) toolsToAppend.push(createGatewayProcessProjection(createProjection, processTool));
 	return [...filteredTools, ...toolsToAppend];
 }
-/** Preserves delivery-critical tools when a narrow allowlist would otherwise hide them. */
-function includeForcedCodexDynamicToolAllow(toolsAllow, params) {
-	if (toolsAllow === void 0 || hasWildcardCodexToolsAllow(toolsAllow)) return toolsAllow;
-	const forcedToolNames = shouldForceMessageTool(params) ? ["message"] : [];
-	if (forcedToolNames.length === 0) return toolsAllow;
-	if (toolsAllow.length === 0) return forcedToolNames;
-	const normalized = new Set(toolsAllow.map((name) => normalizeCodexDynamicToolName(name)));
-	const missingToolNames = forcedToolNames.filter((toolName) => !normalized.has(normalizeCodexDynamicToolName(toolName)));
-	return missingToolNames.length === 0 ? toolsAllow : [...toolsAllow, ...missingToolNames];
-}
 /** Decides whether Codex native code mode can own shell/file tools for this turn. */
 function shouldEnableCodexAppServerNativeToolSurface(params, sandbox, options = {}) {
 	if (params.pluginHarnessToolPolicyRestricted === true) return false;
 	if (isCodexMemoryFlushRun(params)) return false;
 	if (params.disableTools) return false;
-	if (isCodexNativeExecutionBlockedByNodeExecHost(params, {
+	if (!resolveCodexNativeExecutionPolicyForRun(params, {
 		agentId: options.agentId,
 		runtimeSessionKey: options.runtimeSessionKey,
 		sandbox
-	})) return false;
-	const toolsAllow = includeForcedCodexDynamicToolAllow(params.toolsAllow, params);
+	}).nativeToolSurfaceAllowed) return false;
+	const toolsAllow = params.toolsAllow;
 	if (toolsAllow === void 0) return canCodexAppServerNativeToolSurfaceHonorSandbox(sandbox, options);
 	return hasWildcardCodexToolsAllow(toolsAllow) && canCodexAppServerNativeToolSurfaceHonorSandbox(sandbox, options);
 }
-/** Returns true when OpenClaw policy requires the Node-owned exec/process tools instead. */
-function isCodexNativeExecutionBlockedByNodeExecHost(params, options = {}) {
-	return !resolveCodexNativeExecutionPolicy({
+function resolveCodexNativeExecutionPolicyForRun(params, options = {}) {
+	return resolveCodexNativeExecutionPolicy({
 		config: params.config,
 		sessionKey: resolveCodexRuntimePolicySessionKey(params, options.runtimeSessionKey),
 		sessionId: params.sessionId,
 		agentId: options.agentId,
 		execOverrides: params.execOverrides,
-		sandboxAvailable: options.sandbox?.enabled,
+		sandboxAvailable: options.sandbox === null ? false : options.sandbox?.enabled,
 		readRuntimeSessionEntry: true
-	}).nativeToolSurfaceAllowed;
+	});
 }
 function resolveCodexRuntimePolicySessionKey(params, runtimeSessionKey) {
 	return runtimeSessionKey?.trim() || params.sandboxSessionKey?.trim() || params.sessionKey?.trim() || params.sessionId;
@@ -1088,8 +546,8 @@ function disableCodexPluginThreadConfig(pluginConfig) {
 	};
 }
 /** Adds sandbox_exec/process aliases when native Code Mode cannot directly honor the sandbox. */
-function addSandboxShellDynamicToolsIfAvailable(filteredTools, allTools, input) {
-	if (!shouldExposeSandboxExecDynamicTool(input) || isSandboxShellDynamicToolExcluded(input.pluginConfig)) return filteredTools;
+function addSandboxShellDynamicToolsIfAvailable(filteredTools, allTools, input, executionPolicy) {
+	if (isCodexMemoryFlushRun(input.params) || !executionPolicy.nativeToolSurfaceAllowed || !input.sandbox?.enabled || !input.sandbox.backendId.trim() || input.nativeToolSurfaceEnabled !== false || isSandboxShellDynamicToolExcluded(input.pluginConfig)) return filteredTools;
 	const execTool = allTools.find((tool) => normalizeCodexDynamicToolName(tool.name) === "exec");
 	const processTool = allTools.find((tool) => normalizeCodexDynamicToolName(tool.name) === "process");
 	if (!execTool || !processTool) return filteredTools;
@@ -1116,16 +574,6 @@ function addSandboxShellDynamicToolsIfAvailable(filteredTools, allTools, input)
 		sandboxProcessTool
 	];
 }
-function shouldExposeSandboxExecDynamicTool(input) {
-	if (isCodexMemoryFlushRun(input.params)) return false;
-	if (isCodexNativeExecutionBlockedByNodeExecHost(input.params, {
-		agentId: input.sessionAgentId,
-		runtimeSessionKey: input.sandboxSessionKey,
-		sandbox: input.sandbox
-	})) return false;
-	const backendId = input.sandbox?.enabled ? input.sandbox.backendId.trim().toLowerCase() : "";
-	return Boolean(backendId && input.nativeToolSurfaceEnabled === false);
-}
 function isSandboxShellDynamicToolExcluded(config) {
 	return isCodexDynamicToolExcluded(config, [
 		"exec",
@@ -1134,32 +582,24 @@ function isSandboxShellDynamicToolExcluded(config) {
 		"sandbox_process"
 	]);
 }
-function addNodeShellDynamicToolsIfNeeded(filteredTools, allTools, input, nodePolicy) {
+async function addNodeShellDynamicToolsIfNeeded(filteredTools, allTools, input, nodePolicy) {
 	if (isCodexMemoryFlushRun(input.params)) return filteredTools;
 	const nodeExecIsDefault = nodePolicy.effectiveExecHost === "node";
 	const nodeExecAvailableFromAuto = nodePolicy.requestedExecHost === "auto" && nodePolicy.effectiveExecHost === "gateway";
 	if (!nodeExecIsDefault && !nodeExecAvailableFromAuto) return filteredTools;
 	const execTool = allTools.find((tool) => normalizeCodexDynamicToolName(tool.name) === "exec");
-	if (!execTool) return filteredTools;
-	if (!isCodexDynamicToolExcluded(input.pluginConfig, ["exec", "node_exec"]) && !filteredTools.some((tool) => normalizeCodexDynamicToolName(tool.name) === "node_exec")) return [...filteredTools, createExecAliasDynamicTool(execTool, {
-		host: "node",
-		node: nodePolicy.node
-	})];
-	return filteredTools;
+	if (!execTool || isCodexDynamicToolExcluded(input.pluginConfig, ["exec", "node_exec"]) || filteredTools.some((tool) => normalizeCodexDynamicToolName(tool.name) === "node_exec")) return filteredTools;
+	const nodeExec = await createNodeExecAliasDynamicTool(execTool, nodePolicy.node, input.runAbortController.signal, input.nodeExecAvailability);
+	return nodeExec ? [...filteredTools, nodeExec] : filteredTools;
 }
 function shouldKeepOpenClawShellDynamicTools(input, nodePolicy) {
 	return !isCodexMemoryFlushRun(input.params) && input.nativeToolSurfaceEnabled === false && input.sandbox?.enabled !== true && nodePolicy.effectiveExecHost !== "node";
 }
-function resolveCodexNativeExecutionPolicyForDynamicTools(input) {
-	return resolveCodexNativeExecutionPolicy({
-		config: input.params.config,
-		sessionKey: resolveCodexRuntimePolicySessionKey(input.params, input.sandboxSessionKey),
-		sessionId: input.params.sessionId,
-		agentId: input.sessionAgentId,
-		execOverrides: input.params.execOverrides,
-		sandboxAvailable: input.sandbox?.enabled,
-		readRuntimeSessionEntry: true
-	});
+/** Keeps replacement shell tools direct even when model metadata mandates Codex Code Mode. */
+function placeDisabledNativeShellToolsInDirectNamespace(tools, nativeToolSurfaceEnabled) {
+	if (nativeToolSurfaceEnabled !== false) return tools;
+	for (const tool of tools) if (CODEX_DISABLED_NATIVE_SHELL_DYNAMIC_TOOLS.has(normalizeCodexDynamicToolName(tool.name))) tool.catalogMode = "direct-only";
+	return tools;
 }
 /** Applies a normalized tool allowlist while preserving shell aliases for exec/process. */
 function filterCodexDynamicToolsForAllowlist(tools, toolsAllow) {
@@ -1172,19 +612,526 @@ function filterCodexDynamicToolsForAllowlist(tools, toolsAllow) {
 		return allowSet.has(normalized) || normalized === "sandbox_exec" && allowSet.has("exec") || normalized === "sandbox_process" && (allowSet.has("exec") || allowSet.has("process")) || normalized === "gateway_exec" && allowSet.has("exec") || normalized === "gateway_process" && (allowSet.has("exec") || allowSet.has("process")) || normalized === "node_exec" && allowSet.has("exec");
 	});
 }
-/** Detects the wildcard allowlist marker after Codex tool-name normalization. */
-function hasWildcardCodexToolsAllow(toolsAllow) {
-	return toolsAllow.some((name) => normalizeCodexDynamicToolName(name) === "*");
+/** Detects the wildcard allowlist marker after Codex tool-name normalization. */
+function hasWildcardCodexToolsAllow(toolsAllow) {
+	return toolsAllow.some((name) => normalizeCodexDynamicToolName(name) === "*");
+}
+/** Forces message delivery through the message tool when the source channel requires it. */
+function shouldForceMessageTool(params) {
+	return params.disableMessageTool !== true && params.sourceReplyDeliveryMode === "message_tool_only";
+}
+//#endregion
+//#region extensions/codex/src/app-server/event-projector-native-tool-lifecycle.ts
+function isMcpToolCallItemNotification(method, params) {
+	return (method === "item/started" || method === "item/completed") && isJsonObject(params.item) && params.item.type === "mcpToolCall";
+}
+/** Owns native item lifetimes, outcome order, presentation, and approval correlation. */
+var CodexNativeToolLifecycleProjector = class {
+	constructor(context, threadId, turnId, options = {}) {
+		this.context = context;
+		this.threadId = threadId;
+		this.turnId = turnId;
+		this.options = options;
+		this.terminalPresentationClearedItemIds = /* @__PURE__ */ new Set();
+		this.nativeToolOutcomeOrdinals = /* @__PURE__ */ new Map();
+		this.startedAtByItem = /* @__PURE__ */ new Map();
+		this.activeItems = /* @__PURE__ */ new Map();
+		this.webSearchCompletionByItem = /* @__PURE__ */ new Map();
+		this.completedItemIds = /* @__PURE__ */ new Set();
+		this.approvalFailureDispositionByItem = /* @__PURE__ */ new Map();
+		this.preToolUseFailureByItem = /* @__PURE__ */ new Map();
+		this.finalized = false;
+		this.turnCompleted = false;
+		this.pendingMcpNotifications = 0;
+	}
+	recordNativeToolOutcome(item) {
+		if (!item || this.nativeToolOutcomeOrdinals.has(item.id) || !shouldClearTerminalPresentationForNativeItem(item)) return;
+		const ordinal = this.context.allocateToolOutcomeOrdinal?.(item.id);
+		if (ordinal !== void 0) this.nativeToolOutcomeOrdinals.set(item.id, ordinal);
+	}
+	clearTerminalPresentationForNativeItem(item) {
+		if (!item || this.terminalPresentationClearedItemIds.has(item.id) || !shouldClearTerminalPresentationForNativeItem(item)) return;
+		const toolCallOrdinal = this.nativeToolOutcomeOrdinals.get(item.id);
+		this.terminalPresentationClearedItemIds.add(item.id);
+		this.context.onToolOutcome?.({
+			toolName: itemName(item) ?? item.type,
+			argsHash: "",
+			resultHash: "",
+			...toolCallOrdinal !== void 0 ? { toolCallOrdinal } : {},
+			terminalPresentation: void 0,
+			presentationOnly: true
+		});
+	}
+	getActiveMcpToolCall(serverName) {
+		if (this.finalized || this.turnCompleted || this.pendingMcpNotifications > 0 || this.options.runAbortSignal?.aborted) return;
+		let candidate;
+		for (const { mcpToolCall } of this.activeItems.values()) {
+			if (mcpToolCall?.server !== serverName) continue;
+			if (candidate) return;
+			candidate = mcpToolCall;
+		}
+		if (!candidate || candidate.status !== "inProgress" || typeof candidate.server !== "string" || !candidate.server.trim() || typeof candidate.tool !== "string" || !candidate.tool.trim() || candidate.arguments === void 0 || candidate.appContext != null || candidate.pluginId != null) return;
+		return {
+			id: candidate.id,
+			server: candidate.server,
+			tool: candidate.tool,
+			arguments: candidate.arguments
+		};
+	}
+	recordMcpToolCallReceipt(notification) {
+		const params = isJsonObject(notification.params) ? notification.params : void 0;
+		if (!params || !isCodexNotificationForTurn(params, this.threadId, this.turnId)) return;
+		if (isMcpToolCallItemNotification(notification.method, params)) this.pendingMcpNotifications += 1;
+		else if (notification.method === "turn/completed" && readCodexTurn(params.turn)?.id === this.turnId) this.turnCompleted = true;
+	}
+	handleNotification(notification) {
+		const params = isJsonObject(notification.params) ? notification.params : void 0;
+		if (!params || !isCodexNotificationForTurn(params, this.threadId, this.turnId)) return;
+		if (this.pendingMcpNotifications > 0 && isMcpToolCallItemNotification(notification.method, params)) this.pendingMcpNotifications -= 1;
+		if (notification.method === "turn/completed") {
+			const turn = readCodexTurn(params.turn);
+			if (!turn || turn.id !== this.turnId) return;
+			this.turnCompleted = true;
+			for (const item of turn.items ?? []) this.recordSnapshotItem(item);
+			return;
+		}
+		if (notification.method === "rawResponseItem/completed") {
+			const item = isJsonObject(params.item) ? params.item : void 0;
+			if (item) this.recordRawWebSearchResult(item);
+			return;
+		}
+		if (notification.method !== "item/started" && notification.method !== "item/completed") return;
+		const item = readItem(params.item);
+		if (!item) return;
+		this.recordItem({
+			phase: notification.method === "item/started" ? "start" : "result",
+			item,
+			sourceTimestampMs: asDateTimestampMs(notification.method === "item/started" ? params.startedAtMs : params.completedAtMs)
+		});
+	}
+	recordItem(params) {
+		const toolName = auditNativeToolName(params.item) ?? (params.item.type === "mcpToolCall" ? params.item.type : void 0);
+		if (!toolName || this.completedItemIds.has(params.item.id)) return;
+		if (params.phase === "start") {
+			this.recordStarted(params.item.id, toolName, auditNativeToolUnfinishedStatus(params.item), params.sourceTimestampMs, params.item.type === "mcpToolCall" ? params.item : void 0);
+			return;
+		}
+		if (params.item.type === "webSearch") {
+			this.webSearchCompletionByItem.set(params.item.id, {
+				runWasAborted: this.options.runAbortSignal?.aborted === true,
+				sourceTimestampMs: params.sourceTimestampMs
+			});
+			return;
+		}
+		const itemDurationMs = typeof params.item.durationMs === "number" ? params.item.durationMs : void 0;
+		this.recordTerminal(params.item.id, toolName, auditNativeToolTerminalStatus(params.item), {
+			itemDurationMs,
+			sourceTimestampMs: params.sourceTimestampMs
+		});
+	}
+	recordApprovalFailureDisposition(toolCallId, disposition) {
+		if (!this.completedItemIds.has(toolCallId)) this.approvalFailureDispositionByItem.set(toolCallId, disposition);
+	}
+	recordPreToolUseFailure(failure, runWasAborted = this.options.runAbortSignal?.aborted === true) {
+		if (this.completedItemIds.has(failure.toolCallId)) return;
+		const record = {
+			failure,
+			terminalReason: runWasAborted && this.options.runAbortSignal ? resolveCodexToolAbortTerminalReason(this.options.runAbortSignal) : failure.disposition
+		};
+		if (this.finalized) {
+			this.completedItemIds.add(failure.toolCallId);
+			this.emitPreToolUseFailure(record, failure.toolName, failure.durationMs);
+			return;
+		}
+		this.preToolUseFailureByItem.set(failure.toolCallId, record);
+	}
+	recordRawWebSearchResult(item) {
+		if (readStringField(item, "type") !== "web_search_call") return;
+		const toolCallId = readStringField(item, "id");
+		if (!toolCallId || this.completedItemIds.has(toolCallId)) return;
+		const toolName = "web_search";
+		this.recordStarted(toolCallId, toolName, "unknown");
+		const rawStatus = readStringField(item, "status");
+		if (rawStatus === "in_progress" || rawStatus === "running") return;
+		const status = rawStatus === "completed" ? "completed" : rawStatus === "cancelled" ? "cancelled" : rawStatus === "failed" || rawStatus === "error" || rawStatus === "incomplete" ? "failed" : "unknown";
+		this.recordTerminal(toolCallId, toolName, status, { sourceTimestampMs: this.webSearchCompletionByItem.get(toolCallId)?.sourceTimestampMs });
+	}
+	recordTerminal(toolCallId, toolName, status, options = {}) {
+		const runWasAborted = options.runWasAborted ?? this.options.runAbortSignal?.aborted === true;
+		const preToolUseFailure = this.preToolUseFailureByItem.get(toolCallId);
+		this.preToolUseFailureByItem.delete(toolCallId);
+		const approvalFailureDisposition = this.approvalFailureDispositionByItem.get(toolCallId);
+		this.approvalFailureDispositionByItem.delete(toolCallId);
+		this.completedItemIds.add(toolCallId);
+		this.activeItems.delete(toolCallId);
+		this.webSearchCompletionByItem.delete(toolCallId);
+		const startedAt = this.startedAtByItem.get(toolCallId);
+		this.startedAtByItem.delete(toolCallId);
+		const endedAt = options.sourceTimestampMs ?? Date.now();
+		const durationMs = options.itemDurationMs ?? (startedAt === void 0 ? 0 : Math.max(0, endedAt - startedAt));
+		if (preToolUseFailure) {
+			this.emitPreToolUseFailure(preToolUseFailure, toolName, durationMs, options.sourceTimestampMs);
+			return;
+		}
+		const terminalEvent = approvalFailureDisposition ? {
+			type: "tool.execution.error",
+			durationMs,
+			errorCategory: "codex_native_tool_approval",
+			terminalReason: approvalFailureDisposition
+		} : status === "blocked" ? {
+			type: "tool.execution.blocked",
+			reason: "codex_native_tool_blocked",
+			deniedReason: "codex_native_tool_blocked"
+		} : status === "failed" || status === "cancelled" || status === "unknown" ? {
+			type: "tool.execution.error",
+			durationMs,
+			errorCategory: status === "unknown" ? "codex_native_tool_outcome_unknown" : status === "cancelled" ? "aborted" : "codex_native_tool_error",
+			...status === "unknown" ? { errorCode: "tool_outcome_unknown" } : {},
+			terminalReason: status === "unknown" ? "failed" : runWasAborted && this.options.runAbortSignal ? resolveCodexToolAbortTerminalReason(this.options.runAbortSignal) : status === "cancelled" ? "cancelled" : "failed"
+		} : {
+			type: "tool.execution.completed",
+			durationMs
+		};
+		emitTrustedDiagnosticEvent({
+			...this.buildBase(toolCallId, toolName),
+			...terminalEvent,
+			...options.sourceTimestampMs !== void 0 ? { sourceTimestampMs: options.sourceTimestampMs } : {}
+		});
+	}
+	finalizeActive(runWasAborted = this.options.runAbortSignal?.aborted === true) {
+		this.finalized = true;
+		for (const [toolCallId, { toolName, unfinishedStatus }] of this.activeItems) {
+			const webSearchCompletion = this.webSearchCompletionByItem.get(toolCallId);
+			const itemRunWasAborted = webSearchCompletion ? webSearchCompletion.runWasAborted : runWasAborted;
+			this.recordTerminal(toolCallId, toolName, unfinishedStatus, {
+				runWasAborted: itemRunWasAborted,
+				sourceTimestampMs: webSearchCompletion?.sourceTimestampMs
+			});
+		}
+		for (const [toolCallId, record] of this.preToolUseFailureByItem) if (!this.completedItemIds.has(toolCallId)) this.recordTerminal(toolCallId, record.failure.toolName, "failed", { itemDurationMs: record.failure.durationMs });
+		this.activeItems.clear();
+		this.webSearchCompletionByItem.clear();
+		this.approvalFailureDispositionByItem.clear();
+		this.preToolUseFailureByItem.clear();
+	}
+	emitPreToolUseFailure(record, toolName, durationMs, sourceTimestampMs) {
+		emitCodexNativePreToolUseFailureDiagnostic({
+			agentId: this.context.agentId,
+			sessionId: this.context.sessionId,
+			sessionKey: this.context.sessionKey,
+			runId: this.context.runId,
+			failure: {
+				...record.failure,
+				toolName,
+				durationMs
+			},
+			terminalReason: record.terminalReason,
+			sourceTimestampMs
+		});
+	}
+	recordSnapshotItem(item) {
+		if (!auditNativeToolName(item) || this.completedItemIds.has(item.id) || itemStatus(item) === "running") return;
+		const toolName = auditNativeToolName(item);
+		if (!toolName) return;
+		this.recordStarted(item.id, toolName, auditNativeToolUnfinishedStatus(item));
+		this.recordItem({
+			phase: "result",
+			item
+		});
+	}
+	recordStarted(toolCallId, toolName, unfinishedStatus, sourceTimestampMs, mcpToolCall) {
+		if (this.activeItems.has(toolCallId)) return;
+		this.startedAtByItem.set(toolCallId, sourceTimestampMs ?? Date.now());
+		this.activeItems.set(toolCallId, {
+			toolName,
+			unfinishedStatus,
+			mcpToolCall
+		});
+		emitTrustedDiagnosticEvent({
+			type: "tool.execution.started",
+			...this.buildBase(toolCallId, toolName),
+			...sourceTimestampMs !== void 0 ? { sourceTimestampMs } : {}
+		});
+	}
+	buildBase(toolCallId, toolName) {
+		return {
+			agentId: this.context.agentId,
+			runId: this.context.runId,
+			sessionId: this.context.sessionId,
+			sessionKey: this.context.sessionKey,
+			toolName,
+			toolCallId
+		};
+	}
+};
+//#endregion
+//#region extensions/codex/src/app-server/remote-workspace-media.ts
+const REMOTE_WORKSPACE_MEDIA_TIMEOUT_MS = 6e4;
+const REMOTE_WORKSPACE_MEDIA_MAX_BYTES = 67108864;
+const REMOTE_WORKSPACE_MEDIA_MAX_ATTACHMENTS = 16;
+const CODEX_REMOTE_MEDIA_CHUNK_BYTES = 524288;
+const CODEX_REMOTE_COMMAND_DEFAULT_OUTPUT_BYTES = 1048576;
+const CODEX_BOUNDED_REMOTE_FILE_READER = [
+	"try{",
+	"const fs=require(\"node:fs\");",
+	"const path=require(\"node:path\");",
+	"const file=process.argv[1];",
+	"const max=Number(process.argv[2]);",
+	"const offset=Number(process.argv[3]);",
+	"const chunk=Number(process.argv[4]);",
+	"const workspace=process.argv[5];",
+	"if(!Number.isSafeInteger(max)||max<0)throw Error(\"invalid media byte limit\");",
+	"if(!Number.isSafeInteger(offset)||offset<0||!Number.isSafeInteger(chunk)||chunk<=0)throw Error(\"invalid media chunk\");",
+	"if(fs.lstatSync(file).isSymbolicLink())throw Error(\"symbolic links are not allowed\");",
+	"const noFollow=fs.constants.O_NOFOLLOW??0;",
+	"const fd=fs.openSync(file,fs.constants.O_RDONLY|noFollow);",
+	"try{",
+	"const before=fs.fstatSync(fd);",
+	"if(!before.isFile())throw Error(\"not a regular file\");",
+	"if(workspace){",
+	"const descriptor=process.platform===\"linux\"?fs.realpathSync(`/proc/self/fd/${fd}`):fs.realpathSync(file);",
+	"const relative=path.relative(fs.realpathSync(workspace),descriptor);",
+	"if(!relative||relative===\"..\"||relative.startsWith(`..${path.sep}`)||path.isAbsolute(relative))throw Error(\"file escapes remote workspace\");",
+	"const verified=fs.statSync(descriptor);",
+	"if(verified.dev!==before.dev||verified.ino!==before.ino)throw Error(\"file changed while being opened\");",
+	"}",
+	"if(before.size>max)throw Error(`file exceeds limit of ${max} bytes`);",
+	"if(offset>before.size)throw Error(\"file changed while being read\");",
+	"const expected=Math.min(chunk,before.size-offset);",
+	"const buffer=Buffer.allocUnsafe(expected);",
+	"let total=0;",
+	"while(total<buffer.length){",
+	"const count=fs.readSync(fd,buffer,total,buffer.length-total,offset+total);",
+	"if(count===0)break;total+=count;",
+	"}",
+	"if(total!==expected)throw Error(\"file changed while being read\");",
+	"const after=fs.fstatSync(fd);",
+	"const revision=stat=>[stat.dev,stat.ino,stat.size,stat.mtimeMs,stat.ctimeMs].join(\":\");",
+	"if(!after.isFile()||revision(after)!==revision(before))throw Error(\"file changed while being read\");",
+	"process.stdout.write(JSON.stringify({dataBase64:buffer.toString(\"base64\"),size:before.size,revision:revision(before)}));",
+	"}finally{fs.closeSync(fd)}",
+	"}catch(error){process.stderr.write(error instanceof Error?error.message:String(error));process.exitCode=1}"
+].join("");
+const MESSAGE_MEDIA_KEYS = [
+	"media",
+	"mediaUrl",
+	"media_url",
+	"path",
+	"filePath",
+	"fileUrl",
+	"imageUrl",
+	"image_url"
+];
+const MESSAGE_MEDIA_ARRAY_KEYS = [
+	"mediaUrls",
+	"media_urls",
+	"imageUrls",
+	"image_urls"
+];
+const ATTACHMENT_MEDIA_KEYS = [
+	"media",
+	"mediaUrl",
+	"path",
+	"filePath",
+	"fileUrl",
+	"url"
+];
+/** Reads actual remote bytes with a cap enforced by Codex before transport. */
+async function readBoundedCodexRemoteWorkspaceFile(params) {
+	if (!Number.isSafeInteger(params.maxBytes) || params.maxBytes < 0) throw new Error("Codex remote workspace upload requires a valid media byte limit.");
+	params.signal?.throwIfAborted();
+	const chunks = [];
+	let offset = 0;
+	let expectedSize;
+	let expectedRevision;
+	const startedAt = Date.now();
+	do {
+		params.signal?.throwIfAborted();
+		const timeoutMs = params.timeoutMs === void 0 ? void 0 : params.timeoutMs - (Date.now() - startedAt);
+		if (timeoutMs !== void 0 && timeoutMs <= 0) throw new Error("Codex remote workspace file transfer timed out.");
+		let response;
+		try {
+			response = await params.client.request("command/exec", {
+				command: [
+					"node",
+					"-e",
+					CODEX_BOUNDED_REMOTE_FILE_READER,
+					"--",
+					params.path,
+					String(params.maxBytes),
+					String(offset),
+					String(CODEX_REMOTE_MEDIA_CHUNK_BYTES),
+					...params.workspaceRoot ? [params.workspaceRoot] : []
+				],
+				env: {
+					NODE_OPTIONS: null,
+					NODE_PATH: null
+				},
+				...timeoutMs === void 0 ? {} : { timeoutMs }
+			}, {
+				signal: params.signal,
+				timeoutMs
+			});
+		} catch (error) {
+			if (error instanceof Error && /failed to spawn|executable.*not found|\bENOENT\b/iu.test(error.message)) throw new Error("Codex remote workspace file transfer requires Node.js on the remote app-server host.", { cause: error });
+			throw error;
+		}
+		if (!response || response.exitCode !== 0) {
+			const detail = typeof response?.stderr === "string" ? response.stderr.trim() : "";
+			throw new Error(`Codex remote workspace artifact could not be read: ${params.path}${detail ? `: ${detail}` : ""}`);
+		}
+		if (typeof response.stdout !== "string" || response.stdout.length > CODEX_REMOTE_COMMAND_DEFAULT_OUTPUT_BYTES) throw new Error("Codex remote workspace artifact exceeded the native command output cap.");
+		let payload;
+		try {
+			payload = JSON.parse(response.stdout);
+		} catch {
+			throw new Error("Codex remote workspace artifact returned invalid chunk data.");
+		}
+		if (!payload || typeof payload !== "object" || Array.isArray(payload)) throw new Error("Codex remote workspace artifact returned invalid chunk data.");
+		const chunk = payload;
+		if (typeof chunk.dataBase64 !== "string" || !Number.isSafeInteger(chunk.size) || chunk.size < 0 || chunk.size > params.maxBytes || typeof chunk.revision !== "string" || !chunk.revision) throw new Error("Codex remote workspace artifact returned invalid or oversized chunk data.");
+		if (expectedSize === void 0) {
+			expectedSize = chunk.size;
+			expectedRevision = chunk.revision;
+		}
+		if (chunk.size !== expectedSize || chunk.revision !== expectedRevision) throw new Error("Codex remote workspace artifact changed during chunked transfer.");
+		const remainingBytes = expectedSize - offset;
+		const expectedChunkBytes = Math.min(CODEX_REMOTE_MEDIA_CHUNK_BYTES, remainingBytes);
+		if (chunk.dataBase64.length > Math.ceil(expectedChunkBytes / 3) * 4) throw new Error("Codex remote workspace artifact returned oversized chunk data.");
+		const buffer = Buffer.from(chunk.dataBase64, "base64");
+		if (buffer.byteLength !== expectedChunkBytes || buffer.toString("base64") !== chunk.dataBase64) throw new Error("Codex remote workspace artifact returned invalid chunk data.");
+		chunks.push(buffer);
+		offset += buffer.byteLength;
+	} while (offset < (expectedSize ?? 0));
+	return { dataBase64: Buffer.concat(chunks, offset).toString("base64") };
+}
+/** Stages authoritative bounded remote bytes into immutable Gateway-owned media. */
+async function prepareCodexRemoteWorkspaceMessageMedia(params) {
+	const { localWorkspaceRoot, remoteWorkspaceRoot } = params;
+	if (!localWorkspaceRoot || !remoteWorkspaceRoot) return params.args;
+	const remotePathsByLocalPath = /* @__PURE__ */ new Map();
+	const gatewayManagedPaths = /* @__PURE__ */ new Set();
+	const gatewayMediaRoot = getMediaDir();
+	let attachmentEntries = 0;
+	const mapMediaPath = (value) => {
+		if (typeof value !== "string") return value;
+		if (path.isAbsolute(value) && isPathStrictlyInside(gatewayMediaRoot, value)) {
+			attachmentEntries += 1;
+			gatewayManagedPaths.add(value);
+			return value;
+		}
+		const mapped = mapCodexAppServerLocalWorkspacePath({
+			value,
+			localWorkspaceRoot,
+			remoteWorkspaceRoot
+		});
+		if (value.trim() && !isCodexPassThroughMediaSource(value)) {
+			attachmentEntries += 1;
+			remotePathsByLocalPath.set(mapped, mapCodexAppServerRemoteWorkspacePath({
+				value: mapped,
+				localWorkspaceRoot,
+				remoteWorkspaceRoot
+			}));
+		}
+		return mapped;
+	};
+	let mappedArgs = params.args;
+	const setMappedValue = (key, value) => {
+		if (value === params.args[key]) return;
+		if (mappedArgs === params.args) mappedArgs = { ...params.args };
+		mappedArgs[key] = value;
+	};
+	for (const key of MESSAGE_MEDIA_KEYS) setMappedValue(key, mapMediaPath(params.args[key]));
+	for (const key of MESSAGE_MEDIA_ARRAY_KEYS) {
+		const value = params.args[key];
+		if (Array.isArray(value)) {
+			const mapped = value.map(mapMediaPath);
+			if (mapped.some((entry, index) => entry !== value[index])) setMappedValue(key, mapped);
+		}
+	}
+	if (Array.isArray(params.args.attachments)) {
+		const attachments = params.args.attachments;
+		const mapped = attachments.map((attachment) => {
+			if (!attachment || typeof attachment !== "object" || Array.isArray(attachment)) return attachment;
+			const record = attachment;
+			let mappedAttachment = record;
+			for (const key of ATTACHMENT_MEDIA_KEYS) {
+				const value = mapMediaPath(record[key]);
+				if (value !== record[key]) {
+					if (mappedAttachment === record) mappedAttachment = { ...record };
+					mappedAttachment[key] = value;
+				}
+			}
+			return mappedAttachment;
+		});
+		if (mapped.some((attachment, index) => attachment !== attachments[index])) setMappedValue("attachments", mapped);
+	}
+	if (attachmentEntries > REMOTE_WORKSPACE_MEDIA_MAX_ATTACHMENTS) throw new Error(`Codex remote workspace upload exceeds the ${REMOTE_WORKSPACE_MEDIA_MAX_ATTACHMENTS}-attachment limit.`);
+	for (const managedPath of gatewayManagedPaths) await assertGatewayManagedMediaPath(managedPath, gatewayMediaRoot);
+	if (remotePathsByLocalPath.size === 0) return mappedArgs;
+	const readRemoteFile = params.readRemoteFile;
+	if (!readRemoteFile) throw new Error("Codex remote workspace file transfer requires an active app-server client.");
+	const maxBytes = params.maxBytes ?? REMOTE_WORKSPACE_MEDIA_MAX_BYTES;
+	const timeoutMs = params.timeoutMs ?? REMOTE_WORKSPACE_MEDIA_TIMEOUT_MS;
+	const deadline = Date.now() + timeoutMs;
+	const stagedPaths = /* @__PURE__ */ new Map();
+	let totalBytes = 0;
+	for (const [localPath, remotePath] of remotePathsByLocalPath) {
+		params.signal?.throwIfAborted();
+		const remainingBytes = maxBytes - totalBytes;
+		const remainingMs = deadline - Date.now();
+		if (remainingMs <= 0) throw new Error("Codex remote workspace attachment batch timed out.");
+		const response = await readRemoteFile({
+			path: remotePath,
+			maxBytes: remainingBytes,
+			workspaceRoot: remoteWorkspaceRoot,
+			signal: params.signal,
+			timeoutMs: remainingMs
+		});
+		if (!response || typeof response.dataBase64 !== "string") throw new Error(`Codex remote workspace artifact returned no file data: ${remotePath}`);
+		if (response.dataBase64.length > Math.ceil(remainingBytes / 3) * 4) throw new Error(`Codex remote workspace artifact exceeds the limit of ${remainingBytes} bytes.`);
+		const remoteBuffer = Buffer.from(response.dataBase64, "base64");
+		if (remoteBuffer.byteLength > remainingBytes || remoteBuffer.toString("base64") !== response.dataBase64) throw new Error(`Codex remote workspace artifact returned invalid or oversized file data: ${remotePath}`);
+		totalBytes += remoteBuffer.byteLength;
+		const saved = await saveMediaBuffer(remoteBuffer, void 0, "outbound", maxBytes, path.basename(remotePath));
+		stagedPaths.set(localPath, saved.path);
+	}
+	return mapMessageMediaValues(mappedArgs, (value) => stagedPaths.get(value) ?? value);
+}
+async function assertGatewayManagedMediaPath(value, mediaRoot) {
+	const opened = await (await root(mediaRoot, { symlinks: "reject" })).open(path.relative(mediaRoot, value), { symlinks: "reject" });
+	try {
+		if (!(await opened.handle.stat()).isFile()) throw new Error(`Codex Gateway-managed media is not a regular file: ${value}`);
+	} finally {
+		await opened[Symbol.asyncDispose]();
+	}
 }
-/** Forces message delivery through the message tool when the source channel requires it. */
-function shouldForceMessageTool(params) {
-	return params.disableMessageTool !== true && params.sourceReplyDeliveryMode === "message_tool_only";
+function mapMessageMediaValues(args, mapValue) {
+	const mapped = { ...args };
+	for (const key of MESSAGE_MEDIA_KEYS) {
+		const value = mapped[key];
+		if (typeof value === "string") mapped[key] = mapValue(value);
+	}
+	for (const key of MESSAGE_MEDIA_ARRAY_KEYS) {
+		const value = mapped[key];
+		if (Array.isArray(value)) mapped[key] = value.map((entry) => typeof entry === "string" ? mapValue(entry) : entry);
+	}
+	if (Array.isArray(mapped.attachments)) mapped.attachments = mapped.attachments.map((attachment) => {
+		if (!attachment || typeof attachment !== "object" || Array.isArray(attachment)) return attachment;
+		const record = { ...attachment };
+		for (const key of ATTACHMENT_MEDIA_KEYS) {
+			const value = record[key];
+			if (typeof value === "string") record[key] = mapValue(value);
+		}
+		return record;
+	});
+	return mapped;
 }
 //#endregion
 //#region extensions/codex/src/app-server/sandbox-exec-server-node-relay.ts
-const CODEX_NODE_EXEC_SERVER_MAX_MESSAGE_BYTES$1 = 64 * 1024 * 1024;
+const CODEX_NODE_EXEC_SERVER_MAX_MESSAGE_BYTES$1 = 67108864;
 const CODEX_NODE_EXEC_SERVER_MAX_FAILURE_DETAIL_CHARS = 240;
-const CODEX_NODE_HTTP_CREDENTIAL_BODY_MAX_BYTES = 1024 * 1024;
+const CODEX_NODE_HTTP_CREDENTIAL_BODY_MAX_BYTES = 1048576;
 const CODEX_NODE_HTTP_CREDENTIAL_SCAN_MAX_FIELDS = 256;
 const CODEX_NODE_HTTP_CREDENTIAL_SCAN_MAX_DEPTH = 8;
 const CODEX_NODE_HTTP_CREDENTIAL_HEADER_NAMES = /* @__PURE__ */ new Set([
@@ -1824,10 +1771,10 @@ function joinSandboxChildPath(parent, child) {
 * Implements filesystem JSON-RPC handlers for the Codex sandbox exec-server
 * with OpenClaw sandbox policy checks before every bridge operation.
 */
-const CODEX_SANDBOX_EXEC_SERVER_MAX_READ_FILE_BYTES = 512 * 1024 * 1024;
+const CODEX_SANDBOX_EXEC_SERVER_MAX_READ_FILE_BYTES = 536870912;
 const CODEX_SANDBOX_EXEC_SERVER_MAX_OPEN_FILE_READS = 128;
-const CODEX_SANDBOX_EXEC_SERVER_MAX_BUFFERED_FILE_READ_BYTES = 64 * 1024 * 1024;
-const CODEX_SANDBOX_EXEC_SERVER_MAX_READ_BLOCK_BYTES = 1024 * 1024;
+const CODEX_SANDBOX_EXEC_SERVER_MAX_BUFFERED_FILE_READ_BYTES = 67108864;
+const CODEX_SANDBOX_EXEC_SERVER_MAX_READ_BLOCK_BYTES = 1048576;
 const CODEX_SANDBOX_EXEC_SERVER_MAX_FILE_READ_HANDLE_ID_BYTES = 32;
 /** Opens a policy-checked sandbox file under a bounded, connection-owned handle. */
 async function openFile(execServer, handles, params) {
@@ -2231,7 +2178,7 @@ function delay(ms) {
 * access through the active OpenClaw sandbox backend.
 */
 /** Maximum JSON-line size accepted from the streaming HTTP helper process. */
-const SANDBOX_HTTP_STREAM_LINE_MAX_CHARS = 256 * 1024;
+const SANDBOX_HTTP_STREAM_LINE_MAX_CHARS = 262144;
 /** Handles one sandbox HTTP JSON-RPC request, optionally streaming response body deltas. */
 async function httpRequest(execServer, notifications, params) {
 	const record = requireObject(params, "http/request params");
@@ -2543,6 +2490,9 @@ def assert_url_allowed(url):
     PINNED_ADDRESSES[hostname] = sorted(addresses)
 
 class GuardedRedirectHandler(urllib.request.HTTPRedirectHandler):
+    # Python 3.9 lacks the 308 dispatch alias; use the same guarded redirect path.
+    http_error_308 = urllib.request.HTTPRedirectHandler.http_error_302
+
     def __init__(self, redirect_policy):
         self.redirect_policy = redirect_policy
 
@@ -2656,7 +2606,7 @@ python3 "$tmp"
 * termination for Codex sandbox exec-server process RPCs.
 */
 const ENV_KEY_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
-const RETAINED_PROCESS_OUTPUT_BYTES = 1024 * 1024;
+const RETAINED_PROCESS_OUTPUT_BYTES = 1048576;
 const CLOSED_PROCESS_EVICTION_MS = 6e4;
 /** Starts a sandbox-backed process and registers it in the connection-local process table. */
 async function startProcess(execServer, processes, notify, params) {
@@ -2913,10 +2863,11 @@ function readEnv(value) {
 	return env;
 }
 function readProcessEnv(record) {
-	return sanitizeEnvVars({
+	const requestedEnv = {
 		...buildEnvFromPolicy(record.envPolicy),
 		...readEnv(record.env)
-	}).allowed;
+	};
+	return sanitizeEnvVars(requestedEnv).allowed;
 }
 function buildEnvFromPolicy(value) {
 	if (!value || typeof value !== "object" || Array.isArray(value)) return {};
@@ -3031,8 +2982,8 @@ var CodexSandboxExecSession = class {
 * Hosts the local OpenClaw sandbox exec-server that Codex app-server native
 * execution can register as an external environment.
 */
-const CODEX_SANDBOX_EXEC_SERVER_MAX_INBOUND_MESSAGE_BYTES = 100 * 1024 * 1024;
-const CODEX_NODE_EXEC_SERVER_MAX_MESSAGE_BYTES = 64 * 1024 * 1024;
+const CODEX_SANDBOX_EXEC_SERVER_MAX_INBOUND_MESSAGE_BYTES = 104857600;
+const CODEX_NODE_EXEC_SERVER_MAX_MESSAGE_BYTES = 67108864;
 const codexNodeExecServerLeases = /* @__PURE__ */ new WeakMap();
 /** Starts or reuses a sandbox exec-server and registers it with Codex app-server. */
 async function ensureCodexSandboxExecServerEnvironment(params) {
@@ -3323,52 +3274,6 @@ async function handleMessage(session, data) {
 	await session.handleRequest(parseRequest(buffer.toString("utf8")));
 }
 //#endregion
-//#region extensions/codex/src/app-server/provider-capabilities.ts
-function resolveOverriddenProviderWebSearchSupport(modelProviderOverride) {
-	const provider = modelProviderOverride?.trim().toLowerCase();
-	if (!provider) return;
-	return provider === "openai" ? "supported" : "unsupported";
-}
-async function readConfiguredProviderWebSearchSupport(params) {
-	return (await params.client.request("modelProvider/capabilities/read", {}, {
-		timeoutMs: params.timeoutMs,
-		signal: params.signal
-	})).webSearch ? "supported" : "unsupported";
-}
-async function resolveCodexProviderWebSearchSupportForClient(params) {
-	const overrideSupport = resolveOverriddenProviderWebSearchSupport(params.modelProviderOverride);
-	if (overrideSupport) return overrideSupport;
-	try {
-		return await readConfiguredProviderWebSearchSupport(params);
-	} catch {
-		return "unknown";
-	}
-}
-async function resolveCodexProviderWebSearchSupport(params) {
-	const overrideSupport = resolveOverriddenProviderWebSearchSupport(params.modelProviderOverride);
-	if (overrideSupport) return overrideSupport;
-	let client;
-	try {
-		client = await params.clientFactory({
-			startOptions: params.appServer.start,
-			...params.preparedAuth ? { preparedAuth: params.preparedAuth } : { authProfileId: params.authProfileId },
-			agentDir: params.agentDir,
-			config: params.config,
-			timeoutMs: params.appServer.requestTimeoutMs
-		});
-		return await resolveCodexProviderWebSearchSupportForClient({
-			client,
-			timeoutMs: params.appServer.requestTimeoutMs,
-			modelProviderOverride: params.modelProviderOverride,
-			signal: params.signal
-		});
-	} catch {
-		return "unknown";
-	} finally {
-		if (client) releaseLeasedSharedCodexAppServerClient(client);
-	}
-}
-//#endregion
 //#region extensions/codex/src/app-server/approval-bridge.ts
 /**
 * Bridges Codex app-server approval requests into OpenClaw policy hooks and
@@ -3413,6 +3318,8 @@ async function handleCodexAppServerApprovalRequest(params) {
 			resolvedOutcome = "approved-once";
 			resolvedMessage = "Codex app-server approval granted for this byte-bound command only.";
 		}
+		params.signal?.throwIfAborted();
+		if (resolvedOutcome !== "denied") params.paramsForRun.hostCapabilities.assertActive();
 		emitApprovalEvent(params.paramsForRun, {
 			phase: "resolved",
 			kind: context.kind,
@@ -3451,6 +3358,7 @@ async function handleCodexAppServerApprovalRequest(params) {
 			autoApprove: params.autoApprove,
 			signal: params.signal
 		});
+		params.signal?.throwIfAborted();
 		if (policyOutcome?.outcome === "denied") {
 			recordNativeToolFailureDisposition(params, context, policyOutcome.failureDisposition);
 			return await resolvePolicyApproval("denied", policyOutcome.reason);
@@ -3459,6 +3367,7 @@ async function handleCodexAppServerApprovalRequest(params) {
 		if (CONCRETE_TOOL_AUTO_APPROVAL_METHODS.has(params.method) && !readNetworkApprovalContext(requestParams) && params.autoApprove === true) return await resolvePolicyApproval("approved-session", "Codex app-server approval auto-approved by runtime policy.");
 		const requestResult = await requestPluginApproval({
 			hostCapabilities: params.paramsForRun.hostCapabilities,
+			signal: params.signal,
 			title: context.title,
 			description: context.description,
 			severity: context.severity,
@@ -3972,7 +3881,8 @@ function summarizeNetworkPolicyAmendments(value) {
 function sanitizePermissionHostValue(value) {
 	const withoutScheme = sanitizePermissionScalar(value).toLowerCase().replace(/^[a-z][a-z0-9+.-]*:\/\//, "");
 	const authority = withoutScheme.split(/[/?#]/, 1)[0] ?? withoutScheme;
-	return truncateCodexApprovalDisplayText(authority.includes("@") ? authority.slice(authority.lastIndexOf("@") + 1) : authority, PERMISSION_VALUE_MAX_LENGTH);
+	const withoutUserInfo = authority.includes("@") ? authority.slice(authority.lastIndexOf("@") + 1) : authority;
+	return truncateCodexApprovalDisplayText(withoutUserInfo, PERMISSION_VALUE_MAX_LENGTH);
 }
 function sanitizePermissionPathValue(value) {
 	return truncateCodexApprovalDisplayText(formatApprovalDisplayPath(sanitizePermissionScalar(value)), PERMISSION_VALUE_MAX_LENGTH);
@@ -4101,7 +4011,8 @@ function appendPreviewPart(source, part, separator) {
 }
 function sanitizeApprovalPreview(source, maxLength) {
 	if (!source || !source.value) return { omitted: false };
-	const sanitized = sanitizeCodexApprovalVisibleText(stripDanglingCodexApprovalTerminalSequence(source.value));
+	const rawPreview = stripDanglingCodexApprovalTerminalSequence(source.value);
+	const sanitized = sanitizeCodexApprovalVisibleText(rawPreview);
 	if (!sanitized) return { omitted: true };
 	return {
 		text: formatCodexDisplayText(truncateCodexApprovalDisplayText(sanitized, maxLength)),
@@ -4246,6 +4157,7 @@ async function routeCodexAppServerElicitationRequest(params) {
 	const requestTurnId = requestParams.turnId;
 	if (requestTurnId !== null && requestTurnId !== void 0 && requestTurnId !== params.turnId) return { kind: "not-mine" };
 	if (!((isJsonObject(requestParams["_meta"]) ? requestParams["_meta"] : void 0)?.[MCP_TOOL_APPROVAL_KIND_KEY] === MCP_TOOL_APPROVAL_KIND || params.computerUseMcpServerName !== void 0 && readNonBlankStringField(requestParams, "serverName") === params.computerUseMcpServerName)) return { kind: "not-mine" };
+	if (params.signal?.aborted) return handled(createCodexElicitationResponse("cancel"));
 	const pluginResolution = resolvePluginElicitation({
 		requestParams,
 		pluginAppPolicyContext: params.pluginAppPolicyContext
@@ -4270,16 +4182,63 @@ async function routeCodexAppServerElicitationRequest(params) {
 			signal: params.signal
 		}));
 	}
-	const approvalPrompt = readComputerUseApprovalElicitation(requestParams, params.computerUseMcpServerName) ?? readBridgeableApprovalElicitation(requestParams);
+	const computerUsePrompt = readComputerUseApprovalElicitation(requestParams, params.computerUseMcpServerName);
+	const approvalPrompt = computerUsePrompt ?? readBridgeableApprovalElicitation(requestParams);
 	if (!approvalPrompt) return handled(createCodexElicitationResponse("decline"));
+	let persistence;
+	if (!computerUsePrompt) {
+		const serverName = readNonBlankStringField(requestParams, "serverName");
+		const server = serverName ? params.paramsForRun.config?.mcp?.servers?.[serverName] : void 0;
+		const mode = serverName ? resolveProjectedMcpCodexToolApprovalMode(serverName, server ?? {}, params.projectedMcpServers?.[serverName]) : void 0;
+		if (!requiresMcpCodexToolApproval({
+			mode,
+			fullPermission: params.autoApproveMcpTools
+		})) {
+			params.paramsForRun.hostCapabilities.assertActive();
+			return handled(buildElicitationResponse(approvalPrompt, "approved-once"));
+		}
+		if (mode === "prompt") approvalPrompt.allowedDecisions = ["allow-once", "deny"];
+		else if (serverName && serverName !== CODEX_APPS_SERVER_NAME && Object.hasOwn(params.paramsForRun.config?.mcp?.servers ?? {}, serverName) && requestTurnId === params.turnId && readPersistHints(approvalPrompt.meta, "explicit").includes("always")) {
+			const resolveItem = () => {
+				const item = params.getActiveMcpToolCall?.(serverName);
+				return item?.server === serverName && matchesMcpApprovalDisplay(item, approvalPrompt.meta) ? item : void 0;
+			};
+			const item = resolveItem();
+			if (item) persistence = {
+				mcpTool: {
+					server: serverName,
+					tool: item.tool
+				},
+				toolCallId: item.id,
+				isMcpToolApprovalActive: () => {
+					const current = resolveItem();
+					return current?.id === item.id && current.tool === item.tool;
+				}
+			};
+		}
+	}
 	return handled(buildElicitationResponse(approvalPrompt, await requestPluginApprovalOutcome({
-		paramsForRun: params.paramsForRun,
+		hostCapabilities: params.paramsForRun.hostCapabilities,
 		title: approvalPrompt.title,
 		description: approvalPrompt.description,
 		allowedDecisions: approvalPrompt.allowedDecisions,
+		toolName: "codex_mcp_tool_approval",
+		...persistence,
 		signal: params.signal
 	})));
 }
+function matchesMcpApprovalDisplay(item, meta) {
+	if (!Object.hasOwn(meta, MCP_TOOL_APPROVAL_TOOL_PARAMS_DISPLAY_KEY)) return true;
+	const display = meta[MCP_TOOL_APPROVAL_TOOL_PARAMS_DISPLAY_KEY];
+	if (!Array.isArray(display)) return false;
+	const args = item.arguments;
+	return display.every((param) => {
+		if (!isJsonObject(param) || typeof param.name !== "string" || !isJsonObject(args)) return false;
+		if (!Object.hasOwn(args, param.name)) return false;
+		const value = args[param.name];
+		return typeof param.value !== "string" || param.value === (typeof value === "string" ? value : JSON.stringify(value));
+	});
+}
 function handled(response) {
 	return {
 		kind: "handled",
@@ -4395,14 +4354,14 @@ async function buildPluginPolicyElicitationResponse(params) {
 	const response = buildElicitationResponse(approvalPrompt, "approved-once");
 	if (response.action === "accept") {
 		if (mode === "allow") return response;
-		const outcome = await requestPluginApprovalOutcome({
-			paramsForRun: params.paramsForRun,
+		return buildElicitationResponse(approvalPrompt, await requestPluginApprovalOutcome({
+			hostCapabilities: params.paramsForRun.hostCapabilities,
 			title: approvalPrompt.title,
 			description: approvalPrompt.description,
 			allowedDecisions: allowedPluginPolicyApprovalDecisions(mode, approvalPrompt),
+			toolName: "codex_mcp_tool_approval",
 			signal: params.signal
-		});
-		return buildElicitationResponse(approvalPrompt, mode === "ask" && outcome === "approved-session" ? "approved-once" : outcome);
+		}));
 	}
 	logPluginElicitationDecline("unmappable_schema", params.requestParams);
 	return createCodexElicitationResponse("decline");
@@ -4437,15 +4396,16 @@ function readPluginApprovalElicitation(entry, requestParams) {
 		allowedDecisions: buildApprovalAllowedDecisions(requestedSchema, meta)
 	};
 }
-function buildApprovalAllowedDecisions(requestedSchema, meta) {
-	return canMapPersistentApproval(requestedSchema, meta) ? [
+function buildApprovalAllowedDecisions(requestedSchema, meta, allowSession = false) {
+	return canMapPersistentApproval(requestedSchema, meta, allowSession) ? [
 		"allow-once",
 		"allow-always",
 		"deny"
 	] : ["allow-once", "deny"];
 }
-function canMapPersistentApproval(requestedSchema, meta) {
+function canMapPersistentApproval(requestedSchema, meta, allowSession) {
 	const persistHints = readPersistHints(meta, "explicit");
+	if (allowSession) return choosePersistHint(persistHints) !== void 0;
 	if (persistHints.length > 0) return persistHints.includes("always");
 	const properties = isJsonObject(requestedSchema.properties) ? requestedSchema.properties : {};
 	return Object.entries(properties).some(([name, value]) => {
@@ -4470,16 +4430,20 @@ function readBridgeableApprovalElicitation(requestParams) {
 	const requestedSchema = requestParams.requestedSchema;
 	if (readNonBlankStringField(requestedSchema, "type") !== "object" || !isJsonObject(requestedSchema.properties)) return;
 	const title = sanitizeDisplayText(readNonBlankStringField(requestParams, "message") ?? "") || "Codex MCP tool approval";
+	const serverName = readNonBlankStringField(requestParams, "serverName");
 	return {
 		title,
 		description: buildApprovalDescription({
 			title,
 			meta: requestParams["_meta"],
 			requestedSchema,
-			serverName: sanitizeOptionalDisplayText(readNonBlankStringField(requestParams, "serverName"))
+			serverName: sanitizeOptionalDisplayText(serverName),
+			remedy: serverName ? formatMcpCodexApprovalRemedy(serverName) : void 0
 		}),
 		requestedSchema,
-		meta: requestParams["_meta"]
+		meta: requestParams["_meta"],
+		persistHintsMode: "explicit",
+		allowedDecisions: buildApprovalAllowedDecisions(requestedSchema, requestParams["_meta"], true)
 	};
 }
 function readComputerUseApprovalElicitation(requestParams, expectedServerName) {
@@ -4509,6 +4473,7 @@ function buildApprovalDescription(params) {
 		connectorName && `App: ${connectorName}`,
 		toolTitle && `Tool: ${toolTitle}`,
 		params.serverName && `MCP server: ${params.serverName}`,
+		params.remedy,
 		toolDescription
 	].filter((line) => Boolean(line));
 	const paramLines = readDisplayParamLines(params.meta);
@@ -4544,7 +4509,8 @@ function readDisplayParamLines(meta) {
 	return remaining > 0 ? [...lines, `- Additional parameters: ${remaining} more`] : lines;
 }
 function formatDisplayParamValue(value) {
-	return truncateCodexApprovalDisplayText(sanitizeDisplayText(typeof value === "string" ? value : formatDisplayJsonValue(value ?? null)), MAX_DISPLAY_PARAM_VALUE_LENGTH);
+	const formatted = typeof value === "string" ? value : formatDisplayJsonValue(value ?? null);
+	return truncateCodexApprovalDisplayText(sanitizeDisplayText(formatted), MAX_DISPLAY_PARAM_VALUE_LENGTH);
 }
 function formatDisplayJsonValue(value, depth = MAX_DISPLAY_VALUE_DEPTH) {
 	if (value === null) return "null";
@@ -4588,35 +4554,10 @@ function sanitizeDisplayText(value) {
 	const escaped = sanitized ? formatCodexDisplayText(sanitized) : "";
 	return clipped && escaped ? `${escaped}...` : escaped;
 }
-async function requestPluginApprovalOutcome(params) {
-	try {
-		const requestResult = await requestPluginApproval({
-			hostCapabilities: params.paramsForRun.hostCapabilities,
-			title: params.title,
-			description: params.description,
-			severity: "warning",
-			toolName: "codex_mcp_tool_approval",
-			allowedDecisions: params.allowedDecisions
-		});
-		const approvalId = requestResult?.id;
-		if (!approvalId) return "unavailable";
-		const approvalResult = approvalRequestExplicitlyUnavailable(requestResult) ? void 0 : await waitForPluginApprovalDecision({
-			hostCapabilities: params.paramsForRun.hostCapabilities,
-			approvalId,
-			signal: params.signal
-		});
-		if (params.signal?.aborted) return "cancelled";
-		if (approvalResult?.terminalReason === "timeout") return "timed-out";
-		return mapExecDecisionToOutcome(approvalResult?.decision);
-	} catch {
-		return params.signal?.aborted ? "cancelled" : "denied";
-	}
-}
 function buildElicitationResponse(approvalPrompt, outcome) {
 	const { requestedSchema, meta } = approvalPrompt;
 	if (outcome === "cancelled") return createCodexElicitationResponse("cancel");
-	if (outcome === "timed-out") return createCodexElicitationResponse("decline", null, { message: codexApprovalTimeoutText("other") });
-	if (outcome === "denied" || outcome === "unavailable") return createCodexElicitationResponse("decline");
+	if (outcome === "timed-out" || outcome === "denied" || outcome === "unavailable") return createCodexElicitationResponse("decline");
 	const content = buildAcceptedContent(approvalPrompt, outcome);
 	if (!content && !hasNoSchemaProperties(requestedSchema)) {
 		embeddedAgentLog.warn("codex MCP approval elicitation approved without a mappable response", {
@@ -4643,7 +4584,7 @@ function buildAcceptedContent(approvalPrompt, outcome) {
 			schema,
 			required: required.has(name)
 		};
-		const next = readApprovalFieldValue(property, outcome) ?? readPersistFieldValue(property, meta, outcome, approvalPrompt.persistHintsMode ?? "legacy") ?? readFallbackFieldValue(property, outcome);
+		const next = readApprovalFieldValue(property, outcome, choosePersistHint(readPersistHints(meta, approvalPrompt.persistHintsMode))) ?? readPersistFieldValue(property, meta, outcome, approvalPrompt.persistHintsMode ?? "legacy") ?? readFallbackFieldValue(property, outcome);
 		if (next === void 0) {
 			if (isApprovalField(property)) sawApprovalField = true;
 			if (property.required) return;
@@ -4654,15 +4595,14 @@ function buildAcceptedContent(approvalPrompt, outcome) {
 	}
 	return sawApprovalField ? content : void 0;
 }
-function readApprovalFieldValue(property, outcome) {
+function readApprovalFieldValue(property, outcome, persist) {
 	if (!isApprovalField(property)) return;
 	if (readNonBlankStringField(property.schema, "type") === "boolean") return true;
 	const options = readEnumOptions(property.schema);
 	if (options.length === 0) return;
-	const sessionChoice = options.find((option) => isSessionApprovalOption(option));
 	const acceptChoice = options.find((option) => isPositiveApprovalOption(option));
-	if (outcome === "approved-session") return sessionChoice?.value ?? acceptChoice?.value;
-	return acceptChoice?.value ?? sessionChoice?.value;
+	if (outcome === "approved-session") return options.find((option) => isPersistentApprovalOption(option, persist))?.value ?? acceptChoice?.value;
+	return acceptChoice?.value;
 }
 function readPersistFieldValue(property, meta, outcome, persistHintsMode) {
 	if (!isPersistField(property) || outcome !== "approved-session") return;
@@ -4741,19 +4681,233 @@ function isPositiveApprovalOption(option) {
 	const haystack = `${option.value} ${option.label}`.toLowerCase();
 	return /\b(allow|approve|accept|yes|continue|proceed|true)\b/.test(haystack);
 }
-function isSessionApprovalOption(option) {
+function isPersistentApprovalOption(option, persist) {
 	const haystack = `${option.value} ${option.label}`.toLowerCase();
-	return /\b(session|always|persistent)\b/.test(haystack) && /\b(allow|approve|accept)\b/.test(haystack);
+	return (persist === "always" ? /\b(always|persistent)\b|\bdon't ask me again\b/.test(haystack) : persist === "session" && /\bsession\b/.test(haystack)) && /\b(allow|approve|accept)\b/.test(haystack);
 }
 function readNonBlankStringField(record, key) {
 	const value = record?.[key];
 	return typeof value === "string" && value.trim() ? value : void 0;
 }
-function readFirstString$1(record, keys) {
-	for (const key of keys) {
-		const value = readNonBlankStringField(record, key);
-		if (value) return value;
+function readFirstString$1(record, keys) {
+	for (const key of keys) {
+		const value = readNonBlankStringField(record, key);
+		if (value) return value;
+	}
+}
+//#endregion
+//#region extensions/codex/src/app-server/dynamic-tool-catalog.ts
+/** Namespace attached to OpenClaw-owned dynamic tools exposed to Codex. */
+const CODEX_OPENCLAW_DYNAMIC_TOOL_NAMESPACE = "openclaw";
+const CODEX_DYNAMIC_TOOL_NAME_MAX_CHARS = 128;
+const CODEX_DYNAMIC_TOOL_NAME_PATTERN = /^[a-zA-Z0-9_-]+$/u;
+const ALWAYS_DIRECT_DYNAMIC_TOOL_NAMES = /* @__PURE__ */ new Set([
+	"agents_list",
+	"agents_wait",
+	"progress_card",
+	"sessions_spawn",
+	"sessions_yield"
+]);
+function createCodexDynamicToolSpecs(params) {
+	const directToolNames = /* @__PURE__ */ new Set([...ALWAYS_DIRECT_DYNAMIC_TOOL_NAMES, ...params.directToolNames ?? []]);
+	const specs = [];
+	const namespaceTools = [];
+	const directOnlyNamespaceTools = [];
+	const entries = params.loading === "direct" ? params.entries : params.entries.toSorted((left, right) => left.name.localeCompare(right.name));
+	for (const entry of entries) {
+		const functionSpec = createCodexDynamicToolFunctionSpec({ entry });
+		if (entry.name === "openclaw" && directToolNames.has(entry.name)) {
+			specs.push(functionSpec);
+			continue;
+		}
+		if (entry.tool.catalogMode === "direct-only") {
+			directOnlyNamespaceTools.push(functionSpec);
+			continue;
+		}
+		if (params.loading === "direct" || directToolNames.has(entry.name)) {
+			specs.push(functionSpec);
+			continue;
+		}
+		namespaceTools.push({
+			...functionSpec,
+			deferLoading: true
+		});
+	}
+	if (namespaceTools.length > 0) specs.push({
+		type: "namespace",
+		name: CODEX_OPENCLAW_DYNAMIC_TOOL_NAMESPACE,
+		description: "",
+		tools: namespaceTools
+	});
+	if (directOnlyNamespaceTools.length > 0) specs.push({
+		type: "namespace",
+		name: CODEX_OPENCLAW_DIRECT_DYNAMIC_TOOL_NAMESPACE,
+		description: "",
+		tools: directOnlyNamespaceTools
+	});
+	return specs;
+}
+function createCodexDynamicToolFunctionSpec(params) {
+	return {
+		type: "function",
+		name: params.entry.name,
+		description: params.entry.description,
+		inputSchema: params.entry.inputSchema
+	};
+}
+function projectCodexDynamicTools(tools) {
+	const projectedTools = [];
+	const quarantinedTools = [];
+	let length;
+	try {
+		length = tools.length;
+	} catch {
+		return {
+			tools: [],
+			quarantinedTools: [{
+				tool: "tool[0]",
+				violations: ["tool[0] is unreadable"]
+			}]
+		};
+	}
+	for (let toolIndex = 0; toolIndex < length; toolIndex += 1) {
+		let tool;
+		try {
+			tool = tools[toolIndex];
+		} catch {
+			quarantinedTools.push({
+				tool: `tool[${toolIndex}]`,
+				violations: [`tool[${toolIndex}] is unreadable`]
+			});
+			continue;
+		}
+		const descriptor = readCodexDynamicToolDescriptor(tool, toolIndex);
+		if (!descriptor.ok) {
+			quarantinedTools.push(descriptor.diagnostic);
+			continue;
+		}
+		const normalizedParameters = normalizeOpenAIStrictCompatSchema(descriptor.parameters);
+		const projection = projectRuntimeToolInputSchema(normalizedParameters ?? descriptor.parameters, `${descriptor.name}.inputSchema`);
+		if (projection.violations.length > 0) {
+			quarantinedTools.push({
+				tool: descriptor.name,
+				violations: projection.violations
+			});
+			continue;
+		}
+		if (!isRecord(projection.schema)) {
+			quarantinedTools.push({
+				tool: descriptor.name,
+				violations: [`${descriptor.name}.inputSchema must be a JSON object schema`]
+			});
+			continue;
+		}
+		projectedTools.push({
+			tool,
+			name: descriptor.name,
+			description: descriptor.description,
+			inputSchema: projection.schema
+		});
+	}
+	return {
+		tools: projectedTools,
+		quarantinedTools
+	};
+}
+function readCodexDynamicToolDescriptor(tool, toolIndex) {
+	const fallbackName = `tool[${toolIndex}]`;
+	let name;
+	try {
+		const rawName = tool.name;
+		if (typeof rawName !== "string" || !rawName) return {
+			ok: false,
+			diagnostic: {
+				tool: fallbackName,
+				violations: [`${fallbackName}.name must be a non-empty string`]
+			}
+		};
+		const trimmedName = rawName.trim();
+		let nameViolation;
+		if (!trimmedName) nameViolation = `${rawName}.name must not be empty`;
+		else if (trimmedName !== rawName) nameViolation = `${rawName}.name must not have leading or trailing whitespace`;
+		else if (!CODEX_DYNAMIC_TOOL_NAME_PATTERN.test(rawName)) nameViolation = `${rawName}.name must match ^[a-zA-Z0-9_-]+$`;
+		else if (rawName.length > CODEX_DYNAMIC_TOOL_NAME_MAX_CHARS) nameViolation = `${rawName}.name must be at most ${CODEX_DYNAMIC_TOOL_NAME_MAX_CHARS} characters`;
+		else if (rawName === "mcp" || rawName.startsWith("mcp__")) nameViolation = `${rawName}.name is reserved by Codex app-server`;
+		if (nameViolation) return {
+			ok: false,
+			diagnostic: {
+				tool: rawName,
+				violations: [nameViolation]
+			}
+		};
+		name = rawName;
+	} catch {
+		return {
+			ok: false,
+			diagnostic: {
+				tool: fallbackName,
+				violations: [`${fallbackName}.name is unreadable`]
+			}
+		};
+	}
+	let description;
+	try {
+		description = typeof tool.description === "string" ? tool.description : "";
+	} catch {
+		return {
+			ok: false,
+			diagnostic: {
+				tool: name,
+				violations: [`${name}.description is unreadable`]
+			}
+		};
+	}
+	let parameters;
+	try {
+		parameters = tool.parameters;
+	} catch {
+		return {
+			ok: false,
+			diagnostic: {
+				tool: name,
+				violations: [`${name}.inputSchema is unreadable`]
+			}
+		};
+	}
+	return {
+		ok: true,
+		name,
+		description,
+		parameters
+	};
+}
+//#endregion
+//#region extensions/codex/src/app-server/dynamic-tool-availability.ts
+/** Prepare the actual executable set, then reproject only changed owner definitions. */
+function finalizeCodexToolAvailability(entries) {
+	const snapshots = entries.map((entry) => ({
+		entry,
+		parameters: entry.tool.parameters,
+		description: entry.tool.description
+	}));
+	const preparedNames = /* @__PURE__ */ new Set();
+	finalizeAgentToolAvailability(entries.map((entry) => entry.tool), { onPrepared: (tool) => preparedNames.add(tool.name) });
+	const tools = [];
+	const quarantinedTools = [];
+	for (const { entry, parameters, description } of snapshots) {
+		if (entry.tool.parameters === parameters && entry.tool.description === description) {
+			tools.push(entry);
+			continue;
+		}
+		const projected = projectCodexDynamicTools([entry.tool]);
+		tools.push(...projected.tools);
+		quarantinedTools.push(...projected.quarantinedTools);
 	}
+	return {
+		tools,
+		quarantinedTools,
+		preparedNames
+	};
 }
 //#endregion
 //#region extensions/codex/src/app-server/dynamic-tools.ts
@@ -4778,7 +4932,7 @@ function assertCodexDynamicToolInputMatchesSchema(params) {
 	const visibleErrors = validation.errors.slice(0, MAX_CODEX_DYNAMIC_TOOL_VALIDATION_ERRORS);
 	const details = visibleErrors.map((error) => {
 		if (error.text.length <= MAX_CODEX_DYNAMIC_TOOL_VALIDATION_ERROR_CHARS) return error.text;
-		return `${error.text.slice(0, MAX_CODEX_DYNAMIC_TOOL_VALIDATION_ERROR_CHARS - 19)}${CODEX_DYNAMIC_TOOL_VALIDATION_TRUNCATED_SUFFIX}`;
+		return `${error.text.slice(0, 141)}${CODEX_DYNAMIC_TOOL_VALIDATION_TRUNCATED_SUFFIX}`;
 	}).join("; ");
 	const omitted = validation.errors.length - visibleErrors.length;
 	const omittedSuffix = omitted > 0 ? `; ${omitted} more violation(s) omitted` : "";
@@ -4919,15 +5073,6 @@ function normalizeAcceptedSessionSpawn(result) {
 		childSessionKey
 	} : null;
 }
-/** Namespace attached to OpenClaw-owned dynamic tools exposed to Codex. */
-const CODEX_OPENCLAW_DYNAMIC_TOOL_NAMESPACE = "openclaw";
-const CODEX_DYNAMIC_TOOL_NAME_MAX_CHARS = 128;
-const CODEX_DYNAMIC_TOOL_NAME_PATTERN = /^[a-zA-Z0-9_-]+$/u;
-const ALWAYS_DIRECT_DYNAMIC_TOOL_NAMES = /* @__PURE__ */ new Set([
-	"agents_list",
-	"sessions_spawn",
-	"sessions_yield"
-]);
 const EXPLICIT_MESSAGE_PROVIDER_KEYS = ["channel", "provider"];
 const EXPLICIT_MESSAGE_TARGET_KEYS = [
 	"target",
@@ -4967,18 +5112,23 @@ function createCodexDynamicToolBridge(params) {
 	const toolResultMaxChars = typeof contextWindowTokens === "number" && Number.isFinite(contextWindowTokens) && contextWindowTokens > 0 ? Math.max(1, resolveLiveToolResultMaxChars({ contextWindowTokens })) : DEFAULT_MAX_LIVE_TOOL_RESULT_CHARS;
 	const availableProjection = projectCodexExecutableDynamicToolSurface(params.tools, params.hookContext);
 	const registeredProjection = params.registeredTools ? projectCodexDynamicTools(params.registeredTools) : availableProjection;
-	const availableTools = availableProjection.tools;
-	const quarantinedAvailableToolNames = new Set(availableProjection.quarantinedTools.map((tool) => tool.tool));
-	const registeredSpecTools = (params.registeredTools ? registeredProjection.tools : availableTools).filter((entry) => !quarantinedAvailableToolNames.has(entry.name));
+	const inheritedSpecs = params.registeredSpecs ? structuredClone([...params.registeredSpecs]) : void 0;
+	const inheritedNames = inheritedSpecs ? new Set(flattenCodexDynamicToolFunctions(inheritedSpecs).map((tool) => tool.name)) : void 0;
+	const registrationNames = inheritedNames ?? new Set(registeredProjection.tools.map((entry) => entry.name));
+	const finalized = finalizeCodexToolAvailability(availableProjection.tools.filter((entry) => registrationNames.has(entry.name)));
+	const availableTools = finalized.tools;
+	availableProjection.quarantinedTools.push(...finalized.quarantinedTools);
 	const toolMap = new Map(availableTools.map((entry) => [entry.name, entry]));
-	const registeredToolNames = new Set(registeredSpecTools.map((entry) => entry.name));
+	const quarantinedAvailableToolNames = new Set(availableProjection.quarantinedTools.map((tool) => tool.tool));
+	const registeredSpecTools = (params.registeredTools ? registeredProjection.tools : availableTools).filter((entry) => !quarantinedAvailableToolNames.has(entry.name)).map((entry) => finalized.preparedNames.has(entry.name) ? toolMap.get(entry.name) ?? entry : entry);
+	const registeredToolNames = inheritedNames ?? new Set(registeredSpecTools.map((entry) => entry.name));
 	const quarantinedTools = dedupeQuarantinedDynamicTools([...availableProjection.quarantinedTools, ...registeredProjection.quarantinedTools]);
-	warnQuarantinedDynamicTools({
+	reportQuarantinedDynamicTools({
 		tools: quarantinedTools,
 		availableToolCount: availableTools.length,
-		registeredToolCount: registeredSpecTools.length
+		registeredToolCount: registeredSpecTools.length,
+		hookContext: params.hookContext
 	});
-	emitQuarantinedDynamicToolDiagnostics(quarantinedTools, params.hookContext);
 	const telemetry = {
 		didSendViaMessagingTool: false,
 		didDeliverSourceReplyViaMessageTool: false,
@@ -4987,6 +5137,8 @@ function createCodexDynamicToolBridge(params) {
 		messagingToolSentTargets: [],
 		messagingToolSourceReplyPayloads: [],
 		toolMediaUrls: [],
+		toolAutoDeliveryMediaUrls: [],
+		coreTtsToolResults: [],
 		toolAudioAsVoice: false,
 		acceptedSessionSpawns: [],
 		quarantinedTools
@@ -5002,16 +5154,23 @@ function createCodexDynamicToolBridge(params) {
 	};
 	const legacyExtensionRunner = createCodexAppServerToolResultExtensionRunner(toolResultHookContext);
 	const executionSnapshotStates = /* @__PURE__ */ new Map();
-	const directToolNames = /* @__PURE__ */ new Set([...ALWAYS_DIRECT_DYNAMIC_TOOL_NAMES, ...params.directToolNames ?? []]);
+	const directToolNames = params.directToolNames;
 	let readRemoteWorkspaceFile;
 	return {
 		availableTools: availableTools.map((entry) => entry.tool),
-		availableSpecs: createCodexDynamicToolSpecs({
+		availableSpecs: inheritedSpecs ? inheritedSpecs.flatMap((spec) => {
+			if (spec.type === "function") return toolMap.has(spec.name) ? [spec] : [];
+			const tools = spec.tools.filter((tool) => toolMap.has(tool.name));
+			return tools.length ? [{
+				...spec,
+				tools
+			}] : [];
+		}) : createCodexDynamicToolSpecs({
 			entries: availableTools,
 			loading: params.loading ?? "searchable",
 			directToolNames
 		}),
-		specs: createCodexDynamicToolSpecs({
+		specs: inheritedSpecs ?? createCodexDynamicToolSpecs({
 			entries: registeredSpecTools,
 			loading: params.loading ?? "searchable",
 			directToolNames
@@ -5112,6 +5271,7 @@ function createCodexDynamicToolBridge(params) {
 				}));
 				const rawResult = await Reflect.apply(tool.execute, tool, executionArgs);
 				captureExecutionBoundary();
+				if (toolName === "message" && asOptionalRecord(asOptionalRecord(rawResult.details)?.messageDelivery)?.sourceReplyDelivered === true) telemetry.sourceReplyDelivered = true;
 				const telemetryRawResult = sanitizeToolResult(rawResult);
 				const rawIsError = isToolResultError(rawResult);
 				const rawResultFailureKind = resolveToolResultFailureKind(rawResult);
@@ -5200,13 +5360,17 @@ function createCodexDynamicToolBridge(params) {
 				const toolConfirmedSourceReply = params.hookContext?.sourceReplyDeliveryMode === "message_tool_only" && toolName === "message" && !resultIsError && (rawResult.terminate === true || result.terminate === true);
 				const confirmedSourceReply = params.hookContext?.sourceReplyDeliveryMode === "message_tool_only" && toolName === "message" && (toolConfirmedSourceReply || deliveredSourceReply || receiptConfirmedSourceReply);
 				const sourceReplyFinal = confirmedSourceReply ? executedArgs.final !== false : void 0;
+				const autoDeliveryTtsMediaUrls = getCoreTtsToolResultMediaUrls(rawResult);
 				collectToolTelemetry({
 					toolName,
 					args: executedArgs,
 					result,
 					mediaTrustResult: telemetryRawResult,
 					telemetry,
+					signal,
 					isError: resultIsError,
+					autoDeliveryTtsMediaUrls,
+					coreTtsToolResult: autoDeliveryTtsMediaUrls?.length ? rawResult : void 0,
 					messagingTarget: confirmedMessagingTarget,
 					sourceReplyFinal
 				});
@@ -5216,12 +5380,15 @@ function createCodexDynamicToolBridge(params) {
 				const asyncStarted = isAsyncStartedToolResult(rawResult) || isAsyncStartedToolResult(result);
 				withDynamicToolAsyncStarted(response, asyncStarted);
 				const replaySafe = executionPrevented || !asyncStarted && isReplaySafeToolInstance(toolEntry.tool) && isReplaySafeToolCall(toolName, executedArgs);
+				copyInternalToolResultState(rawResult, response);
 				return withDynamicToolExecutionState(response, {
 					executedArguments: executedArgs,
 					executionStarted: didStartExecution && !executionPrevented,
 					sideEffectEvidence: !replaySafe
 				});
 			} catch (error) {
+				const trustedNoStart = consumeTrustedToolNoStartError(error);
+				executionPrevented ||= trustedNoStart;
 				captureExecutionBoundary();
 				if (toolName === "computer" && params.computerContextEpoch?.frameToolCallId === call.callId) invalidateComputerFrame(params.computerContextEpoch);
 				const executionDisposition = getBeforeToolCallFailureDisposition(error) ?? (signal.aborted ? resolveCodexToolAbortTerminalReason(signal) : resolveToolExecutionErrorKind(error));
@@ -5238,13 +5405,6 @@ function createCodexDynamicToolBridge(params) {
 					toolCallOrdinal: options?.toolCallOrdinal
 				});
 				notifyAgentToolResult(options?.onAgentToolResult, toolName, failedResult, true);
-				collectToolTelemetry({
-					toolName,
-					args: executedArgs,
-					result: void 0,
-					telemetry,
-					isError: true
-				});
 				runAgentHarnessAfterToolCallHook({
 					toolName,
 					toolCallId: call.callId,
@@ -5277,19 +5437,36 @@ function createCodexDynamicToolBridge(params) {
 	};
 }
 function projectCodexExecutableDynamicToolSurface(tools, hookContext) {
-	const projected = projectCodexDynamicTools(tools);
-	const wrapped = wrapProjectedCodexDynamicTools(projected.tools, hookContext);
+	const { tools: projectedTools, quarantinedTools } = projectCodexDynamicTools(tools);
+	const wrappedTools = [];
+	for (const entry of projectedTools) try {
+		if (isToolWrappedWithBeforeToolCallHook(entry.tool)) {
+			setBeforeToolCallDiagnosticsEnabled(entry.tool, false);
+			wrappedTools.push(entry);
+			continue;
+		}
+		wrappedTools.push({
+			...entry,
+			tool: wrapToolWithBeforeToolCallHook(entry.tool, hookContext, { emitDiagnostics: false })
+		});
+	} catch {
+		quarantinedTools.push({
+			tool: entry.name,
+			violations: [`${entry.name} could not be wrapped for before-tool-call hooks`]
+		});
+	}
 	return {
-		tools: wrapped.tools,
-		quarantinedTools: dedupeQuarantinedDynamicTools([...projected.quarantinedTools, ...wrapped.quarantinedTools])
+		tools: wrappedTools,
+		quarantinedTools: dedupeQuarantinedDynamicTools(quarantinedTools)
 	};
 }
 /** Applies the exact schema and hook-wrapper projection used by the executable Codex bridge. */
 function projectCodexExecutableDynamicTools(params) {
 	const projected = projectCodexExecutableDynamicToolSurface(params.tools, params.hookContext);
+	const finalized = finalizeCodexToolAvailability(projected.tools);
 	return {
-		availableTools: projected.tools.map((entry) => entry.tool),
-		quarantinedTools: projected.quarantinedTools
+		availableTools: finalized.tools.map((entry) => entry.tool),
+		quarantinedTools: [...projected.quarantinedTools, ...finalized.quarantinedTools]
 	};
 }
 function notifyAgentToolResult(observer, toolName, result, isError) {
@@ -5315,226 +5492,22 @@ function failedToolResult(message, status = "failed") {
 		}
 	};
 }
-function wrapProjectedCodexDynamicTools(tools, hookContext) {
-	const wrappedTools = [];
-	const quarantinedTools = [];
-	for (const entry of tools) try {
-		if (isToolWrappedWithBeforeToolCallHook(entry.tool)) {
-			setBeforeToolCallDiagnosticsEnabled(entry.tool, false);
-			wrappedTools.push(entry);
-			continue;
-		}
-		wrappedTools.push({
-			...entry,
-			tool: wrapToolWithBeforeToolCallHook(entry.tool, hookContext, { emitDiagnostics: false })
-		});
-	} catch {
-		quarantinedTools.push({
-			tool: entry.name,
-			violations: [`${entry.name} could not be wrapped for before-tool-call hooks`]
-		});
-	}
-	return {
-		tools: wrappedTools,
-		quarantinedTools
-	};
-}
-function createCodexDynamicToolSpecs(params) {
-	const specs = [];
-	const namespaceTools = [];
-	const directOnlyNamespaceTools = [];
-	const entries = params.loading === "direct" ? params.entries : params.entries.toSorted((left, right) => left.name.localeCompare(right.name));
-	for (const entry of entries) {
-		const functionSpec = createCodexDynamicToolFunctionSpec({ entry });
-		if (entry.name === "openclaw" && params.directToolNames.has(entry.name)) {
-			specs.push(functionSpec);
-			continue;
-		}
-		if (entry.tool.catalogMode === "direct-only") {
-			directOnlyNamespaceTools.push(functionSpec);
-			continue;
-		}
-		if (params.loading === "direct" || params.directToolNames.has(entry.name)) {
-			specs.push(functionSpec);
-			continue;
-		}
-		namespaceTools.push({
-			...functionSpec,
-			deferLoading: true
-		});
-	}
-	if (namespaceTools.length > 0) specs.push({
-		type: "namespace",
-		name: CODEX_OPENCLAW_DYNAMIC_TOOL_NAMESPACE,
-		description: "",
-		tools: namespaceTools
-	});
-	if (directOnlyNamespaceTools.length > 0) specs.push({
-		type: "namespace",
-		name: CODEX_OPENCLAW_DIRECT_DYNAMIC_TOOL_NAMESPACE,
-		description: "",
-		tools: directOnlyNamespaceTools
-	});
-	return specs;
-}
-function createCodexDynamicToolFunctionSpec(params) {
-	return {
-		type: "function",
-		name: params.entry.name,
-		description: params.entry.description,
-		inputSchema: params.entry.inputSchema
-	};
-}
-function projectCodexDynamicTools(tools) {
-	const projectedTools = [];
-	const quarantinedTools = [];
-	let length;
-	try {
-		length = tools.length;
-	} catch {
-		return {
-			tools: [],
-			quarantinedTools: [{
-				tool: "tool[0]",
-				violations: ["tool[0] is unreadable"]
-			}]
-		};
-	}
-	for (let toolIndex = 0; toolIndex < length; toolIndex += 1) {
-		let tool;
-		try {
-			tool = tools[toolIndex];
-		} catch {
-			quarantinedTools.push({
-				tool: `tool[${toolIndex}]`,
-				violations: [`tool[${toolIndex}] is unreadable`]
-			});
-			continue;
-		}
-		const descriptor = readCodexDynamicToolDescriptor(tool, toolIndex);
-		if (!descriptor.ok) {
-			quarantinedTools.push(descriptor.diagnostic);
-			continue;
-		}
-		const normalizedParameters = normalizeOpenAIToolSchemas({
-			provider: "openai",
-			modelApi: "openai-chatgpt-responses",
-			tools: [{ parameters: descriptor.parameters }]
-		})[0]?.parameters;
-		const projection = projectRuntimeToolInputSchema(normalizedParameters ?? descriptor.parameters, `${descriptor.name}.inputSchema`);
-		if (projection.violations.length > 0) {
-			quarantinedTools.push({
-				tool: descriptor.name,
-				violations: projection.violations
-			});
-			continue;
-		}
-		if (!isRecord(projection.schema)) {
-			quarantinedTools.push({
-				tool: descriptor.name,
-				violations: [`${descriptor.name}.inputSchema must be a JSON object schema`]
-			});
-			continue;
-		}
-		projectedTools.push({
-			tool,
-			name: descriptor.name,
-			description: descriptor.description,
-			inputSchema: projection.schema
-		});
-	}
-	return {
-		tools: projectedTools,
-		quarantinedTools
-	};
-}
-function readCodexDynamicToolDescriptor(tool, toolIndex) {
-	const fallbackName = `tool[${toolIndex}]`;
-	let name;
-	try {
-		const rawName = tool.name;
-		if (typeof rawName !== "string" || !rawName) return {
-			ok: false,
-			diagnostic: {
-				tool: fallbackName,
-				violations: [`${fallbackName}.name must be a non-empty string`]
-			}
-		};
-		const trimmedName = rawName.trim();
-		let nameViolation;
-		if (!trimmedName) nameViolation = `${rawName}.name must not be empty`;
-		else if (trimmedName !== rawName) nameViolation = `${rawName}.name must not have leading or trailing whitespace`;
-		else if (!CODEX_DYNAMIC_TOOL_NAME_PATTERN.test(rawName)) nameViolation = `${rawName}.name must match ^[a-zA-Z0-9_-]+$`;
-		else if (rawName.length > CODEX_DYNAMIC_TOOL_NAME_MAX_CHARS) nameViolation = `${rawName}.name must be at most ${CODEX_DYNAMIC_TOOL_NAME_MAX_CHARS} characters`;
-		else if (rawName === "mcp" || rawName.startsWith("mcp__")) nameViolation = `${rawName}.name is reserved by Codex app-server`;
-		if (nameViolation) return {
-			ok: false,
-			diagnostic: {
-				tool: rawName,
-				violations: [nameViolation]
-			}
-		};
-		name = rawName;
-	} catch {
-		return {
-			ok: false,
-			diagnostic: {
-				tool: fallbackName,
-				violations: [`${fallbackName}.name is unreadable`]
-			}
-		};
-	}
-	let description;
-	try {
-		description = typeof tool.description === "string" ? tool.description : "";
-	} catch {
-		return {
-			ok: false,
-			diagnostic: {
-				tool: name,
-				violations: [`${name}.description is unreadable`]
-			}
-		};
-	}
-	let parameters;
-	try {
-		parameters = tool.parameters;
-	} catch {
-		return {
-			ok: false,
-			diagnostic: {
-				tool: name,
-				violations: [`${name}.inputSchema is unreadable`]
-			}
-		};
-	}
-	return {
-		ok: true,
-		name,
-		description,
-		parameters
-	};
-}
-function warnQuarantinedDynamicTools(params) {
+function reportQuarantinedDynamicTools(params) {
 	if (params.tools.length === 0) return;
-	const unique = /* @__PURE__ */ new Map();
-	for (const tool of params.tools) unique.set(tool.tool, tool.violations);
-	embeddedAgentLog.warn(`codex app-server quarantined ${unique.size} unsupported dynamic tool ${unique.size === 1 ? "definition" : "definitions"}: ${[...unique.keys()].join(", ")}; retained ${params.availableToolCount} available and ${params.registeredToolCount} registered tools`, {
-		tools: [...unique.entries()].map(([tool, violations]) => ({
+	embeddedAgentLog.warn(`codex app-server quarantined ${params.tools.length} unsupported dynamic tool ${params.tools.length === 1 ? "definition" : "definitions"}: ${params.tools.map((tool) => tool.tool).join(", ")}; retained ${params.availableToolCount} available and ${params.registeredToolCount} registered tools`, {
+		tools: params.tools.map(({ tool, violations }) => ({
 			tool,
 			violations
 		})),
 		availableToolCount: params.availableToolCount,
 		registeredToolCount: params.registeredToolCount
 	});
-}
-function emitQuarantinedDynamicToolDiagnostics(tools, ctx) {
-	for (const tool of tools) emitTrustedDiagnosticEvent({
+	for (const tool of params.tools) emitTrustedDiagnosticEvent({
 		type: "tool.execution.blocked",
-		agentId: ctx?.agentId,
-		runId: ctx?.runId,
-		sessionId: ctx?.sessionId,
-		sessionKey: ctx?.sessionKey,
+		agentId: params.hookContext?.agentId,
+		runId: params.hookContext?.runId,
+		sessionId: params.hookContext?.sessionId,
+		sessionKey: params.hookContext?.sessionKey,
 		toolName: tool.tool,
 		deniedReason: "unsupported_tool_schema",
 		reason: tool.violations.join(", ")
@@ -5569,15 +5542,26 @@ function collectToolTelemetry(params) {
 		const response = normalizeHeartbeatToolResponse(params.result?.details);
 		if (response) params.telemetry.heartbeatToolResponse = response;
 	}
-	if (!params.isError && params.result) {
+	if (params.result && !params.signal.aborted) {
 		const media = extractToolResultMediaArtifact(params.result);
 		if (media) {
 			const mediaUrls = filterToolResultMediaUrls(params.toolName, media.mediaUrls, params.mediaTrustResult ?? params.result);
 			const seen = new Set(params.telemetry.toolMediaUrls);
-			for (const mediaUrl of mediaUrls) if (!seen.has(mediaUrl)) {
-				seen.add(mediaUrl);
-				params.telemetry.toolMediaUrls.push(mediaUrl);
+			const autoDeliveryMediaUrls = new Set(params.telemetry.toolAutoDeliveryMediaUrls);
+			const rawAutoDeliveryMediaUrls = new Set(params.autoDeliveryTtsMediaUrls);
+			let retainsCoreTtsMedia = false;
+			for (const mediaUrl of mediaUrls) {
+				if (!seen.has(mediaUrl)) {
+					seen.add(mediaUrl);
+					params.telemetry.toolMediaUrls.push(mediaUrl);
+				}
+				if (rawAutoDeliveryMediaUrls.has(mediaUrl)) {
+					autoDeliveryMediaUrls.add(mediaUrl);
+					retainsCoreTtsMedia = true;
+				} else autoDeliveryMediaUrls.delete(mediaUrl);
 			}
+			params.telemetry.toolAutoDeliveryMediaUrls = [...autoDeliveryMediaUrls];
+			if (retainsCoreTtsMedia && params.coreTtsToolResult && !params.telemetry.coreTtsToolResults.includes(params.coreTtsToolResult)) params.telemetry.coreTtsToolResults.push(params.coreTtsToolResult);
 			if (media.audioAsVoice) params.telemetry.toolAudioAsVoice = true;
 		}
 	}
@@ -5814,4 +5798,4 @@ function isCronAddAction(args) {
 	return typeof action === "string" && action.trim().toLowerCase() === "add";
 }
 //#endregion
-export { shouldRequireCodexSandboxExecServerEnvironment as C, CodexNativeToolLifecycleProjector as D, readBoundedCodexRemoteWorkspaceFile as E, shouldEnableCodexAppServerNativeToolSurface as S, filterCodexVisionTools as T, resolveCodexAppServerHookChannelId as _, emitDynamicToolStartedDiagnostic as a, resolveCodexNodePlacementToolConstructionPlan as b, resolveCodexProviderWebSearchSupport as c, releaseCodexSandboxExecServerEnvironment as d, buildDynamicTools as f, resolveCodexAppServerExecutionCwd as g, formatCodexDynamicToolBuildStageSummary as h, emitDynamicToolErrorDiagnostic as i, resolveCodexProviderWebSearchSupportForClient as l, disableCodexPluginThreadConfig as m, projectCodexExecutableDynamicTools as n, emitDynamicToolTerminalDiagnostic as o, createCodexDynamicToolBuildStageTracker as p, routeCodexAppServerElicitationRequest as r, handleCodexAppServerApprovalRequest as s, createCodexDynamicToolBridge as t, ensureCodexSandboxExecServerEnvironment as u, resolveCodexExternalSandboxPolicyForOpenClawSandbox as v, shouldWarnCodexDynamicToolBuildStageSummary as w, resolveCodexSandboxEnvironmentSelection as x, resolveCodexMessageToolProvider as y };
+export { shouldRequireCodexSandboxExecServerEnvironment as C, shouldEnableCodexAppServerNativeToolSurface as S, filterCodexVisionTools as T, resolveCodexAppServerHookChannelId as _, emitDynamicToolStartedDiagnostic as a, resolveCodexNodePlacementToolConstructionPlan as b, ensureCodexSandboxExecServerEnvironment as c, CodexNativeToolLifecycleProjector as d, buildDynamicTools as f, resolveCodexAppServerExecutionCwd as g, formatCodexDynamicToolBuildStageSummary as h, emitDynamicToolErrorDiagnostic as i, releaseCodexSandboxExecServerEnvironment as l, disableCodexPluginThreadConfig as m, projectCodexExecutableDynamicTools as n, emitDynamicToolTerminalDiagnostic as o, createCodexDynamicToolBuildStageTracker as p, routeCodexAppServerElicitationRequest as r, handleCodexAppServerApprovalRequest as s, createCodexDynamicToolBridge as t, readBoundedCodexRemoteWorkspaceFile as u, resolveCodexExternalSandboxPolicyForOpenClawSandbox as v, shouldWarnCodexDynamicToolBuildStageSummary as w, resolveCodexSandboxEnvironmentSelection as x, resolveCodexMessageToolProvider as y };