@openclaw/codex 2026.9.1 → 2026.9.3

package/dist/{dynamic-tools-BU9tmlYm.js → dynamic-tools-D-JBoaLt.js}

@@ -1,263 +1,45 @@
-import { $t as isJsonObject, Qt as flattenCodexDynamicToolFunctions, Zt as CODEX_OPENCLAW_DIRECT_DYNAMIC_TOOL_NAMESPACE, _t as resolveCodexToolAbortTerminalReason, bt as withDynamicToolTranscriptDetails, it as readCodexTurn, ot as createCodexElicitationResponse, vt as createFailedDynamicToolResponse, yt as withDynamicToolExecutionState } from "./shared-client-DxcfF9KX.js";
-import { E as readCodexPluginConfig, w as isCodexRemoteExecPlacementSandbox } from "./config-BhmfC1s6.js";
-import { E as itemStatus, I as readItem, b as auditNativeToolUnfinishedStatus, h as isCodexNotificationForTurn, v as auditNativeToolName, y as auditNativeToolTerminalStatus } from "./attempt-client-cleanup-DYHcRQAa.js";
-import { B as emitCodexNativePreToolUseFailureDiagnostic, S as resolveCodexWebSearchPlan, at as filterCodexDynamicTools, lt as isSystemAgentOnlyCodexDynamicToolAllowlist, ot as filterCodexDynamicToolsForDisabledNativeSurface, st as isForcedPrivateQaCodexRuntime, ut as normalizeCodexDynamicToolName } from "./thread-lifecycle-DAcEJ_Om.js";
-import { l as resolveCodexNativeExecutionPolicy, u as resolveCodexNodeExecToolOverrides } from "./request-DYAI5FQE.js";
-import { r as sanitizeInlineImageDataUrl, t as invalidInlineImageText } from "./image-payload-sanitizer-CnfoUPCE.js";
-import { a as formatCodexDisplayText } from "./command-formatters-CLHhEB1Q.js";
-import { a as requestPluginApprovalOutcome, c as truncateCodexApprovalDisplayText, i as requestPluginApproval, l as waitForPluginApprovalDecision, n as codexApprovalTimeoutText, o as sanitizeCodexApprovalVisibleText, r as mapExecDecisionToOutcome, s as stripDanglingCodexApprovalTerminalSequence, t as approvalRequestExplicitlyUnavailable } from "./plugin-approval-roundtrip-CNe-Xrjx.js";
-import { a as CODEX_NODE_EXEC_DYNAMIC_TOOL_NAME, c as createNodeExecAliasDynamicTool, i as CODEX_GATEWAY_PROCESS_DYNAMIC_TOOL_NAME, l as isCodexDynamicToolExcluded, o as createGatewayExecProjection, r as CODEX_GATEWAY_EXEC_DYNAMIC_TOOL_NAME, s as createGatewayProcessProjection } from "./provider-capabilities-DW5p4k9w.js";
+import { a as flattenCodexDynamicToolFunctions, o as isJsonObject, r as CODEX_OPENCLAW_DIRECT_DYNAMIC_TOOL_NAMESPACE, x as readCodexPluginConfig, y as isCodexRemoteExecPlacementSandbox } from "./protocol-CAAcVIKF.js";
+import { B as withDynamicToolTranscriptDetails, E as createCodexElicitationResponse, L as resolveCodexToolAbortTerminalReason, R as createFailedDynamicToolResponse, w as readCodexTurn, z as withDynamicToolExecutionState } from "./client-BEKu4yDx.js";
+import { a as formatCodexDisplayText } from "./command-formatters-DeTfrapr.js";
+import "./config-JDfTI4VI.js";
+import { r as sanitizeInlineImageDataUrl, t as invalidInlineImageText } from "./image-payload-sanitizer-tupAr-2o.js";
+import { E as itemStatus, L as readItem, T as itemName, b as auditNativeToolUnfinishedStatus, h as isCodexNotificationForTurn, k as shouldClearTerminalPresentationForNativeItem, v as auditNativeToolName, y as auditNativeToolTerminalStatus } from "./attempt-client-cleanup-D6cR54TV.js";
+import { B as emitCodexNativePreToolUseFailureDiagnostic, S as resolveCodexWebSearchPlan, it as isForcedPrivateQaCodexRuntime, nt as filterCodexDynamicTools, ot as isSystemAgentOnlyCodexDynamicToolAllowlist, rt as filterCodexDynamicToolsForDisabledNativeSurface, st as normalizeCodexDynamicToolName } from "./thread-lifecycle-D1pzRwHB.js";
+import { n as resolveCodexNativeExecutionPolicy, r as resolveCodexNodeExecToolOverrides } from "./native-execution-policy-umd0tgh4.js";
+import { a as CODEX_NODE_EXEC_DYNAMIC_TOOL_NAME, c as createNodeExecAliasDynamicTool, i as CODEX_GATEWAY_PROCESS_DYNAMIC_TOOL_NAME, l as isCodexDynamicToolExcluded, o as createGatewayExecProjection, r as CODEX_GATEWAY_EXEC_DYNAMIC_TOOL_NAME, s as createGatewayProcessProjection } from "./provider-capabilities-W4tfK5Y5.js";
+import { a as requestPluginApprovalOutcome, c as truncateCodexApprovalDisplayText, i as requestPluginApproval, l as waitForPluginApprovalDecision, n as codexApprovalTimeoutText, o as sanitizeCodexApprovalVisibleText, r as mapExecDecisionToOutcome, s as stripDanglingCodexApprovalTerminalSequence, t as approvalRequestExplicitlyUnavailable } from "./plugin-approval-roundtrip-DeW95wB5.js";
+import { createRequire } from "node:module";
 import { asNonArrayRecord, asOptionalRecord, isRecord, normalizeOptionalString, normalizeTrimmedStringList, readStringField } from "openclaw/plugin-sdk/string-coerce-runtime";
-import { validateJsonSchemaValue } from "openclaw/plugin-sdk/json-schema-runtime";
-import path, { posix } from "node:path";
-import { createDeferred } from "openclaw/plugin-sdk/extension-shared";
-import { asDateTimestampMs } from "openclaw/plugin-sdk/number-runtime";
-import { HEARTBEAT_RESPONSE_TOOL_NAME, buildAgentHookContextChannelFields, buildEmbeddedAttemptToolRunContext, consumeAdjustedParamsForToolCall, consumePreExecutionBlockedToolCall, createAgentToolResultMiddlewareRunner, createCodexAppServerToolResultExtensionRunner, embeddedAgentLog, extractMessagingToolSend, extractMessagingToolSendResult, extractToolResultMediaArtifact, filterProviderNormalizableTools, filterToolResultMediaUrls, finalizeToolTerminalPresentation, formatApprovalDisplayPath, formatToolExecutionErrorMessage, getBeforeToolCallFailureDisposition, getChannelAgentToolMeta, getPluginToolMeta, getPluginToolSideEffectOwnerKey, hasNativeHookRelayInvocation, invokeNativeHookRelay, isDeliveredMessageToolOnlySourceReplyResult, isDeliveredMessagingToolResult, isHostScopedAgentToolActive, isMessagingTool, isMessagingToolSendAction, isReplaySafeToolCall, isSubagentSessionKey, isToolResultError, isToolWrappedWithBeforeToolCallHook, normalizeAgentRuntimeTools, normalizeHeartbeatToolResponse, projectRuntimeToolInputSchema, resolveAttemptSpawnWorkspaceDir, resolveModelAuthMode, resolveNativeHookRelayDeferredToolApproval, resolveToolExecutionErrorKind, resolveToolResultFailureKind, runAgentHarnessAfterToolCallHook, sanitizeToolResult, setBeforeToolCallDiagnosticsEnabled, supportsModelTools, wrapToolWithBeforeToolCallHook } from "openclaw/plugin-sdk/agent-harness-runtime";
-import { isPathStrictlyInside, root } from "openclaw/plugin-sdk/file-access-runtime";
 import { createHash, randomUUID } from "node:crypto";
-import { resolveAgentDir as resolveAgentDir$1 } from "openclaw/plugin-sdk/agent-runtime";
-import { formatErrorMessage as formatErrorMessage$1, redactSensitiveText } from "openclaw/plugin-sdk/security-runtime";
+import { asDateTimestampMs } from "openclaw/plugin-sdk/number-runtime";
 import { killProcessTree } from "openclaw/plugin-sdk/process-runtime";
-import { SsrFBlockedError, isBlockedHostnameOrIp } from "openclaw/plugin-sdk/ssrf-runtime";
-import { spawn } from "node:child_process";
+import { validateJsonSchemaValue } from "openclaw/plugin-sdk/json-schema-runtime";
+import path, { posix } from "node:path";
+import { expectDefined } from "openclaw/plugin-sdk/expect-runtime";
 import { once } from "node:events";
+import { spawn } from "node:child_process";
 import { coerceErrorMessage } from "openclaw/plugin-sdk/error-runtime";
 import { DEFAULT_MAX_LIVE_TOOL_RESULT_CHARS, estimateToolResultTextChars, resolveLiveToolResultMaxChars, sliceToolResultTextToBudget, sliceUtf16Safe, truncateUtf16Safe } from "openclaw/plugin-sdk/text-utility-runtime";
+import { createDeferred } from "openclaw/plugin-sdk/extension-shared";
+import { createStageTimingTracker, formatStageTimings } from "openclaw/plugin-sdk/time-runtime";
+import { isPathStrictlyInside, root } from "openclaw/plugin-sdk/file-access-runtime";
+import { fileURLToPath, pathToFileURL } from "node:url";
+import { resolveAgentDir } from "openclaw/plugin-sdk/agent-runtime";
+import { HEARTBEAT_RESPONSE_TOOL_NAME, buildAgentHookContextChannelFields, buildEmbeddedAttemptToolRunContext, consumeAdjustedParamsForToolCall, consumePreExecutionBlockedToolCall, createAgentToolResultMiddlewareRunner, createCodexAppServerToolResultExtensionRunner, embeddedAgentLog, extractMessagingToolSend, extractMessagingToolSendResult, extractToolResultMediaArtifact, filterProviderNormalizableTools, filterToolResultMediaUrls, finalizeAgentToolAvailability, finalizeToolTerminalPresentation, formatApprovalDisplayPath, formatToolExecutionErrorMessage, getBeforeToolCallFailureDisposition, getChannelAgentToolMeta, getPluginToolMeta, getPluginToolSideEffectOwnerKey, hasNativeHookRelayInvocation, invokeNativeHookRelay, isDeliveredMessageToolOnlySourceReplyResult, isDeliveredMessagingToolResult, isHostScopedAgentToolActive, isMessagingTool, isMessagingToolSendAction, isReplaySafeToolCall, isSubagentSessionKey, isToolResultError, isToolWrappedWithBeforeToolCallHook, normalizeAgentRuntimeTools, normalizeHeartbeatToolResponse, projectRuntimeToolInputSchema, resolveAttemptSpawnWorkspaceDir, resolveModelAuthMode, resolveNativeHookRelayDeferredToolApproval, resolveToolExecutionErrorKind, resolveToolResultFailureKind, runAgentHarnessAfterToolCallHook, sanitizeToolResult, setBeforeToolCallDiagnosticsEnabled, supportsModelTools, wrapToolWithBeforeToolCallHook } from "openclaw/plugin-sdk/agent-harness-runtime";
+import { formatErrorMessage as formatErrorMessage$2, redactSensitiveText } from "openclaw/plugin-sdk/security-runtime";
 import { emitTrustedDiagnosticEvent } from "openclaw/plugin-sdk/diagnostic-runtime";
 import { isIP } from "node:net";
-import { WebSocketServer } from "ws";
-import { fileURLToPath, pathToFileURL } from "node:url";
-import { expectDefined } from "openclaw/plugin-sdk/expect-runtime";
 import { redactToolPayloadText } from "openclaw/plugin-sdk/logging-core";
 import { formatMcpCodexApprovalRemedy, requiresMcpCodexToolApproval, resolveCodexScheduledToolProjectionFactory, resolveProjectedMcpCodexToolApprovalMode, runWithCronCreatorAuthorityCapabilityResolver } from "openclaw/plugin-sdk/codex-mcp-projection";
 import { buildRemoteCommand, isToolAllowed, sanitizeEnvVars } from "openclaw/plugin-sdk/sandbox";
 import { saveMediaBuffer } from "openclaw/plugin-sdk/media-store";
 import { getMediaDir } from "openclaw/plugin-sdk/media-runtime";
-import { consumeTrustedToolNoStartError, getCoreTtsToolResultMediaUrls } from "openclaw/plugin-sdk/agent-harness-tool-runtime";
+import { consumeTrustedToolNoStartError, copyInternalToolResultState, getCoreTtsToolResultMediaUrls } from "openclaw/plugin-sdk/agent-harness-tool-runtime";
+import { SsrFBlockedError, isBlockedHostnameOrIp } from "openclaw/plugin-sdk/ssrf-runtime";
 import { normalizeOpenAIStrictCompatSchema } from "openclaw/plugin-sdk/provider-tools";
-//#region extensions/codex/src/app-server/event-projector-native-tool-lifecycle.ts
-function isMcpToolCallItemNotification(method, params) {
-	return (method === "item/started" || method === "item/completed") && isJsonObject(params.item) && params.item.type === "mcpToolCall";
-}
-/** Owns native item lifetimes for diagnostics and MCP approval correlation. */
-var CodexNativeToolLifecycleProjector = class {
-	constructor(context, threadId, turnId, options = {}) {
-		this.context = context;
-		this.threadId = threadId;
-		this.turnId = turnId;
-		this.options = options;
-		this.startedAtByItem = /* @__PURE__ */ new Map();
-		this.activeItems = /* @__PURE__ */ new Map();
-		this.webSearchCompletionByItem = /* @__PURE__ */ new Map();
-		this.completedItemIds = /* @__PURE__ */ new Set();
-		this.approvalFailureDispositionByItem = /* @__PURE__ */ new Map();
-		this.preToolUseFailureByItem = /* @__PURE__ */ new Map();
-		this.finalized = false;
-		this.turnCompleted = false;
-		this.pendingMcpNotifications = 0;
-	}
-	getActiveMcpToolCall(serverName) {
-		if (this.finalized || this.turnCompleted || this.pendingMcpNotifications > 0 || this.options.runAbortSignal?.aborted) return;
-		let candidate;
-		for (const { mcpToolCall } of this.activeItems.values()) {
-			if (mcpToolCall?.server !== serverName) continue;
-			if (candidate) return;
-			candidate = mcpToolCall;
-		}
-		if (!candidate || candidate.status !== "inProgress" || typeof candidate.server !== "string" || !candidate.server.trim() || typeof candidate.tool !== "string" || !candidate.tool.trim() || candidate.arguments === void 0 || candidate.appContext != null || candidate.pluginId != null) return;
-		return {
-			id: candidate.id,
-			server: candidate.server,
-			tool: candidate.tool,
-			arguments: candidate.arguments
-		};
-	}
-	recordMcpToolCallReceipt(notification) {
-		const params = isJsonObject(notification.params) ? notification.params : void 0;
-		if (!params || !isCodexNotificationForTurn(params, this.threadId, this.turnId)) return;
-		if (isMcpToolCallItemNotification(notification.method, params)) this.pendingMcpNotifications += 1;
-		else if (notification.method === "turn/completed" && readCodexTurn(params.turn)?.id === this.turnId) this.turnCompleted = true;
-	}
-	handleNotification(notification) {
-		const params = isJsonObject(notification.params) ? notification.params : void 0;
-		if (!params || !isCodexNotificationForTurn(params, this.threadId, this.turnId)) return;
-		if (this.pendingMcpNotifications > 0 && isMcpToolCallItemNotification(notification.method, params)) this.pendingMcpNotifications -= 1;
-		if (notification.method === "turn/completed") {
-			const turn = readCodexTurn(params.turn);
-			if (!turn || turn.id !== this.turnId) return;
-			this.turnCompleted = true;
-			for (const item of turn.items ?? []) this.recordSnapshotItem(item);
-			return;
-		}
-		if (notification.method === "rawResponseItem/completed") {
-			const item = isJsonObject(params.item) ? params.item : void 0;
-			if (item) this.recordRawWebSearchResult(item);
-			return;
-		}
-		if (notification.method !== "item/started" && notification.method !== "item/completed") return;
-		const item = readItem(params.item);
-		if (!item) return;
-		this.recordItem({
-			phase: notification.method === "item/started" ? "start" : "result",
-			item,
-			sourceTimestampMs: asDateTimestampMs(notification.method === "item/started" ? params.startedAtMs : params.completedAtMs)
-		});
-	}
-	recordItem(params) {
-		const toolName = auditNativeToolName(params.item) ?? (params.item.type === "mcpToolCall" ? params.item.type : void 0);
-		if (!toolName || this.completedItemIds.has(params.item.id)) return;
-		if (params.phase === "start") {
-			this.recordStarted(params.item.id, toolName, auditNativeToolUnfinishedStatus(params.item), params.sourceTimestampMs, params.item.type === "mcpToolCall" ? params.item : void 0);
-			return;
-		}
-		if (params.item.type === "webSearch") {
-			this.webSearchCompletionByItem.set(params.item.id, {
-				runWasAborted: this.options.runAbortSignal?.aborted === true,
-				sourceTimestampMs: params.sourceTimestampMs
-			});
-			return;
-		}
-		const itemDurationMs = typeof params.item.durationMs === "number" ? params.item.durationMs : void 0;
-		this.recordTerminal(params.item.id, toolName, auditNativeToolTerminalStatus(params.item), {
-			itemDurationMs,
-			sourceTimestampMs: params.sourceTimestampMs
-		});
-	}
-	recordApprovalFailureDisposition(toolCallId, disposition) {
-		if (!this.completedItemIds.has(toolCallId)) this.approvalFailureDispositionByItem.set(toolCallId, disposition);
-	}
-	recordPreToolUseFailure(failure, runWasAborted = this.options.runAbortSignal?.aborted === true) {
-		if (this.completedItemIds.has(failure.toolCallId)) return;
-		const record = {
-			failure,
-			terminalReason: runWasAborted && this.options.runAbortSignal ? resolveCodexToolAbortTerminalReason(this.options.runAbortSignal) : failure.disposition
-		};
-		if (this.finalized) {
-			this.completedItemIds.add(failure.toolCallId);
-			this.emitPreToolUseFailure(record, failure.toolName, failure.durationMs);
-			return;
-		}
-		this.preToolUseFailureByItem.set(failure.toolCallId, record);
-	}
-	recordRawWebSearchResult(item) {
-		if (readStringField(item, "type") !== "web_search_call") return;
-		const toolCallId = readStringField(item, "id");
-		if (!toolCallId || this.completedItemIds.has(toolCallId)) return;
-		const toolName = "web_search";
-		this.recordStarted(toolCallId, toolName, "unknown");
-		const rawStatus = readStringField(item, "status");
-		if (rawStatus === "in_progress" || rawStatus === "running") return;
-		const status = rawStatus === "completed" ? "completed" : rawStatus === "cancelled" ? "cancelled" : rawStatus === "failed" || rawStatus === "error" || rawStatus === "incomplete" ? "failed" : "unknown";
-		this.recordTerminal(toolCallId, toolName, status, { sourceTimestampMs: this.webSearchCompletionByItem.get(toolCallId)?.sourceTimestampMs });
-	}
-	recordTerminal(toolCallId, toolName, status, options = {}) {
-		const runWasAborted = options.runWasAborted ?? this.options.runAbortSignal?.aborted === true;
-		const preToolUseFailure = this.preToolUseFailureByItem.get(toolCallId);
-		this.preToolUseFailureByItem.delete(toolCallId);
-		const approvalFailureDisposition = this.approvalFailureDispositionByItem.get(toolCallId);
-		this.approvalFailureDispositionByItem.delete(toolCallId);
-		this.completedItemIds.add(toolCallId);
-		this.activeItems.delete(toolCallId);
-		this.webSearchCompletionByItem.delete(toolCallId);
-		const startedAt = this.startedAtByItem.get(toolCallId);
-		this.startedAtByItem.delete(toolCallId);
-		const endedAt = options.sourceTimestampMs ?? Date.now();
-		const durationMs = options.itemDurationMs ?? (startedAt === void 0 ? 0 : Math.max(0, endedAt - startedAt));
-		if (preToolUseFailure) {
-			this.emitPreToolUseFailure(preToolUseFailure, toolName, durationMs, options.sourceTimestampMs);
-			return;
-		}
-		const terminalEvent = approvalFailureDisposition ? {
-			type: "tool.execution.error",
-			durationMs,
-			errorCategory: "codex_native_tool_approval",
-			terminalReason: approvalFailureDisposition
-		} : status === "blocked" ? {
-			type: "tool.execution.blocked",
-			reason: "codex_native_tool_blocked",
-			deniedReason: "codex_native_tool_blocked"
-		} : status === "failed" || status === "cancelled" || status === "unknown" ? {
-			type: "tool.execution.error",
-			durationMs,
-			errorCategory: status === "unknown" ? "codex_native_tool_outcome_unknown" : status === "cancelled" ? "aborted" : "codex_native_tool_error",
-			...status === "unknown" ? { errorCode: "tool_outcome_unknown" } : {},
-			terminalReason: status === "unknown" ? "failed" : runWasAborted && this.options.runAbortSignal ? resolveCodexToolAbortTerminalReason(this.options.runAbortSignal) : status === "cancelled" ? "cancelled" : "failed"
-		} : {
-			type: "tool.execution.completed",
-			durationMs
-		};
-		emitTrustedDiagnosticEvent({
-			...this.buildBase(toolCallId, toolName),
-			...terminalEvent,
-			...options.sourceTimestampMs !== void 0 ? { sourceTimestampMs: options.sourceTimestampMs } : {}
-		});
-	}
-	finalizeActive(runWasAborted = this.options.runAbortSignal?.aborted === true) {
-		this.finalized = true;
-		for (const [toolCallId, { toolName, unfinishedStatus }] of this.activeItems) {
-			const webSearchCompletion = this.webSearchCompletionByItem.get(toolCallId);
-			const itemRunWasAborted = webSearchCompletion ? webSearchCompletion.runWasAborted : runWasAborted;
-			this.recordTerminal(toolCallId, toolName, unfinishedStatus, {
-				runWasAborted: itemRunWasAborted,
-				sourceTimestampMs: webSearchCompletion?.sourceTimestampMs
-			});
-		}
-		for (const [toolCallId, record] of this.preToolUseFailureByItem) if (!this.completedItemIds.has(toolCallId)) this.recordTerminal(toolCallId, record.failure.toolName, "failed", { itemDurationMs: record.failure.durationMs });
-		this.activeItems.clear();
-		this.webSearchCompletionByItem.clear();
-		this.approvalFailureDispositionByItem.clear();
-		this.preToolUseFailureByItem.clear();
-	}
-	emitPreToolUseFailure(record, toolName, durationMs, sourceTimestampMs) {
-		emitCodexNativePreToolUseFailureDiagnostic({
-			agentId: this.context.agentId,
-			sessionId: this.context.sessionId,
-			sessionKey: this.context.sessionKey,
-			runId: this.context.runId,
-			failure: {
-				...record.failure,
-				toolName,
-				durationMs
-			},
-			terminalReason: record.terminalReason,
-			sourceTimestampMs
-		});
-	}
-	recordSnapshotItem(item) {
-		if (!auditNativeToolName(item) || this.completedItemIds.has(item.id) || itemStatus(item) === "running") return;
-		const toolName = auditNativeToolName(item);
-		if (!toolName) return;
-		this.recordStarted(item.id, toolName, auditNativeToolUnfinishedStatus(item));
-		this.recordItem({
-			phase: "result",
-			item
-		});
-	}
-	recordStarted(toolCallId, toolName, unfinishedStatus, sourceTimestampMs, mcpToolCall) {
-		if (this.activeItems.has(toolCallId)) return;
-		this.startedAtByItem.set(toolCallId, sourceTimestampMs ?? Date.now());
-		this.activeItems.set(toolCallId, {
-			toolName,
-			unfinishedStatus,
-			mcpToolCall
-		});
-		emitTrustedDiagnosticEvent({
-			type: "tool.execution.started",
-			...this.buildBase(toolCallId, toolName),
-			...sourceTimestampMs !== void 0 ? { sourceTimestampMs } : {}
-		});
-	}
-	buildBase(toolCallId, toolName) {
-		return {
-			agentId: this.context.agentId,
-			runId: this.context.runId,
-			sessionId: this.context.sessionId,
-			sessionKey: this.context.sessionKey,
-			toolName,
-			toolCallId
-		};
-	}
-};
+//#region extensions/codex/src/app-server/dynamic-tool-build-state.ts
+/** Mutable dependency seam shared by dynamic-tool construction and its behavioral tests. */
+const dynamicToolBuildState = {};
 //#endregion
 //#region extensions/codex/src/app-server/remote-workspace-path.ts
 /** Projects a gateway workspace path into the remote Codex execution workspace. */
@@ -307,273 +89,6 @@ function joinRemoteWorkspacePath(remoteRoot, suffix) {
 	return remoteRoot.endsWith("/") ? `${remoteRoot}${suffix}` : `${remoteRoot}/${suffix}`;
 }
 //#endregion
-//#region extensions/codex/src/app-server/remote-workspace-media.ts
-const REMOTE_WORKSPACE_MEDIA_TIMEOUT_MS = 6e4;
-const REMOTE_WORKSPACE_MEDIA_MAX_BYTES = 67108864;
-const REMOTE_WORKSPACE_MEDIA_MAX_ATTACHMENTS = 16;
-const CODEX_REMOTE_MEDIA_CHUNK_BYTES = 524288;
-const CODEX_REMOTE_COMMAND_DEFAULT_OUTPUT_BYTES = 1048576;
-const CODEX_BOUNDED_REMOTE_FILE_READER = [
-	"try{",
-	"const fs=require(\"node:fs\");",
-	"const path=require(\"node:path\");",
-	"const file=process.argv[1];",
-	"const max=Number(process.argv[2]);",
-	"const offset=Number(process.argv[3]);",
-	"const chunk=Number(process.argv[4]);",
-	"const workspace=process.argv[5];",
-	"if(!Number.isSafeInteger(max)||max<0)throw Error(\"invalid media byte limit\");",
-	"if(!Number.isSafeInteger(offset)||offset<0||!Number.isSafeInteger(chunk)||chunk<=0)throw Error(\"invalid media chunk\");",
-	"if(fs.lstatSync(file).isSymbolicLink())throw Error(\"symbolic links are not allowed\");",
-	"const noFollow=fs.constants.O_NOFOLLOW??0;",
-	"const fd=fs.openSync(file,fs.constants.O_RDONLY|noFollow);",
-	"try{",
-	"const before=fs.fstatSync(fd);",
-	"if(!before.isFile())throw Error(\"not a regular file\");",
-	"if(workspace){",
-	"const descriptor=process.platform===\"linux\"?fs.realpathSync(`/proc/self/fd/${fd}`):fs.realpathSync(file);",
-	"const relative=path.relative(fs.realpathSync(workspace),descriptor);",
-	"if(!relative||relative===\"..\"||relative.startsWith(`..${path.sep}`)||path.isAbsolute(relative))throw Error(\"file escapes remote workspace\");",
-	"const verified=fs.statSync(descriptor);",
-	"if(verified.dev!==before.dev||verified.ino!==before.ino)throw Error(\"file changed while being opened\");",
-	"}",
-	"if(before.size>max)throw Error(`file exceeds limit of ${max} bytes`);",
-	"if(offset>before.size)throw Error(\"file changed while being read\");",
-	"const expected=Math.min(chunk,before.size-offset);",
-	"const buffer=Buffer.allocUnsafe(expected);",
-	"let total=0;",
-	"while(total<buffer.length){",
-	"const count=fs.readSync(fd,buffer,total,buffer.length-total,offset+total);",
-	"if(count===0)break;total+=count;",
-	"}",
-	"if(total!==expected)throw Error(\"file changed while being read\");",
-	"const after=fs.fstatSync(fd);",
-	"const revision=stat=>[stat.dev,stat.ino,stat.size,stat.mtimeMs,stat.ctimeMs].join(\":\");",
-	"if(!after.isFile()||revision(after)!==revision(before))throw Error(\"file changed while being read\");",
-	"process.stdout.write(JSON.stringify({dataBase64:buffer.toString(\"base64\"),size:before.size,revision:revision(before)}));",
-	"}finally{fs.closeSync(fd)}",
-	"}catch(error){process.stderr.write(error instanceof Error?error.message:String(error));process.exitCode=1}"
-].join("");
-const MESSAGE_MEDIA_KEYS = [
-	"media",
-	"mediaUrl",
-	"media_url",
-	"path",
-	"filePath",
-	"fileUrl",
-	"imageUrl",
-	"image_url"
-];
-const MESSAGE_MEDIA_ARRAY_KEYS = [
-	"mediaUrls",
-	"media_urls",
-	"imageUrls",
-	"image_urls"
-];
-const ATTACHMENT_MEDIA_KEYS = [
-	"media",
-	"mediaUrl",
-	"path",
-	"filePath",
-	"fileUrl",
-	"url"
-];
-/** Reads actual remote bytes with a cap enforced by Codex before transport. */
-async function readBoundedCodexRemoteWorkspaceFile(params) {
-	if (!Number.isSafeInteger(params.maxBytes) || params.maxBytes < 0) throw new Error("Codex remote workspace upload requires a valid media byte limit.");
-	params.signal?.throwIfAborted();
-	const chunks = [];
-	let offset = 0;
-	let expectedSize;
-	let expectedRevision;
-	const startedAt = Date.now();
-	do {
-		params.signal?.throwIfAborted();
-		const timeoutMs = params.timeoutMs === void 0 ? void 0 : params.timeoutMs - (Date.now() - startedAt);
-		if (timeoutMs !== void 0 && timeoutMs <= 0) throw new Error("Codex remote workspace file transfer timed out.");
-		let response;
-		try {
-			response = await params.client.request("command/exec", {
-				command: [
-					"node",
-					"-e",
-					CODEX_BOUNDED_REMOTE_FILE_READER,
-					"--",
-					params.path,
-					String(params.maxBytes),
-					String(offset),
-					String(CODEX_REMOTE_MEDIA_CHUNK_BYTES),
-					...params.workspaceRoot ? [params.workspaceRoot] : []
-				],
-				env: {
-					NODE_OPTIONS: null,
-					NODE_PATH: null
-				},
-				...timeoutMs === void 0 ? {} : { timeoutMs }
-			}, {
-				signal: params.signal,
-				timeoutMs
-			});
-		} catch (error) {
-			if (error instanceof Error && /failed to spawn|executable.*not found|\bENOENT\b/iu.test(error.message)) throw new Error("Codex remote workspace file transfer requires Node.js on the remote app-server host.", { cause: error });
-			throw error;
-		}
-		if (!response || response.exitCode !== 0) {
-			const detail = typeof response?.stderr === "string" ? response.stderr.trim() : "";
-			throw new Error(`Codex remote workspace artifact could not be read: ${params.path}${detail ? `: ${detail}` : ""}`);
-		}
-		if (typeof response.stdout !== "string" || response.stdout.length > CODEX_REMOTE_COMMAND_DEFAULT_OUTPUT_BYTES) throw new Error("Codex remote workspace artifact exceeded the native command output cap.");
-		let payload;
-		try {
-			payload = JSON.parse(response.stdout);
-		} catch {
-			throw new Error("Codex remote workspace artifact returned invalid chunk data.");
-		}
-		if (!payload || typeof payload !== "object" || Array.isArray(payload)) throw new Error("Codex remote workspace artifact returned invalid chunk data.");
-		const chunk = payload;
-		if (typeof chunk.dataBase64 !== "string" || !Number.isSafeInteger(chunk.size) || chunk.size < 0 || chunk.size > params.maxBytes || typeof chunk.revision !== "string" || !chunk.revision) throw new Error("Codex remote workspace artifact returned invalid or oversized chunk data.");
-		if (expectedSize === void 0) {
-			expectedSize = chunk.size;
-			expectedRevision = chunk.revision;
-		}
-		if (chunk.size !== expectedSize || chunk.revision !== expectedRevision) throw new Error("Codex remote workspace artifact changed during chunked transfer.");
-		const remainingBytes = expectedSize - offset;
-		const expectedChunkBytes = Math.min(CODEX_REMOTE_MEDIA_CHUNK_BYTES, remainingBytes);
-		if (chunk.dataBase64.length > Math.ceil(expectedChunkBytes / 3) * 4) throw new Error("Codex remote workspace artifact returned oversized chunk data.");
-		const buffer = Buffer.from(chunk.dataBase64, "base64");
-		if (buffer.byteLength !== expectedChunkBytes || buffer.toString("base64") !== chunk.dataBase64) throw new Error("Codex remote workspace artifact returned invalid chunk data.");
-		chunks.push(buffer);
-		offset += buffer.byteLength;
-	} while (offset < (expectedSize ?? 0));
-	return { dataBase64: Buffer.concat(chunks, offset).toString("base64") };
-}
-/** Stages authoritative bounded remote bytes into immutable Gateway-owned media. */
-async function prepareCodexRemoteWorkspaceMessageMedia(params) {
-	const { localWorkspaceRoot, remoteWorkspaceRoot } = params;
-	if (!localWorkspaceRoot || !remoteWorkspaceRoot) return params.args;
-	const remotePathsByLocalPath = /* @__PURE__ */ new Map();
-	const gatewayManagedPaths = /* @__PURE__ */ new Set();
-	const gatewayMediaRoot = getMediaDir();
-	let attachmentEntries = 0;
-	const mapMediaPath = (value) => {
-		if (typeof value !== "string") return value;
-		if (path.isAbsolute(value) && isPathStrictlyInside(gatewayMediaRoot, value)) {
-			attachmentEntries += 1;
-			gatewayManagedPaths.add(value);
-			return value;
-		}
-		const mapped = mapCodexAppServerLocalWorkspacePath({
-			value,
-			localWorkspaceRoot,
-			remoteWorkspaceRoot
-		});
-		if (value.trim() && !isCodexPassThroughMediaSource(value)) {
-			attachmentEntries += 1;
-			remotePathsByLocalPath.set(mapped, mapCodexAppServerRemoteWorkspacePath({
-				value: mapped,
-				localWorkspaceRoot,
-				remoteWorkspaceRoot
-			}));
-		}
-		return mapped;
-	};
-	let mappedArgs = params.args;
-	const setMappedValue = (key, value) => {
-		if (value === params.args[key]) return;
-		if (mappedArgs === params.args) mappedArgs = { ...params.args };
-		mappedArgs[key] = value;
-	};
-	for (const key of MESSAGE_MEDIA_KEYS) setMappedValue(key, mapMediaPath(params.args[key]));
-	for (const key of MESSAGE_MEDIA_ARRAY_KEYS) {
-		const value = params.args[key];
-		if (Array.isArray(value)) {
-			const mapped = value.map(mapMediaPath);
-			if (mapped.some((entry, index) => entry !== value[index])) setMappedValue(key, mapped);
-		}
-	}
-	if (Array.isArray(params.args.attachments)) {
-		const attachments = params.args.attachments;
-		const mapped = attachments.map((attachment) => {
-			if (!attachment || typeof attachment !== "object" || Array.isArray(attachment)) return attachment;
-			const record = attachment;
-			let mappedAttachment = record;
-			for (const key of ATTACHMENT_MEDIA_KEYS) {
-				const value = mapMediaPath(record[key]);
-				if (value !== record[key]) {
-					if (mappedAttachment === record) mappedAttachment = { ...record };
-					mappedAttachment[key] = value;
-				}
-			}
-			return mappedAttachment;
-		});
-		if (mapped.some((attachment, index) => attachment !== attachments[index])) setMappedValue("attachments", mapped);
-	}
-	if (attachmentEntries > REMOTE_WORKSPACE_MEDIA_MAX_ATTACHMENTS) throw new Error(`Codex remote workspace upload exceeds the ${REMOTE_WORKSPACE_MEDIA_MAX_ATTACHMENTS}-attachment limit.`);
-	for (const managedPath of gatewayManagedPaths) await assertGatewayManagedMediaPath(managedPath, gatewayMediaRoot);
-	if (remotePathsByLocalPath.size === 0) return mappedArgs;
-	const readRemoteFile = params.readRemoteFile;
-	if (!readRemoteFile) throw new Error("Codex remote workspace file transfer requires an active app-server client.");
-	const maxBytes = params.maxBytes ?? REMOTE_WORKSPACE_MEDIA_MAX_BYTES;
-	const timeoutMs = params.timeoutMs ?? REMOTE_WORKSPACE_MEDIA_TIMEOUT_MS;
-	const deadline = Date.now() + timeoutMs;
-	const stagedPaths = /* @__PURE__ */ new Map();
-	let totalBytes = 0;
-	for (const [localPath, remotePath] of remotePathsByLocalPath) {
-		params.signal?.throwIfAborted();
-		const remainingBytes = maxBytes - totalBytes;
-		const remainingMs = deadline - Date.now();
-		if (remainingMs <= 0) throw new Error("Codex remote workspace attachment batch timed out.");
-		const response = await readRemoteFile({
-			path: remotePath,
-			maxBytes: remainingBytes,
-			workspaceRoot: remoteWorkspaceRoot,
-			signal: params.signal,
-			timeoutMs: remainingMs
-		});
-		if (!response || typeof response.dataBase64 !== "string") throw new Error(`Codex remote workspace artifact returned no file data: ${remotePath}`);
-		if (response.dataBase64.length > Math.ceil(remainingBytes / 3) * 4) throw new Error(`Codex remote workspace artifact exceeds the limit of ${remainingBytes} bytes.`);
-		const remoteBuffer = Buffer.from(response.dataBase64, "base64");
-		if (remoteBuffer.byteLength > remainingBytes || remoteBuffer.toString("base64") !== response.dataBase64) throw new Error(`Codex remote workspace artifact returned invalid or oversized file data: ${remotePath}`);
-		totalBytes += remoteBuffer.byteLength;
-		const saved = await saveMediaBuffer(remoteBuffer, void 0, "outbound", maxBytes, path.basename(remotePath));
-		stagedPaths.set(localPath, saved.path);
-	}
-	return mapMessageMediaValues(mappedArgs, (value) => stagedPaths.get(value) ?? value);
-}
-async function assertGatewayManagedMediaPath(value, mediaRoot) {
-	const opened = await (await root(mediaRoot, { symlinks: "reject" })).open(path.relative(mediaRoot, value), { symlinks: "reject" });
-	try {
-		if (!(await opened.handle.stat()).isFile()) throw new Error(`Codex Gateway-managed media is not a regular file: ${value}`);
-	} finally {
-		await opened[Symbol.asyncDispose]();
-	}
-}
-function mapMessageMediaValues(args, mapValue) {
-	const mapped = { ...args };
-	for (const key of MESSAGE_MEDIA_KEYS) {
-		const value = mapped[key];
-		if (typeof value === "string") mapped[key] = mapValue(value);
-	}
-	for (const key of MESSAGE_MEDIA_ARRAY_KEYS) {
-		const value = mapped[key];
-		if (Array.isArray(value)) mapped[key] = value.map((entry) => typeof entry === "string" ? mapValue(entry) : entry);
-	}
-	if (Array.isArray(mapped.attachments)) mapped.attachments = mapped.attachments.map((attachment) => {
-		if (!attachment || typeof attachment !== "object" || Array.isArray(attachment)) return attachment;
-		const record = { ...attachment };
-		for (const key of ATTACHMENT_MEDIA_KEYS) {
-			const value = record[key];
-			if (typeof value === "string") record[key] = mapValue(value);
-		}
-		return record;
-	});
-	return mapped;
-}
-//#endregion
-//#region extensions/codex/src/app-server/dynamic-tool-build-state.ts
-/** Mutable dependency seam shared by dynamic-tool construction and its behavioral tests. */
-const dynamicToolBuildState = {};
-//#endregion
 //#region extensions/codex/src/app-server/vision-tools.ts
 /**
 * Codex's enabled native surface includes its stable view_image loader. Keep
@@ -641,46 +156,23 @@ function resolveCodexAppServerHookChannelId(params, sandboxSessionKey) {
 }
 const CODEX_DYNAMIC_TOOL_BUILD_WARN_TOTAL_MS = 1e3;
 const CODEX_DYNAMIC_TOOL_BUILD_WARN_STAGE_MS = 500;
-/** Creates cheap optional timing instrumentation for the dynamic-tool hot path. */
-function createCodexDynamicToolBuildStageTracker(options = {}) {
-	if (!options.enabled) return {
-		mark() {},
-		snapshot() {
-			return {
-				totalMs: 0,
-				stages: []
-			};
-		}
-	};
-	const startedAt = Date.now();
-	let previousAt = startedAt;
-	const stages = [];
-	const toMs = (value) => Math.max(0, Math.round(value));
+/** Captures bounded preparation stages before a slow turn needs diagnosis. */
+function createCodexDynamicToolBuildStageTracker() {
+	const { mark, snapshot } = createStageTimingTracker();
 	return {
-		mark(name) {
-			const currentAt = Date.now();
-			stages.push({
-				name,
-				durationMs: toMs(currentAt - previousAt),
-				elapsedMs: toMs(currentAt - startedAt)
-			});
-			previousAt = currentAt;
-		},
-		snapshot() {
-			return {
-				totalMs: toMs(Date.now() - startedAt),
-				stages: stages.slice()
-			};
-		}
+		mark,
+		snapshot
 	};
 }
 /** Returns true when dynamic-tool construction is slow enough to warrant a warning log. */
-function shouldWarnCodexDynamicToolBuildStageSummary(summary) {
-	return summary.totalMs >= CODEX_DYNAMIC_TOOL_BUILD_WARN_TOTAL_MS || summary.stages.some((stage) => stage.durationMs >= CODEX_DYNAMIC_TOOL_BUILD_WARN_STAGE_MS);
+function shouldWarnCodexDynamicToolBuildStageSummary(summary, profilerEnabled = false) {
+	const totalWarnMs = profilerEnabled ? CODEX_DYNAMIC_TOOL_BUILD_WARN_TOTAL_MS : 1e4;
+	const stageWarnMs = profilerEnabled ? CODEX_DYNAMIC_TOOL_BUILD_WARN_STAGE_MS : 5e3;
+	return summary.totalMs >= totalWarnMs || summary.stages.some((stage) => stage.durationMs >= stageWarnMs);
 }
 /** Formats per-stage timings into the compact form used by Codex app-server logs. */
 function formatCodexDynamicToolBuildStageSummary(summary) {
-	return summary.stages.length > 0 ? summary.stages.map((stage) => `${stage.name}:${stage.durationMs}ms@${stage.elapsedMs}ms`).join(",") : "none";
+	return formatStageTimings(summary.stages);
 }
 /** Builds, filters, and normalizes Codex-compatible runtime tools for a single turn. */
 async function buildDynamicTools(input) {
@@ -702,9 +194,9 @@ async function buildDynamicTools(input) {
 		input.onWebSearchPolicyResolved?.(false);
 		return [];
 	}
-	const toolBuildStages = createCodexDynamicToolBuildStageTracker({ enabled: input.profilerEnabled });
+	const toolBuildStages = createCodexDynamicToolBuildStageTracker();
 	const modelHasVision = params.model.input?.includes("image") ?? false;
-	const agentDir = params.agentDir ?? resolveAgentDir$1(params.config ?? {}, input.sessionAgentId);
+	const agentDir = params.agentDir ?? resolveAgentDir(params.config ?? {}, input.sessionAgentId);
 	const injectedOpenClawCodingToolsFactory = dynamicToolBuildState.openClawCodingToolsFactory;
 	const nativeExecutionPolicy = resolveCodexNativeExecutionPolicyForRun(params, {
 		agentId: input.policyAgentId,
@@ -738,31 +230,17 @@ async function buildDynamicTools(input) {
 		...toolConstructionPlan ? { toolConstructionPlan } : {},
 		messageProvider: resolveCodexMessageToolProvider(params),
 		toolPolicyMessageProvider: params.messageProvider ?? params.messageChannel,
-		clientCaps: params.clientCaps,
-		chatType: params.chatType,
-		agentAccountId: params.agentAccountId,
-		messageTo: params.messageTo,
-		messageThreadId: params.messageThreadId,
-		nativeChannelId: params.chatId,
-		messageActionTurnCapability: params.messageActionTurnCapability,
-		groupId: params.groupId,
-		groupChannel: params.groupChannel,
-		groupSpace: params.groupSpace,
-		spawnedBy: params.spawnedBy,
-		senderId: params.senderId,
-		senderName: params.senderName,
-		senderUsername: params.senderUsername,
-		senderE164: params.senderE164,
-		senderIsOwner: params.senderIsOwner,
+		...params.onToolResult ? { questionPrompt: {
+			send: params.onToolResult,
+			...params.messageChannel ? { messageChannel: params.messageChannel } : {}
+		} } : {},
 		inputProvenance: params.inputProvenance,
 		trustedInternalHandoff: params.trustedInternalHandoff,
-		scheduledToolPolicy: params.scheduledToolPolicy,
 		allowGatewaySubagentBinding: params.allowGatewaySubagentBinding || isForcedPrivateQaCodexRuntime(),
 		sessionKey: input.sandboxSessionKey,
 		runSessionKey: params.sessionKey && params.sessionKey !== input.sandboxSessionKey ? params.sessionKey : void 0,
 		sessionId: params.sessionId,
 		runId: params.runId,
-		approvalReviewerDeviceId: params.approvalReviewerDeviceId,
 		agentDir,
 		preparedModelRuntime: params.preparedModelRuntime,
 		cwd: input.effectiveCwd ?? input.effectiveWorkspace,
@@ -787,25 +265,18 @@ async function buildDynamicTools(input) {
 		modelAuthMode: resolveModelAuthMode(params.model.provider, params.config, params.toolAuthProfileStore ?? params.authProfileStore, { workspaceDir: input.effectiveWorkspace }),
 		suppressManagedWebSearch: false,
 		webFetchHostnameAllowlistRef,
-		currentChannelId: params.currentChannelId,
-		currentMessagingTarget: params.currentMessagingTarget,
 		hookChannelId: resolveCodexAppServerHookChannelId(params, input.sandboxSessionKey),
-		currentThreadTs: params.currentThreadTs,
-		currentMessageId: params.currentMessageId,
-		replyToMode: params.replyToMode,
-		hasRepliedRef: params.hasRepliedRef,
 		modelHasVision,
 		computerContextEpoch: input.computerContextEpoch,
+		oneShotCliRun: params.oneShotCliRun,
 		registerRunCleanup: input.registerRunCleanup,
 		requireExplicitMessageTarget: params.requireExplicitMessageTarget ?? isSubagentSessionKey(params.sessionKey),
-		sourceReplyDeliveryMode: params.sourceReplyDeliveryMode,
-		taskSuggestionDeliveryMode: params.taskSuggestionDeliveryMode,
 		disableMessageTool: input.ignoreDisableMessageTool ? false : params.disableMessageTool,
 		forceMessageTool: shouldForceMessageTool(messagePolicyParams),
 		enableHeartbeatTool: params.trigger === "heartbeat" || input.forceHeartbeatTool === true,
 		forceHeartbeatTool: params.trigger === "heartbeat" || input.forceHeartbeatTool === true,
 		onYield: (message, acknowledgment) => {
-			input.onYieldDetected(acknowledgment);
+			input.onYieldDetected(message, acknowledgment);
 			input.onCodexAppServerEvent?.({
 				stream: "codex_app_server.tool",
 				data: {
@@ -825,6 +296,7 @@ async function buildDynamicTools(input) {
 		cronCreatorToolAllowlistCaptureRef: input.cronCreatorToolAllowlistCaptureRef,
 		cronCreatorAuthorityUnavailableReason: input.cronCreatorAuthorityUnavailableReason
 	};
+	input.onMessageToolTargetResolved?.(options.requireExplicitMessageTarget === true);
 	const buildOpenClawCodingTools = () => {
 		const bindingOptions = { cwd: input.effectiveCwd ?? input.effectiveWorkspace };
 		if (injectedOpenClawCodingToolsFactory) return params.hostCapabilities.bindToolSurface(injectedOpenClawCodingToolsFactory(options), bindingOptions);
@@ -911,7 +383,7 @@ async function buildDynamicTools(input) {
 		}))
 	});
 	const summary = toolBuildStages.snapshot();
-	if (shouldWarnCodexDynamicToolBuildStageSummary(summary)) {
+	if (shouldWarnCodexDynamicToolBuildStageSummary(summary, input.profilerEnabled)) {
 		const phase = input.forceHeartbeatTool ? "registered-tools" : "runtime-tools";
 		embeddedAgentLog.warn(`codex app-server dynamic tool build timings runId=${params.runId} sessionId=${params.sessionId} phase=${phase} totalMs=${summary.totalMs} stages=${formatCodexDynamicToolBuildStageSummary(summary)}`, {
 			runId: params.runId,
@@ -1033,82 +505,589 @@ function disableCodexPluginThreadConfig(pluginConfig) {
 			...config.codexPlugins,
 			enabled: false
 		}
-	};
+	};
+}
+/** Adds sandbox_exec/process aliases when native Code Mode cannot directly honor the sandbox. */
+function addSandboxShellDynamicToolsIfAvailable(filteredTools, allTools, input, executionPolicy) {
+	if (isCodexMemoryFlushRun(input.params) || !executionPolicy.nativeToolSurfaceAllowed || !input.sandbox?.enabled || !input.sandbox.backendId.trim() || input.nativeToolSurfaceEnabled !== false || isSandboxShellDynamicToolExcluded(input.pluginConfig)) return filteredTools;
+	const execTool = allTools.find((tool) => normalizeCodexDynamicToolName(tool.name) === "exec");
+	const processTool = allTools.find((tool) => normalizeCodexDynamicToolName(tool.name) === "process");
+	if (!execTool || !processTool) return filteredTools;
+	const sandboxExecTool = {
+		...execTool,
+		name: "sandbox_exec",
+		description: "Run a shell command through OpenClaw's configured sandbox backend for this session. Use when OpenClaw sandboxing is active or when a command must execute in the sandbox backend, such as an SSH-backed sandbox or Docker container-path bind layout. Use Codex's native shell only when no OpenClaw sandbox is active and native Code Mode is available.",
+		execute: async (toolCallId, args, signal, onUpdate) => {
+			const result = await execTool.execute(toolCallId, args, signal, onUpdate);
+			return {
+				...result,
+				content: result.content.map((item) => item.type === "text" ? Object.assign({}, item, { text: item.text.replace("Use process (list/poll/log/write/send-keys/submit/paste/kill/clear/remove) for follow-up.", "Use sandbox_process (list/poll/log/write/send-keys/submit/paste/kill/clear/remove) for follow-up.") }) : item)
+			};
+		}
+	};
+	const sandboxProcessTool = {
+		...processTool,
+		name: "sandbox_process",
+		description: "Manage background shell sessions through OpenClaw's configured sandbox backend for this session: list, poll, log, write, send-keys, submit, paste, kill, clear, or remove. Use only for sandbox follow-up; use Codex's native shell session handling only when no OpenClaw sandbox is active and native Code Mode is available."
+	};
+	return [
+		...filteredTools,
+		sandboxExecTool,
+		sandboxProcessTool
+	];
+}
+function isSandboxShellDynamicToolExcluded(config) {
+	return isCodexDynamicToolExcluded(config, [
+		"exec",
+		"sandbox_exec",
+		"process",
+		"sandbox_process"
+	]);
+}
+async function addNodeShellDynamicToolsIfNeeded(filteredTools, allTools, input, nodePolicy) {
+	if (isCodexMemoryFlushRun(input.params)) return filteredTools;
+	const nodeExecIsDefault = nodePolicy.effectiveExecHost === "node";
+	const nodeExecAvailableFromAuto = nodePolicy.requestedExecHost === "auto" && nodePolicy.effectiveExecHost === "gateway";
+	if (!nodeExecIsDefault && !nodeExecAvailableFromAuto) return filteredTools;
+	const execTool = allTools.find((tool) => normalizeCodexDynamicToolName(tool.name) === "exec");
+	if (!execTool || isCodexDynamicToolExcluded(input.pluginConfig, ["exec", "node_exec"]) || filteredTools.some((tool) => normalizeCodexDynamicToolName(tool.name) === "node_exec")) return filteredTools;
+	const nodeExec = await createNodeExecAliasDynamicTool(execTool, nodePolicy.node, input.runAbortController.signal, input.nodeExecAvailability);
+	return nodeExec ? [...filteredTools, nodeExec] : filteredTools;
+}
+function shouldKeepOpenClawShellDynamicTools(input, nodePolicy) {
+	return !isCodexMemoryFlushRun(input.params) && input.nativeToolSurfaceEnabled === false && input.sandbox?.enabled !== true && nodePolicy.effectiveExecHost !== "node";
+}
+/** Keeps replacement shell tools direct even when model metadata mandates Codex Code Mode. */
+function placeDisabledNativeShellToolsInDirectNamespace(tools, nativeToolSurfaceEnabled) {
+	if (nativeToolSurfaceEnabled !== false) return tools;
+	for (const tool of tools) if (CODEX_DISABLED_NATIVE_SHELL_DYNAMIC_TOOLS.has(normalizeCodexDynamicToolName(tool.name))) tool.catalogMode = "direct-only";
+	return tools;
+}
+/** Applies a normalized tool allowlist while preserving shell aliases for exec/process. */
+function filterCodexDynamicToolsForAllowlist(tools, toolsAllow) {
+	if (!toolsAllow) return tools;
+	if (toolsAllow.length === 0) return [];
+	if (hasWildcardCodexToolsAllow(toolsAllow)) return tools;
+	const allowSet = new Set(toolsAllow.map((name) => normalizeCodexDynamicToolName(name)).filter(Boolean));
+	return tools.filter((tool) => {
+		const normalized = normalizeCodexDynamicToolName(tool.name);
+		return allowSet.has(normalized) || normalized === "sandbox_exec" && allowSet.has("exec") || normalized === "sandbox_process" && (allowSet.has("exec") || allowSet.has("process")) || normalized === "gateway_exec" && allowSet.has("exec") || normalized === "gateway_process" && (allowSet.has("exec") || allowSet.has("process")) || normalized === "node_exec" && allowSet.has("exec");
+	});
+}
+/** Detects the wildcard allowlist marker after Codex tool-name normalization. */
+function hasWildcardCodexToolsAllow(toolsAllow) {
+	return toolsAllow.some((name) => normalizeCodexDynamicToolName(name) === "*");
+}
+/** Forces message delivery through the message tool when the source channel requires it. */
+function shouldForceMessageTool(params) {
+	return params.disableMessageTool !== true && params.sourceReplyDeliveryMode === "message_tool_only";
+}
+//#endregion
+//#region extensions/codex/src/app-server/event-projector-native-tool-lifecycle.ts
+function isMcpToolCallItemNotification(method, params) {
+	return (method === "item/started" || method === "item/completed") && isJsonObject(params.item) && params.item.type === "mcpToolCall";
+}
+/** Owns native item lifetimes, outcome order, presentation, and approval correlation. */
+var CodexNativeToolLifecycleProjector = class {
+	constructor(context, threadId, turnId, options = {}) {
+		this.context = context;
+		this.threadId = threadId;
+		this.turnId = turnId;
+		this.options = options;
+		this.terminalPresentationClearedItemIds = /* @__PURE__ */ new Set();
+		this.nativeToolOutcomeOrdinals = /* @__PURE__ */ new Map();
+		this.startedAtByItem = /* @__PURE__ */ new Map();
+		this.activeItems = /* @__PURE__ */ new Map();
+		this.webSearchCompletionByItem = /* @__PURE__ */ new Map();
+		this.completedItemIds = /* @__PURE__ */ new Set();
+		this.approvalFailureDispositionByItem = /* @__PURE__ */ new Map();
+		this.preToolUseFailureByItem = /* @__PURE__ */ new Map();
+		this.finalized = false;
+		this.turnCompleted = false;
+		this.pendingMcpNotifications = 0;
+	}
+	recordNativeToolOutcome(item) {
+		if (!item || this.nativeToolOutcomeOrdinals.has(item.id) || !shouldClearTerminalPresentationForNativeItem(item)) return;
+		const ordinal = this.context.allocateToolOutcomeOrdinal?.(item.id);
+		if (ordinal !== void 0) this.nativeToolOutcomeOrdinals.set(item.id, ordinal);
+	}
+	clearTerminalPresentationForNativeItem(item) {
+		if (!item || this.terminalPresentationClearedItemIds.has(item.id) || !shouldClearTerminalPresentationForNativeItem(item)) return;
+		const toolCallOrdinal = this.nativeToolOutcomeOrdinals.get(item.id);
+		this.terminalPresentationClearedItemIds.add(item.id);
+		this.context.onToolOutcome?.({
+			toolName: itemName(item) ?? item.type,
+			argsHash: "",
+			resultHash: "",
+			...toolCallOrdinal !== void 0 ? { toolCallOrdinal } : {},
+			terminalPresentation: void 0,
+			presentationOnly: true
+		});
+	}
+	getActiveMcpToolCall(serverName) {
+		if (this.finalized || this.turnCompleted || this.pendingMcpNotifications > 0 || this.options.runAbortSignal?.aborted) return;
+		let candidate;
+		for (const { mcpToolCall } of this.activeItems.values()) {
+			if (mcpToolCall?.server !== serverName) continue;
+			if (candidate) return;
+			candidate = mcpToolCall;
+		}
+		if (!candidate || candidate.status !== "inProgress" || typeof candidate.server !== "string" || !candidate.server.trim() || typeof candidate.tool !== "string" || !candidate.tool.trim() || candidate.arguments === void 0 || candidate.appContext != null || candidate.pluginId != null) return;
+		return {
+			id: candidate.id,
+			server: candidate.server,
+			tool: candidate.tool,
+			arguments: candidate.arguments
+		};
+	}
+	recordMcpToolCallReceipt(notification) {
+		const params = isJsonObject(notification.params) ? notification.params : void 0;
+		if (!params || !isCodexNotificationForTurn(params, this.threadId, this.turnId)) return;
+		if (isMcpToolCallItemNotification(notification.method, params)) this.pendingMcpNotifications += 1;
+		else if (notification.method === "turn/completed" && readCodexTurn(params.turn)?.id === this.turnId) this.turnCompleted = true;
+	}
+	handleNotification(notification) {
+		const params = isJsonObject(notification.params) ? notification.params : void 0;
+		if (!params || !isCodexNotificationForTurn(params, this.threadId, this.turnId)) return;
+		if (this.pendingMcpNotifications > 0 && isMcpToolCallItemNotification(notification.method, params)) this.pendingMcpNotifications -= 1;
+		if (notification.method === "turn/completed") {
+			const turn = readCodexTurn(params.turn);
+			if (!turn || turn.id !== this.turnId) return;
+			this.turnCompleted = true;
+			for (const item of turn.items ?? []) this.recordSnapshotItem(item);
+			return;
+		}
+		if (notification.method === "rawResponseItem/completed") {
+			const item = isJsonObject(params.item) ? params.item : void 0;
+			if (item) this.recordRawWebSearchResult(item);
+			return;
+		}
+		if (notification.method !== "item/started" && notification.method !== "item/completed") return;
+		const item = readItem(params.item);
+		if (!item) return;
+		this.recordItem({
+			phase: notification.method === "item/started" ? "start" : "result",
+			item,
+			sourceTimestampMs: asDateTimestampMs(notification.method === "item/started" ? params.startedAtMs : params.completedAtMs)
+		});
+	}
+	recordItem(params) {
+		const toolName = auditNativeToolName(params.item) ?? (params.item.type === "mcpToolCall" ? params.item.type : void 0);
+		if (!toolName || this.completedItemIds.has(params.item.id)) return;
+		if (params.phase === "start") {
+			this.recordStarted(params.item.id, toolName, auditNativeToolUnfinishedStatus(params.item), params.sourceTimestampMs, params.item.type === "mcpToolCall" ? params.item : void 0);
+			return;
+		}
+		if (params.item.type === "webSearch") {
+			this.webSearchCompletionByItem.set(params.item.id, {
+				runWasAborted: this.options.runAbortSignal?.aborted === true,
+				sourceTimestampMs: params.sourceTimestampMs
+			});
+			return;
+		}
+		const itemDurationMs = typeof params.item.durationMs === "number" ? params.item.durationMs : void 0;
+		this.recordTerminal(params.item.id, toolName, auditNativeToolTerminalStatus(params.item), {
+			itemDurationMs,
+			sourceTimestampMs: params.sourceTimestampMs
+		});
+	}
+	recordApprovalFailureDisposition(toolCallId, disposition) {
+		if (!this.completedItemIds.has(toolCallId)) this.approvalFailureDispositionByItem.set(toolCallId, disposition);
+	}
+	recordPreToolUseFailure(failure, runWasAborted = this.options.runAbortSignal?.aborted === true) {
+		if (this.completedItemIds.has(failure.toolCallId)) return;
+		const record = {
+			failure,
+			terminalReason: runWasAborted && this.options.runAbortSignal ? resolveCodexToolAbortTerminalReason(this.options.runAbortSignal) : failure.disposition
+		};
+		if (this.finalized) {
+			this.completedItemIds.add(failure.toolCallId);
+			this.emitPreToolUseFailure(record, failure.toolName, failure.durationMs);
+			return;
+		}
+		this.preToolUseFailureByItem.set(failure.toolCallId, record);
+	}
+	recordRawWebSearchResult(item) {
+		if (readStringField(item, "type") !== "web_search_call") return;
+		const toolCallId = readStringField(item, "id");
+		if (!toolCallId || this.completedItemIds.has(toolCallId)) return;
+		const toolName = "web_search";
+		this.recordStarted(toolCallId, toolName, "unknown");
+		const rawStatus = readStringField(item, "status");
+		if (rawStatus === "in_progress" || rawStatus === "running") return;
+		const status = rawStatus === "completed" ? "completed" : rawStatus === "cancelled" ? "cancelled" : rawStatus === "failed" || rawStatus === "error" || rawStatus === "incomplete" ? "failed" : "unknown";
+		this.recordTerminal(toolCallId, toolName, status, { sourceTimestampMs: this.webSearchCompletionByItem.get(toolCallId)?.sourceTimestampMs });
+	}
+	recordTerminal(toolCallId, toolName, status, options = {}) {
+		const runWasAborted = options.runWasAborted ?? this.options.runAbortSignal?.aborted === true;
+		const preToolUseFailure = this.preToolUseFailureByItem.get(toolCallId);
+		this.preToolUseFailureByItem.delete(toolCallId);
+		const approvalFailureDisposition = this.approvalFailureDispositionByItem.get(toolCallId);
+		this.approvalFailureDispositionByItem.delete(toolCallId);
+		this.completedItemIds.add(toolCallId);
+		this.activeItems.delete(toolCallId);
+		this.webSearchCompletionByItem.delete(toolCallId);
+		const startedAt = this.startedAtByItem.get(toolCallId);
+		this.startedAtByItem.delete(toolCallId);
+		const endedAt = options.sourceTimestampMs ?? Date.now();
+		const durationMs = options.itemDurationMs ?? (startedAt === void 0 ? 0 : Math.max(0, endedAt - startedAt));
+		if (preToolUseFailure) {
+			this.emitPreToolUseFailure(preToolUseFailure, toolName, durationMs, options.sourceTimestampMs);
+			return;
+		}
+		const terminalEvent = approvalFailureDisposition ? {
+			type: "tool.execution.error",
+			durationMs,
+			errorCategory: "codex_native_tool_approval",
+			terminalReason: approvalFailureDisposition
+		} : status === "blocked" ? {
+			type: "tool.execution.blocked",
+			reason: "codex_native_tool_blocked",
+			deniedReason: "codex_native_tool_blocked"
+		} : status === "failed" || status === "cancelled" || status === "unknown" ? {
+			type: "tool.execution.error",
+			durationMs,
+			errorCategory: status === "unknown" ? "codex_native_tool_outcome_unknown" : status === "cancelled" ? "aborted" : "codex_native_tool_error",
+			...status === "unknown" ? { errorCode: "tool_outcome_unknown" } : {},
+			terminalReason: status === "unknown" ? "failed" : runWasAborted && this.options.runAbortSignal ? resolveCodexToolAbortTerminalReason(this.options.runAbortSignal) : status === "cancelled" ? "cancelled" : "failed"
+		} : {
+			type: "tool.execution.completed",
+			durationMs
+		};
+		emitTrustedDiagnosticEvent({
+			...this.buildBase(toolCallId, toolName),
+			...terminalEvent,
+			...options.sourceTimestampMs !== void 0 ? { sourceTimestampMs: options.sourceTimestampMs } : {}
+		});
+	}
+	finalizeActive(runWasAborted = this.options.runAbortSignal?.aborted === true) {
+		this.finalized = true;
+		for (const [toolCallId, { toolName, unfinishedStatus }] of this.activeItems) {
+			const webSearchCompletion = this.webSearchCompletionByItem.get(toolCallId);
+			const itemRunWasAborted = webSearchCompletion ? webSearchCompletion.runWasAborted : runWasAborted;
+			this.recordTerminal(toolCallId, toolName, unfinishedStatus, {
+				runWasAborted: itemRunWasAborted,
+				sourceTimestampMs: webSearchCompletion?.sourceTimestampMs
+			});
+		}
+		for (const [toolCallId, record] of this.preToolUseFailureByItem) if (!this.completedItemIds.has(toolCallId)) this.recordTerminal(toolCallId, record.failure.toolName, "failed", { itemDurationMs: record.failure.durationMs });
+		this.activeItems.clear();
+		this.webSearchCompletionByItem.clear();
+		this.approvalFailureDispositionByItem.clear();
+		this.preToolUseFailureByItem.clear();
+	}
+	emitPreToolUseFailure(record, toolName, durationMs, sourceTimestampMs) {
+		emitCodexNativePreToolUseFailureDiagnostic({
+			agentId: this.context.agentId,
+			sessionId: this.context.sessionId,
+			sessionKey: this.context.sessionKey,
+			runId: this.context.runId,
+			failure: {
+				...record.failure,
+				toolName,
+				durationMs
+			},
+			terminalReason: record.terminalReason,
+			sourceTimestampMs
+		});
+	}
+	recordSnapshotItem(item) {
+		if (!auditNativeToolName(item) || this.completedItemIds.has(item.id) || itemStatus(item) === "running") return;
+		const toolName = auditNativeToolName(item);
+		if (!toolName) return;
+		this.recordStarted(item.id, toolName, auditNativeToolUnfinishedStatus(item));
+		this.recordItem({
+			phase: "result",
+			item
+		});
+	}
+	recordStarted(toolCallId, toolName, unfinishedStatus, sourceTimestampMs, mcpToolCall) {
+		if (this.activeItems.has(toolCallId)) return;
+		this.startedAtByItem.set(toolCallId, sourceTimestampMs ?? Date.now());
+		this.activeItems.set(toolCallId, {
+			toolName,
+			unfinishedStatus,
+			mcpToolCall
+		});
+		emitTrustedDiagnosticEvent({
+			type: "tool.execution.started",
+			...this.buildBase(toolCallId, toolName),
+			...sourceTimestampMs !== void 0 ? { sourceTimestampMs } : {}
+		});
+	}
+	buildBase(toolCallId, toolName) {
+		return {
+			agentId: this.context.agentId,
+			runId: this.context.runId,
+			sessionId: this.context.sessionId,
+			sessionKey: this.context.sessionKey,
+			toolName,
+			toolCallId
+		};
+	}
+};
+//#endregion
+//#region extensions/codex/src/app-server/remote-workspace-media.ts
+const REMOTE_WORKSPACE_MEDIA_TIMEOUT_MS = 6e4;
+const REMOTE_WORKSPACE_MEDIA_MAX_BYTES = 67108864;
+const REMOTE_WORKSPACE_MEDIA_MAX_ATTACHMENTS = 16;
+const CODEX_REMOTE_MEDIA_CHUNK_BYTES = 524288;
+const CODEX_REMOTE_COMMAND_DEFAULT_OUTPUT_BYTES = 1048576;
+const CODEX_BOUNDED_REMOTE_FILE_READER = [
+	"try{",
+	"const fs=require(\"node:fs\");",
+	"const path=require(\"node:path\");",
+	"const file=process.argv[1];",
+	"const max=Number(process.argv[2]);",
+	"const offset=Number(process.argv[3]);",
+	"const chunk=Number(process.argv[4]);",
+	"const workspace=process.argv[5];",
+	"if(!Number.isSafeInteger(max)||max<0)throw Error(\"invalid media byte limit\");",
+	"if(!Number.isSafeInteger(offset)||offset<0||!Number.isSafeInteger(chunk)||chunk<=0)throw Error(\"invalid media chunk\");",
+	"if(fs.lstatSync(file).isSymbolicLink())throw Error(\"symbolic links are not allowed\");",
+	"const noFollow=fs.constants.O_NOFOLLOW??0;",
+	"const fd=fs.openSync(file,fs.constants.O_RDONLY|noFollow);",
+	"try{",
+	"const before=fs.fstatSync(fd);",
+	"if(!before.isFile())throw Error(\"not a regular file\");",
+	"if(workspace){",
+	"const descriptor=process.platform===\"linux\"?fs.realpathSync(`/proc/self/fd/${fd}`):fs.realpathSync(file);",
+	"const relative=path.relative(fs.realpathSync(workspace),descriptor);",
+	"if(!relative||relative===\"..\"||relative.startsWith(`..${path.sep}`)||path.isAbsolute(relative))throw Error(\"file escapes remote workspace\");",
+	"const verified=fs.statSync(descriptor);",
+	"if(verified.dev!==before.dev||verified.ino!==before.ino)throw Error(\"file changed while being opened\");",
+	"}",
+	"if(before.size>max)throw Error(`file exceeds limit of ${max} bytes`);",
+	"if(offset>before.size)throw Error(\"file changed while being read\");",
+	"const expected=Math.min(chunk,before.size-offset);",
+	"const buffer=Buffer.allocUnsafe(expected);",
+	"let total=0;",
+	"while(total<buffer.length){",
+	"const count=fs.readSync(fd,buffer,total,buffer.length-total,offset+total);",
+	"if(count===0)break;total+=count;",
+	"}",
+	"if(total!==expected)throw Error(\"file changed while being read\");",
+	"const after=fs.fstatSync(fd);",
+	"const revision=stat=>[stat.dev,stat.ino,stat.size,stat.mtimeMs,stat.ctimeMs].join(\":\");",
+	"if(!after.isFile()||revision(after)!==revision(before))throw Error(\"file changed while being read\");",
+	"process.stdout.write(JSON.stringify({dataBase64:buffer.toString(\"base64\"),size:before.size,revision:revision(before)}));",
+	"}finally{fs.closeSync(fd)}",
+	"}catch(error){process.stderr.write(error instanceof Error?error.message:String(error));process.exitCode=1}"
+].join("");
+const MESSAGE_MEDIA_KEYS = [
+	"media",
+	"mediaUrl",
+	"media_url",
+	"path",
+	"filePath",
+	"fileUrl",
+	"imageUrl",
+	"image_url"
+];
+const MESSAGE_MEDIA_ARRAY_KEYS = [
+	"mediaUrls",
+	"media_urls",
+	"imageUrls",
+	"image_urls"
+];
+const ATTACHMENT_MEDIA_KEYS = [
+	"media",
+	"mediaUrl",
+	"path",
+	"filePath",
+	"fileUrl",
+	"url"
+];
+/** Reads actual remote bytes with a cap enforced by Codex before transport. */
+async function readBoundedCodexRemoteWorkspaceFile(params) {
+	if (!Number.isSafeInteger(params.maxBytes) || params.maxBytes < 0) throw new Error("Codex remote workspace upload requires a valid media byte limit.");
+	params.signal?.throwIfAborted();
+	const chunks = [];
+	let offset = 0;
+	let expectedSize;
+	let expectedRevision;
+	const startedAt = Date.now();
+	do {
+		params.signal?.throwIfAborted();
+		const timeoutMs = params.timeoutMs === void 0 ? void 0 : params.timeoutMs - (Date.now() - startedAt);
+		if (timeoutMs !== void 0 && timeoutMs <= 0) throw new Error("Codex remote workspace file transfer timed out.");
+		let response;
+		try {
+			response = await params.client.request("command/exec", {
+				command: [
+					"node",
+					"-e",
+					CODEX_BOUNDED_REMOTE_FILE_READER,
+					"--",
+					params.path,
+					String(params.maxBytes),
+					String(offset),
+					String(CODEX_REMOTE_MEDIA_CHUNK_BYTES),
+					...params.workspaceRoot ? [params.workspaceRoot] : []
+				],
+				env: {
+					NODE_OPTIONS: null,
+					NODE_PATH: null
+				},
+				...timeoutMs === void 0 ? {} : { timeoutMs }
+			}, {
+				signal: params.signal,
+				timeoutMs
+			});
+		} catch (error) {
+			if (error instanceof Error && /failed to spawn|executable.*not found|\bENOENT\b/iu.test(error.message)) throw new Error("Codex remote workspace file transfer requires Node.js on the remote app-server host.", { cause: error });
+			throw error;
+		}
+		if (!response || response.exitCode !== 0) {
+			const detail = typeof response?.stderr === "string" ? response.stderr.trim() : "";
+			throw new Error(`Codex remote workspace artifact could not be read: ${params.path}${detail ? `: ${detail}` : ""}`);
+		}
+		if (typeof response.stdout !== "string" || response.stdout.length > CODEX_REMOTE_COMMAND_DEFAULT_OUTPUT_BYTES) throw new Error("Codex remote workspace artifact exceeded the native command output cap.");
+		let payload;
+		try {
+			payload = JSON.parse(response.stdout);
+		} catch {
+			throw new Error("Codex remote workspace artifact returned invalid chunk data.");
+		}
+		if (!payload || typeof payload !== "object" || Array.isArray(payload)) throw new Error("Codex remote workspace artifact returned invalid chunk data.");
+		const chunk = payload;
+		if (typeof chunk.dataBase64 !== "string" || !Number.isSafeInteger(chunk.size) || chunk.size < 0 || chunk.size > params.maxBytes || typeof chunk.revision !== "string" || !chunk.revision) throw new Error("Codex remote workspace artifact returned invalid or oversized chunk data.");
+		if (expectedSize === void 0) {
+			expectedSize = chunk.size;
+			expectedRevision = chunk.revision;
+		}
+		if (chunk.size !== expectedSize || chunk.revision !== expectedRevision) throw new Error("Codex remote workspace artifact changed during chunked transfer.");
+		const remainingBytes = expectedSize - offset;
+		const expectedChunkBytes = Math.min(CODEX_REMOTE_MEDIA_CHUNK_BYTES, remainingBytes);
+		if (chunk.dataBase64.length > Math.ceil(expectedChunkBytes / 3) * 4) throw new Error("Codex remote workspace artifact returned oversized chunk data.");
+		const buffer = Buffer.from(chunk.dataBase64, "base64");
+		if (buffer.byteLength !== expectedChunkBytes || buffer.toString("base64") !== chunk.dataBase64) throw new Error("Codex remote workspace artifact returned invalid chunk data.");
+		chunks.push(buffer);
+		offset += buffer.byteLength;
+	} while (offset < (expectedSize ?? 0));
+	return { dataBase64: Buffer.concat(chunks, offset).toString("base64") };
 }
-/** Adds sandbox_exec/process aliases when native Code Mode cannot directly honor the sandbox. */
-function addSandboxShellDynamicToolsIfAvailable(filteredTools, allTools, input, executionPolicy) {
-	if (isCodexMemoryFlushRun(input.params) || !executionPolicy.nativeToolSurfaceAllowed || !input.sandbox?.enabled || !input.sandbox.backendId.trim() || input.nativeToolSurfaceEnabled !== false || isSandboxShellDynamicToolExcluded(input.pluginConfig)) return filteredTools;
-	const execTool = allTools.find((tool) => normalizeCodexDynamicToolName(tool.name) === "exec");
-	const processTool = allTools.find((tool) => normalizeCodexDynamicToolName(tool.name) === "process");
-	if (!execTool || !processTool) return filteredTools;
-	const sandboxExecTool = {
-		...execTool,
-		name: "sandbox_exec",
-		description: "Run a shell command through OpenClaw's configured sandbox backend for this session. Use when OpenClaw sandboxing is active or when a command must execute in the sandbox backend, such as an SSH-backed sandbox or Docker container-path bind layout. Use Codex's native shell only when no OpenClaw sandbox is active and native Code Mode is available.",
-		execute: async (toolCallId, args, signal, onUpdate) => {
-			const result = await execTool.execute(toolCallId, args, signal, onUpdate);
-			return {
-				...result,
-				content: result.content.map((item) => item.type === "text" ? Object.assign({}, item, { text: item.text.replace("Use process (list/poll/log/write/send-keys/submit/paste/kill/clear/remove) for follow-up.", "Use sandbox_process (list/poll/log/write/send-keys/submit/paste/kill/clear/remove) for follow-up.") }) : item)
-			};
+/** Stages authoritative bounded remote bytes into immutable Gateway-owned media. */
+async function prepareCodexRemoteWorkspaceMessageMedia(params) {
+	const { localWorkspaceRoot, remoteWorkspaceRoot } = params;
+	if (!localWorkspaceRoot || !remoteWorkspaceRoot) return params.args;
+	const remotePathsByLocalPath = /* @__PURE__ */ new Map();
+	const gatewayManagedPaths = /* @__PURE__ */ new Set();
+	const gatewayMediaRoot = getMediaDir();
+	let attachmentEntries = 0;
+	const mapMediaPath = (value) => {
+		if (typeof value !== "string") return value;
+		if (path.isAbsolute(value) && isPathStrictlyInside(gatewayMediaRoot, value)) {
+			attachmentEntries += 1;
+			gatewayManagedPaths.add(value);
+			return value;
+		}
+		const mapped = mapCodexAppServerLocalWorkspacePath({
+			value,
+			localWorkspaceRoot,
+			remoteWorkspaceRoot
+		});
+		if (value.trim() && !isCodexPassThroughMediaSource(value)) {
+			attachmentEntries += 1;
+			remotePathsByLocalPath.set(mapped, mapCodexAppServerRemoteWorkspacePath({
+				value: mapped,
+				localWorkspaceRoot,
+				remoteWorkspaceRoot
+			}));
 		}
+		return mapped;
 	};
-	const sandboxProcessTool = {
-		...processTool,
-		name: "sandbox_process",
-		description: "Manage background shell sessions through OpenClaw's configured sandbox backend for this session: list, poll, log, write, send-keys, submit, paste, kill, clear, or remove. Use only for sandbox follow-up; use Codex's native shell session handling only when no OpenClaw sandbox is active and native Code Mode is available."
+	let mappedArgs = params.args;
+	const setMappedValue = (key, value) => {
+		if (value === params.args[key]) return;
+		if (mappedArgs === params.args) mappedArgs = { ...params.args };
+		mappedArgs[key] = value;
 	};
-	return [
-		...filteredTools,
-		sandboxExecTool,
-		sandboxProcessTool
-	];
-}
-function isSandboxShellDynamicToolExcluded(config) {
-	return isCodexDynamicToolExcluded(config, [
-		"exec",
-		"sandbox_exec",
-		"process",
-		"sandbox_process"
-	]);
-}
-async function addNodeShellDynamicToolsIfNeeded(filteredTools, allTools, input, nodePolicy) {
-	if (isCodexMemoryFlushRun(input.params)) return filteredTools;
-	const nodeExecIsDefault = nodePolicy.effectiveExecHost === "node";
-	const nodeExecAvailableFromAuto = nodePolicy.requestedExecHost === "auto" && nodePolicy.effectiveExecHost === "gateway";
-	if (!nodeExecIsDefault && !nodeExecAvailableFromAuto) return filteredTools;
-	const execTool = allTools.find((tool) => normalizeCodexDynamicToolName(tool.name) === "exec");
-	if (!execTool || isCodexDynamicToolExcluded(input.pluginConfig, ["exec", "node_exec"]) || filteredTools.some((tool) => normalizeCodexDynamicToolName(tool.name) === "node_exec")) return filteredTools;
-	const nodeExec = await createNodeExecAliasDynamicTool(execTool, nodePolicy.node, input.runAbortController.signal, input.nodeExecAvailability);
-	return nodeExec ? [...filteredTools, nodeExec] : filteredTools;
-}
-function shouldKeepOpenClawShellDynamicTools(input, nodePolicy) {
-	return !isCodexMemoryFlushRun(input.params) && input.nativeToolSurfaceEnabled === false && input.sandbox?.enabled !== true && nodePolicy.effectiveExecHost !== "node";
+	for (const key of MESSAGE_MEDIA_KEYS) setMappedValue(key, mapMediaPath(params.args[key]));
+	for (const key of MESSAGE_MEDIA_ARRAY_KEYS) {
+		const value = params.args[key];
+		if (Array.isArray(value)) {
+			const mapped = value.map(mapMediaPath);
+			if (mapped.some((entry, index) => entry !== value[index])) setMappedValue(key, mapped);
+		}
+	}
+	if (Array.isArray(params.args.attachments)) {
+		const attachments = params.args.attachments;
+		const mapped = attachments.map((attachment) => {
+			if (!attachment || typeof attachment !== "object" || Array.isArray(attachment)) return attachment;
+			const record = attachment;
+			let mappedAttachment = record;
+			for (const key of ATTACHMENT_MEDIA_KEYS) {
+				const value = mapMediaPath(record[key]);
+				if (value !== record[key]) {
+					if (mappedAttachment === record) mappedAttachment = { ...record };
+					mappedAttachment[key] = value;
+				}
+			}
+			return mappedAttachment;
+		});
+		if (mapped.some((attachment, index) => attachment !== attachments[index])) setMappedValue("attachments", mapped);
+	}
+	if (attachmentEntries > REMOTE_WORKSPACE_MEDIA_MAX_ATTACHMENTS) throw new Error(`Codex remote workspace upload exceeds the ${REMOTE_WORKSPACE_MEDIA_MAX_ATTACHMENTS}-attachment limit.`);
+	for (const managedPath of gatewayManagedPaths) await assertGatewayManagedMediaPath(managedPath, gatewayMediaRoot);
+	if (remotePathsByLocalPath.size === 0) return mappedArgs;
+	const readRemoteFile = params.readRemoteFile;
+	if (!readRemoteFile) throw new Error("Codex remote workspace file transfer requires an active app-server client.");
+	const maxBytes = params.maxBytes ?? REMOTE_WORKSPACE_MEDIA_MAX_BYTES;
+	const timeoutMs = params.timeoutMs ?? REMOTE_WORKSPACE_MEDIA_TIMEOUT_MS;
+	const deadline = Date.now() + timeoutMs;
+	const stagedPaths = /* @__PURE__ */ new Map();
+	let totalBytes = 0;
+	for (const [localPath, remotePath] of remotePathsByLocalPath) {
+		params.signal?.throwIfAborted();
+		const remainingBytes = maxBytes - totalBytes;
+		const remainingMs = deadline - Date.now();
+		if (remainingMs <= 0) throw new Error("Codex remote workspace attachment batch timed out.");
+		const response = await readRemoteFile({
+			path: remotePath,
+			maxBytes: remainingBytes,
+			workspaceRoot: remoteWorkspaceRoot,
+			signal: params.signal,
+			timeoutMs: remainingMs
+		});
+		if (!response || typeof response.dataBase64 !== "string") throw new Error(`Codex remote workspace artifact returned no file data: ${remotePath}`);
+		if (response.dataBase64.length > Math.ceil(remainingBytes / 3) * 4) throw new Error(`Codex remote workspace artifact exceeds the limit of ${remainingBytes} bytes.`);
+		const remoteBuffer = Buffer.from(response.dataBase64, "base64");
+		if (remoteBuffer.byteLength > remainingBytes || remoteBuffer.toString("base64") !== response.dataBase64) throw new Error(`Codex remote workspace artifact returned invalid or oversized file data: ${remotePath}`);
+		totalBytes += remoteBuffer.byteLength;
+		const saved = await saveMediaBuffer(remoteBuffer, void 0, "outbound", maxBytes, path.basename(remotePath));
+		stagedPaths.set(localPath, saved.path);
+	}
+	return mapMessageMediaValues(mappedArgs, (value) => stagedPaths.get(value) ?? value);
 }
-/** Keeps replacement shell tools direct even when model metadata mandates Codex Code Mode. */
-function placeDisabledNativeShellToolsInDirectNamespace(tools, nativeToolSurfaceEnabled) {
-	if (nativeToolSurfaceEnabled !== false) return tools;
-	for (const tool of tools) if (CODEX_DISABLED_NATIVE_SHELL_DYNAMIC_TOOLS.has(normalizeCodexDynamicToolName(tool.name))) tool.catalogMode = "direct-only";
-	return tools;
+async function assertGatewayManagedMediaPath(value, mediaRoot) {
+	const opened = await (await root(mediaRoot, { symlinks: "reject" })).open(path.relative(mediaRoot, value), { symlinks: "reject" });
+	try {
+		if (!(await opened.handle.stat()).isFile()) throw new Error(`Codex Gateway-managed media is not a regular file: ${value}`);
+	} finally {
+		await opened[Symbol.asyncDispose]();
+	}
 }
-/** Applies a normalized tool allowlist while preserving shell aliases for exec/process. */
-function filterCodexDynamicToolsForAllowlist(tools, toolsAllow) {
-	if (!toolsAllow) return tools;
-	if (toolsAllow.length === 0) return [];
-	if (hasWildcardCodexToolsAllow(toolsAllow)) return tools;
-	const allowSet = new Set(toolsAllow.map((name) => normalizeCodexDynamicToolName(name)).filter(Boolean));
-	return tools.filter((tool) => {
-		const normalized = normalizeCodexDynamicToolName(tool.name);
-		return allowSet.has(normalized) || normalized === "sandbox_exec" && allowSet.has("exec") || normalized === "sandbox_process" && (allowSet.has("exec") || allowSet.has("process")) || normalized === "gateway_exec" && allowSet.has("exec") || normalized === "gateway_process" && (allowSet.has("exec") || allowSet.has("process")) || normalized === "node_exec" && allowSet.has("exec");
+function mapMessageMediaValues(args, mapValue) {
+	const mapped = { ...args };
+	for (const key of MESSAGE_MEDIA_KEYS) {
+		const value = mapped[key];
+		if (typeof value === "string") mapped[key] = mapValue(value);
+	}
+	for (const key of MESSAGE_MEDIA_ARRAY_KEYS) {
+		const value = mapped[key];
+		if (Array.isArray(value)) mapped[key] = value.map((entry) => typeof entry === "string" ? mapValue(entry) : entry);
+	}
+	if (Array.isArray(mapped.attachments)) mapped.attachments = mapped.attachments.map((attachment) => {
+		if (!attachment || typeof attachment !== "object" || Array.isArray(attachment)) return attachment;
+		const record = { ...attachment };
+		for (const key of ATTACHMENT_MEDIA_KEYS) {
+			const value = record[key];
+			if (typeof value === "string") record[key] = mapValue(value);
+		}
+		return record;
 	});
-}
-/** Detects the wildcard allowlist marker after Codex tool-name normalization. */
-function hasWildcardCodexToolsAllow(toolsAllow) {
-	return toolsAllow.some((name) => normalizeCodexDynamicToolName(name) === "*");
-}
-/** Forces message delivery through the message tool when the source channel requires it. */
-function shouldForceMessageTool(params) {
-	return params.disableMessageTool !== true && params.sourceReplyDeliveryMode === "message_tool_only";
+	return mapped;
 }
 //#endregion
 //#region extensions/codex/src/app-server/sandbox-exec-server-node-relay.ts
@@ -1140,7 +1119,7 @@ const CODEX_NODE_HTTP_CREDENTIAL_FIELD_NAME_PATTERN = /^(?:(?:[a-z\d]+_)*(?:toke
 const nodeExecServerTextDecoder = new TextDecoder("utf-8", { fatal: true });
 /** Produces the bounded, redacted terminal failure shared by pending and claimed node leases. */
 function createCodexNodeExecServerDisconnectError(reason, cause) {
-	const detail = cause === void 0 ? "" : `: ${truncateUtf16Safe(redactSensitiveText(formatErrorMessage$1(cause), { mode: "tools" }), CODEX_NODE_EXEC_SERVER_MAX_FAILURE_DETAIL_CHARS)}`;
+	const detail = cause === void 0 ? "" : `: ${truncateUtf16Safe(redactSensitiveText(formatErrorMessage$2(cause), { mode: "tools" }), CODEX_NODE_EXEC_SERVER_MAX_FAILURE_DETAIL_CHARS)}`;
 	return /* @__PURE__ */ new Error(`Codex execution node disconnected; start a fresh attempt. (${reason}${detail})`);
 }
 /** Relays one authorized, single-use Codex exec-server channel without interpreting its protocol. */
@@ -1434,6 +1413,10 @@ const sandboxExecServerRegistry = {
 	}
 };
 //#endregion
+//#region extensions/codex/src/app-server/sandbox-exec-server.websocket.ts
+const require = createRequire(import.meta.url);
+const websocket = require(path.join(path.dirname(require.resolve("ws/package.json")), "index.js"));
+//#endregion
 //#region extensions/codex/src/app-server/sandbox-exec-server/json-rpc.ts
 /** JSON-RPC error code used when a sandbox filesystem resource does not exist. */
 const JSON_RPC_NOT_FOUND = -32004;
@@ -3112,7 +3095,7 @@ async function startOpenClawExecServer(sandbox) {
 			fsBridge
 		};
 	}
-	const server = new WebSocketServer({
+	const server = new websocket.WebSocketServer({
 		host: "127.0.0.1",
 		port: 0,
 		maxPayload: connection.kind === "node" ? CODEX_NODE_EXEC_SERVER_MAX_MESSAGE_BYTES : CODEX_SANDBOX_EXEC_SERVER_MAX_INBOUND_MESSAGE_BYTES
@@ -4686,6 +4669,7 @@ const CODEX_DYNAMIC_TOOL_NAME_MAX_CHARS = 128;
 const CODEX_DYNAMIC_TOOL_NAME_PATTERN = /^[a-zA-Z0-9_-]+$/u;
 const ALWAYS_DIRECT_DYNAMIC_TOOL_NAMES = /* @__PURE__ */ new Set([
 	"agents_list",
+	"agents_wait",
 	"progress_card",
 	"sessions_spawn",
 	"sessions_yield"
@@ -4864,6 +4848,34 @@ function readCodexDynamicToolDescriptor(tool, toolIndex) {
 	};
 }
 //#endregion
+//#region extensions/codex/src/app-server/dynamic-tool-availability.ts
+/** Prepare the actual executable set, then reproject only changed owner definitions. */
+function finalizeCodexToolAvailability(entries) {
+	const snapshots = entries.map((entry) => ({
+		entry,
+		parameters: entry.tool.parameters,
+		description: entry.tool.description
+	}));
+	const preparedNames = /* @__PURE__ */ new Set();
+	finalizeAgentToolAvailability(entries.map((entry) => entry.tool), { onPrepared: (tool) => preparedNames.add(tool.name) });
+	const tools = [];
+	const quarantinedTools = [];
+	for (const { entry, parameters, description } of snapshots) {
+		if (entry.tool.parameters === parameters && entry.tool.description === description) {
+			tools.push(entry);
+			continue;
+		}
+		const projected = projectCodexDynamicTools([entry.tool]);
+		tools.push(...projected.tools);
+		quarantinedTools.push(...projected.quarantinedTools);
+	}
+	return {
+		tools,
+		quarantinedTools,
+		preparedNames
+	};
+}
+//#endregion
 //#region extensions/codex/src/app-server/dynamic-tools.ts
 /**
 * Bridges OpenClaw runtime tools into Codex app-server dynamic tool specs and
@@ -5068,18 +5080,21 @@ function createCodexDynamicToolBridge(params) {
 	const registeredProjection = params.registeredTools ? projectCodexDynamicTools(params.registeredTools) : availableProjection;
 	const inheritedSpecs = params.registeredSpecs ? structuredClone([...params.registeredSpecs]) : void 0;
 	const inheritedNames = inheritedSpecs ? new Set(flattenCodexDynamicToolFunctions(inheritedSpecs).map((tool) => tool.name)) : void 0;
-	const availableTools = availableProjection.tools.filter((entry) => !inheritedNames || inheritedNames.has(entry.name));
-	const quarantinedAvailableToolNames = new Set(availableProjection.quarantinedTools.map((tool) => tool.tool));
-	const registeredSpecTools = (params.registeredTools ? registeredProjection.tools : availableTools).filter((entry) => !quarantinedAvailableToolNames.has(entry.name));
+	const registrationNames = inheritedNames ?? new Set(registeredProjection.tools.map((entry) => entry.name));
+	const finalized = finalizeCodexToolAvailability(availableProjection.tools.filter((entry) => registrationNames.has(entry.name)));
+	const availableTools = finalized.tools;
+	availableProjection.quarantinedTools.push(...finalized.quarantinedTools);
 	const toolMap = new Map(availableTools.map((entry) => [entry.name, entry]));
+	const quarantinedAvailableToolNames = new Set(availableProjection.quarantinedTools.map((tool) => tool.tool));
+	const registeredSpecTools = (params.registeredTools ? registeredProjection.tools : availableTools).filter((entry) => !quarantinedAvailableToolNames.has(entry.name)).map((entry) => finalized.preparedNames.has(entry.name) ? toolMap.get(entry.name) ?? entry : entry);
 	const registeredToolNames = inheritedNames ?? new Set(registeredSpecTools.map((entry) => entry.name));
 	const quarantinedTools = dedupeQuarantinedDynamicTools([...availableProjection.quarantinedTools, ...registeredProjection.quarantinedTools]);
-	warnQuarantinedDynamicTools({
+	reportQuarantinedDynamicTools({
 		tools: quarantinedTools,
 		availableToolCount: availableTools.length,
-		registeredToolCount: registeredSpecTools.length
+		registeredToolCount: registeredSpecTools.length,
+		hookContext: params.hookContext
 	});
-	emitQuarantinedDynamicToolDiagnostics(quarantinedTools, params.hookContext);
 	const telemetry = {
 		didSendViaMessagingTool: false,
 		didDeliverSourceReplyViaMessageTool: false,
@@ -5222,6 +5237,7 @@ function createCodexDynamicToolBridge(params) {
 				}));
 				const rawResult = await Reflect.apply(tool.execute, tool, executionArgs);
 				captureExecutionBoundary();
+				if (toolName === "message" && asOptionalRecord(asOptionalRecord(rawResult.details)?.messageDelivery)?.sourceReplyDelivered === true) telemetry.sourceReplyDelivered = true;
 				const telemetryRawResult = sanitizeToolResult(rawResult);
 				const rawIsError = isToolResultError(rawResult);
 				const rawResultFailureKind = resolveToolResultFailureKind(rawResult);
@@ -5330,6 +5346,7 @@ function createCodexDynamicToolBridge(params) {
 				const asyncStarted = isAsyncStartedToolResult(rawResult) || isAsyncStartedToolResult(result);
 				withDynamicToolAsyncStarted(response, asyncStarted);
 				const replaySafe = executionPrevented || !asyncStarted && isReplaySafeToolInstance(toolEntry.tool) && isReplaySafeToolCall(toolName, executedArgs);
+				copyInternalToolResultState(rawResult, response);
 				return withDynamicToolExecutionState(response, {
 					executedArguments: executedArgs,
 					executionStarted: didStartExecution && !executionPrevented,
@@ -5386,19 +5403,36 @@ function createCodexDynamicToolBridge(params) {
 	};
 }
 function projectCodexExecutableDynamicToolSurface(tools, hookContext) {
-	const projected = projectCodexDynamicTools(tools);
-	const wrapped = wrapProjectedCodexDynamicTools(projected.tools, hookContext);
+	const { tools: projectedTools, quarantinedTools } = projectCodexDynamicTools(tools);
+	const wrappedTools = [];
+	for (const entry of projectedTools) try {
+		if (isToolWrappedWithBeforeToolCallHook(entry.tool)) {
+			setBeforeToolCallDiagnosticsEnabled(entry.tool, false);
+			wrappedTools.push(entry);
+			continue;
+		}
+		wrappedTools.push({
+			...entry,
+			tool: wrapToolWithBeforeToolCallHook(entry.tool, hookContext, { emitDiagnostics: false })
+		});
+	} catch {
+		quarantinedTools.push({
+			tool: entry.name,
+			violations: [`${entry.name} could not be wrapped for before-tool-call hooks`]
+		});
+	}
 	return {
-		tools: wrapped.tools,
-		quarantinedTools: dedupeQuarantinedDynamicTools([...projected.quarantinedTools, ...wrapped.quarantinedTools])
+		tools: wrappedTools,
+		quarantinedTools: dedupeQuarantinedDynamicTools(quarantinedTools)
 	};
 }
 /** Applies the exact schema and hook-wrapper projection used by the executable Codex bridge. */
 function projectCodexExecutableDynamicTools(params) {
 	const projected = projectCodexExecutableDynamicToolSurface(params.tools, params.hookContext);
+	const finalized = finalizeCodexToolAvailability(projected.tools);
 	return {
-		availableTools: projected.tools.map((entry) => entry.tool),
-		quarantinedTools: projected.quarantinedTools
+		availableTools: finalized.tools.map((entry) => entry.tool),
+		quarantinedTools: [...projected.quarantinedTools, ...finalized.quarantinedTools]
 	};
 }
 function notifyAgentToolResult(observer, toolName, result, isError) {
@@ -5409,7 +5443,8 @@ function notifyAgentToolResult(observer, toolName, result, isError) {
 			isError
 		});
 	} catch (error) {
-		embeddedAgentLog.warn(`onAgentToolResult handler failed: tool=${toolName} error=${String(error)}`);
+		const message = formatToolExecutionErrorMessage(error, "Unknown error");
+		embeddedAgentLog.warn(`onAgentToolResult handler failed: tool=${toolName} error=${message}`);
 	}
 }
 function failedToolResult(message, status = "failed") {
@@ -5424,50 +5459,22 @@ function failedToolResult(message, status = "failed") {
 		}
 	};
 }
-function wrapProjectedCodexDynamicTools(tools, hookContext) {
-	const wrappedTools = [];
-	const quarantinedTools = [];
-	for (const entry of tools) try {
-		if (isToolWrappedWithBeforeToolCallHook(entry.tool)) {
-			setBeforeToolCallDiagnosticsEnabled(entry.tool, false);
-			wrappedTools.push(entry);
-			continue;
-		}
-		wrappedTools.push({
-			...entry,
-			tool: wrapToolWithBeforeToolCallHook(entry.tool, hookContext, { emitDiagnostics: false })
-		});
-	} catch {
-		quarantinedTools.push({
-			tool: entry.name,
-			violations: [`${entry.name} could not be wrapped for before-tool-call hooks`]
-		});
-	}
-	return {
-		tools: wrappedTools,
-		quarantinedTools
-	};
-}
-function warnQuarantinedDynamicTools(params) {
+function reportQuarantinedDynamicTools(params) {
 	if (params.tools.length === 0) return;
-	const unique = /* @__PURE__ */ new Map();
-	for (const tool of params.tools) unique.set(tool.tool, tool.violations);
-	embeddedAgentLog.warn(`codex app-server quarantined ${unique.size} unsupported dynamic tool ${unique.size === 1 ? "definition" : "definitions"}: ${[...unique.keys()].join(", ")}; retained ${params.availableToolCount} available and ${params.registeredToolCount} registered tools`, {
-		tools: [...unique.entries()].map(([tool, violations]) => ({
+	embeddedAgentLog.warn(`codex app-server quarantined ${params.tools.length} unsupported dynamic tool ${params.tools.length === 1 ? "definition" : "definitions"}: ${params.tools.map((tool) => tool.tool).join(", ")}; retained ${params.availableToolCount} available and ${params.registeredToolCount} registered tools`, {
+		tools: params.tools.map(({ tool, violations }) => ({
 			tool,
 			violations
 		})),
 		availableToolCount: params.availableToolCount,
 		registeredToolCount: params.registeredToolCount
 	});
-}
-function emitQuarantinedDynamicToolDiagnostics(tools, ctx) {
-	for (const tool of tools) emitTrustedDiagnosticEvent({
+	for (const tool of params.tools) emitTrustedDiagnosticEvent({
 		type: "tool.execution.blocked",
-		agentId: ctx?.agentId,
-		runId: ctx?.runId,
-		sessionId: ctx?.sessionId,
-		sessionKey: ctx?.sessionKey,
+		agentId: params.hookContext?.agentId,
+		runId: params.hookContext?.runId,
+		sessionId: params.hookContext?.sessionId,
+		sessionKey: params.hookContext?.sessionKey,
 		toolName: tool.tool,
 		deniedReason: "unsupported_tool_schema",
 		reason: tool.violations.join(", ")
@@ -5644,7 +5651,36 @@ function withDynamicToolAsyncStarted(response, asyncStarted) {
 function normalizeToolResultMaxChars(maxChars) {
 	return typeof maxChars === "number" && Number.isFinite(maxChars) && maxChars > 0 ? Math.floor(maxChars) : DEFAULT_MAX_LIVE_TOOL_RESULT_CHARS;
 }
-function convertToolContents(content, toolResultMaxChars = DEFAULT_MAX_LIVE_TOOL_RESULT_CHARS) {
+function sanitizeToolTextRuns(rawContent) {
+	const content = [];
+	for (let index = 0; index < rawContent.length;) {
+		const item = rawContent[index];
+		if (item.type !== "text") {
+			content.push(item);
+			index += 1;
+			continue;
+		}
+		const textRun = [];
+		while (index < rawContent.length) {
+			const next = rawContent[index];
+			if (next.type !== "text") break;
+			textRun.push(next);
+			index += 1;
+		}
+		const sanitizedText = sanitizeToolResult(textRun.map((entry) => entry.text).join(""));
+		let offset = 0;
+		content.push(...textRun.map((entry, runIndex) => {
+			const targetEnd = runIndex === textRun.length - 1 ? sanitizedText.length : Math.min(sanitizedText.length, offset + entry.text.length);
+			const text = sliceUtf16Safe(sanitizedText, offset, targetEnd);
+			const sanitized = Object.assign({}, entry, { text });
+			offset += text.length;
+			return sanitized;
+		}));
+	}
+	return content;
+}
+function convertToolContents(rawContent, toolResultMaxChars = DEFAULT_MAX_LIVE_TOOL_RESULT_CHARS) {
+	const content = sanitizeToolTextRuns(rawContent);
 	const maxChars = normalizeToolResultMaxChars(toolResultMaxChars);
 	const totalTextChars = content.reduce((total, item) => total + (item.type === "text" ? item.text.length : 0), 0);
 	if (content.reduce((total, item) => total + (item.type === "text" ? estimateToolResultTextChars(item.text) : 0), 0) <= maxChars) return content.flatMap(convertToolContent);
@@ -5758,4 +5794,4 @@ function isCronAddAction(args) {
 	return typeof action === "string" && action.trim().toLowerCase() === "add";
 }
 //#endregion
-export { filterCodexVisionTools as C, shouldWarnCodexDynamicToolBuildStageSummary as S, CodexNativeToolLifecycleProjector as T, resolveCodexMessageToolProvider as _, emitDynamicToolStartedDiagnostic as a, shouldEnableCodexAppServerNativeToolSurface as b, ensureCodexSandboxExecServerEnvironment as c, createCodexDynamicToolBuildStageTracker as d, disableCodexPluginThreadConfig as f, resolveCodexExternalSandboxPolicyForOpenClawSandbox as g, resolveCodexAppServerHookChannelId as h, emitDynamicToolErrorDiagnostic as i, releaseCodexSandboxExecServerEnvironment as l, resolveCodexAppServerExecutionCwd as m, projectCodexExecutableDynamicTools as n, emitDynamicToolTerminalDiagnostic as o, formatCodexDynamicToolBuildStageSummary as p, routeCodexAppServerElicitationRequest as r, handleCodexAppServerApprovalRequest as s, createCodexDynamicToolBridge as t, buildDynamicTools as u, resolveCodexNodePlacementToolConstructionPlan as v, readBoundedCodexRemoteWorkspaceFile as w, shouldRequireCodexSandboxExecServerEnvironment as x, resolveCodexSandboxEnvironmentSelection as y };
+export { shouldRequireCodexSandboxExecServerEnvironment as C, shouldEnableCodexAppServerNativeToolSurface as S, filterCodexVisionTools as T, resolveCodexAppServerHookChannelId as _, emitDynamicToolStartedDiagnostic as a, resolveCodexNodePlacementToolConstructionPlan as b, ensureCodexSandboxExecServerEnvironment as c, CodexNativeToolLifecycleProjector as d, buildDynamicTools as f, resolveCodexAppServerExecutionCwd as g, formatCodexDynamicToolBuildStageSummary as h, emitDynamicToolErrorDiagnostic as i, releaseCodexSandboxExecServerEnvironment as l, disableCodexPluginThreadConfig as m, projectCodexExecutableDynamicTools as n, emitDynamicToolTerminalDiagnostic as o, createCodexDynamicToolBuildStageTracker as p, routeCodexAppServerElicitationRequest as r, handleCodexAppServerApprovalRequest as s, createCodexDynamicToolBridge as t, readBoundedCodexRemoteWorkspaceFile as u, resolveCodexExternalSandboxPolicyForOpenClawSandbox as v, shouldWarnCodexDynamicToolBuildStageSummary as w, resolveCodexSandboxEnvironmentSelection as x, resolveCodexMessageToolProvider as y };