@openclaw/codex 2026.9.1 → 2026.9.3

package/dist/{isolated-completion-kg9kv4iH.js → isolated-completion-DHBefrzg.js}

@@ -1,26 +1,14 @@
-import { $t as isJsonObject, Wt as resolveCodexAppServerPreparedAuthHandoff } from "./shared-client-DxcfF9KX.js";
-import { E as readCodexPluginConfig, r as resolveCodexAppServerHomeScope } from "./config-BhmfC1s6.js";
-import { t as runBoundedCodexAppServerTurn } from "./bounded-turn-wzJrwKKe.js";
-import { a as createAttributedCodexAssistantMessage } from "./event-projector-assistant-message-DHRFXKbS.js";
+import { i as resolveCodexAppServerHomeScope } from "./config-options-jnIFvwxD.js";
+import { x as readCodexPluginConfig } from "./protocol-CAAcVIKF.js";
+import { g as assertCodexPassiveTurnItems } from "./client-BEKu4yDx.js";
+import "./config-JDfTI4VI.js";
+import { Z as resolveCodexAppServerPreparedAuthHandoff } from "./shared-client-CVhez2Uo.js";
+import { runBoundedCodexAppServerTurn } from "./bounded-turn-lRpmZHFv.js";
+import { a as createAttributedCodexAssistantMessage } from "./event-projector-assistant-message-BmBM4qBV.js";
 //#region extensions/codex/src/app-server/isolated-completion.ts
-const ISOLATED_PASSIVE_ITEM_TYPES = /* @__PURE__ */ new Set(["agentMessage", "reasoning"]);
-function assertIsolatedCompletionItems(items, prompt) {
-	let promptEchoSeen = false;
-	for (const item of items) {
-		if (ISOLATED_PASSIVE_ITEM_TYPES.has(item.type)) continue;
-		if (item.type === "userMessage" && !promptEchoSeen) {
-			const content = Array.isArray(item.content) ? item.content : [];
-			const input = content[0];
-			if (content.length === 1 && isJsonObject(input) && input.type === "text" && input.text === prompt) {
-				promptEchoSeen = true;
-				continue;
-			}
-		}
-		throw new Error(`Codex isolated completion returned unexpected native item: ${item.type}`);
-	}
-}
 /** Runs prompt-only Codex inference on an ephemeral, ring-zero native thread. */
 async function runCodexIsolatedCompletion(params, options) {
+	params.assertCurrent?.();
 	const authorization = params.authorization;
 	if (authorization.owner !== "harness") throw new Error("Codex native isolated completion requires harness-owned authorization.");
 	const pluginConfig = readCodexPluginConfig(options.pluginConfig);
@@ -35,6 +23,7 @@ async function runCodexIsolatedCompletion(params, options) {
 		subscriptionProfileRequiredError: "Prepared Codex subscription route requires a scoped native OAuth or token profile.",
 		subscriptionProfileUnusableError: `Prepared Codex auth profile "${authorization.plan.forwardedAuthProfileId}" is unusable.`
 	});
+	params.assertCurrent?.();
 	const authSelection = authHandoff.preparedAuth ? { preparedAuth: authHandoff.preparedAuth } : { profile: authHandoff.authProfileId };
 	const result = await runBoundedCodexAppServerTurn({
 		config: params.config,
@@ -46,6 +35,7 @@ async function runCodexIsolatedCompletion(params, options) {
 		authRequirement,
 		timeoutMs: params.timeoutMs,
 		signal: params.abortSignal,
+		assertCurrent: params.assertCurrent,
 		agentDir: params.agentDir,
 		authProfileStore: authorization.authProfileStore,
 		options,
@@ -60,7 +50,8 @@ async function runCodexIsolatedCompletion(params, options) {
 		isolation: "configured-transport",
 		requireNoExternalCapabilities: true
 	});
-	assertIsolatedCompletionItems(result.items, params.prompt);
+	params.assertCurrent?.();
+	assertCodexPassiveTurnItems(result.items, params.prompt, "isolated completion");
 	return { assistant: createAttributedCodexAssistantMessage({
 		api: "openai-chatgpt-responses",
 		provider: params.provider,

package/dist/{managed-binary-4-Vjz5GH.js → managed-binary-DrjjRRUD.js}

@@ -1,9 +1,10 @@
+import { n as MANAGED_CODEX_APP_SERVER_PACKAGE } from "./version-omm6IPI3.js";
 import { createRequire } from "node:module";
-import { access } from "node:fs/promises";
+import { constants, existsSync, realpathSync } from "node:fs";
 import path from "node:path";
-import { constants, existsSync, readFileSync, realpathSync } from "node:fs";
-import { fileURLToPath } from "node:url";
+import { access } from "node:fs/promises";
 import { expectDefined } from "openclaw/plugin-sdk/expect-runtime";
+import { resolveGlobalSingleton } from "openclaw/plugin-sdk/global-singleton";
 //#region extensions/codex/src/app-server/desktop-app-paths.ts
 /** Shared path candidates for Codex's macOS desktop app bundle. */
 const MACOS_DESKTOP_CODEX_APP_PATH_CANDIDATES = [{
@@ -41,34 +42,24 @@ function resolveFirstExistingMacOSDesktopCodexBundledMarketplacePath(params = {}
 	return candidates.find((candidate) => pathExists(candidate));
 }
 //#endregion
-//#region extensions/codex/src/app-server/version.ts
-/**
-* Version and package pins for the managed Codex app-server runtime.
-*/
-/** Exact Codex app-server version shipped by the OpenClaw Codex bridge. */
-const CODEX_APP_SERVER_VERSION = "0.152.1";
-/** Inclusive runtime compatibility floor for external app-server binaries. */
-const MIN_SUPPORTED_CODEX_APP_SERVER_VERSION = "0.149.0";
-/** npm package name for the managed Codex app-server binary. */
-const MANAGED_CODEX_APP_SERVER_PACKAGE = "@openai/codex";
-//#endregion
 //#region extensions/codex/src/app-server/managed-binary.ts
 /**
 * Resolves the managed Codex app-server binary shipped with or installed beside
 * the Codex plugin before stdio startup.
 */
-const CODEX_PLUGIN_ROOT = resolveDefaultCodexPluginRoot(path.dirname(fileURLToPath(import.meta.url)));
-let registeredCodexPluginRoot;
+const registeredCodexPlugin = resolveGlobalSingleton(Symbol.for("openclaw.codexManagedPluginRoot"), () => ({}));
 /** Records the process-stable plugin root prepared by OpenClaw's plugin loader. */
 function setManagedCodexPluginRoot(pluginRoot) {
-	registeredCodexPluginRoot = pluginRoot;
+	registeredCodexPlugin.root = pluginRoot;
 }
 /** Rewrites managed stdio start options to point at an executable Codex binary path. */
 async function resolveManagedCodexAppServerStartOptions(startOptions, options = {}) {
 	if (startOptions.transport !== "stdio" || startOptions.commandSource !== "managed") return startOptions;
+	const pluginRoot = options.pluginRoot ?? registeredCodexPlugin.root;
+	if (!pluginRoot) throw new Error("Codex plugin root is unavailable. Load the Codex plugin before starting its managed app-server.");
 	const platform = options.platform ?? process.platform;
 	const commandPaths = await findManagedCodexAppServerCommandPaths({
-		candidateCommandPaths: resolveManagedCodexAppServerCommandCandidates(options.pluginRoot ?? registeredCodexPluginRoot ?? CODEX_PLUGIN_ROOT, platform, startOptions.managedCommandOrder ?? "package-first"),
+		candidateCommandPaths: resolveManagedCodexAppServerCommandCandidates(pluginRoot, platform, startOptions.managedCommandOrder ?? "package-first"),
 		pathExists: options.pathExists ?? commandPathExists,
 		platform
 	});
@@ -158,76 +149,18 @@ function resolvePackageJsonFromRoot(packageName, root) {
 	}
 }
 function resolveManagedCodexAppServerCommandCandidates(pluginRoot, platform, managedCommandOrder) {
-	const pathApi = pathForPlatform(platform);
-	const commandName = platform === "win32" ? "codex.cmd" : "codex";
-	const roots = resolveManagedCodexAppServerCandidateRoots(pluginRoot, platform);
-	const packageCommandPaths = [...roots.map((root) => pathApi.join(root, "node_modules", ".bin", commandName)), ...resolveManagedCodexPackageBinCandidates(roots, platform)];
-	const desktopCommandPaths = resolveDesktopCodexAppServerCommandCandidates(platform);
-	const orderedCommandPaths = managedCommandOrder === "desktop-first" ? [...desktopCommandPaths, ...packageCommandPaths] : [...packageCommandPaths, ...desktopCommandPaths];
-	return [...new Set(orderedCommandPaths)];
-}
-function resolveDesktopCodexAppServerCommandCandidates(platform) {
-	return resolveMacOSDesktopCodexAppServerCommandCandidates(platform);
-}
-function resolveDefaultCodexPluginRoot(moduleDir) {
-	const moduleBaseName = path.basename(moduleDir);
-	if (moduleBaseName === "dist" || moduleBaseName === "dist-runtime") return path.dirname(moduleDir);
-	return path.resolve(moduleDir, "..", "..");
-}
-function resolveManagedCodexAppServerCandidateRoots(pluginRoot, platform) {
-	const pathApi = pathForPlatform(platform);
-	const directRoots = [
-		pluginRoot,
-		pathApi.dirname(pluginRoot),
-		pathApi.dirname(pathApi.dirname(pluginRoot)),
-		isDistExtensionRoot(pluginRoot, platform) ? pathApi.dirname(pathApi.dirname(pathApi.dirname(pluginRoot))) : null
-	].filter((root) => Boolean(root));
-	return [.../* @__PURE__ */ new Set([...directRoots, ...resolveNearestNodeModulesProjectRoots(directRoots, platform)])];
-}
-function resolveNearestNodeModulesProjectRoots(roots, platform) {
-	const pathApi = pathForPlatform(platform);
-	const projectRoots = [];
-	for (const root of roots) {
-		let current = pathApi.resolve(root);
-		while (true) {
-			if (pathApi.basename(current) === "node_modules") {
-				projectRoots.push(pathApi.dirname(current));
-				break;
-			}
-			const parent = pathApi.dirname(current);
-			if (parent === current) break;
-			current = parent;
-		}
-	}
-	return projectRoots;
-}
-function resolveManagedCodexPackageBinCandidates(roots, platform) {
-	if (platform === "win32") return [];
-	const candidates = [];
-	for (const root of roots) {
-		const candidate = resolveManagedCodexPackageBinCandidate(root);
-		if (candidate) candidates.push(candidate);
-	}
-	return candidates;
+	const packageCommand = resolveManagedCodexPackageEntrypoint(pluginRoot);
+	const packageCommandPaths = packageCommand ? [packageCommand] : [];
+	const desktopCommandPaths = resolveMacOSDesktopCodexAppServerCommandCandidates(platform);
+	return managedCommandOrder === "desktop-first" ? [...desktopCommandPaths, ...packageCommandPaths] : [...packageCommandPaths, ...desktopCommandPaths];
 }
-function resolveManagedCodexPackageBinCandidate(root) {
+function resolveManagedCodexPackageEntrypoint(pluginRoot) {
 	try {
-		const packageJsonPath = createRequire(path.join(root, "package.json")).resolve(`${MANAGED_CODEX_APP_SERVER_PACKAGE}/package.json`);
-		const packageRoot = path.dirname(packageJsonPath);
-		const packageJson = JSON.parse(readFileSync(packageJsonPath, "utf8"));
-		const packageBin = packageJson.bin && typeof packageJson.bin === "object" ? packageJson.bin : void 0;
-		const binPath = typeof packageJson.bin === "string" ? packageJson.bin : typeof packageBin?.codex === "string" ? packageBin.codex : null;
-		return binPath ? path.resolve(packageRoot, binPath) : null;
+		return createRequire(path.join(pluginRoot, "package.json")).resolve(`${MANAGED_CODEX_APP_SERVER_PACKAGE}/bin/codex.js`);
 	} catch {
-		return null;
+		return;
 	}
 }
-function isDistExtensionRoot(pluginRoot, platform) {
-	const pathApi = pathForPlatform(platform);
-	const extensionsDir = pathApi.dirname(pluginRoot);
-	const distDir = pathApi.dirname(extensionsDir);
-	return pathApi.basename(extensionsDir) === "extensions" && (pathApi.basename(distDir) === "dist" || pathApi.basename(distDir) === "dist-runtime");
-}
 function pathForPlatform(platform) {
 	return platform === "win32" ? path.win32 : path.posix;
 }
@@ -250,4 +183,4 @@ async function commandPathExists(filePath, platform) {
 	}
 }
 //#endregion
-export { setManagedCodexPluginRoot as a, resolveFirstExistingMacOSDesktopCodexBundledMarketplacePath as c, resolveMacOSDesktopCodexComputerUseServiceAppCandidates as d, resolvePackagedCodexNativeCommand as i, resolveMacOSDesktopCodexAppPathCandidates as l, resolveManagedCodexAppServerStartOptions as n, CODEX_APP_SERVER_VERSION as o, resolveManagedCodexNativeCommand as r, MIN_SUPPORTED_CODEX_APP_SERVER_VERSION as s, isManagedCodexDesktopCommand as t, resolveMacOSDesktopCodexBundledMarketplaceCandidates as u };
+export { setManagedCodexPluginRoot as a, resolveMacOSDesktopCodexBundledMarketplaceCandidates as c, resolvePackagedCodexNativeCommand as i, resolveMacOSDesktopCodexComputerUseServiceAppCandidates as l, resolveManagedCodexAppServerStartOptions as n, resolveFirstExistingMacOSDesktopCodexBundledMarketplacePath as o, resolveManagedCodexNativeCommand as r, resolveMacOSDesktopCodexAppPathCandidates as s, isManagedCodexDesktopCommand as t };

package/dist/managed-thread-store-D1t5jh3G.js

@@ -0,0 +1,66 @@
+import { createHash } from "node:crypto";
+import { embeddedAgentLog } from "openclaw/plugin-sdk/agent-harness-registration";
+import { z } from "zod";
+//#region extensions/codex/src/app-server/managed-thread-store.ts
+const CODEX_MANAGED_THREAD_NAMESPACE = "app-server-managed-threads";
+const CODEX_MANAGED_THREAD_MAX_ENTRIES = 2e4;
+const managedThreadSchema = z.object({
+	version: z.literal(1),
+	kind: z.literal("managed-thread"),
+	sourceHomeId: z.string().min(1),
+	threadId: z.string().min(1),
+	rolloutPath: z.string().min(1).optional()
+});
+async function markStartedCodexManagedThread(store, params) {
+	if (!store) return;
+	try {
+		await store.mark({
+			sourceHomeId: params.sourceHomeId,
+			threadId: params.threadId,
+			...params.rolloutPath ? { rolloutPath: params.rolloutPath } : {}
+		});
+	} catch (error) {
+		embeddedAgentLog.warn("failed to record Codex managed thread ownership", { error });
+	}
+}
+function managedThreadStoreKey(sourceHomeId, threadId) {
+	return `sha256:${createHash("sha256").update("openclaw:codex-managed-thread:v1\0").update(sourceHomeId).update("\0").update(threadId).digest("hex")}`;
+}
+/** Durable ownership index for Codex threads created by OpenClaw. */
+function createCodexManagedThreadStore(state) {
+	return {
+		async has(sourceHomeId, threadId) {
+			const parsed = managedThreadSchema.safeParse(state.lookup(managedThreadStoreKey(sourceHomeId, threadId)));
+			return parsed.success && parsed.data.sourceHomeId === sourceHomeId && parsed.data.threadId === threadId;
+		},
+		async mark(params) {
+			try {
+				const value = managedThreadSchema.parse({
+					version: 1,
+					kind: "managed-thread",
+					sourceHomeId: params.sourceHomeId.trim(),
+					threadId: params.threadId.trim(),
+					...params.rolloutPath?.trim() ? { rolloutPath: params.rolloutPath.trim() } : {}
+				});
+				state.registerIfAbsent(managedThreadStoreKey(value.sourceHomeId, value.threadId), value);
+				return true;
+			} catch (error) {
+				embeddedAgentLog.warn("failed to record Codex managed thread ownership", { error });
+				return false;
+			}
+		},
+		async snapshot() {
+			const byHome = /* @__PURE__ */ new Map();
+			for (const entry of state.entries()) {
+				const parsed = managedThreadSchema.safeParse(entry.value);
+				if (!parsed.success) continue;
+				const ids = byHome.get(parsed.data.sourceHomeId) ?? /* @__PURE__ */ new Set();
+				ids.add(parsed.data.threadId);
+				byHome.set(parsed.data.sourceHomeId, ids);
+			}
+			return byHome;
+		}
+	};
+}
+//#endregion
+export { markStartedCodexManagedThread as i, CODEX_MANAGED_THREAD_NAMESPACE as n, createCodexManagedThreadStore as r, CODEX_MANAGED_THREAD_MAX_ENTRIES as t };

package/dist/media-understanding-provider.js

@@ -1,4 +1,3 @@
-import { t as runBoundedCodexAppServerTurn } from "./bounded-turn-wzJrwKKe.js";
 import { isRecord } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { validateJsonSchemaValue } from "openclaw/plugin-sdk/json-schema-runtime";
 //#region extensions/codex/media-understanding-provider.ts
@@ -44,6 +43,8 @@ async function describeCodexImages(req, options) {
 	const model = req.model.trim();
 	if (!model) throw new Error("Codex image understanding requires model id.");
 	req.signal?.throwIfAborted();
+	const { runBoundedCodexAppServerTurn } = await import("./bounded-turn-lRpmZHFv.js");
+	req.signal?.throwIfAborted();
 	const { text } = await runBoundedCodexAppServerTurn({
 		config: req.cfg,
 		model: {
@@ -82,6 +83,8 @@ async function extractCodexStructured(req, options) {
 	if (req.input.length === 0) throw new Error("Codex structured extraction requires at least one input.");
 	if (!req.input.some((entry) => entry.type === "image")) throw new Error("Codex structured extraction requires at least one image input.");
 	req.signal?.throwIfAborted();
+	const { runBoundedCodexAppServerTurn } = await import("./bounded-turn-lRpmZHFv.js");
+	req.signal?.throwIfAborted();
 	const { text } = await runBoundedCodexAppServerTurn({
 		config: req.cfg,
 		model: {

package/dist/{model-catalog-CUM68Hkl.js → model-catalog-B_6M04Wo.js}

@@ -1,8 +1,9 @@
-import { r as buildCodexRuntimeModelParams } from "./harness-DXVZ5II5.js";
-import { $t as isJsonObject, r as captureSharedCodexAppServerCatalogLifetime } from "./shared-client-DxcfF9KX.js";
-import { E as readCodexPluginConfig, i as resolveCodexAppServerRuntimeOptions } from "./config-BhmfC1s6.js";
-import { t as listAllCodexAppServerModels } from "./models-sYnEc0gd.js";
-import { o as withCodexAppServerJsonClient } from "./request-DYAI5FQE.js";
+import { r as buildCodexRuntimeModelParams } from "./harness-FR6eQgyO.js";
+import { o as isJsonObject, x as readCodexPluginConfig } from "./protocol-CAAcVIKF.js";
+import { o as withCodexAppServerJsonClient } from "./request-CGvGOpeR.js";
+import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-BWf6JLWG.js";
+import { r as captureSharedCodexAppServerCatalogLifetime } from "./shared-client-CVhez2Uo.js";
+import { t as listAllCodexAppServerModels } from "./models-P9k2qAof.js";
 //#region extensions/codex/src/app-server/model-catalog.ts
 const DEFAULT_MODEL_DISCOVERY_TIMEOUT_MS = 2500;
 const INPUT_TYPES = /* @__PURE__ */ new Set([

package/dist/{models-sYnEc0gd.js → models-P9k2qAof.js}

@@ -1,4 +1,4 @@
-import { Y as assertCodexModelListResponse } from "./shared-client-DxcfF9KX.js";
+import { h as assertCodexModelListResponse } from "./client-BEKu4yDx.js";
 import { normalizeOptionalString, uniqueStrings } from "openclaw/plugin-sdk/string-coerce-runtime";
 //#region extensions/codex/src/app-server/models.ts
 /**
@@ -37,8 +37,8 @@ async function withCodexAppServerModelRequest(options, run) {
 	if (options.request) return await run(options.request);
 	const timeoutMs = options.timeoutMs ?? 2500;
 	const useSharedClient = options.sharedClient !== false;
-	const { createIsolatedCodexAppServerClient, getLeasedSharedCodexAppServerClient, releaseLeasedSharedCodexAppServerClient } = await import("./shared-client-DxcfF9KX.js").then((n) => n.x);
-	const { requestCodexAppServerClientJson } = await import("./request-DYAI5FQE.js").then((n) => n.a);
+	const { createIsolatedCodexAppServerClient, getLeasedSharedCodexAppServerClient, releaseLeasedSharedCodexAppServerClient } = await import("./shared-client-CVhez2Uo.js").then((n) => n.y);
+	const { requestCodexAppServerClientJson } = await import("./request-CGvGOpeR.js").then((n) => n.a);
 	const client = await (useSharedClient ? getLeasedSharedCodexAppServerClient : createIsolatedCodexAppServerClient)({
 		startOptions: options.startOptions,
 		timeoutMs,
@@ -56,7 +56,7 @@ async function withCodexAppServerModelRequest(options, run) {
 		}));
 	} finally {
 		if (useSharedClient) releaseLeasedSharedCodexAppServerClient(client);
-		else client.close();
+		else await client.closeAndWait();
 	}
 }
 async function requestModelListPage(request, options) {

package/dist/native-execution-policy-umd0tgh4.js

@@ -0,0 +1,128 @@
+import { resolveAgentConfig, tryResolveDefaultAgentId } from "openclaw/plugin-sdk/agent-scope-runtime";
+import { normalizeAgentId, parseAgentSessionKey } from "openclaw/plugin-sdk/routing";
+import { getSessionEntry } from "openclaw/plugin-sdk/session-store-runtime";
+import { resolveSandboxRuntimeStatus } from "openclaw/plugin-sdk/sandbox";
+//#region extensions/codex/src/app-server/native-execution-policy.ts
+/** Projects node execution ownership into the runtime tool factory options. */
+function resolveCodexNodeExecToolOverrides(policy) {
+	if (policy.effectiveExecHost !== "node") return;
+	const node = policy.node?.trim();
+	return {
+		host: "node",
+		...node ? { node } : {}
+	};
+}
+/** Resolves node/gateway/sandbox execution ownership from overrides, session, agent, and config. */
+function resolveCodexNativeExecutionPolicy(params) {
+	const config = params.config ?? {};
+	const sessionKey = params.sessionKey?.trim() || params.sessionId?.trim() || void 0;
+	const agentId = resolvePolicyAgentId({
+		config,
+		sessionKey,
+		agentId: params.agentId
+	});
+	const canReadSessionEntry = Boolean(agentId) && params.readRuntimeSessionEntry && shouldReadRuntimeSessionEntry({
+		config,
+		sessionKey,
+		agentId
+	});
+	const sessionEntry = params.sessionEntry ?? (canReadSessionEntry && sessionKey && agentId ? readRuntimeSessionEntryBestEffort({
+		sessionKey,
+		agentId
+	}) : void 0);
+	const sandboxAgentId = parseAgentSessionKey(sessionKey)?.agentId ?? agentId;
+	const sandboxAvailable = params.sandboxAvailable ?? (sessionKey && sandboxAgentId ? resolveSandboxRuntimeStatus({
+		cfg: config,
+		sessionKey,
+		agentId: sandboxAgentId,
+		classificationAgentId: sandboxAgentId
+	}).sandboxed : false);
+	const agentExec = agentId ? resolvePolicyAgentExec({
+		config,
+		agentId
+	}) : void 0;
+	const globalExec = config.tools?.exec;
+	const requestedExecHost = normalizeExecTarget(params.execOverrides?.host) ?? normalizeExecTarget(sessionEntry?.execHost) ?? normalizeExecTarget(agentExec?.host) ?? normalizeExecTarget(globalExec?.host) ?? "auto";
+	const effectiveExecHost = resolveEffectiveExecHost({
+		requestedExecHost,
+		sandboxAvailable
+	});
+	const node = params.execOverrides?.node ?? sessionEntry?.execNode ?? agentExec?.node ?? globalExec?.node;
+	if (effectiveExecHost !== "node") return {
+		nativeToolSurfaceAllowed: true,
+		requestedExecHost,
+		effectiveExecHost,
+		node
+	};
+	return {
+		nativeToolSurfaceAllowed: false,
+		requestedExecHost,
+		effectiveExecHost,
+		node,
+		blockReason: "OpenClaw exec host=node is active for this session. Codex app-server native execution cannot route shell, filesystem, MCP, or app-backed work through the selected OpenClaw node."
+	};
+}
+/** Formats the user-facing explanation shown when native tools are blocked by exec host=node. */
+function formatCodexNativeNodeExecBlock(params) {
+	return [
+		`Codex-native ${params.surface} is unavailable because OpenClaw exec host=node is active for this session.`,
+		params.reason ?? "Codex app-server native execution cannot route execution through the selected OpenClaw node.",
+		"Use a normal Codex harness turn so OpenClaw exec/process tools run on the node, or switch exec host to gateway for native Codex app-server execution."
+	].join(" ");
+}
+function resolvePolicyAgentId(params) {
+	const explicitAgentId = normalizeAgentIdOrDefault(params.agentId);
+	if (explicitAgentId) return explicitAgentId;
+	const sessionAgentId = parseAgentIdFromSessionKey(params.sessionKey);
+	if (sessionAgentId) return sessionAgentId;
+	return tryResolveDefaultAgentId(params.config);
+}
+function resolvePolicyAgentExec(params) {
+	return resolveAgentConfig(params.config, params.agentId)?.tools?.exec;
+}
+function parseAgentIdFromSessionKey(sessionKey) {
+	const raw = sessionKey?.trim();
+	if (!raw) return;
+	const parts = raw.toLowerCase().split(":").filter(Boolean);
+	if (parts.length < 3 || parts[0] !== "agent" || !parts[2]) return;
+	return normalizeAgentIdOrDefault(parts[1]);
+}
+function shouldReadRuntimeSessionEntry(params) {
+	if (!params.sessionKey) return false;
+	const explicitAgentId = normalizeAgentIdOrDefault(params.agentId);
+	if (!explicitAgentId) return true;
+	const sessionAgentId = parseAgentIdFromSessionKey(params.sessionKey);
+	if (!sessionAgentId) return isDefaultAgentSessionKeyForAgent({
+		config: params.config,
+		agentId: explicitAgentId
+	});
+	return sessionAgentId === explicitAgentId;
+}
+function isDefaultAgentSessionKeyForAgent(params) {
+	return normalizeAgentId(params.agentId) === tryResolveDefaultAgentId(params.config);
+}
+function normalizeAgentIdOrDefault(value) {
+	const normalized = normalizeAgentId(value);
+	return normalized === "main" && !(value ?? "").trim() ? void 0 : normalized;
+}
+function normalizeExecTarget(value) {
+	const normalized = value?.trim().toLowerCase();
+	if (normalized === "auto" || normalized === "sandbox" || normalized === "gateway" || normalized === "node") return normalized;
+}
+function resolveEffectiveExecHost(params) {
+	if (params.requestedExecHost === "auto") return params.sandboxAvailable ? "sandbox" : "gateway";
+	return params.requestedExecHost;
+}
+function readRuntimeSessionEntryBestEffort(params) {
+	try {
+		return getSessionEntry({
+			sessionKey: params.sessionKey,
+			agentId: params.agentId,
+			hydrateSkillPromptRefs: false
+		});
+	} catch {
+		return;
+	}
+}
+//#endregion
+export { resolveCodexNativeExecutionPolicy as n, resolveCodexNodeExecToolOverrides as r, formatCodexNativeNodeExecBlock as t };