@openclaw/codex 2026.9.1 → 2026.9.3

package/dist/{thread-lifecycle-DAcEJ_Om.js → thread-lifecycle-D1pzRwHB.js}

@@ -1,482 +1,73 @@
-import { $t as isJsonObject, E as CodexThreadStartRequestError, Et as isCodexAppServerLiveThreadClaimed, H as isCodexAppServerOverloadError, I as getCodexAppServerClientInstanceId, Jt as readCodexSessionMeta, K as resolveCodexAppServerClientInstanceId, Mt as withAbortableTimeout, Ot as readCodexClientSessionMeta, Q as assertCodexThreadForkResponse, Qt as flattenCodexDynamicToolFunctions, St as consumeCodexAppServerLiveThread, T as CodexThreadBindingConflictError, Tt as isCodexAppServerClientRuntimeLive, W as isCodexAppServerRequestTimeoutError, X as assertCodexThreadAcceptsDirectInput, _ as retainSharedCodexAppServerClientByInstanceId, _t as resolveCodexToolAbortTerminalReason, et as assertCodexThreadStartResponse, jt as unsubscribeCodexAppServerLiveThread, kt as releaseCodexAppServerLiveThread, n as captureCodexAppServerClientLifetime, q as CodexAppServerRpcError, w as CodexAdoptedThreadActiveError } from "./shared-client-DxcfF9KX.js";
-import { D as resolveCodexPluginsPolicy, F as resolveCodexAppServerHomeDir, I as resolveCodexAppServerLocalHomeDir, M as CODEX_PLUGINS_MARKETPLACE_NAME, N as CODEX_PLUGINS_WORKSPACE_MARKETPLACE_NAME, n as codexSandboxPolicyForTurn, p as assertCodexModelBackedReviewerEffectiveConfig } from "./config-BhmfC1s6.js";
-import { a as hashCodexAppServerBindingFingerprint, c as reclaimCurrentCodexSessionGeneration, d as sessionBindingIdentity, i as createCodexSessionGenerationSupersededError, n as assertCodexBindingMayBeReplaced, o as isCodexAppServerNativeAuthProfile, s as normalizeCodexAppServerBindingModelProvider } from "./session-binding-BHuTCRZQ.js";
-import { a as closeCodexStartupClientBestEffort, c as isCodexAppServerUnsafeSubscriptionError, d as unsubscribeCodexThreadBestEffort, l as retireUnsafeCodexTurnClientBestEffort, n as CODEX_APP_SERVER_UNSUBSCRIBE_TIMEOUT_MS, r as CodexAppServerUnsafeSubscriptionError } from "./attempt-client-cleanup-DYHcRQAa.js";
-import { c as serializeCodexAppInventoryError, n as buildCodexAppServerConnectionFingerprint, s as defaultCodexAppInventoryCache, t as resumeCodexAppServerThread } from "./thread-resume-C7pyVKeW.js";
-import { c as withExclusiveCodexAppServerThread, l as isIncognitoSessionKey, o as withCodexAppServerThreadMutation, r as retainCodexAppServerBindingSubscription } from "./thread-ownership-zGokd8i1.js";
-import { f as projectBoundedCodexThreadHistory, g as codexCatalogHomeId } from "./transcript-mirror-DTUxFWa_.js";
-import { i as refreshCodexThreadPolicy, n as CodexThreadPolicyHandoffError, r as assertCodexSupervisionThreadLineage, t as CodexIncognitoPolicyChangeError } from "./thread-policy-g4KbJPzp.js";
-import { r as sanitizeInlineImageDataUrl, t as invalidInlineImageText } from "./image-payload-sanitizer-CnfoUPCE.js";
+import { l as sessionBindingIdentity, n as assertCodexBindingMayBeReplaced } from "./session-binding-record-CaZjYwNS.js";
+import { f as assertCodexModelBackedReviewerEffectiveConfig, g as readCodexEffectiveConfig, h as CODEX_SESSION_OVERRIDABLE_LAYER_TYPES, n as codexSandboxPolicyForTurn } from "./config-options-jnIFvwxD.js";
+import { S as resolveCodexPluginsPolicy, a as flattenCodexDynamicToolFunctions, c as resolveCodexAppServerLocalHomeDir, o as isJsonObject, s as resolveCodexAppServerHomeDir } from "./protocol-CAAcVIKF.js";
+import { L as resolveCodexToolAbortTerminalReason, _ as assertCodexThreadAcceptsDirectInput, b as assertCodexThreadStartResponse, d as isCodexAppServerRequestTimeoutError, l as isCodexAppServerOverloadError, p as resolveCodexAppServerClientInstanceId, r as getCodexAppServerClientInstanceId, v as assertCodexThreadForkResponse } from "./client-BEKu4yDx.js";
+import { i as markStartedCodexManagedThread } from "./managed-thread-store-D1t5jh3G.js";
+import { n as withCodexAppServerThreadMutation, t as isIncognitoSessionKey } from "./incognito-session-uhrBF6wJ.js";
+import { i as isCodexThreadReadMissingError, n as readCodexSessionMeta, r as CodexAppServerRpcError } from "./session-catalog-provenance-DkJHo735.js";
+import { n as codexCatalogHomeId, r as projectBoundedCodexThreadHistory } from "./session-catalog-home-id-D7-aLiNt.js";
+import { c as serializeCodexAppInventoryError, o as CodexAppInventoryCache, s as defaultCodexAppInventoryCache, t as buildCodexAppServerConnectionFingerprint } from "./plugin-app-cache-key-CdSQzWyX.js";
+import { t as withAbortableTimeout } from "./timeout-BVw8aaM1.js";
+import "./config-JDfTI4VI.js";
+import { r as sanitizeInlineImageDataUrl, t as invalidInlineImageText } from "./image-payload-sanitizer-tupAr-2o.js";
+import { t as assertCodexSessionRuntimeOwnership } from "./binding-connection-QqgcPCgk.js";
+import { n as normalizeCodexAppServerBindingModelProvider, t as isCodexAppServerNativeAuthProfile } from "./auth-profile-CwzO4_RG.js";
+import { C as CodexThreadBindingConflictError, G as unsubscribeCodexAppServerLiveThread, H as readCodexClientSessionMeta, P as consumeCodexAppServerLiveThread, R as isCodexAppServerClientRuntimeLive, S as CodexAdoptedThreadActiveError, U as releaseCodexAppServerLiveThread, _ as retainSharedCodexAppServerClientByInstanceId, n as captureCodexAppServerClientLifetime, w as CodexThreadStartRequestError, z as isCodexAppServerLiveThreadClaimed } from "./shared-client-CVhez2Uo.js";
+import { a as closeCodexStartupClientBestEffort, d as unsubscribeCodexThreadBestEffort, l as retireUnsafeCodexTurnClientBestEffort, n as CODEX_APP_SERVER_UNSUBSCRIBE_TIMEOUT_MS, r as CodexAppServerUnsafeSubscriptionError, s as isCodexAppServerUnsafeSubscriptionError } from "./attempt-client-cleanup-D6cR54TV.js";
+import { a as readCodexPluginInventory, o as resolveOwnedAppApprovalOverrideKeys } from "./plugin-inventory-CoRCzWW4.js";
+import { t as ensureCodexPluginActivation } from "./plugin-activation-BQK-f5sV.js";
+import { o as resolveCodexSessionBinding, r as hashCodexAppServerBindingFingerprint } from "./session-binding-CKSepwIC.js";
+import { i as refreshCodexThreadPolicy, n as CodexThreadPolicyHandoffError, r as assertCodexSupervisionThreadLineage, t as CodexIncognitoPolicyChangeError } from "./thread-policy-D8kI7yAO.js";
+import { t as resumeCodexAppServerThread } from "./thread-resume-T5cveyxA.js";
+import { r as retainCodexAppServerBindingSubscription, s as withExclusiveCodexAppServerThread } from "./thread-ownership-D6oASVRu.js";
+import "./transcript-mirror-t5TOccct.js";
 import { asOptionalRecord, isRecord, normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
-import fs from "node:fs/promises";
-import path from "node:path";
-import { createDeferred } from "openclaw/plugin-sdk/extension-shared";
-import { addTimerTimeoutGraceMs, finiteSecondsToTimerSafeMilliseconds } from "openclaw/plugin-sdk/number-runtime";
-import { AgentHarnessPreflightError, SKILL_WORKSHOP_TOOL_NAME, buildCredentialSafetyPrompt, buildDelegationGuidanceSection, buildHarnessVisibleReplyGuidance, buildSkillWorkshopPromptSection, buildTemporalContextText, embeddedAgentLog, formatErrorMessage, isActiveHarnessContextEngine, isHostScopedAgentToolActive, resolveMainSessionDelegationMode } from "openclaw/plugin-sdk/agent-harness-runtime";
-import { isPathInside } from "openclaw/plugin-sdk/file-access-runtime";
 import * as crypto$1 from "node:crypto";
 import crypto, { createHash } from "node:crypto";
+import { resolveSessionAgentIdsStrict } from "openclaw/plugin-sdk/agent-scope-runtime";
+import { addTimerTimeoutGraceMs, finiteSecondsToTimerSafeMilliseconds } from "openclaw/plugin-sdk/number-runtime";
+import path from "node:path";
 import os from "node:os";
+import fs from "node:fs/promises";
+import { expectDefined } from "openclaw/plugin-sdk/expect-runtime";
+import { sliceUtf16Safe, truncateUtf16Safe } from "openclaw/plugin-sdk/text-utility-runtime";
+import { createDeferred } from "openclaw/plugin-sdk/extension-shared";
+import { createStageTimingTracker, formatStageTimings } from "openclaw/plugin-sdk/time-runtime";
+import { isPathInside } from "openclaw/plugin-sdk/file-access-runtime";
 import { isDeepStrictEqual } from "node:util";
 import { resolveAgentDir as resolveAgentDir$1 } from "openclaw/plugin-sdk/agent-runtime";
-import { resolveSessionAgentIdsStrict } from "openclaw/plugin-sdk/agent-scope-runtime";
-import { z } from "zod";
-import { coerceErrorMessage } from "openclaw/plugin-sdk/error-runtime";
-import { sliceUtf16Safe, truncateUtf16Safe } from "openclaw/plugin-sdk/text-utility-runtime";
+import { AgentHarnessPreflightError, SKILL_WORKSHOP_TOOL_NAME, buildCredentialSafetyPrompt, buildDelegationGuidanceSection, buildHarnessVisibleReplyGuidance, buildSkillWorkshopPromptSection, buildTemporalContextText, buildUiPresentationPrompt, embeddedAgentLog, formatErrorMessage, isActiveHarnessContextEngine, isHostScopedAgentToolActive, isOpenClawRuntimeContextCustomMessage, resolveMainSessionDelegationMode } from "openclaw/plugin-sdk/agent-harness-runtime";
 import { emitTrustedDiagnosticEvent } from "openclaw/plugin-sdk/diagnostic-runtime";
-import { expectDefined } from "openclaw/plugin-sdk/expect-runtime";
 import { redactSensitiveFieldValue, redactToolPayloadText } from "openclaw/plugin-sdk/logging-core";
+import { IMAGE_BLOCK_TOKENS } from "openclaw/plugin-sdk/agent-core";
 import { resolveRequiredHomeDir, resolveStateDir } from "openclaw/plugin-sdk/state-paths";
 import { buildCodexUserMcpServersThreadConfigPatchForRun } from "openclaw/plugin-sdk/codex-mcp-projection";
 import { registerRetainedNativeHookRelayForBundledRuntime } from "openclaw/plugin-sdk/native-hook-relay-runtime";
 import { isDiagnosticFlagEnabled } from "openclaw/plugin-sdk/diagnostic-flags";
 import { listRegisteredPluginAgentPromptGuidance } from "openclaw/plugin-sdk/plugin-runtime";
 import { buildHostnameAllowlistPolicyFromSuffixAllowlist } from "openclaw/plugin-sdk/ssrf-policy";
-//#region extensions/codex/src/app-server/plugin-inventory.ts
-/**
-* Reads Codex plugin marketplace state and app inventory to decide which
-* plugin-owned apps can be exposed to a native Codex thread.
-*/
-const CODEX_PLUGINS_REMOTE_MARKETPLACE_NAME = `${CODEX_PLUGINS_MARKETPLACE_NAME}-remote`;
-const CODEX_PLUGINS_API_MARKETPLACE_NAME = "openai-api-curated";
-/** Reads configured Codex plugin state and maps owned apps to readiness diagnostics. */
-async function readCodexPluginInventory(params) {
-	const policy = params.policy ?? resolveCodexPluginsPolicy(params.pluginConfig);
-	if (!policy.enabled) return {
-		policy,
-		records: [],
-		diagnostics: [{
-			code: "disabled",
-			message: "Native Codex plugin support is disabled."
-		}]
-	};
-	const appInventory = readCachedAppInventory(params);
-	const installedPlugins = await readInstalledCodexPluginMetadata({
-		...params,
-		policy
-	});
-	const pluginCatalogs = /* @__PURE__ */ new Map();
-	const diagnostics = [];
-	const records = [];
-	if (appInventory?.state === "missing") diagnostics.push({
-		code: "app_inventory_missing",
-		message: "Cached Codex app inventory is missing; plugin apps are excluded for this setup."
-	});
-	else if (appInventory?.state === "stale") diagnostics.push({
-		code: "app_inventory_stale",
-		message: "Cached Codex app inventory is stale; using stale app readiness and refreshing."
-	});
-	for (const pluginPolicy of policy.pluginPolicies) {
-		if (!pluginPolicy.enabled && !policy.allowAllPlugins) continue;
-		let listed = installedPlugins;
-		let resolvedPlugin = findConfiguredMarketplacePlugin(listed, pluginPolicy);
-		if (!resolvedPlugin && pluginPolicy.enabled && pluginPolicy.marketplaceName !== "workspace-directory") {
-			const requestParams = buildPluginCatalogRequestParams(params, pluginPolicy.marketplaceName);
-			const catalogKey = JSON.stringify([requestParams, pluginMetadataCatalogScope(pluginPolicy.marketplaceName)]);
-			let catalog = pluginCatalogs.get(catalogKey);
-			if (!catalog) {
-				catalog = listCodexPluginMetadata(params, pluginPolicy.marketplaceName);
-				pluginCatalogs.set(catalogKey, catalog);
-			}
-			listed = await catalog;
-			resolvedPlugin = findConfiguredMarketplacePlugin(listed, pluginPolicy);
-		}
-		if (!listed.marketplaces.some((marketplace) => marketplaceMatchesConfiguredName(marketplace, pluginPolicy.marketplaceName))) {
-			diagnostics.push({
-				code: "marketplace_missing",
-				plugin: pluginPolicy,
-				message: `Codex marketplace ${pluginPolicy.marketplaceName} was not found.`
-			});
-			continue;
-		}
-		if (!resolvedPlugin) {
-			diagnostics.push({
-				code: "plugin_missing",
-				plugin: pluginPolicy,
-				message: `${pluginPolicy.pluginName} was not found in ${pluginPolicy.marketplaceName}.`
-			});
-			continue;
-		}
-		const { summary } = resolvedPlugin;
-		const unavailableByMarketplacePolicy = summary.availability === "DISABLED_BY_ADMIN" || summary.installPolicy === "NOT_AVAILABLE";
-		if (unavailableByMarketplacePolicy) {
-			diagnostics.push({
-				code: "plugin_disabled",
-				plugin: pluginPolicy,
-				message: `${pluginPolicy.pluginName} is unavailable in ${pluginPolicy.marketplaceName}.`
-			});
-			if (!summary.installed) continue;
-		}
-		const detail = await readPluginDetail(params, marketplaceRef(resolvedPlugin.marketplace, pluginPolicy.marketplaceName), pluginPolicy, summary, diagnostics);
-		const ownedAppIds = detail?.apps.map((app) => app.id).filter(Boolean).toSorted() ?? [];
-		const appOwnership = resolveAppOwnership({
-			detail,
-			appInventory,
-			summary
-		});
-		if (appOwnership === "ambiguous") diagnostics.push({
-			code: "app_ownership_ambiguous",
-			plugin: pluginPolicy,
-			message: `${pluginPolicy.pluginName} has only display-name app matches; apps are not exposed until ownership is stable.`
-		});
-		if (summary.installed && !summary.enabled) diagnostics.push({
-			code: "plugin_disabled",
-			plugin: pluginPolicy,
-			message: `${pluginPolicy.pluginName} is installed in Codex but disabled.`
-		});
-		const apps = resolveOwnedApps({
-			pluginPolicy,
-			detail,
-			appInventory
-		});
-		records.push({
-			policy: pluginPolicy,
-			summary,
-			...detail ? { detail } : {},
-			activationRequired: pluginPolicy.enabled && (unavailableByMarketplacePolicy || !summary.installed || !summary.enabled),
-			authRequired: apps.some((app) => app.needsAuth || !app.accessible),
-			appOwnership,
-			ownedAppIds,
-			apps
-		});
-	}
-	return {
-		policy,
-		records,
-		diagnostics,
-		...appInventory ? { appInventory } : {}
-	};
-}
-/** Finds a configured plugin only in its authorized marketplace identity. */
-function findCodexMarketplacePluginSummary(listed, marketplaceName, pluginName) {
-	const resolved = findConfiguredMarketplacePlugin(listed, {
-		marketplaceName,
-		pluginName
-	});
-	return resolved ? {
-		marketplace: marketplaceRef(resolved.marketplace, marketplaceName),
-		summary: resolved.summary
-	} : void 0;
-}
-/** Builds plugin/read or plugin/install params from a marketplace reference. */
-function pluginReadParams(marketplace, pluginName) {
-	return {
-		...marketplace.path ? { marketplacePath: marketplace.path } : {},
-		...marketplace.remoteMarketplaceName ? { remoteMarketplaceName: marketplace.remoteMarketplaceName } : {},
-		pluginName
-	};
-}
-/** Returns configured plugin keys whose current metadata may still recover. */
-function resolveRecoverableCodexPluginConfigKeys(params) {
-	return params.policy.pluginPolicies.filter((pluginPolicy) => pluginPolicy.enabled && !isSettledMissingPluginPolicy({
-		pluginPolicy,
-		metadataCache: params.metadataCache,
-		appCacheKey: params.appCacheKey,
-		configCwd: params.configCwd
-	})).map((pluginPolicy) => pluginPolicy.configKey).toSorted();
-}
-async function listCodexPluginMetadata(params, marketplaceName) {
-	const requestParams = buildPluginCatalogRequestParams(params, marketplaceName);
-	if (!params.metadataCache || !params.appCacheKey) return await params.request("plugin/list", requestParams);
-	return (await params.metadataCache.load({
-		appCacheKey: params.appCacheKey,
-		queryKind: "curated-global",
-		requestParams,
-		catalogScope: pluginMetadataCatalogScope(marketplaceName),
-		request: async (method, listedParams) => await params.request(method, listedParams),
-		cacheable: (response) => response.marketplaces.some((marketplace) => marketplaceMatchesConfiguredName(marketplace, marketplaceName))
-	})).response;
-}
-async function readInstalledCodexPluginMetadata(params) {
-	const requestParams = params.configCwd ? { cwds: [params.configCwd] } : {};
-	if (!params.metadataCache || !params.appCacheKey) return await params.request("plugin/installed", requestParams);
-	return (await params.metadataCache.load({
-		appCacheKey: params.appCacheKey,
-		queryKind: "installed",
-		requestParams,
-		request: async (method, installedParams) => await params.request(method, installedParams),
-		cacheable: (response) => params.policy.pluginPolicies.every((pluginPolicy) => {
-			if (!pluginPolicy.enabled && !params.policy.allowAllPlugins) return true;
-			return Boolean(findConfiguredMarketplacePlugin(response, pluginPolicy));
-		})
-	})).response;
-}
-function isSettledMissingPluginPolicy(params) {
-	const queryKind = params.pluginPolicy.marketplaceName === "workspace-directory" ? "installed" : "curated-global";
-	const requestParams = queryKind === "installed" ? params.configCwd ? { cwds: [params.configCwd] } : {} : buildPluginCatalogRequestParams(params, params.pluginPolicy.marketplaceName);
-	const listed = params.metadataCache.read(params.appCacheKey, queryKind, requestParams, queryKind === "curated-global" ? pluginMetadataCatalogScope(params.pluginPolicy.marketplaceName) : void 0)?.response;
-	if (!listed) return false;
-	return !findConfiguredMarketplacePlugin(listed, params.pluginPolicy);
-}
-function pluginMetadataCatalogScope(marketplaceName) {
-	return isOpenAiCuratedMarketplaceName(marketplaceName) ? void 0 : marketplaceName;
-}
-function buildPluginCatalogRequestParams(params, marketplaceName) {
-	const marketplaceKinds = marketplaceName === "created-by-me-remote" ? ["created-by-me-remote"] : marketplaceName.startsWith("workspace-shared-with-me") ? ["shared-with-me"] : void 0;
-	return {
-		...params.configCwd ? { cwds: [params.configCwd] } : {},
-		...marketplaceKinds ? { marketplaceKinds: [...marketplaceKinds] } : {}
-	};
-}
-function readCachedAppInventory(params) {
-	if (!params.appCache || !params.appCacheKey) return;
-	const request = async (method, requestParams) => await params.request(method, requestParams);
-	return params.appCache.read({
-		key: params.appCacheKey,
-		request,
-		nowMs: params.nowMs,
-		suppressRefresh: params.suppressAppInventoryRefresh
-	});
-}
-async function readPluginDetail(params, marketplace, pluginPolicy, summary, diagnostics) {
-	if (params.readPluginDetails === false) return;
-	if (marketplace.remoteMarketplaceName && !summary.remotePluginId) {
-		diagnostics.push({
-			code: "plugin_detail_unavailable",
-			plugin: pluginPolicy,
-			message: `${pluginPolicy.pluginName} detail unavailable: Codex did not return a remote plugin id.`
-		});
-		return;
-	}
-	try {
-		return (await params.request("plugin/read", pluginReadParams(marketplace, marketplace.remoteMarketplaceName && summary.remotePluginId ? summary.remotePluginId : pluginPolicy.pluginName))).plugin;
-	} catch (error) {
-		diagnostics.push({
-			code: "plugin_detail_unavailable",
-			plugin: pluginPolicy,
-			message: `${pluginPolicy.pluginName} detail unavailable: ${error instanceof Error ? error.message : String(error)}`
-		});
-		return;
-	}
-}
-function resolveAppOwnership(params) {
-	if (params.detail && params.detail.apps.length > 0) return "proven";
-	return (params.appInventory?.snapshot?.apps ?? []).filter((app) => app.pluginDisplayNames.some((displayName) => displayName === params.summary.name)).length > 0 ? "ambiguous" : "none";
-}
-function resolveOwnedApps(params) {
-	const detailApps = params.detail?.apps ?? [];
-	if (detailApps.length === 0) return [];
-	if (params.appInventory?.state === "missing") {
-		embeddedAgentLog.warn("codex plugin inventory missing app inventory for detail apps", {
-			configKey: params.pluginPolicy.configKey,
-			pluginName: params.pluginPolicy.pluginName,
-			appIds: detailApps.map((app) => app.id).toSorted()
-		});
-		return [];
-	}
-	const appInfoById = new Map((params.appInventory?.snapshot?.apps ?? []).map((app) => [app.id, app]));
-	return detailApps.map((app) => {
-		const info = appInfoById.get(app.id);
-		if (!info) return {
-			id: app.id,
-			name: app.name,
-			accessible: false,
-			enabled: false,
-			needsAuth: true
-		};
-		return Object.assign({
-			id: app.id,
-			name: app.name,
-			accessible: info.isAccessible,
-			enabled: info.isEnabled,
-			needsAuth: !info.isAccessible
-		}, resolveOwnedAppApprovalOverrideKeys(info));
-	}).toSorted((left, right) => left.id.localeCompare(right.id));
-}
-/** Returns current tool keys whose overrides could bypass the requested reviewer. */
-function resolveOwnedAppApprovalOverrideKeys(app) {
-	if (!app.toolSummaries) return {};
-	const appName = app.name.trim();
-	const appNameLower = appName.toLowerCase();
-	const keys = app.toolSummaries.filter((tool) => !tool.isReadOnly).flatMap((tool) => resolveAppToolConfigKeys({
-		appName,
-		appNameLower,
-		tool
-	}));
-	return { approvalOverrideToolConfigKeys: Array.from(new Set(keys)).toSorted() };
-}
-function resolveAppToolConfigKeys(params) {
-	const keys = [params.tool.name];
-	if (params.tool.title) keys.push(params.tool.title);
-	if (params.appName) keys.push(`${params.appName}_${params.tool.name}`);
-	if (params.appNameLower && params.appNameLower !== params.appName) keys.push(`${params.appNameLower}_${params.tool.name}`);
-	return keys;
-}
-function findPluginSummary(marketplace, pluginName) {
-	const exact = marketplace.plugins.find((plugin) => plugin.id === pluginName || plugin.id === `${pluginName}@${marketplace.name}`);
-	if (exact) return exact;
-	const matches = marketplace.plugins.filter((plugin) => plugin.name === pluginName || pluginNameFromPluginId(plugin.id, marketplace.name) === pluginName);
-	return matches.length === 1 ? matches[0] : void 0;
-}
-function findConfiguredMarketplacePlugin(listed, plugin) {
-	if (plugin.marketplaceName === "workspace-directory") return findWorkspaceMarketplacePlugin(listed, plugin.pluginName);
-	for (const marketplace of listed.marketplaces) {
-		if (!marketplaceMatchesConfiguredName(marketplace, plugin.marketplaceName)) continue;
-		const summary = findPluginSummary(marketplace, plugin.pluginName);
-		if (summary) return {
-			marketplace,
-			summary
-		};
-	}
-}
-function marketplaceMatchesConfiguredName(marketplace, configuredMarketplaceName) {
-	return isOpenAiCuratedMarketplaceName(configuredMarketplaceName) ? isOpenAiCuratedMarketplace(marketplace) : marketplace.name === configuredMarketplaceName;
-}
-function findWorkspaceMarketplacePlugin(listed, pluginName) {
-	const marketplace = listed.marketplaces.find((entry) => entry.name === CODEX_PLUGINS_WORKSPACE_MARKETPLACE_NAME);
-	const summary = marketplace?.plugins.find((plugin) => plugin.id === pluginName);
-	return marketplace && summary ? {
-		marketplace,
-		summary
-	} : void 0;
-}
-function pluginNameFromPluginId(pluginId, marketplaceName) {
-	const trimmed = pluginId.trim();
-	if (!trimmed) return;
-	const marketplaceSuffix = `@${marketplaceName}`;
-	return (trimmed.endsWith(marketplaceSuffix) ? trimmed.slice(0, -marketplaceSuffix.length) : trimmed).split("/").at(-1)?.trim() || void 0;
-}
-function marketplaceRef(marketplace, name) {
-	return {
-		name,
-		...marketplace.path ? { path: marketplace.path } : {},
-		...!marketplace.path ? { remoteMarketplaceName: marketplace.name } : {}
-	};
-}
-/** True for any supported OpenAI curated marketplace wire name, matching Codex's own curated predicate. */
-function isOpenAiCuratedMarketplace(marketplace) {
-	return isOpenAiCuratedMarketplaceName(marketplace.name);
-}
-/** True for all Codex wire aliases of the same OpenAI-curated catalog. */
-function isOpenAiCuratedMarketplaceName(marketplaceName) {
-	return marketplaceName === "openai-curated" || marketplaceName === CODEX_PLUGINS_REMOTE_MARKETPLACE_NAME || marketplaceName === CODEX_PLUGINS_API_MARKETPLACE_NAME;
-}
-//#endregion
-//#region extensions/codex/src/app-server/plugin-activation.ts
-/**
-* Activates legacy curated Codex plugins while requiring owner-managed
-* installation for every other marketplace.
-*/
-/** Activates legacy curated plugins without granting install authority to other marketplaces. */
-async function ensureCodexPluginActivation(params) {
-	if (params.identity.marketplaceName === "workspace-directory") return activationFailure(params.identity, "disabled", { message: "workspace-directory plugins must be installed and enabled outside OpenClaw before use." });
-	if (!isOpenAiCuratedMarketplaceName(params.identity.marketplaceName)) {
-		const target = params.identity.pluginName.endsWith(`@${params.identity.marketplaceName}`) ? params.identity.pluginName : `${params.identity.pluginName}@${params.identity.marketplaceName}`;
-		return activationFailure(params.identity, "disabled", { message: `${params.identity.marketplaceName} plugins must be installed and enabled by an owner before use. Run /codex plugins install ${target}.` });
-	}
-	const listed = await listCuratedCodexPluginMetadata(params);
-	const resolved = findCodexMarketplacePluginSummary(listed, params.identity.marketplaceName, params.identity.pluginName);
-	if (!resolved) {
-		if (!listed.marketplaces.some((marketplace) => isOpenAiCuratedMarketplace(marketplace))) return activationFailure(params.identity, "marketplace_missing", { message: `Codex marketplace ${CODEX_PLUGINS_MARKETPLACE_NAME} was not found.` });
-		return activationFailure(params.identity, "plugin_missing", { message: `${params.identity.pluginName} was not found in ${CODEX_PLUGINS_MARKETPLACE_NAME}.` });
-	}
-	if (resolved.marketplace.remoteMarketplaceName && !resolved.summary.remotePluginId) return activationFailure(params.identity, "plugin_missing", { message: `${params.identity.pluginName} detail unavailable: Codex did not return a remote plugin id.` });
-	if (resolved.summary.availability === "DISABLED_BY_ADMIN" || resolved.summary.installPolicy === "NOT_AVAILABLE") return activationFailure(params.identity, "disabled", { message: `${params.identity.pluginName} was disabled or made unavailable by its marketplace administrator.` });
-	if (resolved.summary.installed && resolved.summary.enabled && !params.installEvenIfActive) return {
-		identity: params.identity,
-		ok: true,
-		reason: "already_active",
-		installAttempted: false,
-		marketplace: resolved.marketplace,
-		diagnostics: []
-	};
-	const remotePluginId = resolved.marketplace.remoteMarketplaceName ? resolved.summary.remotePluginId : void 0;
-	let installResponse;
-	try {
-		installResponse = await params.request("plugin/install", pluginReadParams(resolved.marketplace, remotePluginId ?? params.identity.pluginName));
-	} catch (error) {
-		if (!(error instanceof CodexAppServerRpcError) || error.code !== -32600 || !remotePluginId || error.message !== `remote plugin ${remotePluginId} is disabled by admin` && error.message !== `remote plugin ${remotePluginId} is not available for install`) throw error;
-		return {
-			identity: params.identity,
-			ok: false,
-			reason: "install_failed",
-			installAttempted: true,
-			marketplace: resolved.marketplace,
-			diagnostics: [{ message: `Codex plugin install failed: ${coerceErrorMessage(error)}` }]
-		};
-	}
-	if (params.metadataCache && params.appCacheKey) params.metadataCache.invalidate(params.appCacheKey);
-	const refreshDiagnostics = [];
-	let refreshFailed = false;
-	try {
-		const refreshResult = await refreshCodexPluginRuntimeState({
-			request: params.request,
-			appCache: params.appCache,
-			appCacheKey: params.appCacheKey,
-			configCwd: params.configCwd,
-			metadataCache: params.metadataCache,
-			deferAppInventoryRefresh: params.deferAppInventoryRefresh,
-			targetAppIds: params.targetAppIds
-		});
-		refreshDiagnostics.push(...refreshResult.diagnostics);
-	} catch (error) {
-		refreshFailed = true;
-		refreshDiagnostics.push({ message: `Codex plugin runtime refresh failed after install: ${coerceErrorMessage(error)}` });
-	}
-	const authRequired = installResponse.appsNeedingAuth.length > 0;
-	return {
-		identity: params.identity,
-		ok: !authRequired && !refreshFailed,
-		reason: refreshFailed ? "refresh_failed" : authRequired ? "auth_required" : resolved.summary.installed && resolved.summary.enabled ? "already_active" : "installed",
-		installAttempted: true,
-		marketplace: resolved.marketplace,
-		installResponse,
-		diagnostics: [...refreshDiagnostics, ...installResponse.appsNeedingAuth.map((app) => ({ message: `${app.name} requires app authentication before plugin tools are exposed.` }))]
-	};
-}
-/** Forces Codex plugin, skill, hook, MCP, and app inventory refreshes after activation. */
-async function refreshCodexPluginRuntimeState(params) {
-	const diagnostics = [];
-	await listCuratedCodexPluginMetadata(params, { forceRefetch: true });
-	await params.request("skills/list", {
-		cwds: params.configCwd ? [params.configCwd] : [],
-		forceReload: true
-	});
-	try {
-		await params.request("hooks/list", { cwds: params.configCwd ? [params.configCwd] : [] });
-	} catch (error) {
-		diagnostics.push({ message: `Codex hooks refresh skipped: ${coerceErrorMessage(error)}` });
-	}
-	await params.request("config/mcpServer/reload", void 0);
-	if (params.appCache && params.appCacheKey) {
-		params.appCache.invalidate(params.appCacheKey, "Codex plugin activation changed app inventory", void 0, params.targetAppIds);
-		if (params.deferAppInventoryRefresh) return { diagnostics };
-		const request = async (method, requestParams) => await params.request(method, requestParams);
-		try {
-			await params.appCache.refreshNow({
-				key: params.appCacheKey,
-				request,
-				forceRefetch: true,
-				targetAppIds: params.targetAppIds
-			});
-		} catch (error) {
-			diagnostics.push({ message: `Codex app inventory refresh skipped: ${coerceErrorMessage(error)}` });
+//#region extensions/codex/src/app-server/plugin-app-approval-overrides.ts
+/** Projects ask approvals into the native session layer without changing saved settings. */
+function buildCodexAppApprovalOverrides(config, app) {
+	const appsRoot = config.apps;
+	const appConfig = isJsonObject(appsRoot) ? appsRoot[app.id] : void 0;
+	if (!isJsonObject(appConfig)) return {};
+	const overrides = {};
+	const keys = app.approvalOverrideToolConfigKeys;
+	for (const [section, fields] of [["tools", { approval_mode: "auto" }], ["links", {
+		approvals_reviewer: "user",
+		default_tools_approval_mode: "auto"
+	}]]) {
+		const entries = appConfig[section];
+		if (!isJsonObject(entries)) continue;
+		const projected = [];
+		for (const [name, value] of Object.entries(entries).toSorted(([left], [right]) => left.localeCompare(right))) {
+			if (!isJsonObject(value) || section === "tools" && keys && !keys.includes(name)) continue;
+			if (Object.keys(fields).some((field) => value[field] !== void 0 && value[field] !== null)) projected.push([name, fields]);
 		}
+		if (projected.length > 0) overrides[section] = Object.fromEntries(projected);
 	}
-	return { diagnostics };
-}
-async function listCuratedCodexPluginMetadata(params, options = {}) {
-	const requestParams = {
-		...params.configCwd ? { cwds: [params.configCwd] } : {},
-		...options.forceRefetch ? { forceRefetch: true } : {}
-	};
-	if (!params.metadataCache || !params.appCacheKey) return await params.request("plugin/list", requestParams);
-	return (await params.metadataCache.load({
-		appCacheKey: params.appCacheKey,
-		queryKind: "curated-global",
-		requestParams,
-		request: async (method, listedParams) => await params.request(method, listedParams),
-		cacheable: (response) => response.marketplaces.some((marketplace) => isOpenAiCuratedMarketplace(marketplace))
-	})).response;
-}
-function activationFailure(identity, reason, diagnostic, extraDiagnostics = []) {
-	return {
-		identity,
-		ok: false,
-		reason,
-		installAttempted: false,
-		diagnostics: [diagnostic, ...extraDiagnostics]
-	};
+	return overrides;
 }
 //#endregion
 //#region extensions/codex/src/app-server/plugin-thread-app-admission.ts
@@ -592,12 +183,15 @@ async function readCodexConfigForAppAdmission(params) {
 					return [];
 				}
 				if (!isJsonObject(layer.config)) throw new Error("Codex config/read returned an invalid layer config");
+				if (!isJsonObject(layer.name) || typeof layer.name.type !== "string") throw new Error("Codex config/read returned an invalid config layer source");
+				if (layer.config.apps !== void 0 && !CODEX_SESSION_OVERRIDABLE_LAYER_TYPES.has(layer.name.type)) throw new Error(`Codex app policy cannot override ${layer.name.type}; move app settings to a supported user or project config layer before exposing native apps`);
 				return [layer.config];
 			})
 		};
 	} catch (error) {
-		embeddedAgentLog.warn("codex plugin app admission config read failed", { error: serializeCodexAppInventoryError(error) });
-		return;
+		const details = serializeCodexAppInventoryError(error);
+		embeddedAgentLog.warn("codex plugin app admission config read failed", { error: details });
+		throw new Error(`Could not verify the Codex app allowlist: ${String(details.message)}. No native thread was started; resolve the native configuration error and retry.`, { cause: error });
 	}
 }
 function resolveCodexExplicitAppEnablement(layersHighestPrecedenceFirst, appId) {
@@ -617,7 +211,7 @@ function shouldForceRefreshCodexNotReadyPluginApps(params, policy, inventory) {
 * Builds Codex thread config patches that expose only policy-approved apps
 * for native Codex turns.
 */
-const CODEX_PLUGIN_THREAD_CONFIG_INPUT_FINGERPRINT_VERSION = 4;
+const CODEX_PLUGIN_THREAD_CONFIG_INPUT_FINGERPRINT_VERSION = 6;
 const CODEX_PLUGIN_THREAD_CONFIG_FINGERPRINT_VERSION = 2;
 /** Returns true when plugin config exists and thread config may need app patches. */
 function shouldBuildCodexPluginThreadConfig(pluginConfig) {
@@ -763,20 +357,17 @@ async function buildCodexPluginThreadConfig(params) {
 		});
 	}
 	const accountAppsResult = policy.allowAllPlugins ? await readCodexThreadAdmissibleAccountApps(params, appCache) : { apps: [] };
+	let appAdmissionConfig;
+	const getAdmissionConfig = () => appAdmissionConfig ??= readCodexConfigForAppAdmission(params);
 	const diagnostics = [
 		...inventory.diagnostics,
 		...activationDiagnostics,
 		...accountAppsResult.diagnostic ? [accountAppsResult.diagnostic] : []
 	];
 	const provisionalAppIds = /* @__PURE__ */ new Set();
-	const apps = { _default: {
-		enabled: false,
-		destructive_enabled: false,
-		open_world_enabled: false
-	} };
+	const { apps } = buildDisabledAppsConfigPatch();
 	const policyApps = {};
 	const pluginAppIds = {};
-	let configForAppAdmission;
 	const pluginOwnedAppIds = collectCodexReservedPluginAppIds({
 		policy,
 		inventory,
@@ -803,7 +394,7 @@ async function buildCodexPluginThreadConfig(params) {
 			record,
 			inventory
 		})) {
-			const admissionConfig = resolveCodexPluginAppThreadAdmission(app, inventory) === "blocked" ? void 0 : await (configForAppAdmission ??= readCodexConfigForAppAdmission(params));
+			const admissionConfig = resolveCodexPluginAppThreadAdmission(app, inventory) === "blocked" ? void 0 : await getAdmissionConfig();
 			if (!admissionConfig || resolveCodexExplicitAppEnablement(admissionConfig.layers, app.id) === false) {
 				diagnostics.push({
 					code: "app_not_ready",
@@ -812,16 +403,8 @@ async function buildCodexPluginThreadConfig(params) {
 				});
 				continue;
 			}
-			if (record.policy.destructiveApprovalMode === "ask" && !await clearPersistedAppToolApprovalOverrides({
-				request: params.request,
-				configCwd: params.configCwd,
-				config: admissionConfig.config,
-				plugin: record.policy,
-				app,
-				diagnostics
-			})) continue;
 			provisionalAppIds.add(app.id);
-			apps[app.id] = buildEnabledAppConfig(record.policy);
+			apps[app.id] = buildEnabledAppConfig(record.policy, record.policy.destructiveApprovalMode === "ask" ? buildCodexAppApprovalOverrides(admissionConfig.config, app) : void 0);
 			policyApps[app.id] = {
 				configKey: record.policy.configKey,
 				marketplaceName: record.policy.marketplaceName,
@@ -835,26 +418,11 @@ async function buildCodexPluginThreadConfig(params) {
 	}
 	for (const app of unresolvedDisabledPluginOwnership ? [] : accountAppsResult.apps) {
 		if (pluginOwnedAppIds.has(app.id)) continue;
-		configForAppAdmission ??= readCodexConfigForAppAdmission(params);
-		const admissionConfig = await configForAppAdmission;
-		if (!admissionConfig) {
-			diagnostics.push({
-				code: "account_app_config_unavailable",
-				message: "Codex account app configuration was unavailable; account apps were not exposed."
-			});
-			break;
-		}
+		const admissionConfig = await getAdmissionConfig();
 		if (resolveCodexExplicitAppEnablement(admissionConfig.layers, app.id) === false) continue;
 		const accountApp = toCodexPluginOwnedAccountApp(app);
-		if (policy.destructiveApprovalMode === "ask" && !await clearPersistedAppToolApprovalOverrides({
-			request: params.request,
-			configCwd: params.configCwd,
-			config: admissionConfig.config,
-			app: accountApp,
-			diagnostics
-		})) continue;
 		provisionalAppIds.add(app.id);
-		apps[app.id] = buildEnabledAppConfig(policy);
+		apps[app.id] = buildEnabledAppConfig(policy, policy.destructiveApprovalMode === "ask" ? buildCodexAppApprovalOverrides(admissionConfig.config, accountApp) : void 0);
 		policyApps[app.id] = {
 			source: "account",
 			appName: app.name,
@@ -864,7 +432,7 @@ async function buildCodexPluginThreadConfig(params) {
 			mcpServerNames: []
 		};
 	}
-	const configPatch = { apps };
+	const configPatch = Object.keys(policyApps).length === 0 ? buildDisabledAppsConfigPatch() : disableUnlistedCodexApps({ apps }, (await getAdmissionConfig()).config);
 	const policyContext = buildPluginAppPolicyContext(policyApps, pluginAppIds);
 	return {
 		enabled: true,
@@ -914,36 +482,76 @@ function emptyPluginThreadConfig(params) {
 	};
 }
 function buildDisabledAppsConfigPatch() {
-	return { apps: { _default: {
-		enabled: false,
-		destructive_enabled: false,
-		open_world_enabled: false
-	} } };
+	return {
+		"features.apps": false,
+		apps: { _default: {
+			enabled: false,
+			destructive_enabled: false,
+			open_world_enabled: false
+		} }
+	};
+}
+function disableUnlistedCodexApps(configPatch, nativeConfig) {
+	const apps = { ...configPatch.apps };
+	for (const id of Object.keys(isJsonObject(nativeConfig.apps) ? nativeConfig.apps : {})) if (id !== "_default" && !Object.hasOwn(apps, id)) apps[id] = { enabled: false };
+	return {
+		...configPatch,
+		apps
+	};
 }
-function buildEnabledAppConfig(policy) {
+function buildEnabledAppConfig(policy, approvalOverrides = {}) {
 	return {
+		...approvalOverrides,
 		enabled: true,
 		destructive_enabled: policy.allowDestructiveActions,
-		open_world_enabled: true,
+		open_world_enabled: policy.allowOpenWorld !== false,
 		default_tools_approval_mode: "auto",
 		...policy.destructiveApprovalMode === "ask" ? { approvals_reviewer: "user" } : {}
 	};
 }
 /** Rebuilds the safe per-thread apps patch persisted with a Codex thread binding. */
 function buildCodexPluginAppsConfigPatchFromPolicyContext(policyContext) {
-	const apps = { _default: {
-		enabled: false,
-		destructive_enabled: false,
-		open_world_enabled: false
-	} };
-	for (const [appId, policy] of Object.entries(policyContext.apps).toSorted(([left], [right]) => left.localeCompare(right))) apps[appId] = {
-		enabled: true,
-		destructive_enabled: policy.allowDestructiveActions,
-		open_world_enabled: policy.allowOpenWorld !== false,
-		default_tools_approval_mode: "auto",
-		...policy.destructiveApprovalMode === "ask" ? { approvals_reviewer: "user" } : {}
+	const disabledConfigPatch = buildDisabledAppsConfigPatch();
+	const { apps } = disabledConfigPatch;
+	for (const [appId, policy] of Object.entries(policyContext.apps).toSorted(([left], [right]) => left.localeCompare(right))) apps[appId] = buildEnabledAppConfig(policy);
+	return Object.keys(policyContext.apps).length > 0 ? { apps } : disabledConfigPatch;
+}
+/** Projects current ask overrides before a side thread replays its bound app policy. */
+async function refreshCodexPluginAppApprovalPolicy(params) {
+	if (Object.keys(params.policyContext.apps).length === 0) return {
+		policyContext: params.policyContext,
+		configPatch: buildDisabledAppsConfigPatch(),
+		diagnostics: []
+	};
+	const targetApps = Object.entries(params.policyContext.apps).filter(([, app]) => app.destructiveApprovalMode === "ask").toSorted(([left], [right]) => left.localeCompare(right));
+	const targetAppIds = targetApps.map(([id]) => id);
+	const diagnostics = [];
+	const readParams = {
+		...params,
+		appCacheKey: "approval-policy-replay"
+	};
+	const [inventory, admissionConfig] = await Promise.all([targetAppIds.length > 0 ? refreshCodexPluginAppInventory(readParams, new CodexAppInventoryCache(), { targetAppIds }) : void 0, readCodexConfigForAppAdmission(readParams)]);
+	const configPatch = disableUnlistedCodexApps(buildCodexPluginAppsConfigPatchFromPolicyContext(params.policyContext), admissionConfig.config);
+	const currentApps = new Map(inventory?.apps.map((app) => [app.id, toCodexPluginOwnedAccountApp(app)]));
+	const apps = { ...params.policyContext.apps };
+	for (const [id, policy] of targetApps) {
+		const app = currentApps.get(id);
+		if (!app) diagnostics.push({
+			code: "app_not_ready",
+			message: `Could not verify current Codex app approval policy for ${id}; the app was not exposed.`
+		});
+		else {
+			configPatch.apps[id] = buildEnabledAppConfig(policy, buildCodexAppApprovalOverrides(admissionConfig.config, app));
+			continue;
+		}
+		delete apps[id];
+		configPatch.apps[id] = { enabled: false };
+	}
+	return {
+		policyContext: buildPluginAppPolicyContext(apps, Object.fromEntries(Object.entries(params.policyContext.pluginAppIds).map(([key, ids]) => [key, ids.filter((id) => Object.hasOwn(apps, id))]))),
+		configPatch,
+		diagnostics
 	};
-	return { apps };
 }
 function buildPluginAppPolicyContext(apps, pluginAppIds) {
 	return {
@@ -956,49 +564,6 @@ function buildPluginAppPolicyContext(apps, pluginAppIds) {
 		pluginAppIds
 	};
 }
-async function clearPersistedAppToolApprovalOverrides(params) {
-	try {
-		const overrideNames = readPersistedAppToolApprovalOverrideNames(params.config, params.app);
-		if (overrideNames.length === 0) return true;
-		const edits = overrideNames.map((toolName) => ({
-			keyPath: `apps.${quoteConfigKeyPathSegment(params.app.id)}.tools.${quoteConfigKeyPathSegment(toolName)}.approval_mode`,
-			value: null,
-			mergeStrategy: "replace"
-		}));
-		const response = await params.request("config/batchWrite", { edits });
-		if (!isJsonObject(response) || response.status !== "ok" && response.status !== "okOverridden") throw new Error("Codex did not confirm the approval override batch");
-		if (response.status === "okOverridden") throw new Error(`approval override for ${overrideNames.join(", ")} is controlled by another config layer`);
-		const confirmed = await params.request("config/read", {
-			includeLayers: false,
-			...params.configCwd ? { cwd: params.configCwd } : {}
-		});
-		if (!isJsonObject(confirmed) || !isJsonObject(confirmed.config)) throw new Error("Codex did not confirm effective app approval configuration");
-		const remainingOverrideNames = readPersistedAppToolApprovalOverrideNames(confirmed.config, params.app);
-		if (remainingOverrideNames.length > 0) throw new Error(`effective approval overrides remain for ${remainingOverrideNames.join(", ")}`);
-		return true;
-	} catch (error) {
-		params.diagnostics.push({
-			code: "approval_overrides_clear_failed",
-			...params.plugin ? { plugin: params.plugin } : {},
-			message: `Could not clear durable Codex app approval overrides for ${params.app.id}: ${error instanceof Error ? error.message : String(error)}`
-		});
-		return false;
-	}
-}
-function readPersistedAppToolApprovalOverrideNames(config, app) {
-	const appsRoot = config.apps;
-	const appConfig = isJsonObject(appsRoot) ? appsRoot[app.id] : void 0;
-	const tools = isJsonObject(appConfig) ? appConfig.tools : void 0;
-	if (!isJsonObject(tools)) return [];
-	const keys = app.approvalOverrideToolConfigKeys;
-	return Object.entries(tools).flatMap(([name, value]) => (!keys || keys.includes(name)) && hasPersistedToolApprovalOverride(value) ? [name] : []).toSorted();
-}
-function hasPersistedToolApprovalOverride(value) {
-	return isJsonObject(value) && value.approval_mode !== void 0 && value.approval_mode !== null;
-}
-function quoteConfigKeyPathSegment(segment) {
-	return `"${segment.replace(/["\\]/g, (char) => `\\${char}`)}"`;
-}
 function shouldWaitForInitialAppInventory(params, policy, inventory) {
 	if (inventory.records.some((record) => record.activationRequired)) return false;
 	return shouldRefreshMissingAppInventory(params, policy, inventory);
@@ -1030,23 +595,32 @@ function policyFingerprint(policy) {
 	};
 }
 function mergeJsonObjects(left, right) {
-	const merged = { ...left };
+	const merged = {
+		...left,
+		...right
+	};
 	for (const [key, value] of Object.entries(right)) {
-		const existing = merged[key];
-		merged[key] = isJsonObject(existing) && isJsonObject(value) ? mergeJsonObjects(existing, value) : value;
+		const existing = left[key];
+		if (Object.hasOwn(left, key) && isJsonObject(existing) && isJsonObject(value)) merged[key] = mergeJsonObjects(existing, value);
 	}
 	return merged;
 }
 function fingerprintJson(value) {
-	return crypto.createHash("sha256").update(stableStringify$1(value)).digest("hex");
+	return crypto.createHash("sha256").update(stringifyCodexPluginPolicy(value)).digest("hex");
 }
-function stableStringify$1(value) {
-	if (Array.isArray(value)) return `[${value.map((item) => stableStringify$1(item)).join(",")}]`;
-	if (value && typeof value === "object") return `{${Object.entries(value).toSorted(([left], [right]) => left.localeCompare(right)).map(([key, item]) => `${JSON.stringify(key)}:${stableStringify$1(item)}`).join(",")}}`;
+function stringifyCodexPluginPolicy(value) {
+	if (Array.isArray(value)) return `[${value.map((item) => stringifyCodexPluginPolicy(item)).join(",")}]`;
+	if (value && typeof value === "object") return `{${Object.entries(value).toSorted(([left], [right]) => left.localeCompare(right)).map(([key, item]) => `${JSON.stringify(key)}:${stringifyCodexPluginPolicy(item)}`).join(",")}}`;
 	return JSON.stringify(value);
 }
 //#endregion
 //#region extensions/codex/src/app-server/context-engine-projection.ts
+/**
+* Projects OpenClaw context-engine assemblies into Codex prompt text while
+* preserving safety boundaries and redacting tool payloads.
+*/
+/** Attachment preparation must not degrade to a prompt that silently loses the saved input. */
+var CodexContextAttachmentError = class extends Error {};
 const CONTEXT_HEADER = "OpenClaw assembled context for this turn:";
 const CONTEXT_OPEN = "<conversation_context>";
 const CONTEXT_CLOSE = "</conversation_context>";
@@ -1065,16 +639,22 @@ const MIN_PROMPT_BUDGET_TOKENS = 8e3;
 function neutralizeCodexExplicitMentionSigils(text) {
 	return text.replace(/\$(?=[A-Za-z0-9_:-])/gu, "＄").replace(/\[@(?=[A-Za-z0-9_:-]+\]\()/gu, "[＠");
 }
+/** Hidden durable notes are context; transient runtime carriers are current-turn only. */
+function isCodexDurableCustomMessage(message) {
+	return message.role === "custom" && message.excludeFromContext !== true && !isOpenClawRuntimeContextCustomMessage(message);
+}
 /** Projects assembled OpenClaw context-engine messages into Codex prompt inputs. */
-function projectContextEngineAssemblyForCodex(params) {
+async function projectContextEngineAssemblyForCodex(params) {
 	const prompt = params.prompt.trim();
-	const contextMessages = dropDuplicateTrailingPrompt(params.assembledMessages, prompt);
 	const maxRenderedContextChars = normalizeRenderedContextMaxChars(params.maxRenderedContextChars);
-	const renderedContext = neutralizeCodexExplicitMentionSigils(renderMessagesForCodexContext(contextMessages, {
+	const context = await renderMessagesForCodexContext(params.assembledMessages.filter((message) => message.role !== "custom" || isCodexDurableCustomMessage(message)), {
 		maxTextPartChars: resolveTextPartMaxChars(maxRenderedContextChars),
-		toolPayloadMode: params.toolPayloadMode ?? "elide"
-	}));
-	const boundedContext = renderedContext ? truncateOlderContext(renderedContext, maxRenderedContextChars) : void 0;
+		toolPayloadMode: params.toolPayloadMode ?? "elide",
+		maxRenderedContextChars,
+		prepareFileContext: params.prepareFileContext,
+		currentUserTurnIdempotencyKey: params.currentUserTurnIdempotencyKey
+	});
+	const boundedContext = context.text;
 	const promptPrefix = boundedContext ? [
 		CONTEXT_HEADER,
 		CONTEXT_SAFETY_NOTE,
@@ -1092,7 +672,8 @@ function projectContextEngineAssemblyForCodex(params) {
 		promptText,
 		...promptContextRange ? { promptContextRange } : {},
 		assembledMessages: params.assembledMessages,
-		prePromptMessageCount: params.originalHistoryMessages.length
+		prePromptMessageCount: params.originalHistoryMessages.length,
+		...context.images.length ? { images: context.images } : {}
 	};
 }
 /** Resolves rendered context size from a token budget and reserve. */
@@ -1180,17 +761,43 @@ function resolveProjectionPromptBudgetTokens(params) {
 	const effectiveReserveTokens = Math.min(requestedReserveTokens, Math.max(0, params.contextTokenBudget - minPromptBudget));
 	return Math.max(1, params.contextTokenBudget - effectiveReserveTokens);
 }
-function dropDuplicateTrailingPrompt(messages, prompt) {
-	if (!prompt) return messages;
-	const trailing = messages.at(-1);
-	if (!trailing || trailing.role !== "user") return messages;
-	return extractMessageText(trailing).trim() === prompt ? messages.slice(0, -1) : messages;
-}
-function renderMessagesForCodexContext(messages, options) {
-	return messages.map((message) => {
-		const text = renderMessageBody(message, options);
-		return text ? `[${message.role}]\n${text}` : void 0;
-	}).filter((value) => Boolean(value)).join("\n\n");
+async function renderMessagesForCodexContext(messages, options) {
+	const tail = [];
+	const images = [];
+	let retainedImageChars = 0;
+	let totalChars = 0;
+	let retainedChars = 0;
+	for (let index = messages.length - 1; index >= 0; index--) {
+		const message = messages[index];
+		if (message.role === "user" && options.currentUserTurnIdempotencyKey && Reflect.get(message, "idempotencyKey") === options.currentUserTurnIdempotencyKey) continue;
+		const remaining = options.maxRenderedContextChars - retainedChars;
+		const files = remaining > 0 && message.role === "user" ? await options.prepareFileContext?.(message, Math.min(remaining, options.maxTextPartChars)) : void 0;
+		const imageChars = (files?.images.length ?? 0) * IMAGE_BLOCK_TOKENS * APPROX_RENDERED_CHARS_PER_TOKEN;
+		const imagesFit = imageChars < remaining;
+		const acceptedImageChars = imagesFit ? imageChars : 0;
+		const text = [
+			renderMessageBody(message, {
+				...options,
+				mediaPrepared: files !== void 0
+			}),
+			files?.text ? truncateText(files.text, options.maxTextPartChars) : void 0,
+			imageChars > 0 && !imagesFit ? "[Attachment images omitted: context budget exceeded]" : void 0
+		].filter(Boolean).join("\n\n");
+		if (!text && acceptedImageChars === 0) continue;
+		const chunk = `[${message.role}]\n${text}${totalChars > 0 ? "\n\n" : ""}`;
+		totalChars += chunk.length;
+		if (remaining > 0) {
+			const retained = neutralizeCodexExplicitMentionSigils(chunk).slice(-(remaining - acceptedImageChars));
+			tail.push(retained);
+			retainedChars += retained.length + acceptedImageChars;
+			retainedImageChars += acceptedImageChars;
+			if (imagesFit && files?.images.length) images.unshift(...files.images);
+		}
+	}
+	return {
+		text: truncateOlderContext(tail.toReversed().join(""), options.maxRenderedContextChars - retainedImageChars, totalChars),
+		images
+	};
 }
 function renderMessageBody(message, options) {
 	if (message.role === "compactionSummary" || message.role === "branchSummary") return truncateText(message.summary.trim(), options.maxTextPartChars);
@@ -1204,7 +811,7 @@ function renderMessagePart(part, options) {
 	const record = part;
 	const type = typeof record.type === "string" ? record.type : void 0;
 	if (type === "text") return typeof record.text === "string" ? truncateText(record.text.trim(), options.maxTextPartChars) : "";
-	if (type === "image") return "[image omitted]";
+	if (type === "image") return options.mediaPrepared ? "" : "[image omitted]";
 	if (type === "toolCall" || type === "tool_use") {
 		const label = `tool call${typeof record.name === "string" ? `: ${record.name}` : ""}`;
 		if (options.toolPayloadMode === "preserve") return truncateText(`${label}\n${stableJson(renderToolCallPayload(record))}`, options.maxTextPartChars);
@@ -1287,16 +894,6 @@ function stableJson(value) {
 		return "[unserializable payload omitted]";
 	}
 }
-function extractMessageText(message) {
-	if (!hasMessageContent(message)) return "";
-	if (typeof message.content === "string") return message.content;
-	if (!Array.isArray(message.content)) return "";
-	return message.content.flatMap((part) => {
-		if (!part || typeof part !== "object" || !("type" in part)) return [];
-		const record = part;
-		return record.type === "text" ? [typeof record.text === "string" ? record.text : ""] : [];
-	}).join("\n");
-}
 function hasMessageContent(message) {
 	return "content" in message;
 }
@@ -1312,13 +909,13 @@ function truncateText(text, maxChars) {
 	const truncated = truncateUtf16Safe(text, maxChars);
 	return `${truncated}\n[truncated ${text.length - truncated.length} chars]`;
 }
-function truncateOlderContext(text, maxChars) {
-	if (text.length <= maxChars) return text;
+function truncateOlderContext(text, maxChars, totalChars = text.length) {
+	if (totalChars <= maxChars) return text;
 	if (maxChars <= 0) return "";
 	const buildMarker = (omittedChars) => `[truncated ${omittedChars} chars from older context]\n`;
-	let marker = buildMarker(text.length - maxChars);
+	let marker = buildMarker(totalChars - maxChars);
 	let tailChars = Math.max(0, maxChars - marker.length);
-	marker = buildMarker(text.length - tailChars);
+	marker = buildMarker(totalChars - tailChars);
 	if (marker.length >= maxChars) return marker.slice(0, maxChars);
 	tailChars = maxChars - marker.length;
 	return `${marker}${sliceUtf16Safe(text, -tailChars).trimStart()}`;
@@ -1533,7 +1130,7 @@ function shouldRecheckRecoverablePluginBinding(params) {
 //#endregion
 //#region extensions/codex/src/app-server/thread-fingerprints.ts
 function codexDynamicToolsFingerprint(dynamicTools) {
-	return fingerprintDynamicTools(dynamicTools);
+	return hashCodexAppServerBindingFingerprint(legacyFingerprintDynamicTools(dynamicTools));
 }
 function codexLegacyDynamicToolsFingerprint(dynamicTools) {
 	return legacyFingerprintDynamicTools(dynamicTools);
@@ -1541,11 +1138,8 @@ function codexLegacyDynamicToolsFingerprint(dynamicTools) {
 function areCodexDynamicToolFingerprintsCompatible(params) {
 	return areDynamicToolFingerprintsCompatible(params.previous, params.next, params.nextLegacy);
 }
-function fingerprintDynamicTools(dynamicTools) {
-	return hashCodexAppServerBindingFingerprint(legacyFingerprintDynamicTools(dynamicTools));
-}
 function legacyFingerprintDynamicTools(dynamicTools) {
-	return JSON.stringify(dynamicTools.map(fingerprintDynamicToolSpec).toSorted(compareJsonFingerprint));
+	return JSON.stringify(dynamicTools.map(stabilizeJsonValue).toSorted(compareJsonFingerprint));
 }
 function legacyFingerprintUserMcpServersConfigPatch(configPatch) {
 	return configPatch ? JSON.stringify(stabilizeJsonValue(configPatch)) : void 0;
@@ -1556,15 +1150,10 @@ function fingerprintUserMcpServersConfigPatch(configPatch) {
 function redactUserMcpServersFingerprintSecrets(value) {
 	if (Array.isArray(value)) return value.map(redactUserMcpServersFingerprintSecrets);
 	if (!value || typeof value !== "object") return value;
-	const next = {};
-	for (const [key, entry] of Object.entries(value)) {
-		if (key === "http_headers" && entry && typeof entry === "object" && !Array.isArray(entry)) {
-			next[key] = Object.fromEntries(Object.entries(entry).map(([header, headerValue]) => [header, header.toLowerCase() === "authorization" ? fingerprintUserMcpServersAuthorizationHeader(headerValue) : headerValue]));
-			continue;
-		}
-		next[key] = redactUserMcpServersFingerprintSecrets(entry);
-	}
-	return next;
+	return Object.fromEntries(Object.entries(value).map(([key, entry]) => {
+		if (key === "http_headers" && entry && typeof entry === "object" && !Array.isArray(entry)) return [key, Object.fromEntries(Object.entries(entry).map(([header, headerValue]) => [header, header.toLowerCase() === "authorization" ? fingerprintUserMcpServersAuthorizationHeader(headerValue) : headerValue]))];
+		return [key, redactUserMcpServersFingerprintSecrets(entry)];
+	}));
 }
 function fingerprintUserMcpServersAuthorizationHeader(value) {
 	return typeof value === "string" && value.length > 0 ? `<redacted:sha256:${crypto$1.createHash("sha256").update(value).digest("hex")}>` : "<redacted>";
@@ -1589,15 +1178,10 @@ function fingerprintCodexThreadConfig(request, authProfileId, dynamicToolsFinger
 function fingerprintEnvironmentSelection(environments) {
 	return environments ? JSON.stringify(environments.map(stabilizeJsonValue)) : void 0;
 }
-function fingerprintDynamicToolSpec(tool) {
-	return stabilizeJsonValue(tool);
-}
 function stabilizeJsonValue(value) {
 	if (Array.isArray(value)) return value.map(stabilizeJsonValue);
 	if (!isJsonObject(value)) return value;
-	const stable = {};
-	for (const [key, child] of Object.entries(value).toSorted(([left], [right]) => left.localeCompare(right))) stable[key] = stabilizeJsonValue(child);
-	return stable;
+	return Object.fromEntries(Object.entries(value).toSorted(([left], [right]) => left.localeCompare(right)).map(([key, child]) => [key, stabilizeJsonValue(child)]));
 }
 function readActiveCodexTurnIds(thread) {
 	return (thread.turns ?? []).filter((turn) => turn.status === "inProgress").map((turn) => typeof turn.id === "string" ? turn.id : "").filter((turnId) => turnId.trim().length > 0);
@@ -1827,10 +1411,12 @@ function applyCodexNativeSkillIsolation(config, isolation) {
 function hasCodexNativeToolCatalog(binding) {
 	return binding?.connectionScope === "supervision" && !binding.pendingSupervisionBranch;
 }
-/** Pinned serde omits false deferLoading; every other declaration byte remains native-owned. */
+/** Pinned serde omits empty catalogs and false deferLoading; declarations remain native-owned. */
 function parseCodexNativeToolCatalog(metadata, threadId, fingerprint) {
 	const fail = () => /* @__PURE__ */ new Error("The canonical Codex native tool catalog is missing, corrupt, or changed; the thread is preserved. Reconnect and inspect its native metadata before retrying.");
-	if (!isJsonObject(metadata) || metadata.id !== threadId || !Array.isArray(metadata.dynamic_tools) || Buffer.byteLength(JSON.stringify(metadata.dynamic_tools)) > 1048576) throw fail();
+	if (!isJsonObject(metadata) || metadata.id !== threadId) throw fail();
+	const catalog = metadata.dynamic_tools ?? [];
+	if (!Array.isArray(catalog) || Buffer.byteLength(JSON.stringify(catalog)) > 1048576) throw fail();
 	const names = /* @__PURE__ */ new Set();
 	const namespaces = /* @__PURE__ */ new Set();
 	const validName = (name) => typeof name === "string" && /^[a-zA-Z0-9_-]{1,128}$/u.test(name);
@@ -1851,7 +1437,7 @@ function parseCodexNativeToolCatalog(metadata, threadId, fingerprint) {
 			...value.deferLoading === true ? { deferLoading: true } : {}
 		};
 	};
-	const tools = metadata.dynamic_tools.map((value) => {
+	const tools = catalog.map((value) => {
 		if (!isJsonObject(value) || value.type !== "namespace") return readFunction(value);
 		if (!validName(value.name) || namespaces.has(value.name) || typeof value.description !== "string" || !Array.isArray(value.tools) || !value.tools.length || Object.keys(value).some((key) => ![
 			"type",
@@ -1882,68 +1468,6 @@ async function loadCodexNativeToolCatalog(params) {
 	return parseCodexNativeToolCatalog(metadata, binding.threadId, binding.dynamicToolsFingerprint);
 }
 //#endregion
-//#region extensions/codex/src/app-server/managed-thread-store.ts
-const CODEX_MANAGED_THREAD_NAMESPACE = "app-server-managed-threads";
-const CODEX_MANAGED_THREAD_MAX_ENTRIES = 2e4;
-const managedThreadSchema = z.object({
-	version: z.literal(1),
-	kind: z.literal("managed-thread"),
-	sourceHomeId: z.string().min(1),
-	threadId: z.string().min(1),
-	rolloutPath: z.string().min(1).optional()
-});
-async function markStartedCodexManagedThread(store, params) {
-	if (!store) return;
-	try {
-		await store.mark({
-			sourceHomeId: params.sourceHomeId,
-			threadId: params.threadId,
-			...params.rolloutPath ? { rolloutPath: params.rolloutPath } : {}
-		});
-	} catch (error) {
-		embeddedAgentLog.warn("failed to record Codex managed thread ownership", { error });
-	}
-}
-function managedThreadStoreKey(sourceHomeId, threadId) {
-	return `sha256:${createHash("sha256").update("openclaw:codex-managed-thread:v1\0").update(sourceHomeId).update("\0").update(threadId).digest("hex")}`;
-}
-/** Durable ownership index for Codex threads created by OpenClaw. */
-function createCodexManagedThreadStore(state) {
-	return {
-		async has(sourceHomeId, threadId) {
-			const parsed = managedThreadSchema.safeParse(state.lookup(managedThreadStoreKey(sourceHomeId, threadId)));
-			return parsed.success && parsed.data.sourceHomeId === sourceHomeId && parsed.data.threadId === threadId;
-		},
-		async mark(params) {
-			try {
-				const value = managedThreadSchema.parse({
-					version: 1,
-					kind: "managed-thread",
-					sourceHomeId: params.sourceHomeId.trim(),
-					threadId: params.threadId.trim(),
-					...params.rolloutPath?.trim() ? { rolloutPath: params.rolloutPath.trim() } : {}
-				});
-				state.registerIfAbsent(managedThreadStoreKey(value.sourceHomeId, value.threadId), value);
-				return true;
-			} catch (error) {
-				embeddedAgentLog.warn("failed to record Codex managed thread ownership", { error });
-				return false;
-			}
-		},
-		async snapshot() {
-			const byHome = /* @__PURE__ */ new Map();
-			for (const entry of state.entries()) {
-				const parsed = managedThreadSchema.safeParse(entry.value);
-				if (!parsed.success) continue;
-				const ids = byHome.get(parsed.data.sourceHomeId) ?? /* @__PURE__ */ new Set();
-				ids.add(parsed.data.threadId);
-				byHome.set(parsed.data.sourceHomeId, ids);
-			}
-			return byHome;
-		}
-	};
-}
-//#endregion
 //#region extensions/codex/src/app-server/thread-mcp-attestation.ts
 async function attestCodexRestrictedToolSurfaceMcpServersDisabled(client, threadId, threadConfig, signal, expectedActiveServerNames = []) {
 	const configuredServers = threadConfig?.mcp_servers;
@@ -1982,14 +1506,13 @@ async function attestCodexRestrictedToolSurfaceMcpServersDisabled(client, thread
 //#endregion
 //#region extensions/codex/src/app-server/plugin-thread-attestation.ts
 /**
-* Confirms admitted plugin and account apps against their actual Codex thread before
-* OpenClaw commits a binding or starts a turn.
+* Checks app availability and enforces restricted MCP surfaces before a turn.
 */
 /** Every admission path checks the same surface; its lifecycle owner keeps the claim fenced. */
 async function attestCodexThreadToolSurface(params) {
 	params.assertCurrent();
 	if (params.appIds.length > 0) {
-		await params.lifecycleTiming.measure("plugin-app-attestation", () => attestCodexPluginThreadApps(params));
+		await params.lifecycleTiming.measure("plugin-app-attestation", () => checkCodexThreadAppAvailability(params));
 		params.assertCurrent();
 	}
 	if (params.restrictedToolSurface) {
@@ -2004,7 +1527,7 @@ var CodexPluginThreadAppAttestationError = class extends Error {
 	}
 };
 /** Reads the existing runtime snapshot with the started thread's effective app policy. */
-async function attestCodexPluginThreadApps(params) {
+async function checkCodexThreadAppAvailability(params) {
 	const appIds = Array.from(new Set(params.appIds.filter(Boolean))).toSorted();
 	if (appIds.length === 0) return;
 	let response;
@@ -2014,8 +1537,10 @@ async function attestCodexPluginThreadApps(params) {
 			forceRefresh: false
 		}, { signal: params.signal });
 	} catch (error) {
+		params.signal?.throwIfAborted();
 		throw new CodexPluginThreadAppAttestationError(`Codex could not confirm admitted apps for thread ${params.threadId}`, { cause: error });
 	}
+	params.signal?.throwIfAborted();
 	const installedById = new Map(response.apps.map((app) => [app.id, app]));
 	const failures = appIds.flatMap((appId) => {
 		const app = installedById.get(appId);
@@ -2023,7 +1548,10 @@ async function attestCodexPluginThreadApps(params) {
 		if (!app.enabled) return [`${appId}:disabled`];
 		return app.callable ? [] : [`${appId}:not-callable`];
 	});
-	if (failures.length > 0) throw new CodexPluginThreadAppAttestationError(`Codex thread ${params.threadId} did not expose admitted apps: ${failures.join(", ")}`);
+	if (failures.length > 0) embeddedAgentLog.warn("codex apps unavailable; continuing with remaining tools", {
+		threadId: params.threadId,
+		failures
+	});
 }
 /** Deletes a persistent pre-turn thread; ephemeral threads can only be unsubscribed. */
 async function discardUnattestedCodexPluginThread(params) {
@@ -2207,7 +1735,10 @@ function createCodexNativeHookRelay(params) {
 		}),
 		signal: params.signal,
 		runBeforeToolCall: params.hostCapabilities.runBeforeToolCall,
-		assertActive: params.hostCapabilities.assertActive,
+		assertActive: () => {
+			params.hostCapabilities.assertActive();
+			params.assertCurrent?.();
+		},
 		retention: {
 			readClaim: readCodexNativeChildThreadId,
 			shouldRetainAfterForegroundClose: () => successfulYieldRetentionAuthorized && directChildClaims.size > 0,
@@ -2523,7 +2054,6 @@ function buildDeveloperInstructions(params, options = {}) {
 	let hasSubagentsList = false;
 	let hasSessionsSend = false;
 	let hasSeenDirectNamespace = false;
-	let messageToolAvailable = options.dynamicTools ? false : params.disableMessageTool !== true;
 	for (const spec of options.dynamicTools ?? []) {
 		const isDirectNamespace = spec.type === "namespace" && !hasSeenDirectNamespace && spec.name.trim() === "openclaw_direct";
 		if (isDirectNamespace) hasSeenDirectNamespace = true;
@@ -2540,7 +2070,6 @@ function buildDeveloperInstructions(params, options = {}) {
 			hasSessionsYield ||= isDirectNamespace && name === "sessions_yield";
 			hasSubagentsList ||= name === "subagents";
 			hasSessionsSend ||= name === "sessions_send";
-			messageToolAvailable ||= name === "message";
 		}
 	}
 	const nativeCommandGuidance = listRegisteredPluginAgentPromptGuidance({
@@ -2570,15 +2099,11 @@ function buildDeveloperInstructions(params, options = {}) {
 			hasSubagentsList,
 			hasSessionsSend
 		}).join("\n") : void 0,
-		buildHarnessVisibleReplyGuidance({
-			sourceReplyDeliveryMode: params.sourceReplyDeliveryMode,
-			messageToolAvailable,
-			uiPresentation: params.disableTools !== true && params.promptMode !== "minimal" && params.promptMode !== "none" ? {
-				showWidgetToolName,
-				dashboardToolName,
-				portalToolName
-			} : void 0
-		}),
+		params.disableTools !== true && params.promptMode !== "minimal" && params.promptMode !== "none" ? buildUiPresentationPrompt({
+			showWidgetToolName,
+			dashboardToolName,
+			portalToolName
+		}) : void 0,
 		buildCredentialSafetyPrompt(secretsToolName),
 		nativeCommandGuidance,
 		params.extraSystemPrompt
@@ -2686,6 +2211,7 @@ function resolveCodexWebSearchPlan(params) {
 const CODEX_CODE_MODE_THREAD_CONFIG = {
 	"features.code_mode": true,
 	"features.code_mode_only": false,
+	"features.shell_tool": true,
 	"features.apply_patch_streaming_events": true,
 	suppress_unstable_features_warning: true
 };
@@ -2712,6 +2238,7 @@ const CODEX_RING_ZERO_RESTRICTED_FEATURES = /* @__PURE__ */ new Set([
 	"code_mode",
 	"code_mode_only",
 	"computer_use",
+	"context_management",
 	"current_time_reminder",
 	"default_mode_request_user_input",
 	"deferred_executor",
@@ -2764,15 +2291,6 @@ const CODEX_RING_ZERO_RESTRICTED_FEATURE_ALIASES = /* @__PURE__ */ new Map([
 	["telepathy", "chronicle"],
 	["codex_hooks", "hooks"]
 ]);
-const CODEX_RING_ZERO_OVERRIDABLE_LAYER_TYPES = /* @__PURE__ */ new Set([
-	"packagedDefaults",
-	"mdm",
-	"system",
-	"enterpriseManaged",
-	"user",
-	"project",
-	"sessionFlags"
-]);
 /** Common deterministic start/resume/fork fields; no run resources or unsupported setters. */
 function buildCodexThreadConfiguration(params, options) {
 	return {
@@ -2926,17 +2444,16 @@ function buildRestrictedToolConfigPatch(inheritedMcpServerNames, scheduledAppAut
 		...Object.keys(mcpServers).length > 0 ? { mcp_servers: mcpServers } : {}
 	};
 }
-async function readCodexInheritedMcpServerNames(client, cwd, signal) {
-	const response = await client.request("config/read", {
-		cwd,
-		includeLayers: true
-	}, { signal });
-	if (!isJsonObject(response) || !isJsonObject(response.config)) throw new Error("Codex config/read returned an invalid effective config");
+async function readCodexInheritedMcpServerNames(client, cwd, signal, effectiveConfig) {
+	const response = effectiveConfig ?? await readCodexEffectiveConfig(client, cwd, signal);
 	if (!Array.isArray(response.layers)) throw new Error("Codex config/read omitted effective config layers");
 	for (const layer of response.layers) {
 		if (!isJsonObject(layer) || !isJsonObject(layer.name) || typeof layer.name.type !== "string") throw new Error("Codex config/read returned invalid effective config layers");
-		if (layer.name.type === "legacyManagedConfigTomlFromFile" || layer.name.type === "legacyManagedConfigTomlFromMdm") throw new Error(`Codex restricted tool surface cannot override config layer ${layer.name.type}`);
-		if (!CODEX_RING_ZERO_OVERRIDABLE_LAYER_TYPES.has(layer.name.type)) throw new Error(`Codex restricted tool surface does not recognize config layer ${layer.name.type}`);
+		if (layer.name.type === "legacyManagedConfigTomlFromFile" || layer.name.type === "legacyManagedConfigTomlFromMdm") {
+			const migrationGuidance = layer.name.type === "legacyManagedConfigTomlFromFile" ? "migrate /etc/codex/managed_config.toml to /etc/codex/requirements.toml before running restricted or isolated turns. For ChatGPT-only authentication, use allowed_login_methods = [\"chatgpt\"] in /etc/codex/requirements.toml" : "replace the legacy MDM payload with base64-encoded TOML requirements in the com.openai.codex managed preference requirements_toml_base64 before running restricted or isolated turns. For ChatGPT-only authentication, include allowed_login_methods = [\"chatgpt\"] in that TOML payload";
+			throw new Error(`Codex restricted tool surface cannot override config layer ${layer.name.type}; ${migrationGuidance}.`);
+		}
+		if (!CODEX_SESSION_OVERRIDABLE_LAYER_TYPES.has(layer.name.type)) throw new Error(`Codex restricted tool surface does not recognize config layer ${layer.name.type}`);
 	}
 	const configuredServers = response.config.mcp_servers;
 	if (configuredServers === void 0) return [];
@@ -2968,6 +2485,7 @@ async function assertCodexManagedRequirementsDoNotOverrideToolPolicy(client, opt
 		for (const [feature, enabled] of Object.entries(featureRequirements)) {
 			if (typeof enabled !== "boolean") throw new Error("Codex configRequirements/read returned invalid feature requirements");
 			const canonicalFeature = CODEX_RING_ZERO_RESTRICTED_FEATURE_ALIASES.get(feature) ?? feature;
+			if (options.requiredNativeShell && canonicalFeature === "shell_tool" && !enabled) throw new Error("Codex native code mode requires shell_tool, but managed requirements disable it. Ask your administrator to allow the shell, or select a tool policy that disables native code mode; no automation authority was captured.");
 			const deniedByToolPolicy = options.restrictedToolSurface && CODEX_RING_ZERO_RESTRICTED_FEATURES.has(canonicalFeature) || additionalDeniedFeatures.has(canonicalFeature);
 			if (canonicalFeature === "hooks" && managedHooksAllowed) continue;
 			if (enabled && deniedByToolPolicy) throw new Error(`Codex tool policy cannot override required feature ${feature}`);
@@ -3262,11 +2780,6 @@ function appApprovalCeiling(mode) {
 	if (mode === "allow") return "approve";
 	return mode === "ask" ? "prompt" : "auto";
 }
-function stableStringify(value) {
-	if (Array.isArray(value)) return `[${value.map(stableStringify).join(",")}]`;
-	if (value && typeof value === "object") return `{${Object.entries(value).toSorted(([left], [right]) => left.localeCompare(right)).map(([key, item]) => `${JSON.stringify(key)}:${stableStringify(item)}`).join(",")}}`;
-	return JSON.stringify(value);
-}
 /** Intersects a stored app-ID cap with current policy without admitting new apps. */
 function intersectCodexPluginThreadConfigWithScheduledAuthority(config, authority, currentPolicy = {
 	config: {},
@@ -3296,13 +2809,17 @@ function intersectCodexPluginThreadConfigWithScheduledAuthority(config, authorit
 		};
 	}
 	const policyContext = buildPluginAppPolicyContext(apps, Object.fromEntries(Object.entries(config.policyContext.pluginAppIds).map(([key, ids]) => [key, ids.filter((id) => Object.hasOwn(apps, id))]).filter(([, ids]) => ids.length > 0)));
-	const configPatch = buildCodexPluginAppsConfigPatchFromPolicyContext(policyContext);
+	const configPatch = disableUnlistedCodexApps(buildCodexPluginAppsConfigPatchFromPolicyContext(policyContext), currentPolicy.config);
 	const appsPatch = asOptionalRecord(configPatch.apps);
 	for (const [appId, captured] of capturedById) {
 		const appPatch = asOptionalRecord(appsPatch?.[appId]);
 		if (!appPatch || !Object.hasOwn(apps, appId)) continue;
 		const currentApp = apps[appId];
 		if (!currentApp) continue;
+		if (currentApp.destructiveApprovalMode === "ask") Object.assign(appPatch, buildCodexAppApprovalOverrides(currentPolicy.config, {
+			id: appId,
+			approvalOverrideToolConfigKeys: []
+		}));
 		const storedAppCeiling = appApprovalCeiling(captured.destructiveApprovalMode);
 		const currentAppCeiling = appApprovalCeiling(defaultApprovalMode(currentApp));
 		const tools = currentPolicy.toolsByApp.get(appId) ?? /* @__PURE__ */ new Map();
@@ -3315,7 +2832,7 @@ function intersectCodexPluginThreadConfigWithScheduledAuthority(config, authorit
 			}];
 		}));
 	}
-	const fingerprint = crypto.createHash("sha256").update(stableStringify({
+	const fingerprint = crypto.createHash("sha256").update(stringifyCodexPluginPolicy({
 		version: 1,
 		namespace: CODEX_SCHEDULED_APP_AUTHORITY_NAMESPACE,
 		authority: scheduled,
@@ -3355,7 +2872,7 @@ function buildLegacyScheduledCodexAppRecoveryPrompt(params) {
 function buildScheduledCodexAppAuthorityInputFingerprint(baseFingerprint, authority) {
 	const scheduled = parseScheduledCodexAppAuthority(authority);
 	if (!scheduled) return baseFingerprint;
-	return crypto.createHash("sha256").update(stableStringify({
+	return crypto.createHash("sha256").update(stringifyCodexPluginPolicy({
 		version: 1,
 		namespace: CODEX_SCHEDULED_APP_AUTHORITY_NAMESPACE,
 		baseFingerprint,
@@ -3367,67 +2884,36 @@ function buildScheduledCodexAppAuthorityInputFingerprint(baseFingerprint, author
 const CODEX_THREAD_LIFECYCLE_TIMING_WARN_TOTAL_MS = 1e3;
 const CODEX_THREAD_LIFECYCLE_TIMING_WARN_STAGE_MS = 500;
 function shouldWarnCodexThreadLifecycleTimingSummary(summary, options = {}) {
-	const totalThresholdMs = options.totalThresholdMs ?? CODEX_THREAD_LIFECYCLE_TIMING_WARN_TOTAL_MS;
-	const stageThresholdMs = options.stageThresholdMs ?? CODEX_THREAD_LIFECYCLE_TIMING_WARN_STAGE_MS;
+	const detailed = options.enabled || options.log?.isEnabled?.("trace");
+	const totalThresholdMs = options.totalThresholdMs ?? (detailed ? CODEX_THREAD_LIFECYCLE_TIMING_WARN_TOTAL_MS : 1e4);
+	const stageThresholdMs = options.stageThresholdMs ?? (detailed ? CODEX_THREAD_LIFECYCLE_TIMING_WARN_STAGE_MS : 5e3);
 	return summary.totalMs >= totalThresholdMs || summary.spans.some((span) => span.durationMs >= stageThresholdMs);
 }
 function formatCodexThreadLifecycleTimingSummary(params) {
-	const spans = params.summary.spans.length > 0 ? params.summary.spans.map((span) => `${span.name}:${span.durationMs}ms@${span.elapsedMs}ms`).join(",") : "none";
+	const spans = formatStageTimings(params.summary.spans);
 	return `[trace:codex-app-server] thread lifecycle: runId=${params.runId} sessionId=${params.sessionId} sessionKey=${params.sessionKey ?? "unknown"} action=${params.action} totalMs=${params.summary.totalMs} stages=${spans}`;
 }
 function createCodexThreadLifecycleTimingTracker(options = {}) {
 	const log = options.log ?? embeddedAgentLog;
-	if (!options.enabled && log.isEnabled?.("trace") !== true) return {
-		async measure(_name, run) {
-			return await run();
-		},
-		measureSync(_name, run) {
-			return run();
-		},
-		mark() {},
-		logSummary() {}
-	};
-	const now = options.now ?? Date.now;
-	const startedAt = now();
+	const timing = createStageTimingTracker(options.now ?? Date.now);
 	let didLog = false;
-	const spans = [];
-	const toMs = (value) => Math.max(0, Math.round(value));
-	const record = (name, spanStartedAt) => {
-		const currentAt = now();
-		spans.push({
-			name,
-			durationMs: toMs(currentAt - spanStartedAt),
-			elapsedMs: toMs(currentAt - startedAt)
-		});
-	};
-	const snapshot = () => ({
-		totalMs: toMs(now() - startedAt),
-		spans: spans.slice()
-	});
 	return {
-		async measure(name, run) {
-			const spanStartedAt = now();
-			try {
-				return await run();
-			} finally {
-				record(name, spanStartedAt);
-			}
-		},
-		measureSync(name, run) {
-			const spanStartedAt = now();
-			try {
-				return run();
-			} finally {
-				record(name, spanStartedAt);
-			}
-		},
+		measure: timing.measure,
+		measureSync: timing.measureSync,
 		mark(name) {
-			record(name, now());
+			timing.measureSync(name, () => void 0);
 		},
 		logSummary(params) {
 			if (didLog) return;
-			const summary = snapshot();
-			const shouldWarn = shouldWarnCodexThreadLifecycleTimingSummary(summary, options);
+			const { totalMs, stages: spans } = timing.snapshot();
+			const summary = {
+				totalMs,
+				spans
+			};
+			const shouldWarn = shouldWarnCodexThreadLifecycleTimingSummary(summary, {
+				...options,
+				log
+			});
 			if (!shouldWarn && !log.isEnabled?.("trace")) return;
 			didLog = true;
 			const message = formatCodexThreadLifecycleTimingSummary({
@@ -3462,7 +2948,7 @@ function resolveCodexThreadAgentDir(params) {
 	return params.agentDir ?? params.params.agentDir ?? resolveAgentDir$1(params.params.config ?? {}, agentId);
 }
 async function prepareCodexThreadLifecyclePreflight(params) {
-	await assertCodexModelBackedReviewerEffectiveConfig({
+	let effectiveConfig = await assertCodexModelBackedReviewerEffectiveConfig({
 		client: params.client,
 		approvalsReviewer: params.appServer.approvalsReviewer,
 		cwd: params.cwd,
@@ -3518,13 +3004,17 @@ async function prepareCodexThreadLifecyclePreflight(params) {
 	const allowConfiguredManagedHooks = params.params.pluginHarnessToolPolicyRestricted === true && !ringZeroActive && !messageOnlySourceReply && params.params.scheduledRuntimeAuthority === void 0;
 	const imageGenerationDenied = params.params.pluginHarnessToolPolicySafeDeniedTools?.includes("image_generate") === true;
 	if (restrictedToolSurface && params.nativeCodeModeEnabled !== false) throw new Error("Codex restricted tool surfaces require native code mode to be disabled");
-	const restrictedToolSurfaceInheritedMcpServerNames = restrictedToolSurface ? await lifecycleTiming.measure("restricted-tool-surface-mcp-config-read", () => readCodexInheritedMcpServerNames(params.client, params.cwd, params.signal)) : [];
-	if (restrictedToolSurface || imageGenerationDenied) await lifecycleTiming.measure("tool-policy-config-requirements-read", () => assertCodexManagedRequirementsDoNotOverrideToolPolicy(params.client, {
+	if ((restrictedToolSurface || params.nativeCodeModeEnabled !== false) && !effectiveConfig) effectiveConfig = await lifecycleTiming.measure("tool-policy-config-read", () => readCodexEffectiveConfig(params.client, params.cwd, params.signal));
+	const restrictedToolSurfaceInheritedMcpServerNames = restrictedToolSurface ? await lifecycleTiming.measure("restricted-tool-surface-mcp-policy", () => readCodexInheritedMcpServerNames(params.client, params.cwd, params.signal, effectiveConfig)) : [];
+	if (restrictedToolSurface || imageGenerationDenied || params.nativeCodeModeEnabled !== false) await lifecycleTiming.measure("tool-policy-config-requirements-read", () => assertCodexManagedRequirementsDoNotOverrideToolPolicy(params.client, {
 		restrictedToolSurface,
+		requiredNativeShell: params.nativeCodeModeEnabled !== false,
 		additionalDeniedFeatures: imageGenerationDenied ? ["image_generation"] : void 0,
 		allowedManagedRequirementsFingerprint: readScheduledCodexAppManagedRequirementsFingerprint(params.params.scheduledRuntimeAuthority),
 		allowConfiguredManagedHooks
 	}, params.signal));
+	const features = effectiveConfig?.config.features;
+	if (params.nativeCodeModeEnabled !== false && isJsonObject(features) && features.shell_tool === false && !CODEX_SESSION_OVERRIDABLE_LAYER_TYPES.has(effectiveConfig?.origins?.["features.shell_tool"]?.name.type ?? "")) throw new Error("Codex native code mode requires shell_tool, but the effective shell setting cannot be overridden. Ask your administrator to allow the shell, or select a tool policy that disables native code mode; no automation authority was captured.");
 	const ringZeroConfigFingerprint = ringZeroActive ? fingerprintJsonObject({
 		version: 1,
 		baseInstructions: "",
@@ -3553,71 +3043,26 @@ async function prepareCodexThreadLifecyclePreflight(params) {
 	};
 }
 //#endregion
-//#region extensions/codex/src/app-server/thread-lifecycle-result.ts
+//#region extensions/codex/src/app-server/thread-lifecycle-io.ts
 function resolveCodexThreadRolloutPath(thread) {
 	const rolloutPath = thread.path?.trim();
 	if (!rolloutPath || !path.isAbsolute(rolloutPath) || path.extname(rolloutPath) !== ".jsonl" || !path.basename(rolloutPath).includes(thread.id)) return;
 	return rolloutPath;
 }
-/** Materializes the public lifecycle result after a fresh thread is durably committed. */
-function buildStartedCodexThreadBinding(input) {
-	const { context, params, response, startParams } = input;
-	return {
-		threadId: response.thread.id,
-		...input.clientId ? { clientId: input.clientId } : {},
-		cwd: params.cwd,
-		...input.rolloutPath ? { rolloutPath: input.rolloutPath } : {},
-		authProfileId: params.params.authProfileId,
-		agentWorkspaceDeveloperInstructions: params.agentWorkspaceDeveloperInstructions,
-		model: response.model ?? startParams.model ?? params.params.modelId,
-		modelProvider: response.modelProvider ?? input.startModelProvider ?? input.modelProvider,
-		dynamicToolsFingerprint: context.dynamicToolsFingerprint,
-		dynamicToolsContainDeferred: context.dynamicToolsContainDeferred,
-		nativeSkillIsolationFingerprint: context.nativeSkillIsolationFingerprint,
-		userMcpServersFingerprint: context.userMcpServersFingerprint,
-		mcpServersFingerprint: input.nextMcpServersFingerprint,
-		configuredMcpOwnershipVersion: params.configuredMcpOwnershipVersion,
-		ringZeroConfigFingerprint: context.ringZeroConfigFingerprint,
-		ringZeroClientInstanceId: context.ringZeroClientInstanceId,
-		networkProxyProfileName: params.appServer.networkProxy?.profileName,
-		networkProxyConfigFingerprint: context.networkProxyConfigFingerprint,
-		nativeHookRelayGeneration: input.finalConfigPatch.nativeHookRelayGeneration,
-		appServerRuntimeFingerprint: params.appServerRuntimeFingerprint,
-		pluginAppsFingerprint: input.pluginThreadConfig?.fingerprint,
-		pluginAppsInputFingerprint: input.pluginThreadConfig?.inputFingerprint,
-		pluginAppPolicyContext: input.pluginThreadConfig?.policyContext,
-		contextEngine: context.contextEngineBinding,
-		environmentSelectionFingerprint: context.environmentSelectionFingerprint,
-		...startParams.ephemeral ? { liveThreadEphemeralPolicy: startParams.developerInstructions } : {},
-		...!context.preserveExistingBinding ? { liveThreadConfigFingerprint: fingerprintCodexThreadConfig({
-			...startParams,
-			model: response.model ?? startParams.model ?? null,
-			requestedModel: startParams.model ?? null,
-			modelProvider: input.bindingModelProvider ?? null,
-			requestedModelProvider: startParams.modelProvider ?? input.bindingModelProvider ?? null
-		}, params.params.authProfileId, context.dynamicToolsFingerprint) } : {},
-		lifecycle: {
-			action: "started",
-			...context.rotatedContextEngineBinding ? { rotatedContextEngineBinding: true } : {}
-		}
-	};
-}
-//#endregion
-//#region extensions/codex/src/app-server/thread-lifecycle-io.ts
 async function resumeExistingCodexThread(params, context) {
 	const { binding: resumeBinding, bindingIdentity, startModelSelection, startModelProvider, userMcpServersConfigPatch, dynamicToolsFingerprint, dynamicToolsContainDeferred, webSearchThreadConfigFingerprint, nativeSkillIsolationFingerprint, userMcpServersFingerprint, ringZeroConfigFingerprint, ringZeroClientInstanceId, networkProxyConfigFingerprint, contextEngineBinding, environmentSelectionFingerprint, hostSystemAgentActive, restrictedToolSurface, restrictedToolSurfaceInheritedMcpServerNames, nativeSkillIsolation, lifecycleTiming, normalizeBindingModelProvider, throwIfAborted, clearCurrentBinding } = context;
+	let acceptedConfiguration;
+	let disposeConfiguration;
 	let resumeReservation;
-	let resumeResponseAccepted = false;
 	let ordinaryAppConfigChanged = false;
 	let policyOutcome = "not-written";
-	const assertHandoffCurrent = () => {
-		params.params.hostCapabilities.assertActive();
-		throwIfAborted();
-		context.assertResumeOwnership();
-		context.assertResumeConfiguration();
-	};
 	const abandonClient = params.abandonClient ?? (() => closeCodexStartupClientBestEffort(params.client));
 	try {
+		const configuration = await context.prepareResume();
+		const assertHandoffCurrent = configuration.assertConfigured;
+		disposeConfiguration = configuration.dispose;
+		await context.releaseRetainedThread(configuration.assertCurrent);
+		configuration.assertCurrent();
 		const authProfileId = resumeBinding.connectionScope === "supervision" ? void 0 : params.params.authProfileId ?? resumeBinding.authProfileId;
 		const finalConfigPatch = context.prebuiltFinalConfigPatch ?? params.buildFinalConfigPatch?.({
 			action: "resume",
@@ -3626,9 +3071,8 @@ async function resumeExistingCodexThread(params, context) {
 			configPatch: params.finalConfigPatch,
 			nativeHookRelayGeneration: params.nativeHookRelayGeneration
 		};
-		const pluginThreadConfig = context.prebuiltPluginThreadConfig ?? (params.pluginThreadConfig?.requiresCurrentPolicyCheck ? await lifecycleTiming.measure("plugin-config-build", () => params.pluginThreadConfig?.build()) : void 0);
-		const pluginAppsConfigPatch = pluginThreadConfig?.configPatch ?? (params.pluginThreadConfig?.enabled && resumeBinding.pluginAppPolicyContext ? buildCodexPluginAppsConfigPatchFromPolicyContext(resumeBinding.pluginAppPolicyContext) : void 0);
-		const resumeConfig = applyCodexNativeSkillIsolation(mergeCodexThreadConfigs(params.config, userMcpServersConfigPatch, pluginAppsConfigPatch, finalConfigPatch.configPatch), nativeSkillIsolation);
+		const pluginThreadConfig = context.prebuiltPluginThreadConfig ?? (params.pluginThreadConfig?.enabled ? await lifecycleTiming.measure("plugin-config-build", () => params.pluginThreadConfig?.build()) : void 0);
+		const resumeConfig = applyCodexNativeSkillIsolation(mergeCodexThreadConfigs(params.config, userMcpServersConfigPatch, pluginThreadConfig?.configPatch, finalConfigPatch.configPatch), nativeSkillIsolation);
 		const resumeParams = lifecycleTiming.measureSync("thread-resume-params", () => buildThreadResumeParams(params.params, {
 			threadId: resumeBinding.threadId,
 			cwd: params.cwd,
@@ -3657,11 +3101,12 @@ async function resumeExistingCodexThread(params, context) {
 			abandonClient,
 			request: resumeParams,
 			signal: params.signal,
-			assertCurrent: context.assertResumeOwnership
+			assertCurrent: configuration.assertCurrent
 		}));
-		resumeResponseAccepted = true;
+		acceptedConfiguration = configuration;
 		assertCodexThreadAcceptsDirectInput(response.thread);
-		context.assertResumeConfiguration();
+		configuration.assertConfigured();
+		if (requestModelProvider && response.modelProvider !== requestModelProvider) throw new Error("Codex resumed a different model provider than the one selected for this turn");
 		const loadedPluginThreadConfig = await context.buildLoadedPluginThreadConfig?.(resumeBinding);
 		if (loadedPluginThreadConfig && loadedPluginThreadConfig.fingerprint !== (pluginThreadConfig?.fingerprint ?? resumeBinding.pluginAppsFingerprint)) {
 			ordinaryAppConfigChanged = resumeBinding.connectionScope !== "supervision" && !resumeBinding.pendingResumeConfiguration;
@@ -3695,7 +3140,7 @@ async function resumeExistingCodexThread(params, context) {
 			cwd: params.cwd,
 			rolloutPath: resolveCodexThreadRolloutPath(response.thread) ?? resumeBinding.rolloutPath,
 			authProfileId,
-			model: response.model ?? resumeParams.model ?? params.params.modelId,
+			model: resumeParams.model ?? response.model ?? params.params.modelId,
 			preserveNativeModel: resumeBinding.preserveNativeModel === true ? true : void 0,
 			modelProvider: normalizeBindingModelProvider(authProfileId, response.modelProvider ?? requestModelProvider ?? startModelProvider),
 			dynamicToolsFingerprint,
@@ -3760,13 +3205,13 @@ async function resumeExistingCodexThread(params, context) {
 		};
 	} catch (error) {
 		resumeReservation?.release();
-		if (!resumeResponseAccepted && (!(error instanceof CodexAppServerRpcError) || isCodexAppServerOverloadError(error))) throw error;
-		if (resumeResponseAccepted) {
+		if (!acceptedConfiguration && (!(error instanceof CodexAppServerRpcError) || error.method === "thread/read" && !isCodexThreadReadMissingError(error, resumeBinding.threadId) || isCodexAppServerOverloadError(error))) throw error;
+		if (acceptedConfiguration) {
 			const handoffError = error instanceof CodexThreadPolicyHandoffError || error instanceof CodexAppServerUnsafeSubscriptionError ? error : new CodexThreadPolicyHandoffError(policyOutcome, error);
 			const subscriptionReleased = await unsubscribeCodexThreadBestEffort(params.client, {
 				threadId: resumeBinding.threadId,
 				timeoutMs: CODEX_APP_SERVER_UNSUBSCRIBE_TIMEOUT_MS,
-				assertCurrent: context.assertResumeOwnership
+				assertCurrent: acceptedConfiguration.assertCurrent
 			}).catch(() => false);
 			if (!subscriptionReleased || handoffError instanceof CodexThreadPolicyHandoffError && handoffError.outcome === "unknown") {
 				if (resumeBinding.connectionScope === "supervision") await retireUnsafeCodexTurnClientBestEffort(params.client, "session policy handoff");
@@ -3777,11 +3222,13 @@ async function resumeExistingCodexThread(params, context) {
 				}
 			}
 			if (!ordinaryAppConfigChanged || !subscriptionReleased) throw handoffError;
-			assertHandoffCurrent();
+			acceptedConfiguration.assertConfigured();
 		}
-		if (resumeBinding.pendingResumeConfiguration || resumeBinding.connectionScope === "supervision" || params.signal?.aborted) throw error;
+		if (resumeBinding.pendingResumeConfiguration || resumeBinding.preserveNativeModel || resumeBinding.connectionScope === "supervision" || params.signal?.aborted) throw error;
 		embeddedAgentLog.warn("codex app-server thread resume failed; starting a new thread", { error });
 		await clearCurrentBinding("rotating a stale thread binding");
+	} finally {
+		disposeConfiguration?.();
 	}
 }
 async function startFreshCodexThread(params, context) {
@@ -3812,9 +3259,18 @@ async function startFreshCodexThread(params, context) {
 		disableLoginShell: params.disableLoginShell
 	}));
 	const requestModelProvider = typeof startParams.modelProvider === "string" && startParams.modelProvider.trim() ? startParams.modelProvider : void 0;
+	const assertCurrent = () => {
+		throwIfAborted();
+		params.params.hostCapabilities.assertActive();
+		params.assertCurrent?.();
+	};
 	const threadStartResponse = await lifecycleTiming.measure("thread-start-request", async () => {
 		try {
-			return await params.client.request("thread/start", startParams, { signal: params.signal });
+			assertCurrent();
+			return await params.client.request("thread/start", startParams, {
+				signal: params.signal,
+				assertCurrent
+			});
 		} catch (error) {
 			if (error instanceof CodexAppServerRpcError) throw new CodexThreadStartRequestError(error);
 			throw error;
@@ -3822,10 +3278,6 @@ async function startFreshCodexThread(params, context) {
 	});
 	const response = assertCodexThreadStartResponse(threadStartResponse);
 	const provisionalAppIds = pluginThreadConfig?.provisionalAppIds;
-	const assertCurrent = () => {
-		throwIfAborted();
-		params.params.hostCapabilities.assertActive();
-	};
 	const rejectUncommittedThread = async (cause) => {
 		if (!await discardUnattestedCodexPluginThread({
 			client: params.client,
@@ -3862,35 +3314,38 @@ async function startFreshCodexThread(params, context) {
 	});
 	const bindingModelProvider = normalizeBindingModelProvider(params.params.authProfileId, response.modelProvider ?? requestModelProvider ?? startModelProvider ?? modelProvider);
 	const nextMcpServersFingerprint = params.mcpServersFingerprintEvaluated === true ? params.mcpServersFingerprint : void 0;
+	const startedBinding = {
+		threadId: response.thread.id,
+		...clientId ? { clientId } : {},
+		cwd: params.cwd,
+		...rolloutPath ? { rolloutPath } : {},
+		authProfileId: params.params.authProfileId,
+		agentWorkspaceDeveloperInstructions: params.agentWorkspaceDeveloperInstructions,
+		model: response.model ?? startParams.model ?? params.params.modelId,
+		modelProvider: bindingModelProvider,
+		dynamicToolsFingerprint,
+		dynamicToolsContainDeferred,
+		nativeSkillIsolationFingerprint,
+		userMcpServersFingerprint,
+		mcpServersFingerprint: nextMcpServersFingerprint,
+		configuredMcpOwnershipVersion: params.configuredMcpOwnershipVersion,
+		ringZeroConfigFingerprint,
+		ringZeroClientInstanceId,
+		networkProxyProfileName: params.appServer.networkProxy?.profileName,
+		networkProxyConfigFingerprint,
+		nativeHookRelayGeneration: finalConfigPatch.nativeHookRelayGeneration,
+		appServerRuntimeFingerprint: params.appServerRuntimeFingerprint,
+		pluginAppsFingerprint: pluginThreadConfig?.fingerprint,
+		pluginAppsInputFingerprint: pluginThreadConfig?.inputFingerprint,
+		pluginAppPolicyContext: pluginThreadConfig?.policyContext,
+		contextEngine: contextEngineBinding,
+		environmentSelectionFingerprint
+	};
 	if (!preserveExistingBinding) {
 		const nextBinding = {
-			threadId: response.thread.id,
-			...clientId ? { clientId } : {},
-			cwd: params.cwd,
-			...rolloutPath ? { rolloutPath } : {},
-			authProfileId: params.params.authProfileId,
-			agentWorkspaceDeveloperInstructions: params.agentWorkspaceDeveloperInstructions,
-			model: response.model ?? startParams.model ?? params.params.modelId,
-			modelProvider: bindingModelProvider,
-			dynamicToolsFingerprint,
-			dynamicToolsContainDeferred,
+			...startedBinding,
 			webSearchThreadConfigFingerprint,
-			nativeSkillIsolationFingerprint,
-			userMcpServersFingerprint,
-			mcpServersFingerprint: nextMcpServersFingerprint,
-			configuredMcpOwnershipVersion: params.configuredMcpOwnershipVersion,
-			ringZeroConfigFingerprint,
-			ringZeroClientInstanceId,
-			nativeToolPolicyRestricted: restrictedToolSurface ? true : void 0,
-			networkProxyProfileName: params.appServer.networkProxy?.profileName,
-			networkProxyConfigFingerprint,
-			nativeHookRelayGeneration: finalConfigPatch.nativeHookRelayGeneration,
-			appServerRuntimeFingerprint: params.appServerRuntimeFingerprint,
-			pluginAppsFingerprint: pluginThreadConfig?.fingerprint,
-			pluginAppsInputFingerprint: pluginThreadConfig?.inputFingerprint,
-			pluginAppPolicyContext: pluginThreadConfig?.policyContext,
-			contextEngine: contextEngineBinding,
-			environmentSelectionFingerprint
+			nativeToolPolicyRestricted: restrictedToolSurface ? true : void 0
 		};
 		const managedSourceHomeId = codexCatalogHomeId(resolveCodexAppServerLocalHomeDir(params.appServer.start, resolveCodexThreadAgentDir(params)));
 		let committed;
@@ -3931,20 +3386,22 @@ async function startFreshCodexThread(params, context) {
 		threadId: response.thread.id,
 		action: rotatedContextEngineBinding ? "rotated" : "started"
 	});
-	return buildStartedCodexThreadBinding({
-		bindingModelProvider,
-		clientId,
-		context,
-		finalConfigPatch,
-		nextMcpServersFingerprint,
-		params,
-		pluginThreadConfig,
-		response,
-		rolloutPath,
-		startModelProvider: requestModelProvider ?? startModelProvider,
-		startParams,
-		modelProvider
-	});
+	return {
+		...startedBinding,
+		modelProvider: response.modelProvider ?? requestModelProvider ?? startModelProvider ?? modelProvider,
+		...startParams.ephemeral ? { liveThreadEphemeralPolicy: startParams.developerInstructions } : {},
+		...!preserveExistingBinding ? { liveThreadConfigFingerprint: fingerprintCodexThreadConfig({
+			...startParams,
+			model: response.model ?? startParams.model ?? null,
+			requestedModel: startParams.model ?? null,
+			modelProvider: bindingModelProvider ?? null,
+			requestedModelProvider: startParams.modelProvider ?? bindingModelProvider ?? null
+		}, params.params.authProfileId, dynamicToolsFingerprint) } : {},
+		lifecycle: {
+			action: "started",
+			...rotatedContextEngineBinding ? { rotatedContextEngineBinding: true } : {}
+		}
+	};
 }
 //#endregion
 //#region extensions/codex/src/app-server/thread-lifecycle-warm.ts
@@ -4032,6 +3489,7 @@ async function tryReuseCodexLiveThread(options) {
 		try {
 			retainedThread.assertCurrent();
 			params.params.hostCapabilities.assertActive();
+			params.assertCurrent?.();
 		} catch (cause) {
 			throw new AgentHarnessPreflightError("Codex warm thread ownership changed before this turn could run. No turn was sent; reconnect before continuing, or start a new conversation if the original thread was closed.", { cause });
 		}
@@ -4163,11 +3621,14 @@ async function tryReuseCodexLiveThread(options) {
 //#endregion
 //#region extensions/codex/src/app-server/thread-lifecycle-adoption.ts
 /** Passive refusal must precede releasing or acquiring any native subscription. */
-async function assertAdoptedCodexThreadResumeAllowed(params, threadId, context) {
+async function assertAdoptedCodexThreadResumeAllowed(params, threadId, context, assertCurrent) {
 	const { thread } = await context.lifecycleTiming.measure("thread-read-adoption-status", () => params.client.request("thread/read", {
 		threadId,
 		includeTurns: false
-	}, { signal: params.signal }));
+	}, {
+		signal: params.signal,
+		assertCurrent
+	}));
 	context.throwIfAborted();
 	assertCodexThreadAcceptsDirectInput(thread);
 	if (thread.status?.type === "active") throw new CodexAdoptedThreadActiveError();
@@ -4182,13 +3643,25 @@ async function withCodexThreadLifecycleBinding(params, run) {
 		agentId: params.agentId ?? params.params.agentId,
 		config: params.params.config
 	});
-	const snapshot = await params.bindingStore.read(identity);
+	const { binding: snapshot, assertCurrent } = await resolveCodexSessionBinding({
+		reclaimStale: true,
+		bindingStore: params.bindingStore,
+		identity,
+		config: params.params.config,
+		storePath: params.params.sessionTarget?.storePath,
+		assertCurrent: () => {
+			params.params.hostCapabilities.assertActive();
+			params.assertCurrent?.();
+		},
+		signal: params.signal,
+		assertBinding: params.params.expectedSessionRuntimeOwnership ? (binding) => assertCodexSessionRuntimeOwnership(binding, params.params.expectedSessionRuntimeOwnership) : void 0
+	});
 	const runWithLease = () => params.bindingStore.withLease(identity, async () => {
-		const binding = await params.bindingStore.read(identity);
+		const binding = params.bindingStore.read(identity);
+		assertCodexSessionRuntimeOwnership(binding, params.params.expectedSessionRuntimeOwnership);
 		if (binding?.threadId !== snapshot?.threadId || binding?.clientId !== snapshot?.clientId) throw new CodexThreadBindingConflictError(binding?.threadId ?? snapshot?.threadId ?? params.params.sessionId, "acquiring thread lifecycle ownership");
-		params.params.hostCapabilities.assertActive();
-		params.signal?.throwIfAborted();
-		return await run(identity, binding);
+		assertCurrent();
+		return await run(identity, binding, assertCurrent);
 	});
 	return snapshot?.pendingResumeConfiguration ? await withExclusiveCodexAppServerThread({
 		bindingStore: params.bindingStore,
@@ -4206,32 +3679,27 @@ async function resumePendingCodexThread(params, context) {
 	})) throw new Error(`Cannot configure resumed Codex thread ${binding.threadId} under a transient or incompatible session policy. The thread is preserved; retry from its normal session or use /new for the current policy.`);
 	const prebuiltPluginThreadConfig = params.pluginThreadConfig?.enabled ? await lifecycleTiming.measure("plugin-config-build", () => params.pluginThreadConfig?.build()) : void 0;
 	const clientId = resolveCodexAppServerClientInstanceId(params.client);
-	const configuration = await preparePendingCodexThreadResume(params, binding, context.dynamicToolsFingerprint, async (assertCurrent) => {
-		const released = await context.releaseRetainedThread(binding.threadId, assertCurrent);
-		assertCurrent();
-		if (!released || binding.clientId && binding.clientId !== clientId) await releaseCodexConsumedLiveThread({
-			client: params.client,
-			abandonClient: params.abandonClient,
-			lifecycleTiming,
-			threadId: binding.threadId,
-			assertCurrent
-		});
+	const resumed = await resumeExistingCodexThread(params, {
+		...context,
+		prebuiltPluginThreadConfig,
+		prepareResume: () => preparePendingCodexThreadResume(params, binding, context.dynamicToolsFingerprint),
+		releaseRetainedThread: async (assertCurrent) => {
+			const released = await context.releaseRetainedThread(binding.threadId, assertCurrent);
+			assertCurrent();
+			if (!released || binding.clientId && binding.clientId !== clientId) await releaseCodexConsumedLiveThread({
+				client: params.client,
+				abandonClient: params.abandonClient,
+				lifecycleTiming,
+				threadId: binding.threadId,
+				assertCurrent
+			});
+		}
 	});
-	try {
-		const resumed = await resumeExistingCodexThread(params, {
-			...context,
-			prebuiltPluginThreadConfig,
-			assertResumeConfiguration: configuration.assertConfigured,
-			assertResumeOwnership: configuration.assertCurrent
-		});
-		if (!resumed) throw new Error(`Codex did not configure resumed thread ${binding.threadId}.`);
-		return resumed;
-	} finally {
-		configuration.dispose();
-	}
+	if (!resumed) throw new Error(`Codex did not configure resumed thread ${binding.threadId}.`);
+	return resumed;
 }
 /** Manual attachment is intent, never evidence that loaded native overrides took effect. */
-async function preparePendingCodexThreadResume(params, binding, dynamicToolsFingerprint, releaseSubscription) {
+async function preparePendingCodexThreadResume(params, binding, dynamicToolsFingerprint) {
 	const fail = (reason) => /* @__PURE__ */ new Error(`Cannot configure resumed Codex thread ${binding.threadId}: ${reason}. The thread is preserved; continue it in native Codex or use /new for the current OpenClaw tools.`);
 	const agentDir = resolveCodexThreadAgentDir(params);
 	const localHome = resolveCodexAppServerLocalHomeDir(params.appServer.start, agentDir);
@@ -4240,6 +3708,7 @@ async function preparePendingCodexThreadResume(params, binding, dynamicToolsFing
 	const assertClient = captureCodexAppServerClientLifetime(params.client, "native-process");
 	const assertCurrent = () => {
 		params.params.hostCapabilities.assertActive();
+		params.assertCurrent?.();
 		params.signal?.throwIfAborted();
 		assertClient();
 		if (isCodexAppServerLiveThreadClaimed(params.client, binding.threadId)) throw new CodexAdoptedThreadActiveError();
@@ -4248,10 +3717,12 @@ async function preparePendingCodexThreadResume(params, binding, dynamicToolsFing
 	const { thread } = await params.client.request("thread/read", {
 		threadId: binding.threadId,
 		includeTurns: false
-	}, { signal: params.signal });
+	}, {
+		signal: params.signal,
+		assertCurrent
+	});
 	assertCurrent();
-	const statusType = thread.status?.type;
-	if (thread.id !== binding.threadId || statusType !== "idle" && statusType !== "notLoaded") throw fail("the native thread is not idle; wait for its current run to finish");
+	if (thread.id !== binding.threadId || !isCodexThreadNonRunning(thread.status)) throw fail("the native thread is not idle; wait for its current run to finish");
 	assertCodexThreadAcceptsDirectInput(thread);
 	const observation = observeCodexThreadConfiguration(params, thread, assertCurrent);
 	const dispose = observation.dispose;
@@ -4262,8 +3733,6 @@ async function preparePendingCodexThreadResume(params, binding, dynamicToolsFing
 		const recordedTools = metadata.dynamic_tools ?? [];
 		if (!Array.isArray(recordedTools) || codexDynamicToolsFingerprint(recordedTools) !== dynamicToolsFingerprint) throw fail("its immutable native tool catalog does not match the current OpenClaw tools");
 		assertCurrent();
-		await releaseSubscription(assertCurrent);
-		assertCurrent();
 		return {
 			assertConfigured: observation.assertConfigured,
 			assertCurrent,
@@ -4279,21 +3748,29 @@ async function prepareCodexThreadResume(params, binding, context) {
 	const assertClient = captureCodexAppServerClientLifetime(params.client, binding.connectionScope === "supervision" ? "connection" : "native-process");
 	const assertCurrent = () => {
 		params.params.hostCapabilities.assertActive();
+		params.assertCurrent?.();
 		params.signal?.throwIfAborted();
 		assertClient();
 		if (isCodexAppServerLiveThreadClaimed(params.client, binding.threadId)) throw new CodexAdoptedThreadActiveError();
 	};
 	assertCurrent();
-	const thread = await assertAdoptedCodexThreadResumeAllowed(params, binding.threadId, context);
-	assertCurrent();
+	let thread;
+	try {
+		thread = await assertAdoptedCodexThreadResumeAllowed(params, binding.threadId, context, assertCurrent);
+	} finally {
+		assertCurrent();
+	}
 	assertCodexSupervisionThreadLineage(binding, thread);
 	return {
 		...observeCodexThreadConfiguration(params, thread, assertCurrent),
 		assertCurrent
 	};
 }
+function isCodexThreadNonRunning(status) {
+	return status?.type === "idle" || status?.type === "notLoaded" || status?.type === "systemError";
+}
 function observeCodexThreadConfiguration(params, thread, assertCurrent) {
-	if (thread.status?.type !== "idle" && thread.status?.type !== "notLoaded") throw new CodexAdoptedThreadActiveError();
+	if (!isCodexThreadNonRunning(thread.status)) throw new CodexAdoptedThreadActiveError();
 	let unloaded = thread.status.type === "notLoaded";
 	return {
 		dispose: params.client.addNotificationHandler((notification) => {
@@ -4309,6 +3786,10 @@ function observeCodexThreadConfiguration(params, thread, assertCurrent) {
 //#region extensions/codex/src/app-server/thread-supervision.ts
 async function materializePendingSupervisionBranch(params) {
 	let pending = params.binding.pendingSupervisionBranch;
+	const requestOptions = {
+		signal: params.signal,
+		assertCurrent: params.throwIfAborted
+	};
 	const connectionFingerprint = buildCodexAppServerConnectionFingerprint(params.appServer, params.attempt.agentDir);
 	if (!pending.connectionFingerprint || pending.connectionFingerprint !== connectionFingerprint) throw new Error("Codex supervision source connection changed before branch materialization");
 	pending = await recoverPendingSupervisionArtifacts(params, pending);
@@ -4316,7 +3797,7 @@ async function materializePendingSupervisionBranch(params) {
 	const sourceResponse = await params.lifecycleTiming.measure("supervision-source-read", () => params.client.request("thread/read", {
 		threadId: pending.sourceThreadId,
 		includeTurns: true
-	}, { signal: params.signal }));
+	}, requestOptions));
 	params.throwIfAborted();
 	const sourceThread = sourceResponse.thread;
 	if (sourceThread.id !== pending.sourceThreadId) throw new Error(`Codex supervision source read returned ${sourceThread.id} for ${pending.sourceThreadId}`);
@@ -4342,7 +3823,7 @@ async function materializePendingSupervisionBranch(params) {
 			});
 		} catch (error) {
 			try {
-				const current = await params.bindingStore.read(params.bindingIdentity);
+				const current = params.bindingStore.read(params.bindingIdentity);
 				if (matchesPendingSupervisionState(current, pending)) cleanupExpected = pending;
 				else if (matchesPendingSupervisionState(current, expected)) cleanupExpected = expected;
 				else throw new CodexThreadBindingConflictError(pending.sourceThreadId, "verifying supervised Codex cleanup tracking");
@@ -4359,7 +3840,7 @@ async function materializePendingSupervisionBranch(params) {
 		const probeParams = buildPendingSupervisionProbeForkParams(params, pending);
 		const rawProbeResponse = await params.lifecycleTiming.measure("supervision-model-probe-fork", async () => {
 			try {
-				return await params.client.request("thread/fork", probeParams, { signal: params.signal });
+				return await params.client.request("thread/fork", probeParams, requestOptions);
 			} catch (error) {
 				if (!(error instanceof CodexAppServerRpcError)) throw new CodexAppServerUnsafeSubscriptionError("Codex model probe fork may have materialized without a response", { cause: error });
 				throw error;
@@ -4414,7 +3895,7 @@ async function materializePendingSupervisionBranch(params) {
 		});
 		const rawStartResponse = await params.lifecycleTiming.measure("supervision-thread-start", async () => {
 			try {
-				return await params.client.request("thread/start", startParams, { signal: params.signal });
+				return await params.client.request("thread/start", startParams, requestOptions);
 			} catch (error) {
 				if (error instanceof CodexAppServerRpcError) throw new CodexThreadStartRequestError(error);
 				throw new CodexAppServerUnsafeSubscriptionError("Canonical Codex branch may have started without a response", { cause: error });
@@ -4435,7 +3916,7 @@ async function materializePendingSupervisionBranch(params) {
 		});
 		if (params.restrictedToolSurface) await params.lifecycleTiming.measure("restricted-tool-surface-mcp-attestation", () => attestCodexRestrictedToolSurfaceMcpServersDisabled(params.client, finalThreadId, startParams.config, params.signal));
 		if (params.provisionalAppIds?.length) try {
-			await params.lifecycleTiming.measure("plugin-app-attestation", () => attestCodexPluginThreadApps({
+			await params.lifecycleTiming.measure("plugin-app-attestation", () => checkCodexThreadAppAvailability({
 				client: params.client,
 				threadId: finalThreadId,
 				appIds: params.provisionalAppIds ?? [],
@@ -4457,7 +3938,7 @@ async function materializePendingSupervisionBranch(params) {
 			await params.lifecycleTiming.measure("supervision-history-inject", () => params.client.request("thread/inject_items", {
 				threadId: finalThreadId,
 				items: history.responseItems
-			}, { signal: params.signal }));
+			}, requestOptions));
 			params.throwIfAborted();
 		}
 		const historyCoveredThrough = (/* @__PURE__ */ new Date()).toISOString();
@@ -4474,11 +3955,11 @@ async function materializePendingSupervisionBranch(params) {
 					modelProvider: bindingModelProvider,
 					historyCoveredThrough
 				}
-			});
+			}, params.throwIfAborted);
 		} catch (error) {
 			let current;
 			try {
-				current = await params.bindingStore.read(params.bindingIdentity);
+				current = params.bindingStore.read(params.bindingIdentity);
 			} catch (readError) {
 				provisionalCleanupSafe = false;
 				throw new CodexAppServerUnsafeSubscriptionError(`Canonical Codex branch binding could not be verified: ${finalThreadId}`, { cause: new AggregateError([error, readError]) });
@@ -4669,11 +4150,16 @@ async function archiveSupervisionArtifact(client, threadId) {
 }
 //#endregion
 //#region extensions/codex/src/app-server/thread-lifecycle-run.ts
-async function startOrResumeThread(params) {
-	const incognito = isIncognitoSessionKey(params.params.sessionKey);
-	const clientId = resolveCodexAppServerClientInstanceId(params.client);
-	return await withCodexThreadLifecycleBinding(params, async (bindingIdentity, currentBinding) => {
-		let binding = currentBinding;
+async function startOrResumeThread(input) {
+	const incognito = isIncognitoSessionKey(input.params.sessionKey);
+	const clientId = resolveCodexAppServerClientInstanceId(input.client);
+	return await withCodexThreadLifecycleBinding(input, async (bindingIdentity, saved, assert) => {
+		const params = {
+			...input,
+			assertCurrent: assert
+		};
+		const expectedOwnership = params.params.expectedSessionRuntimeOwnership;
+		let binding = saved;
 		if (hasCodexNativeToolCatalog(binding)) {
 			const nativeCatalog = await loadCodexNativeToolCatalog({
 				client: params.client,
@@ -4682,7 +4168,7 @@ async function startOrResumeThread(params) {
 				agentDir: resolveCodexThreadAgentDir(params),
 				assertCurrent: () => {
 					params.signal?.throwIfAborted();
-					params.params.hostCapabilities.assertActive();
+					assert();
 				}
 			});
 			if (!isDeepStrictEqual(params.dynamicTools, nativeCatalog)) throw new Error("Canonical Codex declarations changed after tool preparation; retry the turn on its preserved native thread.");
@@ -4709,13 +4195,6 @@ async function startOrResumeThread(params) {
 			threadId,
 			assertCurrent
 		});
-		if (!binding && bindingIdentity.kind === "session" && bindingIdentity.sessionKey) {
-			if (!await lifecycleTiming.measure("reclaim-binding-generation", () => reclaimCurrentCodexSessionGeneration({
-				bindingStore: params.bindingStore,
-				identity: bindingIdentity,
-				config: params.params.config
-			}))) throw createCodexSessionGenerationSupersededError(bindingIdentity.sessionId);
-		}
 		if (binding?.pendingSupervisionBranch) {
 			await releaseRetainedThread(binding.threadId);
 			const pendingBinding = binding;
@@ -4749,7 +4228,10 @@ async function startOrResumeThread(params) {
 				environmentSelection: params.environmentSelection,
 				provisionalAppIds: pluginThreadConfig?.provisionalAppIds,
 				signal: params.signal,
-				throwIfAborted,
+				throwIfAborted: () => {
+					throwIfAborted();
+					assert();
+				},
 				lifecycleTiming,
 				normalizeBindingModelProvider,
 				bindingPatch: {
@@ -4781,11 +4263,11 @@ async function startOrResumeThread(params) {
 		const clearCurrentBinding = async (operation) => {
 			const current = binding;
 			if (!current?.threadId) return;
-			assertCodexBindingMayBeReplaced(current, operation);
+			assertCodexBindingMayBeReplaced(current, operation, expectedOwnership);
 			if (!await params.bindingStore.mutate(bindingIdentity, {
 				kind: "clear",
 				threadId: current.threadId
-			})) throw new CodexThreadBindingConflictError(current.threadId, operation);
+			}, assert)) throw new CodexThreadBindingConflictError(current.threadId, operation);
 			binding = void 0;
 		};
 		const resolveRequestContext = () => {
@@ -4879,14 +4361,14 @@ async function startOrResumeThread(params) {
 		const unknownProviderWebSearchSupport = params.nativeProviderWebSearchSupport === "unknown";
 		if (binding?.threadId && (params.configuredMcpOwnershipVersion === 1 && (binding.configuredMcpOwnershipVersion !== 1 || binding.dynamicToolsFingerprint === void 0 || binding.mcpServersFingerprint !== void 0 || binding.userMcpServersFingerprint !== void 0) || params.configuredMcpOwnershipVersion !== 1 && binding.configuredMcpOwnershipVersion === 1) && binding?.threadId) {
 			const predecessorBinding = binding;
-			assertCodexBindingMayBeReplaced(predecessorBinding, "changing configured MCP ownership");
+			assertCodexBindingMayBeReplaced(predecessorBinding, "changing configured MCP ownership", expectedOwnership);
 			embeddedAgentLog.debug("codex app-server configured MCP ownership changed; starting a new thread", { threadId: predecessorBinding.threadId });
 			replacementPredecessor = predecessorBinding;
 			binding = void 0;
 			preserveExistingBinding = false;
 		}
 		if (binding?.threadId && params.mcpServersFingerprintEvaluated === true && binding.mcpServersFingerprint !== params.mcpServersFingerprint) {
-			assertCodexBindingMayBeReplaced(binding, "changing MCP configuration");
+			assertCodexBindingMayBeReplaced(binding, "changing MCP configuration", expectedOwnership);
 			if (!ringZeroActive && (transientNativeToolRestriction || webSearchBindingChanged && (explicitTransientWebSearchRestriction || unknownProviderWebSearchSupport))) {
 				embeddedAgentLog.debug("codex app-server MCP config changed during transient restricted turn; starting transient thread", { threadId: binding.threadId });
 				preserveExistingBinding = true;
@@ -4898,7 +4380,7 @@ async function startOrResumeThread(params) {
 		}
 		const deferLegacyWebSearchRotationToTransientNativeSurface = params.nativeCodeModeEnabled === false && binding?.webSearchThreadConfigFingerprint === void 0 && !persistentWebSearchRestriction;
 		if (binding?.threadId && webSearchBindingChanged && !deferLegacyWebSearchRotationToTransientNativeSurface) {
-			assertCodexBindingMayBeReplaced(binding, "changing web-search configuration");
+			assertCodexBindingMayBeReplaced(binding, "changing web-search configuration", expectedOwnership);
 			if (!ringZeroActive && transientWebSearchRestriction) {
 				embeddedAgentLog.debug("codex app-server tool surface restricted for turn; starting transient thread", { threadId: binding.threadId });
 				preserveExistingBinding = true;
@@ -4909,13 +4391,13 @@ async function startOrResumeThread(params) {
 			binding = void 0;
 		}
 		if (binding?.threadId && transientNativeToolRestriction && !ringZeroActive) {
-			assertCodexBindingMayBeReplaced(binding, "starting a native-tool-restricted turn");
+			assertCodexBindingMayBeReplaced(binding, "starting a native-tool-restricted turn", expectedOwnership);
 			embeddedAgentLog.debug("codex app-server native tool surface disabled for turn; starting transient thread", { threadId: binding.threadId });
 			preserveExistingBinding = true;
 			binding = void 0;
 		}
 		if (binding?.threadId && transientDelegationRestriction) {
-			assertCodexBindingMayBeReplaced(binding, "starting a delegation-restricted turn");
+			assertCodexBindingMayBeReplaced(binding, "starting a delegation-restricted turn", expectedOwnership);
 			embeddedAgentLog.debug("codex app-server delegation restricted for turn; starting transient thread", { threadId: binding.threadId });
 			binding = void 0;
 		}
@@ -4973,7 +4455,7 @@ async function startOrResumeThread(params) {
 		}
 		if (binding?.threadId) {
 			if (binding.dynamicToolsFingerprint && !areDynamicToolFingerprintsCompatible(binding.dynamicToolsFingerprint, dynamicToolsFingerprint, legacyDynamicToolsFingerprint)) {
-				assertCodexBindingMayBeReplaced(binding, "changing the dynamic tool catalog");
+				assertCodexBindingMayBeReplaced(binding, "changing the dynamic tool catalog", expectedOwnership);
 				preserveExistingBinding = shouldStartTransientNoToolThread({
 					previous: binding.dynamicToolsFingerprint,
 					nextHasDynamicTools: params.dynamicTools.length > 0
@@ -4996,27 +4478,24 @@ async function startOrResumeThread(params) {
 					throwIfAborted();
 					await clearCurrentBinding(incognito ? "rotating an unavailable ephemeral thread binding" : "rotating a stale plugin app binding");
 				} else {
-					const configuration = await prepareCodexThreadResume(params, binding, requestContext);
-					try {
-						await releaseRetainedThread(binding.threadId, binding.clientId, configuration.assertCurrent);
-						configuration.assertCurrent();
-						const resumed = await resumeExistingCodexThread(params, {
-							...requestContext,
-							binding,
-							clearCurrentBinding,
-							prebuiltFinalConfigPatch: warmReuse.prebuiltFinalConfigPatch,
-							prebuiltPluginThreadConfig,
-							buildLoadedPluginThreadConfig,
-							assertResumeOwnership: configuration.assertCurrent,
-							assertResumeConfiguration: configuration.assertConfigured
-						});
-						if (resumed) return resumed;
-					} finally {
-						configuration.dispose();
-					}
+					const resumeBinding = binding;
+					const resumed = await resumeExistingCodexThread(params, {
+						...requestContext,
+						binding: resumeBinding,
+						clearCurrentBinding,
+						prebuiltFinalConfigPatch: warmReuse.prebuiltFinalConfigPatch,
+						prebuiltPluginThreadConfig,
+						buildLoadedPluginThreadConfig,
+						prepareResume: () => prepareCodexThreadResume(params, resumeBinding, requestContext),
+						releaseRetainedThread: async (assertCurrent) => {
+							await releaseRetainedThread(resumeBinding.threadId, resumeBinding.clientId, assertCurrent);
+						}
+					});
+					if (resumed) return resumed;
 				}
 			}
 		}
+		assertCodexBindingMayBeReplaced(binding, "starting a fresh native thread", expectedOwnership);
 		if (initialBoundThreadId && !preserveExistingBinding && !replacementPredecessor) await releaseRetainedThread(initialBoundThreadId);
 		const started = await startFreshCodexThread(params, {
 			...requestContext,
@@ -5139,6 +4618,17 @@ function buildTurnStartParams(params, options) {
 	const useThreadPermissionProfile = options.appServer.networkProxy && !options.sandboxPolicy;
 	const currentSenderContext = params.trigger === "user" ? buildCodexCurrentSenderContextValue(params) : void 0;
 	let additionalContext = buildCodexTemporalAdditionalContext(params, { sessionStatusAvailable: options.sessionStatusAvailable === true });
+	additionalContext = {
+		...additionalContext,
+		openclaw_source_delivery: {
+			kind: "application",
+			value: ["Current source-delivery policy for this turn (replaces earlier source-delivery guidance):", buildHarnessVisibleReplyGuidance({
+				sourceReplyDeliveryMode: params.sourceReplyDeliveryMode,
+				messageToolAvailable: options.messageToolAvailable === true,
+				requireExplicitMessageTarget: options.requireExplicitMessageTarget
+			})].join("\n")
+		}
+	};
 	if (currentSenderContext) additionalContext = {
 		...additionalContext,
 		openclaw_current_sender: {
@@ -5231,4 +4721,4 @@ function joinPresentSections(...sections) {
 	return sections.filter((section) => Boolean(section?.trim())).join("\n\n");
 }
 //#endregion
-export { resolveCodexNativeSkillIsolation as $, readCodexMcpToolConnectorId as A, refreshCodexPluginRuntimeState as At, emitCodexNativePreToolUseFailureDiagnostic as B, buildDeveloperInstructions as C, buildCodexPluginThreadConfig as Ct, resolveCodexAppServerThreadModelSelection as D, mergeCodexThreadConfigs as Dt, resolveCodexAppServerRequestModelSelection as E, buildDisabledAppsConfigPatch as Et, assertCodexNativeHookRelayAllowed as F, attestCodexRestrictedToolSurfaceMcpServersDisabled as G, resolveCodexNativeHookRelayTtlMs as H, buildCodexNativeHookRelayConfig as I, createCodexManagedThreadStore as J, CODEX_MANAGED_THREAD_MAX_ENTRIES as K, buildCodexNativeHookRelayDisabledConfig as L, isCodexAppServerProfilerEnabled as M, isOpenAiCuratedMarketplaceName as Mt, CODEX_NATIVE_HOOK_RELAY_EVENTS as N, pluginReadParams as Nt, resolveCodexBindingModelProviderFallback as O, shouldBuildCodexPluginThreadConfig as Ot, CODEX_NATIVE_HOOK_RELAY_TTL_GRACE_MS as P, resolveRecoverableCodexPluginConfigKeys as Pt, applyCodexNativeSkillIsolation as Q, buildCodexNativeHookRelayId as R, resolveCodexWebSearchPlan as S, buildCodexPluginAppsConfigPatchFromPolicyContext as St, resolveCodexAppServerModelProvider as T, buildCodexPluginThreadConfigTimeoutFallback as Tt, scheduleCodexNativeHookRelayUnregister as U, resolveCodexNativeHookRelayEvents as V, attestCodexPluginThreadApps as W, loadCodexNativeToolCatalog as X, hasCodexNativeToolCatalog as Y, parseCodexNativeToolCatalog as Z, buildCodexRingZeroThreadConfigPatch as _, neutralizeCodexExplicitMentionSigils as _t, readCodexSupportedReasoningEfforts as a, filterCodexDynamicTools as at, readCodexInheritedMcpServerNames as b, resolveCodexContextEngineProjectionReserveTokens as bt, assertScheduledCodexAppAuthorityRuntime as c, isMessageOnlyCodexSourceReply as ct, buildScheduledCodexAppServerConnectionIdentity as d, resolveCodexDynamicToolsLoading as dt, areCodexDynamicToolFingerprintsCompatible as et, captureScheduledCodexAppAuthority as f, resolveCodexDynamicToolsLoadingForRuntime as ft, assertCodexManagedRequirementsDoNotOverrideToolPolicy as g, fitCodexProjectedContextForTurnStart as gt, resolveScheduledCodexAppCreatorCaptureDecision as h, buildCodexContinuityCalibration as ht, buildCodexUserInput as i, fingerprintUserMcpServersConfigPatch as it, readCodexMcpToolUiVisibility as j, isOpenAiCuratedMarketplace as jt, buildCodexProjectDocThreadConfig as k, ensureCodexPluginActivation as kt, buildLegacyScheduledCodexAppRecoveryPrompt as l, isSystemAgentOnlyCodexDynamicToolAllowlist as lt, readCurrentCodexScheduledAppPolicy as m, isContextEngineBindingCompatible as mt, buildTurnCollaborationMode as n, codexLegacyDynamicToolsFingerprint as nt, resolveCodexAppServerReasoningEffort as o, filterCodexDynamicToolsForDisabledNativeSurface as ot, intersectCodexPluginThreadConfigWithScheduledAuthority as p, buildContextEngineBinding as pt, CODEX_MANAGED_THREAD_NAMESPACE as q, buildTurnStartParams as r, fingerprintJsonObject as rt, startOrResumeThread as s, isForcedPrivateQaCodexRuntime as st, buildCodexTemporalAdditionalContext as t, codexDynamicToolsFingerprint as tt, buildScheduledCodexAppAuthorityInputFingerprint as u, normalizeCodexDynamicToolName as ut, buildCodexRuntimeThreadConfig as v, projectContextEngineAssemblyForCodex as vt, CODEX_NATIVE_PERSONALITY_NONE as w, buildCodexPluginThreadConfigInputFingerprint as wt, buildCodexNativeWebSearchThreadConfig as x, resolveCodexContinuityProjectionMaxChars as xt, buildCodexThreadConfiguration as y, resolveCodexContextEngineProjectionMaxChars as yt, createCodexNativeHookRelay as z };
+export { codexLegacyDynamicToolsFingerprint as $, readCodexMcpToolConnectorId as A, emitCodexNativePreToolUseFailureDiagnostic as B, buildDeveloperInstructions as C, buildCodexPluginThreadConfigTimeoutFallback as Ct, resolveCodexAppServerThreadModelSelection as D, shouldBuildCodexPluginThreadConfig as Dt, resolveCodexAppServerRequestModelSelection as E, refreshCodexPluginAppApprovalPolicy as Et, assertCodexNativeHookRelayAllowed as F, attestCodexRestrictedToolSurfaceMcpServersDisabled as G, resolveCodexNativeHookRelayTtlMs as H, buildCodexNativeHookRelayConfig as I, parseCodexNativeToolCatalog as J, hasCodexNativeToolCatalog as K, buildCodexNativeHookRelayDisabledConfig as L, isCodexAppServerProfilerEnabled as M, CODEX_NATIVE_HOOK_RELAY_EVENTS as N, resolveCodexBindingModelProviderFallback as O, CODEX_NATIVE_HOOK_RELAY_TTL_GRACE_MS as P, codexDynamicToolsFingerprint as Q, buildCodexNativeHookRelayId as R, resolveCodexWebSearchPlan as S, buildCodexPluginThreadConfigInputFingerprint as St, resolveCodexAppServerModelProvider as T, mergeCodexThreadConfigs as Tt, scheduleCodexNativeHookRelayUnregister as U, resolveCodexNativeHookRelayEvents as V, checkCodexThreadAppAvailability as W, resolveCodexNativeSkillIsolation as X, applyCodexNativeSkillIsolation as Y, areCodexDynamicToolFingerprintsCompatible as Z, buildCodexRingZeroThreadConfigPatch as _, projectContextEngineAssemblyForCodex as _t, readCodexSupportedReasoningEfforts as a, isMessageOnlyCodexSourceReply as at, readCodexInheritedMcpServerNames as b, resolveCodexContinuityProjectionMaxChars as bt, assertScheduledCodexAppAuthorityRuntime as c, resolveCodexDynamicToolsLoading as ct, buildScheduledCodexAppServerConnectionIdentity as d, isContextEngineBindingCompatible as dt, fingerprintJsonObject as et, captureScheduledCodexAppAuthority as f, CodexContextAttachmentError as ft, assertCodexManagedRequirementsDoNotOverrideToolPolicy as g, neutralizeCodexExplicitMentionSigils as gt, resolveScheduledCodexAppCreatorCaptureDecision as h, isCodexDurableCustomMessage as ht, buildCodexUserInput as i, isForcedPrivateQaCodexRuntime as it, readCodexMcpToolUiVisibility as j, buildCodexProjectDocThreadConfig as k, buildLegacyScheduledCodexAppRecoveryPrompt as l, resolveCodexDynamicToolsLoadingForRuntime as lt, readCurrentCodexScheduledAppPolicy as m, fitCodexProjectedContextForTurnStart as mt, buildTurnCollaborationMode as n, filterCodexDynamicTools as nt, resolveCodexAppServerReasoningEffort as o, isSystemAgentOnlyCodexDynamicToolAllowlist as ot, intersectCodexPluginThreadConfigWithScheduledAuthority as p, buildCodexContinuityCalibration as pt, loadCodexNativeToolCatalog as q, buildTurnStartParams as r, filterCodexDynamicToolsForDisabledNativeSurface as rt, startOrResumeThread as s, normalizeCodexDynamicToolName as st, buildCodexTemporalAdditionalContext as t, fingerprintUserMcpServersConfigPatch as tt, buildScheduledCodexAppAuthorityInputFingerprint as u, buildContextEngineBinding as ut, buildCodexRuntimeThreadConfig as v, resolveCodexContextEngineProjectionMaxChars as vt, CODEX_NATIVE_PERSONALITY_NONE as w, buildDisabledAppsConfigPatch as wt, buildCodexNativeWebSearchThreadConfig as x, buildCodexPluginThreadConfig as xt, buildCodexThreadConfiguration as y, resolveCodexContextEngineProjectionReserveTokens as yt, createCodexNativeHookRelay as z };