@openclaw/codex 2026.9.3 → 2026.9.5

package/dist/{dynamic-tools-D-JBoaLt.js → .setup/dynamic-tools-D16lOp67.mjs}

@@ -1,13 +1,17 @@
-import { a as flattenCodexDynamicToolFunctions, o as isJsonObject, r as CODEX_OPENCLAW_DIRECT_DYNAMIC_TOOL_NAMESPACE, x as readCodexPluginConfig, y as isCodexRemoteExecPlacementSandbox } from "./protocol-CAAcVIKF.js";
-import { B as withDynamicToolTranscriptDetails, E as createCodexElicitationResponse, L as resolveCodexToolAbortTerminalReason, R as createFailedDynamicToolResponse, w as readCodexTurn, z as withDynamicToolExecutionState } from "./client-BEKu4yDx.js";
-import { a as formatCodexDisplayText } from "./command-formatters-DeTfrapr.js";
-import "./config-JDfTI4VI.js";
-import { r as sanitizeInlineImageDataUrl, t as invalidInlineImageText } from "./image-payload-sanitizer-tupAr-2o.js";
-import { E as itemStatus, L as readItem, T as itemName, b as auditNativeToolUnfinishedStatus, h as isCodexNotificationForTurn, k as shouldClearTerminalPresentationForNativeItem, v as auditNativeToolName, y as auditNativeToolTerminalStatus } from "./attempt-client-cleanup-D6cR54TV.js";
-import { B as emitCodexNativePreToolUseFailureDiagnostic, S as resolveCodexWebSearchPlan, it as isForcedPrivateQaCodexRuntime, nt as filterCodexDynamicTools, ot as isSystemAgentOnlyCodexDynamicToolAllowlist, rt as filterCodexDynamicToolsForDisabledNativeSurface, st as normalizeCodexDynamicToolName } from "./thread-lifecycle-D1pzRwHB.js";
-import { n as resolveCodexNativeExecutionPolicy, r as resolveCodexNodeExecToolOverrides } from "./native-execution-policy-umd0tgh4.js";
-import { a as CODEX_NODE_EXEC_DYNAMIC_TOOL_NAME, c as createNodeExecAliasDynamicTool, i as CODEX_GATEWAY_PROCESS_DYNAMIC_TOOL_NAME, l as isCodexDynamicToolExcluded, o as createGatewayExecProjection, r as CODEX_GATEWAY_EXEC_DYNAMIC_TOOL_NAME, s as createGatewayProcessProjection } from "./provider-capabilities-W4tfK5Y5.js";
-import { a as requestPluginApprovalOutcome, c as truncateCodexApprovalDisplayText, i as requestPluginApproval, l as waitForPluginApprovalDecision, n as codexApprovalTimeoutText, o as sanitizeCodexApprovalVisibleText, r as mapExecDecisionToOutcome, s as stripDanglingCodexApprovalTerminalSequence, t as approvalRequestExplicitlyUnavailable } from "./plugin-approval-roundtrip-DeW95wB5.js";
+import { CODEX_NATIVE_TOOL_REQUIREMENTS } from "../native-tool-policy.js";
+import { d as CODEX_OPENCLAW_DIRECT_DYNAMIC_TOOL_NAMESPACE, m as isJsonObject, p as flattenCodexDynamicToolFunctions } from "./config-security-BRQ2mgW9.mjs";
+import { d as readCodexPluginConfig, l as isCodexRemoteExecPlacementSandbox } from "./config-parsing-CcB9iPoq.mjs";
+import { B as withDynamicToolTranscriptDetails, E as createCodexElicitationResponse, L as resolveCodexToolAbortTerminalReason, R as createFailedDynamicToolResponse, w as readCodexTurn, z as withDynamicToolExecutionState } from "./client-vXs2929Q.mjs";
+import { o as formatCodexDisplayText } from "./command-formatters-CGEkdawF.mjs";
+import { c as itemName, f as shouldClearTerminalPresentationForNativeItem, l as itemStatus, n as auditNativeToolTerminalStatus, r as auditNativeToolUnfinishedStatus, t as auditNativeToolName, x as readItem } from "./event-projector-items-DyTQ_XqL.mjs";
+import { s as codexAppIdentityKey } from "./plugin-app-cache-key-BOxKP7db.mjs";
+import "./config-CedDWjM-.mjs";
+import { r as sanitizeInlineImageDataUrl, t as invalidInlineImageText } from "./image-payload-sanitizer-tupAr-2o.mjs";
+import { v as isCodexNotificationForTurn } from "./attempt-client-cleanup-BpYKdTA0.mjs";
+import { H as emitCodexNativePreToolUseFailureDiagnostic, at as filterCodexDynamicToolsForDisabledNativeSurface, ct as isSystemAgentOnlyCodexDynamicToolAllowlist, it as filterCodexDynamicTools, lt as normalizeCodexDynamicToolName, ot as isForcedPrivateQaCodexRuntime, w as resolveCodexWebSearchPlan } from "./thread-lifecycle-Cik28qWn.mjs";
+import { n as resolveCodexNativeExecutionPolicy, r as resolveCodexNodeExecToolOverrides } from "./native-execution-policy-YBMHSzC4.mjs";
+import { a as CODEX_NODE_EXEC_DYNAMIC_TOOL_NAME, c as createNodeExecAliasDynamicTool, i as CODEX_GATEWAY_PROCESS_DYNAMIC_TOOL_NAME, l as isCodexDynamicToolExcluded, o as createGatewayExecProjection, r as CODEX_GATEWAY_EXEC_DYNAMIC_TOOL_NAME, s as createGatewayProcessProjection } from "./provider-capabilities-B8J4Dy-O.mjs";
+import { a as requestPluginApprovalOutcome, c as truncateCodexApprovalDisplayText, i as requestPluginApproval, l as waitForPluginApprovalDecision, n as codexApprovalTimeoutText, o as sanitizeCodexApprovalVisibleText, r as mapExecDecisionToOutcome, s as stripDanglingCodexApprovalTerminalSequence, t as approvalRequestExplicitlyUnavailable } from "./plugin-approval-roundtrip-CjfzafAZ.mjs";
 import { createRequire } from "node:module";
 import { asNonArrayRecord, asOptionalRecord, isRecord, normalizeOptionalString, normalizeTrimmedStringList, readStringField } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { createHash, randomUUID } from "node:crypto";
@@ -20,22 +24,22 @@ import { once } from "node:events";
 import { spawn } from "node:child_process";
 import { coerceErrorMessage } from "openclaw/plugin-sdk/error-runtime";
 import { DEFAULT_MAX_LIVE_TOOL_RESULT_CHARS, estimateToolResultTextChars, resolveLiveToolResultMaxChars, sliceToolResultTextToBudget, sliceUtf16Safe, truncateUtf16Safe } from "openclaw/plugin-sdk/text-utility-runtime";
+import { emitTrustedDiagnosticEvent } from "openclaw/plugin-sdk/diagnostic-runtime";
 import { createDeferred } from "openclaw/plugin-sdk/extension-shared";
 import { createStageTimingTracker, formatStageTimings } from "openclaw/plugin-sdk/time-runtime";
 import { isPathStrictlyInside, root } from "openclaw/plugin-sdk/file-access-runtime";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { resolveAgentDir } from "openclaw/plugin-sdk/agent-runtime";
-import { HEARTBEAT_RESPONSE_TOOL_NAME, buildAgentHookContextChannelFields, buildEmbeddedAttemptToolRunContext, consumeAdjustedParamsForToolCall, consumePreExecutionBlockedToolCall, createAgentToolResultMiddlewareRunner, createCodexAppServerToolResultExtensionRunner, embeddedAgentLog, extractMessagingToolSend, extractMessagingToolSendResult, extractToolResultMediaArtifact, filterProviderNormalizableTools, filterToolResultMediaUrls, finalizeAgentToolAvailability, finalizeToolTerminalPresentation, formatApprovalDisplayPath, formatToolExecutionErrorMessage, getBeforeToolCallFailureDisposition, getChannelAgentToolMeta, getPluginToolMeta, getPluginToolSideEffectOwnerKey, hasNativeHookRelayInvocation, invokeNativeHookRelay, isDeliveredMessageToolOnlySourceReplyResult, isDeliveredMessagingToolResult, isHostScopedAgentToolActive, isMessagingTool, isMessagingToolSendAction, isReplaySafeToolCall, isSubagentSessionKey, isToolResultError, isToolWrappedWithBeforeToolCallHook, normalizeAgentRuntimeTools, normalizeHeartbeatToolResponse, projectRuntimeToolInputSchema, resolveAttemptSpawnWorkspaceDir, resolveModelAuthMode, resolveNativeHookRelayDeferredToolApproval, resolveToolExecutionErrorKind, resolveToolResultFailureKind, runAgentHarnessAfterToolCallHook, sanitizeToolResult, setBeforeToolCallDiagnosticsEnabled, supportsModelTools, wrapToolWithBeforeToolCallHook } from "openclaw/plugin-sdk/agent-harness-runtime";
+import { HEARTBEAT_RESPONSE_TOOL_NAME, applyEmbeddedAttemptToolsAllow, buildAgentHookContextChannelFields, buildEmbeddedAttemptToolRunContext, consumeAdjustedParamsForToolCall, consumePreExecutionBlockedToolCall, createAgentToolResultMiddlewareRunner, createCodexAppServerToolResultExtensionRunner, embeddedAgentLog, extractMessagingToolSend, extractMessagingToolSendResult, extractToolResultMediaArtifact, filterProviderNormalizableTools, filterToolResultMediaUrls, finalizeAgentToolAvailability, finalizeToolTerminalPresentation, formatApprovalDisplayPath, formatToolExecutionErrorMessage, getBeforeToolCallFailureDisposition, getChannelAgentToolMeta, getPluginToolMeta, getPluginToolSideEffectOwnerKey, hasNativeHookRelayInvocation, invokeNativeHookRelay, isDeliveredMessageToolOnlySourceReplyResult, isDeliveredMessagingToolResult, isHostScopedAgentToolActive, isMessagingTool, isMessagingToolSendAction, isReplaySafeToolCall, isSubagentSessionKey, isToolResultError, isToolWrappedWithBeforeToolCallHook, normalizeAgentRuntimeTools, normalizeHeartbeatToolResponse, projectRuntimeToolInputSchema, resolveAttemptSpawnWorkspaceDir, resolveModelAuthMode, resolveNativeHookRelayDeferredToolApproval, resolveToolExecutionErrorKind, resolveToolResultFailureKind, runAgentHarnessAfterToolCallHook, sanitizeToolResult, setBeforeToolCallDiagnosticsEnabled, supportsModelTools, wrapToolWithBeforeToolCallHook } from "openclaw/plugin-sdk/agent-harness-runtime";
 import { formatErrorMessage as formatErrorMessage$2, redactSensitiveText } from "openclaw/plugin-sdk/security-runtime";
-import { emitTrustedDiagnosticEvent } from "openclaw/plugin-sdk/diagnostic-runtime";
+import { consumeTrustedToolNoStartError, copyInternalToolResultState, getCoreTtsToolResultMediaUrls } from "openclaw/plugin-sdk/agent-harness-tool-runtime";
 import { isIP } from "node:net";
 import { redactToolPayloadText } from "openclaw/plugin-sdk/logging-core";
 import { formatMcpCodexApprovalRemedy, requiresMcpCodexToolApproval, resolveCodexScheduledToolProjectionFactory, resolveProjectedMcpCodexToolApprovalMode, runWithCronCreatorAuthorityCapabilityResolver } from "openclaw/plugin-sdk/codex-mcp-projection";
 import { buildRemoteCommand, isToolAllowed, sanitizeEnvVars } from "openclaw/plugin-sdk/sandbox";
+import { SsrFBlockedError, isBlockedHostnameOrIp } from "openclaw/plugin-sdk/ssrf-runtime";
 import { saveMediaBuffer } from "openclaw/plugin-sdk/media-store";
 import { getMediaDir } from "openclaw/plugin-sdk/media-runtime";
-import { consumeTrustedToolNoStartError, copyInternalToolResultState, getCoreTtsToolResultMediaUrls } from "openclaw/plugin-sdk/agent-harness-tool-runtime";
-import { SsrFBlockedError, isBlockedHostnameOrIp } from "openclaw/plugin-sdk/ssrf-runtime";
 import { normalizeOpenAIStrictCompatSchema } from "openclaw/plugin-sdk/provider-tools";
 //#region extensions/codex/src/app-server/dynamic-tool-build-state.ts
 /** Mutable dependency seam shared by dynamic-tool construction and its behavioral tests. */
@@ -105,14 +109,6 @@ function filterCodexVisionTools(tools, params) {
 * OpenClaw-owned tools, Codex native-tool fallback rules, sandbox shell shims,
 * and provider allowlist normalization.
 */
-const CODEX_NATIVE_SANDBOX_TOOL_REQUIREMENTS = [
-	"exec",
-	"process",
-	"read",
-	"write",
-	"edit",
-	"apply_patch"
-];
 const CODEX_MEMORY_FLUSH_DYNAMIC_TOOL_ALLOW = /* @__PURE__ */ new Set(["read", "write"]);
 const CODEX_DISABLED_NATIVE_SHELL_DYNAMIC_TOOLS = /* @__PURE__ */ new Set([
 	"exec",
@@ -209,6 +205,7 @@ async function buildDynamicTools(input) {
 		nativeToolSurfaceEnabled: input.nativeToolSurfaceEnabled,
 		nativeProviderWebSearchSupport: input.nativeProviderWebSearchSupport
 	});
+	const messageToolProvider = resolveCodexMessageToolProvider(params);
 	const webFetchHostnameAllowlistRef = {};
 	const toolConstructionPlan = resolveCodexNodePlacementToolConstructionPlan(input.sandbox, input.nativeToolSurfaceEnabled);
 	const options = {
@@ -228,11 +225,11 @@ async function buildDynamicTools(input) {
 		} : void 0,
 		sandbox: input.sandbox,
 		...toolConstructionPlan ? { toolConstructionPlan } : {},
-		messageProvider: resolveCodexMessageToolProvider(params),
+		messageProvider: messageToolProvider,
 		toolPolicyMessageProvider: params.messageProvider ?? params.messageChannel,
 		...params.onToolResult ? { questionPrompt: {
 			send: params.onToolResult,
-			...params.messageChannel ? { messageChannel: params.messageChannel } : {}
+			messageChannel: messageToolProvider
 		} } : {},
 		inputProvenance: params.inputProvenance,
 		trustedInternalHandoff: params.trustedInternalHandoff,
@@ -335,7 +332,7 @@ async function buildDynamicTools(input) {
 			agentId: input.policyAgentId,
 			sessionKey: input.sandboxSessionKey,
 			sandboxToolPolicy: input.sandbox?.tools,
-			messageProvider: resolveCodexMessageToolProvider(params),
+			messageProvider: messageToolProvider,
 			agentAccountId: params.agentAccountId,
 			groupId: params.groupId,
 			groupChannel: params.groupChannel,
@@ -456,7 +453,7 @@ function canCodexAppServerNativeToolSurfaceHonorSandbox(sandbox, options = {}) {
 	return false;
 }
 function canSandboxToolPolicyExposeCodexNativeToolSurface(sandbox) {
-	return CODEX_NATIVE_SANDBOX_TOOL_REQUIREMENTS.every((toolName) => isToolAllowed(sandbox.tools, toolName));
+	return CODEX_NATIVE_TOOL_REQUIREMENTS.every((toolName) => isToolAllowed(sandbox.tools, toolName));
 }
 function isCodexMemoryFlushRun(params) {
 	return params?.trigger === "memory" && Boolean(params.memoryFlushWritePath?.trim());
@@ -565,13 +562,12 @@ function placeDisabledNativeShellToolsInDirectNamespace(tools, nativeToolSurface
 }
 /** Applies a normalized tool allowlist while preserving shell aliases for exec/process. */
 function filterCodexDynamicToolsForAllowlist(tools, toolsAllow) {
-	if (!toolsAllow) return tools;
-	if (toolsAllow.length === 0) return [];
-	if (hasWildcardCodexToolsAllow(toolsAllow)) return tools;
-	const allowSet = new Set(toolsAllow.map((name) => normalizeCodexDynamicToolName(name)).filter(Boolean));
-	return tools.filter((tool) => {
-		const normalized = normalizeCodexDynamicToolName(tool.name);
-		return allowSet.has(normalized) || normalized === "sandbox_exec" && allowSet.has("exec") || normalized === "sandbox_process" && (allowSet.has("exec") || allowSet.has("process")) || normalized === "gateway_exec" && allowSet.has("exec") || normalized === "gateway_process" && (allowSet.has("exec") || allowSet.has("process")) || normalized === "node_exec" && allowSet.has("exec");
+	return applyEmbeddedAttemptToolsAllow(tools, toolsAllow, {
+		toolMeta: getPluginToolMeta,
+		toolAliases: (tool) => {
+			const normalized = normalizeCodexDynamicToolName(tool.name);
+			return normalized === "sandbox_exec" || normalized === "gateway_exec" || normalized === "node_exec" ? ["exec"] : normalized === "sandbox_process" || normalized === "gateway_process" ? ["exec", "process"] : [];
+		}
 	});
 }
 /** Detects the wildcard allowlist marker after Codex tool-name normalization. */
@@ -1854,32 +1850,50 @@ async function readFile(execServer, params) {
 async function writeFile(execServer, params) {
 	const record = requireObject(params, "fs/writeFile params");
 	const filePath = resolveExecServerPath(requireString(record.path, "path"), "write path");
+	const fsBridge = execServer.fsBridge;
+	const canonicalDestination = await fsBridge.resolvePinnedMutationTarget?.({
+		filePath,
+		action: "write"
+	});
 	assertFsSandboxAccess(execServer, record, [{
 		path: filePath,
 		access: "write"
-	}]);
-	const fsBridge = execServer.fsBridge;
+	}, ...canonicalDestination ? [{
+		path: canonicalDestination.policyPath,
+		access: "write"
+	}] : []]);
 	if ((await fsBridge.stat({ filePath: posix.dirname(filePath) }))?.type !== "directory") throw new JsonRpcProtocolError(JSON_RPC_NOT_FOUND, "parent directory not found");
 	await fsBridge.writeFile({
 		filePath,
 		data: Buffer.from(requireBase64String(record.dataBase64, "dataBase64"), "base64"),
-		mkdir: false
+		mkdir: false,
+		pinnedPath: canonicalDestination?.pinnedPath
 	});
 }
 /** Creates a sandbox directory, respecting recursive and parent-directory semantics. */
 async function createDirectory(execServer, params) {
 	const record = requireObject(params, "fs/createDirectory params");
 	const filePath = resolveExecServerPath(requireString(record.path, "path"), "create-directory path");
+	const fsBridge = execServer.fsBridge;
+	const canonicalDestination = await fsBridge.resolvePinnedMutationTarget?.({
+		filePath,
+		action: "mkdir"
+	});
 	assertFsSandboxAccess(execServer, record, [{
 		path: filePath,
 		access: "write"
-	}]);
-	const fsBridge = execServer.fsBridge;
+	}, ...canonicalDestination ? [{
+		path: canonicalDestination.policyPath,
+		access: "write"
+	}] : []]);
 	if (record.recursive === false) {
 		const parentPath = posix.dirname(filePath);
 		if ((await fsBridge.stat({ filePath: parentPath }))?.type !== "directory") throw new JsonRpcProtocolError(JSON_RPC_NOT_FOUND, "parent directory not found");
 	}
-	await fsBridge.mkdirp({ filePath });
+	await fsBridge.mkdirp({
+		filePath,
+		pinnedPath: canonicalDestination?.pinnedPath
+	});
 }
 /** Returns normalized metadata for a sandbox path. */
 async function getMetadata(execServer, params) {
@@ -1928,15 +1942,26 @@ async function removePath(execServer, params) {
 	const record = requireObject(params, "fs/remove params");
 	const filePath = resolveExecServerPath(requireString(record.path, "path"), "remove path");
 	const fsSandboxPolicy = resolveFsSandboxPolicy(execServer, record);
+	const canonicalDestination = await execServer.fsBridge.resolvePinnedMutationTarget?.({
+		filePath,
+		action: "remove"
+	});
 	assertResolvedFsSandboxAccess(fsSandboxPolicy, [{
 		path: filePath,
 		access: "write"
-	}]);
-	if (record.recursive !== false) assertNoReadOnlyDescendant(fsSandboxPolicy, filePath, "remove");
+	}, ...canonicalDestination ? [{
+		path: canonicalDestination.policyPath,
+		access: "write"
+	}] : []]);
+	if (record.recursive !== false) {
+		assertNoReadOnlyDescendant(fsSandboxPolicy, filePath, "remove");
+		if (canonicalDestination) assertNoReadOnlyDescendant(fsSandboxPolicy, canonicalDestination.policyPath, "remove");
+	}
 	await execServer.fsBridge.remove({
 		filePath,
 		recursive: record.recursive !== false,
-		force: record.force !== false
+		force: record.force !== false,
+		pinnedPath: canonicalDestination?.pinnedPath
 	});
 }
 /** Copies sandbox files or recursive directories while enforcing source and destination policy. */
@@ -1970,10 +1995,25 @@ async function copySandboxPath(execServer, params) {
 	}]);
 	const sourceStat = await fsBridge.stat({ filePath: params.sourcePath });
 	if (!sourceStat) throw new JsonRpcProtocolError(JSON_RPC_NOT_FOUND, "file not found");
-	if (sourceStat?.type === "directory") {
+	const canonicalDestination = await fsBridge.resolvePinnedMutationTarget?.({
+		filePath: params.destinationPath,
+		action: sourceStat.type === "directory" ? "mkdir" : "copy-destination"
+	});
+	const canonicalPolicyEntries = canonicalDestination ? [{
+		path: canonicalDestination.policyPath,
+		access: "write"
+	}] : [];
+	assertResolvedFsSandboxAccess(params.fsSandboxPolicy, canonicalPolicyEntries);
+	if (sourceStat.type === "directory") {
 		if (!params.recursive) throw new Error(`Cannot copy directory without recursive=true: ${params.sourcePath}`);
-		if (pathContains(normalizeSandboxAbsolutePath(params.sourcePath, "copy source path"), normalizeSandboxAbsolutePath(params.destinationPath, "copy destination path"))) throw new Error("Cannot recursively copy a directory into itself.");
-		await fsBridge.mkdirp({ filePath: params.destinationPath });
+		if (pathContains(normalizeSandboxAbsolutePath((await fsBridge.resolvePinnedMutationTarget?.({
+			filePath: params.sourcePath,
+			action: "mkdir"
+		}))?.policyPath ?? params.sourcePath, "copy source path"), normalizeSandboxAbsolutePath(canonicalDestination?.policyPath ?? params.destinationPath, "copy destination path"))) throw new Error("Cannot recursively copy a directory into itself.");
+		await fsBridge.mkdirp({
+			filePath: params.destinationPath,
+			pinnedPath: canonicalDestination?.pinnedPath
+		});
 		for (const entry of await listDirectoryEntries(execServer, params.sourcePath, params.fsSandboxPolicy)) {
 			if (!entry.isDirectory && !entry.isFile) throw new Error(`Cannot copy unsupported filesystem entry: ${entry.fileName}`);
 			await copySandboxPath(execServer, {
@@ -1989,7 +2029,8 @@ async function copySandboxPath(execServer, params) {
 		await fsBridge.copyFile({
 			sourcePath: params.sourcePath,
 			destinationPath: params.destinationPath,
-			mkdir: true
+			mkdir: true,
+			pinnedPath: canonicalDestination?.pinnedPath
 		});
 		return;
 	}
@@ -2001,7 +2042,8 @@ async function copySandboxPath(execServer, params) {
 	await fsBridge.writeFile({
 		filePath: params.destinationPath,
 		data,
-		mkdir: true
+		mkdir: true,
+		pinnedPath: canonicalDestination?.pinnedPath
 	});
 }
 function assertSandboxFileReadWithinLimit(stat) {
@@ -4220,7 +4262,7 @@ function resolvePluginElicitation(params) {
 	const appId = readFirstString$1(meta, PLUGIN_APP_ID_META_KEYS) ?? readFirstString$1(requestParams, PLUGIN_APP_ID_META_KEYS);
 	const connectorId = readFirstString$1(meta, PLUGIN_CONNECTOR_ID_META_KEYS);
 	const isCodexConnectorApproval = isCodexConnectorApprovalElicitation(requestParams, meta);
-	if (isCodexConnectorApproval && appId && connectorId && appId !== connectorId) return {
+	if (isCodexConnectorApproval && appId && connectorId && codexAppIdentityKey(appId) !== codexAppIdentityKey(connectorId)) return {
 		kind: "decline",
 		reason: "app_id_connector_id_mismatch"
 	};
@@ -4229,20 +4271,19 @@ function resolvePluginElicitation(params) {
 			kind: "decline",
 			reason: "missing_policy_context"
 		};
-		const entry = context.apps[appId];
-		if (entry?.source === "account" && !isCodexConnectorApproval) return {
+		const matches = Object.entries(context.apps).filter(([id]) => codexAppIdentityKey(id) === codexAppIdentityKey(appId)).map(([, entry]) => entry);
+		if (matches.some((entry) => entry.source === "account") && !isCodexConnectorApproval) return {
 			kind: "decline",
 			reason: "account_app_source_mismatch"
 		};
-		return uniquePluginMatch(entry ? [entry] : [], "app_id");
+		return uniquePluginMatch(matches, "app_id");
 	}
 	if (isCodexConnectorApproval && connectorId) {
 		if (!context) return {
 			kind: "decline",
 			reason: "missing_policy_context"
 		};
-		const entry = context.apps[connectorId];
-		return uniquePluginMatch(entry ? [entry] : [], "connector_id");
+		return uniquePluginMatch(Object.entries(context.apps).filter(([id]) => codexAppIdentityKey(id) === codexAppIdentityKey(connectorId)).map(([, entry]) => entry), "connector_id");
 	}
 	const serverName = readNonBlankStringField(requestParams, "serverName");
 	if (serverName && context) {
@@ -4662,6 +4703,64 @@ function readFirstString$1(record, keys) {
 	}
 }
 //#endregion
+//#region extensions/codex/src/app-server/dynamic-tool-automations-allowlist.ts
+function createCodexAutomationsToolsAllowResolver(specs) {
+	const names = /* @__PURE__ */ new Set();
+	const qualifiedNames = /* @__PURE__ */ new Map();
+	for (const spec of specs) {
+		if (spec.type === "function") {
+			names.add(spec.name);
+			continue;
+		}
+		for (const tool of spec.tools) {
+			names.add(tool.name);
+			const separator = spec.name.endsWith("_") || tool.name.startsWith("_") ? "" : "__";
+			qualifiedNames.set(`${spec.name}${separator}${tool.name}`, tool.name);
+		}
+	}
+	function resolveList(value) {
+		const resolved = value.map((name) => typeof name !== "string" || names.has(name) ? name : qualifiedNames.get(name) ?? name);
+		return resolved.every((name, index) => name === value[index]) ? value : resolved;
+	}
+	function resolvePayload(value) {
+		if (!isJsonObject(value) || !Array.isArray(value.toolsAllow)) return value;
+		const toolsAllow = resolveList(value.toolsAllow);
+		return toolsAllow === value.toolsAllow ? value : {
+			...value,
+			toolsAllow
+		};
+	}
+	function resolveJobFields(value, paddedKeys) {
+		let resolved = value;
+		for (const [key, entry] of Object.entries(value)) {
+			const field = paddedKeys ? key.trim() : key;
+			if (key !== field && Object.hasOwn(value, field)) continue;
+			const next = field === "toolsAllow" && Array.isArray(entry) ? resolveList(entry) : field === "payload" || field === "namePayload" ? resolvePayload(entry) : entry;
+			if (next !== entry) {
+				if (resolved === value) resolved = { ...value };
+				resolved[key] = next;
+			}
+		}
+		return resolved;
+	}
+	return (args) => {
+		if (!isJsonObject(args)) return args;
+		const job = args.job;
+		if (!job || isJsonObject(job) && Object.keys(job).length === 0) return resolveJobFields(args, false);
+		if (!isJsonObject(job)) return args;
+		const wrapper = isJsonObject(job.data) ? "data" : isJsonObject(job.job) ? "job" : void 0;
+		const wrapped = wrapper ? job[wrapper] : void 0;
+		const resolved = wrapper && isJsonObject(wrapped) ? {
+			...job,
+			[wrapper]: resolveJobFields(wrapped, true)
+		} : resolveJobFields(job, true);
+		return resolved === job ? args : {
+			...args,
+			job: resolved
+		};
+	};
+}
+//#endregion
 //#region extensions/codex/src/app-server/dynamic-tool-catalog.ts
 /** Namespace attached to OpenClaw-owned dynamic tools exposed to Codex. */
 const CODEX_OPENCLAW_DYNAMIC_TOOL_NAMESPACE = "openclaw";
@@ -5083,6 +5182,11 @@ function createCodexDynamicToolBridge(params) {
 	const registrationNames = inheritedNames ?? new Set(registeredProjection.tools.map((entry) => entry.name));
 	const finalized = finalizeCodexToolAvailability(availableProjection.tools.filter((entry) => registrationNames.has(entry.name)));
 	const availableTools = finalized.tools;
+	const pluginLocalMediaTrustByToolName = /* @__PURE__ */ new Map();
+	for (const { name, tool } of availableTools) {
+		const pluginMeta = getPluginToolMeta(tool);
+		if (pluginMeta) pluginLocalMediaTrustByToolName.set(name, new Set(pluginMeta.trustedLocalMedia === true ? [name] : []));
+	}
 	availableProjection.quarantinedTools.push(...finalized.quarantinedTools);
 	const toolMap = new Map(availableTools.map((entry) => [entry.name, entry]));
 	const quarantinedAvailableToolNames = new Set(availableProjection.quarantinedTools.map((tool) => tool.tool));
@@ -5121,6 +5225,12 @@ function createCodexDynamicToolBridge(params) {
 	const legacyExtensionRunner = createCodexAppServerToolResultExtensionRunner(toolResultHookContext);
 	const executionSnapshotStates = /* @__PURE__ */ new Map();
 	const directToolNames = params.directToolNames;
+	const specs = inheritedSpecs ?? createCodexDynamicToolSpecs({
+		entries: registeredSpecTools,
+		loading: params.loading ?? "searchable",
+		directToolNames
+	});
+	const resolveAutomationsToolsAllow = createCodexAutomationsToolsAllowResolver(specs);
 	let readRemoteWorkspaceFile;
 	return {
 		availableTools: availableTools.map((entry) => entry.tool),
@@ -5136,11 +5246,7 @@ function createCodexDynamicToolBridge(params) {
 			loading: params.loading ?? "searchable",
 			directToolNames
 		}),
-		specs: inheritedSpecs ?? createCodexDynamicToolSpecs({
-			entries: registeredSpecTools,
-			loading: params.loading ?? "searchable",
-			directToolNames
-		}),
+		specs,
 		resultContentSourceForTool: (toolName) => toolMap.get(toolName)?.tool.resultContentSource,
 		sideEffectOwnerKeyForTool: (toolName) => {
 			const tool = toolMap.get(toolName)?.tool;
@@ -5177,7 +5283,7 @@ function createCodexDynamicToolBridge(params) {
 				});
 			}
 			const { tool, name: toolName } = toolEntry;
-			const rawArguments = call.arguments;
+			const rawArguments = toolName === "automations" ? resolveAutomationsToolsAllow(call.arguments) : call.arguments;
 			const args = asNonArrayRecord(rawArguments);
 			const startedAt = Date.now();
 			const signal = composeAbortSignals(params.signal, options?.signal);
@@ -5338,7 +5444,8 @@ function createCodexDynamicToolBridge(params) {
 					autoDeliveryTtsMediaUrls,
 					coreTtsToolResult: autoDeliveryTtsMediaUrls?.length ? rawResult : void 0,
 					messagingTarget: confirmedMessagingTarget,
-					sourceReplyFinal
+					sourceReplyFinal,
+					trustedLocalMediaToolNames: pluginLocalMediaTrustByToolName.get(toolName)
 				});
 				if (deliveredSourceReply || receiptConfirmedSourceReply || toolConfirmedSourceReply) telemetry.didDeliverSourceReplyViaMessageTool = true;
 				const continuesSourceReplyProgress = confirmedSourceReply && sourceReplyFinal === false;
@@ -5512,7 +5619,7 @@ function collectToolTelemetry(params) {
 	if (params.result && !params.signal.aborted) {
 		const media = extractToolResultMediaArtifact(params.result);
 		if (media) {
-			const mediaUrls = filterToolResultMediaUrls(params.toolName, media.mediaUrls, params.mediaTrustResult ?? params.result);
+			const mediaUrls = filterToolResultMediaUrls(params.toolName, media.mediaUrls, params.coreTtsToolResult ?? params.mediaTrustResult ?? params.result, params.trustedLocalMediaToolNames);
 			const seen = new Set(params.telemetry.toolMediaUrls);
 			const autoDeliveryMediaUrls = new Set(params.telemetry.toolAutoDeliveryMediaUrls);
 			const rawAutoDeliveryMediaUrls = new Set(params.autoDeliveryTtsMediaUrls);

package/dist/{effective-mcp-catalog-J_5Ep5Um.js → .setup/effective-mcp-catalog-K6kLCN8X.mjs}

@@ -1,6 +1,6 @@
-import { l as sessionBindingIdentity } from "./session-binding-record-CaZjYwNS.js";
-import { _ as retainSharedCodexAppServerClientByInstanceId } from "./shared-client-CVhez2Uo.js";
-import "./session-binding-CKSepwIC.js";
+import { p as sessionBindingIdentity } from "./session-binding-record-TH3xA0zj.mjs";
+import { _ as retainSharedCodexAppServerClientByInstanceId } from "./shared-client-BpTtuLQ5.mjs";
+import "./session-binding-_0W_fHRr.mjs";
 import { asOptionalRecord, normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { assignMcpCatalogSafeServerNames } from "openclaw/plugin-sdk/agent-harness-runtime";
 //#region extensions/codex/src/app-server/effective-mcp-catalog.ts

package/dist/{ephemeral-turn-DSwzP8YY.js → .setup/ephemeral-turn-R1gA8Sn6.mjs}

@@ -1,8 +1,7 @@
-import { o as isJsonObject } from "./protocol-CAAcVIKF.js";
-import { T as readCodexTurnCompletedNotification } from "./client-BEKu4yDx.js";
-import { p as getCodexAppServerTurnRouter } from "./attempt-client-cleanup-D6cR54TV.js";
-import { o as isTerminalTurnStatus, s as readCodexNotificationItem } from "./attempt-notifications--H8zXR5-.js";
-import { t as CodexUsageProjection } from "./event-projector-usage-CIyrYYid.js";
+import { m as isJsonObject } from "./config-security-BRQ2mgW9.mjs";
+import { T as readCodexTurnCompletedNotification } from "./client-vXs2929Q.mjs";
+import { m as getCodexAppServerTurnRouter } from "./attempt-client-cleanup-BpYKdTA0.mjs";
+import { c as readCodexNotificationItem, s as isTerminalTurnStatus, t as CodexUsageProjection } from "./event-projector-usage-C7Ntzs-f.mjs";
 import { readStringField } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { toStringifiedError } from "openclaw/plugin-sdk/error-runtime";
 import { createDeferred } from "openclaw/plugin-sdk/extension-shared";

package/dist/{event-projector-assistant-message-BmBM4qBV.js → .setup/event-projector-assistant-message-DNUR1s0A.mjs}

@@ -1,4 +1,4 @@
-import { t as resolveCodexLocalRuntimeAttribution } from "./local-runtime-attribution-B_2mnqhb.js";
+import { t as resolveCodexLocalRuntimeAttribution } from "./local-runtime-attribution-B_2mnqhb.mjs";
 import { formatErrorMessage } from "openclaw/plugin-sdk/agent-harness-runtime";
 //#region extensions/codex/src/app-server/event-projector-assistant-message.ts
 const ZERO_USAGE = {
@@ -70,13 +70,16 @@ function createAssistantCommentaryMessage(params, text, itemId, timestamp) {
 		}
 	};
 }
-function createAssistantAsyncMessage(params, text, itemId, timestamp) {
+function createAssistantAsyncMessage(params, text, itemId, timestamp, questions) {
 	return {
 		...createNonterminalAssistantMessage(params, [{
 			type: "text",
 			text
 		}], timestamp),
-		openclawAsyncDelivery: { itemId }
+		openclawAsyncDelivery: {
+			itemId,
+			...questions ? { questions } : {}
+		}
 	};
 }
 function createAssistantReasoningMessage(params, text) {