@openclaw/codex 2026.9.4 → 2026.9.5

package/dist/.setup/cyber-failover-DYwbmf1o.mjs

@@ -0,0 +1,123 @@
+import { d as readCodexPluginConfig } from "./config-parsing-CcB9iPoq.mjs";
+import { t as attemptTerminal } from "./attempt-terminal-gZrxQ35N.mjs";
+//#region extensions/codex/src/app-server/cyber-failover.ts
+/**
+* Automatic Daybreak escalation for OpenAI cyber-policy refusals.
+*
+* OpenAI refuses some defensive-cyber work on its general models and directs
+* approved workspaces to a Daybreak model instead. When a turn is refused, the
+* harness retries it once on the configured Daybreak model so the refused work
+* reaches the tier allowed to answer it. Only a refused turn is ever routed
+* there, and the retry never changes the session's stored model selection.
+*
+* Authorization stays server-owned. `model/list` advertises Daybreak to every
+* client, but an unentitled workspace still gets 401/403 on use, and each such
+* attempt costs the transport's full five-try reconnect ladder. Entitlement is
+* therefore only ever observed from an actual attempt, and a failure is
+* remembered per workspace so siblings do not each pay for it.
+*/
+const DEFAULT_CYBER_FAILOVER = {
+	mode: "auto",
+	model: "gpt-daybreak-blue-latest",
+	cooloffMs: 6e5
+};
+function resolveCodexCyberFailoverConfig(pluginConfig) {
+	const configured = readCodexPluginConfig(pluginConfig).appServer?.cyberFailover;
+	if (!configured) return DEFAULT_CYBER_FAILOVER;
+	return {
+		mode: configured.mode ?? DEFAULT_CYBER_FAILOVER.mode,
+		model: configured.model ?? DEFAULT_CYBER_FAILOVER.model,
+		cooloffMs: configured.cooloffMs ?? DEFAULT_CYBER_FAILOVER.cooloffMs
+	};
+}
+const unavailableTargets = /* @__PURE__ */ new Map();
+const MAX_UNAVAILABLE_TARGETS = 256;
+const inFlightProbes = /* @__PURE__ */ new Set();
+function targetKey(model, workspace) {
+	const normalized = model.trim().toLowerCase();
+	const slashIndex = normalized.lastIndexOf("/");
+	return [
+		workspace?.agentId?.trim().toLowerCase() ?? "",
+		workspace?.authProfileId?.trim().toLowerCase() ?? "",
+		slashIndex >= 0 ? normalized.slice(slashIndex + 1) : normalized
+	].join("\0");
+}
+/** Marks a workspace/target probe in flight; the returned handle releases it. */
+function reserveCodexCyberProbe(params) {
+	const key = targetKey(params.model, params.workspace);
+	inFlightProbes.add(key);
+	return () => {
+		inFlightProbes.delete(key);
+	};
+}
+/** Remembers that this workspace cannot use the target for `cooloffMs`. */
+function recordCodexCyberTargetUnavailable(params) {
+	if (params.cooloffMs <= 0) return;
+	const now = params.now ?? Date.now();
+	for (const [key, expiresAt] of unavailableTargets) if (expiresAt <= now) unavailableTargets.delete(key);
+	while (unavailableTargets.size >= MAX_UNAVAILABLE_TARGETS) {
+		const oldest = unavailableTargets.keys().next();
+		if (oldest.done) break;
+		unavailableTargets.delete(oldest.value);
+	}
+	unavailableTargets.set(targetKey(params.model, params.workspace), now + params.cooloffMs);
+}
+/** Decides whether a refused turn may be retried on Daybreak. */
+function planCodexCyberEscalation(params) {
+	const { config } = params;
+	if (config.mode !== "auto") return {
+		kind: "skip",
+		reason: "disabled"
+	};
+	if (!params.replaySafe) return {
+		kind: "skip",
+		reason: "not_replay_safe"
+	};
+	if (!config.model.trim()) return {
+		kind: "skip",
+		reason: "no_target"
+	};
+	const key = targetKey(config.model, params.workspace);
+	if (params.currentModel && targetKey(params.currentModel, params.workspace) === key) return {
+		kind: "skip",
+		reason: "already_daybreak"
+	};
+	const now = params.now ?? Date.now();
+	const expiresAt = unavailableTargets.get(key);
+	if (expiresAt !== void 0 && expiresAt <= now) unavailableTargets.delete(key);
+	else if (expiresAt !== void 0) return {
+		kind: "skip",
+		reason: "target_unavailable"
+	};
+	if (inFlightProbes.has(key)) return {
+		kind: "skip",
+		reason: "probe_in_flight"
+	};
+	return {
+		kind: "escalate",
+		model: config.model
+	};
+}
+const AUTHORIZATION_FAILURE_RE = /\b(401|403)\b|unauthorized|not authorized|forbidden/i;
+/** Everything the escalation decision needs from one attempt outcome. */
+function readCodexCyberAttemptVerdict(result) {
+	const message = result?.currentAttemptAssistant;
+	const refusals = message?.role === "assistant" ? message.diagnostics ?? [] : [];
+	const cyberRefused = result?.terminal.kind === "ok" && refusals.some((d) => d.type === "provider_refusal" && d.details?.category === "cyber" && d.details?.provider === "openai");
+	const promptError = result ? attemptTerminal.project(result.terminal).promptError : void 0;
+	const answered = !(promptError !== void 0 && promptError !== null) && message?.role === "assistant" && !refusals.some((d) => d.type === "provider_refusal") && message.stopReason !== "error" && message.stopReason !== "aborted";
+	const errorTexts = [
+		typeof promptError === "string" ? promptError : void 0,
+		promptError instanceof Error ? promptError.message : void 0,
+		result?.lastAssistant?.errorMessage,
+		message?.errorMessage
+	];
+	return {
+		cyberRefused,
+		replaySafe: result?.replayMetadata?.replaySafe === true && result.runtimeContinuationStarted !== true,
+		answered,
+		unavailable: errorTexts.some((t) => t !== void 0 && AUTHORIZATION_FAILURE_RE.test(t))
+	};
+}
+//#endregion
+export { planCodexCyberEscalation, readCodexCyberAttemptVerdict, recordCodexCyberTargetUnavailable, reserveCodexCyberProbe, resolveCodexCyberFailoverConfig };

package/dist/.setup/cyber-failover-notice-e9G3J9-e.mjs

@@ -0,0 +1,17 @@
+import { t as emitCodexAppServerEvent } from "./run-attempt-lifecycle-B7JbY4-F.mjs";
+//#region extensions/codex/src/app-server/cyber-failover-notice.ts
+async function emitCodexCyberNotice(params, notice) {
+	await emitCodexAppServerEvent(params, {
+		stream: "notice",
+		data: {
+			phase: "provider_policy",
+			category: "cyber",
+			state: notice.state,
+			provider: "openai",
+			...notice.model ? { model: notice.model } : {},
+			fallbackModel: notice.fallbackModel
+		}
+	});
+}
+//#endregion
+export { emitCodexCyberNotice };

package/dist/{dynamic-tools-CmN5RAip.js → .setup/dynamic-tools-D16lOp67.mjs}

@@ -1,14 +1,17 @@
-import { a as flattenCodexDynamicToolFunctions, o as isJsonObject, r as CODEX_OPENCLAW_DIRECT_DYNAMIC_TOOL_NAMESPACE, x as readCodexPluginConfig, y as isCodexRemoteExecPlacementSandbox } from "./protocol-5bh1G-H7.js";
-import { B as withDynamicToolTranscriptDetails, E as createCodexElicitationResponse, L as resolveCodexToolAbortTerminalReason, R as createFailedDynamicToolResponse, w as readCodexTurn, z as withDynamicToolExecutionState } from "./client-B57KWPQx.js";
-import { o as formatCodexDisplayText } from "./command-formatters-lxlkNZgU.js";
-import { c as itemName, f as shouldClearTerminalPresentationForNativeItem, l as itemStatus, n as auditNativeToolTerminalStatus, r as auditNativeToolUnfinishedStatus, t as auditNativeToolName, x as readItem } from "./event-projector-items-5VhsECCO.js";
-import "./config-oIORaQ5T.js";
-import { r as sanitizeInlineImageDataUrl, t as invalidInlineImageText } from "./image-payload-sanitizer-tupAr-2o.js";
-import { h as isCodexNotificationForTurn } from "./attempt-client-cleanup-DKHzbwt5.js";
-import { C as resolveCodexWebSearchPlan, V as emitCodexNativePreToolUseFailureDiagnostic, at as isForcedPrivateQaCodexRuntime, ct as normalizeCodexDynamicToolName, it as filterCodexDynamicToolsForDisabledNativeSurface, rt as filterCodexDynamicTools, st as isSystemAgentOnlyCodexDynamicToolAllowlist } from "./thread-lifecycle-DXl1-I6b.js";
-import { n as resolveCodexNativeExecutionPolicy, r as resolveCodexNodeExecToolOverrides } from "./native-execution-policy-umd0tgh4.js";
-import { a as CODEX_NODE_EXEC_DYNAMIC_TOOL_NAME, c as createNodeExecAliasDynamicTool, i as CODEX_GATEWAY_PROCESS_DYNAMIC_TOOL_NAME, l as isCodexDynamicToolExcluded, o as createGatewayExecProjection, r as CODEX_GATEWAY_EXEC_DYNAMIC_TOOL_NAME, s as createGatewayProcessProjection } from "./provider-capabilities-BvCUL69A.js";
-import { a as requestPluginApprovalOutcome, c as truncateCodexApprovalDisplayText, i as requestPluginApproval, l as waitForPluginApprovalDecision, n as codexApprovalTimeoutText, o as sanitizeCodexApprovalVisibleText, r as mapExecDecisionToOutcome, s as stripDanglingCodexApprovalTerminalSequence, t as approvalRequestExplicitlyUnavailable } from "./plugin-approval-roundtrip-Bz3FT8W5.js";
+import { CODEX_NATIVE_TOOL_REQUIREMENTS } from "../native-tool-policy.js";
+import { d as CODEX_OPENCLAW_DIRECT_DYNAMIC_TOOL_NAMESPACE, m as isJsonObject, p as flattenCodexDynamicToolFunctions } from "./config-security-BRQ2mgW9.mjs";
+import { d as readCodexPluginConfig, l as isCodexRemoteExecPlacementSandbox } from "./config-parsing-CcB9iPoq.mjs";
+import { B as withDynamicToolTranscriptDetails, E as createCodexElicitationResponse, L as resolveCodexToolAbortTerminalReason, R as createFailedDynamicToolResponse, w as readCodexTurn, z as withDynamicToolExecutionState } from "./client-vXs2929Q.mjs";
+import { o as formatCodexDisplayText } from "./command-formatters-CGEkdawF.mjs";
+import { c as itemName, f as shouldClearTerminalPresentationForNativeItem, l as itemStatus, n as auditNativeToolTerminalStatus, r as auditNativeToolUnfinishedStatus, t as auditNativeToolName, x as readItem } from "./event-projector-items-DyTQ_XqL.mjs";
+import { s as codexAppIdentityKey } from "./plugin-app-cache-key-BOxKP7db.mjs";
+import "./config-CedDWjM-.mjs";
+import { r as sanitizeInlineImageDataUrl, t as invalidInlineImageText } from "./image-payload-sanitizer-tupAr-2o.mjs";
+import { v as isCodexNotificationForTurn } from "./attempt-client-cleanup-BpYKdTA0.mjs";
+import { H as emitCodexNativePreToolUseFailureDiagnostic, at as filterCodexDynamicToolsForDisabledNativeSurface, ct as isSystemAgentOnlyCodexDynamicToolAllowlist, it as filterCodexDynamicTools, lt as normalizeCodexDynamicToolName, ot as isForcedPrivateQaCodexRuntime, w as resolveCodexWebSearchPlan } from "./thread-lifecycle-Cik28qWn.mjs";
+import { n as resolveCodexNativeExecutionPolicy, r as resolveCodexNodeExecToolOverrides } from "./native-execution-policy-YBMHSzC4.mjs";
+import { a as CODEX_NODE_EXEC_DYNAMIC_TOOL_NAME, c as createNodeExecAliasDynamicTool, i as CODEX_GATEWAY_PROCESS_DYNAMIC_TOOL_NAME, l as isCodexDynamicToolExcluded, o as createGatewayExecProjection, r as CODEX_GATEWAY_EXEC_DYNAMIC_TOOL_NAME, s as createGatewayProcessProjection } from "./provider-capabilities-B8J4Dy-O.mjs";
+import { a as requestPluginApprovalOutcome, c as truncateCodexApprovalDisplayText, i as requestPluginApproval, l as waitForPluginApprovalDecision, n as codexApprovalTimeoutText, o as sanitizeCodexApprovalVisibleText, r as mapExecDecisionToOutcome, s as stripDanglingCodexApprovalTerminalSequence, t as approvalRequestExplicitlyUnavailable } from "./plugin-approval-roundtrip-CjfzafAZ.mjs";
 import { createRequire } from "node:module";
 import { asNonArrayRecord, asOptionalRecord, isRecord, normalizeOptionalString, normalizeTrimmedStringList, readStringField } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { createHash, randomUUID } from "node:crypto";
@@ -21,14 +24,15 @@ import { once } from "node:events";
 import { spawn } from "node:child_process";
 import { coerceErrorMessage } from "openclaw/plugin-sdk/error-runtime";
 import { DEFAULT_MAX_LIVE_TOOL_RESULT_CHARS, estimateToolResultTextChars, resolveLiveToolResultMaxChars, sliceToolResultTextToBudget, sliceUtf16Safe, truncateUtf16Safe } from "openclaw/plugin-sdk/text-utility-runtime";
+import { emitTrustedDiagnosticEvent } from "openclaw/plugin-sdk/diagnostic-runtime";
 import { createDeferred } from "openclaw/plugin-sdk/extension-shared";
 import { createStageTimingTracker, formatStageTimings } from "openclaw/plugin-sdk/time-runtime";
 import { isPathStrictlyInside, root } from "openclaw/plugin-sdk/file-access-runtime";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { resolveAgentDir } from "openclaw/plugin-sdk/agent-runtime";
-import { HEARTBEAT_RESPONSE_TOOL_NAME, buildAgentHookContextChannelFields, buildEmbeddedAttemptToolRunContext, consumeAdjustedParamsForToolCall, consumePreExecutionBlockedToolCall, createAgentToolResultMiddlewareRunner, createCodexAppServerToolResultExtensionRunner, embeddedAgentLog, extractMessagingToolSend, extractMessagingToolSendResult, extractToolResultMediaArtifact, filterProviderNormalizableTools, filterToolResultMediaUrls, finalizeAgentToolAvailability, finalizeToolTerminalPresentation, formatApprovalDisplayPath, formatToolExecutionErrorMessage, getBeforeToolCallFailureDisposition, getChannelAgentToolMeta, getPluginToolMeta, getPluginToolSideEffectOwnerKey, hasNativeHookRelayInvocation, invokeNativeHookRelay, isDeliveredMessageToolOnlySourceReplyResult, isDeliveredMessagingToolResult, isHostScopedAgentToolActive, isMessagingTool, isMessagingToolSendAction, isReplaySafeToolCall, isSubagentSessionKey, isToolResultError, isToolWrappedWithBeforeToolCallHook, normalizeAgentRuntimeTools, normalizeHeartbeatToolResponse, projectRuntimeToolInputSchema, resolveAttemptSpawnWorkspaceDir, resolveModelAuthMode, resolveNativeHookRelayDeferredToolApproval, resolveToolExecutionErrorKind, resolveToolResultFailureKind, runAgentHarnessAfterToolCallHook, sanitizeToolResult, setBeforeToolCallDiagnosticsEnabled, supportsModelTools, wrapToolWithBeforeToolCallHook } from "openclaw/plugin-sdk/agent-harness-runtime";
+import { HEARTBEAT_RESPONSE_TOOL_NAME, applyEmbeddedAttemptToolsAllow, buildAgentHookContextChannelFields, buildEmbeddedAttemptToolRunContext, consumeAdjustedParamsForToolCall, consumePreExecutionBlockedToolCall, createAgentToolResultMiddlewareRunner, createCodexAppServerToolResultExtensionRunner, embeddedAgentLog, extractMessagingToolSend, extractMessagingToolSendResult, extractToolResultMediaArtifact, filterProviderNormalizableTools, filterToolResultMediaUrls, finalizeAgentToolAvailability, finalizeToolTerminalPresentation, formatApprovalDisplayPath, formatToolExecutionErrorMessage, getBeforeToolCallFailureDisposition, getChannelAgentToolMeta, getPluginToolMeta, getPluginToolSideEffectOwnerKey, hasNativeHookRelayInvocation, invokeNativeHookRelay, isDeliveredMessageToolOnlySourceReplyResult, isDeliveredMessagingToolResult, isHostScopedAgentToolActive, isMessagingTool, isMessagingToolSendAction, isReplaySafeToolCall, isSubagentSessionKey, isToolResultError, isToolWrappedWithBeforeToolCallHook, normalizeAgentRuntimeTools, normalizeHeartbeatToolResponse, projectRuntimeToolInputSchema, resolveAttemptSpawnWorkspaceDir, resolveModelAuthMode, resolveNativeHookRelayDeferredToolApproval, resolveToolExecutionErrorKind, resolveToolResultFailureKind, runAgentHarnessAfterToolCallHook, sanitizeToolResult, setBeforeToolCallDiagnosticsEnabled, supportsModelTools, wrapToolWithBeforeToolCallHook } from "openclaw/plugin-sdk/agent-harness-runtime";
 import { formatErrorMessage as formatErrorMessage$2, redactSensitiveText } from "openclaw/plugin-sdk/security-runtime";
-import { emitTrustedDiagnosticEvent } from "openclaw/plugin-sdk/diagnostic-runtime";
+import { consumeTrustedToolNoStartError, copyInternalToolResultState, getCoreTtsToolResultMediaUrls } from "openclaw/plugin-sdk/agent-harness-tool-runtime";
 import { isIP } from "node:net";
 import { redactToolPayloadText } from "openclaw/plugin-sdk/logging-core";
 import { formatMcpCodexApprovalRemedy, requiresMcpCodexToolApproval, resolveCodexScheduledToolProjectionFactory, resolveProjectedMcpCodexToolApprovalMode, runWithCronCreatorAuthorityCapabilityResolver } from "openclaw/plugin-sdk/codex-mcp-projection";
@@ -36,7 +40,6 @@ import { buildRemoteCommand, isToolAllowed, sanitizeEnvVars } from "openclaw/plu
 import { SsrFBlockedError, isBlockedHostnameOrIp } from "openclaw/plugin-sdk/ssrf-runtime";
 import { saveMediaBuffer } from "openclaw/plugin-sdk/media-store";
 import { getMediaDir } from "openclaw/plugin-sdk/media-runtime";
-import { consumeTrustedToolNoStartError, copyInternalToolResultState, getCoreTtsToolResultMediaUrls } from "openclaw/plugin-sdk/agent-harness-tool-runtime";
 import { normalizeOpenAIStrictCompatSchema } from "openclaw/plugin-sdk/provider-tools";
 //#region extensions/codex/src/app-server/dynamic-tool-build-state.ts
 /** Mutable dependency seam shared by dynamic-tool construction and its behavioral tests. */
@@ -106,14 +109,6 @@ function filterCodexVisionTools(tools, params) {
 * OpenClaw-owned tools, Codex native-tool fallback rules, sandbox shell shims,
 * and provider allowlist normalization.
 */
-const CODEX_NATIVE_SANDBOX_TOOL_REQUIREMENTS = [
-	"exec",
-	"process",
-	"read",
-	"write",
-	"edit",
-	"apply_patch"
-];
 const CODEX_MEMORY_FLUSH_DYNAMIC_TOOL_ALLOW = /* @__PURE__ */ new Set(["read", "write"]);
 const CODEX_DISABLED_NATIVE_SHELL_DYNAMIC_TOOLS = /* @__PURE__ */ new Set([
 	"exec",
@@ -210,6 +205,7 @@ async function buildDynamicTools(input) {
 		nativeToolSurfaceEnabled: input.nativeToolSurfaceEnabled,
 		nativeProviderWebSearchSupport: input.nativeProviderWebSearchSupport
 	});
+	const messageToolProvider = resolveCodexMessageToolProvider(params);
 	const webFetchHostnameAllowlistRef = {};
 	const toolConstructionPlan = resolveCodexNodePlacementToolConstructionPlan(input.sandbox, input.nativeToolSurfaceEnabled);
 	const options = {
@@ -229,11 +225,11 @@ async function buildDynamicTools(input) {
 		} : void 0,
 		sandbox: input.sandbox,
 		...toolConstructionPlan ? { toolConstructionPlan } : {},
-		messageProvider: resolveCodexMessageToolProvider(params),
+		messageProvider: messageToolProvider,
 		toolPolicyMessageProvider: params.messageProvider ?? params.messageChannel,
 		...params.onToolResult ? { questionPrompt: {
 			send: params.onToolResult,
-			...params.messageChannel ? { messageChannel: params.messageChannel } : {}
+			messageChannel: messageToolProvider
 		} } : {},
 		inputProvenance: params.inputProvenance,
 		trustedInternalHandoff: params.trustedInternalHandoff,
@@ -336,7 +332,7 @@ async function buildDynamicTools(input) {
 			agentId: input.policyAgentId,
 			sessionKey: input.sandboxSessionKey,
 			sandboxToolPolicy: input.sandbox?.tools,
-			messageProvider: resolveCodexMessageToolProvider(params),
+			messageProvider: messageToolProvider,
 			agentAccountId: params.agentAccountId,
 			groupId: params.groupId,
 			groupChannel: params.groupChannel,
@@ -457,7 +453,7 @@ function canCodexAppServerNativeToolSurfaceHonorSandbox(sandbox, options = {}) {
 	return false;
 }
 function canSandboxToolPolicyExposeCodexNativeToolSurface(sandbox) {
-	return CODEX_NATIVE_SANDBOX_TOOL_REQUIREMENTS.every((toolName) => isToolAllowed(sandbox.tools, toolName));
+	return CODEX_NATIVE_TOOL_REQUIREMENTS.every((toolName) => isToolAllowed(sandbox.tools, toolName));
 }
 function isCodexMemoryFlushRun(params) {
 	return params?.trigger === "memory" && Boolean(params.memoryFlushWritePath?.trim());
@@ -566,13 +562,12 @@ function placeDisabledNativeShellToolsInDirectNamespace(tools, nativeToolSurface
 }
 /** Applies a normalized tool allowlist while preserving shell aliases for exec/process. */
 function filterCodexDynamicToolsForAllowlist(tools, toolsAllow) {
-	if (!toolsAllow) return tools;
-	if (toolsAllow.length === 0) return [];
-	if (hasWildcardCodexToolsAllow(toolsAllow)) return tools;
-	const allowSet = new Set(toolsAllow.map((name) => normalizeCodexDynamicToolName(name)).filter(Boolean));
-	return tools.filter((tool) => {
-		const normalized = normalizeCodexDynamicToolName(tool.name);
-		return allowSet.has(normalized) || normalized === "sandbox_exec" && allowSet.has("exec") || normalized === "sandbox_process" && (allowSet.has("exec") || allowSet.has("process")) || normalized === "gateway_exec" && allowSet.has("exec") || normalized === "gateway_process" && (allowSet.has("exec") || allowSet.has("process")) || normalized === "node_exec" && allowSet.has("exec");
+	return applyEmbeddedAttemptToolsAllow(tools, toolsAllow, {
+		toolMeta: getPluginToolMeta,
+		toolAliases: (tool) => {
+			const normalized = normalizeCodexDynamicToolName(tool.name);
+			return normalized === "sandbox_exec" || normalized === "gateway_exec" || normalized === "node_exec" ? ["exec"] : normalized === "sandbox_process" || normalized === "gateway_process" ? ["exec", "process"] : [];
+		}
 	});
 }
 /** Detects the wildcard allowlist marker after Codex tool-name normalization. */
@@ -1855,32 +1850,50 @@ async function readFile(execServer, params) {
 async function writeFile(execServer, params) {
 	const record = requireObject(params, "fs/writeFile params");
 	const filePath = resolveExecServerPath(requireString(record.path, "path"), "write path");
+	const fsBridge = execServer.fsBridge;
+	const canonicalDestination = await fsBridge.resolvePinnedMutationTarget?.({
+		filePath,
+		action: "write"
+	});
 	assertFsSandboxAccess(execServer, record, [{
 		path: filePath,
 		access: "write"
-	}]);
-	const fsBridge = execServer.fsBridge;
+	}, ...canonicalDestination ? [{
+		path: canonicalDestination.policyPath,
+		access: "write"
+	}] : []]);
 	if ((await fsBridge.stat({ filePath: posix.dirname(filePath) }))?.type !== "directory") throw new JsonRpcProtocolError(JSON_RPC_NOT_FOUND, "parent directory not found");
 	await fsBridge.writeFile({
 		filePath,
 		data: Buffer.from(requireBase64String(record.dataBase64, "dataBase64"), "base64"),
-		mkdir: false
+		mkdir: false,
+		pinnedPath: canonicalDestination?.pinnedPath
 	});
 }
 /** Creates a sandbox directory, respecting recursive and parent-directory semantics. */
 async function createDirectory(execServer, params) {
 	const record = requireObject(params, "fs/createDirectory params");
 	const filePath = resolveExecServerPath(requireString(record.path, "path"), "create-directory path");
+	const fsBridge = execServer.fsBridge;
+	const canonicalDestination = await fsBridge.resolvePinnedMutationTarget?.({
+		filePath,
+		action: "mkdir"
+	});
 	assertFsSandboxAccess(execServer, record, [{
 		path: filePath,
 		access: "write"
-	}]);
-	const fsBridge = execServer.fsBridge;
+	}, ...canonicalDestination ? [{
+		path: canonicalDestination.policyPath,
+		access: "write"
+	}] : []]);
 	if (record.recursive === false) {
 		const parentPath = posix.dirname(filePath);
 		if ((await fsBridge.stat({ filePath: parentPath }))?.type !== "directory") throw new JsonRpcProtocolError(JSON_RPC_NOT_FOUND, "parent directory not found");
 	}
-	await fsBridge.mkdirp({ filePath });
+	await fsBridge.mkdirp({
+		filePath,
+		pinnedPath: canonicalDestination?.pinnedPath
+	});
 }
 /** Returns normalized metadata for a sandbox path. */
 async function getMetadata(execServer, params) {
@@ -1929,15 +1942,26 @@ async function removePath(execServer, params) {
 	const record = requireObject(params, "fs/remove params");
 	const filePath = resolveExecServerPath(requireString(record.path, "path"), "remove path");
 	const fsSandboxPolicy = resolveFsSandboxPolicy(execServer, record);
+	const canonicalDestination = await execServer.fsBridge.resolvePinnedMutationTarget?.({
+		filePath,
+		action: "remove"
+	});
 	assertResolvedFsSandboxAccess(fsSandboxPolicy, [{
 		path: filePath,
 		access: "write"
-	}]);
-	if (record.recursive !== false) assertNoReadOnlyDescendant(fsSandboxPolicy, filePath, "remove");
+	}, ...canonicalDestination ? [{
+		path: canonicalDestination.policyPath,
+		access: "write"
+	}] : []]);
+	if (record.recursive !== false) {
+		assertNoReadOnlyDescendant(fsSandboxPolicy, filePath, "remove");
+		if (canonicalDestination) assertNoReadOnlyDescendant(fsSandboxPolicy, canonicalDestination.policyPath, "remove");
+	}
 	await execServer.fsBridge.remove({
 		filePath,
 		recursive: record.recursive !== false,
-		force: record.force !== false
+		force: record.force !== false,
+		pinnedPath: canonicalDestination?.pinnedPath
 	});
 }
 /** Copies sandbox files or recursive directories while enforcing source and destination policy. */
@@ -1971,10 +1995,25 @@ async function copySandboxPath(execServer, params) {
 	}]);
 	const sourceStat = await fsBridge.stat({ filePath: params.sourcePath });
 	if (!sourceStat) throw new JsonRpcProtocolError(JSON_RPC_NOT_FOUND, "file not found");
-	if (sourceStat?.type === "directory") {
+	const canonicalDestination = await fsBridge.resolvePinnedMutationTarget?.({
+		filePath: params.destinationPath,
+		action: sourceStat.type === "directory" ? "mkdir" : "copy-destination"
+	});
+	const canonicalPolicyEntries = canonicalDestination ? [{
+		path: canonicalDestination.policyPath,
+		access: "write"
+	}] : [];
+	assertResolvedFsSandboxAccess(params.fsSandboxPolicy, canonicalPolicyEntries);
+	if (sourceStat.type === "directory") {
 		if (!params.recursive) throw new Error(`Cannot copy directory without recursive=true: ${params.sourcePath}`);
-		if (pathContains(normalizeSandboxAbsolutePath(params.sourcePath, "copy source path"), normalizeSandboxAbsolutePath(params.destinationPath, "copy destination path"))) throw new Error("Cannot recursively copy a directory into itself.");
-		await fsBridge.mkdirp({ filePath: params.destinationPath });
+		if (pathContains(normalizeSandboxAbsolutePath((await fsBridge.resolvePinnedMutationTarget?.({
+			filePath: params.sourcePath,
+			action: "mkdir"
+		}))?.policyPath ?? params.sourcePath, "copy source path"), normalizeSandboxAbsolutePath(canonicalDestination?.policyPath ?? params.destinationPath, "copy destination path"))) throw new Error("Cannot recursively copy a directory into itself.");
+		await fsBridge.mkdirp({
+			filePath: params.destinationPath,
+			pinnedPath: canonicalDestination?.pinnedPath
+		});
 		for (const entry of await listDirectoryEntries(execServer, params.sourcePath, params.fsSandboxPolicy)) {
 			if (!entry.isDirectory && !entry.isFile) throw new Error(`Cannot copy unsupported filesystem entry: ${entry.fileName}`);
 			await copySandboxPath(execServer, {
@@ -1990,7 +2029,8 @@ async function copySandboxPath(execServer, params) {
 		await fsBridge.copyFile({
 			sourcePath: params.sourcePath,
 			destinationPath: params.destinationPath,
-			mkdir: true
+			mkdir: true,
+			pinnedPath: canonicalDestination?.pinnedPath
 		});
 		return;
 	}
@@ -2002,7 +2042,8 @@ async function copySandboxPath(execServer, params) {
 	await fsBridge.writeFile({
 		filePath: params.destinationPath,
 		data,
-		mkdir: true
+		mkdir: true,
+		pinnedPath: canonicalDestination?.pinnedPath
 	});
 }
 function assertSandboxFileReadWithinLimit(stat) {
@@ -4221,7 +4262,7 @@ function resolvePluginElicitation(params) {
 	const appId = readFirstString$1(meta, PLUGIN_APP_ID_META_KEYS) ?? readFirstString$1(requestParams, PLUGIN_APP_ID_META_KEYS);
 	const connectorId = readFirstString$1(meta, PLUGIN_CONNECTOR_ID_META_KEYS);
 	const isCodexConnectorApproval = isCodexConnectorApprovalElicitation(requestParams, meta);
-	if (isCodexConnectorApproval && appId && connectorId && appId !== connectorId) return {
+	if (isCodexConnectorApproval && appId && connectorId && codexAppIdentityKey(appId) !== codexAppIdentityKey(connectorId)) return {
 		kind: "decline",
 		reason: "app_id_connector_id_mismatch"
 	};
@@ -4230,20 +4271,19 @@ function resolvePluginElicitation(params) {
 			kind: "decline",
 			reason: "missing_policy_context"
 		};
-		const entry = context.apps[appId];
-		if (entry?.source === "account" && !isCodexConnectorApproval) return {
+		const matches = Object.entries(context.apps).filter(([id]) => codexAppIdentityKey(id) === codexAppIdentityKey(appId)).map(([, entry]) => entry);
+		if (matches.some((entry) => entry.source === "account") && !isCodexConnectorApproval) return {
 			kind: "decline",
 			reason: "account_app_source_mismatch"
 		};
-		return uniquePluginMatch(entry ? [entry] : [], "app_id");
+		return uniquePluginMatch(matches, "app_id");
 	}
 	if (isCodexConnectorApproval && connectorId) {
 		if (!context) return {
 			kind: "decline",
 			reason: "missing_policy_context"
 		};
-		const entry = context.apps[connectorId];
-		return uniquePluginMatch(entry ? [entry] : [], "connector_id");
+		return uniquePluginMatch(Object.entries(context.apps).filter(([id]) => codexAppIdentityKey(id) === codexAppIdentityKey(connectorId)).map(([, entry]) => entry), "connector_id");
 	}
 	const serverName = readNonBlankStringField(requestParams, "serverName");
 	if (serverName && context) {
@@ -5142,6 +5182,11 @@ function createCodexDynamicToolBridge(params) {
 	const registrationNames = inheritedNames ?? new Set(registeredProjection.tools.map((entry) => entry.name));
 	const finalized = finalizeCodexToolAvailability(availableProjection.tools.filter((entry) => registrationNames.has(entry.name)));
 	const availableTools = finalized.tools;
+	const pluginLocalMediaTrustByToolName = /* @__PURE__ */ new Map();
+	for (const { name, tool } of availableTools) {
+		const pluginMeta = getPluginToolMeta(tool);
+		if (pluginMeta) pluginLocalMediaTrustByToolName.set(name, new Set(pluginMeta.trustedLocalMedia === true ? [name] : []));
+	}
 	availableProjection.quarantinedTools.push(...finalized.quarantinedTools);
 	const toolMap = new Map(availableTools.map((entry) => [entry.name, entry]));
 	const quarantinedAvailableToolNames = new Set(availableProjection.quarantinedTools.map((tool) => tool.tool));
@@ -5399,7 +5444,8 @@ function createCodexDynamicToolBridge(params) {
 					autoDeliveryTtsMediaUrls,
 					coreTtsToolResult: autoDeliveryTtsMediaUrls?.length ? rawResult : void 0,
 					messagingTarget: confirmedMessagingTarget,
-					sourceReplyFinal
+					sourceReplyFinal,
+					trustedLocalMediaToolNames: pluginLocalMediaTrustByToolName.get(toolName)
 				});
 				if (deliveredSourceReply || receiptConfirmedSourceReply || toolConfirmedSourceReply) telemetry.didDeliverSourceReplyViaMessageTool = true;
 				const continuesSourceReplyProgress = confirmedSourceReply && sourceReplyFinal === false;
@@ -5573,7 +5619,7 @@ function collectToolTelemetry(params) {
 	if (params.result && !params.signal.aborted) {
 		const media = extractToolResultMediaArtifact(params.result);
 		if (media) {
-			const mediaUrls = filterToolResultMediaUrls(params.toolName, media.mediaUrls, params.mediaTrustResult ?? params.result);
+			const mediaUrls = filterToolResultMediaUrls(params.toolName, media.mediaUrls, params.coreTtsToolResult ?? params.mediaTrustResult ?? params.result, params.trustedLocalMediaToolNames);
 			const seen = new Set(params.telemetry.toolMediaUrls);
 			const autoDeliveryMediaUrls = new Set(params.telemetry.toolAutoDeliveryMediaUrls);
 			const rawAutoDeliveryMediaUrls = new Set(params.autoDeliveryTtsMediaUrls);

package/dist/{effective-mcp-catalog-Bd73bqA8.js → .setup/effective-mcp-catalog-K6kLCN8X.mjs}

@@ -1,6 +1,6 @@
-import { l as sessionBindingIdentity } from "./session-binding-record-Bcvslnhf.js";
-import { _ as retainSharedCodexAppServerClientByInstanceId } from "./shared-client-CscigXXL.js";
-import "./session-binding-CI8UuilT.js";
+import { p as sessionBindingIdentity } from "./session-binding-record-TH3xA0zj.mjs";
+import { _ as retainSharedCodexAppServerClientByInstanceId } from "./shared-client-BpTtuLQ5.mjs";
+import "./session-binding-_0W_fHRr.mjs";
 import { asOptionalRecord, normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { assignMcpCatalogSafeServerNames } from "openclaw/plugin-sdk/agent-harness-runtime";
 //#region extensions/codex/src/app-server/effective-mcp-catalog.ts

package/dist/{ephemeral-turn-D78_VmzO.js → .setup/ephemeral-turn-R1gA8Sn6.mjs}

@@ -1,8 +1,7 @@
-import { o as isJsonObject } from "./protocol-5bh1G-H7.js";
-import { T as readCodexTurnCompletedNotification } from "./client-B57KWPQx.js";
-import { p as getCodexAppServerTurnRouter } from "./attempt-client-cleanup-DKHzbwt5.js";
-import { o as isTerminalTurnStatus, s as readCodexNotificationItem } from "./attempt-notifications-C9XufG6l.js";
-import { t as CodexUsageProjection } from "./event-projector-usage-BfXmpOec.js";
+import { m as isJsonObject } from "./config-security-BRQ2mgW9.mjs";
+import { T as readCodexTurnCompletedNotification } from "./client-vXs2929Q.mjs";
+import { m as getCodexAppServerTurnRouter } from "./attempt-client-cleanup-BpYKdTA0.mjs";
+import { c as readCodexNotificationItem, s as isTerminalTurnStatus, t as CodexUsageProjection } from "./event-projector-usage-C7Ntzs-f.mjs";
 import { readStringField } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { toStringifiedError } from "openclaw/plugin-sdk/error-runtime";
 import { createDeferred } from "openclaw/plugin-sdk/extension-shared";

package/dist/{event-projector-assistant-message-BmBM4qBV.js → .setup/event-projector-assistant-message-DNUR1s0A.mjs}

@@ -1,4 +1,4 @@
-import { t as resolveCodexLocalRuntimeAttribution } from "./local-runtime-attribution-B_2mnqhb.js";
+import { t as resolveCodexLocalRuntimeAttribution } from "./local-runtime-attribution-B_2mnqhb.mjs";
 import { formatErrorMessage } from "openclaw/plugin-sdk/agent-harness-runtime";
 //#region extensions/codex/src/app-server/event-projector-assistant-message.ts
 const ZERO_USAGE = {
@@ -70,13 +70,16 @@ function createAssistantCommentaryMessage(params, text, itemId, timestamp) {
 		}
 	};
 }
-function createAssistantAsyncMessage(params, text, itemId, timestamp) {
+function createAssistantAsyncMessage(params, text, itemId, timestamp, questions) {
 	return {
 		...createNonterminalAssistantMessage(params, [{
 			type: "text",
 			text
 		}], timestamp),
-		openclawAsyncDelivery: { itemId }
+		openclawAsyncDelivery: {
+			itemId,
+			...questions ? { questions } : {}
+		}
 	};
 }
 function createAssistantReasoningMessage(params, text) {

package/dist/{event-projector-items-5VhsECCO.js → .setup/event-projector-items-DyTQ_XqL.mjs}

@@ -1,4 +1,4 @@
-import { o as isJsonObject } from "./protocol-5bh1G-H7.js";
+import { m as isJsonObject } from "./config-security-BRQ2mgW9.mjs";
 import { asFiniteNumber, normalizeOptionalString as normalizeOptionalString$1, readStringField } from "openclaw/plugin-sdk/string-coerce-runtime";
 //#region extensions/codex/src/app-server/event-projector-values.ts
 const BIO_POLICY_SAFETY_ACCESS_BLOCK_PREFIX = "This content was flagged for possible biological risk.";