@openclaw/codex 2026.9.4 → 2026.9.6

package/dist/{dynamic-tools-CmN5RAip.js → .setup/dynamic-tools-BDXl-8Cw.mjs}

@@ -1,47 +1,47 @@
-import { a as flattenCodexDynamicToolFunctions, o as isJsonObject, r as CODEX_OPENCLAW_DIRECT_DYNAMIC_TOOL_NAMESPACE, x as readCodexPluginConfig, y as isCodexRemoteExecPlacementSandbox } from "./protocol-5bh1G-H7.js";
-import { B as withDynamicToolTranscriptDetails, E as createCodexElicitationResponse, L as resolveCodexToolAbortTerminalReason, R as createFailedDynamicToolResponse, w as readCodexTurn, z as withDynamicToolExecutionState } from "./client-B57KWPQx.js";
-import { o as formatCodexDisplayText } from "./command-formatters-lxlkNZgU.js";
-import { c as itemName, f as shouldClearTerminalPresentationForNativeItem, l as itemStatus, n as auditNativeToolTerminalStatus, r as auditNativeToolUnfinishedStatus, t as auditNativeToolName, x as readItem } from "./event-projector-items-5VhsECCO.js";
-import "./config-oIORaQ5T.js";
-import { r as sanitizeInlineImageDataUrl, t as invalidInlineImageText } from "./image-payload-sanitizer-tupAr-2o.js";
-import { h as isCodexNotificationForTurn } from "./attempt-client-cleanup-DKHzbwt5.js";
-import { C as resolveCodexWebSearchPlan, V as emitCodexNativePreToolUseFailureDiagnostic, at as isForcedPrivateQaCodexRuntime, ct as normalizeCodexDynamicToolName, it as filterCodexDynamicToolsForDisabledNativeSurface, rt as filterCodexDynamicTools, st as isSystemAgentOnlyCodexDynamicToolAllowlist } from "./thread-lifecycle-DXl1-I6b.js";
-import { n as resolveCodexNativeExecutionPolicy, r as resolveCodexNodeExecToolOverrides } from "./native-execution-policy-umd0tgh4.js";
-import { a as CODEX_NODE_EXEC_DYNAMIC_TOOL_NAME, c as createNodeExecAliasDynamicTool, i as CODEX_GATEWAY_PROCESS_DYNAMIC_TOOL_NAME, l as isCodexDynamicToolExcluded, o as createGatewayExecProjection, r as CODEX_GATEWAY_EXEC_DYNAMIC_TOOL_NAME, s as createGatewayProcessProjection } from "./provider-capabilities-BvCUL69A.js";
-import { a as requestPluginApprovalOutcome, c as truncateCodexApprovalDisplayText, i as requestPluginApproval, l as waitForPluginApprovalDecision, n as codexApprovalTimeoutText, o as sanitizeCodexApprovalVisibleText, r as mapExecDecisionToOutcome, s as stripDanglingCodexApprovalTerminalSequence, t as approvalRequestExplicitlyUnavailable } from "./plugin-approval-roundtrip-Bz3FT8W5.js";
+import { CODEX_NATIVE_TOOL_REQUIREMENTS } from "../native-tool-policy.js";
+import { d as readCodexPluginConfig, l as isCodexRemoteExecPlacementSandbox } from "./config-parsing-CcB9iPoq.mjs";
+import { i as isJsonObject, r as flattenCodexDynamicToolFunctions, t as CODEX_OPENCLAW_DIRECT_DYNAMIC_TOOL_NAMESPACE } from "./protocol-CANUwXJ3.mjs";
+import { o as formatCodexDisplayText } from "./command-formatters-Bmqvr9tO.mjs";
+import { S as readItem, c as itemName, f as shouldClearTerminalPresentationForNativeItem, l as itemStatus, n as auditNativeToolTerminalStatus, r as auditNativeToolUnfinishedStatus, t as auditNativeToolName } from "./event-projector-items-C6L_5ZiT.mjs";
+import { s as codexAppIdentityKey } from "./plugin-app-cache-key-B2CsSdnV.mjs";
+import "./config-BoTP_mrL.mjs";
+import { r as sanitizeInlineImageDataUrl, t as invalidInlineImageText } from "./image-payload-sanitizer-tupAr-2o.mjs";
+import { V as protectCodexAppServerLiveThread, v as retainSharedCodexAppServerClientIfCurrent } from "./shared-client-DA4VR4Eb.mjs";
+import { E as createCodexElicitationResponse, L as resolveCodexToolAbortTerminalReason, R as createFailedDynamicToolResponse, T as readCodexTurnCompletedNotification, m as CodexServerRequestResolvedError, z as failedToolResult } from "./client-Cs08OXVQ.mjs";
+import { b as readCodexNotificationTurnId, v as isCodexNotificationForTurn, y as readCodexNotificationThreadId } from "./attempt-client-cleanup-CEv1cKwF.mjs";
+import { A as emitCodexNativePreToolUseFailureDiagnostic, at as filterCodexDynamicTools, lt as isSystemAgentOnlyCodexDynamicToolAllowlist, ot as filterCodexDynamicToolsForDisabledNativeSurface, p as resolveCodexWebSearchPlan, st as isForcedPrivateQaCodexRuntime, ut as normalizeCodexDynamicToolName } from "./thread-requests-BLvGkP2R.mjs";
+import { n as resolveCodexNativeExecutionPolicy, r as resolveCodexNodeExecToolOverrides } from "./native-execution-policy-umd0tgh4.mjs";
+import { a as CODEX_NODE_EXEC_DYNAMIC_TOOL_NAME, c as createNodeExecAliasDynamicTool, d as isCodexDynamicToolExcluded, i as CODEX_GATEWAY_PROCESS_DYNAMIC_TOOL_NAME, l as createSandboxExecProjection, o as createGatewayExecProjection, r as CODEX_GATEWAY_EXEC_DYNAMIC_TOOL_NAME, s as createGatewayProcessProjection, u as createSandboxProcessProjection } from "./provider-capabilities-BfE88FZ5.mjs";
+import { a as requestPluginApprovalOutcome, c as truncateCodexApprovalDisplayText, i as requestPluginApproval, l as waitForPluginApprovalDecision, n as codexApprovalTimeoutText, o as sanitizeCodexApprovalVisibleText, r as mapExecDecisionToOutcome, s as stripDanglingCodexApprovalTerminalSequence, t as approvalRequestExplicitlyUnavailable } from "./plugin-approval-roundtrip-C0MZzCuP.mjs";
 import { createRequire } from "node:module";
-import { asNonArrayRecord, asOptionalRecord, isRecord, normalizeOptionalString, normalizeTrimmedStringList, readStringField } from "openclaw/plugin-sdk/string-coerce-runtime";
+import { asNonArrayRecord, asOptionalRecord, isRecord, normalizeTrimmedStringList, readStringField } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { createHash, randomUUID } from "node:crypto";
 import { asDateTimestampMs } from "openclaw/plugin-sdk/number-runtime";
-import { killProcessTree } from "openclaw/plugin-sdk/process-runtime";
+import { signalProcessTree, spawnTerminalPty } from "openclaw/plugin-sdk/process-runtime";
 import { validateJsonSchemaValue } from "openclaw/plugin-sdk/json-schema-runtime";
 import path, { posix } from "node:path";
+import { isPathStrictlyInside, root } from "openclaw/plugin-sdk/file-access-runtime";
 import { expectDefined } from "openclaw/plugin-sdk/expect-runtime";
 import { once } from "node:events";
 import { spawn } from "node:child_process";
 import { coerceErrorMessage } from "openclaw/plugin-sdk/error-runtime";
 import { DEFAULT_MAX_LIVE_TOOL_RESULT_CHARS, estimateToolResultTextChars, resolveLiveToolResultMaxChars, sliceToolResultTextToBudget, sliceUtf16Safe, truncateUtf16Safe } from "openclaw/plugin-sdk/text-utility-runtime";
+import { emitTrustedDiagnosticEvent } from "openclaw/plugin-sdk/diagnostic-runtime";
 import { createDeferred } from "openclaw/plugin-sdk/extension-shared";
 import { createStageTimingTracker, formatStageTimings } from "openclaw/plugin-sdk/time-runtime";
-import { isPathStrictlyInside, root } from "openclaw/plugin-sdk/file-access-runtime";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { resolveAgentDir } from "openclaw/plugin-sdk/agent-runtime";
-import { HEARTBEAT_RESPONSE_TOOL_NAME, buildAgentHookContextChannelFields, buildEmbeddedAttemptToolRunContext, consumeAdjustedParamsForToolCall, consumePreExecutionBlockedToolCall, createAgentToolResultMiddlewareRunner, createCodexAppServerToolResultExtensionRunner, embeddedAgentLog, extractMessagingToolSend, extractMessagingToolSendResult, extractToolResultMediaArtifact, filterProviderNormalizableTools, filterToolResultMediaUrls, finalizeAgentToolAvailability, finalizeToolTerminalPresentation, formatApprovalDisplayPath, formatToolExecutionErrorMessage, getBeforeToolCallFailureDisposition, getChannelAgentToolMeta, getPluginToolMeta, getPluginToolSideEffectOwnerKey, hasNativeHookRelayInvocation, invokeNativeHookRelay, isDeliveredMessageToolOnlySourceReplyResult, isDeliveredMessagingToolResult, isHostScopedAgentToolActive, isMessagingTool, isMessagingToolSendAction, isReplaySafeToolCall, isSubagentSessionKey, isToolResultError, isToolWrappedWithBeforeToolCallHook, normalizeAgentRuntimeTools, normalizeHeartbeatToolResponse, projectRuntimeToolInputSchema, resolveAttemptSpawnWorkspaceDir, resolveModelAuthMode, resolveNativeHookRelayDeferredToolApproval, resolveToolExecutionErrorKind, resolveToolResultFailureKind, runAgentHarnessAfterToolCallHook, sanitizeToolResult, setBeforeToolCallDiagnosticsEnabled, supportsModelTools, wrapToolWithBeforeToolCallHook } from "openclaw/plugin-sdk/agent-harness-runtime";
+import { HEARTBEAT_RESPONSE_TOOL_NAME, applyEmbeddedAttemptToolsAllow, buildAgentHookContextChannelFields, buildEmbeddedAttemptToolRunContext, consumeAdjustedParamsForToolCall, consumePreExecutionBlockedToolCall, createAgentToolResultMiddlewareRunner, createCodexAppServerToolResultExtensionRunner, embeddedAgentLog, extractMessagingToolSend, extractMessagingToolSendResult, extractMessagingToolSourceReplyPayload, extractToolResultMediaArtifact, filterProviderNormalizableTools, filterToolResultMediaUrls, finalizeAgentToolAvailability, finalizeToolTerminalPresentation, formatApprovalDisplayPath, formatToolExecutionErrorMessage, getBeforeToolCallFailureDisposition, getChannelAgentToolMeta, getPluginToolMeta, getPluginToolSideEffectOwnerKey, hasNativeHookRelayInvocation, invokeNativeHookRelay, isDeliveredMessageToolOnlySourceReplyResult, isDeliveredMessagingToolResult, isDeliveredMessagingToolSendToCurrentSource, isHostScopedAgentToolActive, isMessagingTool, isReplaySafeToolCall, isSubagentSessionKey, isToolResultError, isToolWrappedWithBeforeToolCallHook, normalizeAgentRuntimeTools, normalizeHeartbeatToolResponse, projectPluginMessageDeliveryFact, projectRuntimeToolInputSchema, readEmbeddedMessageDeliveryFact, readToolOperatorHint, resolveAttemptSpawnWorkspaceDir, resolveModelAuthMode, resolveNativeHookRelayDeferredToolApproval, resolveToolExecutionErrorKind, resolveToolResultFailureKind, runAgentHarnessAfterToolCallHook, sanitizeToolResult, setBeforeToolCallDiagnosticsEnabled, supportsModelTools, wrapToolWithBeforeToolCallHook } from "openclaw/plugin-sdk/agent-harness-runtime";
 import { formatErrorMessage as formatErrorMessage$2, redactSensitiveText } from "openclaw/plugin-sdk/security-runtime";
-import { emitTrustedDiagnosticEvent } from "openclaw/plugin-sdk/diagnostic-runtime";
+import { consumeTrustedToolNoStartError, copyInternalToolResultState, getCoreTtsToolResultMediaUrls, normalizeAcceptedSessionSpawnResult } from "openclaw/plugin-sdk/agent-harness-tool-runtime";
 import { isIP } from "node:net";
 import { redactToolPayloadText } from "openclaw/plugin-sdk/logging-core";
 import { formatMcpCodexApprovalRemedy, requiresMcpCodexToolApproval, resolveCodexScheduledToolProjectionFactory, resolveProjectedMcpCodexToolApprovalMode, runWithCronCreatorAuthorityCapabilityResolver } from "openclaw/plugin-sdk/codex-mcp-projection";
-import { buildRemoteCommand, isToolAllowed, sanitizeEnvVars } from "openclaw/plugin-sdk/sandbox";
+import { SANDBOX_COMMAND_MAX_BUFFER_BYTES, buildRemoteCommand, isToolAllowed, prepareSandboxProcessCleanup, sanitizeEnvVars } from "openclaw/plugin-sdk/sandbox";
 import { SsrFBlockedError, isBlockedHostnameOrIp } from "openclaw/plugin-sdk/ssrf-runtime";
-import { saveMediaBuffer } from "openclaw/plugin-sdk/media-store";
+import { normalizeMediaReferenceForComparison, saveMediaBuffer } from "openclaw/plugin-sdk/media-store";
 import { getMediaDir } from "openclaw/plugin-sdk/media-runtime";
-import { consumeTrustedToolNoStartError, copyInternalToolResultState, getCoreTtsToolResultMediaUrls } from "openclaw/plugin-sdk/agent-harness-tool-runtime";
 import { normalizeOpenAIStrictCompatSchema } from "openclaw/plugin-sdk/provider-tools";
-//#region extensions/codex/src/app-server/dynamic-tool-build-state.ts
-/** Mutable dependency seam shared by dynamic-tool construction and its behavioral tests. */
-const dynamicToolBuildState = {};
-//#endregion
 //#region extensions/codex/src/app-server/remote-workspace-path.ts
 /** Projects a gateway workspace path into the remote Codex execution workspace. */
 function mapCodexAppServerRemoteWorkspacePath(params) {
@@ -106,14 +106,6 @@ function filterCodexVisionTools(tools, params) {
 * OpenClaw-owned tools, Codex native-tool fallback rules, sandbox shell shims,
 * and provider allowlist normalization.
 */
-const CODEX_NATIVE_SANDBOX_TOOL_REQUIREMENTS = [
-	"exec",
-	"process",
-	"read",
-	"write",
-	"edit",
-	"apply_patch"
-];
 const CODEX_MEMORY_FLUSH_DYNAMIC_TOOL_ALLOW = /* @__PURE__ */ new Set(["read", "write"]);
 const CODEX_DISABLED_NATIVE_SHELL_DYNAMIC_TOOLS = /* @__PURE__ */ new Set([
 	"exec",
@@ -198,7 +190,6 @@ async function buildDynamicTools(input) {
 	const toolBuildStages = createCodexDynamicToolBuildStageTracker();
 	const modelHasVision = params.model.input?.includes("image") ?? false;
 	const agentDir = params.agentDir ?? resolveAgentDir(params.config ?? {}, input.sessionAgentId);
-	const injectedOpenClawCodingToolsFactory = dynamicToolBuildState.openClawCodingToolsFactory;
 	const nativeExecutionPolicy = resolveCodexNativeExecutionPolicyForRun(params, {
 		agentId: input.policyAgentId,
 		runtimeSessionKey: input.sandboxSessionKey,
@@ -210,6 +201,7 @@ async function buildDynamicTools(input) {
 		nativeToolSurfaceEnabled: input.nativeToolSurfaceEnabled,
 		nativeProviderWebSearchSupport: input.nativeProviderWebSearchSupport
 	});
+	const messageToolProvider = resolveCodexMessageToolProvider(params);
 	const webFetchHostnameAllowlistRef = {};
 	const toolConstructionPlan = resolveCodexNodePlacementToolConstructionPlan(input.sandbox, input.nativeToolSurfaceEnabled);
 	const options = {
@@ -229,11 +221,11 @@ async function buildDynamicTools(input) {
 		} : void 0,
 		sandbox: input.sandbox,
 		...toolConstructionPlan ? { toolConstructionPlan } : {},
-		messageProvider: resolveCodexMessageToolProvider(params),
+		messageProvider: messageToolProvider,
 		toolPolicyMessageProvider: params.messageProvider ?? params.messageChannel,
 		...params.onToolResult ? { questionPrompt: {
 			send: params.onToolResult,
-			...params.messageChannel ? { messageChannel: params.messageChannel } : {}
+			messageChannel: messageToolProvider
 		} } : {},
 		inputProvenance: params.inputProvenance,
 		trustedInternalHandoff: params.trustedInternalHandoff,
@@ -253,7 +245,6 @@ async function buildDynamicTools(input) {
 		config: params.config,
 		skillsSnapshot: params.skillsSnapshot,
 		...params.skillLibraryAuthoring ? { skillWorkshop: { libraryAuthoring: params.skillLibraryAuthoring } } : {},
-		githubPublicationAvailable: params.githubPublicationAvailable,
 		authProfileStore: params.toolAuthProfileStore ?? params.authProfileStore,
 		abortSignal: input.runAbortController.signal,
 		emitBeforeToolCallDiagnostics: false,
@@ -300,7 +291,6 @@ async function buildDynamicTools(input) {
 	input.onMessageToolTargetResolved?.(options.requireExplicitMessageTarget === true);
 	const buildOpenClawCodingTools = () => {
 		const bindingOptions = { cwd: input.effectiveCwd ?? input.effectiveWorkspace };
-		if (injectedOpenClawCodingToolsFactory) return params.hostCapabilities.bindToolSurface(injectedOpenClawCodingToolsFactory(options), bindingOptions);
 		const createToolSurface = params.hostCapabilities.createToolSurface;
 		if (!createToolSurface) throw new Error("Codex tool construction requires a current host capability");
 		return createToolSurface(options, bindingOptions);
@@ -336,7 +326,7 @@ async function buildDynamicTools(input) {
 			agentId: input.policyAgentId,
 			sessionKey: input.sandboxSessionKey,
 			sandboxToolPolicy: input.sandbox?.tools,
-			messageProvider: resolveCodexMessageToolProvider(params),
+			messageProvider: messageToolProvider,
 			agentAccountId: params.agentAccountId,
 			groupId: params.groupId,
 			groupChannel: params.groupChannel,
@@ -457,7 +447,7 @@ function canCodexAppServerNativeToolSurfaceHonorSandbox(sandbox, options = {}) {
 	return false;
 }
 function canSandboxToolPolicyExposeCodexNativeToolSurface(sandbox) {
-	return CODEX_NATIVE_SANDBOX_TOOL_REQUIREMENTS.every((toolName) => isToolAllowed(sandbox.tools, toolName));
+	return CODEX_NATIVE_TOOL_REQUIREMENTS.every((toolName) => isToolAllowed(sandbox.tools, toolName));
 }
 function isCodexMemoryFlushRun(params) {
 	return params?.trigger === "memory" && Boolean(params.memoryFlushWritePath?.trim());
@@ -513,29 +503,9 @@ function addSandboxShellDynamicToolsIfAvailable(filteredTools, allTools, input,
 	if (isCodexMemoryFlushRun(input.params) || !executionPolicy.nativeToolSurfaceAllowed || !input.sandbox?.enabled || !input.sandbox.backendId.trim() || input.nativeToolSurfaceEnabled !== false || isSandboxShellDynamicToolExcluded(input.pluginConfig)) return filteredTools;
 	const execTool = allTools.find((tool) => normalizeCodexDynamicToolName(tool.name) === "exec");
 	const processTool = allTools.find((tool) => normalizeCodexDynamicToolName(tool.name) === "process");
-	if (!execTool || !processTool) return filteredTools;
-	const sandboxExecTool = {
-		...execTool,
-		name: "sandbox_exec",
-		description: "Run a shell command through OpenClaw's configured sandbox backend for this session. Use when OpenClaw sandboxing is active or when a command must execute in the sandbox backend, such as an SSH-backed sandbox or Docker container-path bind layout. Use Codex's native shell only when no OpenClaw sandbox is active and native Code Mode is available.",
-		execute: async (toolCallId, args, signal, onUpdate) => {
-			const result = await execTool.execute(toolCallId, args, signal, onUpdate);
-			return {
-				...result,
-				content: result.content.map((item) => item.type === "text" ? Object.assign({}, item, { text: item.text.replace("Use process (list/poll/log/write/send-keys/submit/paste/kill/clear/remove) for follow-up.", "Use sandbox_process (list/poll/log/write/send-keys/submit/paste/kill/clear/remove) for follow-up.") }) : item)
-			};
-		}
-	};
-	const sandboxProcessTool = {
-		...processTool,
-		name: "sandbox_process",
-		description: "Manage background shell sessions through OpenClaw's configured sandbox backend for this session: list, poll, log, write, send-keys, submit, paste, kill, clear, or remove. Use only for sandbox follow-up; use Codex's native shell session handling only when no OpenClaw sandbox is active and native Code Mode is available."
-	};
-	return [
-		...filteredTools,
-		sandboxExecTool,
-		sandboxProcessTool
-	];
+	if (!execTool) return filteredTools;
+	const sandboxTools = [...filteredTools, createSandboxExecProjection(execTool)];
+	return processTool ? [...sandboxTools, createSandboxProcessProjection(processTool)] : sandboxTools;
 }
 function isSandboxShellDynamicToolExcluded(config) {
 	return isCodexDynamicToolExcluded(config, [
@@ -566,13 +536,12 @@ function placeDisabledNativeShellToolsInDirectNamespace(tools, nativeToolSurface
 }
 /** Applies a normalized tool allowlist while preserving shell aliases for exec/process. */
 function filterCodexDynamicToolsForAllowlist(tools, toolsAllow) {
-	if (!toolsAllow) return tools;
-	if (toolsAllow.length === 0) return [];
-	if (hasWildcardCodexToolsAllow(toolsAllow)) return tools;
-	const allowSet = new Set(toolsAllow.map((name) => normalizeCodexDynamicToolName(name)).filter(Boolean));
-	return tools.filter((tool) => {
-		const normalized = normalizeCodexDynamicToolName(tool.name);
-		return allowSet.has(normalized) || normalized === "sandbox_exec" && allowSet.has("exec") || normalized === "sandbox_process" && (allowSet.has("exec") || allowSet.has("process")) || normalized === "gateway_exec" && allowSet.has("exec") || normalized === "gateway_process" && (allowSet.has("exec") || allowSet.has("process")) || normalized === "node_exec" && allowSet.has("exec");
+	return applyEmbeddedAttemptToolsAllow(tools, toolsAllow, {
+		toolMeta: getPluginToolMeta,
+		toolAliases: (tool) => {
+			const normalized = normalizeCodexDynamicToolName(tool.name);
+			return normalized === "sandbox_exec" || normalized === "gateway_exec" || normalized === "node_exec" ? ["exec"] : normalized === "sandbox_process" || normalized === "gateway_process" ? ["exec", "process"] : [];
+		}
 	});
 }
 /** Detects the wildcard allowlist marker after Codex tool-name normalization. */
@@ -645,17 +614,17 @@ var CodexNativeToolLifecycleProjector = class {
 		const params = isJsonObject(notification.params) ? notification.params : void 0;
 		if (!params || !isCodexNotificationForTurn(params, this.threadId, this.turnId)) return;
 		if (isMcpToolCallItemNotification(notification.method, params)) this.pendingMcpNotifications += 1;
-		else if (notification.method === "turn/completed" && readCodexTurn(params.turn)?.id === this.turnId) this.turnCompleted = true;
+		else if (notification.method === "turn/completed" && readCodexTurnCompletedNotification(params)?.turn.id === this.turnId) this.turnCompleted = true;
 	}
 	handleNotification(notification) {
 		const params = isJsonObject(notification.params) ? notification.params : void 0;
 		if (!params || !isCodexNotificationForTurn(params, this.threadId, this.turnId)) return;
 		if (this.pendingMcpNotifications > 0 && isMcpToolCallItemNotification(notification.method, params)) this.pendingMcpNotifications -= 1;
 		if (notification.method === "turn/completed") {
-			const turn = readCodexTurn(params.turn);
+			const turn = readCodexTurnCompletedNotification(params)?.turn;
 			if (!turn || turn.id !== this.turnId) return;
 			this.turnCompleted = true;
-			for (const item of turn.items ?? []) this.recordSnapshotItem(item);
+			for (const item of turn.items) this.recordSnapshotItem(item);
 			return;
 		}
 		if (notification.method === "rawResponseItem/completed") {
@@ -899,6 +868,22 @@ const ATTACHMENT_MEDIA_KEYS = [
 	"fileUrl",
 	"url"
 ];
+function collectCodexMessageMediaUrls(record) {
+	const urls = [];
+	const push = (value) => {
+		if (typeof value === "string" && value.trim()) urls.push(value.trim());
+	};
+	for (const key of MESSAGE_MEDIA_KEYS) push(record[key]);
+	for (const key of MESSAGE_MEDIA_ARRAY_KEYS) {
+		const value = record[key];
+		if (Array.isArray(value)) for (const entry of value) push(entry);
+	}
+	if (Array.isArray(record.attachments)) for (const attachment of record.attachments) {
+		if (!isRecord(attachment)) continue;
+		for (const key of ATTACHMENT_MEDIA_KEYS) push(attachment[key]);
+	}
+	return urls;
+}
 /** Reads actual remote bytes with a cap enforced by Codex before transport. */
 async function readBoundedCodexRemoteWorkspaceFile(params) {
 	if (!Number.isSafeInteger(params.maxBytes) || params.maxBytes < 0) throw new Error("Codex remote workspace upload requires a valid media byte limit.");
@@ -907,10 +892,10 @@ async function readBoundedCodexRemoteWorkspaceFile(params) {
 	let offset = 0;
 	let expectedSize;
 	let expectedRevision;
-	const startedAt = Date.now();
+	const startedAt = performance.now();
 	do {
 		params.signal?.throwIfAborted();
-		const timeoutMs = params.timeoutMs === void 0 ? void 0 : params.timeoutMs - (Date.now() - startedAt);
+		const timeoutMs = params.timeoutMs === void 0 ? void 0 : Math.floor(params.timeoutMs - (performance.now() - startedAt));
 		if (timeoutMs !== void 0 && timeoutMs <= 0) throw new Error("Codex remote workspace file transfer timed out.");
 		let response;
 		try {
@@ -971,7 +956,11 @@ async function readBoundedCodexRemoteWorkspaceFile(params) {
 /** Stages authoritative bounded remote bytes into immutable Gateway-owned media. */
 async function prepareCodexRemoteWorkspaceMessageMedia(params) {
 	const { localWorkspaceRoot, remoteWorkspaceRoot } = params;
-	if (!localWorkspaceRoot || !remoteWorkspaceRoot) return params.args;
+	const sourcePathsByStagedPath = /* @__PURE__ */ new Map();
+	if (!localWorkspaceRoot || !remoteWorkspaceRoot) return {
+		args: params.args,
+		sourcePathsByStagedPath
+	};
 	const remotePathsByLocalPath = /* @__PURE__ */ new Map();
 	const gatewayManagedPaths = /* @__PURE__ */ new Set();
 	const gatewayMediaRoot = getMediaDir();
@@ -990,11 +979,18 @@ async function prepareCodexRemoteWorkspaceMessageMedia(params) {
 		});
 		if (value.trim() && !isCodexPassThroughMediaSource(value)) {
 			attachmentEntries += 1;
-			remotePathsByLocalPath.set(mapped, mapCodexAppServerRemoteWorkspacePath({
+			const remotePath = mapCodexAppServerRemoteWorkspacePath({
 				value: mapped,
 				localWorkspaceRoot,
 				remoteWorkspaceRoot
-			}));
+			});
+			const sourcePaths = remotePathsByLocalPath.get(mapped)?.sourcePaths ?? /* @__PURE__ */ new Set();
+			sourcePaths.add(value);
+			sourcePaths.add(remotePath);
+			remotePathsByLocalPath.set(mapped, {
+				remotePath,
+				sourcePaths
+			});
 		}
 		return mapped;
 	};
@@ -1031,18 +1027,21 @@ async function prepareCodexRemoteWorkspaceMessageMedia(params) {
 	}
 	if (attachmentEntries > REMOTE_WORKSPACE_MEDIA_MAX_ATTACHMENTS) throw new Error(`Codex remote workspace upload exceeds the ${REMOTE_WORKSPACE_MEDIA_MAX_ATTACHMENTS}-attachment limit.`);
 	for (const managedPath of gatewayManagedPaths) await assertGatewayManagedMediaPath(managedPath, gatewayMediaRoot);
-	if (remotePathsByLocalPath.size === 0) return mappedArgs;
+	if (remotePathsByLocalPath.size === 0) return {
+		args: mappedArgs,
+		sourcePathsByStagedPath
+	};
 	const readRemoteFile = params.readRemoteFile;
 	if (!readRemoteFile) throw new Error("Codex remote workspace file transfer requires an active app-server client.");
 	const maxBytes = params.maxBytes ?? REMOTE_WORKSPACE_MEDIA_MAX_BYTES;
 	const timeoutMs = params.timeoutMs ?? REMOTE_WORKSPACE_MEDIA_TIMEOUT_MS;
-	const deadline = Date.now() + timeoutMs;
+	const deadline = performance.now() + timeoutMs;
 	const stagedPaths = /* @__PURE__ */ new Map();
 	let totalBytes = 0;
-	for (const [localPath, remotePath] of remotePathsByLocalPath) {
+	for (const [localPath, { remotePath, sourcePaths }] of remotePathsByLocalPath) {
 		params.signal?.throwIfAborted();
 		const remainingBytes = maxBytes - totalBytes;
-		const remainingMs = deadline - Date.now();
+		const remainingMs = Math.floor(deadline - performance.now());
 		if (remainingMs <= 0) throw new Error("Codex remote workspace attachment batch timed out.");
 		const response = await readRemoteFile({
 			path: remotePath,
@@ -1058,8 +1057,15 @@ async function prepareCodexRemoteWorkspaceMessageMedia(params) {
 		totalBytes += remoteBuffer.byteLength;
 		const saved = await saveMediaBuffer(remoteBuffer, void 0, "outbound", maxBytes, path.basename(remotePath));
 		stagedPaths.set(localPath, saved.path);
+		sourcePathsByStagedPath.set(normalizeMediaReferenceForComparison(saved.path), [...sourcePaths]);
 	}
-	return mapMessageMediaValues(mappedArgs, (value) => stagedPaths.get(value) ?? value);
+	return {
+		args: mapMessageMediaValues(mappedArgs, (value) => stagedPaths.get(value) ?? value),
+		sourcePathsByStagedPath
+	};
+}
+function resolveCodexMediaSourceUrls(mediaUrls, sourcePathsByStagedPath) {
+	return [...new Set(mediaUrls.flatMap((url) => [url, ...sourcePathsByStagedPath?.get(normalizeMediaReferenceForComparison(url)) ?? []]))];
 }
 async function assertGatewayManagedMediaPath(value, mediaRoot) {
 	const opened = await (await root(mediaRoot, { symlinks: "reject" })).open(path.relative(mediaRoot, value), { symlinks: "reject" });
@@ -1091,6 +1097,209 @@ function mapMessageMediaValues(args, mapValue) {
 	return mapped;
 }
 //#endregion
+//#region extensions/codex/src/app-server/native-process-authority.ts
+const clients = /* @__PURE__ */ new WeakMap();
+/** A physical client joins native call receipts to its concrete sandbox processes. */
+function getCodexNativeProcessClient(client) {
+	let owner = clients.get(client);
+	if (!owner) {
+		owner = new CodexNativeProcessClient(client);
+		clients.set(client, owner);
+	}
+	return owner;
+}
+function hasCodexNativeBackgroundProcesses(client, threadId) {
+	return clients.get(client)?.hasProcesses(threadId) ?? false;
+}
+var CodexNativeProcessClient = class {
+	constructor(client) {
+		this.client = client;
+		this.id = randomUUID();
+		this.authPath = `/openclaw-${randomUUID()}`;
+		this.threads = /* @__PURE__ */ new Map();
+		this.closed = false;
+		client.addNotificationHandler((notification) => {
+			if (!isJsonObject(notification.params)) return;
+			const threadId = readCodexNotificationThreadId(notification.params);
+			const turnId = readCodexNotificationTurnId(notification.params);
+			const commands = threadId ? this.threads.get(threadId) : void 0;
+			if (!commands || !turnId) return;
+			if (notification.method === "turn/completed") {
+				for (const command of commands.values()) if (command.turnId === turnId) this.closeAdmission(command);
+			} else if (notification.method === "item/completed") {
+				const item = notification.params.item;
+				const command = isJsonObject(item) && typeof item.id === "string" ? commands.get(item.id) : void 0;
+				if (command?.turnId === turnId) this.closeAdmission(command);
+			}
+		});
+		client.addCloseHandler(() => {
+			this.closed = true;
+			const owners = /* @__PURE__ */ new Set();
+			for (const commands of this.threads.values()) for (const command of commands.values()) owners.add(command.owner);
+			for (const owner of owners) owner.cancelClient(this);
+		});
+	}
+	admit(owner, receipt, parentTurn, assertActive) {
+		if (this.closed) throw new Error("Codex process source client is closed");
+		let commands = this.threads.get(receipt.threadId);
+		const existing = commands?.get(receipt.itemId);
+		if (existing) {
+			if (existing.owner === owner && existing.turnId === receipt.turnId && existing.accepting) return;
+			throw new Error("Codex reused an unsettled native command identity");
+		}
+		if (!commands) {
+			commands = /* @__PURE__ */ new Map();
+			this.threads.set(receipt.threadId, commands);
+		}
+		const command = {
+			...receipt,
+			owner,
+			client: this,
+			parentTurn,
+			accepting: true,
+			processes: /* @__PURE__ */ new Set(),
+			assertActive,
+			releaseClient: retainSharedCodexAppServerClientIfCurrent(this.client),
+			releaseThread: protectCodexAppServerLiveThread(this.client, receipt.threadId)
+		};
+		commands.set(receipt.itemId, command);
+		owner.commands.add(command);
+	}
+	hasProcesses(threadId) {
+		return [...this.threads.get(threadId)?.values() ?? []].some((command) => command.processes.size > 0);
+	}
+	claim(metadata, terminate) {
+		if (this.closed || !isJsonObject(metadata) || typeof metadata.threadId !== "string" || typeof metadata.toolCallId !== "string") throw new Error("Codex process start requires its admitted native command");
+		const command = this.threads.get(metadata.threadId)?.get(metadata.toolCallId);
+		if (!command) throw new Error("Codex process start has no admitted native command");
+		const assertAdmission = () => {
+			command.owner.assertCurrent();
+			command.assertActive();
+			if (this.closed || !command.accepting || this.threads.get(command.threadId)?.get(command.itemId) !== command) throw new Error("Codex native command admission has ended");
+		};
+		assertAdmission();
+		const process = { terminate };
+		command.processes.add(process);
+		let settled = false;
+		return {
+			assertAdmission,
+			assertCurrent: () => {
+				command.owner.assertCurrent();
+				if (this.closed || settled) throw new Error("Codex native process authority has ended");
+			},
+			settle: () => {
+				if (settled) return;
+				settled = true;
+				command.processes.delete(process);
+				this.forgetSettled(command);
+			},
+			fail: (error) => command.owner.reportSettlementFailure(error)
+		};
+	}
+	closeAdmission(command) {
+		command.accepting = false;
+		this.forgetSettled(command);
+	}
+	forgetSettled(command) {
+		if (command.accepting || command.processes.size > 0) return;
+		const commands = this.threads.get(command.threadId);
+		if (commands?.get(command.itemId) === command) {
+			commands.delete(command.itemId);
+			if (commands.size === 0) this.threads.delete(command.threadId);
+		}
+		command.owner.commands.delete(command);
+		command.releaseThread();
+		command.releaseClient?.();
+		command.owner.releaseIfSettled();
+	}
+};
+/** Original-source custody outlives foreground authority, never permitting new admission after release. */
+var CodexNativeProcessAuthority = class {
+	constructor(host, onCleanupFailure) {
+		this.onCleanupFailure = onCleanupFailure;
+		this.commands = /* @__PURE__ */ new Set();
+		this.holds = 1;
+		this.cancelled = false;
+		this.released = false;
+		this.onAbort = () => {
+			if (!this.cancelled) this.cancel().catch(this.onCleanupFailure);
+		};
+		this.source = host.retainSourceAuthority?.();
+		this.source?.signal?.addEventListener("abort", this.onAbort, { once: true });
+		if (this.source?.signal?.aborted) this.onAbort();
+	}
+	assertCurrent() {
+		if (this.cancelled || this.released) throw new Error("Codex native process source has ended");
+		try {
+			this.source?.assertCurrent();
+			if (this.cancelled || this.released) throw new Error("Codex native process source has ended");
+		} catch (error) {
+			this.onAbort();
+			throw error;
+		}
+	}
+	bindTurn(client, threadId, turnId) {
+		this.parentTurn = {
+			client,
+			threadId,
+			turnId
+		};
+	}
+	admit(client, receipt, assertAdmissionCurrent, childParentThreadId) {
+		this.assertCurrent();
+		if (this.holds === 0) throw new Error("Codex native process admission is closed");
+		const parent = this.parentTurn;
+		if (parent?.client !== client || (childParentThreadId ? childParentThreadId !== parent.threadId : receipt.threadId !== parent.threadId || receipt.turnId !== parent.turnId)) throw new Error("Codex native command does not belong to its admitted turn");
+		assertAdmissionCurrent();
+		getCodexNativeProcessClient(client).admit(this, receipt, parent, assertAdmissionCurrent);
+	}
+	retainAdmission() {
+		this.assertCurrent();
+		this.holds += 1;
+		let held = true;
+		return () => {
+			if (held) {
+				held = false;
+				this.release();
+			}
+		};
+	}
+	release() {
+		if (this.holds === 0) return;
+		this.holds -= 1;
+		if (this.holds === 0) for (const command of this.commands) command.client.closeAdmission(command);
+		this.releaseIfSettled();
+	}
+	releaseIfSettled() {
+		if (this.released || this.holds > 0 || this.commands.size > 0) return;
+		this.released = true;
+		this.source?.signal?.removeEventListener("abort", this.onAbort);
+		this.source?.release();
+	}
+	cancelTurn(client, threadId, turnId) {
+		const owner = getCodexNativeProcessClient(client);
+		return this.terminate([...this.commands].filter((command) => command.client === owner && command.parentTurn.threadId === threadId && command.parentTurn.turnId === turnId));
+	}
+	cancelClient(client) {
+		this.terminate([...this.commands].filter((command) => command.client === client)).catch(this.onCleanupFailure);
+	}
+	reportSettlementFailure(error) {
+		this.onCleanupFailure(new AggregateError([error], "Codex native process cleanup failed; background work remains unsettled"));
+	}
+	cancel() {
+		this.cancelled = true;
+		return this.cancellation ??= this.terminate([...this.commands]);
+	}
+	async terminate(commands) {
+		const processes = commands.flatMap((command) => {
+			command.client.closeAdmission(command);
+			return [...command.processes];
+		});
+		const failures = (await Promise.allSettled(processes.map((process) => process.terminate()))).flatMap((result) => result.status === "rejected" ? [result.reason] : []);
+		if (failures.length > 0) throw new AggregateError(failures, "Codex native process cleanup failed; background work remains unsettled");
+	}
+};
+//#endregion
 //#region extensions/codex/src/app-server/sandbox-exec-server-node-relay.ts
 const CODEX_NODE_EXEC_SERVER_MAX_MESSAGE_BYTES$1 = 67108864;
 const CODEX_NODE_EXEC_SERVER_MAX_FAILURE_DETAIL_CHARS = 240;
@@ -1855,32 +2064,50 @@ async function readFile(execServer, params) {
 async function writeFile(execServer, params) {
 	const record = requireObject(params, "fs/writeFile params");
 	const filePath = resolveExecServerPath(requireString(record.path, "path"), "write path");
+	const fsBridge = execServer.fsBridge;
+	const canonicalDestination = await fsBridge.resolvePinnedMutationTarget?.({
+		filePath,
+		action: "write"
+	});
 	assertFsSandboxAccess(execServer, record, [{
 		path: filePath,
 		access: "write"
-	}]);
-	const fsBridge = execServer.fsBridge;
+	}, ...canonicalDestination ? [{
+		path: canonicalDestination.policyPath,
+		access: "write"
+	}] : []]);
 	if ((await fsBridge.stat({ filePath: posix.dirname(filePath) }))?.type !== "directory") throw new JsonRpcProtocolError(JSON_RPC_NOT_FOUND, "parent directory not found");
 	await fsBridge.writeFile({
 		filePath,
 		data: Buffer.from(requireBase64String(record.dataBase64, "dataBase64"), "base64"),
-		mkdir: false
+		mkdir: false,
+		pinnedPath: canonicalDestination?.pinnedPath
 	});
 }
 /** Creates a sandbox directory, respecting recursive and parent-directory semantics. */
 async function createDirectory(execServer, params) {
 	const record = requireObject(params, "fs/createDirectory params");
 	const filePath = resolveExecServerPath(requireString(record.path, "path"), "create-directory path");
+	const fsBridge = execServer.fsBridge;
+	const canonicalDestination = await fsBridge.resolvePinnedMutationTarget?.({
+		filePath,
+		action: "mkdir"
+	});
 	assertFsSandboxAccess(execServer, record, [{
 		path: filePath,
 		access: "write"
-	}]);
-	const fsBridge = execServer.fsBridge;
+	}, ...canonicalDestination ? [{
+		path: canonicalDestination.policyPath,
+		access: "write"
+	}] : []]);
 	if (record.recursive === false) {
 		const parentPath = posix.dirname(filePath);
 		if ((await fsBridge.stat({ filePath: parentPath }))?.type !== "directory") throw new JsonRpcProtocolError(JSON_RPC_NOT_FOUND, "parent directory not found");
 	}
-	await fsBridge.mkdirp({ filePath });
+	await fsBridge.mkdirp({
+		filePath,
+		pinnedPath: canonicalDestination?.pinnedPath
+	});
 }
 /** Returns normalized metadata for a sandbox path. */
 async function getMetadata(execServer, params) {
@@ -1929,15 +2156,26 @@ async function removePath(execServer, params) {
 	const record = requireObject(params, "fs/remove params");
 	const filePath = resolveExecServerPath(requireString(record.path, "path"), "remove path");
 	const fsSandboxPolicy = resolveFsSandboxPolicy(execServer, record);
+	const canonicalDestination = await execServer.fsBridge.resolvePinnedMutationTarget?.({
+		filePath,
+		action: "remove"
+	});
 	assertResolvedFsSandboxAccess(fsSandboxPolicy, [{
 		path: filePath,
 		access: "write"
-	}]);
-	if (record.recursive !== false) assertNoReadOnlyDescendant(fsSandboxPolicy, filePath, "remove");
+	}, ...canonicalDestination ? [{
+		path: canonicalDestination.policyPath,
+		access: "write"
+	}] : []]);
+	if (record.recursive !== false) {
+		assertNoReadOnlyDescendant(fsSandboxPolicy, filePath, "remove");
+		if (canonicalDestination) assertNoReadOnlyDescendant(fsSandboxPolicy, canonicalDestination.policyPath, "remove");
+	}
 	await execServer.fsBridge.remove({
 		filePath,
 		recursive: record.recursive !== false,
-		force: record.force !== false
+		force: record.force !== false,
+		pinnedPath: canonicalDestination?.pinnedPath
 	});
 }
 /** Copies sandbox files or recursive directories while enforcing source and destination policy. */
@@ -1971,10 +2209,25 @@ async function copySandboxPath(execServer, params) {
 	}]);
 	const sourceStat = await fsBridge.stat({ filePath: params.sourcePath });
 	if (!sourceStat) throw new JsonRpcProtocolError(JSON_RPC_NOT_FOUND, "file not found");
-	if (sourceStat?.type === "directory") {
+	const canonicalDestination = await fsBridge.resolvePinnedMutationTarget?.({
+		filePath: params.destinationPath,
+		action: sourceStat.type === "directory" ? "mkdir" : "copy-destination"
+	});
+	const canonicalPolicyEntries = canonicalDestination ? [{
+		path: canonicalDestination.policyPath,
+		access: "write"
+	}] : [];
+	assertResolvedFsSandboxAccess(params.fsSandboxPolicy, canonicalPolicyEntries);
+	if (sourceStat.type === "directory") {
 		if (!params.recursive) throw new Error(`Cannot copy directory without recursive=true: ${params.sourcePath}`);
-		if (pathContains(normalizeSandboxAbsolutePath(params.sourcePath, "copy source path"), normalizeSandboxAbsolutePath(params.destinationPath, "copy destination path"))) throw new Error("Cannot recursively copy a directory into itself.");
-		await fsBridge.mkdirp({ filePath: params.destinationPath });
+		if (pathContains(normalizeSandboxAbsolutePath((await fsBridge.resolvePinnedMutationTarget?.({
+			filePath: params.sourcePath,
+			action: "mkdir"
+		}))?.policyPath ?? params.sourcePath, "copy source path"), normalizeSandboxAbsolutePath(canonicalDestination?.policyPath ?? params.destinationPath, "copy destination path"))) throw new Error("Cannot recursively copy a directory into itself.");
+		await fsBridge.mkdirp({
+			filePath: params.destinationPath,
+			pinnedPath: canonicalDestination?.pinnedPath
+		});
 		for (const entry of await listDirectoryEntries(execServer, params.sourcePath, params.fsSandboxPolicy)) {
 			if (!entry.isDirectory && !entry.isFile) throw new Error(`Cannot copy unsupported filesystem entry: ${entry.fileName}`);
 			await copySandboxPath(execServer, {
@@ -1990,7 +2243,8 @@ async function copySandboxPath(execServer, params) {
 		await fsBridge.copyFile({
 			sourcePath: params.sourcePath,
 			destinationPath: params.destinationPath,
-			mkdir: true
+			mkdir: true,
+			pinnedPath: canonicalDestination?.pinnedPath
 		});
 		return;
 	}
@@ -2002,7 +2256,8 @@ async function copySandboxPath(execServer, params) {
 	await fsBridge.writeFile({
 		filePath: params.destinationPath,
 		data,
-		mkdir: true
+		mkdir: true,
+		pinnedPath: canonicalDestination?.pinnedPath
 	});
 }
 function assertSandboxFileReadWithinLimit(stat) {
@@ -2023,7 +2278,7 @@ function metadataResponse(stat) {
 /** Owns one sandbox subprocess tree through close, reaping, and backend finalization. */
 const SANDBOX_CHILD_TERM_GRACE_MS = 1e3;
 const SANDBOX_CHILD_REAP_TIMEOUT_MS = 4500;
-const SANDBOX_EXEC_MARKER = "CODEX_SANDBOX_EXEC_ID";
+const SANDBOX_CHILD_INTERRUPT_POLL_MS = 50;
 async function spawnSandboxChild(params) {
 	const [command, ...args] = params.argv;
 	const finalize = async (status, exitCode) => await params.finalizeExec?.({
@@ -2037,54 +2292,88 @@ async function spawnSandboxChild(params) {
 		throw new Error("OpenClaw sandbox exec spec did not provide a command.");
 	}
 	let child;
-	try {
-		child = spawn(command, args, {
-			detached: process.platform !== "win32",
-			env: params.env,
-			stdio: [
-				"pipe",
-				"pipe",
-				"pipe"
-			]
-		});
-	} catch (error) {
-		await finalize("failed", null).catch(params.onFinalizeError);
-		throw error;
-	}
+	let pty;
+	let exitOutcome;
 	let outcome;
-	const closed = new Promise((resolve) => {
-		child.once("close", (code, signal) => resolve(outcome = {
-			exitCode: code ?? 1,
+	let escalation;
+	const ready = createDeferred();
+	const exited = createDeferred();
+	const closed = createDeferred();
+	const recordExit = (exitCode, signal) => {
+		if (!exitOutcome) {
+			clearTimeout(escalation);
+			exited.resolve(exitOutcome = {
+				exitCode,
+				signal
+			});
+		}
+	};
+	const recordClose = (exitCode, signal) => {
+		recordExit(exitCode, signal);
+		closed.resolve(outcome = {
+			exitCode,
 			signal
-		}));
-	});
-	let finalizePromise;
+		});
+	};
+	let startFailed = false;
+	let startupPending = true;
+	let terminationRequested = false;
 	let terminationCleanup;
 	let terminationError;
-	const settled = closed.then(async (result) => {
+	let settlementStarted = false;
+	const interruptions = /* @__PURE__ */ new Set();
+	const localSignals = [];
+	const settled = closed.promise.then(async (result) => {
+		settlementStarted = true;
 		await terminationCleanup;
-		child.stdin.destroy();
-		await (finalizePromise ??= finalize(params.finalizeStatus(result), result.exitCode));
+		if (interruptions.size > 0) await Promise.allSettled(interruptions);
+		await Promise.all(localSignals);
+		child?.stdin?.destroy();
+		await finalize(startFailed ? "failed" : params.finalizeStatus(result), startFailed ? null : result.exitCode);
 		return result;
 	});
 	settled.catch(params.onFinalizeError);
+	const assertCurrent = () => {
+		params.assertCurrent?.();
+		if (terminationRequested) throw new Error("Sandbox child process start cancelled");
+	};
 	let terminationPromise;
 	const owner = {
-		process: child,
+		assertCurrent,
+		exited: exited.promise,
+		closed: closed.promise,
 		settled,
 		terminate: () => terminationPromise ??= (async () => {
-			child.stdin.destroy();
+			terminationRequested = true;
+			if (startupPending) await ready.promise;
+			if (startFailed || settlementStarted) return await settled;
+			child?.stdin?.destroy();
 			terminationCleanup = params.terminateRemote?.().catch((error) => {
 				terminationError = error instanceof Error ? error : new Error(String(error));
 			});
 			await terminationCleanup;
 			if (!outcome) {
-				if (child.pid) killProcessTree(child.pid, {
-					detached: process.platform !== "win32",
-					graceMs: SANDBOX_CHILD_TERM_GRACE_MS
-				});
-				else child.kill("SIGTERM");
-				if (!await Promise.race([closed.then(() => true), delay(SANDBOX_CHILD_REAP_TIMEOUT_MS).then(() => false)])) throw new Error(`Sandbox child process tree ${child.pid ?? "unknown"} survived SIGKILL; tear down the sandbox environment and inspect the surviving process tree before retrying.`);
+				const signalLocal = (signal) => {
+					if (exitOutcome) return;
+					if (pty) pty.kill(signal);
+					else if (child?.pid) {
+						const pid = child.pid;
+						localSignals.push(new Promise((resolve) => {
+							signalProcessTree(pid, signal, {
+								detached: process.platform !== "win32",
+								onComplete: resolve
+							});
+						}));
+					} else child?.kill(signal);
+				};
+				signalLocal("SIGTERM");
+				if (!exitOutcome) {
+					escalation = setTimeout(() => signalLocal("SIGKILL"), SANDBOX_CHILD_TERM_GRACE_MS);
+					escalation.unref?.();
+				}
+				const reaped = await Promise.race([closed.promise.then(() => true), delay(SANDBOX_CHILD_REAP_TIMEOUT_MS).then(() => false)]).finally(() => clearTimeout(escalation));
+				await Promise.all(localSignals);
+				if (!reaped) throw new Error(`Sandbox child process tree ${pty?.pid ?? child?.pid ?? "unknown"} survived SIGKILL; tear down the sandbox environment and inspect the surviving process tree before retrying.`);
 			}
 			const result = await settled;
 			if (terminationError) throw terminationError;
@@ -2093,46 +2382,85 @@ async function spawnSandboxChild(params) {
 	};
 	params.owners.add(owner);
 	settled.then(() => params.owners.delete(owner), () => params.owners.delete(owner));
-	return owner;
-}
-function prepareSandboxChildExec(backend, env) {
-	const marker = randomUUID();
-	return {
-		env: {
-			...env,
-			[SANDBOX_EXEC_MARKER]: marker
-		},
-		terminate: async () => {
-			const result = await backend.runShellCommand({
-				script: SANDBOX_REMOTE_TERMINATE_SCRIPT,
-				args: [`${SANDBOX_EXEC_MARKER}=${marker}`],
-				allowFailure: true,
-				signal: AbortSignal.timeout(SANDBOX_CHILD_REAP_TIMEOUT_MS)
-			});
-			if (result.code !== 0) {
-				const detail = result.stderr.toString("utf8").trim() || result.stdout.toString("utf8").trim();
-				throw new Error(detail || `Sandbox process tree cleanup failed with code ${result.code}; tear down the sandbox environment and inspect surviving processes before retrying.`);
+	const interrupt = async () => {
+		await ready.promise;
+		const interruptRemote = params.interruptRemote;
+		if (exitOutcome || terminationRequested || !interruptRemote) return;
+		const interruption = (async () => {
+			const deadline = performance.now() + SANDBOX_CHILD_REAP_TIMEOUT_MS;
+			while (true) {
+				if (exitOutcome || terminationRequested) return;
+				const remainingMs = Math.ceil(deadline - performance.now());
+				if (remainingMs <= 0) throw new Error("Sandbox process interrupt timed out waiting for remote process admission");
+				assertCurrent();
+				if (await interruptRemote(remainingMs)) return;
+				await Promise.race([delay(Math.min(SANDBOX_CHILD_INTERRUPT_POLL_MS, Math.max(0, deadline - performance.now()))), exited.promise]);
 			}
+		})();
+		interruptions.add(interruption);
+		try {
+			await interruption;
+		} finally {
+			interruptions.delete(interruption);
 		}
 	};
+	try {
+		if (params.usePty) {
+			const env = Object.fromEntries(Object.entries(params.env).filter((entry) => entry[1] !== void 0));
+			pty = await spawnTerminalPty({
+				file: command,
+				args,
+				cwd: params.cwd,
+				env,
+				cols: 80,
+				rows: 24
+			}, { assertCurrent });
+			pty.onExit(({ exitCode, signal }) => {
+				recordClose(signal ? 1 : exitCode, signal || null);
+			});
+			return {
+				...owner,
+				pty,
+				interrupt
+			};
+		}
+		assertCurrent();
+		child = spawn(command, args, {
+			detached: process.platform !== "win32",
+			env: params.env,
+			cwd: params.cwd,
+			stdio: [
+				"pipe",
+				"pipe",
+				"pipe"
+			]
+		});
+		child.once("exit", (code, signal) => recordExit(code ?? 1, signal));
+		child.once("close", (code, signal) => recordClose(code ?? 1, signal));
+		const markStartFailed = () => {
+			startFailed = true;
+		};
+		child.once("error", markStartFailed);
+		try {
+			await once(child, "spawn");
+		} finally {
+			child.off("error", markStartFailed);
+		}
+		return {
+			...owner,
+			process: child,
+			interrupt
+		};
+	} catch (error) {
+		startFailed = true;
+		if (!child) recordClose(1, null);
+		await settled.catch(() => void 0);
+		throw error;
+	} finally {
+		startupPending = false;
+		ready.resolve();
+	}
 }
-const SANDBOX_REMOTE_TERMINATE_SCRIPT = String.raw`
-find_owned_pids() {
-  for env_file in /proc/[0-9]*/environ; do
-    if [ -r "$env_file" ] && tr '\0' '\n' < "$env_file" 2>/dev/null | grep -Fqx "$1"; then
-      basename "$(dirname "$env_file")"
-    fi
-  done
-}
-owned="$(find_owned_pids "$1")"
-[ -z "$owned" ] || kill -TERM $owned 2>/dev/null || true
-sleep 1
-owned="$(find_owned_pids "$1")"
-[ -z "$owned" ] || kill -KILL $owned 2>/dev/null || true
-sleep 1
-owned="$(find_owned_pids "$1")"
-[ -z "$owned" ] || { echo "Sandbox process IDs survived SIGKILL: $owned" >&2; exit 1; }
-`.trim();
 function delay(ms) {
 	return new Promise((resolve) => {
 		setTimeout(resolve, ms).unref?.();
@@ -2147,7 +2475,7 @@ function delay(ms) {
 /** Maximum JSON-line size accepted from the streaming HTTP helper process. */
 const SANDBOX_HTTP_STREAM_LINE_MAX_CHARS = 262144;
 /** Handles one sandbox HTTP JSON-RPC request, optionally streaming response body deltas. */
-async function httpRequest(execServer, notifications, params) {
+async function httpRequest(execServer, notifications, params, operations) {
 	const record = requireObject(params, "http/request params");
 	const requestId = requireString(record.requestId, "requestId");
 	const url = requireString(record.url, "url");
@@ -2163,11 +2491,14 @@ async function httpRequest(execServer, notifications, params) {
 		redirectPolicy,
 		streamResponse: record.streamResponse === true
 	};
-	if (request.streamResponse) return await runStreamingSandboxHttpRequest(execServer, notifications, requestId, request);
-	return await runSandboxHttpRequest(execServer, {
-		...request,
-		streamResponse: false
+	const response = createDeferred();
+	const operation = runSandboxHttpRequest(execServer, notifications, requestId, request, response);
+	operations.add(operation);
+	operation.then(() => operations.delete(operation), (error) => {
+		operations.delete(operation);
+		response.reject(error);
 	});
+	return await response.promise;
 }
 function assertSandboxHttpRequestTargetAllowed(url) {
 	let parsed;
@@ -2179,50 +2510,54 @@ function assertSandboxHttpRequestTargetAllowed(url) {
 	if (parsed.protocol !== "http:" && parsed.protocol !== "https:") throw new SsrFBlockedError(`Blocked non-HTTP(S) protocol in sandbox http/request: ${parsed.protocol}`);
 	if (isBlockedHostnameOrIp(parsed.hostname)) throw new SsrFBlockedError(`Blocked hostname or private/internal IP in sandbox http/request: ${parsed.hostname}`);
 }
-async function runSandboxHttpRequest(execServer, params) {
-	const result = await execServer.backend.runShellCommand({
-		script: SANDBOX_HTTP_REQUEST_SCRIPT,
-		stdin: JSON.stringify(params),
-		allowFailure: true
-	});
-	if (result.code !== 0) {
-		const stderr = result.stderr.toString("utf8").trim();
-		throw new Error(stderr || `sandbox http/request failed with code ${result.code}`);
-	}
-	const parsed = JSON.parse(result.stdout.toString("utf8"));
-	if (typeof parsed.status !== "number" || !Array.isArray(parsed.headers)) throw new Error("sandbox http/request returned an invalid response envelope");
-	return {
-		status: parsed.status,
-		headers: readHttpHeaders(parsed.headers),
-		bodyBase64: typeof parsed.bodyBase64 === "string" ? parsed.bodyBase64 : ""
-	};
-}
-async function runStreamingSandboxHttpRequest(execServer, notifications, requestId, params) {
-	const backend = execServer.backend;
-	const remoteExec = prepareSandboxChildExec(backend, {});
-	const execSpec = await backend.buildExecSpec({
-		command: SANDBOX_HTTP_REQUEST_SCRIPT,
-		workdir: execServer.sandbox.containerWorkdir,
-		env: remoteExec.env,
-		usePty: false
-	});
+async function runSandboxHttpRequest(execServer, notifications, requestId, params, response) {
 	const lifecycle = { failed: false };
-	const owner = await spawnSandboxChild({
-		argv: execSpec.argv,
-		env: execSpec.env,
-		finalizeExec: backend.finalizeExec,
-		finalizeToken: execSpec.finalizeToken,
-		finalizeStatus: (outcome) => lifecycle.failed || outcome.exitCode !== 0 ? "failed" : "completed",
-		onFinalizeError: (error) => {
-			embeddedAgentLog.warn("codex sandbox http/request finalize failed", { error });
-		},
-		owners: execServer.children,
-		terminateRemote: remoteExec.terminate
-	});
+	let owner;
+	try {
+		notifications.signal.throwIfAborted();
+		const backend = execServer.backend;
+		const remoteExec = prepareSandboxProcessCleanup(backend, {});
+		const execSpec = await backend.buildExecSpec({
+			command: SANDBOX_HTTP_REQUEST_SCRIPT,
+			workdir: execServer.sandbox.containerWorkdir,
+			env: remoteExec.env,
+			usePty: false
+		});
+		owner = await spawnSandboxChild({
+			argv: execSpec.argv,
+			env: execSpec.env,
+			cwd: execSpec.cwd,
+			assertCurrent: () => {
+				notifications.signal.throwIfAborted();
+				execSpec.assertCurrent?.();
+			},
+			finalizeExec: backend.finalizeExec,
+			finalizeToken: execSpec.finalizeToken,
+			finalizeStatus: (outcome) => lifecycle.failed || outcome.exitCode !== 0 ? "failed" : "completed",
+			onFinalizeError: (error) => {
+				embeddedAgentLog.warn("codex sandbox http/request finalize failed", { error });
+			},
+			owners: execServer.children,
+			terminateRemote: remoteExec.terminate
+		});
+	} catch (error) {
+		response.reject(error);
+		return;
+	}
 	const child = owner.process;
+	const completion = createDeferred();
+	owner.settled.then(() => completion.resolve(), completion.reject);
+	let termination;
+	const terminate = () => {
+		if (!termination) {
+			termination = owner.terminate().then(() => void 0);
+			termination.then(completion.resolve, completion.reject);
+		}
+		return termination;
+	};
 	const abortOnSessionClose = () => {
 		lifecycle.failed = true;
-		owner.terminate().catch((error) => {
+		terminate().catch((error) => {
 			embeddedAgentLog.warn("codex sandbox http/request cleanup failed", { error });
 		});
 	};
@@ -2230,21 +2565,38 @@ async function runStreamingSandboxHttpRequest(execServer, notifications, request
 	child.once("close", () => {
 		notifications.signal.removeEventListener("abort", abortOnSessionClose);
 	});
-	if (notifications.signal.aborted) abortOnSessionClose();
 	child.stdin.on("error", (error) => {
 		if (error.code === "EPIPE" || error.code === "ERR_STREAM_DESTROYED") return;
 		embeddedAgentLog.warn("codex sandbox http/request stdin write failed", { error });
 	});
-	child.stdin.end(JSON.stringify(params));
-	return await readStreamingSandboxHttpResponse({
+	readSandboxHttpResponse({
 		child,
 		lifecycle,
-		owner,
+		terminate,
 		requestId,
-		notifications
-	});
+		notifications,
+		streamResponse: params.streamResponse
+	}).then(response.resolve, response.reject);
+	try {
+		if (notifications.signal.aborted) abortOnSessionClose();
+		else {
+			owner.assertCurrent();
+			child.stdin.end(JSON.stringify(params));
+		}
+		await completion.promise;
+		await termination;
+	} catch (error) {
+		lifecycle.failed = true;
+		response.reject(error);
+		await terminate().catch((cleanupError) => {
+			embeddedAgentLog.warn("codex sandbox http/request cleanup failed", { error: cleanupError });
+		});
+		throw error;
+	} finally {
+		notifications.signal.removeEventListener("abort", abortOnSessionClose);
+	}
 }
-function readStreamingSandboxHttpResponse(params) {
+function readSandboxHttpResponse(params) {
 	return new Promise((resolve, reject) => {
 		let headerResolved = false;
 		let failed = false;
@@ -2252,11 +2604,21 @@ function readStreamingSandboxHttpResponse(params) {
 		let lastBodySeq = 0;
 		let stdoutBuffer = "";
 		let stderr = "";
-		const fail = (message, _exitCode) => {
+		const buffered = {
+			stdout: {
+				chunks: [],
+				bytes: 0
+			},
+			stderr: {
+				chunks: [],
+				bytes: 0
+			}
+		};
+		const fail = (message) => {
 			if (failed) return;
 			failed = true;
 			params.lifecycle.failed = true;
-			params.owner.terminate().catch((error) => {
+			params.terminate().catch((error) => {
 				embeddedAgentLog.warn("codex sandbox http/request cleanup failed", { error });
 			});
 			if (headerResolved) {
@@ -2271,9 +2633,28 @@ function readStreamingSandboxHttpResponse(params) {
 			}
 			reject(new Error(message));
 		};
-		params.child.stdout.setEncoding("utf8");
+		const bufferOutput = (stream, chunk) => {
+			const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+			const output = buffered[stream];
+			output.bytes += buffer.byteLength;
+			if (output.bytes > SANDBOX_COMMAND_MAX_BUFFER_BYTES) {
+				fail(`sandbox http/request ${stream} exceeded ${SANDBOX_COMMAND_MAX_BUFFER_BYTES} bytes`);
+				return;
+			}
+			output.chunks.push(buffer);
+		};
+		if (params.streamResponse) {
+			params.child.stdout.setEncoding("utf8");
+			params.child.stderr.setEncoding("utf8");
+		}
 		params.child.stdout.on("data", (chunk) => {
-			stdoutBuffer += chunk;
+			if (failed) return;
+			if (!params.streamResponse) {
+				bufferOutput("stdout", chunk);
+				return;
+			}
+			const text = typeof chunk === "string" ? chunk : chunk.toString("utf8");
+			stdoutBuffer += text;
 			let newline = stdoutBuffer.indexOf("\n");
 			while (newline >= 0) {
 				const line = stdoutBuffer.slice(0, newline).trim();
@@ -2300,15 +2681,20 @@ function readStreamingSandboxHttpResponse(params) {
 						});
 					}
 				} catch (error) {
-					fail(error instanceof Error ? error.message : String(error), null);
+					fail(error instanceof Error ? error.message : String(error));
 				}
 				newline = stdoutBuffer.indexOf("\n");
 			}
-			if (stdoutBuffer.length > SANDBOX_HTTP_STREAM_LINE_MAX_CHARS) fail(`sandbox http/request produced an unterminated stdout line longer than ${SANDBOX_HTTP_STREAM_LINE_MAX_CHARS} characters`, null);
+			if (stdoutBuffer.length > SANDBOX_HTTP_STREAM_LINE_MAX_CHARS) fail(`sandbox http/request produced an unterminated stdout line longer than ${SANDBOX_HTTP_STREAM_LINE_MAX_CHARS} characters`);
 		});
-		params.child.stderr.setEncoding("utf8");
 		params.child.stderr.on("data", (chunk) => {
-			stderr = sliceUtf16Safe(`${stderr}${chunk}`, -4096);
+			if (failed) return;
+			if (!params.streamResponse) {
+				bufferOutput("stderr", chunk);
+				return;
+			}
+			const text = typeof chunk === "string" ? chunk : chunk.toString("utf8");
+			stderr = sliceUtf16Safe(`${stderr}${text}`, -4096);
 		});
 		params.child.once("error", (error) => {
 			childFailure ??= error.message;
@@ -2318,17 +2704,32 @@ function readStreamingSandboxHttpResponse(params) {
 			const exitCode = code ?? 1;
 			if (failed) return;
 			if (childFailure) {
-				fail(childFailure, exitCode);
+				fail(childFailure);
 				return;
 			}
 			if (exitCode === 0) {
+				if (!params.streamResponse) {
+					try {
+						const parsed = JSON.parse(Buffer.concat(buffered.stdout.chunks).toString("utf8"));
+						if (typeof parsed.status !== "number" || !Array.isArray(parsed.headers)) throw new Error("sandbox http/request returned an invalid response envelope");
+						resolve({
+							status: parsed.status,
+							headers: readHttpHeaders(parsed.headers),
+							bodyBase64: typeof parsed.bodyBase64 === "string" ? parsed.bodyBase64 : ""
+						});
+					} catch (error) {
+						fail(error instanceof Error ? error.message : String(error));
+					}
+					return;
+				}
 				if (!headerResolved) {
 					params.lifecycle.failed = true;
 					reject(/* @__PURE__ */ new Error("sandbox http/request exited before returning headers"));
 				}
 				return;
 			}
-			fail(stderr.trim() || `sandbox http/request failed with code ${exitCode}`, exitCode);
+			if (!params.streamResponse) stderr = Buffer.concat(buffered.stderr.chunks).toString("utf8");
+			fail(stderr.trim() || `sandbox http/request failed with code ${exitCode}`);
 		});
 	});
 }
@@ -2576,7 +2977,7 @@ const ENV_KEY_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
 const RETAINED_PROCESS_OUTPUT_BYTES = 1048576;
 const CLOSED_PROCESS_EVICTION_MS = 6e4;
 /** Starts a sandbox-backed process and registers it in the connection-local process table. */
-async function startProcess(execServer, processes, notify, params) {
+async function startProcess(execServer, processes, notify, params, processAuthority) {
 	const record = requireObject(params, "process/start params");
 	const processId = requireString(record.processId, "processId");
 	if (processes.has(processId)) throw new Error(`process already exists: ${processId}`);
@@ -2608,18 +3009,39 @@ async function startProcess(execServer, processes, notify, params) {
 			managed.evictionTimer.unref?.();
 		}
 	};
+	const source = processAuthority?.claim(record.metadata, async () => {
+		await terminateManagedProcess(managed);
+	});
 	processes.set(processId, managed);
 	const startPromise = runProcess(execServer, managed, {
 		argv,
 		cwd,
-		env
+		env,
+		source
 	});
 	managed.startPromise = startPromise;
+	startPromise.catch(() => void 0).then(async () => {
+		await managed.child?.settled;
+		if (managed.terminationRequested) await managed.child?.terminate();
+		source?.settle();
+	}).catch((error) => {
+		source?.fail(error);
+		embeddedAgentLog.warn("codex sandbox process settlement failed", {
+			processId,
+			error: coerceErrorMessage(error)
+		});
+	});
 	try {
 		await startPromise;
 	} catch (error) {
-		processes.delete(processId);
 		managed.failure = coerceErrorMessage(error);
+		await managed.child?.terminate().catch((cleanupError) => {
+			embeddedAgentLog.warn("codex sandbox failed-start cleanup failed", {
+				processId,
+				error: coerceErrorMessage(cleanupError)
+			});
+		});
+		processes.delete(processId);
 		managed.exitCode = null;
 		managed.exited = true;
 		managed.closed = true;
@@ -2643,13 +3065,14 @@ function assertSupportedProcessSandbox(execServer, record) {
 }
 async function runProcess(execServer, managed, params) {
 	const backend = execServer.backend;
+	params.source?.assertAdmission();
 	throwIfProcessStartCancelled(managed);
-	const remoteExec = prepareSandboxChildExec(backend, params.env);
+	const remoteExec = prepareSandboxProcessCleanup(backend, params.env);
 	const execSpec = await backend.buildExecSpec({
-		command: buildRemoteCommand(params.argv),
+		command: `exec ${buildRemoteCommand(params.argv)}`,
 		workdir: params.cwd,
 		env: remoteExec.env,
-		usePty: false
+		usePty: managed.tty
 	});
 	if (managed.terminationRequested) {
 		await backend.finalizeExec?.({
@@ -2660,9 +3083,18 @@ async function runProcess(execServer, managed, params) {
 		});
 		throw new Error("process start cancelled");
 	}
+	let spawned = false;
 	const owner = await spawnSandboxChild({
 		argv: execSpec.argv,
 		env: execSpec.env,
+		cwd: execSpec.cwd,
+		usePty: managed.tty,
+		assertCurrent: () => {
+			if (spawned) params.source?.assertCurrent();
+			else params.source?.assertAdmission();
+			execSpec.assertCurrent?.();
+			throwIfProcessStartCancelled(managed);
+		},
 		finalizeExec: backend.finalizeExec,
 		finalizeToken: execSpec.finalizeToken,
 		finalizeStatus: () => managed.failure ? "failed" : "completed",
@@ -2675,19 +3107,29 @@ async function runProcess(execServer, managed, params) {
 			});
 		},
 		owners: execServer.children,
-		terminateRemote: remoteExec.terminate
+		terminateRemote: remoteExec.terminate,
+		interruptRemote: remoteExec.interrupt
 	});
+	spawned = true;
 	managed.child = owner;
+	owner.exited.then(({ exitCode }) => emitProcessExited(managed, exitCode));
+	owner.closed.then(({ exitCode }) => emitProcessClosed(managed, exitCode));
+	if ("pty" in owner) {
+		owner.pty.onData((chunk) => appendProcessChunk(managed, "pty", Buffer.from(chunk)));
+		return;
+	}
 	const child = owner.process;
-	child.stdout.on("data", (chunk) => appendProcessChunk(managed, managed.tty ? "pty" : "stdout", chunk));
+	child.stdout.on("data", (chunk) => appendProcessChunk(managed, "stdout", chunk));
 	child.stderr.on("data", (chunk) => appendProcessChunk(managed, "stderr", chunk));
 	child.once("error", (error) => {
 		managed.failure ??= error.message;
 		notifyProcessWaiters(managed);
 	});
-	child.once("close", (code) => {
-		emitProcessClosed(managed, code ?? 1);
+	child.stdin.on("error", (error) => {
+		managed.failure ??= error.message;
+		notifyProcessWaiters(managed);
 	});
+	owner.assertCurrent();
 	if (!managed.tty && !managed.pipeStdin) child.stdin.end();
 }
 function throwIfProcessStartCancelled(managed) {
@@ -2716,7 +3158,7 @@ function appendProcessChunk(managed, stream, data) {
 	});
 	notifyProcessWaiters(managed);
 }
-function emitProcessClosed(managed, exitCode) {
+function emitProcessExited(managed, exitCode) {
 	if (!managed.exited) {
 		const exitSeq = managed.nextSeq;
 		managed.nextSeq += 1;
@@ -2725,9 +3167,14 @@ function emitProcessClosed(managed, exitCode) {
 		if (exitCode !== null) managed.emitNotification("process/exited", {
 			processId: managed.processId,
 			seq: exitSeq,
-			exitCode
+			exitCode,
+			sandboxDenied: false
 		});
 	}
+	notifyProcessWaiters(managed);
+}
+function emitProcessClosed(managed, exitCode) {
+	emitProcessExited(managed, exitCode);
 	if (!managed.closed) {
 		const closeSeq = managed.nextSeq;
 		managed.nextSeq += 1;
@@ -2759,7 +3206,7 @@ async function readProcess(processes, params) {
 	const managed = requireProcess(processes, requireString(record.processId, "processId"));
 	const afterSeq = typeof record.afterSeq === "number" ? record.afterSeq : 0;
 	const waitMs = typeof record.waitMs === "number" && record.waitMs > 0 ? record.waitMs : 0;
-	if (!managed.exited && !hasChunksAtOrAfter(managed, afterSeq) && waitMs > 0) await waitForProcessUpdate(managed, waitMs);
+	if (!managed.closed && managed.nextSeq - 1 <= afterSeq && waitMs > 0) await waitForProcessUpdate(managed, waitMs);
 	const chunks = limitProcessChunks(managed.chunks.filter((chunk) => chunk.seq > afterSeq), typeof record.maxBytes === "number" && record.maxBytes > 0 ? record.maxBytes : void 0);
 	const lastChunk = chunks.at(-1);
 	return {
@@ -2778,15 +3225,37 @@ function writeProcess(processes, params) {
 	const managed = processes.get(processId);
 	if (!managed) return { status: "unknownProcess" };
 	const chunk = Buffer.from(requireString(record.chunk, "chunk"), "base64");
-	if (!managed.tty && !managed.pipeStdin || managed.closed || !managed.child?.process.stdin.writable) return { status: "stdinClosed" };
-	managed.child.process.stdin.write(chunk);
+	if (!managed.tty && !managed.pipeStdin || managed.closed || !managed.child) return { status: "stdinClosed" };
+	if ("pty" in managed.child) {
+		managed.child.assertCurrent();
+		managed.child.pty.write(chunk);
+	} else {
+		if (!managed.child.process.stdin.writable) return { status: "stdinClosed" };
+		managed.child.assertCurrent();
+		managed.child.process.stdin.write(chunk);
+	}
 	return { status: "accepted" };
 }
+async function signalProcess(processes, params) {
+	const record = requireObject(params, "process/signal params");
+	const processId = requireString(record.processId, "processId");
+	if (record.signal !== "interrupt") throw new Error("process/signal only supports interrupt");
+	const managed = processes.get(processId);
+	if (managed && !managed.exited) {
+		await managed.startPromise;
+		managed.child?.assertCurrent();
+		await managed.child?.interrupt();
+	}
+	return {};
+}
 /** Requests process termination and reports whether it was running at call time. */
 async function terminateProcess(processes, params) {
 	const processId = requireString(requireObject(params, "process/terminate params").processId, "processId");
 	const managed = processes.get(processId);
 	if (!managed) return { running: false };
+	return await terminateManagedProcess(managed);
+}
+async function terminateManagedProcess(managed) {
 	const running = !managed.exited;
 	managed.terminationRequested = true;
 	await managed.startPromise?.catch(() => void 0);
@@ -2810,9 +3279,6 @@ function notifyProcessWaiters(managed) {
 	managed.waiters = [];
 	for (const waiter of waiters) waiter();
 }
-function hasChunksAtOrAfter(managed, afterSeq) {
-	return managed.chunks.some((chunk) => chunk.seq > afterSeq);
-}
 function requireProcess(processes, processId) {
 	const managed = processes.get(processId);
 	if (!managed) throw new Error(`unknown process: ${processId}`);
@@ -2861,11 +3327,13 @@ function readStringList(value) {
 /** Owns the JSON-RPC protocol and resources of one sandbox execution connection. */
 /** Connection-local execution state; closing it never enables session resumption. */
 var CodexSandboxExecSession = class {
-	constructor(execServer, transport) {
+	constructor(execServer, transport, processAuthority) {
 		this.execServer = execServer;
 		this.transport = transport;
+		this.processAuthority = processAuthority;
 		this.processes = /* @__PURE__ */ new Map();
 		this.fileReads = /* @__PURE__ */ new Map();
+		this.httpRequests = /* @__PURE__ */ new Set();
 		this.closeController = new AbortController();
 		this.notifications = {
 			isOpen: transport.isOpen,
@@ -2900,7 +3368,10 @@ var CodexSandboxExecSession = class {
 		if (!this.cleanup) {
 			this.closeController.abort();
 			closeAllFileReads(this.fileReads);
-			this.cleanup = Promise.all([...this.processes.keys()].map(async (processId) => terminateProcess(this.processes, { processId }))).then(() => void 0);
+			this.cleanup = Promise.allSettled([...this.httpRequests, ...[...this.processes.keys()].map(async (processId) => terminateProcess(this.processes, { processId }))]).then((results) => {
+				const failures = results.flatMap((result) => result.status === "rejected" ? [result.reason] : []);
+				if (failures.length > 0) throw new AggregateError(failures, "Codex sandbox execution cleanup failed");
+			});
 		}
 		return this.cleanup;
 	}
@@ -2916,9 +3387,10 @@ var CodexSandboxExecSession = class {
 				capabilities: { networkProxyLaunch: false }
 			};
 			case "environment/status": return { status: "ready" };
-			case "process/start": return startProcess(this.execServer, this.processes, this.notifications.send, params);
+			case "process/start": return startProcess(this.execServer, this.processes, this.notifications.send, params, this.processAuthority);
 			case "process/read": return await readProcess(this.processes, params);
 			case "process/write": return writeProcess(this.processes, params);
+			case "process/signal": return await signalProcess(this.processes, params);
 			case "process/terminate": return await terminateProcess(this.processes, params);
 			case "fs/open": return await openFile(this.execServer, this.fileReads, params);
 			case "fs/readBlock": return readFileBlock(this.fileReads, params);
@@ -2938,7 +3410,7 @@ var CodexSandboxExecSession = class {
 			case "fs/copy":
 				await copyPath(this.execServer, params);
 				return {};
-			case "http/request": return await httpRequest(this.execServer, this.notifications, params);
+			case "http/request": return await httpRequest(this.execServer, this.notifications, params, this.httpRequests);
 			default: throw new JsonRpcProtocolError(JSON_RPC_METHOD_NOT_FOUND, `Unsupported OpenClaw sandbox exec-server method: ${method}`);
 		}
 	}
@@ -2965,9 +3437,17 @@ async function ensureCodexSandboxExecServerEnvironment(params) {
 		signal: params.signal,
 		onExecutionDisconnect: params.onExecutionDisconnect
 	});
-	const environmentId = nodeLease ? `openclaw-node-${nodeLease.id}` : execServer.environmentId;
+	const processAuthority = params.requireProcessAuthority && !("node" in execServer) ? getCodexNativeProcessClient(params.client) : void 0;
+	if (processAuthority && !("node" in execServer)) {
+		const authorities = execServer.processAuthorities ??= /* @__PURE__ */ new Map();
+		if (!authorities.has(processAuthority.authPath)) {
+			authorities.set(processAuthority.authPath, processAuthority);
+			params.client.addCloseHandler(() => authorities.delete(processAuthority.authPath));
+		}
+	}
+	const environmentId = nodeLease ? `openclaw-node-${nodeLease.id}` : processAuthority ? `${execServer.environmentId}-${processAuthority.id}` : execServer.environmentId;
 	try {
-		const execServerUrl = nodeLease ? `${execServer.url}?lease=${nodeLease.id}` : execServer.url;
+		const execServerUrl = nodeLease ? `${execServer.url}?lease=${nodeLease.id}` : processAuthority ? new URL(processAuthority.authPath, execServer.url).href : execServer.url;
 		await params.client.request("environment/add", {
 			environmentId,
 			execServerUrl
@@ -3139,7 +3619,8 @@ async function startOpenClawExecServer(sandbox) {
 			handleNodeConnection(execServer, socket, request);
 			return;
 		}
-		handleConnection(execServer, socket);
+		const requestPath = new URL(request.url ?? "", "ws://127.0.0.1").pathname;
+		handleConnection(execServer, socket, execServer.processAuthorities?.get(requestPath));
 	});
 	embeddedAgentLog.info("codex sandbox exec-server started", {
 		environmentId,
@@ -3161,7 +3642,8 @@ function buildEnvironmentId(sandbox) {
 	return `openclaw-sandbox-${createHash("sha256").update(sandbox.runtimeId).digest("hex").slice(0, 16)}`;
 }
 function isAuthorizedExecServerRequest(execServer, request) {
-	return new URL(request.url ?? "", "ws://127.0.0.1").pathname === execServer.authPath;
+	const url = new URL(request.url ?? "", "ws://127.0.0.1");
+	return url.pathname === execServer.authPath || !("node" in execServer) && execServer.processAuthorities?.has(url.pathname) === true;
 }
 function readCodexPlacementNodeId(sandbox) {
 	if (!("placementExecutionMode" in sandbox) || sandbox.placementExecutionMode !== "remote-exec" || !("placementNodeId" in sandbox) || typeof sandbox.placementNodeId !== "string" || !sandbox.placementNodeId) return;
@@ -3214,11 +3696,11 @@ function handleClosedCodexNodeExecServerLease(execServer, lease, result) {
 		closeCodexNodeExecServerLease(execServer, lease);
 	}
 }
-function handleConnection(execServer, socket) {
+function handleConnection(execServer, socket, processAuthority) {
 	const session = new CodexSandboxExecSession(execServer, {
 		isOpen: () => socket.readyState === socket.OPEN,
 		send: (message) => socket.send(JSON.stringify(message))
-	});
+	}, processAuthority);
 	socket.on("message", (data) => {
 		handleMessage(session, data).catch((error) => {
 			embeddedAgentLog.warn("codex sandbox exec-server message failed", { error });
@@ -3241,6 +3723,73 @@ async function handleMessage(session, data) {
 	await session.handleRequest(parseRequest(buffer.toString("utf8")));
 }
 //#endregion
+//#region extensions/codex/src/app-server/native-command-approval.ts
+const PERSISTENT_APPROVAL_TARGET_MAX_LENGTH = 256;
+function resolveCommandApproval(requestParams, outcome) {
+	if (outcome === "cancelled") return {
+		scope: "cancelled",
+		decision: "cancel"
+	};
+	if (outcome === "denied" || outcome === "unavailable") return {
+		scope: "denied",
+		decision: "decline"
+	};
+	const capabilities = commandApprovalCapabilities(requestParams);
+	if (outcome === "approved-session" && capabilities.repeated) return capabilities.repeated;
+	return capabilities.once ? {
+		scope: "once",
+		decision: "accept"
+	} : {
+		scope: "denied",
+		decision: "decline"
+	};
+}
+function commandApprovalAllowedDecisions(requestParams, requiresOneShot) {
+	if (!Array.isArray(requestParams?.availableDecisions)) return;
+	const capabilities = commandApprovalCapabilities(requestParams);
+	const decisions = [];
+	if (capabilities.once) decisions.push("allow-once");
+	if (!requiresOneShot && capabilities.repeated) decisions.push("allow-always");
+	decisions.push("deny");
+	return decisions;
+}
+function commandApprovalCapabilities(requestParams) {
+	const available = requestParams?.availableDecisions;
+	if (!Array.isArray(available)) return {
+		once: true,
+		repeated: {
+			scope: "session",
+			decision: "acceptForSession"
+		}
+	};
+	return {
+		once: available.includes("accept"),
+		repeated: available.includes("acceptForSession") ? {
+			scope: "session",
+			decision: "acceptForSession"
+		} : findAvailableCommandPersistentApproval(available)
+	};
+}
+function findAvailableCommandPersistentApproval(available) {
+	for (const decision of available) {
+		if (!isJsonObject(decision)) continue;
+		const exec = decision.acceptWithExecpolicyAmendment;
+		const network = decision.applyNetworkPolicyAmendment;
+		const prefix = isJsonObject(exec) ? exec.execpolicy_amendment : void 0;
+		const amendment = isJsonObject(network) ? network.network_policy_amendment : void 0;
+		let target;
+		if (Array.isArray(prefix) && prefix.length > 0 && prefix.every((part) => typeof part === "string")) target = `Command prefix: ${JSON.stringify(prefix)}`;
+		else if (isJsonObject(amendment) && amendment.action === "allow" && typeof amendment.host === "string" && amendment.host.length > 0) target = `Network host: ${JSON.stringify(amendment.host)}`;
+		else continue;
+		if (target.length > PERSISTENT_APPROVAL_TARGET_MAX_LENGTH || sanitizeCodexApprovalVisibleText(target) !== target) continue;
+		return {
+			scope: "persistent",
+			decision,
+			description: `Allow Always requests a persistent allow rule for future sessions.\n${target}`
+		};
+	}
+}
+//#endregion
 //#region extensions/codex/src/app-server/approval-bridge.ts
 /**
 * Bridges Codex app-server approval requests into OpenClaw policy hooks and
@@ -3266,12 +3815,14 @@ async function handleCodexAppServerApprovalRequest(params) {
 		paramsForRun: params.paramsForRun
 	});
 	if (params.signal?.aborted) {
+		if (params.signal.reason instanceof CodexServerRequestResolvedError) return;
 		recordNativeToolFailureDisposition(params, context, "cancelled");
 		return buildApprovalResponse(params.method, context.requestParams, "cancelled");
 	}
 	let revalidateMutableFileApproval;
 	let mutableFileApprovalRequiresOneShot = false;
-	const resolvePolicyApproval = async (outcome, message = approvalResolutionMessage(outcome), approvalId) => {
+	let approvalId;
+	const resolvePolicyApproval = async (outcome, message = approvalResolutionMessage(outcome), resolvedApprovalId) => {
 		let resolvedOutcome = outcome;
 		let resolvedMessage = message;
 		if (outcome !== "denied" && revalidateMutableFileApproval) {
@@ -3285,6 +3836,16 @@ async function handleCodexAppServerApprovalRequest(params) {
 			resolvedOutcome = "approved-once";
 			resolvedMessage = "Codex app-server approval granted for this byte-bound command only.";
 		}
+		if (params.method === "item/commandExecution/requestApproval" && resolvedOutcome !== "denied") {
+			const resolution = resolveCommandApproval(context.requestParams, resolvedOutcome);
+			if (resolution.scope === "denied") {
+				resolvedOutcome = "denied";
+				resolvedMessage = "Codex app-server request does not offer the approved scope.";
+			} else if (resolvedOutcome === "approved-session" && resolution.scope === "once") {
+				resolvedOutcome = "approved-once";
+				resolvedMessage = approvalResolutionMessage(resolvedOutcome);
+			} else if (resolution.scope === "persistent") resolvedMessage = "Codex app-server approval granted; persistent policy amendment requested for future sessions.";
+		}
 		params.signal?.throwIfAborted();
 		if (resolvedOutcome !== "denied") params.paramsForRun.hostCapabilities.assertActive();
 		emitApprovalEvent(params.paramsForRun, {
@@ -3292,9 +3853,9 @@ async function handleCodexAppServerApprovalRequest(params) {
 			kind: context.kind,
 			status: resolvedOutcome === "denied" ? "denied" : "approved",
 			title: context.title,
-			...approvalId ? {
-				approvalId,
-				approvalSlug: approvalId
+			...resolvedApprovalId ? {
+				approvalId: resolvedApprovalId,
+				approvalSlug: resolvedApprovalId
 			} : {},
 			...context.eventDetails,
 			...approvalEventScope(params.method, resolvedOutcome),
@@ -3331,22 +3892,25 @@ async function handleCodexAppServerApprovalRequest(params) {
 			return await resolvePolicyApproval("denied", policyOutcome.reason);
 		}
 		if (policyOutcome?.outcome === "approved-once" || policyOutcome?.outcome === "approved-session") return await resolvePolicyApproval(policyOutcome.outcome);
-		if (CONCRETE_TOOL_AUTO_APPROVAL_METHODS.has(params.method) && !readNetworkApprovalContext(requestParams) && params.autoApprove === true) return await resolvePolicyApproval("approved-session", "Codex app-server approval auto-approved by runtime policy.");
+		if (CONCRETE_TOOL_AUTO_APPROVAL_METHODS.has(params.method) && !readNetworkApprovalContext(requestParams) && params.autoApprove === true) return await resolvePolicyApproval("approved-once", "Codex app-server approval auto-approved by runtime policy.");
+		const allowedDecisions = nativeApprovalAllowedDecisions({
+			method: params.method,
+			requestParams,
+			requiresOneShot: mutableFileApprovalRequiresOneShot
+		});
+		const repeatedApproval = params.method === "item/commandExecution/requestApproval" && allowedDecisions?.includes("allow-always") ? commandApprovalCapabilities(requestParams).repeated : void 0;
 		const requestResult = await requestPluginApproval({
 			hostCapabilities: params.paramsForRun.hostCapabilities,
 			signal: params.signal,
 			title: context.title,
-			description: context.description,
+			description: repeatedApproval?.scope === "persistent" ? `${repeatedApproval.description}\n${context.description}` : context.description,
 			severity: context.severity,
 			toolName: context.toolName,
 			toolCallId: context.approvalId,
-			allowedDecisions: nativeApprovalAllowedDecisions({
-				method: params.method,
-				requestParams,
-				requiresOneShot: mutableFileApprovalRequiresOneShot
-			})
+			allowedDecisions
 		});
-		const approvalId = requestResult?.id;
+		approvalId = requestResult?.id;
+		params.signal?.throwIfAborted();
 		if (!approvalId) {
 			recordNativeToolFailureDisposition(params, context, "failed");
 			emitApprovalEvent(params.paramsForRun, {
@@ -3375,16 +3939,16 @@ async function handleCodexAppServerApprovalRequest(params) {
 			signal: params.signal,
 			hostCapabilities: params.paramsForRun.hostCapabilities
 		});
-		const approvalTimedOut = !params.signal?.aborted && approvalResult?.terminalReason === "timeout";
-		const outcome = params.signal?.aborted ? "cancelled" : mapExecDecisionToOutcome(approvalResult?.decision);
+		params.signal?.throwIfAborted();
+		const approvalTimedOut = approvalResult?.terminalReason === "timeout";
+		const outcome = mapExecDecisionToOutcome(approvalResult?.decision);
 		if (approvalTimedOut) recordNativeToolFailureDisposition(params, context, "timed_out", context.approvalKind);
-		else if (outcome === "cancelled") recordNativeToolFailureDisposition(params, context, params.signal?.aborted ? resolveCodexToolAbortTerminalReason(params.signal) : "cancelled");
 		else if (outcome === "unavailable") recordNativeToolFailureDisposition(params, context, "failed");
 		if (outcome === "approved-once" || outcome === "approved-session") return await resolvePolicyApproval(outcome, approvalResolutionMessage(outcome), approvalId);
 		emitApprovalEvent(params.paramsForRun, {
 			phase: "resolved",
 			kind: context.kind,
-			status: outcome === "denied" ? "denied" : outcome === "unavailable" ? "unavailable" : outcome === "cancelled" ? "failed" : "approved",
+			status: outcome,
 			title: context.title,
 			approvalId,
 			approvalSlug: approvalId,
@@ -3394,6 +3958,7 @@ async function handleCodexAppServerApprovalRequest(params) {
 		});
 		return buildApprovalResponse(params.method, context.requestParams, outcome);
 	} catch (error) {
+		if (params.signal?.reason instanceof CodexServerRequestResolvedError) return;
 		const cancelled = params.signal?.aborted === true;
 		recordNativeToolFailureDisposition(params, context, cancelled && params.signal ? resolveCodexToolAbortTerminalReason(params.signal) : "failed");
 		emitApprovalEvent(params.paramsForRun, {
@@ -3401,6 +3966,10 @@ async function handleCodexAppServerApprovalRequest(params) {
 			kind: context.kind,
 			status: cancelled ? "failed" : "unavailable",
 			title: context.title,
+			...approvalId ? {
+				approvalId,
+				approvalSlug: approvalId
+			} : {},
 			...context.eventDetails,
 			...approvalEventScope(params.method, cancelled ? "cancelled" : "denied"),
 			message: cancelled ? "Codex app-server approval cancelled because the run stopped." : `Codex app-server approval route failed: ${formatCodexDisplayText(coerceErrorMessage(error))}`
@@ -3417,7 +3986,7 @@ function recordNativeToolFailureDisposition(params, context, disposition, approv
 }
 /** Converts an OpenClaw approval outcome into the app-server method response. */
 function buildApprovalResponse(method, requestParams, outcome) {
-	if (method === "item/commandExecution/requestApproval") return { decision: commandApprovalDecision(requestParams, outcome) };
+	if (method === "item/commandExecution/requestApproval") return { decision: resolveCommandApproval(requestParams, outcome).decision };
 	if (method === "item/fileChange/requestApproval") return { decision: fileChangeApprovalDecision(outcome) };
 	if (method === "item/permissions/requestApproval") {
 		if (outcome === "approved-session" || outcome === "approved-once") return {
@@ -3675,28 +4244,13 @@ function stableJsonText(value) {
 		return entries.every((entry) => entry !== void 0) ? `{${entries.join(",")}}` : void 0;
 	}
 }
-function commandApprovalDecision(requestParams, outcome) {
-	if (outcome === "cancelled") return "cancel";
-	if (outcome === "denied" || outcome === "unavailable") return "decline";
-	const capabilities = commandApprovalCapabilities(requestParams);
-	if (outcome === "approved-session" && capabilities.sessionDecision !== void 0) return capabilities.sessionDecision;
-	return capabilities.once ? "accept" : "decline";
-}
 function nativeApprovalAllowedDecisions(params) {
 	if (params.method === "item/fileChange/requestApproval") return [
 		"allow-once",
 		"allow-always",
 		"deny"
 	];
-	if (params.method !== "item/commandExecution/requestApproval") return;
-	const available = params.requestParams?.availableDecisions;
-	if (!Array.isArray(available)) return;
-	const capabilities = commandApprovalCapabilities(params.requestParams);
-	const decisions = [];
-	if (capabilities.once) decisions.push("allow-once");
-	if (!params.requiresOneShot && capabilities.sessionDecision !== void 0) decisions.push("allow-always");
-	decisions.push("deny");
-	return decisions;
+	return params.method === "item/commandExecution/requestApproval" ? commandApprovalAllowedDecisions(params.requestParams, params.requiresOneShot) : void 0;
 }
 function fileChangeApprovalDecision(outcome) {
 	if (outcome === "cancelled") return "cancel";
@@ -3878,22 +4432,6 @@ function isPrivateNetworkHostPattern(value) {
 	if (wildcardStripped.startsWith("10.") || wildcardStripped.startsWith("127.") || wildcardStripped.startsWith("192.168.") || wildcardStripped.startsWith("169.254.")) return true;
 	return /^172\.(1[6-9]|2\d|3[0-1])\./.test(wildcardStripped);
 }
-function commandApprovalCapabilities(requestParams) {
-	const available = requestParams?.availableDecisions;
-	if (!Array.isArray(available)) return {
-		once: true,
-		sessionDecision: "acceptForSession"
-	};
-	return {
-		once: available.includes("accept"),
-		...available.includes("acceptForSession") ? { sessionDecision: "acceptForSession" } : { sessionDecision: findAvailableCommandAmendmentDecision(requestParams) }
-	};
-}
-function findAvailableCommandAmendmentDecision(requestParams) {
-	const available = requestParams?.availableDecisions;
-	if (!Array.isArray(available)) return;
-	return available.find((entry) => isJsonObject(entry) && (isJsonObject(entry.acceptWithExecpolicyAmendment) || isJsonObject(entry.applyNetworkPolicyAmendment)));
-}
 function approvalResolutionMessage(outcome) {
 	return {
 		"approved-session": "Codex app-server approval granted for the session.",
@@ -4221,7 +4759,7 @@ function resolvePluginElicitation(params) {
 	const appId = readFirstString$1(meta, PLUGIN_APP_ID_META_KEYS) ?? readFirstString$1(requestParams, PLUGIN_APP_ID_META_KEYS);
 	const connectorId = readFirstString$1(meta, PLUGIN_CONNECTOR_ID_META_KEYS);
 	const isCodexConnectorApproval = isCodexConnectorApprovalElicitation(requestParams, meta);
-	if (isCodexConnectorApproval && appId && connectorId && appId !== connectorId) return {
+	if (isCodexConnectorApproval && appId && connectorId && codexAppIdentityKey(appId) !== codexAppIdentityKey(connectorId)) return {
 		kind: "decline",
 		reason: "app_id_connector_id_mismatch"
 	};
@@ -4230,20 +4768,19 @@ function resolvePluginElicitation(params) {
 			kind: "decline",
 			reason: "missing_policy_context"
 		};
-		const entry = context.apps[appId];
-		if (entry?.source === "account" && !isCodexConnectorApproval) return {
+		const matches = Object.entries(context.apps).filter(([id]) => codexAppIdentityKey(id) === codexAppIdentityKey(appId)).map(([, entry]) => entry);
+		if (matches.some((entry) => entry.source === "account") && !isCodexConnectorApproval) return {
 			kind: "decline",
 			reason: "account_app_source_mismatch"
 		};
-		return uniquePluginMatch(entry ? [entry] : [], "app_id");
+		return uniquePluginMatch(matches, "app_id");
 	}
 	if (isCodexConnectorApproval && connectorId) {
 		if (!context) return {
 			kind: "decline",
 			reason: "missing_policy_context"
 		};
-		const entry = context.apps[connectorId];
-		return uniquePluginMatch(entry ? [entry] : [], "connector_id");
+		return uniquePluginMatch(Object.entries(context.apps).filter(([id]) => codexAppIdentityKey(id) === codexAppIdentityKey(connectorId)).map(([, entry]) => entry), "connector_id");
 	}
 	const serverName = readNonBlankStringField(requestParams, "serverName");
 	if (serverName && context) {
@@ -4979,142 +5516,6 @@ function applyCurrentMessageProvider(toolName, args, currentProvider) {
 		provider
 	};
 }
-function normalizeRouteToken(value) {
-	if (typeof value === "number") return Number.isFinite(value) ? String(value) : void 0;
-	const normalized = value?.trim().toLowerCase();
-	return normalized ? normalized : void 0;
-}
-function sourceRouteTokens(hookContext) {
-	const tokens = /* @__PURE__ */ new Set();
-	const currentTarget = normalizeRouteToken(hookContext?.currentMessagingTarget);
-	const currentChannel = normalizeRouteToken(hookContext?.currentChannelId);
-	const currentProvider = normalizeRouteToken(hookContext?.currentChannelProvider);
-	if (currentTarget) tokens.add(currentTarget);
-	if (currentChannel) tokens.add(currentChannel);
-	const channelPrefixIndex = currentChannel?.indexOf(":") ?? -1;
-	if (channelPrefixIndex >= 0 && currentChannel) {
-		const unprefixedChannel = currentChannel.slice(channelPrefixIndex + 1);
-		if (unprefixedChannel) {
-			tokens.add(unprefixedChannel);
-			for (const segment of unprefixedChannel.split(/[;,]/u)) {
-				const token = normalizeRouteToken(segment);
-				if (token) tokens.add(token);
-			}
-		}
-	}
-	if (currentProvider && currentChannel?.startsWith(`${currentProvider}:`)) {
-		const unprefixedChannel = currentChannel.slice(currentProvider.length + 1);
-		if (unprefixedChannel) tokens.add(unprefixedChannel);
-	}
-	return tokens;
-}
-function routeTokenMatchesSource(token, hookContext) {
-	const normalized = normalizeRouteToken(token);
-	return normalized !== void 0 && sourceRouteTokens(hookContext).has(normalized);
-}
-function routeProviderMatchesSource(provider, hookContext) {
-	const normalized = normalizeRouteToken(provider);
-	if (!normalized) return false;
-	const currentProvider = normalizeRouteToken(hookContext?.currentChannelProvider);
-	const currentChannel = normalizeRouteToken(hookContext?.currentChannelId);
-	return currentProvider === normalized || currentChannel?.startsWith(`${normalized}:`) === true;
-}
-function routeTokenMatchesCurrentMessage(token, hookContext) {
-	const normalized = normalizeRouteToken(token);
-	return normalized !== void 0 && normalized === normalizeRouteToken(hookContext?.currentMessageId);
-}
-function readRouteToken(record, key) {
-	const value = record[key];
-	return typeof value === "string" || typeof value === "number" ? value : void 0;
-}
-function explicitRouteTokensMismatchCurrent(args, keys, currentToken) {
-	const normalizedCurrent = normalizeRouteToken(currentToken);
-	if (!normalizedCurrent) return false;
-	return keys.some((key) => {
-		const normalized = normalizeRouteToken(readRouteToken(args, key));
-		return normalized !== void 0 && normalized !== normalizedCurrent;
-	});
-}
-function explicitThreadRouteTargetsNonSource(args, hookContext, messagingTarget) {
-	const normalizedCurrentThread = normalizeRouteToken(hookContext?.currentThreadId);
-	const explicitThreadTokens = [...EXPLICIT_MESSAGE_THREAD_KEYS.map((key) => normalizeRouteToken(readRouteToken(args, key))), normalizeRouteToken(messagingTarget?.threadId)].filter((value) => value !== void 0);
-	if (explicitThreadTokens.length === 0) return false;
-	return normalizedCurrentThread === void 0 || explicitThreadTokens.some((value) => value !== normalizedCurrentThread);
-}
-function replyReceiptMatchesCurrentMessage(value, hookContext, depth = 0) {
-	if (depth > 4 || value === null) return false;
-	if (typeof value === "string") {
-		const trimmed = value.trim();
-		if (!trimmed || !["{", "["].includes(trimmed[0] ?? "")) return false;
-		try {
-			return replyReceiptMatchesCurrentMessage(JSON.parse(trimmed), hookContext, depth + 1);
-		} catch {
-			return false;
-		}
-	}
-	if (typeof value !== "object") return false;
-	if (Array.isArray(value)) return value.some((item) => replyReceiptMatchesCurrentMessage(item, hookContext, depth + 1));
-	const record = value;
-	for (const key of [
-		"repliedTo",
-		"replyTo",
-		"replyToId",
-		"replyToIdFull"
-	]) if (routeTokenMatchesCurrentMessage(typeof record[key] === "string" ? record[key] : void 0, hookContext)) return true;
-	for (const key of [
-		"content",
-		"details",
-		"payload",
-		"receipt",
-		"result",
-		"results",
-		"sendResult",
-		"text"
-	]) if (replyReceiptMatchesCurrentMessage(record[key], hookContext, depth + 1)) return true;
-	return false;
-}
-function hasExplicitNonSourceMessageRoute(args, hookContext, messagingTarget) {
-	const currentProvider = normalizeRouteToken(hookContext?.currentChannelProvider);
-	for (const key of EXPLICIT_MESSAGE_PROVIDER_KEYS) {
-		const provider = normalizeRouteToken(typeof args[key] === "string" ? args[key] : void 0);
-		if (provider && currentProvider !== provider && !routeProviderMatchesSource(provider, hookContext)) return true;
-	}
-	const targetValues = [...EXPLICIT_MESSAGE_TARGET_KEYS.map((key) => typeof args[key] === "string" ? args[key] : void 0), ...Array.isArray(args.targets) ? args.targets.map((value) => typeof value === "string" ? value : void 0) : []].filter((value) => normalizeRouteToken(value) !== void 0);
-	if (explicitThreadRouteTargetsNonSource(args, hookContext, messagingTarget)) return true;
-	if (explicitRouteTokensMismatchCurrent(args, EXPLICIT_MESSAGE_REPLY_KEYS, hookContext?.currentMessageId)) return true;
-	if (messagingTarget?.to !== void 0 && !routeTokenMatchesSource(messagingTarget.to, hookContext)) return true;
-	if (messagingTarget?.to !== void 0) return false;
-	if (targetValues.length === 0) return false;
-	if (targetValues.some((value) => !routeTokenMatchesSource(value, hookContext))) return true;
-	return false;
-}
-function normalizeAcceptedSessionSpawn(result) {
-	const details = asOptionalRecord(asOptionalRecord(result)?.details);
-	if (!details || details.status !== "accepted") return null;
-	const runId = normalizeOptionalString(details.runId);
-	const childSessionKey = normalizeOptionalString(details.childSessionKey);
-	return runId && childSessionKey ? {
-		runId,
-		childSessionKey
-	} : null;
-}
-const EXPLICIT_MESSAGE_PROVIDER_KEYS = ["channel", "provider"];
-const EXPLICIT_MESSAGE_TARGET_KEYS = [
-	"target",
-	"to",
-	"channelId"
-];
-const EXPLICIT_MESSAGE_THREAD_KEYS = [
-	"threadId",
-	"thread_id",
-	"messageThreadId",
-	"topicId"
-];
-const EXPLICIT_MESSAGE_REPLY_KEYS = [
-	"replyTo",
-	"replyToId",
-	"replyToIdFull"
-];
 function computerFrameImageIdentity(content) {
 	if (!Array.isArray(content)) return;
 	const images = content.filter((block) => block.type === "image");
@@ -5142,6 +5543,11 @@ function createCodexDynamicToolBridge(params) {
 	const registrationNames = inheritedNames ?? new Set(registeredProjection.tools.map((entry) => entry.name));
 	const finalized = finalizeCodexToolAvailability(availableProjection.tools.filter((entry) => registrationNames.has(entry.name)));
 	const availableTools = finalized.tools;
+	const pluginLocalMediaTrustByToolName = /* @__PURE__ */ new Map();
+	for (const { name, tool } of availableTools) {
+		const pluginMeta = getPluginToolMeta(tool);
+		if (pluginMeta) pluginLocalMediaTrustByToolName.set(name, new Set(pluginMeta.trustedLocalMedia === true ? [name] : []));
+	}
 	availableProjection.quarantinedTools.push(...finalized.quarantinedTools);
 	const toolMap = new Map(availableTools.map((entry) => [entry.name, entry]));
 	const quarantinedAvailableToolNames = new Set(availableProjection.quarantinedTools.map((tool) => tool.tool));
@@ -5161,6 +5567,7 @@ function createCodexDynamicToolBridge(params) {
 		messagingToolSentMediaUrls: [],
 		messagingToolSentTargets: [],
 		messagingToolSourceReplyPayloads: [],
+		confirmedMediaDeliveries: [],
 		toolMediaUrls: [],
 		toolAutoDeliveryMediaUrls: [],
 		coreTtsToolResults: [],
@@ -5264,16 +5671,16 @@ function createCodexDynamicToolBridge(params) {
 			try {
 				const prepare = tool.prepareArguments;
 				const toolArgs = prepare ? Reflect.apply(prepare, tool, [rawArguments]) : args;
-				const preparedArgs = toolName === "message" && isRecord(toolArgs) ? await prepareCodexRemoteWorkspaceMessageMedia({
+				const preparedMessageMedia = toolName === "message" && isRecord(toolArgs) ? await prepareCodexRemoteWorkspaceMessageMedia({
 					args: toolArgs,
 					localWorkspaceRoot: params.hookContext?.workspaceDir,
 					remoteWorkspaceRoot: params.hookContext?.remoteWorkspaceRoot,
 					readRemoteFile: readRemoteWorkspaceFile,
 					timeoutMs: params.hookContext?.remoteWorkspaceRequestTimeoutMs,
 					signal
-				}) : toolArgs;
-				const telemetryArgs = isRecord(preparedArgs) ? preparedArgs : args;
-				executedArgs = structuredClone(telemetryArgs);
+				}) : void 0;
+				const preparedArgs = preparedMessageMedia?.args ?? toolArgs;
+				executedArgs = structuredClone(isRecord(preparedArgs) ? preparedArgs : args);
 				const messagingContext = {
 					config: params.hookContext?.config,
 					currentChannelId: params.hookContext?.currentChannelId,
@@ -5298,10 +5705,41 @@ function createCodexDynamicToolBridge(params) {
 				}));
 				const rawResult = await Reflect.apply(tool.execute, tool, executionArgs);
 				captureExecutionBoundary();
-				if (toolName === "message" && asOptionalRecord(asOptionalRecord(rawResult.details)?.messageDelivery)?.sourceReplyDelivered === true) telemetry.sourceReplyDelivered = true;
-				const telemetryRawResult = sanitizeToolResult(rawResult);
 				const rawIsError = isToolResultError(rawResult);
+				const messageDelivery = readEmbeddedMessageDeliveryFact(asOptionalRecord(asOptionalRecord(rawResult)?.details)?.messageDelivery);
+				const messagingDelivered = isMessagingTool(toolName) && (messageDelivery ? messageDelivery.status === "settled" && (!rawIsError || messageDelivery.partialDelivery) : isDeliveredMessagingToolResult({
+					toolName,
+					args: executedArgs,
+					result: rawResult,
+					isError: rawIsError
+				}));
+				const mediaDelivery = messagingDelivered ? messageDelivery ?? projectPluginMessageDeliveryFact(rawResult) : void 0;
+				const mediaDeliveryConfirmed = messagingDelivered && !rawIsError && executedArgs.dryRun !== true && mediaDelivery?.status === "settled" && !mediaDelivery.partialDelivery;
+				const messagingTelemetryArgs = applyCurrentMessageProvider(toolName, executedArgs, params.hookContext?.currentChannelProvider);
+				const messagingTarget = isMessagingTool(toolName) ? extractMessagingToolSend(toolName, messagingTelemetryArgs, messagingContext) : void 0;
+				const confirmedMessagingTarget = messagingDelivered && messagingTarget ? extractMessagingToolSendResult(messagingTarget, rawResult) : messagingTarget;
+				const deliveredSourceReply = messagingDelivered && isDeliveredMessageToolOnlySourceReplyResult({
+					sourceReplyDeliveryMode: params.hookContext?.sourceReplyDeliveryMode,
+					toolName,
+					args: executedArgs,
+					result: rawResult,
+					isError: rawIsError,
+					deliveryConfirmed: true,
+					allowExplicitSourceRoute: isDeliveredMessagingToolSendToCurrentSource({
+						send: confirmedMessagingTarget,
+						config: params.hookContext?.config,
+						currentProvider: params.hookContext?.currentChannelProvider,
+						currentAccountId: params.hookContext?.turnSourceAccountId,
+						currentChannelId: params.hookContext?.currentChannelId,
+						currentMessagingTarget: params.hookContext?.currentMessagingTarget,
+						currentThreadId: params.hookContext?.currentThreadId,
+						sessionKey: params.hookContext?.sessionKey,
+						deliveredPayload: rawResult
+					})
+				});
+				if (toolName === "message" && messageDelivery?.sourceReplyDelivered) telemetry.sourceReplyDelivered = true;
 				const rawResultFailureKind = resolveToolResultFailureKind(rawResult);
+				const telemetryRawResult = sanitizeToolResult(rawResult);
 				const middlewareResult = await middlewareRunner.applyToolResultMiddleware({
 					threadId: call.threadId,
 					turnId: call.turnId,
@@ -5320,7 +5758,7 @@ function createCodexDynamicToolBridge(params) {
 					result: middlewareResult
 				});
 				const resultIsError = rawIsError || isToolResultError(result);
-				const acceptedSessionSpawn = toolName === "sessions_spawn" && !rawIsError ? normalizeAcceptedSessionSpawn(telemetryRawResult) : null;
+				const acceptedSessionSpawn = toolName === "sessions_spawn" && !rawIsError ? normalizeAcceptedSessionSpawnResult(telemetryRawResult) : null;
 				if (acceptedSessionSpawn) telemetry.acceptedSessionSpawns.push(acceptedSessionSpawn);
 				const finalResultFailureKind = resolveToolResultFailureKind(result);
 				const resultFailureKind = rawResultFailureKind ?? finalResultFailureKind;
@@ -5353,39 +5791,20 @@ function createCodexDynamicToolBridge(params) {
 					toolName,
 					toolCallOrdinal: options?.toolCallOrdinal
 				});
-				const messagingTelemetryArgs = applyCurrentMessageProvider(toolName, executedArgs, params.hookContext?.currentChannelProvider);
-				const messagingTarget = isMessagingTool(toolName) ? extractMessagingToolSend(toolName, messagingTelemetryArgs, messagingContext) : void 0;
-				const confirmedMessagingTarget = !rawIsError && messagingTarget ? extractMessagingToolSendResult(messagingTarget, telemetryRawResult) : messagingTarget;
-				const terminalType = resultFailureKind === "blocked" ? "blocked" : resultIsError ? "error" : "completed";
+				const terminalType = resultFailureKind === "blocked" ? "blocked" : resultIsError || resultFailureKind ? "error" : "completed";
 				const contentItems = convertToolContents(result.content, toolResultMaxChars);
 				const deliveredFrameImages = contentItems.filter((item) => item.type === "inputImage");
 				const finalFrameImageIdentity = computerFrameImageIdentity(result.content);
 				if (toolName === "computer" && params.computerContextEpoch?.frameToolCallId === call.callId && (deliveredFrameImages.length !== 1 || finalFrameImageIdentity === void 0 || finalFrameImageIdentity !== params.computerContextEpoch.frameImageIdentity)) invalidateComputerFrame(params.computerContextEpoch);
-				const response = withDiagnosticTerminalType({
+				const response = {
 					contentItems,
-					success: !resultIsError
-				}, terminalType);
-				withDynamicToolTranscriptDetails(response, asOptionalRecord(sanitizeToolResult(result))?.details);
-				withDiagnosticFailureDisposition(response, resultFailureKind);
-				const blocksSourceReplyTermination = hasExplicitNonSourceMessageRoute(executedArgs, params.hookContext, confirmedMessagingTarget);
-				const deliveredSourceReply = isDeliveredMessageToolOnlySourceReplyResult({
-					sourceReplyDeliveryMode: params.hookContext?.sourceReplyDeliveryMode,
-					toolName,
-					args: executedArgs,
-					result,
-					hookResult: rawResult,
-					isError: resultIsError,
-					allowExplicitSourceRoute: !blocksSourceReplyTermination
-				});
-				const receiptConfirmedSourceReply = params.hookContext?.sourceReplyDeliveryMode === "message_tool_only" && toolName === "message" && normalizeRouteToken(typeof executedArgs.action === "string" ? executedArgs.action : void 0) === "reply" && !resultIsError && !blocksSourceReplyTermination && isDeliveredMessagingToolResult({
-					toolName,
-					args: executedArgs,
-					result,
-					hookResult: rawResult,
-					isError: resultIsError
-				}) && (replyReceiptMatchesCurrentMessage(rawResult, params.hookContext) || replyReceiptMatchesCurrentMessage(result, params.hookContext));
+					success: !resultIsError,
+					diagnosticTerminalType: terminalType,
+					diagnosticTerminalReason: resultFailureKind === "blocked" ? void 0 : resultFailureKind,
+					transcriptDetails: asOptionalRecord(sanitizeToolResult(result))?.details
+				};
 				const toolConfirmedSourceReply = params.hookContext?.sourceReplyDeliveryMode === "message_tool_only" && toolName === "message" && !resultIsError && (rawResult.terminate === true || result.terminate === true);
-				const confirmedSourceReply = params.hookContext?.sourceReplyDeliveryMode === "message_tool_only" && toolName === "message" && (toolConfirmedSourceReply || deliveredSourceReply || receiptConfirmedSourceReply);
+				const confirmedSourceReply = params.hookContext?.sourceReplyDeliveryMode === "message_tool_only" && toolName === "message" && (toolConfirmedSourceReply || deliveredSourceReply);
 				const sourceReplyFinal = confirmedSourceReply ? executedArgs.final !== false : void 0;
 				const autoDeliveryTtsMediaUrls = getCoreTtsToolResultMediaUrls(rawResult);
 				collectToolTelemetry({
@@ -5396,23 +5815,27 @@ function createCodexDynamicToolBridge(params) {
 					telemetry,
 					signal,
 					isError: resultIsError,
+					messagingDelivered,
+					mediaDeliveryConfirmed,
+					sourcePathsByStagedPath: preparedMessageMedia?.sourcePathsByStagedPath,
 					autoDeliveryTtsMediaUrls,
 					coreTtsToolResult: autoDeliveryTtsMediaUrls?.length ? rawResult : void 0,
 					messagingTarget: confirmedMessagingTarget,
-					sourceReplyFinal
+					sourceReplyFinal,
+					trustedLocalMediaToolNames: pluginLocalMediaTrustByToolName.get(toolName)
 				});
-				if (deliveredSourceReply || receiptConfirmedSourceReply || toolConfirmedSourceReply) telemetry.didDeliverSourceReplyViaMessageTool = true;
+				if (deliveredSourceReply || toolConfirmedSourceReply) telemetry.didDeliverSourceReplyViaMessageTool = true;
 				const continuesSourceReplyProgress = confirmedSourceReply && sourceReplyFinal === false;
-				withDynamicToolTermination(response, (rawResult.terminate === true || result.terminate === true) && !continuesSourceReplyProgress || isToolResultYield(rawResult) || isToolResultYield(result) || confirmedSourceReply && sourceReplyFinal === true);
+				response.terminate = (rawResult.terminate === true || result.terminate === true) && !continuesSourceReplyProgress || isToolResultYield(rawResult) || isToolResultYield(result) || confirmedSourceReply && sourceReplyFinal === true || void 0;
 				const asyncStarted = isAsyncStartedToolResult(rawResult) || isAsyncStartedToolResult(result);
-				withDynamicToolAsyncStarted(response, asyncStarted);
+				response.asyncStarted = asyncStarted || void 0;
 				const replaySafe = executionPrevented || !asyncStarted && isReplaySafeToolInstance(toolEntry.tool) && isReplaySafeToolCall(toolName, executedArgs);
 				copyInternalToolResultState(rawResult, response);
-				return withDynamicToolExecutionState(response, {
-					executedArguments: executedArgs,
-					executionStarted: didStartExecution && !executionPrevented,
-					sideEffectEvidence: !replaySafe
-				});
+				response.executedArguments = executedArgs;
+				response.executionStarted = didStartExecution && !executionPrevented;
+				response.replaySafe = replaySafe;
+				response.sideEffectEvidence = !replaySafe || void 0;
+				return response;
 			} catch (error) {
 				const trustedNoStart = consumeTrustedToolNoStartError(error);
 				executionPrevented ||= trustedNoStart;
@@ -5420,6 +5843,8 @@ function createCodexDynamicToolBridge(params) {
 				if (toolName === "computer" && params.computerContextEpoch?.frameToolCallId === call.callId) invalidateComputerFrame(params.computerContextEpoch);
 				const executionDisposition = getBeforeToolCallFailureDisposition(error) ?? (signal.aborted ? resolveCodexToolAbortTerminalReason(signal) : resolveToolExecutionErrorKind(error));
 				const errorMessage = formatToolExecutionErrorMessage(error, "OpenClaw dynamic tool call failed.");
+				const operatorHint = readToolOperatorHint(error);
+				if (operatorHint) embeddedAgentLog.error(`[tools] ${toolName} failed: ${errorMessage} ${operatorHint}`);
 				executionPrevented = executionPrevented || consumePreExecutionBlockedToolCall(call.callId, toolResultHookContext.runId);
 				const failedResult = failedToolResult(errorMessage, executionDisposition);
 				finalizeToolTerminalPresentation({
@@ -5445,17 +5870,19 @@ function createCodexDynamicToolBridge(params) {
 					startedAt
 				});
 				const replaySafe = !didStartExecution || executionPrevented || isReplaySafeToolInstance(toolEntry.tool) && isReplaySafeToolCall(toolName, executedArgs);
-				return withDynamicToolExecutionState(withDiagnosticFailureDisposition({
+				return {
 					contentItems: [{
 						type: "inputText",
 						text: errorMessage
 					}],
-					success: false
-				}, executionDisposition), {
+					success: false,
+					diagnosticTerminalType: executionDisposition === "blocked" ? "blocked" : "error",
+					diagnosticTerminalReason: executionDisposition === "blocked" ? void 0 : executionDisposition,
 					executedArguments: executedArgs,
 					executionStarted: didStartExecution && !executionPrevented,
-					sideEffectEvidence: didStartExecution && !replaySafe
-				});
+					replaySafe,
+					sideEffectEvidence: didStartExecution && !replaySafe || void 0
+				};
 			} finally {
 				if (executionSnapshotStates.get(call.callId) === executionSnapshotState && (executionSnapshotState.consumed || !executionSnapshotState.retainAfterCompletion)) executionSnapshotStates.delete(call.callId);
 				consumeAdjustedParamsForToolCall(call.callId, toolResultHookContext.runId);
@@ -5508,18 +5935,6 @@ function notifyAgentToolResult(observer, toolName, result, isError) {
 		embeddedAgentLog.warn(`onAgentToolResult handler failed: tool=${toolName} error=${message}`);
 	}
 }
-function failedToolResult(message, status = "failed") {
-	return {
-		content: [{
-			type: "text",
-			text: message
-		}],
-		details: {
-			status,
-			error: message
-		}
-	};
-}
 function reportQuarantinedDynamicTools(params) {
 	if (params.tools.length === 0) return;
 	embeddedAgentLog.warn(`codex app-server quarantined ${params.tools.length} unsupported dynamic tool ${params.tools.length === 1 ? "definition" : "definitions"}: ${params.tools.map((tool) => tool.tool).join(", ")}; retained ${params.availableToolCount} available and ${params.registeredToolCount} registered tools`, {
@@ -5564,16 +5979,15 @@ function composeAbortSignals(...signals) {
 	return AbortSignal.any(activeSignals);
 }
 function collectToolTelemetry(params) {
-	if (params.isError) return;
 	if (!params.isError && params.toolName === "cron" && isCronAddAction(params.args)) params.telemetry.successfulCronAdds = (params.telemetry.successfulCronAdds ?? 0) + 1;
 	if (!params.isError && params.toolName === HEARTBEAT_RESPONSE_TOOL_NAME) {
 		const response = normalizeHeartbeatToolResponse(params.result?.details);
 		if (response) params.telemetry.heartbeatToolResponse = response;
 	}
-	if (params.result && !params.signal.aborted) {
+	if (!params.isError && params.result && !params.signal.aborted) {
 		const media = extractToolResultMediaArtifact(params.result);
 		if (media) {
-			const mediaUrls = filterToolResultMediaUrls(params.toolName, media.mediaUrls, params.mediaTrustResult ?? params.result);
+			const mediaUrls = filterToolResultMediaUrls(params.toolName, media.mediaUrls, params.coreTtsToolResult ?? params.mediaTrustResult ?? params.result, params.trustedLocalMediaToolNames);
 			const seen = new Set(params.telemetry.toolMediaUrls);
 			const autoDeliveryMediaUrls = new Set(params.telemetry.toolAutoDeliveryMediaUrls);
 			const rawAutoDeliveryMediaUrls = new Set(params.autoDeliveryTtsMediaUrls);
@@ -5593,24 +6007,20 @@ function collectToolTelemetry(params) {
 			if (media.audioAsVoice) params.telemetry.toolAudioAsVoice = true;
 		}
 	}
-	if (!isMessagingTool(params.toolName)) return;
-	const isMessagingSendAction = isMessagingToolSendAction(params.toolName, params.args);
-	if (!isMessagingSendAction && !params.messagingTarget) return;
-	if (!isMessagingSendAction && !isDeliveredMessagingToolResult({
-		toolName: params.toolName,
-		args: params.args,
-		result: params.result,
-		hookResult: params.mediaTrustResult,
-		isError: params.isError
-	})) return;
+	if (!params.messagingDelivered) return;
 	params.telemetry.didSendViaMessagingTool = true;
-	const sourceReplyPayload = extractInternalSourceReplyPayload(params.result?.details);
-	if (sourceReplyPayload) {
+	if (asOptionalRecord(asOptionalRecord(params.mediaTrustResult)?.details)?.sourceReplySink === "internal-ui") {
+		const sourceReplyPayload = extractMessagingToolSourceReplyPayload(params.result);
+		if (!sourceReplyPayload) return;
 		const record = {
 			...sourceReplyPayload,
 			...params.sourceReplyFinal !== void 0 ? { sourceReplyFinal: params.sourceReplyFinal } : {}
 		};
 		params.telemetry.messagingToolSourceReplyPayloads.push(record);
+		if (params.mediaDeliveryConfirmed) params.telemetry.confirmedMediaDeliveries.push({
+			kind: "sourceReply",
+			sourceUrls: resolveCodexMediaSourceUrls(collectCodexMessageMediaUrls(record), params.sourcePathsByStagedPath)
+		});
 		return record;
 	}
 	const text = readFirstString(params.args, [
@@ -5620,7 +6030,7 @@ function collectToolTelemetry(params) {
 		"content"
 	]);
 	if (text) params.telemetry.messagingToolSentTexts.push(text);
-	const mediaUrls = collectMediaUrls(params.args);
+	const mediaUrls = params.mediaDeliveryConfirmed ? collectCodexMessageMediaUrls(params.args) : [];
 	params.telemetry.messagingToolSentMediaUrls.push(...mediaUrls);
 	const record = {
 		...params.messagingTarget ?? {
@@ -5643,27 +6053,13 @@ function collectToolTelemetry(params) {
 		...params.sourceReplyFinal !== void 0 ? { sourceReplyFinal: params.sourceReplyFinal } : {}
 	};
 	params.telemetry.messagingToolSentTargets.push(record);
+	if (mediaUrls.length > 0) params.telemetry.confirmedMediaDeliveries.push({
+		kind: "outbound",
+		target: record,
+		sourceUrls: resolveCodexMediaSourceUrls(mediaUrls, params.sourcePathsByStagedPath)
+	});
 	return record;
 }
-function extractInternalSourceReplyPayload(details) {
-	if (!isRecord(details) || details.sourceReplySink !== "internal-ui") return;
-	const rawPayload = details.sourceReply;
-	if (!isRecord(rawPayload)) return;
-	const text = readFirstString(rawPayload, ["text", "message"]);
-	const mediaUrls = collectMediaUrls(rawPayload);
-	const mediaUrl = typeof rawPayload.mediaUrl === "string" && rawPayload.mediaUrl.trim() ? rawPayload.mediaUrl.trim() : mediaUrls[0];
-	const payload = {
-		...text ? { text } : {},
-		...mediaUrl ? { mediaUrl } : {},
-		...mediaUrls.length > 0 ? { mediaUrls } : {},
-		...rawPayload.audioAsVoice === true ? { audioAsVoice: true } : {},
-		...isRecord(rawPayload.presentation) ? { presentation: rawPayload.presentation } : {},
-		...isRecord(rawPayload.interactive) ? { interactive: rawPayload.interactive } : {},
-		...isRecord(rawPayload.channelData) ? { channelData: rawPayload.channelData } : {},
-		...typeof details.idempotencyKey === "string" && details.idempotencyKey.trim() ? { idempotencyKey: details.idempotencyKey.trim() } : {}
-	};
-	return text || mediaUrls.length > 0 || payload.presentation || payload.interactive ? payload : void 0;
-}
 function isToolResultYield(result) {
 	const details = result.details;
 	if (!isRecord(details) || typeof details.status !== "string") return false;
@@ -5673,42 +6069,6 @@ function isAsyncStartedToolResult(result) {
 	const details = result.details;
 	return isRecord(details) && details.async === true && details.status === "started";
 }
-function withDiagnosticTerminalType(response, terminalType) {
-	Object.defineProperty(response, "diagnosticTerminalType", {
-		configurable: true,
-		enumerable: false,
-		value: terminalType
-	});
-	return response;
-}
-function withDiagnosticFailureDisposition(response, disposition) {
-	if (!disposition) return response;
-	withDiagnosticTerminalType(response, disposition === "blocked" ? "blocked" : "error");
-	if (disposition !== "blocked") Object.defineProperty(response, "diagnosticTerminalReason", {
-		configurable: true,
-		enumerable: false,
-		value: disposition
-	});
-	return response;
-}
-function withDynamicToolTermination(response, terminate) {
-	if (!terminate) return response;
-	Object.defineProperty(response, "terminate", {
-		configurable: true,
-		enumerable: false,
-		value: true
-	});
-	return response;
-}
-function withDynamicToolAsyncStarted(response, asyncStarted) {
-	if (!asyncStarted) return response;
-	Object.defineProperty(response, "asyncStarted", {
-		configurable: true,
-		enumerable: false,
-		value: true
-	});
-	return response;
-}
 function normalizeToolResultMaxChars(maxChars) {
 	return typeof maxChars === "number" && Number.isFinite(maxChars) && maxChars > 0 ? Math.floor(maxChars) : DEFAULT_MAX_LIVE_TOOL_RESULT_CHARS;
 }
@@ -5806,53 +6166,9 @@ function readFirstString(record, keys) {
 		if (typeof value === "number" && Number.isFinite(value)) return String(value);
 	}
 }
-function collectMediaUrls(record) {
-	const urls = [];
-	const pushMediaUrl = (value) => {
-		if (typeof value === "string" && value.trim()) urls.push(value.trim());
-	};
-	const pushAttachment = (value) => {
-		if (!value || typeof value !== "object" || Array.isArray(value)) return;
-		const attachment = value;
-		for (const key of [
-			"media",
-			"mediaUrl",
-			"path",
-			"filePath",
-			"fileUrl",
-			"url"
-		]) pushMediaUrl(attachment[key]);
-	};
-	for (const key of [
-		"media",
-		"mediaUrl",
-		"media_url",
-		"path",
-		"filePath",
-		"fileUrl",
-		"imageUrl",
-		"image_url"
-	]) {
-		const value = record[key];
-		pushMediaUrl(value);
-	}
-	for (const key of [
-		"mediaUrls",
-		"media_urls",
-		"imageUrls",
-		"image_urls"
-	]) {
-		const value = record[key];
-		if (!Array.isArray(value)) continue;
-		for (const entry of value) pushMediaUrl(entry);
-	}
-	const attachments = record.attachments;
-	if (Array.isArray(attachments)) for (const attachment of attachments) pushAttachment(attachment);
-	return urls;
-}
 function isCronAddAction(args) {
 	const action = args.action;
 	return typeof action === "string" && action.trim().toLowerCase() === "add";
 }
 //#endregion
-export { shouldRequireCodexSandboxExecServerEnvironment as C, shouldEnableCodexAppServerNativeToolSurface as S, filterCodexVisionTools as T, resolveCodexAppServerHookChannelId as _, emitDynamicToolStartedDiagnostic as a, resolveCodexNodePlacementToolConstructionPlan as b, ensureCodexSandboxExecServerEnvironment as c, CodexNativeToolLifecycleProjector as d, buildDynamicTools as f, resolveCodexAppServerExecutionCwd as g, formatCodexDynamicToolBuildStageSummary as h, emitDynamicToolErrorDiagnostic as i, releaseCodexSandboxExecServerEnvironment as l, disableCodexPluginThreadConfig as m, projectCodexExecutableDynamicTools as n, emitDynamicToolTerminalDiagnostic as o, createCodexDynamicToolBuildStageTracker as p, routeCodexAppServerElicitationRequest as r, handleCodexAppServerApprovalRequest as s, createCodexDynamicToolBridge as t, readBoundedCodexRemoteWorkspaceFile as u, resolveCodexExternalSandboxPolicyForOpenClawSandbox as v, shouldWarnCodexDynamicToolBuildStageSummary as w, resolveCodexSandboxEnvironmentSelection as x, resolveCodexMessageToolProvider as y };
+export { shouldEnableCodexAppServerNativeToolSurface as C, mapCodexAppServerRemoteWorkspacePath as E, resolveCodexSandboxEnvironmentSelection as S, shouldWarnCodexDynamicToolBuildStageSummary as T, formatCodexDynamicToolBuildStageSummary as _, emitDynamicToolStartedDiagnostic as a, resolveCodexExternalSandboxPolicyForOpenClawSandbox as b, ensureCodexSandboxExecServerEnvironment as c, hasCodexNativeBackgroundProcesses as d, readBoundedCodexRemoteWorkspaceFile as f, disableCodexPluginThreadConfig as g, createCodexDynamicToolBuildStageTracker as h, emitDynamicToolErrorDiagnostic as i, releaseCodexSandboxExecServerEnvironment as l, buildDynamicTools as m, projectCodexExecutableDynamicTools as n, emitDynamicToolTerminalDiagnostic as o, CodexNativeToolLifecycleProjector as p, routeCodexAppServerElicitationRequest as r, handleCodexAppServerApprovalRequest as s, createCodexDynamicToolBridge as t, CodexNativeProcessAuthority as u, resolveCodexAppServerExecutionCwd as v, shouldRequireCodexSandboxExecServerEnvironment as w, resolveCodexMessageToolProvider as x, resolveCodexAppServerHookChannelId as y };