@openclaw/codex 2026.9.7 → 2026.10.1-beta.1

package/dist/.setup/{dynamic-tools-DzlsLUuS.mjs → dynamic-tools-DdsymYGQ.mjs}

@@ -1,47 +1,42 @@
-import { CODEX_NATIVE_TOOL_REQUIREMENTS } from "../native-tool-policy.js";
 import { i as isJsonObject, r as flattenCodexDynamicToolFunctions, t as CODEX_OPENCLAW_DIRECT_DYNAMIC_TOOL_NAMESPACE } from "./protocol-CANUwXJ3.mjs";
-import { d as readCodexPluginConfig, l as isCodexRemoteExecPlacementSandbox } from "./config-parsing-b088LyhT.mjs";
-import { o as formatCodexDisplayText } from "./command-formatters-R3ckE3Co.mjs";
-import { s as readItem } from "./event-projector-values-DJSz8BTk.mjs";
-import { s as codexAppIdentityKey } from "./plugin-app-cache-key-BL9B5H0L.mjs";
-import "./config-DKhXquav.mjs";
-import { i as sanitizeInlineImageDataUrl, r as invalidInlineImageText } from "./session-history-read-Ov3StuL4.mjs";
-import { U as protectCodexAppServerLiveThread, _ as retainSharedCodexAppServerClientIfCurrent } from "./shared-client-DqyTMYug.mjs";
-import { a as isCodexResponsesOAuthRun } from "./responses-oauth-twnuTaAa.mjs";
-import { B as resolveCodexToolAbortTerminalReason, E as readCodexTurnCompletedNotification, H as failedToolResult, V as createFailedDynamicToolResponse, k as createCodexElicitationResponse, m as CodexServerRequestResolvedError } from "./client-N0JpgSzF.mjs";
-import { A as itemStatus, C as auditNativeToolUnfinishedStatus, N as shouldClearTerminalPresentationForNativeItem, S as auditNativeToolTerminalStatus, b as readCodexNotificationTurnId, k as itemName, v as isCodexNotificationForTurn, x as auditNativeToolName, y as readCodexNotificationThreadId } from "./attempt-client-cleanup-DOP-cW5j.mjs";
-import { ct as isForcedPrivateQaCodexRuntime, dt as normalizeCodexDynamicToolName, j as emitCodexNativePreToolUseFailureDiagnostic, ot as filterCodexDynamicTools, p as resolveCodexWebSearchPlan, st as filterCodexDynamicToolsForDisabledNativeSurface, ut as isSystemAgentOnlyCodexDynamicToolAllowlist } from "./thread-requests-B_bRnMGN.mjs";
-import { _ as waitForPluginApprovalDecision, d as mapExecDecisionToOutcome, f as requestPluginApproval, g as truncateCodexApprovalDisplayText, h as stripDanglingCodexApprovalTerminalSequence, l as approvalRequestExplicitlyUnavailable, m as sanitizeCodexApprovalVisibleText, p as requestPluginApprovalOutcome, u as codexApprovalTimeoutText } from "./native-subagent-monitor-Dpsmf2wz.mjs";
-import { n as resolveCodexNativeExecutionPolicy, r as resolveCodexNodeExecToolOverrides } from "./native-execution-policy-BxZJy5mP.mjs";
-import { a as CODEX_NODE_EXEC_DYNAMIC_TOOL_NAME, c as createNodeExecAliasDynamicTool, d as isCodexDynamicToolExcluded, i as CODEX_GATEWAY_PROCESS_DYNAMIC_TOOL_NAME, l as createSandboxExecProjection, o as createGatewayExecProjection, r as CODEX_GATEWAY_EXEC_DYNAMIC_TOOL_NAME, s as createGatewayProcessProjection, u as createSandboxProcessProjection } from "./provider-capabilities-CAxoF-X1.mjs";
+import { o as formatCodexDisplayText } from "./command-formatters-DV3DHhdr.mjs";
+import { o as readItem } from "./event-projector-values-DTqZHizf.mjs";
+import { s as codexAppIdentityKey } from "./plugin-app-cache-key-BW8rd98k.mjs";
+import { r as invalidInlineImageText } from "./session-history-read-CNN8zwbD.mjs";
+import { U as protectCodexAppServerLiveThread, _ as retainSharedCodexAppServerClientIfCurrent } from "./shared-client-DJJ3ljH2.mjs";
+import { F as createFailedDynamicToolResponse, I as failedToolResult, P as resolveCodexToolAbortTerminalReason, l as CodexServerRequestResolvedError, w as createCodexElicitationResponse, x as readCodexTurnCompletedNotification } from "./client-CBzEVDyb.mjs";
+import { t as codexWebSocketDataToBuffer } from "./websocket-data-XlRvt8Ys.mjs";
+import { _ as itemStatus, a as isCodexNotificationForTurn, b as shouldClearTerminalPresentationForNativeItem, c as auditNativeToolName, g as itemName, l as auditNativeToolTerminalStatus, o as readCodexNotificationThreadId, s as readCodexNotificationTurnId, u as auditNativeToolUnfinishedStatus } from "./turn-router-CX1-EoCp.mjs";
+import { M as emitCodexNativePreToolUseFailureDiagnostic } from "./thread-requests-COrRJcZb.mjs";
+import { a as requestPluginApprovalOutcome, c as truncateCodexApprovalDisplayText, i as requestPluginApproval, l as waitForPluginApprovalDecision, n as codexApprovalTimeoutText, o as sanitizeCodexApprovalVisibleText, r as mapExecDecisionToOutcome, s as stripDanglingCodexApprovalTerminalSequence, t as approvalRequestExplicitlyUnavailable } from "./plugin-approval-roundtrip-uAR-oQfr.mjs";
+import { d as isCodexPassThroughMediaSource, f as mapCodexAppServerLocalWorkspacePath, p as mapCodexAppServerRemoteWorkspacePath } from "./dynamic-tool-build-CVrx02cH.mjs";
 import { createRequire } from "node:module";
-import { asNonArrayRecord, asOptionalRecord, isRecord, normalizeTrimmedStringList, readNonBlankString, readStringField } from "openclaw/plugin-sdk/string-coerce-runtime";
+import { asNonArrayRecord, asOptionalRecord, filterStringEntries, isRecord, normalizeTrimmedStringList, readNonBlankString, readStringField } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { createHash, randomUUID } from "node:crypto";
-import { signalProcessTree, spawnTerminalPty } from "openclaw/plugin-sdk/process-runtime";
 import { validateJsonSchemaValue } from "openclaw/plugin-sdk/json-schema-runtime";
 import { asDateTimestampMs } from "openclaw/plugin-sdk/number-runtime";
+import { signalProcessTree, spawnTerminalPty } from "openclaw/plugin-sdk/process-runtime";
 import path, { posix } from "node:path";
 import { coerceErrorMessage } from "openclaw/plugin-sdk/error-runtime";
-import { isPathStrictlyInside, root } from "openclaw/plugin-sdk/file-access-runtime";
-import { expectDefined } from "openclaw/plugin-sdk/expect-runtime";
+import { createBoundedRemoteFileReader, isPathStrictlyInside, root } from "openclaw/plugin-sdk/file-access-runtime";
 import { once } from "node:events";
 import { spawn } from "node:child_process";
-import { DEFAULT_MAX_LIVE_TOOL_RESULT_CHARS, estimateToolResultTextChars, resolveLiveToolResultMaxChars, sliceToolResultTextToBudget, sliceUtf16Safe, truncateUtf16Safe } from "openclaw/plugin-sdk/text-utility-runtime";
+import { expectDefined } from "openclaw/plugin-sdk/expect-runtime";
+import { DEFAULT_MAX_LIVE_TOOL_RESULT_CHARS, estimateToolResultTextChars, resolveLiveToolResultMaxChars, safeParseJson, sliceToolResultTextToBudget, sliceUtf16Safe, truncateUtf16Safe } from "openclaw/plugin-sdk/text-utility-runtime";
 import { emitTrustedDiagnosticEvent } from "openclaw/plugin-sdk/diagnostic-runtime";
 import { createDeferred } from "openclaw/plugin-sdk/extension-shared";
-import { createStageTimingTracker, formatStageTimings } from "openclaw/plugin-sdk/time-runtime";
+import { createAgentToolResultMiddlewareRunner, createCodexAppServerToolResultExtensionRunner, embeddedAgentLog, extractMessagingToolSend, extractMessagingToolSendResult, finalizeAgentToolAvailability, finalizeToolTerminalPresentation, formatApprovalDisplayPath, formatToolExecutionErrorMessage, getBeforeToolCallFailureDisposition, getChannelAgentToolMeta, getPluginToolMeta, getPluginToolSideEffectOwnerKey, hasNativeHookRelayInvocation, invokeNativeHookRelay, isDeliveredMessageToolOnlySourceReplyResult, isDeliveredMessagingToolResult, isDeliveredMessagingToolSendToCurrentSource, isMessagingTool, isReplaySafeToolCall, isToolResultError, isToolWrappedWithBeforeToolCallHook, projectPluginMessageDeliveryFact, projectRuntimeToolInputSchema, readEmbeddedMessageDeliveryFact, readToolOperatorHint, resolveNativeHookRelayDeferredToolApproval, resolveToolExecutionErrorKind, runAgentHarnessAfterToolCallHook, sanitizeToolResult, setBeforeToolCallDiagnosticsEnabled, wrapToolWithBeforeToolCallHook } from "openclaw/plugin-sdk/agent-harness-runtime";
 import { fileURLToPath, pathToFileURL } from "node:url";
-import { resolveAgentDir } from "openclaw/plugin-sdk/agent-runtime";
-import { applyEmbeddedAttemptToolsAllow, buildAgentHookContextChannelFields, buildEmbeddedAttemptToolRunContext, createAgentToolResultMiddlewareRunner, createCodexAppServerToolResultExtensionRunner, embeddedAgentLog, extractMessagingToolSend, extractMessagingToolSendResult, filterProviderNormalizableTools, finalizeAgentToolAvailability, finalizeToolTerminalPresentation, formatApprovalDisplayPath, formatToolExecutionErrorMessage, getBeforeToolCallFailureDisposition, getChannelAgentToolMeta, getPluginToolMeta, getPluginToolSideEffectOwnerKey, hasNativeHookRelayInvocation, invokeNativeHookRelay, isDeliveredMessageToolOnlySourceReplyResult, isDeliveredMessagingToolResult, isDeliveredMessagingToolSendToCurrentSource, isHostScopedAgentToolActive, isMessagingTool, isReplaySafeToolCall, isSubagentSessionKey, isToolResultError, isToolWrappedWithBeforeToolCallHook, normalizeAgentRuntimeTools, projectPluginMessageDeliveryFact, projectRuntimeToolInputSchema, readEmbeddedMessageDeliveryFact, readToolOperatorHint, resolveAttemptSpawnWorkspaceDir, resolveModelAuthMode, resolveNativeHookRelayDeferredToolApproval, resolveToolExecutionErrorKind, runAgentHarnessAfterToolCallHook, sanitizeToolResult, setBeforeToolCallDiagnosticsEnabled, supportsModelTools, wrapToolWithBeforeToolCallHook } from "openclaw/plugin-sdk/agent-harness-runtime";
+import { sanitizeInlineImageDataUrl } from "openclaw/plugin-sdk/inline-image-data-url-runtime";
 import { redactToolPayloadText } from "openclaw/plugin-sdk/logging-core";
 import { formatErrorMessage as formatErrorMessage$2, redactSensitiveText as redactSensitiveText$1 } from "openclaw/plugin-sdk/security-runtime";
-import { copyInternalToolResultState, createAgentHarnessToolExecutionBoundaryRegistry, extractMessagingToolSourceReplyPayload, getCoreTtsToolResultMediaUrls, normalizeAcceptedSessionSpawnResult, recordAgentHarnessToolResultTelemetry, runAgentHarnessToolInvocation } from "openclaw/plugin-sdk/agent-harness-tool-runtime";
+import { collectAgentHarnessMessagingMediaUrls, copyInternalToolResultState, createAgentHarnessToolExecutionBoundaryRegistry, extractMessagingToolSourceReplyPayload, getCoreTtsToolResultMediaUrls, mapAgentHarnessMessagingMediaValues, normalizeAcceptedSessionSpawnResult, recordAgentHarnessToolResultTelemetry, runAgentHarnessToolInvocation } from "openclaw/plugin-sdk/agent-harness-tool-runtime";
 import { isIP } from "node:net";
-import { formatMcpCodexApprovalRemedy, requiresMcpCodexToolApproval, resolveCodexScheduledToolProjectionFactory, resolveProjectedMcpCodexToolApprovalMode, runWithCronCreatorAuthorityCapabilityResolver } from "openclaw/plugin-sdk/codex-mcp-projection";
-import { SANDBOX_COMMAND_MAX_BUFFER_BYTES, buildRemoteCommand, isToolAllowed, prepareSandboxProcessCleanup, sanitizeEnvVars } from "openclaw/plugin-sdk/sandbox";
+import { formatMcpCodexApprovalRemedy, requiresMcpCodexToolApproval, resolveProjectedMcpCodexToolApprovalMode } from "openclaw/plugin-sdk/codex-mcp-projection";
+import { SANDBOX_COMMAND_MAX_BUFFER_BYTES, buildRemoteCommand, prepareSandboxProcessCleanup, sanitizeEnvVars } from "openclaw/plugin-sdk/sandbox";
 import { SsrFBlockedError, isBlockedHostnameOrIp } from "openclaw/plugin-sdk/ssrf-runtime";
-import { normalizeMediaReferenceForComparison, saveMediaBuffer } from "openclaw/plugin-sdk/media-store";
 import { getMediaDir } from "openclaw/plugin-sdk/media-runtime";
+import { normalizeMediaReferenceForComparison, saveMediaBuffer } from "openclaw/plugin-sdk/media-store";
 import { normalizeOpenAIStrictCompatSchema } from "openclaw/plugin-sdk/provider-tools";
 //#region extensions/codex/src/app-server/event-projector-native-tool-lifecycle.ts
 function isMcpToolCallItemNotification(method, params) {
@@ -56,7 +51,6 @@ var CodexNativeToolLifecycleProjector = class {
 		this.options = options;
 		this.terminalPresentationClearedItemIds = /* @__PURE__ */ new Set();
 		this.nativeToolOutcomeOrdinals = /* @__PURE__ */ new Map();
-		this.startedAtByItem = /* @__PURE__ */ new Map();
 		this.activeItems = /* @__PURE__ */ new Map();
 		this.webSearchCompletionByItem = /* @__PURE__ */ new Map();
 		this.completedItemIds = /* @__PURE__ */ new Set();
@@ -185,10 +179,9 @@ var CodexNativeToolLifecycleProjector = class {
 		const approvalFailureDisposition = this.approvalFailureDispositionByItem.get(toolCallId);
 		this.approvalFailureDispositionByItem.delete(toolCallId);
 		this.completedItemIds.add(toolCallId);
+		const startedAt = this.activeItems.get(toolCallId)?.startedAt;
 		this.activeItems.delete(toolCallId);
 		this.webSearchCompletionByItem.delete(toolCallId);
-		const startedAt = this.startedAtByItem.get(toolCallId);
-		this.startedAtByItem.delete(toolCallId);
 		const endedAt = options.sourceTimestampMs ?? Date.now();
 		const durationMs = options.itemDurationMs ?? (startedAt === void 0 ? 0 : Math.max(0, endedAt - startedAt));
 		if (preToolUseFailure) {
@@ -268,9 +261,9 @@ var CodexNativeToolLifecycleProjector = class {
 	}
 	recordStarted(toolCallId, toolName, unfinishedStatus, sourceTimestampMs, mcpToolCall, commandProcessId) {
 		if (this.activeItems.has(toolCallId)) return;
-		this.startedAtByItem.set(toolCallId, sourceTimestampMs ?? Date.now());
 		this.activeItems.set(toolCallId, {
 			toolName,
+			startedAt: sourceTimestampMs ?? Date.now(),
 			unfinishedStatus,
 			mcpToolCall,
 			commandProcessId
@@ -293,201 +286,42 @@ var CodexNativeToolLifecycleProjector = class {
 	}
 };
 //#endregion
-//#region extensions/codex/src/app-server/remote-workspace-path.ts
-/** Projects a gateway workspace path into the remote Codex execution workspace. */
-function mapCodexAppServerRemoteWorkspacePath(params) {
-	if (!params.remoteWorkspaceRoot) return params.value;
-	const localRoot = normalizeWorkspaceMatchPath(params.localWorkspaceRoot);
-	const remoteRoot = normalizeWorkspaceMatchPath(params.remoteWorkspaceRoot);
-	const normalizedValue = normalizeWorkspaceMatchPath(params.value);
-	if (!localRoot || !remoteRoot) throw new Error("Codex remoteWorkspaceRoot requires non-empty workspace roots.");
-	if (normalizedValue === localRoot) return remoteRoot;
-	const prefix = `${localRoot}/`;
-	if (!normalizedValue.startsWith(prefix)) throw new Error(`Codex remoteWorkspaceRoot is configured but cwd ${params.value} is outside OpenClaw workspace root ${params.localWorkspaceRoot}; refusing to send a gateway-local cwd to the remote Codex app-server.`);
-	return joinRemoteWorkspacePath(remoteRoot, normalizedValue.slice(prefix.length));
-}
-/** Maps a remote workspace artifact back into the corresponding gateway workspace. */
-function mapCodexAppServerLocalWorkspacePath(params) {
-	if (!params.remoteWorkspaceRoot) return params.value;
-	const localRoot = normalizeWorkspaceMatchPath(params.localWorkspaceRoot);
-	const remoteRoot = normalizeWorkspaceMatchPath(params.remoteWorkspaceRoot);
-	if (!localRoot || !remoteRoot) throw new Error("Codex remoteWorkspaceRoot requires non-empty workspace roots.");
-	const normalizedValue = normalizeWorkspaceMatchPath(params.value);
-	if (!normalizedValue || isCodexPassThroughMediaSource(normalizedValue)) return params.value;
-	const usesWindowsPaths = /^[a-z]:\//iu.test(remoteRoot) || remoteRoot.startsWith("//");
-	const matchValue = usesWindowsPaths ? normalizedValue.toLowerCase() : normalizedValue;
-	const matchRoot = usesWindowsPaths ? remoteRoot.toLowerCase() : remoteRoot;
-	if (matchValue === matchRoot) return params.localWorkspaceRoot;
-	const prefix = matchRoot.endsWith("/") ? matchRoot : `${matchRoot}/`;
-	const isRemoteWorkspacePath = matchValue.startsWith(prefix);
-	if (!isRemoteWorkspacePath && isAbsoluteWorkspacePath(normalizedValue)) throw new Error(`Codex remote workspace artifact ${params.value} is outside ${params.remoteWorkspaceRoot}.`);
-	const suffixSegments = (isRemoteWorkspacePath ? normalizedValue.slice(prefix.length) : normalizedValue).split("/");
-	if (suffixSegments.some((segment) => segment === "..")) throw new Error(`Codex remote workspace artifact ${params.value} must stay inside ${params.remoteWorkspaceRoot}.`);
-	return path.join(params.localWorkspaceRoot, ...suffixSegments.filter((segment) => segment !== "."));
-}
-function normalizeWorkspaceMatchPath(value) {
-	const normalized = value.replace(/\\/gu, "/");
-	if (/^[a-z]:\/$/iu.test(normalized)) return normalized;
-	return normalized.length > 1 ? normalized.replace(/[\\/]+$/u, "") : normalized;
-}
-/** Keeps remote URLs and opaque managed media references out of workspace path mapping. */
-function isCodexPassThroughMediaSource(value) {
-	return /^(?:https?|mxc|buffer|media):\/\//iu.test(value) || /^data:/iu.test(value);
-}
-function isAbsoluteWorkspacePath(value) {
-	return value.startsWith("/") || /^[a-z]:\//iu.test(value) || /^[a-z][a-z0-9+.-]*:/iu.test(value);
-}
-function joinRemoteWorkspacePath(remoteRoot, suffix) {
-	return remoteRoot.endsWith("/") ? `${remoteRoot}${suffix}` : `${remoteRoot}/${suffix}`;
-}
-//#endregion
 //#region extensions/codex/src/app-server/remote-workspace-media.ts
 const REMOTE_WORKSPACE_MEDIA_TIMEOUT_MS = 6e4;
 const REMOTE_WORKSPACE_MEDIA_MAX_BYTES = 67108864;
 const REMOTE_WORKSPACE_MEDIA_MAX_ATTACHMENTS = 16;
-const CODEX_REMOTE_MEDIA_CHUNK_BYTES = 524288;
-const CODEX_REMOTE_COMMAND_DEFAULT_OUTPUT_BYTES = 1048576;
-const CODEX_BOUNDED_REMOTE_FILE_READER = [
-	"try{",
-	"const fs=require(\"node:fs\");",
-	"const path=require(\"node:path\");",
-	"const file=process.argv[1];",
-	"const max=Number(process.argv[2]);",
-	"const offset=Number(process.argv[3]);",
-	"const chunk=Number(process.argv[4]);",
-	"const workspace=process.argv[5];",
-	"if(!Number.isSafeInteger(max)||max<0)throw Error(\"invalid media byte limit\");",
-	"if(!Number.isSafeInteger(offset)||offset<0||!Number.isSafeInteger(chunk)||chunk<=0)throw Error(\"invalid media chunk\");",
-	"if(fs.lstatSync(file).isSymbolicLink())throw Error(\"symbolic links are not allowed\");",
-	"const noFollow=fs.constants.O_NOFOLLOW??0;",
-	"const fd=fs.openSync(file,fs.constants.O_RDONLY|noFollow);",
-	"try{",
-	"const before=fs.fstatSync(fd);",
-	"if(!before.isFile())throw Error(\"not a regular file\");",
-	"if(workspace){",
-	"const descriptor=process.platform===\"linux\"?fs.realpathSync(`/proc/self/fd/${fd}`):fs.realpathSync(file);",
-	"const relative=path.relative(fs.realpathSync(workspace),descriptor);",
-	"if(!relative||relative===\"..\"||relative.startsWith(`..${path.sep}`)||path.isAbsolute(relative))throw Error(\"file escapes remote workspace\");",
-	"const verified=fs.statSync(descriptor);",
-	"if(verified.dev!==before.dev||verified.ino!==before.ino)throw Error(\"file changed while being opened\");",
-	"}",
-	"if(before.size>max)throw Error(`file exceeds limit of ${max} bytes`);",
-	"if(offset>before.size)throw Error(\"file changed while being read\");",
-	"const expected=Math.min(chunk,before.size-offset);",
-	"const buffer=Buffer.allocUnsafe(expected);",
-	"let total=0;",
-	"while(total<buffer.length){",
-	"const count=fs.readSync(fd,buffer,total,buffer.length-total,offset+total);",
-	"if(count===0)break;total+=count;",
-	"}",
-	"if(total!==expected)throw Error(\"file changed while being read\");",
-	"const after=fs.fstatSync(fd);",
-	"const revision=stat=>[stat.dev,stat.ino,stat.size,stat.mtimeMs,stat.ctimeMs].join(\":\");",
-	"if(!after.isFile()||revision(after)!==revision(before))throw Error(\"file changed while being read\");",
-	"process.stdout.write(JSON.stringify({dataBase64:buffer.toString(\"base64\"),size:before.size,revision:revision(before)}));",
-	"}finally{fs.closeSync(fd)}",
-	"}catch(error){process.stderr.write(error instanceof Error?error.message:String(error));process.exitCode=1}"
-].join("");
-const MESSAGE_MEDIA_KEYS = [
-	"media",
-	"mediaUrl",
-	"media_url",
-	"path",
-	"filePath",
-	"fileUrl",
-	"imageUrl",
-	"image_url"
-];
-const MESSAGE_MEDIA_ARRAY_KEYS = [
-	"mediaUrls",
-	"media_urls",
-	"imageUrls",
-	"image_urls"
-];
-const ATTACHMENT_MEDIA_KEYS = [
-	"media",
-	"mediaUrl",
-	"path",
-	"filePath",
-	"fileUrl",
-	"url"
-];
-function collectCodexMessageMediaUrls(record) {
-	const urls = [];
-	mapMessageMediaValues(record, (value) => {
-		if (value.trim()) urls.push(value.trim());
-		return value;
-	});
-	return urls;
-}
-/** Reads actual remote bytes with a cap enforced by Codex before transport. */
-async function readBoundedCodexRemoteWorkspaceFile(params) {
-	if (!Number.isSafeInteger(params.maxBytes) || params.maxBytes < 0) throw new Error("Codex remote workspace upload requires a valid media byte limit.");
-	params.signal?.throwIfAborted();
-	const chunks = [];
-	let offset = 0;
-	let expectedSize;
-	let expectedRevision;
-	const startedAt = performance.now();
-	do {
-		params.signal?.throwIfAborted();
-		const timeoutMs = params.timeoutMs === void 0 ? void 0 : Math.floor(params.timeoutMs - (performance.now() - startedAt));
-		if (timeoutMs !== void 0 && timeoutMs <= 0) throw new Error("Codex remote workspace file transfer timed out.");
-		let response;
-		try {
-			response = await params.client.request("command/exec", {
-				command: [
-					"node",
-					"-e",
-					CODEX_BOUNDED_REMOTE_FILE_READER,
-					"--",
-					params.path,
-					String(params.maxBytes),
-					String(offset),
-					String(CODEX_REMOTE_MEDIA_CHUNK_BYTES),
-					...params.workspaceRoot ? [params.workspaceRoot] : []
-				],
+/** Adapts the current app-server connection without changing its Windows output cap. */
+function createCodexRemoteWorkspaceFileReader(client, authority) {
+	const read = createBoundedRemoteFileReader({
+		outputBytesCap: 1048576,
+		assertCurrent: authority.assertCurrent,
+		execute: async (command, options) => {
+			const response = await client.request("command/exec", {
+				command,
 				env: {
 					NODE_OPTIONS: null,
 					NODE_PATH: null
 				},
-				...timeoutMs === void 0 ? {} : { timeoutMs }
+				...options.timeoutMs === void 0 ? {} : { timeoutMs: options.timeoutMs }
 			}, {
-				signal: params.signal,
-				timeoutMs
+				...options,
+				assertCurrent: authority.assertCurrent,
+				withCurrent: authority.withCurrent
+			}).catch((error) => {
+				if (error instanceof Error && /failed to spawn|executable.*not found|\bENOENT\b/iu.test(error.message)) throw new Error("Codex remote workspace file transfer requires Node.js on the remote app-server host.", { cause: error });
+				throw error;
 			});
-		} catch (error) {
-			if (error instanceof Error && /failed to spawn|executable.*not found|\bENOENT\b/iu.test(error.message)) throw new Error("Codex remote workspace file transfer requires Node.js on the remote app-server host.", { cause: error });
-			throw error;
-		}
-		if (!response || response.exitCode !== 0) {
-			const detail = typeof response?.stderr === "string" ? response.stderr.trim() : "";
-			throw new Error(`Codex remote workspace artifact could not be read: ${params.path}${detail ? `: ${detail}` : ""}`);
+			if (!response || response.exitCode !== 0) throw new Error(`Codex remote workspace file read failed: ${response?.stderr ?? "no response"}`);
+			return response.stdout;
 		}
-		if (typeof response.stdout !== "string" || response.stdout.length > CODEX_REMOTE_COMMAND_DEFAULT_OUTPUT_BYTES) throw new Error("Codex remote workspace artifact exceeded the native command output cap.");
-		let payload;
-		try {
-			payload = JSON.parse(response.stdout);
-		} catch {
-			throw new Error("Codex remote workspace artifact returned invalid chunk data.");
-		}
-		if (!payload || typeof payload !== "object" || Array.isArray(payload)) throw new Error("Codex remote workspace artifact returned invalid chunk data.");
-		const chunk = payload;
-		if (typeof chunk.dataBase64 !== "string" || !Number.isSafeInteger(chunk.size) || chunk.size < 0 || chunk.size > params.maxBytes || typeof chunk.revision !== "string" || !chunk.revision) throw new Error("Codex remote workspace artifact returned invalid or oversized chunk data.");
-		if (expectedSize === void 0) {
-			expectedSize = chunk.size;
-			expectedRevision = chunk.revision;
-		}
-		if (chunk.size !== expectedSize || chunk.revision !== expectedRevision) throw new Error("Codex remote workspace artifact changed during chunked transfer.");
-		const remainingBytes = expectedSize - offset;
-		const expectedChunkBytes = Math.min(CODEX_REMOTE_MEDIA_CHUNK_BYTES, remainingBytes);
-		if (chunk.dataBase64.length > Math.ceil(expectedChunkBytes / 3) * 4) throw new Error("Codex remote workspace artifact returned oversized chunk data.");
-		const buffer = Buffer.from(chunk.dataBase64, "base64");
-		if (buffer.byteLength !== expectedChunkBytes || buffer.toString("base64") !== chunk.dataBase64) throw new Error("Codex remote workspace artifact returned invalid chunk data.");
-		chunks.push(buffer);
-		offset += buffer.byteLength;
-	} while (offset < (expectedSize ?? 0));
-	return { dataBase64: Buffer.concat(chunks, offset).toString("base64") };
+	});
+	return async (params) => {
+		const bytes = await read(params);
+		return authority.withCurrent(() => {
+			params.signal?.throwIfAborted();
+			return bytes;
+		});
+	};
 }
 /** Stages authoritative bounded remote bytes into immutable Gateway-owned media. */
 async function prepareCodexRemoteWorkspaceMessageMedia(params) {
@@ -501,7 +335,7 @@ async function prepareCodexRemoteWorkspaceMessageMedia(params) {
 	const gatewayManagedPaths = /* @__PURE__ */ new Set();
 	const gatewayMediaRoot = getMediaDir();
 	let attachmentEntries = 0;
-	const mappedArgs = mapMessageMediaValues(params.args, (value) => {
+	const mappedArgs = mapAgentHarnessMessagingMediaValues(params.args, (value) => {
 		if (path.isAbsolute(value) && isPathStrictlyInside(gatewayMediaRoot, value)) {
 			attachmentEntries += 1;
 			gatewayManagedPaths.add(value);
@@ -547,24 +381,20 @@ async function prepareCodexRemoteWorkspaceMessageMedia(params) {
 		const remainingBytes = maxBytes - totalBytes;
 		const remainingMs = Math.floor(deadline - performance.now());
 		if (remainingMs <= 0) throw new Error("Codex remote workspace attachment batch timed out.");
-		const response = await readRemoteFile({
+		const remoteBuffer = await readRemoteFile({
 			path: remotePath,
 			maxBytes: remainingBytes,
 			workspaceRoot: remoteWorkspaceRoot,
 			signal: params.signal,
 			timeoutMs: remainingMs
 		});
-		if (!response || typeof response.dataBase64 !== "string") throw new Error(`Codex remote workspace artifact returned no file data: ${remotePath}`);
-		if (response.dataBase64.length > Math.ceil(remainingBytes / 3) * 4) throw new Error(`Codex remote workspace artifact exceeds the limit of ${remainingBytes} bytes.`);
-		const remoteBuffer = Buffer.from(response.dataBase64, "base64");
-		if (remoteBuffer.byteLength > remainingBytes || remoteBuffer.toString("base64") !== response.dataBase64) throw new Error(`Codex remote workspace artifact returned invalid or oversized file data: ${remotePath}`);
 		totalBytes += remoteBuffer.byteLength;
 		const saved = await saveMediaBuffer(remoteBuffer, void 0, "outbound", maxBytes, path.basename(remotePath));
 		stagedPaths.set(localPath, saved.path);
 		sourcePathsByStagedPath.set(normalizeMediaReferenceForComparison(saved.path), [...sourcePaths]);
 	}
 	return {
-		args: mapMessageMediaValues(mappedArgs, (value) => stagedPaths.get(value) ?? value),
+		args: mapAgentHarnessMessagingMediaValues(mappedArgs, (value) => stagedPaths.get(value) ?? value),
 		sourcePathsByStagedPath
 	};
 }
@@ -579,32 +409,6 @@ async function assertGatewayManagedMediaPath(value, mediaRoot) {
 		await opened[Symbol.asyncDispose]();
 	}
 }
-function mapMessageMediaValues(args, mapValue) {
-	const mapString = (value) => typeof value === "string" ? mapValue(value) : value;
-	const mapArray = (values, map) => {
-		const mapped = values.map(map);
-		return mapped.some((value, index) => value !== values[index]) ? mapped : values;
-	};
-	const mapRecord = (record, keys, message = false) => {
-		let mapped = record;
-		const assign = (key, value) => {
-			if (value !== record[key]) {
-				if (mapped === record) mapped = { ...record };
-				mapped[key] = value;
-			}
-		};
-		for (const key of keys) assign(key, mapString(record[key]));
-		if (message) {
-			for (const key of MESSAGE_MEDIA_ARRAY_KEYS) {
-				const value = record[key];
-				if (Array.isArray(value)) assign(key, mapArray(value, mapString));
-			}
-			if (Array.isArray(record.attachments)) assign("attachments", mapArray(record.attachments, (attachment) => isRecord(attachment) ? mapRecord(attachment, ATTACHMENT_MEDIA_KEYS) : attachment));
-		}
-		return mapped;
-	};
-	return mapRecord(args, MESSAGE_MEDIA_KEYS, true);
-}
 //#endregion
 //#region extensions/codex/src/app-server/native-process-authority.ts
 const clients = /* @__PURE__ */ new WeakMap();
@@ -617,9 +421,6 @@ function getCodexNativeProcessClient(client) {
 	}
 	return owner;
 }
-function hasCodexNativeBackgroundProcesses(client, threadId) {
-	return clients.get(client)?.hasProcesses(threadId) ?? false;
-}
 /** Read the native process owner's live inventory, never infer custody from a start event. */
 async function readCodexRetainedBackgroundCommands(params) {
 	params.assertCurrent();
@@ -703,9 +504,6 @@ var CodexNativeProcessClient = class {
 		owner.commands.add(command);
 		return command;
 	}
-	hasProcesses(threadId) {
-		return [...this.threads.get(threadId)?.values() ?? []].some((command) => command.processes.size > 0 || command.background !== void 0);
-	}
 	claim(metadata, terminate) {
 		if (this.closed || !isJsonObject(metadata) || typeof metadata.threadId !== "string" || typeof metadata.toolCallId !== "string") throw new Error("Codex process start requires its admitted native command");
 		const command = this.threads.get(metadata.threadId)?.get(metadata.toolCallId);
@@ -777,12 +575,13 @@ var CodexNativeProcessAuthority = class {
 			throw error;
 		}
 	}
-	ownsCurrentCommand(client, receipt) {
-		return this.findCurrentCommand(client, receipt) !== void 0;
+	hasCurrentProcesses(client, threadId) {
+		this.assertCurrent();
+		return [...this.commands].some((command) => command.client === clients.get(client) && command.threadId === threadId && (command.processes.size > 0 || command.background?.confirmed === true));
 	}
-	findCurrentCommand(client, receipt) {
+	ownsCurrentCommand(client, receipt) {
 		this.assertCurrent();
-		return [...this.commands].find((command) => command.client === clients.get(client) && command.threadId === receipt.threadId && command.turnId === receipt.turnId && command.itemId === receipt.itemId && command.processes.size > 0);
+		return [...this.commands].some((command) => command.client === clients.get(client) && command.threadId === receipt.threadId && command.turnId === receipt.turnId && command.itemId === receipt.itemId && command.processes.size > 0);
 	}
 	bindTurn(client, threadId, turnId) {
 		this.parentTurn = {
@@ -943,10 +742,16 @@ const CODEX_NODE_HTTP_CREDENTIAL_HEADER_NAMES = /* @__PURE__ */ new Set([
 const CODEX_NODE_HTTP_CREDENTIAL_HEADER_NAME_PATTERN = /(?:^|[-_])(?:auth(?:orization|entication)?|token|secret|api[-_]?key|apikey|key|password|passwd|pwd|passphrase|passcode|credentials?|session|jwt|assertion|verifier|sig(?:nature)?|hmac|bearer|ticket|challenge|proof|dpop|otp|totp|pin|mfa)(?:[-_]|$)/iu;
 const CODEX_NODE_HTTP_CREDENTIAL_FIELD_NAME_PATTERN = /^(?:(?:[a-z\d]+_)*(?:token|secret|password|passwd|pwd|passphrase|passcode|credentials?|authorization|api_?key|private_key|secret_key|secret_access_key|jwt|assertion|verifier|signature|hmac|bearer|ticket|(?:oauth|consumer|auth|access)_key|otp|totp|pin)|(?:device|authorization|auth|verification|mfa)_code|session(?:_id)?|jsessionid|saml(?:_?response|_?assertion)?|auth|jwt|code|sig|signature|hmac|key|pass)$/u;
 const nodeExecServerTextDecoder = new TextDecoder("utf-8", { fatal: true });
+var CodexNodeExecServerDisconnectedError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.code = "codex_node_disconnected";
+		this.name = "CodexNodeExecServerDisconnectedError";
+	}
+};
 /** Produces the bounded, redacted terminal failure shared by pending and claimed node leases. */
 function createCodexNodeExecServerDisconnectError(reason, cause) {
-	const detail = cause === void 0 ? "" : `: ${truncateUtf16Safe(redactSensitiveText$1(formatErrorMessage$2(cause), { mode: "tools" }), CODEX_NODE_EXEC_SERVER_MAX_FAILURE_DETAIL_CHARS)}`;
-	return /* @__PURE__ */ new Error(`Codex execution node disconnected; start a fresh attempt. (${reason}${detail})`);
+	return new CodexNodeExecServerDisconnectedError(`Codex execution node disconnected; start a fresh attempt. (${reason}${cause === void 0 ? "" : `: ${truncateUtf16Safe(redactSensitiveText$1(formatErrorMessage$2(cause), { mode: "tools" }), CODEX_NODE_EXEC_SERVER_MAX_FAILURE_DETAIL_CHARS)}`})`);
 }
 /** Relays one authorized, single-use Codex exec-server channel without interpreting its protocol. */
 async function startCodexNodeExecServerRelay(params) {
@@ -1015,7 +820,7 @@ function sendCodexExecServerFrame(socket, frame) {
 	});
 }
 function normalizeCodexExecServerFrame(data) {
-	const frame = Array.isArray(data) ? Buffer.concat(data) : Buffer.isBuffer(data) ? data : data instanceof Uint8Array ? Buffer.from(data.buffer, data.byteOffset, data.byteLength) : Buffer.from(data);
+	const frame = codexWebSocketDataToBuffer(data);
 	if (frame.length > CODEX_NODE_EXEC_SERVER_MAX_MESSAGE_BYTES$1) throw new RangeError("Codex exec-server message exceeds its 64 MiB limit.");
 	if (frame.includes(10) || frame.includes(13)) throw new Error("Codex exec-server messages must occupy exactly one stdio line.");
 	return frame;
@@ -1048,12 +853,8 @@ function rejectCredentialedCodexNodeHttpRequest(request) {
 	return credentialBearing ? createCredentialedCodexNodeHttpRejection(request) : void 0;
 }
 function hasCredentialedCodexNodeHttpUrl(value) {
-	let url;
-	try {
-		url = new URL(value);
-	} catch {
-		throw new Error("Codex http/request URL must be valid.");
-	}
+	const url = URL.parse(value);
+	if (!url) throw new Error("Codex http/request URL must be valid.");
 	if (url.username || url.password || hasSensitiveCodexNodeText(value)) return true;
 	let fields = 0;
 	const hasCredentialedParameter = (name, parameterValue) => ++fields > CODEX_NODE_HTTP_CREDENTIAL_SCAN_MAX_FIELDS || isCodexNodeCredentialField(name) || hasSensitiveCodexNodeText(parameterValue);
@@ -1198,10 +999,8 @@ function sanitizeCodexExecServerEnvironment(record, key) {
 	const values = {};
 	for (const [name, value] of Object.entries(environment)) {
 		if (typeof value !== "string") throw new Error(`Codex process/start ${key} values must be strings.`);
-		try {
-			const url = new URL(value);
-			if (url.username || url.password) continue;
-		} catch {}
+		const url = URL.parse(value);
+		if (url?.username || url?.password) continue;
 		values[name] = value;
 	}
 	record[key] = sanitizeEnvVars(values).allowed;
@@ -1426,7 +1225,6 @@ function assertResolvedFsSandboxAccess(policy, requests) {
 	}
 }
 function resolveFsAccess(policy, rawPath) {
-	if (policy.unrestricted) return "write";
 	const target = normalizeSandboxAbsolutePath(rawPath, "fs path");
 	let selected;
 	for (const entry of policy.entries) {
@@ -1559,7 +1357,8 @@ async function openFile(execServer, handles, params) {
 	if (handles.has(handleId)) throw new JsonRpcProtocolError(-32600, `file read handle \`${handleId}\` already exists`);
 	if (handles.size >= CODEX_SANDBOX_EXEC_SERVER_MAX_OPEN_FILE_READS) throw new JsonRpcProtocolError(-32600, `at most ${CODEX_SANDBOX_EXEC_SERVER_MAX_OPEN_FILE_READS} file reads may be open per connection`);
 	const filePath = resolveExecServerPath(requireString(record.path, "path"), "read path");
-	assertFsSandboxAccess(execServer, record, [{
+	const fsSandboxPolicy = resolveFsSandboxPolicy(execServer, record);
+	assertResolvedFsSandboxAccess(fsSandboxPolicy, [{
 		path: filePath,
 		access: "read"
 	}]);
@@ -1571,9 +1370,11 @@ async function openFile(execServer, handles, params) {
 	};
 	handles.set(handleId, handle);
 	try {
+		const readPolicy = await authorizePhysicalReadPath(fsBridge, fsSandboxPolicy, filePath, handle.abortController.signal);
 		const stat = await fsBridge.stat({
 			filePath,
-			signal: handle.abortController.signal
+			signal: handle.abortController.signal,
+			...readPolicy
 		});
 		if (handles.get(handleId) !== handle || handle.closeRequested || handles.closed) throw new JsonRpcProtocolError(JSON_RPC_NOT_FOUND, `unknown file read handle \`${handleId}\``);
 		if (!stat) throw new JsonRpcProtocolError(JSON_RPC_NOT_FOUND, "file not found");
@@ -1584,7 +1385,8 @@ async function openFile(execServer, handles, params) {
 		const data = await fsBridge.readFile({
 			filePath,
 			maxBytes: handle.reservedBytes,
-			signal: handle.abortController.signal
+			signal: handle.abortController.signal,
+			...readPolicy
 		});
 		if (handles.get(handleId) !== handle || handle.closeRequested || handles.closed) throw new JsonRpcProtocolError(JSON_RPC_NOT_FOUND, `unknown file read handle \`${handleId}\``);
 		if (data.byteLength > handle.reservedBytes) throw new JsonRpcProtocolError(-32600, "sandbox file read exceeds the per-connection buffered file limit");
@@ -1645,17 +1447,23 @@ function requireFileReadHandleId(value) {
 async function readFile(execServer, params) {
 	const record = requireObject(params, "fs/readFile params");
 	const filePath = resolveExecServerPath(requireString(record.path, "path"), "read path");
-	assertFsSandboxAccess(execServer, record, [{
+	const fsSandboxPolicy = resolveFsSandboxPolicy(execServer, record);
+	assertResolvedFsSandboxAccess(fsSandboxPolicy, [{
 		path: filePath,
 		access: "read"
 	}]);
 	const fsBridge = execServer.fsBridge;
-	const stat = await fsBridge.stat({ filePath });
+	const readPolicy = await authorizePhysicalReadPath(fsBridge, fsSandboxPolicy, filePath);
+	const stat = await fsBridge.stat({
+		filePath,
+		...readPolicy
+	});
 	if (!stat) throw new JsonRpcProtocolError(JSON_RPC_NOT_FOUND, "file not found");
 	assertSandboxFileReadWithinLimit(stat);
 	return { dataBase64: (await fsBridge.readFile({
 		filePath,
-		maxBytes: CODEX_SANDBOX_EXEC_SERVER_MAX_READ_FILE_BYTES
+		maxBytes: CODEX_SANDBOX_EXEC_SERVER_MAX_READ_FILE_BYTES,
+		...readPolicy
 	})).toString("base64") };
 }
 async function writeFile(execServer, params) {
@@ -1708,11 +1516,16 @@ async function createDirectory(execServer, params) {
 async function getMetadata(execServer, params) {
 	const record = requireObject(params, "fs/getMetadata params");
 	const filePath = resolveExecServerPath(requireString(record.path, "path"), "metadata path");
-	assertFsSandboxAccess(execServer, record, [{
+	const fsSandboxPolicy = resolveFsSandboxPolicy(execServer, record);
+	assertResolvedFsSandboxAccess(fsSandboxPolicy, [{
 		path: filePath,
 		access: "read"
 	}]);
-	const stat = await execServer.fsBridge.stat({ filePath });
+	const readPolicy = await authorizePhysicalReadPath(execServer.fsBridge, fsSandboxPolicy, filePath);
+	const stat = await execServer.fsBridge.stat({
+		filePath,
+		...readPolicy
+	});
 	if (!stat) throw new JsonRpcProtocolError(JSON_RPC_NOT_FOUND, "file not found");
 	return {
 		isDirectory: stat.type === "directory",
@@ -1735,7 +1548,7 @@ async function listDirectoryEntries(execServer, filePath, fsSandboxPolicy) {
 	const resolved = execServer.fsBridge.resolvePath({ filePath });
 	if (!resolved) throw new Error(`Cannot resolve sandbox path: ${filePath}`);
 	const result = await execServer.backend.runShellCommand({
-		script: "find \"$1\" -mindepth 1 -maxdepth 1 -exec sh -c 'for path do name=${path##*/}; if [ -L \"$path\" ]; then kind=o; elif [ -d \"$path\" ]; then kind=d; elif [ -f \"$path\" ]; then kind=f; else kind=o; fi; printf \"%s\\t%s\\n\" \"$kind\" \"$name\"; done' sh {} +",
+		script: "find \"$1\" -mindepth 1 -maxdepth 1 -exec sh -c 'for path do name=${path##*/}; if [ -L \"$path\" ]; then kind=o; elif [ -d \"$path\" ]; then kind=d; elif [ -f \"$path\" ]; then kind=f; else kind=o; fi; printf \"%s%s\\000\" \"$kind\" \"$name\"; done' sh {} +",
 		args: [resolved.containerPath],
 		allowFailure: true
 	});
@@ -1743,14 +1556,23 @@ async function listDirectoryEntries(execServer, filePath, fsSandboxPolicy) {
 		const stderr = result.stderr.toString("utf8").trim();
 		throw new Error(stderr || `sandbox directory listing failed with code ${result.code}`);
 	}
-	return result.stdout.toString("utf8").split("\n").filter(Boolean).map((line) => {
-		const [kind = "o", fileName = ""] = line.split("	");
-		return {
-			fileName,
-			isDirectory: kind === "d",
-			isFile: kind === "f"
-		};
+	return result.stdout.toString("utf8").split("\0").filter(Boolean).map((entry) => ({
+		fileName: entry.slice(1),
+		isDirectory: entry[0] === "d",
+		isFile: entry[0] === "f"
+	}));
+}
+async function authorizePhysicalReadPath(fsBridge, policy, filePath, signal) {
+	if (!policy || policy.unrestricted || !fsBridge.resolveReadPolicyPath) return {};
+	const expectedPolicyPath = await fsBridge.resolveReadPolicyPath({
+		filePath,
+		signal
 	});
+	assertResolvedFsSandboxAccess(policy, [{
+		path: expectedPolicyPath,
+		access: "read"
+	}]);
+	return { expectedPolicyPath };
 }
 async function removePath(execServer, params) {
 	const record = requireObject(params, "fs/remove params");
@@ -2198,7 +2020,7 @@ function readSandboxHttpResponse(params) {
 				embeddedAgentLog.warn("codex sandbox http/request cleanup failed", { error });
 			});
 			if (headerResolved) {
-				if (params.notifications.isOpen()) params.notifications.send("http/request/bodyDelta", {
+				params.notifications.send("http/request/bodyDelta", {
 					requestId: params.requestId,
 					seq: lastBodySeq + 1,
 					deltaBase64: "",
@@ -2248,7 +2070,7 @@ function readSandboxHttpResponse(params) {
 					} else if (type === "bodyDelta") {
 						const seq = requireNumber(message.seq, "http body sequence");
 						lastBodySeq = Math.max(lastBodySeq, seq);
-						if (params.notifications.isOpen()) params.notifications.send("http/request/bodyDelta", {
+						params.notifications.send("http/request/bodyDelta", {
 							requestId: params.requestId,
 							seq,
 							deltaBase64: typeof message.deltaBase64 === "string" ? message.deltaBase64 : "",
@@ -2875,7 +2697,7 @@ function buildEnvFromPolicy(value) {
 	if (!value || typeof value !== "object" || Array.isArray(value)) return {};
 	const policy = value;
 	const inheritedEnv = readEnv(policy.set);
-	const includeOnly = readStringList(policy.includeOnly);
+	const includeOnly = filterStringEntries(policy.includeOnly);
 	if (includeOnly.length > 0) {
 		const regexes = includeOnly.map(wildcardPatternToRegex);
 		for (const key of Object.keys(inheritedEnv)) if (!regexes.some((regex) => regex.test(key))) delete inheritedEnv[key];
@@ -2886,9 +2708,6 @@ function wildcardPatternToRegex(pattern) {
 	const escaped = pattern.replace(/[.+^${}()|[\]\\]/gu, "\\$&");
 	return new RegExp(`^${escaped.replaceAll("*", ".*").replaceAll("?", ".")}$`, "iu");
 }
-function readStringList(value) {
-	return Array.isArray(value) ? value.filter((entry) => typeof entry === "string") : [];
-}
 //#endregion
 //#region extensions/codex/src/app-server/sandbox-exec-server/session.ts
 /** Owns the JSON-RPC protocol and resources of one sandbox execution connection. */
@@ -2903,7 +2722,6 @@ var CodexSandboxExecSession = class {
 		this.httpRequests = /* @__PURE__ */ new Set();
 		this.closeController = new AbortController();
 		this.notifications = {
-			isOpen: transport.isOpen,
 			signal: this.closeController.signal,
 			send: (method, params) => {
 				if (transport.isOpen()) transport.send({
@@ -3050,14 +2868,10 @@ async function releaseCodexSandboxExecServerEnvironment(sandbox, environment) {
 function canExposeLocalExecServerToAppServer(startOptions) {
 	if (!startOptions || startOptions.transport !== "websocket") return true;
 	if (typeof startOptions.url !== "string") return false;
-	try {
-		const host = new URL(startOptions.url).hostname.toLowerCase();
-		const ipHost = host.startsWith("[") && host.endsWith("]") ? host.slice(1, -1) : host;
-		if (host === "localhost" || ipHost === "::1") return true;
-		return isIP(ipHost) === 4 && ipHost.split(".")[0] === "127";
-	} catch {
-		return false;
-	}
+	const host = URL.parse(startOptions.url)?.hostname.toLowerCase();
+	if (!host) return false;
+	const ipHost = host.startsWith("[") && host.endsWith("]") ? host.slice(1, -1) : host;
+	return host === "localhost" || ipHost === "::1" || isIP(ipHost) === 4 && ipHost.split(".")[0] === "127";
 }
 async function acquireOpenClawExecServer(params) {
 	const { sandbox, runtime, signal, onExecutionDisconnect } = params;
@@ -3178,16 +2992,16 @@ async function startOpenClawExecServer(sandbox) {
 	};
 	server.on("connection", (socket, request) => {
 		socket.on("error", handleExecServerSocketError);
-		if (!isAuthorizedExecServerRequest(execServer, request)) {
+		const requestUrl = new URL(request.url ?? "", "ws://127.0.0.1");
+		if (requestUrl.pathname !== execServer.authPath && ("node" in execServer || !execServer.processAuthorities?.has(requestUrl.pathname))) {
 			socket.close(1008, "unauthorized");
 			return;
 		}
 		if ("node" in execServer) {
-			handleNodeConnection(execServer, socket, request);
+			handleNodeConnection(execServer, socket, requestUrl);
 			return;
 		}
-		const requestPath = new URL(request.url ?? "", "ws://127.0.0.1").pathname;
-		handleConnection(execServer, socket, execServer.processAuthorities?.get(requestPath));
+		handleConnection(execServer, socket, execServer.processAuthorities?.get(requestUrl.pathname));
 	});
 	embeddedAgentLog.info("codex sandbox exec-server started", {
 		environmentId,
@@ -3208,10 +3022,6 @@ async function releaseOpenClawExecServer(execServer) {
 function buildEnvironmentId(sandbox) {
 	return `openclaw-sandbox-${createHash("sha256").update(sandbox.runtimeId).digest("hex").slice(0, 16)}`;
 }
-function isAuthorizedExecServerRequest(execServer, request) {
-	const url = new URL(request.url ?? "", "ws://127.0.0.1");
-	return url.pathname === execServer.authPath || !("node" in execServer) && execServer.processAuthorities?.has(url.pathname) === true;
-}
 function readCodexPlacementNodeId(sandbox) {
 	if (!("placementExecutionMode" in sandbox) || sandbox.placementExecutionMode !== "remote-exec" || !("placementNodeId" in sandbox) || typeof sandbox.placementNodeId !== "string" || !sandbox.placementNodeId) return;
 	return sandbox.placementNodeId;
@@ -3225,8 +3035,8 @@ function readCodexPlacementWorkspaceIdentity(sandbox) {
 		sessionKey: sandbox.sessionKey
 	};
 }
-function handleNodeConnection(execServer, socket, request) {
-	const leaseId = new URL(request.url ?? "", "ws://127.0.0.1").searchParams.get("lease");
+function handleNodeConnection(execServer, socket, requestUrl) {
+	const leaseId = requestUrl.searchParams.get("lease");
 	const lease = leaseId ? execServer.node.leases.get(leaseId) : void 0;
 	if (!lease || lease.claimed || lease.closed) {
 		socket.close(1008, "execution channel unavailable");
@@ -3283,435 +3093,7 @@ function handleExecServerSocketError(error) {
 	embeddedAgentLog.debug("codex sandbox exec-server websocket failed", { error });
 }
 async function handleMessage(session, data) {
-	const buffer = Array.isArray(data) ? Buffer.concat(data) : Buffer.isBuffer(data) ? data : Buffer.from(data);
-	await session.handleRequest(parseRequest(buffer.toString("utf8")));
-}
-//#endregion
-//#region extensions/codex/src/app-server/vision-tools.ts
-/**
-* Codex's enabled native surface includes its stable view_image loader. Keep
-* OpenClaw's view_image tool only when that surface or model vision is unavailable.
-*/
-function filterCodexVisionTools(tools, params) {
-	if (!params.modelHasVision || !params.nativeImageInspectionEnabled) return tools;
-	return tools.filter((tool) => tool.name !== "view_image");
-}
-//#endregion
-//#region extensions/codex/src/app-server/dynamic-tool-build.ts
-const CODEX_MEMORY_FLUSH_DYNAMIC_TOOL_ALLOW = /* @__PURE__ */ new Set(["read", "write"]);
-const CODEX_DISABLED_NATIVE_SHELL_DYNAMIC_TOOLS = /* @__PURE__ */ new Set([
-	"exec",
-	"process",
-	"sandbox_exec",
-	"sandbox_process",
-	CODEX_GATEWAY_EXEC_DYNAMIC_TOOL_NAME,
-	CODEX_GATEWAY_PROCESS_DYNAMIC_TOOL_NAME,
-	CODEX_NODE_EXEC_DYNAMIC_TOOL_NAME
-]);
-/** Keeps node filesystem and process ownership on its native exec-server. */
-function resolveCodexNodePlacementToolConstructionPlan(sandbox, nativeToolSurfaceEnabled) {
-	if (!isCodexRemoteExecPlacementSandbox(sandbox) || sandbox?.backendId !== "node" || !("placementNodeId" in sandbox) || typeof sandbox.placementNodeId !== "string" || !sandbox.placementNodeId) return;
-	if (!nativeToolSurfaceEnabled) throw new Error("Codex node execution requires its native exec-server tool surface; adjust the session tool policy and start a fresh attempt.");
-	return {
-		includeBaseCodingTools: false,
-		includeShellTools: false,
-		includeChannelTools: true,
-		includeOpenClawTools: true,
-		includePluginTools: true
-	};
-}
-function preserveRingZeroSystemAgentTool(allTools, filteredTools) {
-	const openclaw = allTools.find((tool) => tool.name === "openclaw" && tool.catalogMode === "direct-only");
-	if (!openclaw) return filteredTools;
-	return [openclaw, ...filteredTools.filter((tool) => tool.name !== "openclaw")];
-}
-function resolveCodexMessageToolProvider(params) {
-	return params.messageChannel ?? params.messageProvider;
-}
-function resolveCodexAppServerHookChannelId(params, sandboxSessionKey) {
-	return buildAgentHookContextChannelFields({
-		sessionKey: sandboxSessionKey,
-		messageChannel: params.messageChannel,
-		messageProvider: params.messageProvider,
-		currentChannelId: params.currentChannelId,
-		messageTo: params.messageTo
-	}).channelId;
-}
-const CODEX_DYNAMIC_TOOL_BUILD_WARN_TOTAL_MS = 1e3;
-const CODEX_DYNAMIC_TOOL_BUILD_WARN_STAGE_MS = 500;
-function shouldWarnCodexDynamicToolBuildStageSummary(summary, profilerEnabled = false) {
-	const totalWarnMs = profilerEnabled ? CODEX_DYNAMIC_TOOL_BUILD_WARN_TOTAL_MS : 1e4;
-	const stageWarnMs = profilerEnabled ? CODEX_DYNAMIC_TOOL_BUILD_WARN_STAGE_MS : 5e3;
-	return summary.totalMs >= totalWarnMs || summary.stages.some((stage) => stage.durationMs >= stageWarnMs);
-}
-async function buildDynamicTools(input) {
-	const { params } = input;
-	const messagePolicyParams = input.ignoreDisableMessageTool ? {
-		...params,
-		disableMessageTool: false
-	} : params;
-	const toolRunContext = buildEmbeddedAttemptToolRunContext({
-		...params,
-		forceMessageTool: shouldForceMessageTool(messagePolicyParams)
-	});
-	if (params.disableTools) {
-		input.onWebSearchPolicyResolved?.(false);
-		return [];
-	}
-	if (!supportsModelTools(params.model)) {
-		input.onPersistentWebSearchPolicyResolved?.(false);
-		input.onWebSearchPolicyResolved?.(false);
-		return [];
-	}
-	const toolBuildStages = createStageTimingTracker();
-	const modelHasVision = params.model.input?.includes("image") ?? false;
-	const agentDir = params.agentDir ?? resolveAgentDir(params.config ?? {}, input.sessionAgentId);
-	const nativeExecutionPolicy = resolveCodexNativeExecutionPolicyForRun(params, {
-		agentId: input.policyAgentId,
-		runtimeSessionKey: input.sandboxSessionKey,
-		sandbox: input.sandbox
-	});
-	const webSearchPlan = resolveCodexWebSearchPlan({
-		config: params.config,
-		disableTools: params.disableTools,
-		nativeToolSurfaceEnabled: isCodexResponsesOAuthRun(params) || input.nativeToolSurfaceEnabled,
-		nativeProviderWebSearchSupport: input.nativeProviderWebSearchSupport
-	});
-	const messageToolProvider = resolveCodexMessageToolProvider(params);
-	const webFetchHostnameAllowlistRef = {};
-	const toolConstructionPlan = resolveCodexNodePlacementToolConstructionPlan(input.sandbox, input.nativeToolSurfaceEnabled);
-	const options = {
-		agentId: input.sessionAgentId,
-		policyAgentId: input.policyAgentId,
-		...toolRunContext,
-		exec: {
-			...params.execOverrides,
-			...input.sessionPermissionPolicy ? { mode: input.sessionPermissionPolicy.execMode } : {},
-			...resolveCodexNodeExecToolOverrides(nativeExecutionPolicy),
-			config: params.config,
-			elevated: params.bashElevated
-		},
-		sessionPermissionPolicy: input.sessionPermissionPolicy ? {
-			mode: input.sessionPermissionPolicy.mode,
-			root: input.sessionPermissionPolicy.root
-		} : void 0,
-		sandbox: input.sandbox,
-		...toolConstructionPlan ? { toolConstructionPlan } : {},
-		messageProvider: messageToolProvider,
-		toolPolicyMessageProvider: params.messageProvider ?? params.messageChannel,
-		...params.onToolResult ? { questionPrompt: {
-			send: params.onToolResult,
-			messageChannel: messageToolProvider
-		} } : {},
-		inputProvenance: params.inputProvenance,
-		trustedInternalHandoff: params.trustedInternalHandoff,
-		allowGatewaySubagentBinding: params.allowGatewaySubagentBinding || isForcedPrivateQaCodexRuntime(),
-		sessionKey: input.sandboxSessionKey,
-		runSessionKey: params.sessionKey && params.sessionKey !== input.sandboxSessionKey ? params.sessionKey : void 0,
-		sessionId: params.sessionId,
-		runId: params.runId,
-		agentDir,
-		preparedModelRuntime: params.preparedModelRuntime,
-		cwd: input.effectiveCwd ?? input.effectiveWorkspace,
-		workspaceDir: input.effectiveWorkspace,
-		spawnWorkspaceDir: input.effectiveCwd && input.effectiveCwd !== input.effectiveWorkspace ? input.resolvedWorkspace : resolveAttemptSpawnWorkspaceDir({
-			sandbox: input.sandbox,
-			resolvedWorkspace: input.resolvedWorkspace
-		}),
-		config: params.config,
-		skillsSnapshot: params.skillsSnapshot,
-		...params.skillLibraryAuthoring ? { skillWorkshop: { libraryAuthoring: params.skillLibraryAuthoring } } : {},
-		authProfileStore: params.toolAuthProfileStore ?? params.authProfileStore,
-		abortSignal: input.runAbortController.signal,
-		emitBeforeToolCallDiagnostics: false,
-		modelProvider: params.model.provider,
-		modelId: params.modelId,
-		modelCompat: params.model.compat && typeof params.model.compat === "object" ? params.model.compat : void 0,
-		modelApi: params.model.api,
-		modelContextWindowTokens: params.model.contextWindow,
-		delegationCapability: params.delegationCapability,
-		modelAuthMode: resolveModelAuthMode(params.model.provider, params.config, params.toolAuthProfileStore ?? params.authProfileStore, { workspaceDir: input.effectiveWorkspace }),
-		suppressManagedWebSearch: false,
-		webFetchHostnameAllowlistRef,
-		hookChannelId: resolveCodexAppServerHookChannelId(params, input.sandboxSessionKey),
-		modelHasVision,
-		computerContextEpoch: input.computerContextEpoch,
-		oneShotCliRun: params.oneShotCliRun,
-		registerRunCleanup: input.registerRunCleanup,
-		requireExplicitMessageTarget: params.requireExplicitMessageTarget ?? isSubagentSessionKey(params.sessionKey),
-		disableMessageTool: input.ignoreDisableMessageTool ? false : params.disableMessageTool,
-		forceMessageTool: shouldForceMessageTool(messagePolicyParams),
-		enableHeartbeatTool: params.trigger === "heartbeat" || input.forceHeartbeatTool === true,
-		forceHeartbeatTool: params.trigger === "heartbeat" || input.forceHeartbeatTool === true,
-		onYield: (message, acknowledgment) => {
-			input.onYieldDetected(message, acknowledgment);
-			input.onCodexAppServerEvent?.({
-				stream: "codex_app_server.tool",
-				data: {
-					name: "sessions_yield",
-					message
-				}
-			});
-		},
-		claimYieldCompletion: input.claimYieldCompletion,
-		recordToolPrepStage: (name) => {
-			toolBuildStages.mark(name);
-		},
-		onToolOutcome: params.onToolOutcome,
-		isTurnTainted: params.isTurnTainted,
-		allocateToolOutcomeOrdinal: params.allocateToolOutcomeOrdinal,
-		cronCreatorToolAllowlistRef: input.cronCreatorToolAllowlistRef,
-		cronCreatorToolAllowlistCaptureRef: input.cronCreatorToolAllowlistCaptureRef,
-		cronCreatorAuthorityUnavailableReason: input.cronCreatorAuthorityUnavailableReason
-	};
-	input.onMessageToolTargetResolved?.(options.requireExplicitMessageTarget === true);
-	const buildOpenClawCodingTools = () => {
-		const bindingOptions = { cwd: input.effectiveCwd ?? input.effectiveWorkspace };
-		const createToolSurface = params.hostCapabilities.createToolSurface;
-		if (!createToolSurface) throw new Error("Codex tool construction requires a current host capability");
-		return createToolSurface(options, bindingOptions);
-	};
-	const allTools = input.resolveCronCreatorToolAuthority ? runWithCronCreatorAuthorityCapabilityResolver({
-		capability: params.cronCreatorAuthorityCapability,
-		runId: params.runId,
-		resolve: input.resolveCronCreatorToolAuthority,
-		run: buildOpenClawCodingTools
-	}) : buildOpenClawCodingTools();
-	toolBuildStages.mark("create-openclaw-coding-tools");
-	const preNormalizationDiagnostics = [];
-	const readableAllToolProjection = filterProviderNormalizableTools(allTools);
-	preNormalizationDiagnostics.push(...readableAllToolProjection.diagnostics);
-	const readableAllTools = [...readableAllToolProjection.tools];
-	const normallyProfiledTools = input.nativeToolSurfaceEnabled === false ? filterCodexDynamicToolsForDisabledNativeSurface(readableAllTools, input.pluginConfig, { preserveShell: shouldKeepOpenClawShellDynamicTools(input, nativeExecutionPolicy) }) : filterCodexDynamicTools(readableAllTools, input.pluginConfig);
-	const profileFilteredTools = (input.isHostScopedToolActive?.("openclaw") ?? isHostScopedAgentToolActive("openclaw")) && isSystemAgentOnlyCodexDynamicToolAllowlist(params.toolsAllow) ? preserveRingZeroSystemAgentTool(readableAllTools, normallyProfiledTools) : normallyProfiledTools;
-	const codexFilteredTools = await addNodeShellDynamicToolsIfNeeded(addGatewayShellDynamicToolsIfAvailable(addSandboxShellDynamicToolsIfAvailable(isCodexMemoryFlushRun(params) ? filterCodexMemoryFlushDynamicTools(readableAllTools) : profileFilteredTools, readableAllTools, input, nativeExecutionPolicy), readableAllTools, input, nativeExecutionPolicy), readableAllTools, input, nativeExecutionPolicy);
-	toolBuildStages.mark("codex-filtering");
-	const visionFilteredTools = filterCodexVisionTools(codexFilteredTools, {
-		modelHasVision,
-		nativeImageInspectionEnabled: input.nativeToolSurfaceEnabled === true
-	});
-	toolBuildStages.mark("vision-filtering");
-	const webSearchPresent = visionFilteredTools.some((tool) => tool.name === "web_search");
-	const persistentCodexWebSearchSurface = params.config?.tools?.web?.search?.enabled !== false && !(input.pluginConfig.codexDynamicToolsExclude ?? []).some((name) => normalizeCodexDynamicToolName(name) === "web_search");
-	let persistentWebSearchAllowed = webSearchPresent;
-	if (input.onPersistentWebSearchPolicyResolved && !webSearchPresent && persistentCodexWebSearchSurface) {
-		const webSearchPolicy = (await import("openclaw/plugin-sdk/agent-harness")).resolveWebSearchToolPolicy({
-			config: params.config,
-			modelProvider: params.model.provider,
-			modelId: params.modelId,
-			agentId: input.policyAgentId,
-			sessionKey: input.sandboxSessionKey,
-			sandboxToolPolicy: input.sandbox?.tools,
-			messageProvider: messageToolProvider,
-			agentAccountId: params.agentAccountId,
-			groupId: params.groupId,
-			groupChannel: params.groupChannel,
-			groupSpace: params.groupSpace,
-			spawnedBy: params.spawnedBy,
-			senderId: params.senderId,
-			senderName: params.senderName,
-			senderUsername: params.senderUsername,
-			senderE164: params.senderE164,
-			inputProvenance: params.inputProvenance,
-			trustedInternalHandoff: params.trustedInternalHandoff,
-			scheduledToolPolicy: params.scheduledToolPolicy
-		});
-		persistentWebSearchAllowed = webSearchPolicy.persistentAllowed && (!webSearchPolicy.allowed || isCodexMemoryFlushRun(params));
-	}
-	input.onPersistentWebSearchPolicyResolved?.(persistentWebSearchAllowed);
-	const filteredTools = filterCodexDynamicToolsForAllowlist(visionFilteredTools, toolRunContext.runtimeToolAllowlist);
-	toolBuildStages.mark("allowlist-filter");
-	const normalizedTools = normalizeAgentRuntimeTools({
-		runtimePlan: input.ignoreRuntimePlan ? void 0 : params.runtimePlan,
-		tools: filteredTools,
-		provider: params.provider,
-		config: params.config,
-		workspaceDir: input.effectiveWorkspace,
-		env: process.env,
-		modelId: params.modelId,
-		modelApi: params.model.api,
-		model: params.model,
-		allowProviderRuntimePluginLoad: input.ignoreRuntimePlan ? false : void 0,
-		onPreNormalizationSchemaDiagnostics: (diagnostics) => preNormalizationDiagnostics.push(...diagnostics)
-	});
-	toolBuildStages.mark("runtime-normalization");
-	const webSearchAllowed = normalizedTools.some((tool) => tool.name === "web_search");
-	webFetchHostnameAllowlistRef.value = webSearchAllowed ? webSearchPlan.webFetchHostnameAllowlist : void 0;
-	input.onWebSearchPolicyResolved?.(webSearchAllowed);
-	const exposedTools = placeDisabledNativeShellToolsInDirectNamespace(webSearchPlan.suppressManagedWebSearch ? normalizedTools.filter((tool) => tool.name !== "web_search") : normalizedTools, input.nativeToolSurfaceEnabled);
-	if (preNormalizationDiagnostics.length > 0) embeddedAgentLog.warn(`codex app-server quarantined ${preNormalizationDiagnostics.length} unsupported runtime tool schema${preNormalizationDiagnostics.length === 1 ? "" : "s"} before dynamic tool registration`, {
-		runId: params.runId,
-		sessionId: params.sessionId,
-		diagnostics: preNormalizationDiagnostics.map((diagnostic) => ({
-			index: diagnostic.toolIndex,
-			tool: diagnostic.toolName,
-			violations: diagnostic.violations.slice(0, 12),
-			violationCount: diagnostic.violations.length
-		}))
-	});
-	const summary = toolBuildStages.snapshot();
-	if (shouldWarnCodexDynamicToolBuildStageSummary(summary, input.profilerEnabled)) {
-		const phase = input.forceHeartbeatTool ? "registered-tools" : "runtime-tools";
-		embeddedAgentLog.warn(`codex app-server dynamic tool build timings runId=${params.runId} sessionId=${params.sessionId} phase=${phase} totalMs=${summary.totalMs} stages=${formatStageTimings(summary.stages)}`, {
-			runId: params.runId,
-			sessionId: params.sessionId,
-			phase,
-			totalMs: summary.totalMs,
-			stages: summary.stages,
-			allToolCount: readableAllTools.length,
-			codexFilteredToolCount: codexFilteredTools.length,
-			visionFilteredToolCount: visionFilteredTools.length,
-			filteredToolCount: filteredTools.length,
-			normalizedToolCount: exposedTools.length,
-			forceHeartbeatTool: input.forceHeartbeatTool === true,
-			ignoreRuntimePlan: input.ignoreRuntimePlan === true,
-			nativeToolSurfaceEnabled: input.nativeToolSurfaceEnabled === true
-		});
-	}
-	return exposedTools;
-}
-/** Keeps the OpenClaw Gateway execution path available beside Codex native shell. */
-function addGatewayShellDynamicToolsIfAvailable(filteredTools, allTools, input, executionPolicy) {
-	if (isCodexMemoryFlushRun(input.params) || input.nativeToolSurfaceEnabled !== true || input.sandbox?.enabled === true || !executionPolicy.nativeToolSurfaceAllowed || executionPolicy.effectiveExecHost !== "gateway") return filteredTools;
-	const execTool = allTools.find((tool) => normalizeCodexDynamicToolName(tool.name) === "exec");
-	const processTool = allTools.find((tool) => normalizeCodexDynamicToolName(tool.name) === "process");
-	const existingNames = new Set(filteredTools.map((tool) => normalizeCodexDynamicToolName(tool.name)));
-	const execExcluded = isCodexDynamicToolExcluded(input.pluginConfig, ["exec", CODEX_GATEWAY_EXEC_DYNAMIC_TOOL_NAME]);
-	if (!execTool || execExcluded || existingNames.has("gateway_exec")) return filteredTools;
-	const processExcluded = isCodexDynamicToolExcluded(input.pluginConfig, ["process", CODEX_GATEWAY_PROCESS_DYNAMIC_TOOL_NAME]);
-	const processAliasAvailable = Boolean(processTool && !processExcluded && !existingNames.has("gateway_process"));
-	const createProjection = resolveCodexScheduledToolProjectionFactory(input.params.hostCapabilities);
-	if (!createProjection) return filteredTools;
-	const toolsToAppend = [createGatewayExecProjection(createProjection, execTool, {
-		processAliasAvailable,
-		...input.sessionPermissionPolicy?.mode === "guarded" ? { ask: "always" } : {}
-	})];
-	if (processAliasAvailable && processTool) toolsToAppend.push(createGatewayProcessProjection(createProjection, processTool));
-	return [...filteredTools, ...toolsToAppend];
-}
-function shouldEnableCodexAppServerNativeToolSurface(params, sandbox, options = {}) {
-	if (isCodexResponsesOAuthRun(params) || params.pluginHarnessToolPolicyRestricted === true || isCodexMemoryFlushRun(params) || params.disableTools) return false;
-	if (!resolveCodexNativeExecutionPolicyForRun(params, {
-		agentId: options.agentId,
-		runtimeSessionKey: options.runtimeSessionKey,
-		sandbox
-	}).nativeToolSurfaceAllowed) return false;
-	const toolsAllow = params.toolsAllow;
-	if (toolsAllow === void 0) return canCodexAppServerNativeToolSurfaceHonorSandbox(sandbox, options);
-	return hasWildcardCodexToolsAllow(toolsAllow) && canCodexAppServerNativeToolSurfaceHonorSandbox(sandbox, options);
-}
-function resolveCodexNativeExecutionPolicyForRun(params, options = {}) {
-	return resolveCodexNativeExecutionPolicy({
-		config: params.config,
-		sessionKey: options.runtimeSessionKey?.trim() || params.sandboxSessionKey?.trim() || params.sessionKey?.trim() || params.sessionId,
-		sessionId: params.sessionId,
-		agentId: options.agentId,
-		execOverrides: params.execOverrides,
-		sandboxAvailable: options.sandbox === null ? false : options.sandbox?.enabled,
-		readRuntimeSessionEntry: true
-	});
-}
-function canCodexAppServerNativeToolSurfaceHonorSandbox(sandbox, options = {}) {
-	if (!sandbox?.enabled) return true;
-	if (options.sandboxExecServerEnabled === true && (sandbox.backend || isCodexRemoteExecPlacementSandbox(sandbox)) && canSandboxToolPolicyExposeCodexNativeToolSurface(sandbox)) return true;
-	return false;
-}
-function canSandboxToolPolicyExposeCodexNativeToolSurface(sandbox) {
-	return CODEX_NATIVE_TOOL_REQUIREMENTS.every((toolName) => isToolAllowed(sandbox.tools, toolName));
-}
-function isCodexMemoryFlushRun(params) {
-	return params?.trigger === "memory" && Boolean(params.memoryFlushWritePath?.trim());
-}
-function filterCodexMemoryFlushDynamicTools(tools) {
-	return tools.filter((tool) => CODEX_MEMORY_FLUSH_DYNAMIC_TOOL_ALLOW.has(normalizeCodexDynamicToolName(tool.name)));
-}
-/** Requires a Codex sandbox environment only when native tools must run inside OpenClaw sandboxing. */
-function shouldRequireCodexSandboxExecServerEnvironment(params) {
-	return Boolean(isCodexRemoteExecPlacementSandbox(params.sandbox) || params.sandbox?.enabled && params.nativeToolSurfaceEnabled && params.sandboxExecServerEnabled);
-}
-function resolveCodexSandboxEnvironmentSelection(environment, nativeToolSurfaceEnabled) {
-	return nativeToolSurfaceEnabled ? environment ? [environment] : void 0 : [];
-}
-function resolveCodexAppServerExecutionCwd(params) {
-	return mapCodexAppServerRemoteWorkspacePath({
-		value: params.environment && params.nativeToolSurfaceEnabled ? params.environment.cwd : params.effectiveCwd,
-		localWorkspaceRoot: params.localWorkspaceRoot,
-		remoteWorkspaceRoot: params.remoteWorkspaceRoot
-	});
-}
-function resolveCodexExternalSandboxPolicyForOpenClawSandbox(sandbox) {
-	return {
-		type: "externalSandbox",
-		networkAccess: codexNetworkAccessForOpenClawSandbox(sandbox) ? "enabled" : "restricted"
-	};
-}
-function usesDockerNetworkConfig(sandbox) {
-	const backendId = sandbox?.backendId.trim().toLowerCase();
-	return backendId === "docker" || backendId === "podman";
-}
-function codexNetworkAccessForOpenClawSandbox(sandbox) {
-	if (!usesDockerNetworkConfig(sandbox)) return true;
-	const network = sandbox?.docker?.network?.trim().toLowerCase();
-	return Boolean(network && network !== "none");
-}
-function disableCodexPluginThreadConfig(pluginConfig) {
-	const config = readCodexPluginConfig(pluginConfig);
-	return {
-		...config,
-		codexPlugins: {
-			...config.codexPlugins,
-			enabled: false
-		}
-	};
-}
-/** Adds sandbox_exec/process aliases when native Code Mode cannot directly honor the sandbox. */
-function addSandboxShellDynamicToolsIfAvailable(filteredTools, allTools, input, executionPolicy) {
-	if (isCodexMemoryFlushRun(input.params) || !executionPolicy.nativeToolSurfaceAllowed || !input.sandbox?.enabled || !input.sandbox.backendId.trim() || input.nativeToolSurfaceEnabled !== false || isCodexDynamicToolExcluded(input.pluginConfig, [
-		"exec",
-		"sandbox_exec",
-		"process",
-		"sandbox_process"
-	])) return filteredTools;
-	const execTool = allTools.find((tool) => normalizeCodexDynamicToolName(tool.name) === "exec");
-	const processTool = allTools.find((tool) => normalizeCodexDynamicToolName(tool.name) === "process");
-	if (!execTool) return filteredTools;
-	const sandboxTools = [...filteredTools, createSandboxExecProjection(execTool)];
-	return processTool ? [...sandboxTools, createSandboxProcessProjection(processTool)] : sandboxTools;
-}
-async function addNodeShellDynamicToolsIfNeeded(filteredTools, allTools, input, nodePolicy) {
-	if (isCodexMemoryFlushRun(input.params)) return filteredTools;
-	const nodeExecIsDefault = nodePolicy.effectiveExecHost === "node";
-	const nodeExecAvailableFromAuto = nodePolicy.requestedExecHost === "auto" && nodePolicy.effectiveExecHost === "gateway";
-	if (!nodeExecIsDefault && !nodeExecAvailableFromAuto) return filteredTools;
-	const execTool = allTools.find((tool) => normalizeCodexDynamicToolName(tool.name) === "exec");
-	if (!execTool || isCodexDynamicToolExcluded(input.pluginConfig, ["exec", "node_exec"]) || filteredTools.some((tool) => normalizeCodexDynamicToolName(tool.name) === "node_exec")) return filteredTools;
-	const nodeExec = await createNodeExecAliasDynamicTool(execTool, nodePolicy.node, input.runAbortController.signal, input.nodeExecAvailability);
-	return nodeExec ? [...filteredTools, nodeExec] : filteredTools;
-}
-function shouldKeepOpenClawShellDynamicTools(input, nodePolicy) {
-	return !isCodexMemoryFlushRun(input.params) && input.nativeToolSurfaceEnabled === false && input.sandbox?.enabled !== true && nodePolicy.effectiveExecHost !== "node";
-}
-/** Keeps replacement shell tools direct even when model metadata mandates Codex Code Mode. */
-function placeDisabledNativeShellToolsInDirectNamespace(tools, nativeToolSurfaceEnabled) {
-	if (nativeToolSurfaceEnabled !== false) return tools;
-	for (const tool of tools) if (CODEX_DISABLED_NATIVE_SHELL_DYNAMIC_TOOLS.has(normalizeCodexDynamicToolName(tool.name))) tool.catalogMode = "direct-only";
-	return tools;
-}
-/** Applies a normalized tool allowlist while preserving shell aliases for exec/process. */
-function filterCodexDynamicToolsForAllowlist(tools, toolsAllow) {
-	return applyEmbeddedAttemptToolsAllow(tools, toolsAllow, {
-		toolMeta: getPluginToolMeta,
-		toolAliases: (tool) => {
-			const normalized = normalizeCodexDynamicToolName(tool.name);
-			return normalized === "sandbox_exec" || normalized === "gateway_exec" || normalized === "node_exec" ? ["exec"] : normalized === "sandbox_process" || normalized === "gateway_process" ? ["exec", "process"] : [];
-		}
-	});
-}
-function hasWildcardCodexToolsAllow(toolsAllow) {
-	return toolsAllow.some((name) => normalizeCodexDynamicToolName(name) === "*");
-}
-function shouldForceMessageTool(params) {
-	return params.disableMessageTool !== true && params.sourceReplyDeliveryMode === "message_tool_only";
+	await session.handleRequest(parseRequest(codexWebSocketDataToBuffer(data).toString("utf8")));
 }
 //#endregion
 //#region extensions/codex/src/app-server/native-command-approval.ts
@@ -3796,12 +3178,17 @@ async function handleCodexAppServerApprovalRequest(params) {
 		method: params.method,
 		requestParams
 	});
-	const emitEvent = (data) => emitApprovalEvent(params.paramsForRun, {
-		kind: context.kind,
-		title: context.title,
-		...context.eventDetails,
-		...data
-	});
+	const emitEvent = (data) => {
+		params.paramsForRun.onAgentEvent?.({
+			stream: "approval",
+			data: {
+				kind: context.kind,
+				title: context.title,
+				...context.eventDetails,
+				...data
+			}
+		});
+	};
 	if (params.signal?.aborted) {
 		if (params.signal.reason instanceof CodexServerRequestResolvedError) return;
 		recordNativeToolFailureDisposition(params, context, "cancelled");
@@ -4138,8 +3525,8 @@ function readNativeRelayPreToolUseDecision(response) {
 	};
 	const stdout = response.stdout?.trim();
 	if (!stdout) return { blocked: false };
-	const parsed = parseRelayJsonResponse(stdout);
-	const output = isJsonObject(parsed?.hookSpecificOutput) ? parsed.hookSpecificOutput : void 0;
+	const parsed = safeParseJson(stdout);
+	const output = isJsonObject(parsed) && isJsonObject(parsed.hookSpecificOutput) ? parsed.hookSpecificOutput : void 0;
 	if (output?.permissionDecision === "deny") return {
 		blocked: true,
 		reason: readStringField(output, "permissionDecisionReason") || "OpenClaw native hook policy denied Codex app-server approval.",
@@ -4151,14 +3538,6 @@ function readNativeRelayPreToolUseDecision(response) {
 		failureDisposition: "failed"
 	};
 }
-function parseRelayJsonResponse(text) {
-	try {
-		const parsed = JSON.parse(text);
-		return isJsonObject(parsed) ? parsed : void 0;
-	} catch {
-		return;
-	}
-}
 function sanitizeRelayDecisionReason(value) {
 	return sanitizeApprovalPreview(value ? {
 		value,
@@ -4378,12 +3757,6 @@ function approvalResolutionMessage(outcome) {
 function approvalEventScope(method, outcome) {
 	return method === "item/permissions/requestApproval" ? { scope: outcome === "approved-session" ? "session" : "turn" } : {};
 }
-function emitApprovalEvent(params, data) {
-	params.onAgentEvent?.({
-		stream: "approval",
-		data: { ...data }
-	});
-}
 function readPolicyCommand(record) {
 	const command = record?.command;
 	if (typeof command === "string") return command;
@@ -4474,9 +3847,6 @@ function joinDescriptionLinesWithinLimit(lines, maxLength) {
 }
 //#endregion
 //#region extensions/codex/src/app-server/dynamic-tool-diagnostics.ts
-/**
-* Trusted diagnostics emitted around Codex dynamic tool execution lifecycle.
-*/
 function diagnosticToolIdentity(params) {
 	return {
 		agentId: params.agentId,
@@ -4487,14 +3857,12 @@ function diagnosticToolIdentity(params) {
 		toolCallId: params.call.callId
 	};
 }
-/** Emits a start event for one Codex dynamic tool call. */
 function emitDynamicToolStartedDiagnostic(params) {
 	emitTrustedDiagnosticEvent({
 		type: "tool.execution.started",
 		...diagnosticToolIdentity(params)
 	});
 }
-/** Emits an error event for one Codex dynamic tool call. */
 function emitDynamicToolErrorDiagnostic(params) {
 	emitTrustedDiagnosticEvent({
 		type: "tool.execution.error",
@@ -5152,17 +4520,11 @@ function createCodexDynamicToolSpecs(params) {
 			deferLoading: true
 		});
 	}
-	if (namespaceTools.length > 0) specs.push({
+	for (const [name, tools] of [[CODEX_OPENCLAW_DYNAMIC_TOOL_NAMESPACE, namespaceTools], [CODEX_OPENCLAW_DIRECT_DYNAMIC_TOOL_NAMESPACE, directOnlyNamespaceTools]]) if (tools.length > 0) specs.push({
 		type: "namespace",
-		name: CODEX_OPENCLAW_DYNAMIC_TOOL_NAMESPACE,
-		description: "",
-		tools: namespaceTools
-	});
-	if (directOnlyNamespaceTools.length > 0) specs.push({
-		type: "namespace",
-		name: CODEX_OPENCLAW_DIRECT_DYNAMIC_TOOL_NAMESPACE,
+		name,
 		description: "",
-		tools: directOnlyNamespaceTools
+		tools
 	});
 	return specs;
 }
@@ -5298,6 +4660,97 @@ function finalizeCodexToolAvailability(entries) {
 	};
 }
 //#endregion
+//#region extensions/codex/src/app-server/dynamic-tool-content.ts
+function enforceWholeSkillResult(toolName, result, maxChars) {
+	if (toolName !== "skills_read" || isToolResultError(result)) return result;
+	return sanitizeToolTextRuns(result.content).reduce((total, item) => total + (item.type === "text" ? estimateToolResultTextChars(item.text) : 0), 0) <= maxChars ? result : failedToolResult(`This Codex turn cannot deliver the whole skill within its ${maxChars}-character weighted output budget. No instructions were returned; use a harness with a larger instruction budget.`);
+}
+function sanitizeToolTextRuns(rawContent) {
+	const content = [];
+	for (let index = 0; index < rawContent.length;) {
+		const item = rawContent[index];
+		if (item.type !== "text") {
+			content.push(item);
+			index += 1;
+			continue;
+		}
+		const textRun = [];
+		while (index < rawContent.length) {
+			const next = rawContent[index];
+			if (next.type !== "text") break;
+			textRun.push(next);
+			index += 1;
+		}
+		const sanitizedText = sanitizeToolResult(textRun.map((entry) => entry.text).join(""));
+		let offset = 0;
+		content.push(...textRun.map((entry, runIndex) => {
+			const targetEnd = runIndex === textRun.length - 1 ? sanitizedText.length : Math.min(sanitizedText.length, offset + entry.text.length);
+			const text = sliceUtf16Safe(sanitizedText, offset, targetEnd);
+			const sanitized = Object.assign({}, entry, { text });
+			offset += text.length;
+			return sanitized;
+		}));
+	}
+	return content;
+}
+function convertToolContents(rawContent, maxChars) {
+	const content = sanitizeToolTextRuns(rawContent);
+	const totalTextChars = content.reduce((total, item) => total + (item.type === "text" ? item.text.length : 0), 0);
+	if (content.reduce((total, item) => total + (item.type === "text" ? estimateToolResultTextChars(item.text) : 0), 0) <= maxChars) return content.map(convertToolContent);
+	const noticeText = `...(OpenClaw truncated dynamic tool result: original ${totalTextChars} chars, weighted budget ${maxChars}; rerun with narrower args.)`;
+	const notice = `\n${noticeText}`;
+	const noticeChars = estimateToolResultTextChars(notice);
+	let remainingTextBudget = Math.max(0, maxChars - noticeChars);
+	let appendedNotice = false;
+	const output = [];
+	for (const item of content) {
+		if (item.type !== "text") {
+			output.push(convertToolContent(item));
+			continue;
+		}
+		if (appendedNotice) continue;
+		if (noticeChars >= maxChars) {
+			output.push({
+				type: "inputText",
+				text: sliceToolResultTextToBudget(noticeText, maxChars)
+			});
+			appendedNotice = true;
+			continue;
+		}
+		const text = sliceToolResultTextToBudget(item.text, remainingTextBudget);
+		remainingTextBudget -= estimateToolResultTextChars(text);
+		if (remainingTextBudget <= 0 || text.length < item.text.length) {
+			output.push({
+				type: "inputText",
+				text: `${text.trimEnd()}${notice}`
+			});
+			appendedNotice = true;
+		} else if (text.length > 0) output.push({
+			type: "inputText",
+			text
+		});
+	}
+	if (!appendedNotice) output.push({
+		type: "inputText",
+		text: sliceToolResultTextToBudget(noticeText, maxChars)
+	});
+	return output;
+}
+function convertToolContent(content) {
+	if (content.type === "text") return {
+		type: "inputText",
+		text: content.text
+	};
+	const imageUrl = sanitizeInlineImageDataUrl(`data:${content.mimeType};base64,${content.data}`);
+	return imageUrl ? {
+		type: "inputImage",
+		imageUrl
+	} : {
+		type: "inputText",
+		text: invalidInlineImageText("codex dynamic tool")
+	};
+}
+//#endregion
 //#region extensions/codex/src/app-server/dynamic-tool-executable-projection.ts
 function projectCodexExecutableDynamicToolSurface(tools, hookContext) {
 	const { tools: projectedTools, quarantinedTools } = projectCodexDynamicTools(tools);
@@ -5345,7 +4798,7 @@ function assertCodexDynamicToolInputMatchesSchema(params) {
 	throw new Error(`Invalid arguments for tool "${params.toolName}": ${details}${omittedSuffix}.`);
 }
 function applyCurrentMessageProvider(toolName, args, currentProvider) {
-	const hasProvider = typeof args.provider === "string" && args.provider.trim().length > 0 ? true : typeof args.channel === "string" && args.channel.trim().length > 0;
+	const hasProvider = typeof args.provider === "string" && args.provider.trim().length > 0 || typeof args.channel === "string" && args.channel.trim().length > 0;
 	const provider = currentProvider?.trim();
 	if (toolName !== "message" || hasProvider || !provider) return args;
 	return {
@@ -5597,7 +5050,7 @@ function createCodexDynamicToolBridge(params) {
 						isError: rawIsErrorForPresentation,
 						result: event.result
 					});
-					const result = await legacyExtensionRunner.applyToolResultExtensions({
+					const extendedResult = await legacyExtensionRunner.applyToolResultExtensions({
 						threadId: call.threadId,
 						turnId: call.turnId,
 						toolCallId: call.callId,
@@ -5605,6 +5058,7 @@ function createCodexDynamicToolBridge(params) {
 						args: structuredClone(executedArgsForPresentation),
 						result: middlewareResult
 					});
+					const result = enforceWholeSkillResult(toolName, extendedResult, toolResultMaxChars);
 					presentationIsError = rawIsErrorForPresentation || isToolResultError(result);
 					const acceptedSessionSpawn = toolName === "sessions_spawn" && !rawIsErrorForPresentation ? normalizeAcceptedSessionSpawnResult(telemetryRawResultForPresentation) : null;
 					if (acceptedSessionSpawn) telemetry.acceptedSessionSpawns.push(acceptedSessionSpawn);
@@ -5617,11 +5071,7 @@ function createCodexDynamicToolBridge(params) {
 					runAgentHarnessAfterToolCallHook({
 						toolName,
 						toolCallId: call.callId,
-						runId: toolResultHookContext.runId,
-						agentId: toolResultHookContext.agentId,
-						sessionId: toolResultHookContext.sessionId,
-						sessionKey: toolResultHookContext.sessionKey,
-						channelId: toolResultHookContext.channelId,
+						...toolResultHookContext,
 						startArgs: executedArgs,
 						result,
 						startedAt
@@ -5645,7 +5095,7 @@ function createCodexDynamicToolBridge(params) {
 					const autoDeliveryTtsMediaUrls = getCoreTtsToolResultMediaUrls(rawResult);
 					recordAgentHarnessToolResultTelemetry({
 						extractSourceReplyPayload: extractMessagingToolSourceReplyPayload,
-						collectMessagingMediaUrls: collectCodexMessageMediaUrls,
+						collectMessagingMediaUrls: collectAgentHarnessMessagingMediaUrls,
 						resolveMessagingMediaSourceUrls: (mediaUrls) => resolveCodexMediaSourceUrls(mediaUrls, preparedMessageMedia?.sourcePathsByStagedPath),
 						toolName,
 						args: executedArgs,
@@ -5688,11 +5138,7 @@ function createCodexDynamicToolBridge(params) {
 					runAgentHarnessAfterToolCallHook({
 						toolName,
 						toolCallId: call.callId,
-						runId: toolResultHookContext.runId,
-						agentId: toolResultHookContext.agentId,
-						sessionId: toolResultHookContext.sessionId,
-						sessionKey: toolResultHookContext.sessionKey,
-						channelId: toolResultHookContext.channelId,
+						...toolResultHookContext,
 						startArgs: executedArgs,
 						error: errorMessage,
 						startedAt
@@ -5783,91 +5229,5 @@ function isAsyncStartedToolResult(result) {
 	const details = result.details;
 	return isRecord(details) && details.async === true && details.status === "started";
 }
-function sanitizeToolTextRuns(rawContent) {
-	const content = [];
-	for (let index = 0; index < rawContent.length;) {
-		const item = rawContent[index];
-		if (item.type !== "text") {
-			content.push(item);
-			index += 1;
-			continue;
-		}
-		const textRun = [];
-		while (index < rawContent.length) {
-			const next = rawContent[index];
-			if (next.type !== "text") break;
-			textRun.push(next);
-			index += 1;
-		}
-		const sanitizedText = sanitizeToolResult(textRun.map((entry) => entry.text).join(""));
-		let offset = 0;
-		content.push(...textRun.map((entry, runIndex) => {
-			const targetEnd = runIndex === textRun.length - 1 ? sanitizedText.length : Math.min(sanitizedText.length, offset + entry.text.length);
-			const text = sliceUtf16Safe(sanitizedText, offset, targetEnd);
-			const sanitized = Object.assign({}, entry, { text });
-			offset += text.length;
-			return sanitized;
-		}));
-	}
-	return content;
-}
-function convertToolContents(rawContent, maxChars) {
-	const content = sanitizeToolTextRuns(rawContent);
-	const totalTextChars = content.reduce((total, item) => total + (item.type === "text" ? item.text.length : 0), 0);
-	if (content.reduce((total, item) => total + (item.type === "text" ? estimateToolResultTextChars(item.text) : 0), 0) <= maxChars) return content.flatMap(convertToolContent);
-	const noticeText = `...(OpenClaw truncated dynamic tool result: original ${totalTextChars} chars, weighted budget ${maxChars}; rerun with narrower args.)`;
-	const notice = `\n${noticeText}`;
-	const noticeChars = estimateToolResultTextChars(notice);
-	let remainingTextBudget = Math.max(0, maxChars - noticeChars);
-	let appendedNotice = false;
-	const output = [];
-	for (const item of content) {
-		if (item.type !== "text") {
-			output.push(...convertToolContent(item));
-			continue;
-		}
-		if (appendedNotice) continue;
-		if (noticeChars >= maxChars) {
-			output.push({
-				type: "inputText",
-				text: sliceToolResultTextToBudget(noticeText, maxChars)
-			});
-			appendedNotice = true;
-			continue;
-		}
-		const text = sliceToolResultTextToBudget(item.text, remainingTextBudget);
-		remainingTextBudget -= estimateToolResultTextChars(text);
-		if (remainingTextBudget <= 0 || text.length < item.text.length) {
-			output.push({
-				type: "inputText",
-				text: `${text.trimEnd()}${notice}`
-			});
-			appendedNotice = true;
-		} else if (text.length > 0) output.push({
-			type: "inputText",
-			text
-		});
-	}
-	if (!appendedNotice) output.push({
-		type: "inputText",
-		text: sliceToolResultTextToBudget(noticeText, maxChars)
-	});
-	return output;
-}
-function convertToolContent(content) {
-	if (content.type === "text") return [{
-		type: "inputText",
-		text: content.text
-	}];
-	const imageUrl = sanitizeInlineImageDataUrl(`data:${content.mimeType};base64,${content.data}`);
-	if (!imageUrl) return [{
-		type: "inputText",
-		text: invalidInlineImageText("codex dynamic tool")
-	}];
-	return [{
-		type: "inputImage",
-		imageUrl
-	}];
-}
 //#endregion
-export { readCodexRetainedBackgroundCommands as C, CodexNativeToolLifecycleProjector as E, hasCodexNativeBackgroundProcesses as S, mapCodexAppServerRemoteWorkspacePath as T, shouldWarnCodexDynamicToolBuildStageSummary as _, emitDynamicToolStartedDiagnostic as a, createCodexNativePreToolUseFailureBuffer as b, buildDynamicTools as c, resolveCodexAppServerHookChannelId as d, resolveCodexExternalSandboxPolicyForOpenClawSandbox as f, shouldRequireCodexSandboxExecServerEnvironment as g, shouldEnableCodexAppServerNativeToolSurface as h, emitDynamicToolErrorDiagnostic as i, disableCodexPluginThreadConfig as l, resolveCodexSandboxEnvironmentSelection as m, projectCodexExecutableDynamicTools as n, emitDynamicToolTerminalDiagnostic as o, resolveCodexMessageToolProvider as p, routeCodexAppServerElicitationRequest as r, handleCodexAppServerApprovalRequest as s, createCodexDynamicToolBridge as t, resolveCodexAppServerExecutionCwd as u, ensureCodexSandboxExecServerEnvironment as v, readBoundedCodexRemoteWorkspaceFile as w, CodexNativeProcessAuthority as x, releaseCodexSandboxExecServerEnvironment as y };
+export { emitDynamicToolStartedDiagnostic as a, ensureCodexSandboxExecServerEnvironment as c, CodexNativeProcessAuthority as d, readCodexRetainedBackgroundCommands as f, emitDynamicToolErrorDiagnostic as i, releaseCodexSandboxExecServerEnvironment as l, CodexNativeToolLifecycleProjector as m, projectCodexExecutableDynamicTools as n, emitDynamicToolTerminalDiagnostic as o, createCodexRemoteWorkspaceFileReader as p, routeCodexAppServerElicitationRequest as r, handleCodexAppServerApprovalRequest as s, createCodexDynamicToolBridge as t, createCodexNativePreToolUseFailureBuffer as u };