return appServer.start.transport === "stdio" ? resolveCodexAppServerHomeDir(agentDir) : undefined;

}

function restrictCodexAppServerSandboxForOpenClawSandbox(

appServer: CodexAppServerRuntimeOptions,

sandbox: Awaited<ReturnType<typeof resolveSandboxContext>>,

): CodexAppServerRuntimeOptions {

if (!sandbox?.enabled || appServer.sandbox !== "danger-full-access") {

return appServer;

}

return {

...appServer,

sandbox: "workspace-write",

};

}

export async function runCodexAppServerAttempt(

params: EmbeddedRunAttemptParams,

options: {

const attemptStartedAt = Date.now();

const attemptClientFactory = resolveCodexAppServerClientFactory();

const pluginConfig = readCodexPluginConfig(options.pluginConfig);

const appServer = resolveCodexAppServerRuntimeOptions({ pluginConfig });

let pluginAppServer: CodexAppServerRuntimeOptions = appServer;

const nativeHookRelayEvents = resolveCodexNativeHookRelayEvents({

configuredEvents: options.nativeHookRelay?.events,

appServer,

});

const configuredAppServer = resolveCodexAppServerRuntimeOptions({ pluginConfig });

const resolvedWorkspace = resolveUserPath(params.workspaceDir);

await fs.mkdir(resolvedWorkspace, { recursive: true });

const sandboxSessionKey =

: sandbox.workspaceDir

: resolvedWorkspace;

await fs.mkdir(effectiveWorkspace, { recursive: true });

const appServer = restrictCodexAppServerSandboxForOpenClawSandbox(configuredAppServer, sandbox);

let pluginAppServer: CodexAppServerRuntimeOptions = appServer;

const nativeHookRelayEvents = resolveCodexNativeHookRelayEvents({

configuredEvents: options.nativeHookRelay?.events,

appServer,

});

const runAbortController = new AbortController();

const abortFromUpstream = () => {

handleDynamicToolCallWithTimeout,

resolveDynamicToolCallTimeoutMs,

resolveCodexPluginAppCacheEndpoint,

restrictCodexAppServerSandboxForOpenClawSandbox,

resolveOpenClawCodingToolsSessionKeys,

shouldForceMessageTool,

setOpenClawCodingToolsFactoryForTests(factory: OpenClawCodingToolsFactory): void {