`approvalPolicy: "never"`, `approvalsReviewer: "user"`, and

`sandbox: "danger-full-access"`. This is the trusted local operator posture used

for autonomous heartbeats: Codex can use shell and network tools without

stopping on native approval prompts that nobody is around to answer.

stopping on native approval prompts that nobody is around to answer. On local

stdio Codex app-server installs where Codex's system requirements file

disallows the implicit YOLO approval, reviewer, or sandbox value, OpenClaw

treats the implicit default as guardian instead and selects allowed guardian

permissions so it does not send an override that Codex app-server will reject.

Hostname-matching `[[remote_sandbox_config]]` entries in the same requirements

file are honored for the sandbox default decision.

To opt in to Codex guardian-reviewed approvals, set `appServer.mode:

"guardian"`:

Supported `appServer` fields:

| Field | Default | Meaning |

| ----------------------------- | ---------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |

| `transport` | `"stdio"` | `"stdio"` spawns Codex; `"websocket"` connects to `url`. |

| `command` | managed Codex binary | Executable for stdio transport. Leave unset to use the managed binary; set it only for an explicit override. |

| `args` | `["app-server", "--listen", "stdio://"]` | Arguments for stdio transport. |

| `url` | unset | WebSocket app-server URL. |

| `authToken` | unset | Bearer token for WebSocket transport. |

| `headers` | `{}` | Extra WebSocket headers. |

| `clearEnv` | `[]` | Extra environment variable names removed from the spawned stdio app-server process after OpenClaw builds its inherited environment. `CODEX_HOME` and `HOME` are reserved for OpenClaw's per-agent Codex isolation on local launches. |

| `requestTimeoutMs` | `60000` | Timeout for app-server control-plane calls. |

| `turnCompletionIdleTimeoutMs` | `60000` | Quiet window after a turn-scoped Codex app-server request while OpenClaw waits for `turn/completed`. Raise this for slow post-tool or status-only synthesis phases. |

| `mode` | `"yolo"` | Preset for YOLO or guardian-reviewed execution. |

| `approvalPolicy` | `"never"` | Native Codex approval policy sent to thread start/resume/turn. |

| `sandbox` | `"danger-full-access"` | Native Codex sandbox mode sent to thread start/resume. |

| `approvalsReviewer` | `"user"` | Use `"auto_review"` to let Codex review native approval prompts. `guardian_subagent` remains a legacy alias. |

| `serviceTier` | unset | Optional Codex app-server service tier. `"priority"` enables fast-mode routing, `"flex"` requests flex processing, `null` clears the override, and legacy `"fast"` is accepted as `"priority"`. |

| Field | Default | Meaning |

| ----------------------------- | ------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |

| `transport` | `"stdio"` | `"stdio"` spawns Codex; `"websocket"` connects to `url`. |

| `command` | managed Codex binary | Executable for stdio transport. Leave unset to use the managed binary; set it only for an explicit override. |

| `args` | `["app-server", "--listen", "stdio://"]` | Arguments for stdio transport. |

| `url` | unset | WebSocket app-server URL. |

| `authToken` | unset | Bearer token for WebSocket transport. |

| `headers` | `{}` | Extra WebSocket headers. |

| `clearEnv` | `[]` | Extra environment variable names removed from the spawned stdio app-server process after OpenClaw builds its inherited environment. `CODEX_HOME` and `HOME` are reserved for OpenClaw's per-agent Codex isolation on local launches. |

| `requestTimeoutMs` | `60000` | Timeout for app-server control-plane calls. |

| `turnCompletionIdleTimeoutMs` | `60000` | Quiet window after a turn-scoped Codex app-server request while OpenClaw waits for `turn/completed`. Raise this for slow post-tool or status-only synthesis phases. |

| `mode` | `"yolo"` unless local Codex requirements disallow YOLO | Preset for YOLO or guardian-reviewed execution. Local stdio requirements that omit `danger-full-access`, `never` approval, or the `user` reviewer make the implicit default guardian. |

| `approvalPolicy` | `"never"` or an allowed guardian approval policy | Native Codex approval policy sent to thread start/resume/turn. Guardian defaults prefer `"on-request"` when allowed. |

| `sandbox` | `"danger-full-access"` or an allowed guardian sandbox | Native Codex sandbox mode sent to thread start/resume. Guardian defaults prefer `"workspace-write"` when allowed, otherwise `"read-only"`. |

| `approvalsReviewer` | `"user"` or an allowed guardian reviewer | Use `"auto_review"` to let Codex review native approval prompts when allowed, otherwise `guardian_subagent` or `user`. `guardian_subagent` remains a legacy alias. |

| `serviceTier` | unset | Optional Codex app-server service tier. `"priority"` enables fast-mode routing, `"flex"` requests flex processing, `null` clears the override, and legacy `"fast"` is accepted as `"priority"`. |

OpenClaw-owned dynamic tool calls are bounded independently from

`appServer.requestTimeoutMs`: each Codex `item/tool/call` request must receive