PR #75308: Prefer Codex native workspace tools

• Repository: openclaw/openclaw
• Author: steipete
• State: open | merged: False
• Link: https://github.com/openclaw/openclaw/pull/75308

Description (problem / solution / changelog)

This came out of the stuck Codex app-server lane investigation in https://github.com/openclaw/openclaw/issues/75205. The specific incident still deserves its own lifecycle analysis, but one thing was clearly wrong in our default shape: Codex mode was giving the model two different ways to operate on the same local workspace.

Codex already has native file, patch, process, and planning tools. OpenClaw was also injecting its PI-era dynamic tools for read, write, edit, apply_patch, exec, process, and update_plan into the Codex app-server turn. That split ownership makes the runtime boundary harder to reason about and creates room for duplicated command or file state when Codex should be the single owner of those local operations.

This PR adds a native-first dynamic-tool profile for the Codex plugin and makes it the default. In native-first mode, OpenClaw keeps the integration tools that are actually OpenClaw-owned: messaging, sessions, cron, media, gateway, nodes, browser, and web_search. It stops advertising the redundant workspace, process, patch, and planning tools to Codex app-server, so Codex owns that lifecycle end to end.

The old shape remains available for deployments that intentionally need it. codexDynamicToolsProfile: "openclaw-compat" restores the full OpenClaw dynamic tool catalog, and codexDynamicToolsExclude gives us an additive way to remove more OpenClaw dynamic tools from Codex turns without another one-off filter.

I also tightened the Codex developer instruction so it points the model at OpenClaw integration tools rather than vague host actions, and added a regression that checks the actual thread/start dynamic tool catalog sent to Codex.

What I checked before handing this over:

• Reviewed the OpenClaw Codex app-server path and the local Codex harness source so the split is based on the actual native tool boundary, not a guess.

• Ran Pash's dev gateway from this branch with the Codex runtime forced on the native-first profile, then confirmed a live Codex turn only received OpenClaw integration tools. The OpenClaw dynamic read, write, edit, apply_patch, exec, and process tools were absent; update_plan was absent too.

• Temporarily set codexDynamicToolsExclude to ["web_fetch"], restarted the gateway, and confirmed a new live turn omitted web_fetch; then restored the config to [].

• Ran a live native workspace smoke where the agent created, patched, read, and shell-verified a file through Codex-native apply_patch and exec_command while the OpenClaw file/process dynamic tools were still excluded.

• Confirmed /verbose full is handled on the gateway chat path, then captured the live gateway WebSocket event stream for a native Codex turn. The stream showed native command items, native patch items, Codex hook events, lifecycle start/end, and a successful agent.wait completion.

• Re-ran the PR parity gate after its first Opus mock lane timeout. The rerun passed the OpenAI candidate lane, the Opus 4.6 baseline lane, and the generated parity report.

• Addressed the fresh ClawSweeper changelog placement review by moving the PR-linked changelog entry to the ### Changes section tail, then ran git diff --check, git diff --check origin/main...HEAD -- CHANGELOG.md, pnpm check:changelog-attributions, and the merge-helper validate_changelog_entry_for_pr 75308 pashpashpash check.

• Final PR head 0d72cd5ca4ae5292bcf41b3f376d7421dc94fba6 has no failed or pending GitHub checks, including the OpenAI / Opus 4.6 parity gate; ClawSweeper's durable review is updated to needs-human with no remaining repair blocker.

Changed files

• CHANGELOG.md (modified, +1/-0)
• docs/.generated/config-baseline.sha256 (modified, +2/-2)
• docs/plugins/codex-harness.md (modified, +13/-0)
• extensions/codex/openclaw.plugin.json (modified, +20/-0)
• extensions/codex/src/app-server/config.test.ts (modified, +12/-0)
• extensions/codex/src/app-server/config.ts (modified, +6/-0)
• extensions/codex/src/app-server/run-attempt.test.ts (modified, +74/-0)
• extensions/codex/src/app-server/run-attempt.ts (modified, +42/-3)
• extensions/codex/src/app-server/thread-lifecycle.ts (modified, +1/-1)
• src/agents/pi-tools.model-provider-collision.test.ts (modified, +21/-0)
• src/agents/pi-tools.ts (modified, +5/-0)