openclaw - 💡(How to fix) Fix Codex app-server silently drops replies when native tool execution is declined

Summary

When a Codex app-server native tool call, such as commandExecution, ends with status: "declined", OpenClaw can terminate the turn without any user-visible reply in external channels.

This is especially visible in Telegram forum topics: the inbound message is received and routed to the agent, but the bot sends no final reply.

Observed behavior

A native Codex tool item with status: "declined" is projected as a blocked tool internally. Diagnostic events can identify the blocked native tool, but the final EmbeddedRunAttemptResult does not include lastToolError.

The upper embedded-run payload builder then sees a terminal attempt shaped like:

{
  aborted: true,
  assistantTexts: [],
  lastToolError: undefined
}

and emits no reply payload.

Result: external channel users see a silent non-response.

Expected behavior

A declined or blocked native tool should surface as a visible terminal error payload, or at least populate lastToolError, so channel users receive a clear failure message instead of no reply.

For example, a declined commandExecution could become:

{
  toolName: "bash",
  error: "codex native tool blocked",
  mutatingAction: true
}

That lets the existing payload layer emit a visible error reply.

Affected area

Likely affected files:

• extensions/codex/src/app-server/event-projector.ts
• src/agents/pi-embedded-runner/run/payloads.ts

The projector already has logic to map status: "declined" to a blocked item status, but the blocked native tool does not become the attempt-level lastToolError.

Reproduction shape

1. Route an external channel message to an agent using the Codex app-server harness.
2. Have the turn attempt a native commandExecution item.
3. The native tool call receives status: "declined".
4. The turn terminates without final assistant text.

Observed result: no external channel reply is sent.

Expected result: a visible error payload is sent.

Local validation

We carried a small local patch in an owned build and validated that the same failure mode now emits a visible payload instead of going silent.

Patch shape:

• record native tool non-success (blocked / failed) in CodexAppServerEventProjector
• include it as EmbeddedRunAttemptResult.lastToolError
• keep using the existing payload builder to surface the visible error

Regression coverage added locally:

• declined native command item -> lastToolError
• aborted Codex turn with no assistant text + native tool error -> visible error payload

Local validation version:

• @glfruit/[email protected]
• local patch commit: 1ad6756bf374 fix: surface Codex native tool blocks