Summary

On OpenClaw 2026.4.26, Codex-native tool execution can get stuck behind the native hook relay even when:

• commands.native = true
• commands.nativeSkills = true
• all internal hooks are enabled
• the gateway has been restarted
• the hook loader reports loaded 5 internal hook handlers
• openclaw hooks list reports Hooks (5/5 ready)

Despite that, Codex-native shell execution is blocked with:

Command blocked by PreToolUse hook: Native hook relay unavailable

The gateway log shows repeated nativeHook.invoke failures:

2026-04-29T01:18:33.503+08:00 [ws] ⇄ res ✗ nativeHook.invoke 0ms errorCode=INVALID_REQUEST errorMessage=native hook relay not found
2026-04-29T01:19:30.581+08:00 [ws] ⇄ res ✗ nativeHook.invoke 0ms errorCode=INVALID_REQUEST errorMessage=native hook relay not found
2026-04-29T01:19:32.734+08:00 [gateway] signal SIGUSR1 received
2026-04-29T01:19:40.744+08:00 [hooks] loaded 5 internal hook handlers
2026-04-29T01:24:25.742+08:00 [ws] ⇄ res ✗ nativeHook.invoke 1ms errorCode=INVALID_REQUEST errorMessage=native hook relay not found
2026-04-29T01:47:40.568+08:00 [ws] ⇄ res ✗ nativeHook.invoke 0ms errorCode=INVALID_REQUEST errorMessage=native hook relay not found
2026-04-29T01:50:20.500+08:00 [ws] ⇄ res ✗ nativeHook.invoke 0ms errorCode=INVALID_REQUEST errorMessage=native hook relay not found

This makes the ordinary hook health signal look green while the Codex native hook relay path is still broken.

Environment

• OpenClaw version: 2026.4.26
• OS: macOS / Darwin 25.3.0, arm64
• Channel: Telegram direct session
• Agent model route: codex/gpt-5.5
• Authentication / harness shape:
  • OpenAI Codex auth is configured through openai-codex OAuth (auth.profiles.openai-codex:default.mode = "oauth")
  • The active agent route uses the bundled codex/gpt-5.5 provider with the Codex app-server harness enabled (plugins.entries.codex.enabled = true)
  • Codex app-server command is codex, transport is stdio, sandbox is danger-full-access, approval policy is never
• Config facts:
  • commands.native = true
  • commands.nativeSkills = true
  • hooks.internal.enabled = true
  • internal hooks enabled: boot-md, bootstrap-extra-files, command-logger, session-memory, self-improvement

Sanitized relevant config excerpt

Sensitive fields and unrelated providers omitted/redacted:

{
  "meta": {
    "lastTouchedVersion": "2026.4.25",
    "lastTouchedAt": "2026-04-27T15:59:52.736Z"
  },
  "auth": {
    "profiles": {
      "openai-codex:default": {
        "provider": "openai-codex",
        "mode": "oauth"
      }
    },
    "order": {
      "openai-codex": [
        "openai-codex:default"
      ]
    }
  },
  "agents": {
    "defaults": {
      "model": {
        "primary": "codex/gpt-5.5"
      },
      "agentRuntime": {
        "id": "auto",
        "fallback": "pi"
      },
      "workspace": "<redacted-workspace-path>"
    },
    "list": [
      {
        "id": "main"
      }
    ]
  },
  "commands": {
    "native": true,
    "nativeSkills": true,
    "config": true,
    "allowFrom": {
      "telegram": ["<redacted-user-id>"]
    },
    "restart": true,
    "ownerDisplay": "raw"
  },
  "hooks": {
    "internal": {
      "enabled": true,
      "entries": {
        "session-memory": { "enabled": true },
        "command-logger": { "enabled": true },
        "boot-md": { "enabled": true },
        "bootstrap-extra-files": { "enabled": true },
        "self-improvement": { "enabled": true }
      }
    }
  },
  "plugins": {
    "entries": {
      "openai": {
        "enabled": true
      },
      "codex": {
        "enabled": true,
        "config": {
          "appServer": {
            "sandbox": "danger-full-access",
            "transport": "stdio",
            "command": "codex",
            "requestTimeoutMs": 60000,
            "approvalPolicy": "never",
            "approvalsReviewer": "user"
          }
        }
      }
    }
  }
}

Relevant upstream context

This looks related to the recently merged native hook relay work:

• PR #71008: "Bridge Codex native hooks into OpenClaw"
• PR #71765: "feat(plugins): add before agent finalize hook"

I searched for the exact error string native hook relay not found / Native hook relay unavailable and did not find an existing matching issue.

Steps to reproduce

The exact trigger is not fully isolated yet, but the failure has reproduced repeatedly in a long-running Telegram main session using the Codex harness:

1. Use OpenClaw 2026.4.26 with Codex native hooks enabled.
2. Keep commands.native=true and commands.nativeSkills=true.
3. Use a Codex-backed main session where shell/native tools are expected to route through the native hook relay.
4. Attempt a shell command from the agent.
5. Observe the command being blocked by PreToolUse with Native hook relay unavailable.
6. Restart the gateway.
7. Confirm the gateway reloads hooks successfully, for example loaded 5 internal hook handlers and Hooks (5/5 ready).
8. Attempt shell/native tool execution again.
9. Observe nativeHook.invoke ... errorMessage=native hook relay not found continuing after the successful hook load.

Expected behavior

If the gateway has restarted successfully and the hook loader reports all internal hook handlers ready, Codex-native hook relay registration should also be healthy, or OpenClaw should expose a separate health/status signal showing that the relay for the active Codex session is missing.

Shell/native tool execution should not remain blocked by a stale or missing relay after a successful gateway restart and hook reload.

Actual behavior

The ordinary hook system reports healthy, but native hook relay invocations continue failing:

nativeHook.invoke ... errorCode=INVALID_REQUEST errorMessage=native hook relay not found

The active agent sees:

Command blocked by PreToolUse hook: Native hook relay unavailable

This blocks shell execution and forces fallback paths that do not depend on the native hook relay.

Impact

• Codex-native shell/tool execution becomes unavailable in the active session.
• Gateway restart may temporarily improve some surfaces, but it does not reliably repair the active relay path.
• openclaw hooks list / internal hook readiness can be misleading because 5/5 ready does not imply the native relay for the active Codex session is registered.

Workarounds tried

• Enabled command-logger so all 5 bundled internal hooks are enabled.
• Restarted gateway via SIGUSR1.
• Verified the gateway log reported loaded 5 internal hook handlers.
• Continued to see nativeHook.invoke ... native hook relay not found after restart.
• Used non-shell fallback paths where possible.

Suggested diagnosis / possible fix area

The issue appears to be separate from ordinary hook handler loading. It looks more like the per-session/per-run native hook relay registration is stale, missing, expired, or not rebound correctly after gateway restart / thread resume / session recovery.

It would help if OpenClaw exposed or repaired this explicitly, for example:

• include active native hook relay registrations in diagnostics / hooks list / doctor output;
• on Codex thread resume, verify that the expected relay exists before enabling Codex native hook config;
• if the relay is missing, re-register it or fail open/defer to Codex's normal permission path instead of blocking every native tool call;
• distinguish "hook handlers loaded" from "active Codex native relay registered" in health output.