### Fixes

- Codex/app-server: cover `/btw` side-question native hooks and app-server command approvals without relying on unsupported turn-scoped hook config. (#82559) Thanks @Kaspre.

- Gateway/Docker: fail closed for non-loopback gateway starts without explicit shared-secret or trusted-proxy auth, and stop the image default command from bypassing config validation. Fixes #82865. (#82866) Thanks @coygeek.

- Agents/followups: route queued followup turns through CLI runtime backends instead of embedded harness lookup, preventing `claude-cli`/`google-gemini-cli` followups from failing before delivery. Fixes #82847. (#82857) Thanks @hclsys.

- CLI/sessions: let `openclaw sessions cleanup --fix-missing` prune malformed rows with unresolvable transcript metadata instead of throwing. Fixes #80970. (#82745) Thanks @IWhatsskill.

},

runSideQuestion: async (params) => {

const { runCodexAppServerSideQuestion } = await import("./src/app-server/side-question.js");

return runCodexAppServerSideQuestion(params, { pluginConfig: options?.pluginConfig });

return runCodexAppServerSideQuestion(params, {

pluginConfig: options?.pluginConfig,

nativeHookRelay: { enabled: true },

});

},

compact: async (params) => {

const { maybeCompactCodexAppServerSession } = await import("./src/app-server/compact.js");

import plugin from "./index.js";

const runCodexAppServerAttemptMock = vi.hoisted(() => vi.fn());

const runCodexAppServerSideQuestionMock = vi.hoisted(() => vi.fn());

vi.mock("./src/app-server/run-attempt.js", () => ({

runCodexAppServerAttempt: runCodexAppServerAttemptMock,

}));

vi.mock("./src/app-server/side-question.js", () => ({

runCodexAppServerSideQuestion: runCodexAppServerSideQuestionMock,

}));

function mockCall(mock: { mock: { calls: unknown[][] } }, index = 0) {

return mock.mock.calls.at(index);

},

);

});

it("enables the native hook relay for public Codex side questions", async () => {

const harness = createCodexAppServerAgentHarness({ pluginConfig: { appServer: {} } });

const runSideQuestion = harness.runSideQuestion;

const result = { text: "ok" };

runCodexAppServerSideQuestionMock.mockResolvedValueOnce(result);

if (!runSideQuestion) {

throw new Error("Expected Codex harness to expose side questions");

}

await expect(runSideQuestion({ question: "btw" } as never)).resolves.toBe(result);

expect(runCodexAppServerSideQuestionMock).toHaveBeenCalledWith(

{ question: "btw" },

{

pluginConfig: { appServer: {} },

nativeHookRelay: { enabled: true },

},

);

});

});