- Agents/code mode: return structured timeout and runtime-unavailable error codes for known worker failures. Fixes #83389. (#83444) Thanks @Kaspre.

- QA-Lab: isolate multi-scenario suite workers when scenarios need startup config patches, preventing message-routing config from leaking into unrelated scenarios.

- QA-Lab: make the commitments heartbeat-target-none scenario request an immediate heartbeat instead of waiting for the next scheduled heartbeat.

- Codex/Plugin SDK: deliver Codex-native subagent completions through a generic harness task runtime so harness-backed plugins can mirror durable task lifecycle and completion delivery without Codex-specific SDK imports. (#83445) Thanks @bryanpearson.

- Gateway CLI: surface local post-challenge connect assembly failures immediately instead of waiting for the wrapper timeout. Fixes #68944. (#85253) Thanks @samzong.

- Messages: strip unsupported web-search citation control markers from outbound replies before they reach WebChat or external channels. Fixes #85193. (#85204) Thanks @neeravmakwana.

- Agents/exec: treat denied exec approvals as terminal instead of feeding them back into agent follow-up work, and recognize Chinese stop phrases in abort handling. Fixes #69386. (#85194) Thanks @samzong.

### Reserved bundled plugin helper subpaths

These subpaths are plugin-owned compatibility surfaces reserved for their owning

bundled plugin, not general SDK APIs: `plugin-sdk/codex-mcp-projection` and

These subpaths are plugin-owned compatibility surfaces for their owning bundled

plugin, not general SDK APIs: `plugin-sdk/codex-mcp-projection` and

`plugin-sdk/codex-native-task-runtime`. Cross-owner extension imports are blocked

by package contract guardrails.

| `plugin-sdk/runtime` | Broad runtime/logging/backup/plugin-install helpers |

| `plugin-sdk/runtime-env` | Narrow runtime env, logger, timeout, retry, and backoff helpers |

| `plugin-sdk/browser-config` | Supported browser config facade for normalized profile/defaults, CDP URL parsing, and browser-control auth helpers |

| `plugin-sdk/agent-harness-task-runtime` | Generic task lifecycle and completion delivery helpers for harness-backed agents using a host-issued task scope |

| `plugin-sdk/codex-mcp-projection` | Reserved bundled Codex helper for projecting user MCP server config into Codex thread config; not for third-party plugins |

| `plugin-sdk/codex-native-task-runtime` | Reserved bundled Codex helper for native task mirror/runtime wiring; not for third-party plugins |

| `plugin-sdk/codex-native-task-runtime` | Private bundled Codex helper for native task mirror/runtime wiring; not for third-party plugins |

| `plugin-sdk/channel-runtime-context` | Generic channel runtime-context registration and lookup helpers |

| `plugin-sdk/matrix` | Deprecated Matrix compatibility facade for older third-party channel packages; new plugins should import `plugin-sdk/run-command` directly |

| `plugin-sdk/mattermost` | Deprecated Mattermost compatibility facade for older third-party channel packages; new plugins should import generic SDK subpaths directly |

type CodexAppServerEventProjectorOptions,

type CodexAppServerToolTelemetry,

} from "./event-projector.js";

import { CodexNativeSubagentTaskMirror } from "./native-subagent-task-mirror.js";

import { rememberCodexRateLimits, resetCodexRateLimitCacheForTests } from "./rate-limit-cache.js";

import { createCodexTestModel } from "./test-support.js";

expect(result.assistantTexts).toStrictEqual([]);

});

it("mirrors native subagent notifications before current-turn filtering", async () => {

const projector = await createProjector({

...(await createParams()),

sessionKey: "agent:main:main",

} as EmbeddedRunAttemptParams);

const mirrorSpy = vi.spyOn(CodexNativeSubagentTaskMirror.prototype, "handleNotification");

const notification = {

method: "item/completed",

params: {

threadId: THREAD_ID,

turnId: "child-turn",

item: {

type: "collabAgentToolCall",

tool: "spawnAgent",

senderThreadId: THREAD_ID,

receiverThreadIds: ["child-thread"],

agentsStates: {

"child-thread": { status: "completed", message: "done" },

},

},

},

} as ProjectorNotification;

await projector.handleNotification(notification);

expect(mirrorSpy).toHaveBeenCalledWith(notification);

const result = projector.buildResult(buildEmptyToolTelemetry());

expect(result.assistantTexts).toEqual([]);

});

it("ignores notifications that omit top-level thread and turn ids", async () => {

const projector = await createProjector();

} from "openclaw/plugin-sdk/agent-harness-runtime";

import { emitTrustedDiagnosticEvent } from "openclaw/plugin-sdk/diagnostic-runtime";

import { resolveCodexLocalRuntimeAttribution } from "./local-runtime-attribution.js";

import { CodexNativeSubagentTaskMirror } from "./native-subagent-task-mirror.js";

import {

readCodexNotificationThreadId,

readCodexNotificationTurnId,

private guardianReviewCount = 0;

private completedCompactionCount = 0;

private latestRateLimits: JsonValue | undefined;

private readonly nativeSubagentTaskMirror: CodexNativeSubagentTaskMirror;

constructor(

private readonly params: EmbeddedRunAttemptParams,

private readonly threadId: string,

private readonly turnId: string,

private readonly options: CodexAppServerEventProjectorOptions = {},

) {

this.nativeSubagentTaskMirror = new CodexNativeSubagentTaskMirror({

parentThreadId: threadId,

requesterSessionKey: params.sessionKey,

agentId: params.agentId,

});

}

) {}

async handleNotification(notification: CodexServerNotification): Promise<void> {

const params = isJsonObject(notification.params) ? notification.params : undefined;

if (!params) {

return;

}

try {

this.nativeSubagentTaskMirror.handleNotification(notification);

} catch (error) {

embeddedAgentLog.warn("Failed to mirror Codex native subagent lifecycle event", {

method: notification.method,

error: formatErrorMessage(error),

});

}

if (notification.method === "account/rateLimits/updated") {

this.latestRateLimits = params;

rememberCodexRateLimits(params);