fix(codex): auto-approve plugin read tools (#80513)

* fix(codex): auto-approve plugin read tools

* docs: add codex plugin approval changelog

CHANGELOG.md

@@ -49,6 +49,7 @@ Docs: https://docs.openclaw.ai
 
 - Yuanbao: bump `openclaw-plugin-yuanbao` to 2.13.1 to support `sourceReplyDeliveryMode: "automatic"` for group chat. (#79814) Thanks @loongfay.
 - Memory: keep `memory_search` result `corpus` labels aligned with the hit source, so session transcript hits surface as `sessions` and memory-file hits stay `memory`. Fixes #72885. (#71898, #72886) Thanks @rubencu.
+- Codex app-server: default native plugin app tool approvals to automatic so non-destructive read tools run when destructive actions are disabled.
 - Google/Gemini: normalize retired nested Gemini 3 Pro Preview ids while converting manifest catalog rows into emitted provider config, so `google/gemini-3.1-pro-preview` is used for testing instead of `google/gemini-3-pro-preview`.
 - Native apps: advertise the Gateway protocol compatibility range so chat and node sessions can connect to v3 gateways after additive v4 client updates.
 - Gateway/agents: keep stale `sessions_send` ACP manager and `web_fetch` runtime chunks importable after package updates, preventing live gateways from breaking before restart. Fixes #78804. Thanks @Gomesy72.

docs/plugins/codex-native-plugins.md

@@ -137,8 +137,9 @@ are emitted with `open_world_enabled: true`; OpenClaw does not expose a separate
 plugin open-world policy knob and does not maintain per-plugin destructive
 tool-name deny lists.
 
-Tool approval mode is prompted by default for plugin apps because OpenClaw does
-not have an interactive app-elicitation UI in this same-thread path.
+Tool approval mode is automatic by default for plugin apps so non-destructive
+read tools can run without a same-thread approval UI. Destructive tools remain
+controlled by each app's `destructive_enabled` policy.
 
 ## Destructive action policy
 

extensions/codex/src/app-server/plugin-thread-config.test.ts

@@ -64,7 +64,7 @@ describe("Codex plugin thread config", () => {
           enabled: true,
           destructive_enabled: true,
           open_world_enabled: true,
-          default_tools_approval_mode: "prompt",
+          default_tools_approval_mode: "auto",
         },
       },
     });
@@ -253,7 +253,7 @@ describe("Codex plugin thread config", () => {
           enabled: true,
           destructive_enabled: false,
           open_world_enabled: true,
-          default_tools_approval_mode: "prompt",
+          default_tools_approval_mode: "auto",
         },
       },
     });
@@ -577,7 +577,7 @@ describe("Codex plugin thread config", () => {
       enabled: true,
       destructive_enabled: false,
       open_world_enabled: true,
-      default_tools_approval_mode: "prompt",
+      default_tools_approval_mode: "auto",
     });
     expect(apps?.["github-app"]).not.toHaveProperty("tools");
   });

extensions/codex/src/app-server/plugin-thread-config.ts

@@ -196,7 +196,7 @@ export async function buildCodexPluginThreadConfig(
         enabled: true,
         destructive_enabled: record.policy.allowDestructiveActions,
         open_world_enabled: true,
-        default_tools_approval_mode: "prompt",
+        default_tools_approval_mode: "auto",
       };
       apps[app.id] = appConfig;
       policyApps[app.id] = {

extensions/codex/src/app-server/run-attempt.test.ts

@@ -403,7 +403,7 @@ function createPluginAppConfigPatch() {
         enabled: true,
         destructive_enabled: true,
         open_world_enabled: true,
-        default_tools_approval_mode: "prompt",
+        default_tools_approval_mode: "auto",
       },
     },
   };
@@ -435,7 +435,7 @@ function createTwoPluginAppConfigPatch() {
         enabled: true,
         destructive_enabled: true,
         open_world_enabled: true,
-        default_tools_approval_mode: "prompt",
+        default_tools_approval_mode: "auto",
       },
     },
   };
@@ -469,7 +469,7 @@ function createTwoCalendarAppConfigPatch() {
         enabled: true,
         destructive_enabled: true,
         open_world_enabled: true,
-        default_tools_approval_mode: "prompt",
+        default_tools_approval_mode: "auto",
       },
     },
   };