Summary

• Supersedes [plugin sdk] Derive tool target paths for hooks #75605 with the derived apply_patch target-path seam rebased onto current main.
• Adds host-owned apply_patch path derivation for before_tool_call and trusted policy hooks, including sandbox bridge resolution and frozen derived path arrays.
• Clears/re-derives derived paths when trusted policies rewrite params, guards parser lookup against prototype keys, and documents the additive SDK hook field.

Real behavior proof

• Behavior addressed: plugin hooks and trusted tool policies had to re-parse apply_patch envelopes themselves to know target paths, making policy hooks inconsistent with host path resolution and sandbox path bridging.
• Real environment tested: local OpenClaw checkout after rebase onto current main, with plugin SDK API baseline regenerated and full build completed.
• Exact steps or command run after this patch: ran the real before_tool_call E2E path and native Codex hook relay path with apply_patch inputs using pnpm test src/agents/apply-patch-paths.test.ts src/plugins/host-tool-param-parsers.test.ts src/agents/pi-tools.before-tool-call.e2e.test.ts src/agents/harness/native-hook-relay.test.ts src/plugins/contracts/host-hooks.contract.test.ts, then pnpm build.
• Evidence after fix: terminal output from the patched run:

[test] passed 4 Vitest shards in 12.91s
OK docs/.generated/plugin-sdk-api-baseline.sha256
Found 0 warnings and 0 errors.
[build-all] check-plugin-sdk-exports
OK: All 4 required plugin-sdk exports verified.

• Observed result after fix: apply_patch target paths are present on before_tool_call events, trusted policy events receive re-derived paths after param rewrites, native Codex PreToolUse uses the Codex cwd for derived apply_patch paths, and the SDK API baseline/build remain consistent.
• What was not tested: no live third-party plugin install; covered through host hook contract fixtures and real OpenClaw hook execution paths.

Verification

• pnpm test src/agents/apply-patch-paths.test.ts src/plugins/host-tool-param-parsers.test.ts src/agents/pi-tools.before-tool-call.e2e.test.ts src/agents/harness/native-hook-relay.test.ts src/plugins/contracts/host-hooks.contract.test.ts
• pnpm check:test-types
• pnpm lint:core
• pnpm plugin-sdk:api:gen
• pnpm plugin-sdk:api:check
• pnpm run check:no-conflict-markers
• pnpm exec oxfmt --check --threads=1 CHANGELOG.md docs/plugins/hooks.md docs/.generated/plugin-sdk-api-baseline.sha256 src/agents/apply-patch-paths.test.ts src/agents/apply-patch-paths.ts src/agents/harness/native-hook-relay.test.ts src/agents/harness/native-hook-relay.ts src/agents/pi-tools.before-tool-call.e2e.test.ts src/agents/pi-tools.before-tool-call.ts src/agents/pi-tools.ts src/auto-reply/reply/dispatch-from-config.test.ts src/plugins/contracts/host-hooks.contract.test.ts src/plugins/hook-types.ts src/plugins/host-tool-param-parsers.test.ts src/plugins/host-tool-param-parsers.ts src/plugins/trusted-tool-policy.ts
• git diff --check origin/main...HEAD && git diff --check
• pnpm build

Supersedes #75605. Replaces part of #74483 / #73384.