[Enhancement] L2 Output Scanner: hook llm_output for chain-of-thought / reasoning-trace coverage

[Kaspre]

Summary

Enhancement request: openclaw-shield's L2 Output Scanner currently hooks tool_result_persist, which catches secrets/PII in finalized tool-result transcript content. That's the most common attack surface but it misses the LLM's intermediate reasoning trace — model planning, chain-of-thought, abandoned tool plans — which doesn't materialize as a tool call. A model can emit a leaked secret in its reasoning step ("…the AWS key in my context is AKIAXXX…I should not use this…") without ever triggering a tool call, and L2 doesn't get a chance to redact.

The cleaner intercept point would be llm_output: the raw response codex receives from OpenAI, before tool-dispatch. Dependency: OpenClaw must first bridge llm_output (and probably llm_input for symmetric input-side scanning) from codex's native-hook-relay — currently NOT in NATIVE_HOOK_RELAY_EVENTS. The bridge supports only 5 events today: pre_tool_use, post_tool_use, permission_request, before_agent_finalize, before_message_write.

Current state — works correctly within available surface

L2 Output Scanner using tool_result_persist is doing its job within what OpenClaw currently exposes. The proposal here is NOT to replace tool_result_persist (it catches the common attack surface) but to ADD llm_output coverage when available, as defense-in-depth.

Proposed enhancement (depends on upstream OC bridge work)

1. If/when OC bridges llm_output to plugins (would be a new feature request at openclaw/openclaw, narrow ask: "Add llm_input and llm_output to CODEX_NATIVE_HOOK_RELAY_EVENTS"), update L2 Output Scanner to ALSO hook llm_output for codex-routed traffic. Keep tool_result_persist as a fallback for PI-harness or where llm_output isn't bridged.
2. Defense-in-depth: keep both hooks active (one fires before the other; redact at both points). No harm in double-scanning, and the model's intermediate reasoning is where chain-of-thought leaks live.

Why this matters for codex-routed agents specifically

Codex's app-server runs significant inference inside its own surface — model reasoning, tool plan generation, structured-output formatting — and only surfaces a small slice of that to OC (tool calls, final agent reply). The unbridged events are documented in the OC hook-coverage findings doc (~10 codex-emitted plugin hooks are unbridged today). llm_output is the most security-relevant of those gaps.

Implementation pointers for the upstream OC change

A ~30-line patch to extensions/codex/src/app-server/native-hook-relay.ts:

• Add llm_input and llm_output to CODEX_NATIVE_HOOK_RELAY_EVENTS
• Add corresponding entries to CODEX_HOOK_EVENT_BY_NATIVE_EVENT (codex-cli's hook event vocabulary)
• Verify codex app-server actually fires those events — codex-cli 0.130.0 shows hooks stable true, so the bridge wiring is likely the only missing piece.

If openclaw-shield maintainers want to push the upstream change (Knostic likely has more direct channels into the OC project than downstream users), that'd be the most direct path. Happy to provide reproduction help.

Versions tested

• OpenClaw 2026.5.12 stable (commit f066dd2)
• @openclaw/codex@2026.5.12 (bundled codex plugin)
• codex-cli 0.130.0 (linux-x64)
• @knostic/openclaw-shield@0.1.0

Related upstream issues

• openclaw/openclaw#48503 (open) — "[Feature]: Enrich before_tool_call event with action classification and input provenance" — adjacent but different (payload enrichment, not new event coverage).
• The narrow OC enhancement to bridge llm_input/llm_output from codex would be a new issue, not yet filed.

Replaces the enhancement-half of previously-filed combined issue #10 (split per maintainer convention into separate bug + enhancement).