feat(plugins): add before agent finalize hook (#71765)

docs/tools/acp-agents.md

@@ -65,11 +65,12 @@ dynamic tools still execute through OpenClaw, while Codex-native tools such as
 shell/apply-patch execute inside Codex. For Codex-native tool events, OpenClaw
 injects a per-turn native hook relay so plugin hooks can block
 `before_tool_call`, observe `after_tool_call`, and route Codex
-`PermissionRequest` events through OpenClaw approvals. The v1 relay is
-deliberately conservative: it does not mutate Codex-native tool arguments,
-rewrite Codex thread records, or gate final answers/Stop hooks. Use explicit
-ACP only when you want the ACP runtime/session model. The embedded Codex support
-boundary is documented in the
+`PermissionRequest` events through OpenClaw approvals. Codex `Stop` hooks are
+relayed to OpenClaw `before_agent_finalize`, where plugins can request one more
+model pass before Codex finalizes its answer. The relay remains deliberately
+conservative: it does not mutate Codex-native tool arguments or rewrite Codex
+thread records. Use explicit ACP only when you want the ACP runtime/session
+model. The embedded Codex support boundary is documented in the
 [Codex harness v1 support contract](/plugins/codex-harness#v1-support-contract).
 
 Natural-language triggers that should route to the ACP runtime:

docs/tools/plugin.md

@@ -223,7 +223,7 @@ do not run in live chat traffic, check these first:
   `openclaw gateway run` process.
 - Use `openclaw plugins inspect <id> --json` to confirm hook registrations and
   diagnostics. Non-bundled conversation hooks such as `llm_input`,
-  `llm_output`, and `agent_end` need
+  `llm_output`, `before_agent_finalize`, and `agent_end` need
   `plugins.entries.<id>.hooks.allowConversationAccess=true`.
 - For model switching, prefer `before_model_resolve`. It runs before model
   resolution for agent turns; `llm_output` only runs after a model attempt