feat: add permissioned Codex session access

docs/ARCHITECTURE.md

@@ -64,7 +64,7 @@ These are the canonical homes. Do not reintroduce private copies elsewhere.
 | Exact Gateway wizard terminal-restart compatibility and bounded retry policy | `GatewayWizardRestartRecoveryPolicy` | authoritative |
 | Managed-local automatic repair eligibility and orchestration | `ManagedLocalGatewayAutoRepairMonitor` + `ManagedLocalGatewayRepairCoordinator` | authoritative |
 | Capability UI metadata | `NodeCapabilityUiCatalog` (planned) | planned |
-| Capability registration/gating | `NodeCapabilityRegistrationPolicy` (planned) | planned |
+| Capability registration/gating | `NodeCapabilityRegistry` | authoritative |
 | Local MCP exposure policy | `McpCapabilityPolicy` (planned) | planned |
 | Gateway connect envelope | `ConnectEnvelopeBuilder` (planned) | planned |
 | Gateway request tracking | `PendingRequestRegistry` (planned) | planned |
@@ -146,6 +146,7 @@ leading and trailing pipe. Columns, in order:
 | functional-chat-default-mount | closed | src/OpenClaw.Tray.WinUI/Chat/FunctionalChatHostExtensions.cs | mounting the FunctionalUI chat tree as the default ChatPage or ChatWindow surface | ReactorChatHostExtensions and OpenClawReactorChatRoot | legacy FunctionalUI chat files may remain for focused compatibility coverage only | ChatPage and ChatWindow mount the Reactor root directly into their existing ChatHost Borders; no FunctionalUI component mounts or nests Reactor on the default path | review-only: user explicitly deferred new tests for this migration; required build and existing shared/tray suites still run | review-only | when legacy FunctionalUI chat surfaces are removed |
 | settings-store | authoritative | src/OpenClaw.Tray.WinUI/Pages/SettingsPage.xaml.cs | hand-rolled save/echo suppression flags for two-way settings binding | ISettingsStore | PermissionsPage and other surfaces may read SettingsManager directly until migrated | a save originating from Update does not echo Changed to the caller and external saves are republished on the UI thread | SettingsStoreTests.Update_DoesNotEchoChangedToSelf | behavioral | when all settings surfaces read and write through ISettingsStore |
 | settings-page-vm | authoritative | src/OpenClaw.Tray.WinUI/Pages/SettingsPage.xaml.cs | settings load, persist, echo-guard, and auto-save wiring | SettingsPageViewModel | code-behind keeps gateway-uninstall, gateway-info and uptime timer, saved-indicator visual, and app-info population | each settings control persists its field through the store preserving mutate-save-notify order and does not re-persist on external change | SettingsPageViewModelTests.ExternalChange_ReloadsWithoutRePersisting | behavioral | when the Settings page holds no settings persistence logic in code-behind |
+| node-capability-registry | authoritative | src/OpenClaw.Tray.WinUI/Services/NodeService.cs | mutable capability-list storage, Codex access-mode and executable-availability advertisement policy, and shared MCP/Gateway snapshot publication | NodeCapabilityRegistry | NodeService constructs capabilities, wires UI handlers, applies device permissions, and hosts MCP lifecycle | Off advertises no Codex commands; available ReadOnly and ReadAndSteer advertise exactly the two read commands; unavailable Codex advertises none; MCP and Gateway consume one immutable shared snapshot | NodeCapabilityRegistryTests.NodeService_DoesNotOwnCapabilityRegistryStorageOrRegistration | source-shape | when NodeService no longer constructs or wires any node capability |
 | exec-reusable-binding | authoritative | src/OpenClaw.Shared/ExecApprovals/ExecCommandResolution.cs | deriving durable allowlist identities and Allow Always patterns from multi-segment shell resolution | ExecReusableCommandBinder | ExecCommandResolver.Resolve stays the singular resolution used by the state machine and prompt display | at most one identity may be durably authorized per request and it is a fully qualified existing `.exe` image whose arguments are pinned by the generated rule | ExecReusableCommandBinderTests.MultiElementCarrierTail_Binds | behavioral | - |
 | exec-multi-segment-allowlist-closed | closed | src/OpenClaw.Shared/ExecApprovals/ExecCommandResolution.cs | ResolveForAllowlist and ResolveAllowAlwaysPatterns feeding allowlist matching or Allow Always patterns | ExecReusableCommandBinder | the two methods remain compiled with their historical tests until removed but have no production callers | the approval pipeline derives AllowlistResolutions and AllowAlwaysPatterns only from ExecReusableCommandBinder.TryBind | ExecApprovalV2NormalizationPipelineOwnershipTests.Normalizer_DerivesDurableIdentity_OnlyFromReusableBinder | source-shape | when ResolveForAllowlist and ResolveAllowAlwaysPatterns are deleted |
 | canonical-cmd-carrier | authoritative | src/OpenClaw.Shared/Mxc/MxcConfigBuilder.cs | recognizing the cmd.exe /d /s /c carrier and extracting its command payload | CanonicalCmdCarrier | MxcConfigBuilder keeps cmd command-mode switch detection and command-line construction | the approvals binder and the MXC command-line builder agree on which argv shapes are the canonical cmd carrier and what payload they carry | CanonicalCmdCarrierTests.BinderAndMxcBuilder_AgreeOnCarrierRecognition | behavioral | - |

docs/WINDOWS_NODE_TESTING.md

@@ -32,6 +32,18 @@ Short version: run required tests, collect a closeout proof pass with `.\run-app
 
 Every new Windows node call must be exposed through local MCP and `winnode`: register the capability, update `McpToolBridge.CommandDescriptions`, update `src/OpenClaw.WinNode.Cli/skill.md`, add focused tests, and prove discovery/invocation with `winnode` or raw MCP JSON-RPC.
 
+### Codex App Server catalog permission modes
+
+Codex session access is opt-in and may be changed only through the interactive tray Settings UI. Local MCP and gateway configuration commands cannot change it.
+
+| Setting | Advertised commands | Stage 0 behavior |
+|---------|---------------------|------------------|
+| Off | None | Codex catalog access is disabled. |
+| Read only | `codex.appServer.threads.list.v1`, `codex.appServer.threads.history.list.v1`, `codex.appServer.thread.turns.list.v1` | Lists bounded non-archived interactive thread metadata, separately lists explicitly selected archived/history metadata, and reads bounded transcript pages after a fresh eligibility check. |
+| Read and steer | The same three read commands | Owner control is unavailable in Stage 0. No resume, steer, interrupt, or other write command is advertised. |
+
+All three commands reject unknown fields and enforce bounded limits, cursors, text, pagination, and aggregate response bytes. `codex.appServer.threads.list.v1` always sends `archived:false`; `codex.appServer.threads.history.list.v1` requires an explicit `archived` boolean and returns projected metadata only. Transcript bodies are returned only as successful command payloads. Audit and error output uses stable command/outcome summaries and must not contain transcript bodies or private App Server failure details.
+
 ### 1. Settings Toggle
 - Verify the toggle appears in Settings under "ADVANCED"
 - Verify it saves and persists across app restarts

docs/superpowers/plans/2026-08-11-codex-catalog-permission-hardening.md

@@ -0,0 +1,48 @@
+# Codex Catalog Permission Hardening Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Close the three Task 8 Important Codex catalog permission findings without widening the catalog surface.
+
+**Architecture:** Registry-owned cancellation revokes in-flight capabilities; raw App Server surfaces are internal; Codex permission persistence is transactional from the ViewModel's perspective.
+
+**Tech Stack:** .NET 10, C#, xUnit, existing Node capability/MCP/Gateway transports.
+
+## Global Constraints
+
+- Keep exactly `codex.appServer.threads.list.v1` and `codex.appServer.thread.turns.list.v1`.
+- Do not enable ReadAndSteer or modify `allowWriteControls`.
+- Follow RED/GREEN for every production behavior change.
+
+### Task 1: Revoke active catalog executions
+
+**Files:** `NodeCapabilityRegistry.cs`, `NodeCapabilityRegistryTests.cs`.
+
+- [ ] Write a held-execution test that revokes ReadOnly and observes cancellation/no success delivery.
+- [ ] Run the focused registry test and observe the missing generation cancellation RED.
+- [ ] Add one registry-owned cancellation generation, cancel it before publishing a Codex-free/replacement snapshot, and link it in `DeferredCodexSessionCapability.ExecuteAsync`.
+- [ ] Run the focused registry test GREEN.
+
+### Task 2: Close raw policy bypasses
+
+**Files:** `CodexAppServerClient.cs`, `CodexExecutableResolver.cs`, `CodexSessionCatalogService.cs`, assembly friendship configuration, focused source/API tests.
+
+- [ ] Write a source/API contract test requiring raw resolver, client connection, and raw list methods to be internal.
+- [ ] Run it RED against the current public declarations.
+- [ ] Internalize the raw surface, retaining only required Tray and test friend assemblies.
+- [ ] Run Shared/Tray focused tests GREEN.
+
+### Task 3: Make access revocation persistence fail closed
+
+**Files:** `SettingsManager.cs`, `SettingsStore.cs`, `SettingsPageViewModel.cs`, settings tests.
+
+- [ ] Write a failing test that injects a save failure while changing ReadOnly to Off and asserts no runtime refresh or durable-mode mismatch.
+- [ ] Run it RED.
+- [ ] Add a narrow success result/rollback path for the Codex permission update; preserve safe two-way binding behavior.
+- [ ] Run settings tests GREEN and add the local `app.settings.set` denial regression.
+
+### Task 4: Re-review and closeout
+
+- [ ] Run focused tests, the required build, and all three required suites.
+- [ ] Dispatch scoped security and code-quality re-reviews, fix any Critical/Important issues with RED/GREEN loops.
+- [ ] Update Task 8 reports and attempt interactive proof only if the security gates are clean.