Vito Cappello
5621979a46
* feat(models): add session-only model selection * fix(models): use trailing session scope option * test(models): satisfy session scope lint * fix(models): reject duplicate model options * fix(models): clarify default and session scope * fix(models): require complete session option tokens * fix(models): report configured default dispatch * fix(models): keep directive handler within lint limit * fix(models): parse model options in either order * fix(models): apply session scope to aliases * fix(models): align alias scope with reply routing * fix(discord): surface model selection scope in picker * fix(models): preserve mixed-text model selection * fix(models): centralize command selection ownership * fix(models): align session scope lifecycle * fix(models): preserve command and auth ownership * fixup! fix(models): preserve command and auth ownership * fix(auth): preserve scoped CLI provider discovery * test(models): align result and cron fixtures * test(models): nest result timing metadata * fix(discord): narrow silent dispatch results * fix(transcript): preserve admitted turn identity * fix(context-engine): fence the admitted transcript turn * fix(context-engine): stabilize plugin compatibility contract * chore(plugin-sdk): refresh context engine API baseline * chore(plugin-sdk): use Linux context engine API baseline * fix(context-engine): align fallback ownership * fix(fallback): scope auth skip cache by profile * fix(context-engine): settle only accepted fallback turns * refactor(sessions): issue canonical turn admissions * refactor(context-engine): own logical turn advancement * fix(context-engine): settle cron fallback winners * fix(models): align picker and fallback transactions * fix(delivery): notify block admission after queueing * fix(sessions): preserve canonical admission receipts * chore(plugin-sdk): refresh API baseline hash * fix(context-engine): commit accepted turns durably * fix(context-engine): validate durable host transitions * fix(context-engine): preserve fallback turn ownership * fix(context-engine): preserve queued turn order * fix(models): preserve fallback retry ownership * fix(context-engine): enforce durable transcript anchors * fix(runtime): close fallback persistence gaps * fix(context-engine): preflight fallback harnesses * chore(plugin-sdk): use Linux API baseline * fix(context-engine): drain durable commits before reads * fix(models): scope harness auth failures by profile * fix(codex): fence legacy transcript history * fix(commands): honor suppressed directive interpretation * chore(runtime): remove unused branch exports * test(context-engine): derive private outbox payload type * fix(context-engine): apply durable drain degradation * fix(context-engine): recover durable turn intents * fix(context-engine): settle durable turn intents * refactor(context-engine): satisfy branch quality gates * fix(context-engine): close durable recovery gaps * fix(discord): preserve dropped model command outcome * test(copilot): keep journal fixture types local * fix(auto-reply): preserve model alias provenance * fix: close model scope review gaps * fix(models): close review-found scope leaks * fix(review): satisfy branch line budgets * fix(agents): preserve context engine turn facts * fix(agents): finalize silent context turns * fix(context-engine): preserve compatibility window * test(agents): cover both harness preparations * fix(context-engine): retain blocked turn advancements * fix(models): parse compact runtime options * fix(telegram): report runtime resets accurately * fix(models): isolate automatic auth failure skips * fix(context-engine): project commit turn host params --------- Co-authored-by: VACInc <3279061+VACInc@users.noreply.github.com> Co-authored-by: Vincent Koc <vincentkoc@ieee.org>
OpenClaw Codex
Official OpenClaw plugin for OpenAI Codex app-server integration. It exposes the Codex-managed GPT model catalog, the Codex runtime surfaces used by OpenClaw agents, and opt-in supervision of native Codex sessions.
Install from OpenClaw:
openclaw plugins install @openclaw/codex
Use this plugin when you want OpenClaw to run Codex-backed model turns, media understanding, and prompt overlays through the Codex app-server harness, or to browse non-archived Codex CLI, VS Code, Atlas, and ChatGPT sessions and paginated transcripts across paired computers.
Guided onboarding attempts to install and enable supervision after it detects a native Codex installation and the selected inference backend passes its live check; Codex does not need to be the primary backend. Supervision activates when that opportunistic plugin setup succeeds. App Server availability is checked when supervision connects. An explicit Codex plugin disable, plugin-policy block, or supervision.enabled: false prevents opportunistic enablement. Manual setups enable plugins.entries.codex.config.supervision.enabled. Without explicit App Server connection settings, supervision uses a managed user-home stdio connection; explicit appServer settings are honored.
The Gateway-backed operator CLI is:
openclaw codex sessions [--search <text>] [--host <id>] [--limit <count>] [--cursor <cursor>] [--json] [--url <url>] [--token <token>] [--timeout <ms>] [--expect-final]
openclaw codex continue <thread-id> [--json] [--url <url>] [--token <token>] [--timeout <ms>] [--expect-final]
openclaw codex archive <thread-id> --confirm-no-other-runner [--json] [--url <url>] [--token <token>] [--timeout <ms>] [--expect-final]
The catalog never includes archived threads and has no archived or include-archived option. Rows appear in the normal Control UI sessions sidebar and open in the normal Chat pane. Transcript history requires a recent Codex App Server with thread/turns/list and is fetched 20 full-item turns at a time through opaque cursors; OpenClaw does not fall back to an unbounded thread/read, and rejects a serialized transcript page above 20 MiB before transport. --limit defaults to 50 sessions per host, --cursor requires --host, and the sessions Gateway timeout defaults to 75,000 ms so cold paired-node catalogs can complete. Continue and archive retain the shared 30,000 ms default. All operator surfaces require operator.write. Paired-node rows can be listed and read; continue and archive operate only on the Gateway-local host, and archive requires the no-other-runner confirmation. Catalog registration does not require supervision.enabled; that setting gates agent-facing supervision tools.
A supervised OpenClaw Chat cannot be deleted while its model-selection lock protects the native binding. Before native archive, OpenClaw checks the exact target and every non-archived spawned descendant reported by Codex; any active OpenClaw binding blocks the operation. Descendant pagination errors, cycles, and safety-limit exhaustion also fail closed. Codex still does not expose a conditional archive operation or cross-process runner lease, so the confirmation covers unknown native clients and the race between the status read and archive request.
Disabling or uninstalling the plugin leaves supervised Chats locked and unavailable rather than rerouting them. Reinstall or re-enable the same plugin and restart the Gateway to resume those Chats.
These shell commands differ from the in-chat /codex runtime commands. In particular, /codex sessions --host <node> lists Codex CLI session files on one node, /codex threads uses the current conversation's App Server connection, and /codex resume or /codex bind changes that conversation's binding. There is no /codex archive runtime command.
For a supervised branch, Codex App Server selects the snapshot fork's model and provider from its current native configuration. OpenClaw starts the canonical harness thread with exactly that returned pair. Codex persists the canonical thread's native selection, and later resumes preserve it because OpenClaw omits model and provider overrides. OpenClaw cannot substitute its outer runtime, model, or fallback. The returned initial pair can differ from the source's last recorded model.
The visible-history mirror keeps at most 200 user or assistant messages, 512 KiB total, and 64 KiB per message. Image inputs become [Image attachment]; image data and local paths are not copied.
See the Codex harness and Codex supervision guides.