fix(controller): keep permissions synced with live threads

[kesslerio]

summary

/cas_status and the permissions toggle now tell the truth about the live thread. If Codex ignored a downgrade request, the controller could still write default into the binding and act like it worked. From there the status card and the stored binding drifted out of sync.

what changed

• infer permissions from the live thread state instead of trusting the requested mode
• keep the stored binding aligned with that live mode after setThreadPermissions returns
• repair the stored mode during /cas_status when the thread reports something different and no real migration is pending
• show an explicit note when the status refresh corrects the stored mode
• add regressions for status drift repair and for a downgrade request that comes back as full access
• make the affected controller tests stop relying on the harness default thread state

why this is separate

This is related to #104, but it is not the same bug. #104 is about stale approval and questionnaire state blocking full-access transitions. This patch fixes a different contract bug: the controller was trusting the requested permissions mode more than the state Codex returned.

tests

• pnpm test -- src/controller.test.ts
• pnpm typecheck

AI assistance

• Codex assisted with investigation, implementation, review, and PR prep.

---

[huntharo]

Thank you for your contribution!

Unfortunately there are still changes needed to support such an ambitious plugin in OpenClaw. Some of this functionality is now being included directly in OpenClaw.

I have made a new project, https://github.com/pwrdrvr/PwrAgent, that gives you a Codex Desktop replacement app (uses Codex) but also integrates with messaging with openclaw-codex-app-server-like functionality.

In that project if you change Full Access to Default Access in PwrAgent Desktop it will change on the status card in any bound threads across all platforms that have the thread bound. Similarly, if you change access from a bound thread it will warn you (if not acknowledged already) about risks of Full Access, then update all other bound platforms and the desktop app as well. I think you'll like it.

Please give it a try!