[koichiro]

Summary

Support a renamed macOS Codex bundle and add a dedicated Always · Conversation (Always) Stream Deck key for the native conversation-scoped permission shown on the current approval card.

• Discover Codex by bundle ID com.openai.codex and its declared executable instead of assuming Codex.app. Use the discovered app's CLI for account usage, including current and legacy CLI layouts.
• Add vector keypad artwork: a check on green for Allow, a double check on yellow-green for Always, and a cross on red for Deny, with labels beneath the glyphs. Verified in the Stream Deck profile preview after reloading the plugin.
• Label the three approval keys Allow, Always, and Deny, while preserving existing action UUIDs and ordinary approval/rejection behavior.
• Add a local-only keypad action that invokes the visible native card's scopedApproveAction.onClick through the renderer bridge. Depending on the request, this selects Allow similar commands, Allow all edits, or Allow this conversation.
• Require one visible, connected, enabled approval card with one unambiguous scoped callback. Reject missing/loading/disabled/hidden cards, unsupported renderer shapes, and unconfirmed or remote targets without falling back to ordinary approval.
• Preserve ordinary APPR/REJ behavior. The new action does not enable global automatic approval or choose the separate permanent Always allow network rule. Its scope follows Codex's native request UI.
• Document setup, scope, compatibility limits, and hardware verification boundaries.

The new action has no native Micro keycap ID in the inspected Codex build, so it resolves the existing approval-card callback via React fiber props. This is an unofficial compatibility path and may become unavailable after renderer changes. No Codex app files are modified.

This PR targets this fork's agent/stream-deck-plus-controls branch, based on upstream PR #13.

Validation

• TypeScript check passed.
• Automated tests: 522 passed, 1 skipped, 0 failed out of 523 tests. Coverage includes serialized renderer callback execution, refusal of unavailable/ambiguous/hidden/disabled scopes, accessor/cycle rejection, and local-target enforcement.
• Build, Stream Deck package validation, and release audit across all three artifact roots passed.
• Inspected the installed Codex 26.1007.30912 (20156) renderer: native approval cards expose the conversation-scoped callbacks and decision mapping described above.
• Read-only live renderer probe confirmed the visibility API is supported and no scoped action is available when no approval card is present. It did not invoke an approval callback.
• Existing integration verified on macOS 27.0.1 with /Applications/ChatGPT.app, Stream Deck 7.5.0, and USB Stream Deck Plus: chat status monitoring, weekly usage, physical ordinary APPR/REJ, and watcher recovery after a normal Codex relaunch.

The new Always key has not yet been physically tested against a live approval request. The successful physical APPR/REJ tests exercised the existing one-request actions, not this new conversation-scoped action. Login recovery and recovery after an app update remain unverified.