Add Stream Deck Plus dials, touch controls, and model presets

[tlk3]

Summary

This expands Codex Deck into a first-class Stream Deck Plus integration. A new Encoder-only Codex Dial action lets each knob independently configure rotation, press, touch-strip tap, and LCD feedback while preserving all existing keypad behavior.

The default four-knob layout covers:

• Model Presets — immediately cycle through user-defined model/reasoning pairs with continuous wrap and confirmed-state feedback
• Agents — select occupied agents, show live status/context/host feedback, and focus on press
• Actions — select and run configured Codex Micro actions
• Usage — select Auto/5-hour/Weekly views, toggle the overview, and refresh from touch

What changed

• Added the Stream Deck Plus Codex Dial manifest action, encoder layout, icons, and per-action property inspector.
• Added per-knob presets plus fully independent rotation, press, touch, and feedback settings.
• Added accessible live model/reasoning editors with add, remove, drag, keyboard reorder controls, unavailable-entry preservation, and an opt-in Ultra policy.
• Added native paired model/reasoning switching through Codex's own application callback. The plugin does not type, synthesize keyboard navigation, or optimistically claim a selection before Codex confirms it.
• Added immediate confirmed reasoning feedback, ULTRA OFF fail-closed behavior, and compact day/hour/minute usage-reset labels.
• Added controller-wide ordering, bounded backpressure, generation/lifecycle fencing, and truthful SWITCHING, UNLISTED, UNAVAILABLE, degraded, and offline states.
• Extended the authenticated Mac/Windows relay with additive capabilities for confirmed reasoning feedback and Model Presets. Older peers are refused before a partial command is sent.
• Added non-destructive macOS bridge recovery: the watcher now degrades and retries without terminating or relaunching Codex, including when legacy Statsig is unavailable.
• Added macOS launcher hardening, Stream Deck Plus documentation, release-audit coverage, and extensive domain/controller/bridge/relay/property-inspector tests.
• Restored standalone command keycaps such as Terminal against the current Codex Micro runner layout while keeping dedicated reasoning mutations on their guarded path.

User impact

Stream Deck Plus owners can use the touch screen and four knobs as live Codex controls instead of mapping the device as keypad-only. The most common workflow—jumping between a few model/reasoning combinations—now takes one detent and updates the LCD from confirmed Codex state.

Existing Stream Deck keypad actions and single-host behavior remain unchanged. Stream Deck Plus support is optional and configured per knob.

Compatibility and safety

• Uses allow-listed typed actions only; no arbitrary commands, URLs, keyboard focus movement, or global hotkeys.
• Keeps the Chrome DevTools endpoint loopback-only.
• Bounds and validates model catalogs, relay payloads, pending work, and renderer traversal.
• Preserves independent Windows-only, macOS-only, and optional multi-host operation.
• Does not include Codex/Elgato protected artwork, local profiles, logs, tokens, or generated release bundles.

Validation

• npm ci
• npm run check
• npm test — 435 passed, 1 expected skip, 0 failed
• npm run validate
• npm run audit:release — 3 artifact roots passed
• git diff --check origin/main...HEAD

Manual/live verification:

• macOS 26.5.1
• Codex for macOS 26.810.52044 (live renderer and native Micro activation verification)
• Stream Deck 7.4.2 (22730)
• physical Stream Deck Plus
• live Codex macOS renderer integration, including persisted per-knob settings, touch actions, immediate dial feedback, Model Presets, restart persistence, and local bridge recovery

The cross-platform Stream Deck SDK, Windows launcher, and authenticated relay paths have automated coverage. This PR does not claim new physical Stream Deck Plus hardware verification on Windows.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 48ce1ded1a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[tlk3]

Resolved a macOS recovery issue found during live testing on Codex 26.810.52044.

• The background watcher can no longer terminate or relaunch Codex under any bridge-loss condition; it now remains degraded and retries in place.
• Native Micro activation now works when the legacy Statsig client is unavailable, while preserving the older Statsig path and failing closed if native HID/joystick handlers are absent.
• Added RED→GREEN regression coverage for previous-healthy bridge loss, process-generation replacement, no-Statsig activation, legacy activation, and missing-handler refusal.

Verification: 435 tests passed, 1 expected skip, TypeScript check, build, Stream Deck validation, release audit (3 roots), and diff check. The patched artifacts were also installed on macOS 26.5.1 with Codex 26.810.52044; live logs show local=ready and Codex Micro layout synchronized, and the installed watcher has no automatic restart path.

[tlk3]

Fixed Model Presets showing UNAVAILABLE on current Codex builds in 8c62d73. A live read-only probe traced the rejection to a non-enumerable, own-data Symbol.dispose cleanup function on the models/list response envelope. The validator now permits only that exact well-known cleanup symbol on the envelope, never invokes it, and continues rejecting accessors, proxies, unrelated/lookalike symbols, enumerable hooks, and symbols on model records. Original input cloning retains proxy rejection after descriptor validation. Regression reproduced the failure before the change; 75 bridge tests and the full suite (436 passed, 1 expected skip), TypeScript, build, plugin validation, and release audit pass. The patched serialized metadata reader was verified read-only against live Codex: gpt-5.6-sol / medium, nine catalog records. Saved presets and model selection were not modified. This commit is limited to the bridge and its regression test.

[tlk3]

Fixed current Codex model-preset detection in b2b6fff. The composer now displays GPT-prefixed names such as GPT-6 Astra, while catalog display names are normalized to 6 Astra. Normalize the optional GPT prefix on visible labels too, retaining exact catalog matching and ambiguity rejection. Regression reproduced before the fix; 436 tests pass (one expected skip), TypeScript, build, plugin validation, and release audit pass. A read-only probe against the running Codex app now resolves gpt-6-astra / low and all nine catalog models. No Codex restart was needed for verification.