{"record":{"id":"01ffdf39c0705882","repo":"openclaw/openclaw","slug":"codex-write-controls-are-disabled-for-this-codex-p","errorCode":null,"errorMessage":"Codex write controls are disabled for this codex plugin supervision config.","messagePattern":"Codex write controls are disabled for this codex plugin supervision config\\.","errorType":"validation","errorClass":"CodexSupervisionPolicyError","httpStatus":null,"severity":"error","filePath":"extensions/codex/src/supervision-tools.ts","lineNumber":949,"sourceCode":"      (options.useLegacyMcpPolicyEnv === true &&\n        env[LEGACY_CODEX_SUPERVISOR_WRITE_CONTROLS_ENV] === \"1\"),\n  };\n}\n\nfunction requireRawTranscriptAccess(\n  options: CodexSupervisionToolsOptions,\n  pluginConfig: unknown,\n): void {\n  if (!resolveToolPolicy(options, pluginConfig).allowRawTranscripts) {\n    throw new CodexSupervisionPolicyError(\n      \"Codex session reads are disabled for this codex plugin supervision config.\",\n    );\n  }\n}\n\nfunction requireWriteAccess(options: CodexSupervisionToolsOptions, pluginConfig: unknown): void {\n  if (!resolveToolPolicy(options, pluginConfig).allowWriteControls) {\n    throw new CodexSupervisionPolicyError(\n      \"Codex write controls are disabled for this codex plugin supervision config.\",\n    );\n  }\n}\n\nfunction requireLiveToolPolicy(\n  options: CodexSupervisionToolsOptions,\n  policy: CodexSupervisionRequestPolicy,\n): { pluginConfig: unknown; endpoints: ResolvedSupervisionEndpoint[] } {\n  requireOwnerAccess(options);\n  const pluginConfig = options.getPluginConfig();\n  requireSupervisionEnabled(pluginConfig);\n  if (policy === \"raw-transcripts\") {\n    requireRawTranscriptAccess(options, pluginConfig);\n  } else if (policy === \"write-controls\") {\n    requireWriteAccess(options, pluginConfig);\n  }\n  return {","sourceCodeStart":931,"sourceCodeEnd":967,"githubUrl":"https://github.com/openclaw/openclaw/blob/01804a75319da4b69c9ab98ceaa30477e22b8c0b/extensions/codex/src/supervision-tools.ts#L931-L967","documentation":"Thrown by requireWriteAccess() when the resolved Codex supervision tool policy denies write controls. resolveToolPolicy() grants write controls only when config.supervision.allowWriteControls === true OR the legacy env var is set to \"1\" while useLegacyMcpPolicyEnv is enabled. This guards mutation tools (steer, interrupt) so they cannot run against a thread unless the operator explicitly opted in.","triggerScenarios":"Calling codex_session_steer or codex_session_interrupt while plugins.entries.codex.config.supervision is absent, set to { enabled: true } without allowWriteControls, or allowWriteControls: false. Also occurs when the legacy CODEX supervisor write-control env var is unset and useLegacyMcpPolicyEnv is not enabled.","commonSituations":"Operator enabled supervision for read-only session inspection (allowRawTranscripts: true) but forgot allowWriteControls: true. Config migrated by doctor without preserving the write-control flag. Legacy env-based setup dropped after upgrading to config-based policy.","solutions":["Set plugins.entries.codex.config.supervision.allowWriteControls to true in openclaw.json if you intend to steer or interrupt codex turns.","Confirm plugins.entries.codex.config.supervision.enabled is also true; supervision must be on for any policy field to take effect.","If using the legacy env path, set the CODEX supervisor write-control env var to \"1\" and ensure useLegacyMcpPolicyEnv is enabled in the plugin options.","If write control is intentionally off, use read-only session tools instead of steer/interrupt."],"exampleFix":"// before\n\"codex\": { \"supervision\": { \"enabled\": true, \"allowRawTranscripts\": true } }\n// after\n\"codex\": { \"supervision\": { \"enabled\": true, \"allowRawTranscripts\": true, \"allowWriteControls\": true } }","handlingStrategy":"validation","validationCode":"function canWriteControls(pluginConfig) {\n  const supervision = pluginConfig?.codex?.supervision;\n  return supervision?.enabled === true && supervision?.allowWriteControls === true;\n}\n// before calling steer/interrupt:\nif (!canWriteControls(cfg.plugins.entries)) {\n  throw new Error(\"Enable codex supervision allowWriteControls before using write tools.\");\n}","typeGuard":null,"tryCatchPattern":"try {\n  await codexSessionSteer(...);\n} catch (err) {\n  if (err instanceof CodexSupervisionPolicyError && /write controls are disabled/.test(err.message)) {\n    // surface a config guidance message, do not retry until config is fixed\n  } else throw err;\n}","preventionTips":["Set allowWriteControls: true in supervision config at setup time if you plan to steer or interrupt.","Gate write-tool UI actions on a capability check that reads the resolved policy.","Document that read-only supervision does not include steer/interrupt."],"tags":["codex","supervision","config","policy","permissions"],"backgroundTag":null,"analyzedSha":"01804a75319da4b69c9ab98ceaa30477e22b8c0b","analyzedAt":"2026-08-12T04:37:58.197Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}