Best possible solution:

Have maintainers review the dangerous node-command policy and /codex UX, then merge the branch if that policy decision is accepted and normal checks stay green.

Do we have a high-confidence way to reproduce the issue?

Not applicable as a feature PR rather than a bug report. The after-fix path is evidenced by PR-body Crabbox proof for real node-host list/resume behavior plus source inspection of the command routing.

Is this the best way to solve the issue?

Unclear pending maintainer policy review: the implementation follows existing plugin node-host APIs and now uses the established Windows spawn helper, but accepting a dangerous node resume command and the binding UX is a product/security decision.

What I checked:

• Protected label and discussion context: The provided PR context lists the maintainer label and the PR body says the node command policy and Codex slash-command behavior are worth maintainer review before merging. (3595cd31e925)
• Node command registration: The PR registers codex.cli.sessions.list as a default node command on macOS/Linux/Windows and registers codex.cli.session.resume as a dangerous command without default platforms, which matches the explicit-allowlist policy boundary. (extensions/codex/src/node-cli-sessions.ts:67, 3595cd31e925)
• Slash-command binding flow: The PR adds /codex sessions --host ... and /codex resume ... --host ... --bind here, resolving the requested node session before creating a conversation binding. (extensions/codex/src/command-handlers.ts:534, 3595cd31e925)
• Bound turn routing: Bound codex-cli-node-session messages are routed through the injected node resume helper with node id, session id, prompt, cwd, and timeout. (extensions/codex/src/conversation-binding.ts:157, 3595cd31e925)
• Prior Windows finding addressed: Latest head resolves Codex CLI resume through resolveWindowsSpawnProgram/materializeWindowsSpawnProgram, and the added test covers Windows npm .cmd shims. (extensions/codex/src/node-cli-sessions.ts:268, 3595cd31e925)
• Existing node policy contract: Current main filters dangerous plugin node commands out of default allowlists unless explicitly included in gateway.nodes.allowCommands, and the SDK docs say dangerous node-host commands should register node-invoke policies. (src/gateway/node-command-policy.ts:237, 66b98b72946f)

Likely related people:

• steipete: Local blame shows current Codex entry/binding and node policy ranges on main, and GitHub commit history shows prior Codex harness/app-server and plugin SDK surface work in the same area. (role: introduced and recently maintained adjacent Codex plugin and node-policy surfaces; confidence: high; commits: 625713091e, dd26e8c44d4e, 31a0b7bd42a5; files: extensions/codex/index.ts, extensions/codex/src/conversation-binding.ts, extensions/codex/src/command-handlers.ts)
• pashpashpash: Recent current-main history for Codex app-server auth, state isolation, and Windows/env handling touches the process/runtime boundary this PR extends. (role: recent Codex app-server runtime contributor; confidence: medium; commits: 78d51dcebe9e, a412603bad53, 027ea5f08bd9; files: extensions/codex/src/app-server/transport-stdio.ts, docs/plugins/codex-harness.md)
• mbelinky: Beyond authoring this PR, recent current-main history shows Codex watchdog/subagent and related Codex work by this contributor, so they are relevant to follow-up on the proposed surface. (role: recent Codex area contributor and reviewer; confidence: medium; commits: 1aef36b60d83, 949012797bea, 8c75ed3eaa8f; files: extensions/codex/index.ts, extensions/codex/src/command-handlers.ts, CHANGELOG.md)

Remaining risk / open question:

• The PR body says full live gateway-to-node chat pairing was not rerun; the posted proof covers node-host handlers and tests cover routing.
• The new dangerous resume command and slash-command binding UX still need explicit maintainer approval because they change the node command policy surface.

Codex review notes: model gpt-5.5, reasoning high; reviewed against 66b98b72946f.