ai: migrate LLM backbone from Kimi CLI to Codex CLI

Retires the Moonshot/Kimi subscription in favour of the already-paid ChatGPT
plan. Both CLI wrappers now run `codex exec`; the kimi-agent container is gone.

adolf-llm + hindsight-llm:
- runKimi -> runCodex (`codex exec --json --skip-git-repo-check`), resume via
  `codex exec resume <thread_id>`.
- MCP moves from a per-session .mcp.json (a workaround for Kimi having no
  --mcp-config-file flag) to a $CODEX_HOME/config.toml generated once at
  startup from shared-mcp.json. Field translation is load-bearing:
  bearerTokenEnvVar -> bearer_token_env_var, enabledTools -> enabled_tools.
- approval_policy="never" + sandbox_mode required, or unattended turns block
  on an approval prompt nobody can answer.

kimi-agent removed. It was the ONLY large-tier deployment behind LiteLLM, so
deleting it outright would have silently degraded every large-tier request to
the local 4B model via the existing fallbacks. tier-large, the auto_router
complex-reasoning route and their fallbacks now point at the codex-backed
adolf-llm wrapper (model_name: codex-agent).

Three environment blockers fixed along the way:
- OpenAI geo-blocks this host (403 unsupported_country_region_territory).
  Both containers now egress via the host xray proxy, with NO_PROXY keeping
  MCP and *.alogins.net traffic off the tunnel.
- node:22-slim ships no system CA store; the Rust codex binary validates TLS
  against it, so every HTTPS call failed with a generic transport error while
  Node's own fetch worked. ca-certificates added to both images.
- `codex exec resume` rejects -C/--cd (plain `codex exec` accepts it), which
  broke follow-up turns while first turns succeeded.

Known regression: Kimi's managed-usage API has no Codex equivalent, so the
/usage route returns 501 and there is no quota probe for the codex model.
The two quota plugins degrade quietly to no output.

Also: stop tracking cognee.env (live LLM + JWT secrets) and gitignore it.
The secrets remain in earlier history and should be rotated.

Verified live: plain turn, SSE streaming, session resume, MCP tool call,
bearer-token MCP call, and completions through both LiteLLM routes.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014Y5QPagv4iun1ghpwM96Ff

ai/kimi-quota-footer-plugin/index.js

@@ -0,0 +1,128 @@
+/**
+ * Kimi Quota Footer (kb #85) — appends a compact Kimi usage line to the end of
+ * each of Adolf's outgoing replies, via OpenClaw's `reply_payload_sending`
+ * hook (docs/plugins/hooks.md: "Mutate or cancel normalized reply payloads
+ * before delivery... runs after payload normalization and before channel
+ * delivery, including replies routed back to the originating channel").
+ *
+ * Source of the numbers: the LLM-free `GET /usage` route on adolf-llm (kb
+ * #62), which talks straight to Kimi's managed-usage API — no model call
+ * anywhere.
+ *
+ * Never blocks the send path: usage is cached and refreshed in the
+ * background, so a reply is at most decorated with a slightly stale
+ * (<= cacheTtlMs) snapshot, and any error/timeout simply omits the footer
+ * rather than delaying or breaking the message.
+ *
+ * Streaming caveat (verified against /app/dist in the running container,
+ * kb#85): Matrix preview streaming ("draft previews finalize in place",
+ * docs/concepts/streaming.md) delivers the finalized text via a direct
+ * payload edit (`ctx.edit`/`onEditReceipt`) that never calls
+ * deliverOutboundPayloadsInternal, so reply_payload_sending would NOT fire
+ * for that path. Adolf's openclaw.json currently leaves
+ * channels.matrix.streaming unset (default "off"), so every real reply goes
+ * through the normal send path (sendDurableMessageBatch ->
+ * deliverOutboundPayloadsInternal) where this hook does fire. If Matrix
+ * streaming is ever turned on for Adolf, this footer will silently stop
+ * appearing on finalized-in-place replies — re-check this comment first.
+ */
+
+import { definePluginEntry } from "openclaw/plugin-sdk/plugin-entry";
+
+const DEFAULTS = {
+  enabled: true,
+  usageUrl: "http://adolf-llm:8010/usage",
+  cacheTtlMs: 60000, // serve a cached snapshot for up to this long
+  fetchTimeoutMs: 2500, // background fetch only; never on the send path
+  prefix: "— Kimi:",
+};
+
+function normalizeConfig(raw) {
+  const c = raw && typeof raw === "object" ? raw : {};
+  const int = (v, d) => (Number.isFinite(v) && v > 0 ? Math.floor(v) : d);
+  return {
+    enabled: c.enabled !== false,
+    usageUrl: typeof c.usageUrl === "string" && c.usageUrl ? c.usageUrl : DEFAULTS.usageUrl,
+    cacheTtlMs: int(c.cacheTtlMs, DEFAULTS.cacheTtlMs),
+    fetchTimeoutMs: int(c.fetchTimeoutMs, DEFAULTS.fetchTimeoutMs),
+    prefix: typeof c.prefix === "string" && c.prefix ? c.prefix : DEFAULTS.prefix,
+  };
+}
+
+function pct(bucket) {
+  if (!bucket || typeof bucket.pct !== "number") return null;
+  return Math.round(bucket.pct);
+}
+
+function formatFooter(usage, prefix) {
+  if (!usage) return null;
+  const parts = [];
+  const h5 = pct(usage.window_5h);
+  const wk = pct(usage.weekly);
+  const d7 = pct(usage.window_7d);
+  if (h5 !== null) parts.push(`5h ${h5}%`);
+  if (wk !== null) parts.push(`weekly ${wk}%`);
+  if (d7 !== null) parts.push(`7d ${d7}%`);
+  if (parts.length === 0) return null;
+  return `${prefix} ${parts.join(" · ")}`;
+}
+
+export default definePluginEntry({
+  id: "kimi-quota-footer",
+  name: "Kimi Quota Footer",
+  description: "Appends a compact Kimi usage line to the end of each outgoing reply.",
+  register(api) {
+    const cfg = normalizeConfig(api.pluginConfig);
+
+    // Non-blocking cache: the send path never awaits the network. When the
+    // snapshot is stale we kick a background refresh and keep using the last
+    // known one; a quota readout tolerates being a minute stale.
+    let cache = { usage: null, ts: 0 };
+    let refreshing = false;
+
+    async function refresh() {
+      if (refreshing) return;
+      refreshing = true;
+      const controller = new AbortController();
+      const timer = setTimeout(() => controller.abort(), cfg.fetchTimeoutMs);
+      try {
+        const res = await fetch(cfg.usageUrl, { signal: controller.signal });
+        if (!res.ok) throw new Error(`/usage HTTP ${res.status}`);
+        cache = { usage: await res.json(), ts: Date.now() };
+      } catch (e) {
+        api.logger?.debug?.(`kimi-quota-footer: usage refresh failed (${e?.message || e})`);
+      } finally {
+        clearTimeout(timer);
+        refreshing = false;
+      }
+    }
+
+    // Warm the cache at startup so the first reply already carries a footer.
+    refresh();
+
+    // Resolve the current footer, refreshing usage without blocking the send
+    // path (one-shot blocking only on a cold cache).
+    async function currentFooter() {
+      if (!cache.usage) {
+        await refresh();
+      } else if (Date.now() - cache.ts > cfg.cacheTtlMs) {
+        refresh();
+      }
+      return formatFooter(cache.usage, cfg.prefix);
+    }
+
+    api.on("reply_payload_sending", async (event) => {
+      try {
+        if (!cfg.enabled) return;
+        const payload = event?.payload;
+        const text = payload?.text;
+        if (typeof text !== "string" || text.trim().length === 0) return;
+        const footer = await currentFooter();
+        if (!footer || text.includes(footer)) return;
+        return { payload: { ...payload, text: `${text}\n\n${footer}` } };
+      } catch (e) {
+        api.logger?.warn?.(`kimi-quota-footer: hook failed (${e?.message || e})`);
+      }
+    });
+  },
+});

ai/kimi-quota-footer-plugin/openclaw.plugin.json

@@ -0,0 +1,37 @@
+{
+  "id": "kimi-quota-footer",
+  "name": "Kimi Quota Footer",
+  "description": "Appends a compact Kimi usage line (5h/weekly/7d %) to the end of each of Adolf's outgoing replies, via the reply_payload_sending hook. Reads the LLM-free adolf-llm:8010/usage route (kb #62); cached + background-refreshed so it never blocks the send path.",
+  "activation": {
+    "onStartup": true
+  },
+  "configSchema": {
+    "type": "object",
+    "additionalProperties": false,
+    "properties": {
+      "enabled": { "type": "boolean" },
+      "usageUrl": { "type": "string" },
+      "cacheTtlMs": { "type": "integer", "minimum": 1000, "maximum": 3600000 },
+      "fetchTimeoutMs": { "type": "integer", "minimum": 200, "maximum": 30000 },
+      "prefix": { "type": "string" }
+    }
+  },
+  "uiHints": {
+    "enabled": {
+      "label": "Kimi Quota Footer",
+      "help": "Append a compact Kimi usage line to the end of each reply."
+    },
+    "usageUrl": {
+      "label": "Usage URL",
+      "help": "adolf-llm /usage endpoint (default http://adolf-llm:8010/usage)."
+    },
+    "cacheTtlMs": {
+      "label": "Cache TTL (ms)",
+      "help": "How long a fetched usage snapshot is reused before a background refresh (default 60000)."
+    },
+    "prefix": {
+      "label": "Footer Prefix",
+      "help": "Text before the percentages (default \"— Kimi:\")."
+    }
+  }
+}

ai/kimi-quota-footer-plugin/package.json

@@ -0,0 +1,7 @@
+{
+  "name": "kimi-quota-footer",
+  "version": "1.0.0",
+  "type": "module",
+  "main": "index.js",
+  "private": true
+}