Wire diagnostics through the core chat command (#72936)

* feat: wire codex diagnostics feedback

* fix: harden codex diagnostics hints

* fix: neutralize codex diagnostics output

* fix: tighten codex diagnostics safeguards

* fix: bound codex diagnostics feedback output

* fix: tighten codex diagnostics throttling

* fix: confirm codex diagnostics uploads

* docs: clarify codex diagnostics add-on

* fix: route diagnostics through core command

* fix: tighten diagnostics authorization

* fix: pin diagnostics to bundled codex command

* fix: limit owner status in plugin commands

* fix: scope diagnostics confirmations

* fix: scope codex diagnostics cooldowns

* fix: harden codex diagnostics ownership scopes

* fix: harden diagnostics command trust and display

* fix: keep diagnostics command trust internal

* fix: clarify diagnostics exec boundary

* fix: consume codex diagnostics confirmations atomically

* test: include codex diagnostics binding metadata

* test: use string codex binding timestamps

* fix: keep reserved command trust host-only

* fix: harden diagnostics trust and resume hints

* wire diagnostics through exec approval

* fix: keep diagnostics tests aligned with bundled root trust

* fix telegram diagnostics owner auth

* route trajectory exports through exec approval

* fix trajectory exec command encoding

* fix telegram group owner auth

* fix export trajectory approval hardening

* fix pairing command owner bootstrap

* fix telegram owner exec approvals

* fix: make diagnostics approval flow pasteable

* fix: route native sensitive command followups

* fix: invoke diagnostics exports with current cli

* fix: refresh exec approval protocol models

* fix: list codex diagnostics from thread bindings

* fix: fold codex diagnostics into exec approval

* fix: preserve diagnostics approval line breaks

* docs: clarify diagnostics codex workflow

docs/tools/trajectory.md

@@ -20,6 +20,13 @@ Use it when you need to answer questions like:
 - Which model, plugins, skills, and runtime settings were active?
 - What usage and prompt-cache metadata did the provider return?
 
+If you are filing a broad support report for a live Gateway issue, start with
+[`/diagnostics`](/gateway/diagnostics#chat-command). Diagnostics collects the
+sanitized Gateway bundle and, for OpenAI Codex harness sessions, can also send
+Codex feedback to OpenAI servers after approval. Use `/export-trajectory` when
+you specifically need the detailed per-session prompt, tool, and transcript
+timeline.
+
 ## Quick start
 
 Send this in the active session:
@@ -49,6 +56,20 @@ You can choose a relative output directory name:
 The custom path is resolved inside `.openclaw/trajectory-exports/`. Absolute
 paths and `~` paths are rejected.
 
+Trajectory bundles can contain prompts, model messages, tool schemas, tool
+results, runtime events, and local paths. The chat slash command therefore runs
+through exec approval every time. Approve the export once when you intend to
+create the bundle; do not use allow-all. In group chats, OpenClaw sends the
+approval prompt and export result to the owner privately instead of posting the
+trajectory details back to the shared room.
+
+For local inspection or support workflows, you can also run the approved command
+path directly:
+
+```bash
+openclaw sessions export-trajectory --session-key "agent:main:telegram:direct:123" --workspace .
+```
+
 ## Access
 
 Trajectory export is an owner command. The sender must pass the normal command