Skip to content

Commit 1c33990

Browse files
authored
Route OpenAI agents through Codex by default (#78899)
* route openai agent runs through codex * fix: load codex plugin for implicit openai runtime * fix: preserve explicit OpenAI PI Codex auth routing * fix: show codex auth for openai model listing * fix: map codex auth into configured openai list rows * fix: preserve explicit openai pi auth routes * docs: keep openai model route examples canonical * fix: clean openai codex test fixtures * fix: scope codex auth status fallback * fix: repair current ci boundary drift
1 parent 8b701ce commit 1c33990

64 files changed

Lines changed: 1698 additions & 420 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

CHANGELOG.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -183,7 +183,7 @@ Docs: https://docs.openclaw.ai
183183
- Agent delivery: report `deliverySucceeded=false` when outbound delivery returns no adapter result, so claimed/empty delivery paths no longer masquerade as successful sends. Fixes #78532. Thanks @joeyfrasier.
184184
- Cron/isolated runs: fail implicit announce delivery before model execution when `delivery.channel=last` has no previous route, so recurring jobs do not spend tokens before hitting a permanent delivery-target error. Fixes #78608. Thanks @sallyom.
185185
- Gateway/sessions: persist a new generated transcript file when daily gateway-agent session rollover changes the session id, while preserving custom transcript paths. Fixes #78607. Thanks @nailujac, @zerone0x, and @sallyom.
186-
- Doctor/OpenAI Codex: revert the 2026.5.5 `doctor --fix` repair that rewrote valid `openai-codex/*` ChatGPT/Codex OAuth routes to `openai/*`, which could break OAuth-only GPT-5.5 setups or accidentally move users onto the OpenAI API-key route. If 2026.5.5 already changed your default model, run `openclaw models set openai-codex/gpt-5.5 && openclaw config validate` to switch the default agent back to the Codex OAuth PI route. Fixes #78407.
186+
- Doctor/OpenAI Codex: repair legacy `openai-codex/*` agent model refs and stale OpenAI PI session pins to `openai/*` with the Codex runtime, preserving existing `openai-codex` auth profiles so ChatGPT/Codex OAuth users do not fall back to OpenAI API-key routing. Fixes #78407.
187187
- Telegram: keep the polling watchdog tied to `getUpdates` liveness so unrelated outbound Bot API calls cannot mask a wedged inbound poller. Fixes #78422. Thanks @ai-hpc.
188188
- Discord/groups: instruct group-chat agents to stay silent when a message is addressed to someone else, replying only when invited or correcting key facts. (#78615)
189189
- Discord/groups: tell Discord-channel agents to wrap bare URLs as `<https://example.com>` so link previews do not expand into uninvited embeds. (#78614)

docs/cli/models.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -43,8 +43,8 @@ Probe rows can come from auth profiles, env credentials, or `models.json`.
4343
For Codex OAuth troubleshooting, `openclaw models status`,
4444
`openclaw models auth list --provider openai-codex`, and
4545
`openclaw config get agents.defaults.model --json` are the quickest way to
46-
confirm whether an agent is using `openai-codex/*` through PI or `openai/*`
47-
through the native Codex runtime. See [OpenAI provider setup](/providers/openai#check-and-recover-codex-oauth-routing).
46+
confirm whether an agent has a usable `openai-codex` auth profile for
47+
`openai/*` through the native Codex runtime. See [OpenAI provider setup](/providers/openai#check-and-recover-codex-oauth-routing).
4848

4949
Notes:
5050

docs/concepts/agent-runtimes.md

Lines changed: 31 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -41,19 +41,19 @@ There are two runtime families:
4141

4242
Most confusion comes from several different surfaces sharing the Codex name:
4343

44-
| Surface | OpenClaw name/config | What it does |
45-
| ---------------------------------------------------- | ------------------------------------------ | ---------------------------------------------------------------------------------------------------------- |
46-
| Native Codex app-server runtime | `openai/*` plus `agentRuntime.id: "codex"` | Runs the embedded agent turn through Codex app-server. This is the usual ChatGPT/Codex subscription setup. |
47-
| Codex OAuth provider route | `openai-codex/*` model refs | Uses ChatGPT/Codex subscription OAuth through the normal OpenClaw PI runner. |
48-
| Codex ACP adapter | `runtime: "acp"`, `agentId: "codex"` | Runs Codex through the external ACP/acpx control plane. Use only when ACP/acpx is explicitly asked. |
49-
| Native Codex chat-control command set | `/codex ...` | Binds, resumes, steers, stops, and inspects Codex app-server threads from chat. |
50-
| OpenAI Platform API route for GPT/Codex-style models | `openai/*` model refs | Uses OpenAI API-key auth unless a runtime override, such as `agentRuntime.id: "codex"`, runs the turn. |
44+
| Surface | OpenClaw name/config | What it does |
45+
| ------------------------------------------------ | ------------------------------------ | -------------------------------------------------------------------------------------------------------------- |
46+
| Native Codex app-server runtime | `openai/*` model refs | Runs OpenAI embedded agent turns through Codex app-server. This is the usual ChatGPT/Codex subscription setup. |
47+
| Codex OAuth auth profiles | `openai-codex` auth provider | Stores ChatGPT/Codex subscription auth that the Codex app-server harness consumes. |
48+
| Codex ACP adapter | `runtime: "acp"`, `agentId: "codex"` | Runs Codex through the external ACP/acpx control plane. Use only when ACP/acpx is explicitly asked. |
49+
| Native Codex chat-control command set | `/codex ...` | Binds, resumes, steers, stops, and inspects Codex app-server threads from chat. |
50+
| OpenAI Platform API route for non-agent surfaces | `openai/*` plus API-key auth | Used for direct OpenAI APIs such as images, embeddings, speech, and realtime. |
5151

5252
Those surfaces are intentionally independent. Enabling the `codex` plugin makes
53-
the native app-server features available; it does not rewrite
54-
`openai-codex/*` into `openai/*`, does not change existing sessions, and does
55-
not make ACP the Codex default. Selecting `openai-codex/*` means "use the Codex
56-
OAuth provider route" unless you separately force a runtime.
53+
the native app-server features available; `openclaw doctor --fix` owns legacy
54+
`openai-codex/*` route repair and stale session pin cleanup. Selecting
55+
`openai/*` for an agent model now means "run this through Codex" unless a
56+
non-agent OpenAI API surface is being used.
5757

5858
The common ChatGPT/Codex subscription setup uses Codex OAuth for auth, but keeps
5959
the model ref as `openai/*` and selects the `codex` runtime:
@@ -63,9 +63,6 @@ the model ref as `openai/*` and selects the `codex` runtime:
6363
agents: {
6464
defaults: {
6565
model: "openai/gpt-5.5",
66-
agentRuntime: {
67-
id: "codex",
68-
},
6966
},
7067
},
7168
}
@@ -88,20 +85,23 @@ This is the agent-facing decision tree:
8885
1. If the user asks for **Codex bind/control/thread/resume/steer/stop**, use the
8986
native `/codex` command surface when the bundled `codex` plugin is enabled.
9087
2. If the user asks for **Codex as the embedded runtime** or wants the normal
91-
subscription-backed Codex agent experience, use
92-
`openai/<model>` with `agentRuntime.id: "codex"`.
93-
3. If the user asks for **Codex OAuth/subscription auth on the normal OpenClaw
94-
runner**, use `openai-codex/<model>` and leave the runtime as PI.
95-
4. If the user explicitly says **ACP**, **acpx**, or **Codex ACP adapter**, use
88+
subscription-backed Codex agent experience, use `openai/<model>`.
89+
3. If the user explicitly chooses **PI for an OpenAI model**, keep the model ref
90+
as `openai/<model>` and set `agentRuntime.id: "pi"`. A selected
91+
`openai-codex` auth profile is routed internally through PI's legacy
92+
Codex-auth transport.
93+
4. If legacy config still contains **`openai-codex/*` model refs**, repair it to
94+
`openai/<model>` with `openclaw doctor --fix`.
95+
5. If the user explicitly says **ACP**, **acpx**, or **Codex ACP adapter**, use
9696
ACP with `runtime: "acp"` and `agentId: "codex"`.
97-
5. If the request is for **Claude Code, Gemini CLI, OpenCode, Cursor, Droid, or
97+
6. If the request is for **Claude Code, Gemini CLI, OpenCode, Cursor, Droid, or
9898
another external harness**, use ACP/acpx, not the native sub-agent runtime.
9999

100100
| You mean... | Use... |
101101
| --------------------------------------- | -------------------------------------------- |
102102
| Codex app-server chat/thread control | `/codex ...` from the bundled `codex` plugin |
103-
| Codex app-server embedded agent runtime | `agentRuntime.id: "codex"` |
104-
| OpenAI Codex OAuth on the PI runner | `openai-codex/*` model refs |
103+
| Codex app-server embedded agent runtime | `openai/*` agent model refs |
104+
| OpenAI Codex OAuth | `openai-codex` auth profiles |
105105
| Claude Code or other external harness | ACP/acpx |
106106

107107
For the OpenAI-family prefix split, see [OpenAI](/providers/openai) and
@@ -166,17 +166,17 @@ Legacy refs such as `claude-cli/claude-opus-4-7` remain supported for
166166
compatibility, but new config should keep the provider/model canonical and put
167167
the execution backend in `agentRuntime.id`.
168168

169-
`auto` mode is intentionally conservative. Plugin runtimes can claim
170-
provider/model pairs they understand, but the Codex plugin does not claim the
171-
`openai-codex` provider in `auto` mode. That keeps
172-
`openai-codex/*` as the explicit PI Codex OAuth route and avoids silently
173-
moving subscription-auth configs onto the native app-server harness.
169+
`auto` mode is intentionally conservative for most providers. OpenAI agent
170+
models are the exception: unset runtime and `auto` both resolve to the Codex
171+
harness. Explicit PI runtime config remains an opt-in compatibility route for
172+
`openai/*` agent turns; when paired with a selected `openai-codex` auth profile,
173+
OpenClaw routes PI internally through the legacy Codex-auth transport while
174+
keeping the public model ref as `openai/*`. Stale OpenAI PI session pins without
175+
explicit config are repaired back to Codex.
174176

175177
If `openclaw doctor` warns that the `codex` plugin is enabled while
176-
`openai-codex/*` still routes through PI, treat that as a diagnosis, not a
177-
migration. Keep the config unchanged when PI Codex OAuth is what you want.
178-
Switch to `openai/<model>` plus `agentRuntime.id: "codex"` only when you want native
179-
Codex app-server execution.
178+
`openai-codex/*` remains in config, treat that as legacy route state. Run
179+
`openclaw doctor --fix` to rewrite it to `openai/*` with the Codex runtime.
180180

181181
## Compatibility contract
182182

docs/gateway/config-agents.md

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -387,7 +387,7 @@ Time format in system prompt. Default: `auto` (OS preference).
387387
- `toolProgressDetail`: detail mode for `/verbose` tool summaries and progress-draft tool lines. Values: `"explain"` (default, compact human labels) or `"raw"` (append raw command/detail when available). Per-agent `agents.list[].toolProgressDetail` overrides this default.
388388
- `reasoningDefault`: default reasoning visibility for agents. Values: `"off"`, `"on"`, `"stream"`. Per-agent `agents.list[].reasoningDefault` overrides this default. Configured reasoning defaults are only applied for owners, authorized senders, or operator-admin gateway contexts when no per-message or session reasoning override is set.
389389
- `elevatedDefault`: default elevated-output level for agents. Values: `"off"`, `"on"`, `"ask"`, `"full"`. Default: `"on"`.
390-
- `model.primary`: format `provider/model` (e.g. `openai/gpt-5.5` for API-key access or `openai-codex/gpt-5.5` for Codex OAuth). If you omit the provider, OpenClaw tries an alias first, then a unique configured-provider match for that exact model id, and only then falls back to the configured default provider (deprecated compatibility behavior, so prefer explicit `provider/model`). If that provider no longer exposes the configured default model, OpenClaw falls back to the first configured provider/model instead of surfacing a stale removed-provider default.
390+
- `model.primary`: format `provider/model` (e.g. `openai/gpt-5.5` for OpenAI API-key or Codex OAuth access). If you omit the provider, OpenClaw tries an alias first, then a unique configured-provider match for that exact model id, and only then falls back to the configured default provider (deprecated compatibility behavior, so prefer explicit `provider/model`). If that provider no longer exposes the configured default model, OpenClaw falls back to the first configured provider/model instead of surfacing a stale removed-provider default.
391391
- `models`: the configured model catalog and allowlist for `/model`. Each entry can include `alias` (shortcut) and `params` (provider-specific, for example `temperature`, `maxTokens`, `cacheRetention`, `context1m`, `responsesServerCompaction`, `responsesCompactThreshold`, `chat_template_kwargs`, `extra_body`/`extraBody`).
392392
- Safe edits: use `openclaw config set agents.defaults.models '<json>' --strict-json --merge` to add entries. `config set` refuses replacements that would remove existing allowlist entries unless you pass `--replace`.
393393
- Provider-scoped configure/onboarding flows merge selected provider models into this map and preserve unrelated providers already configured.
@@ -426,24 +426,24 @@ model, see [Agent runtimes](/concepts/agent-runtimes).
426426
- `id`: `"auto"`, `"pi"`, a registered plugin harness id, or a supported CLI backend alias. The bundled Codex plugin registers `codex`; the bundled Anthropic plugin provides the `claude-cli` CLI backend.
427427
- `id: "auto"` lets registered plugin harnesses claim supported turns and uses PI when no harness matches. An explicit plugin runtime such as `id: "codex"` requires that harness and fails closed if it is unavailable or fails.
428428
- Environment override: `OPENCLAW_AGENT_RUNTIME=<id|auto|pi>` overrides `id` for that process.
429-
- For Codex-only deployments, set `model: "openai/gpt-5.5"` and `agentRuntime.id: "codex"`.
429+
- OpenAI agent models use the Codex harness by default; `agentRuntime.id: "codex"` remains valid when you want to make that explicit.
430430
- For Claude CLI deployments, prefer `model: "anthropic/claude-opus-4-7"` plus `agentRuntime.id: "claude-cli"`. Legacy `claude-cli/claude-opus-4-7` model refs still work for compatibility, but new config should keep provider/model selection canonical and put the execution backend in `agentRuntime.id`.
431431
- Older runtime-policy keys are rewritten to `agentRuntime` by `openclaw doctor --fix`.
432-
- Harness choice is pinned per session id after the first embedded run. Config/env changes affect new or reset sessions, not an existing transcript. Legacy sessions with transcript history but no recorded pin are treated as PI-pinned. `/status` reports the effective runtime, for example `Runtime: OpenClaw Pi Default` or `Runtime: OpenAI Codex`.
432+
- Harness choice is pinned per session id after the first embedded run. Config/env changes affect new or reset sessions, not an existing transcript. Legacy OpenAI sessions with transcript history but no recorded pin use Codex; stale OpenAI PI pins can be repaired with `openclaw doctor --fix`. `/status` reports the effective runtime, for example `Runtime: OpenClaw Pi Default` or `Runtime: OpenAI Codex`.
433433
- This only controls text agent-turn execution. Media generation, vision, PDF, music, video, and TTS still use their provider/model settings.
434434

435435
**Built-in alias shorthands** (only apply when the model is in `agents.defaults.models`):
436436

437-
| Alias | Model |
438-
| ------------------- | ------------------------------------------ |
439-
| `opus` | `anthropic/claude-opus-4-6` |
440-
| `sonnet` | `anthropic/claude-sonnet-4-6` |
441-
| `gpt` | `openai/gpt-5.5` or `openai-codex/gpt-5.5` |
442-
| `gpt-mini` | `openai/gpt-5.4-mini` |
443-
| `gpt-nano` | `openai/gpt-5.4-nano` |
444-
| `gemini` | `google/gemini-3.1-pro-preview` |
445-
| `gemini-flash` | `google/gemini-3-flash-preview` |
446-
| `gemini-flash-lite` | `google/gemini-3.1-flash-lite-preview` |
437+
| Alias | Model |
438+
| ------------------- | -------------------------------------- |
439+
| `opus` | `anthropic/claude-opus-4-6` |
440+
| `sonnet` | `anthropic/claude-sonnet-4-6` |
441+
| `gpt` | `openai/gpt-5.5` |
442+
| `gpt-mini` | `openai/gpt-5.4-mini` |
443+
| `gpt-nano` | `openai/gpt-5.4-nano` |
444+
| `gemini` | `google/gemini-3.1-pro-preview` |
445+
| `gemini-flash` | `google/gemini-3-flash-preview` |
446+
| `gemini-flash-lite` | `google/gemini-3.1-flash-lite-preview` |
447447

448448
Your configured aliases always win over defaults.
449449

docs/gateway/doctor.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -264,7 +264,7 @@ That stages grounded durable candidates into the short-term dreaming store while
264264
If you previously added legacy OpenAI transport settings under `models.providers.openai-codex`, they can shadow the built-in Codex OAuth provider path that newer releases use automatically. Doctor warns when it sees those old transport settings alongside Codex OAuth so you can remove or rewrite the stale transport override and get the built-in routing/fallback behavior back. Custom proxies and header-only overrides are still supported and do not trigger this warning.
265265
</Accordion>
266266
<Accordion title="2f. Codex route repair">
267-
Doctor checks for legacy `openai-codex/*` model refs. Native Codex harness routing uses canonical `openai/*` model refs plus `agentRuntime.id: "codex"` so the turn goes through the Codex app-server harness instead of the OpenClaw PI OpenAI path.
267+
Doctor checks for legacy `openai-codex/*` model refs. Native Codex harness routing uses canonical `openai/*` model refs; OpenAI agent turns go through the Codex app-server harness instead of the OpenClaw PI OpenAI path.
268268

269269
In `--fix` / `--repair` mode, doctor rewrites affected default-agent and per-agent refs, including primary models, fallbacks, heartbeat/subagent/compaction overrides, hooks, channel model overrides, and stale persisted session route state:
270270

docs/help/faq-first-run.md

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -597,26 +597,26 @@ and troubleshooting see the main [FAQ](/help/faq).
597597
`openai/gpt-5.5` with `agentRuntime.id: "codex"` for the common setup:
598598
ChatGPT/Codex subscription auth plus native Codex app-server execution. Use
599599
`openai-codex/gpt-5.5` only when you want Codex OAuth through the default
600-
PI runner. Use `openai/gpt-5.5` without the Codex runtime override for
601-
direct OpenAI API-key access.
600+
Codex runtime. Direct OpenAI API-key access remains available for non-agent
601+
OpenAI API surfaces and for agent models through an ordered
602+
`openai-codex` API-key profile.
602603
See [Model providers](/concepts/model-providers) and [Onboarding (CLI)](/start/wizard).
603604
</Accordion>
604605

605606
<Accordion title="Why does OpenClaw still mention openai-codex?">
606607
`openai-codex` is the provider and auth-profile id for ChatGPT/Codex OAuth.
607-
It is also the explicit PI model prefix for Codex OAuth:
608+
Older configs also used it as a model prefix:
608609

609-
- `openai/gpt-5.5` + `agentRuntime.id: "codex"` = ChatGPT/Codex subscription auth with native Codex runtime
610-
- `openai-codex/gpt-5.5` = Codex OAuth route in PI
611-
- `openai/gpt-5.5` without a Codex runtime override = direct OpenAI API-key route in PI
610+
- `openai/gpt-5.5` = ChatGPT/Codex subscription auth with native Codex runtime for agent turns
611+
- `openai-codex/gpt-5.5` = legacy model route repaired by `openclaw doctor --fix`
612+
- `openai/gpt-5.5` plus an ordered `openai-codex` API-key profile = API-key auth for an OpenAI agent model
612613
- `openai-codex:...` = auth profile id, not a model ref
613614

614615
If you want the direct OpenAI Platform billing/limit path, set
615616
`OPENAI_API_KEY`. If you want ChatGPT/Codex subscription auth, sign in with
616-
`openclaw models auth login --provider openai-codex`. For native Codex
617-
runtime, keep the model ref as `openai/gpt-5.5` and set
618-
`agentRuntime.id: "codex"`. Use `openai-codex/*` model refs only for PI
619-
runs.
617+
`openclaw models auth login --provider openai-codex`. Keep the model ref as
618+
`openai/gpt-5.5`; `openai-codex/*` model refs are legacy config that
619+
`openclaw doctor --fix` rewrites.
620620

621621
</Accordion>
622622

0 commit comments

Comments
 (0)