fix(codex): preserve plugin tool auth profiles

clawsweeper[bot] · clawsweeper[bot] · commit c226f54be0c2 · 2026-05-19T01:50:34.000Z
diff --git a/src/agents/pi-embedded-runner/run.overflow-compaction.test.ts b/src/agents/pi-embedded-runner/run.overflow-compaction.test.ts
@@ -500,15 +500,9 @@ describe("runEmbeddedPiAgent overflow compaction trigger routing", () => {
       toolAuthProfileStore?: unknown;
     };
     expect(harnessParams?.runtimePlan).toBe(runtimePlan);
-    expect(harnessParams.authProfileStore).toBe(codexAuthStore);
     const forwardedAuthStore = expectRecordFields(harnessParams.authProfileStore, {});
     const authProfiles = expectRecordFields(forwardedAuthStore.profiles, {});
-    expect(Object.keys(authProfiles)).toEqual([
-      "openai-codex:work",
-      "openai-codex:other",
-      "anthropic:work",
-      "xai:work",
-    ]);
+    expect(Object.keys(authProfiles)).toEqual(["openai-codex:work"]);
     expectRecordFields(authProfiles["openai-codex:work"], {
       provider: "openai-codex",
     });
@@ -854,11 +848,11 @@ describe("runEmbeddedPiAgent overflow compaction trigger routing", () => {
       authProfileStore?: { profiles?: Record<string, unknown> };
       toolAuthProfileStore?: unknown;
     };
-    expect(harnessParams.authProfileStore).toBe(codexAuthStore);
     const forwardedAuthStore = expectRecordFields(harnessParams.authProfileStore, {});
     const authProfiles = expectRecordFields(forwardedAuthStore.profiles, {});
-    expectRecordFields(authProfiles["xai:work"], {
-      provider: "xai",
+    expect(Object.keys(authProfiles)).toEqual(["openai-codex:default"]);
+    expectRecordFields(authProfiles["openai-codex:default"], {
+      provider: "openai-codex",
     });
     expect(harnessParams.toolAuthProfileStore).toBe(codexAuthStore);
   });
diff --git a/src/agents/pi-embedded-runner/run.ts b/src/agents/pi-embedded-runner/run.ts
@@ -973,18 +973,14 @@ export async function runEmbeddedPiAgent(
       }
       startupStages.mark("auth");
       notifyExecutionPhase("auth", { provider, model: modelId });
-      const codexHarnessOwnsTransport = pluginHarnessOwnsTransport && agentHarness.id === "codex";
-      // Codex builds OpenClaw tools inside its harness. Keep the full store on
-      // the existing field so installed Codex packages can resolve tool auth.
-      const runAttemptAuthProfileStore =
-        pluginHarnessOwnsTransport && !codexHarnessOwnsTransport
-          ? createScopedAuthProfileStore(
-              attemptAuthProfileStore,
-              pluginHarnessForwardedProfileCandidates.length > 0
-                ? pluginHarnessForwardedProfileCandidates
-                : lastProfileId,
-            )
-          : attemptAuthProfileStore;
+      const runAttemptAuthProfileStore = pluginHarnessOwnsTransport
+        ? createScopedAuthProfileStore(
+            attemptAuthProfileStore,
+            pluginHarnessForwardedProfileCandidates.length > 0
+              ? pluginHarnessForwardedProfileCandidates
+              : lastProfileId,
+          )
+        : attemptAuthProfileStore;
       const { sessionAgentId } = resolveSessionAgentIds({
         sessionKey: params.sessionKey,
         config: params.config,
@@ -1448,6 +1444,8 @@ export async function runEmbeddedPiAgent(
             initialReplayState: accumulatedReplayState,
             authStorage,
             authProfileStore: runAttemptAuthProfileStore,
+            // Codex builds OpenClaw tools inside its harness. Keep transport
+            // auth scoped while letting tool construction see plugin creds.
             toolAuthProfileStore: agentHarness.id === "codex" ? attemptAuthProfileStore : undefined,
             modelRegistry,
             agentId: workspaceResolution.agentId,
