Summary

Remote/VPS OpenAI Codex OAuth regressed after updating @mariozechner/pi-ai to 0.60.0.

OpenClaw already depends on Pi 0.60.0, which changed Codex OAuth flow behavior to support immediate callback resolution and manual pasted auth input racing with the localhost callback. OpenClaw's Codex OAuth wrapper did not adapt to that newer flow for remote environments, so remote login can stall/fail instead of accepting the pasted redirect/code promptly.

Root cause

src/plugins/provider-openai-codex-oauth.ts passes onAuth and onPrompt to loginOpenAICodex(...), but does not pass the newer onManualCodeInput hook for remote/VPS flows.

As a result:

• local/browser-based OAuth may still work
• remote/VPS OAuth can fail to complete cleanly
• agents may silently fall back to configured model fallbacks when Codex auth breaks

Expected behavior

For remote Codex OAuth, OpenClaw should pass a manual input hook so pasted authorization code / redirect URL is handled correctly with the Pi 0.60.0 flow.

Proposed fix

When isRemote === true, pass:

• onManualCodeInput: async () => onPrompt({ message: "Paste the authorization code (or full redirect URL):" })

and add tests covering the remote manual-input path.

Validation

• Added unit coverage for the remote manual input hook
• Existing Codex OAuth tests pass locally

Notes

This looks like an OpenClaw integration regression caused by the Pi 0.60.0 auth flow changes, not necessarily a Pi bug by itself.