Summary

When using openai-codex/gpt-5.4 as the model, the embedded agent's WebSocket streaming connection consistently fails with HTTP 500. The system falls back to HTTP, but the 500 errors continue to appear in gateway.err.log repeatedly.

When switching to other models (qianfan, glm-5, kimibd), the ws-stream 500 errors stop immediately.

Environment

• OpenClaw version: 2026.3.28
• OS: macOS 26.3.1 (Apple Silicon)
• Node: v24.13.1
• Install method: npm install -g openclaw
• Gateway mode: LaunchAgent (local loopback)
• Affected model: openai-codex/gpt-5.4 (OAuth)

Reproduction Steps

1. Start gateway: openclaw gateway
2. Set default model to openai-codex/gpt-5.4
3. Start a conversation that triggers embedded agent activity
4. Observe gateway.err.log

Control Experiments

We performed A/B testing with different models:

Key observation: Switching from GPT-5.4 to another model immediately stops the ws-stream 500 errors. Switching back to GPT-5.4 immediately reproduces the issue.

Logs

Sample from gateway.err.log:

2026-03-30T23:58:25.498+08:00 [agent/embedded] [ws-stream] WebSocket connect failed for session=99011fc6-e9b8-49a2-a43f-e31888ea4461; falling back to HTTP. error=Error: Unexpected server response: 500
2026-03-30T23:58:39.131+08:00 [agent/embedded] [ws-stream] WebSocket connect failed for session=99011fc6-e9b8-49a2-a43f-e31888ea4461; falling back to HTTP. error=Error: read ECONNRESET
2026-03-30T23:59:22.367+08:00 [agent/embedded] [ws-stream] WebSocket connect failed for session=99011fc6-e9b8-49a2-a43f-e31888ea4461; falling back to HTTP. error=Error: Unexpected server response: 500

Earlier in the session, there were also Codex OAuth errors:

2026-03-30T23:20:39.333+08:00 [openai-codex] Token refresh failed: 401 {
  "error": {
    "message": "Your refresh token has already been used to generate a new access token. Please try signing in again.",
    "type": "invalid_request_error",
    "param": null,
    "code": "refresh_token_reused"
  }
}

However, after re-authentication, the ws-stream 500 errors continued even when the OAuth flow was working correctly.

Root Cause Analysis

Based on our experiments:

1. Not a gateway-wide issue: The main gateway service is healthy and reachable
2. Not session-specific: The issue persists across new sessions
3. Not fixed by gateway restart: Restarting the gateway does not resolve the issue
4. Model/provider specific: Only occurs with openai-codex/gpt-5.4, not with other providers
5. Embedded/ws-stream layer issue: The 500 is returned by the gateway's WebSocket handler for embedded agent streaming

Hypothesis: The openai-codex provider path has some incompatibility with the current embedded/ws-stream implementation in OpenClaw 2026.3.28. This could be related to:

• Authentication token handling in the streaming path
• Provider-specific response handling
• Some protocol mismatch between the embedded agent and the gateway's ws-stream endpoint

Workaround

Use alternative models (qianfan, glm-5, kimibd) that do not trigger this issue.

Additional Context

• Gateway health check passes: curl localhost:18789/health returns {"ok":true,"status":"live"}
• openclaw status --deep shows no critical issues
• Main conversation works, only embedded agent streaming is affected