Summary

openclaw models status still reports the openai provider auth overview as effective=missing when the provider is configured with the non-secret delegated OAuth marker apiKey: "oauth:openai-codex".

This is narrower than #83654. The important health signal is now correct: auth.missingProvidersInUse=[] and --check exits 0. But the human-readable provider row still says openai effective=missing:missing, which makes a healthy Codex-runtime setup look partially broken.

Environment

• OpenClaw: 2026.5.12 (f066dd2)
• Install: pnpm
• OS: macOS 26.5 arm64
• Runtime: native Codex app-server / agentRuntime.id="codex"
• Default model: openai/gpt-5.5
• Auth profile: openai-codex:<account> OAuth, healthy

Current config shape

Sanitized ~/.openclaw/agents/main/agent/models.json provider entry:

{
  "providers": {
    "openai": {
      "baseUrl": "https://api.openai.com/v1",
      "apiKey": "oauth:openai-codex",
      "api": "openai-responses",
      "models": [
        {
          "id": "gpt-5.5",
          "name": "GPT-5.5",
          "api": "openai-responses"
        }
      ]
    },
    "openai-codex": {
      "baseUrl": "https://chatgpt.com/backend-api",
      "api": "openai-codex-responses"
    }
  }
}

Auth profile store contains a valid openai-codex:<account> OAuth profile.

Observed output

openclaw models status --check exits 0 and correctly omits the old Missing auth section, but the auth overview includes:

Auth overview
Providers w/ OAuth/tokens (1): openai-codex (1)
- openai effective=missing:missing | models.json=marker(oauth:openai-codex) | source=models.json: ~/.openclaw/agents/main/agent/models.json
- openai-codex effective=profiles:~/.openclaw/agents/main/agent/auth-profiles.json | profiles=1 (oauth=1, token=0, api_key=0) | openai-codex:<account>=OAuth (<account>)

openclaw models status --json similarly reports:

{
  "defaultModel": "openai/gpt-5.5",
  "auth": {
    "missingProvidersInUse": [],
    "providers": [
      {
        "provider": "openai",
        "effective": {
          "kind": "missing",
          "detail": "missing"
        },
        "modelsJson": {
          "value": "marker(oauth:openai-codex)",
          "source": "models.json: ~/.openclaw/agents/main/agent/models.json"
        }
      },
      {
        "provider": "openai-codex",
        "effective": {
          "kind": "profiles",
          "detail": "~/.openclaw/agents/main/agent/auth-profiles.json"
        }
      }
    ]
  }
}

Expected behavior

The openai provider overview should not say effective=missing when the configured provider auth is an explicit non-secret OAuth delegation marker.

Possible output:

- openai effective=models.json:marker(oauth:openai-codex) | models.json=marker(oauth:openai-codex) | source=...

or:

- openai effective=delegated:openai-codex OAuth | models.json=marker(oauth:openai-codex) | source=...

The key requirement is that the display remains truthful: direct OpenAI API key auth is absent, but the configured auth marker is intentional delegated auth evidence, not simply missing.

Root cause notes

In the built dist for 2026.5.12, resolveProviderAuthOverview in list.status-command-*.js builds:

• customKey from getCustomProviderApiKey(cfg, provider)
• usableCustomKey from resolveUsableCustomProviderApiKey(...)

For non-secret markers like oauth:openai-codex, isNonSecretApiKeyMarker(customKey) is true, but resolveUsableCustomProviderApiKey returns null unless it can resolve a concrete env/local key. The status display then falls through to:

return {
  kind: "missing",
  detail: "missing"
};

even though the same provider row also includes:

models.json=marker(oauth:openai-codex)

Local hotfix that resolved the display

I locally patched the status overview to treat OAuth markers as effective models.json auth evidence for display:

if (typeof customKey === "string" && customKey.trim().startsWith("oauth:")) return {
  kind: "models.json",
  detail: formatMarkerOrSecret(customKey)
};

After that, the CLI reports:

- openai effective=models.json:marker(oauth:openai-codex) | models.json=marker(oauth:openai-codex) | source=models.json: ~/.openclaw/agents/main/agent/models.json
- openai-codex effective=profiles:~/.openclaw/agents/main/agent/auth-profiles.json | profiles=1 (oauth=1, token=0, api_key=0) | openai-codex:<account>=OAuth (<account>)

and --json reports:

{
  "provider": "openai",
  "effective": {
    "kind": "models.json",
    "detail": "marker(oauth:openai-codex)"
  },
  "modelsJson": {
    "value": "marker(oauth:openai-codex)"
  }
}

Acceptance criteria

• openclaw models status no longer prints openai effective=missing:missing when models.json contains apiKey: "oauth:openai-codex".
• openclaw models status --json exposes an effective value that reflects the delegated marker, or otherwise distinguishes delegated marker auth from missing auth.
• Direct OpenAI API-key absence remains clear, so users are not misled into thinking a direct OPENAI_API_KEY exists.
• auth.missingProvidersInUse=[] and --check behavior remain unchanged for healthy Codex-runtime setups.
• Add a regression test for an openai provider with apiKey: "oauth:openai-codex" and a valid openai-codex OAuth profile.