Skip to content

fix(auth): clarify Codex OAuth region failures#71501

Merged
vincentkoc merged 1 commit intomainfrom
fix/codex-oauth-region-error
Apr 25, 2026
Merged

fix(auth): clarify Codex OAuth region failures#71501
vincentkoc merged 1 commit intomainfrom
fix/codex-oauth-region-error

Conversation

@vincentkoc
Copy link
Copy Markdown
Member

Summary

  • Detect OpenAI unsupported_country_region_territory failures from the Codex OAuth token exchange.
  • Rewrite that opaque provider response into a stable unsupported_region OAuth error with proxy/region guidance.
  • Add regression coverage and a changelog entry.

Fixes #51175

Validation

  • OPENCLAW_LOCAL_CHECK=0 pnpm test src/plugins/provider-openai-codex-oauth.test.ts
  • OPENCLAW_LOCAL_CHECK=0 pnpm check:changed

@vincentkoc vincentkoc added the dedupe:parent Primary canonical item in dedupe cluster label Apr 25, 2026
@vincentkoc vincentkoc self-assigned this Apr 25, 2026
@openclaw-barnacle openclaw-barnacle Bot added size: XS maintainer Maintainer-authored PR labels Apr 25, 2026
@vincentkoc vincentkoc marked this pull request as ready for review April 25, 2026 09:18
@greptile-apps
Copy link
Copy Markdown
Contributor

greptile-apps Bot commented Apr 25, 2026

Greptile Summary

This PR adds detection of OpenAI's unsupported_country_region_territory token-exchange failure and rewrites it into a stable unsupported_region OAuth error with actionable proxy guidance, replacing the previously opaque generic OAuth error. The change is confined to the error-rewriting helper in provider-openai-codex-oauth.ts, with a corresponding regression test and a changelog entry.

Confidence Score: 5/5

This PR is safe to merge — the change is a narrow, well-tested error-message rewrite with no side-effects on the happy path.

The new branch in rewriteOpenAICodexOAuthError is placed before the existing checks, uses a case-insensitive regex, correctly threads the original error as cause, and the test verifies all three observable side-effects (spin label, runtime.error content, and the FAQ note). No logic issues, no security concerns, and no missing edge cases were found.

No files require special attention.

Reviews (1): Last reviewed commit: "fix(auth): clarify Codex OAuth region fa..." | Re-trigger Greptile

Copy link
Copy Markdown

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: f9029d066d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".


function rewriteOpenAICodexOAuthError(error: unknown): Error {
const message = formatErrorMessage(error);
if (/unsupported_country_region_territory/i.test(message)) {
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Match surfaced token-exchange errors, not hidden response text

The new rewrite branch depends on unsupported_country_region_territory appearing in the thrown error message, but in the currently bundled dependency (node_modules/@mariozechner/pi-ai/dist/utils/oauth/openai-codex.js) the OAuth flow throws new Error("Token exchange failed") after a non-OK token response and does not propagate the response body text. In that real 403 region-denied path, this regex never matches, so users still get the generic OAuth failure with no region/proxy guidance despite the new changelog claim.

Useful? React with 👍 / 👎.

@vincentkoc vincentkoc force-pushed the fix/codex-oauth-region-error branch from f9029d0 to 7f67c3a Compare April 25, 2026 09:28
@vincentkoc vincentkoc merged commit 65ea6a0 into main Apr 25, 2026
65 checks passed
@vincentkoc vincentkoc deleted the fix/codex-oauth-region-error branch April 25, 2026 09:31
vincentkoc added a commit that referenced this pull request Apr 25, 2026
… Unreleased

Three of my (vincentkoc) entries were missing closing PR refs, and
several maintainer-fix entries were missing credit for the user who
reported the underlying issue:

- Diagnostics/OTEL outbound delivery: add (#71471) and credit @jlapenna
  whose #70424 framed the broader tracing work.
- Cron malformed legacy jobs: add (#71509).
- OpenAI/Codex OAuth region failures: add (#71501) and credit reporter
  @wulala-xjj (#51175).
- Telegram duplicate pollers: credit reporter @Co-Messi (#56230).
- MCP/CLI one-shot retire: credit reporter @spartoviMD (#71457).
- OpenAI/Codex image baseUrl canonicalize: credit reporter @GodsBoy
  (#71460).
- Feishu TTS Ogg/Opus: credit reporters @sg1416-zg (#61249) and
  @ycjlb2023-peteryi (#37868).
- MiniMax TTS portal OAuth: credit reporter @zx15210404690-hash
  (#55017).
- MCP config reload disposal: credit reporter @xieyuanqing (#60656).
Angfr95 pushed a commit to Angfr95/openclaw that referenced this pull request Apr 25, 2026
Angfr95 pushed a commit to Angfr95/openclaw that referenced this pull request Apr 25, 2026
… Unreleased

Three of my (vincentkoc) entries were missing closing PR refs, and
several maintainer-fix entries were missing credit for the user who
reported the underlying issue:

- Diagnostics/OTEL outbound delivery: add (openclaw#71471) and credit @jlapenna
  whose openclaw#70424 framed the broader tracing work.
- Cron malformed legacy jobs: add (openclaw#71509).
- OpenAI/Codex OAuth region failures: add (openclaw#71501) and credit reporter
  @wulala-xjj (openclaw#51175).
- Telegram duplicate pollers: credit reporter @Co-Messi (openclaw#56230).
- MCP/CLI one-shot retire: credit reporter @spartoviMD (openclaw#71457).
- OpenAI/Codex image baseUrl canonicalize: credit reporter @GodsBoy
  (openclaw#71460).
- Feishu TTS Ogg/Opus: credit reporters @sg1416-zg (openclaw#61249) and
  @ycjlb2023-peteryi (openclaw#37868).
- MiniMax TTS portal OAuth: credit reporter @zx15210404690-hash
  (openclaw#55017).
- MCP config reload disposal: credit reporter @xieyuanqing (openclaw#60656).
ayesha-aziz123 pushed a commit to ayesha-aziz123/openclaw that referenced this pull request Apr 26, 2026
ayesha-aziz123 pushed a commit to ayesha-aziz123/openclaw that referenced this pull request Apr 26, 2026
… Unreleased

Three of my (vincentkoc) entries were missing closing PR refs, and
several maintainer-fix entries were missing credit for the user who
reported the underlying issue:

- Diagnostics/OTEL outbound delivery: add (openclaw#71471) and credit @jlapenna
  whose openclaw#70424 framed the broader tracing work.
- Cron malformed legacy jobs: add (openclaw#71509).
- OpenAI/Codex OAuth region failures: add (openclaw#71501) and credit reporter
  @wulala-xjj (openclaw#51175).
- Telegram duplicate pollers: credit reporter @Co-Messi (openclaw#56230).
- MCP/CLI one-shot retire: credit reporter @spartoviMD (openclaw#71457).
- OpenAI/Codex image baseUrl canonicalize: credit reporter @GodsBoy
  (openclaw#71460).
- Feishu TTS Ogg/Opus: credit reporters @sg1416-zg (openclaw#61249) and
  @ycjlb2023-peteryi (openclaw#37868).
- MiniMax TTS portal OAuth: credit reporter @zx15210404690-hash
  (openclaw#55017).
- MCP config reload disposal: credit reporter @xieyuanqing (openclaw#60656).
eleqtrizit pushed a commit to eleqtrizit/openclaw that referenced this pull request Apr 29, 2026
… Unreleased

Three of my (vincentkoc) entries were missing closing PR refs, and
several maintainer-fix entries were missing credit for the user who
reported the underlying issue:

- Diagnostics/OTEL outbound delivery: add (openclaw#71471) and credit @jlapenna
  whose openclaw#70424 framed the broader tracing work.
- Cron malformed legacy jobs: add (openclaw#71509).
- OpenAI/Codex OAuth region failures: add (openclaw#71501) and credit reporter
  @wulala-xjj (openclaw#51175).
- Telegram duplicate pollers: credit reporter @Co-Messi (openclaw#56230).
- MCP/CLI one-shot retire: credit reporter @spartoviMD (openclaw#71457).
- OpenAI/Codex image baseUrl canonicalize: credit reporter @GodsBoy
  (openclaw#71460).
- Feishu TTS Ogg/Opus: credit reporters @sg1416-zg (openclaw#61249) and
  @ycjlb2023-peteryi (openclaw#37868).
- MiniMax TTS portal OAuth: credit reporter @zx15210404690-hash
  (openclaw#55017).
- MCP config reload disposal: credit reporter @xieyuanqing (openclaw#60656).
ogt-redknie pushed a commit to ogt-redknie/OPENX that referenced this pull request May 2, 2026
ogt-redknie pushed a commit to ogt-redknie/OPENX that referenced this pull request May 2, 2026
… Unreleased

Three of my (vincentkoc) entries were missing closing PR refs, and
several maintainer-fix entries were missing credit for the user who
reported the underlying issue:

- Diagnostics/OTEL outbound delivery: add (openclaw#71471) and credit @jlapenna
  whose openclaw#70424 framed the broader tracing work.
- Cron malformed legacy jobs: add (openclaw#71509).
- OpenAI/Codex OAuth region failures: add (openclaw#71501) and credit reporter
  @wulala-xjj (openclaw#51175).
- Telegram duplicate pollers: credit reporter @Co-Messi (openclaw#56230).
- MCP/CLI one-shot retire: credit reporter @spartoviMD (openclaw#71457).
- OpenAI/Codex image baseUrl canonicalize: credit reporter @GodsBoy
  (openclaw#71460).
- Feishu TTS Ogg/Opus: credit reporters @sg1416-zg (openclaw#61249) and
  @ycjlb2023-peteryi (openclaw#37868).
- MiniMax TTS portal OAuth: credit reporter @zx15210404690-hash
  (openclaw#55017).
- MCP config reload disposal: credit reporter @xieyuanqing (openclaw#60656).
github-actions Bot pushed a commit to Desicool/openclaw that referenced this pull request May 9, 2026
github-actions Bot pushed a commit to Desicool/openclaw that referenced this pull request May 9, 2026
… Unreleased

Three of my (vincentkoc) entries were missing closing PR refs, and
several maintainer-fix entries were missing credit for the user who
reported the underlying issue:

- Diagnostics/OTEL outbound delivery: add (openclaw#71471) and credit @jlapenna
  whose openclaw#70424 framed the broader tracing work.
- Cron malformed legacy jobs: add (openclaw#71509).
- OpenAI/Codex OAuth region failures: add (openclaw#71501) and credit reporter
  @wulala-xjj (openclaw#51175).
- Telegram duplicate pollers: credit reporter @Co-Messi (openclaw#56230).
- MCP/CLI one-shot retire: credit reporter @spartoviMD (openclaw#71457).
- OpenAI/Codex image baseUrl canonicalize: credit reporter @GodsBoy
  (openclaw#71460).
- Feishu TTS Ogg/Opus: credit reporters @sg1416-zg (openclaw#61249) and
  @ycjlb2023-peteryi (openclaw#37868).
- MiniMax TTS portal OAuth: credit reporter @zx15210404690-hash
  (openclaw#55017).
- MCP config reload disposal: credit reporter @xieyuanqing (openclaw#60656).
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dedupe:parent Primary canonical item in dedupe cluster maintainer Maintainer-authored PR size: XS

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Bug]: openai-codex OAuth fails with 403 unsupported_country_region_territory while codex-cli works

1 participant