Best possible solution:

Land a targeted provider/transport fix after maintainer review and green relevant checks, keeping the OAuth injection wrapper intact for embedded openai-codex runs while stripping only fields rejected by the native ChatGPT Codex backend.

Do we have a high-confidence way to reproduce the issue?

Yes. The high-confidence static reproduction path is current main resolving a boundary-aware OAuth-injecting Codex stream, then the attribution wrapper replacing that stream with a fresh Responses transport before the request is sent.

Is this the best way to solve the issue?

Yes. The PR appears to be the narrowest maintainable fix because it preserves an existing wrapped stream, creates a native Codex transport only for the no-wrapper case, and limits payload sanitization to recognized native ChatGPT Codex URLs.

Acceptance criteria:

• node scripts/test-projects.mjs src/agents/pi-embedded-runner/openai-stream-wrappers.test.ts src/agents/pi-embedded-runner/stream-resolution.test.ts src/agents/openai-transport-stream.test.ts extensions/openai/openai-codex-provider.test.ts extensions/openai/openai-codex-auth-identity.test.ts
• pnpm build
• Optional live smoke with an OpenAI Codex OAuth profile: openclaw agent --agent main --message "Reply with exactly: OK" --json --timeout 180

What I checked:

• Current main bypasses the wrapped Codex stream: On current main, openai-codex attribution always selects a native Responses transport instead of the supplied underlying stream, matching the reported OAuth wrapper bypass path. (src/agents/pi-embedded-runner/openai-stream-wrappers.ts:501, 46888f5afbe9)
• Current main relies on a wrapped boundary-aware stream for OAuth: The embedded runner wraps boundary-aware transports so resolved runtime auth reaches options.apiKey; the comment explicitly calls out openai-codex/gpt-5.5 failing with missing bearer auth when that wrap is absent. (src/agents/pi-embedded-runner/stream-resolution.ts:107, 46888f5afbe9)
• PR preserves existing wrapped streams: The PR diff changes the attribution wrapper to create the native Codex transport only when the base stream is absent or streamSimple, and adds a regression test that the OAuth apiKey reaches the existing stream. (src/agents/pi-embedded-runner/openai-stream-wrappers.ts:498, 8f6606abbdef)
• Prior review concern was addressed: The current PR diff scopes unsupported-parameter stripping to recognized chatgpt.com/backend-api Codex URLs and includes tests preserving custom/proxy Codex-compatible params after payload hooks. (src/agents/openai-transport-stream.ts:876, 8f6606abbdef)
• Credential metadata matches an existing consumer: The Codex app-server auth bridge already reads accountId and chatgptPlanType from auth profile credentials, so persisting those non-secret JWT-derived fields fits the current auth handoff contract. (extensions/codex/src/app-server/auth-bridge.ts:260, 46888f5afbe9)
• Latest head checks are not all complete: Public check-runs for head 8f6606abbdef showed many successes, but build, lint, type, selected fast shards, and several security/quality checks were still queued or in progress during review. (8f6606abbdef)

Likely related people:

• steipete: GitHub commit history shows steipete authored the attribution change named by the PR root cause and most recent OpenAI Codex provider/auth route changes. (role: introduced behavior and recent OpenAI/Codex maintainer; confidence: high; commits: d1b2d81752b8, 3766bbb6745f, e6cd90e3fd9c; files: src/agents/pi-embedded-runner/openai-stream-wrappers.ts, src/agents/openai-transport-stream.ts, extensions/openai/openai-codex-provider.ts)
• @openclaw/openclaw-secops: CODEOWNERS routes src/agents auth-profile and auth-related surfaces to the secops owner group, and this PR changes OAuth credential metadata storage. (role: required adjacent reviewer; confidence: medium; files: .github/CODEOWNERS, src/agents/auth-profiles/types.ts, extensions/openai/openai-codex-provider.ts)
• pashpashpash: Recent history for the Codex app-server auth bridge includes several pashpashpash commits on fallback auth and effective env handoff, which is adjacent to the account metadata consumed by that bridge. (role: adjacent Codex auth maintainer; confidence: medium; commits: a412603bad53, 401ae38f13a3, 20ff49f7c82d; files: extensions/codex/src/app-server/auth-bridge.ts)

Remaining risk / open question:

• Latest PR head still needs completion of queued/in-progress CI before merge.
• The author-reported live OAuth smoke is useful, but this read-only review did not independently run a live OpenAI Codex OAuth request.

Codex review notes: model gpt-5.5, reasoning high; reviewed against 46888f5afbe9.