Best possible solution:

Land the focused eligibility fix after maintainer review and after the contributor adds redacted real Codex runtime proof that an oauthRef-backed profile is selected without missing auth.

Do we have a high-confidence way to reproduce the issue?

Yes, source-level. On current main, construct an OpenAI Codex OAuth credential with missing or blank access and refresh plus a valid oauthRef; evaluateStoredCredentialEligibility returns missing_credential, and resolveAuthProfileOrder filters it out before the app-server can select it.

Is this the best way to solve the issue?

Yes, the proposed direction is narrow and matches the existing SecretRef-style eligibility contract by treating a valid Codex oauthRef as configured. The remaining gate is proof and maintainer confirmation, not a different code shape.

What I checked:

• Current-main eligibility gap: On current main, OAuth eligibility returns missing_credential when both access and refresh normalize as missing; it does not inspect oauthRef, so an oauthRef-only Codex profile is rejected before runtime selection. (src/agents/auth-profiles/credential-state.ts:105, fe89243c3b24)
• Auth order depends on eligibility: resolveAuthProfileOrder filters candidate profile IDs through resolveAuthProfileEligibility, which delegates to credential eligibility; a missing_credential result removes the profile from runtime order. (src/agents/auth-profiles/order.ts:292, fe89243c3b24)
• Codex app-server uses auth order: When no profile is explicitly requested, resolveCodexAppServerAuthProfileId selects the first resolveAuthProfileOrder(..., provider: "openai-codex") result, so the eligibility filter reaches app-server login selection. (extensions/codex/src/app-server/auth-bridge.ts:78, fe89243c3b24)
• oauthRef is a persisted credential contract: The auth profile types define OAuthCredentialRef as an openclaw-credentials reference for openai-codex, and persistence omits inline OAuth secrets while storing oauthRef metadata after secret material is written. (src/agents/auth-profiles/types.ts:19, fe89243c3b24)
• PR patch scope: The PR adds a valid-oauthRef eligibility check plus focused tests for credential eligibility, auth ordering, and Codex app-server profile selection. (src/agents/auth-profiles/credential-state.ts:69, c6e1276ef7ab)
• Related PR does not supersede this code path: The merged related PR classified Codex app-server auth refresh failures and changed error-formatting/client tests, but it did not touch credential-state.ts, order.ts, or app-server auth profile selection. (3b8ac38ae9ee)

Likely related people:

• steipete: Recent auth-profile contract work touched credential-state.ts, order.ts, persisted.ts, OAuth handling, docs, and status surfaces central to this PR. (role: recent auth-profile contributor; confidence: high; commits: 8e179101914e, 1e8564cb13c3; files: src/agents/auth-profiles/credential-state.ts, src/agents/auth-profiles/order.ts, src/agents/auth-profiles/persisted.ts)
• jeffjhunter: Recent Codex app-server OAuth harness work touched auth-bridge.ts, auth-bridge.test.ts, SDK auth exports, and OAuth runtime paths adjacent to the selected-profile behavior. (role: recent Codex app-server OAuth contributor; confidence: medium; commits: 850d685d4bec; files: extensions/codex/src/app-server/auth-bridge.ts, extensions/codex/src/app-server/auth-bridge.test.ts, src/agents/auth-profiles/oauth.ts)
• pashpashpash: Recent app-server launch work touched auth-bridge.ts and its tests, the same file where implicit Codex auth profile selection happens. (role: recent Codex app-server auth-bridge contributor; confidence: medium; commits: 74860e93fd6e; files: extensions/codex/src/app-server/auth-bridge.ts, extensions/codex/src/app-server/auth-bridge.test.ts)
• vincentkoc: The merged related PR handled adjacent Codex app-server auth refresh classification and local history/blame points to recent auth-profile and app-server activity under this name. (role: adjacent auth-refresh contributor; confidence: medium; commits: 3b8ac38ae9ee, d08f68dee733; files: extensions/codex/src/app-server/client.ts, src/agents/auth-profiles/credential-state.ts, src/agents/auth-profiles/order.ts)

Remaining risk / open question:

• Contributor real behavior proof is still absent; tests/checks alone do not show the oauthRef-backed Codex app-server runtime path working after the patch.
• The author’s earlier “Superseded by” note points to a merged related PR that appears adjacent rather than equivalent, so a maintainer should confirm whether this PR should still land.

Codex review notes: model gpt-5.5, reasoning high; reviewed against fe89243c3b24.