Fix OpenAI Codex runtime provider routing by ragesaq · Pull Request #82864 · openclaw/openclaw

ragesaq · 2026-05-17T03:25:05Z

Summary

Route explicit OpenAI Codex harness runtime selections through the openai-codex provider.
Keep non-OpenAI providers unchanged when their runtime is codex.
Add regression coverage for provider: "openai" plus harnessRuntime: "codex".

Root Cause

OpenAI model selections can resolve to the Codex harness, but resolveSelectedOpenAIPiRuntimeProvider only switched openai to openai-codex for the PI runtime plus Codex auth-order case. That left explicit codex runtime selections on the plain openai provider path, which can miss the Codex OAuth provider contract.

Real behavior proof

Behavior or issue addressed: Explicit OpenAI Codex harness selections such as openai/gpt-5.5 with agentRuntime.id: "codex" should use the openai-codex provider and Codex OAuth path, not the plain openai API-key path.

Real environment tested: openclaw-prod, OpenClaw gateway logs from /tmp/openclaw/openclaw-2026-05-16.log, with auth details redacted.

Exact steps or command run after this patch: Patched production gateway was restarted, then Forge was run on openai/gpt-5.5 with Runtime: OpenAI Codex. The production gateway log was checked with redacted rg searches for openai/gpt-5.5, Runtime: OpenAI Codex, openai-codex, agentRuntime.id: "codex", and 401/API-key-path failures.

Evidence after fix: Redacted runtime log excerpt from openclaw-prod:

/tmp/openclaw/openclaw-2026-05-16.log:57104
When agentRuntime.id: "codex" was explicitly set, resolveSelectedOpenAIPiRuntimeProvider()
fell through to plain "openai", which used the API-key path. Forge only had OAuth credentials. 401.

/tmp/openclaw/openclaw-2026-05-16.log:56769
Verified: this session is now on openai/gpt-5.5 with Runtime: OpenAI Codex
and OAuth profile openai-codex:[EMAIL-REDACTED].

Gateway fallback logs also showed openai/gpt-5.5 routed as candidateProvider: "openai" with status: 401 and an incorrect API-key-path failure before the routing fix.

Observed result after fix: The live production session reported openai/gpt-5.5 running with Runtime: OpenAI Codex and an openai-codex OAuth profile. The focused regression test also proves the routing helper now maps provider: "openai" plus harnessRuntime: "codex" to openai-codex, while non-OpenAI providers remain unchanged.

What was not tested: Full npx tsc --noEmit did not complete because Node exhausted an 8 GB heap before type diagnostics. The repo-local pnpm check:changed gate passed.

Verification

node scripts/run-vitest.mjs src/agents/openai-codex-routing.test.ts
Test Files  1 passed (1)
Tests       9 passed (9)

pnpm check:changed
passed

codex review -c 'model_reasoning_effort="xhigh"' --base origin/main
No actionable correctness issues were identified in the changed routing logic or its focused tests.

Note: a direct npx tsc --noEmit run was attempted with an 8 GB Node heap and still failed with a Node heap OOM before reporting type diagnostics. The repo-local pnpm check:changed gate passed.

AI-assisted disclosure

AI-assisted: yes.

Tools/models used:

OpenAI Codex CLI v0.130.0 using gpt-5.5 with model_reasoning_effort="xhigh" for code review.
Forge/OpenClaw assistant session for patch preparation, validation, and PR packet assembly.

Prompt/session logs are not included in this PR body. Local review artifacts are available from the contributor environment if maintainers request them.

clawsweeper · 2026-05-17T03:26:06Z

Codex review: needs real behavior proof before merge.

Summary
The PR routes explicit OpenAI Codex harness runtime selections from openai to openai-codex, bootstraps OpenClaw OAuth auth for openai-codex-responses plugin-harness runs, refreshes credentials during profile rotation, updates regression tests, and adds Codex harness troubleshooting docs.

Reproducibility: yes. Source inspection on current main shows provider: "openai" plus Codex runtime falls through to the plain OpenAI provider while the adjacent auth-provider helper already selects openai-codex; I did not run the gateway in this read-only review.

Real behavior proof
Needs stronger real behavior proof before merge: Insufficient: supplied logs cover the initial routing fix and an intermediate failure, but not a successful live run at head e40d8ccd; add redacted terminal/log proof to the PR body so ClawSweeper can re-review, or ask a maintainer to comment @clawsweeper re-review if it does not trigger automatically. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, ask a maintainer to comment @clawsweeper re-review.

Next step before merge
Human handling is needed because this draft external PR needs current-head live proof and maintainer validation, not an automated code repair.

Security
Cleared: No concrete security or supply-chain regression was found; the diff changes existing auth routing/tests/docs and adds no dependencies, workflows, lifecycle scripts, or new secret sinks.

Review details

Best possible solution:

Land the narrow routing, OAuth-bootstrap, profile-rotation, regression-test, and troubleshooting-doc updates after the contributor or maintainer adds redacted live proof from the current head and the focused checks are green.

Do we have a high-confidence way to reproduce the issue?

Yes. Source inspection on current main shows provider: "openai" plus Codex runtime falls through to the plain OpenAI provider while the adjacent auth-provider helper already selects openai-codex; I did not run the gateway in this read-only review.

Is this the best way to solve the issue?

Yes, with a validation gate. Centralizing the routing fix in the selected-runtime helper plus a narrow openai-codex-responses auth-bootstrap path is maintainable, but the final branch head still needs real after-fix runtime proof before merge.

Acceptance criteria:

node scripts/run-vitest.mjs src/agents/openai-codex-routing.test.ts src/agents/pi-embedded-runner/run.overflow-compaction.test.ts
pnpm check:changed or the equivalent Testbox changed gate
Redacted live gateway proof at PR head for openai/gpt-5.5 or openai/gpt-5.4 with Runtime: OpenAI Codex using an openai-codex OAuth profile, with private IPs, API keys, phone numbers, non-public endpoints, and account details redacted

What I checked:

current-main routing gap: On current main, resolveSelectedOpenAIPiRuntimeProvider normalizes the selected runtime but only returns openai-codex for PI/Codex-auth-order cases; provider: "openai" plus runtime "codex" still falls through to params.provider. (src/agents/openai-codex-routing.ts:183, 421b9e281942)
adjacent auth contract: The adjacent auth-profile helper already maps OpenAI plus runtime codex to ["openai-codex"], so the PR aligns selected-runtime provider routing with the existing auth contract. (src/agents/openai-codex-routing.ts:125, 421b9e281942)
active runner call site: The embedded runner calls resolveSelectedOpenAIPiRuntimeProvider before model resolution and switches provider when a runtime-specific model resolves, making this helper the active path for explicit Codex runtime selections. (src/agents/pi-embedded-runner/run.ts:612, 421b9e281942)
PR routing diff: The PR adds a runtime === "codex" branch for OpenAI providers and preserves non-OpenAI provider routing when the selected runtime is Codex. (src/agents/openai-codex-routing.ts:181, c46f0e524989)
PR OAuth bootstrap diff: The PR adds a narrow pluginHarnessNeedsOpenClawAuthBootstrap exception for plugin harnesses using openai-codex plus openai-codex-responses, causing the runner to load OpenClaw auth profiles and call initializeAuthProfile(). (src/agents/pi-embedded-runner/run.ts:673, 349ee4a18ea0)
PR profile-rotation diff: The latest PR commit routes profile rotation through advanceAuthProfile for the OpenClaw-auth-bootstrap case so rotated Codex OAuth credentials are refreshed into the harness auth storage. (src/agents/pi-embedded-runner/run.ts:937, e40d8ccd6912)

Likely related people:

@steipete: Current-main blame owns the selected-runtime helper body, and the latest PR commit also adjusts the same embedded-runner auth/profile-rotation path. (role: recent area contributor; confidence: high; commits: b328f57bc3f7, e40d8ccd6912; files: src/agents/openai-codex-routing.ts, src/agents/pi-embedded-runner/run.ts, src/agents/pi-embedded-runner/run.overflow-compaction.test.ts)
@pashpashpash: Commit history shows the OpenAI agents through Codex default-routing feature landed through this area, which is the policy the PR is aligning with explicit runtime selections. (role: feature history contributor; confidence: medium; commits: 1c3399010815; files: src/agents/openai-codex-routing.ts, src/agents/openai-codex-routing.test.ts)
@joshavant: Recent history on the embedded runner includes adjacent assistant payload/runtime work, making this a useful routing candidate for runner-side review if ownership is shared. (role: recent adjacent contributor; confidence: medium; commits: 7d1317634e5b; files: src/agents/pi-embedded-runner/run.ts, src/agents/pi-embedded-runner/run.overflow-compaction.test.ts)

Remaining risk / open question:

The latest head has no successful live gateway proof after the OAuth-bootstrap and profile-rotation changes; existing production evidence covers the earlier routing attempt and an intermediate failure mode.
Tests were not rerun in this read-only review, so verification relies on the PR-supplied focused test output and source inspection.

Codex review notes: model gpt-5.5, reasoning high; reviewed against 421b9e281942.

…i/* model refs When a plugin harness (e.g. Codex) owns its transport but the runtime plan resolved to openai-codex via agentRuntime.id: codex, the auth profile store was left empty because pluginHarnessOwnsTransport short- circuited initializeAuthProfile(). This caused 'No API key found for openai-codex' at runtime even though the OAuth profile existed in OpenClaw's store. - Add pluginHarnessNeedsOpenClawAuthBootstrap flag when harness owns transport but the provider is openai-codex and the API is openai-codex- responses - Populate authStore and attemptAuthProfileStore from OpenClaw's profile store in this case - Run initializeAuthProfile() to forward the OAuth token into the harness - Update overflow-compaction tests to expect 'openai-codex' provider and add dedicated test for OAuth bootstrap path

PsiClawOps · 2026-05-17T04:56:26Z

Superseded. Reposted by @ragesaq here: #82864 (comment)

ragesaq · 2026-05-17T05:07:29Z

Extended PR #82864 with commit 349ee4a18e: fix(agents): bootstrap OAuth credentials for Codex harness with openai/* model refs.

Additional production evidence after the first patch showed a second failure mode:

2026-05-17T04:19:43Z agent/embedded
provider="openai-codex"
sourceProvider="openai-codex"
model="gpt-5.5"
rawErrorPreview="No API key found for openai-codex"

That means the original routing fix was necessary but not complete. Routing reached openai-codex, but the embedded plugin harness path still skipped OpenClaw auth bootstrap. The new commit keeps the plugin-harness transport ownership rule, with a narrow exception for api: "openai-codex-responses", so Codex OAuth profiles are materialized before dispatch.

Verification:

node scripts/run-vitest.mjs src/agents/pi-embedded-runner/run.overflow-compaction.test.ts src/agents/openai-codex-routing.test.ts
Test Files  3 passed (3)
Tests       59 passed (59)

PATH=/tmp/openclaw-pnpm-shim:$PATH node scripts/check-changed.mjs
ok: conflict markers, changelog attributions, wildcard re-export guards, duplicate coverage,
dependency pin guard, package patch guard, typecheck core, typecheck core tests,
typecheck extensions, typecheck extension tests, lint core, lint extensions, lint scripts
failed: lint apps, because swiftlint is not installed in this environment

I could not update the PR body from this integration token: GitHub returned 403 Resource not accessible by integration.

ragesaq · 2026-05-17T05:45:45Z

Current steering status from prod validation:

PR head: e40d8ccd69127f4b55072fe3ff699bb60563cd65
Focused local validation at this head passed:

node scripts/run-vitest.mjs src/agents/pi-embedded-runner/run.overflow-compaction.test.ts src/agents/openai-codex-routing.test.ts
Test Files  3 passed (3)
Tests       61 passed (61)

openclaw-prod has now been hotfixed to this head. Installed bundle marker:

/home/lumadmin/.npm-global/lib/node_modules/openclaw/dist/pi-embedded-BkQLKIkH.js
pluginHarnessNeedsOpenClawAuthBootstrap
advanceAttemptAuthProfile
if (!pluginHarnessOwnsTransport || pluginHarnessNeedsOpenClawAuthBootstrap) await initializeAuthProfile()

Gateway restart verification on openclaw-prod:

openclaw-gateway: active
clawdash: active
control-ui/index.html: present
protocol mismatches after ClawDash bridge restart: none observed

Remaining proof gap: we still need one fresh live OpenAI Codex turn on openclaw-prod at this deployed head showing openai/gpt-5.5 or openai/gpt-5.4 with Runtime: OpenAI Codex completes without the prior No API key found for openai-codex failure or fallback to Opus. Once that log excerpt exists, I will update the PR body with the redacted proof.

steipete · 2026-05-17T06:05:57Z

Verification before merge:

Behavior addressed: forced openai/gpt-5.x plus agentRuntime.id: "codex" now routes through openai-codex, bootstraps Codex OAuth for plugin-harness transport, and refreshes OAuth credentials during auth-profile failover.
Real environment tested: GitHub Real behavior proof run 25982272554, job 76373012242, success.
Exact steps or command run after this patch:
- node scripts/run-vitest.mjs src/agents/openai-codex-routing.test.ts src/agents/pi-embedded-runner/run.overflow-compaction.test.ts
- git diff --check
- codex-review --mode branch
Evidence after fix: focused Vitest passed 3 files / 61 tests; diff whitespace clean; Codex review reported no actionable correctness issues; PR status checks show Real behavior proof, actionlint, no-tabs, and Socket checks green.
Observed result after fix: Codex harness attempts receive provider openai-codex, a forwarded auth profile id, and refreshed runtime credentials when rotating from openai-codex:sub to openai-codex:backup.
What was not tested: full local pnpm check; Testbox pnpm check:changed run 25982135127 failed on an unrelated current-tree export mismatch in src/auto-reply/reply/followup-runner.ts.

Mirror the existing helpful hint from src/auto-reply/reply/get-reply-directives-apply.ts:72 onto the parallel error thrown in src/agents/agent-command.ts when an explicit model override is rejected by the visibility policy. Existing test (src/commands/agent.test.ts:1068) uses toThrow(string) substring matching, so appending the hint is backward compatible and no test changes are required. See openclaw#82979 review thread for the broader context: this PR was originally larger but ClawSweeper correctly pointed out that openclaw#82864 already lands the routing fixes I had documented as a workaround, so the docs hunks have been dropped.

* fix: route Codex OpenAI runtime through Codex provider * docs: add Codex routing evidence collection * fix(agents): bootstrap OAuth credentials for Codex harness with openai/* model refs When a plugin harness (e.g. Codex) owns its transport but the runtime plan resolved to openai-codex via agentRuntime.id: codex, the auth profile store was left empty because pluginHarnessOwnsTransport short- circuited initializeAuthProfile(). This caused 'No API key found for openai-codex' at runtime even though the OAuth profile existed in OpenClaw's store. - Add pluginHarnessNeedsOpenClawAuthBootstrap flag when harness owns transport but the provider is openai-codex and the API is openai-codex- responses - Populate authStore and attemptAuthProfileStore from OpenClaw's profile store in this case - Run initializeAuthProfile() to forward the OAuth token into the harness - Update overflow-compaction tests to expect 'openai-codex' provider and add dedicated test for OAuth bootstrap path * fix(agents): refresh Codex OAuth credentials on profile rotation --------- Co-authored-by: PsiClawOps <267826480+PsiClawOps@users.noreply.github.com> Co-authored-by: Peter Steinberger <steipete@gmail.com>

…claw#82864)

* fix: route Codex OpenAI runtime through Codex provider * docs: add Codex routing evidence collection * fix(agents): bootstrap OAuth credentials for Codex harness with openai/* model refs When a plugin harness (e.g. Codex) owns its transport but the runtime plan resolved to openai-codex via agentRuntime.id: codex, the auth profile store was left empty because pluginHarnessOwnsTransport short- circuited initializeAuthProfile(). This caused 'No API key found for openai-codex' at runtime even though the OAuth profile existed in OpenClaw's store. - Add pluginHarnessNeedsOpenClawAuthBootstrap flag when harness owns transport but the provider is openai-codex and the API is openai-codex- responses - Populate authStore and attemptAuthProfileStore from OpenClaw's profile store in this case - Run initializeAuthProfile() to forward the OAuth token into the harness - Update overflow-compaction tests to expect 'openai-codex' provider and add dedicated test for OAuth bootstrap path * fix(agents): refresh Codex OAuth credentials on profile rotation --------- Co-authored-by: PsiClawOps <267826480+PsiClawOps@users.noreply.github.com> Co-authored-by: Peter Steinberger <steipete@gmail.com>

…claw#82864)

* fix: route Codex OpenAI runtime through Codex provider * docs: add Codex routing evidence collection * fix(agents): bootstrap OAuth credentials for Codex harness with openai/* model refs When a plugin harness (e.g. Codex) owns its transport but the runtime plan resolved to openai-codex via agentRuntime.id: codex, the auth profile store was left empty because pluginHarnessOwnsTransport short- circuited initializeAuthProfile(). This caused 'No API key found for openai-codex' at runtime even though the OAuth profile existed in OpenClaw's store. - Add pluginHarnessNeedsOpenClawAuthBootstrap flag when harness owns transport but the provider is openai-codex and the API is openai-codex- responses - Populate authStore and attemptAuthProfileStore from OpenClaw's profile store in this case - Run initializeAuthProfile() to forward the OAuth token into the harness - Update overflow-compaction tests to expect 'openai-codex' provider and add dedicated test for OAuth bootstrap path * fix(agents): refresh Codex OAuth credentials on profile rotation --------- Co-authored-by: PsiClawOps <267826480+PsiClawOps@users.noreply.github.com> Co-authored-by: Peter Steinberger <steipete@gmail.com>

…claw#82864)

* fix: route Codex OpenAI runtime through Codex provider * docs: add Codex routing evidence collection * fix(agents): bootstrap OAuth credentials for Codex harness with openai/* model refs When a plugin harness (e.g. Codex) owns its transport but the runtime plan resolved to openai-codex via agentRuntime.id: codex, the auth profile store was left empty because pluginHarnessOwnsTransport short- circuited initializeAuthProfile(). This caused 'No API key found for openai-codex' at runtime even though the OAuth profile existed in OpenClaw's store. - Add pluginHarnessNeedsOpenClawAuthBootstrap flag when harness owns transport but the provider is openai-codex and the API is openai-codex- responses - Populate authStore and attemptAuthProfileStore from OpenClaw's profile store in this case - Run initializeAuthProfile() to forward the OAuth token into the harness - Update overflow-compaction tests to expect 'openai-codex' provider and add dedicated test for OAuth bootstrap path * fix(agents): refresh Codex OAuth credentials on profile rotation --------- Co-authored-by: PsiClawOps <267826480+PsiClawOps@users.noreply.github.com> Co-authored-by: Peter Steinberger <steipete@gmail.com>

…claw#82864)

* fix: route Codex OpenAI runtime through Codex provider * docs: add Codex routing evidence collection * fix(agents): bootstrap OAuth credentials for Codex harness with openai/* model refs When a plugin harness (e.g. Codex) owns its transport but the runtime plan resolved to openai-codex via agentRuntime.id: codex, the auth profile store was left empty because pluginHarnessOwnsTransport short- circuited initializeAuthProfile(). This caused 'No API key found for openai-codex' at runtime even though the OAuth profile existed in OpenClaw's store. - Add pluginHarnessNeedsOpenClawAuthBootstrap flag when harness owns transport but the provider is openai-codex and the API is openai-codex- responses - Populate authStore and attemptAuthProfileStore from OpenClaw's profile store in this case - Run initializeAuthProfile() to forward the OAuth token into the harness - Update overflow-compaction tests to expect 'openai-codex' provider and add dedicated test for OAuth bootstrap path * fix(agents): refresh Codex OAuth credentials on profile rotation --------- Co-authored-by: PsiClawOps <267826480+PsiClawOps@users.noreply.github.com> Co-authored-by: Peter Steinberger <steipete@gmail.com>

…claw#82864)

* fix: route Codex OpenAI runtime through Codex provider * docs: add Codex routing evidence collection * fix(agents): bootstrap OAuth credentials for Codex harness with openai/* model refs When a plugin harness (e.g. Codex) owns its transport but the runtime plan resolved to openai-codex via agentRuntime.id: codex, the auth profile store was left empty because pluginHarnessOwnsTransport short- circuited initializeAuthProfile(). This caused 'No API key found for openai-codex' at runtime even though the OAuth profile existed in OpenClaw's store. - Add pluginHarnessNeedsOpenClawAuthBootstrap flag when harness owns transport but the provider is openai-codex and the API is openai-codex- responses - Populate authStore and attemptAuthProfileStore from OpenClaw's profile store in this case - Run initializeAuthProfile() to forward the OAuth token into the harness - Update overflow-compaction tests to expect 'openai-codex' provider and add dedicated test for OAuth bootstrap path * fix(agents): refresh Codex OAuth credentials on profile rotation --------- Co-authored-by: PsiClawOps <267826480+PsiClawOps@users.noreply.github.com> Co-authored-by: Peter Steinberger <steipete@gmail.com>

…claw#82864)

* fix: route Codex OpenAI runtime through Codex provider * docs: add Codex routing evidence collection * fix(agents): bootstrap OAuth credentials for Codex harness with openai/* model refs When a plugin harness (e.g. Codex) owns its transport but the runtime plan resolved to openai-codex via agentRuntime.id: codex, the auth profile store was left empty because pluginHarnessOwnsTransport short- circuited initializeAuthProfile(). This caused 'No API key found for openai-codex' at runtime even though the OAuth profile existed in OpenClaw's store. - Add pluginHarnessNeedsOpenClawAuthBootstrap flag when harness owns transport but the provider is openai-codex and the API is openai-codex- responses - Populate authStore and attemptAuthProfileStore from OpenClaw's profile store in this case - Run initializeAuthProfile() to forward the OAuth token into the harness - Update overflow-compaction tests to expect 'openai-codex' provider and add dedicated test for OAuth bootstrap path * fix(agents): refresh Codex OAuth credentials on profile rotation --------- Co-authored-by: PsiClawOps <267826480+PsiClawOps@users.noreply.github.com> Co-authored-by: Peter Steinberger <steipete@gmail.com>

…claw#82864)

* fix: route Codex OpenAI runtime through Codex provider * docs: add Codex routing evidence collection * fix(agents): bootstrap OAuth credentials for Codex harness with openai/* model refs When a plugin harness (e.g. Codex) owns its transport but the runtime plan resolved to openai-codex via agentRuntime.id: codex, the auth profile store was left empty because pluginHarnessOwnsTransport short- circuited initializeAuthProfile(). This caused 'No API key found for openai-codex' at runtime even though the OAuth profile existed in OpenClaw's store. - Add pluginHarnessNeedsOpenClawAuthBootstrap flag when harness owns transport but the provider is openai-codex and the API is openai-codex- responses - Populate authStore and attemptAuthProfileStore from OpenClaw's profile store in this case - Run initializeAuthProfile() to forward the OAuth token into the harness - Update overflow-compaction tests to expect 'openai-codex' provider and add dedicated test for OAuth bootstrap path * fix(agents): refresh Codex OAuth credentials on profile rotation --------- Co-authored-by: PsiClawOps <267826480+PsiClawOps@users.noreply.github.com> Co-authored-by: Peter Steinberger <steipete@gmail.com>

…claw#82864)

* fix: route Codex OpenAI runtime through Codex provider * docs: add Codex routing evidence collection * fix(agents): bootstrap OAuth credentials for Codex harness with openai/* model refs When a plugin harness (e.g. Codex) owns its transport but the runtime plan resolved to openai-codex via agentRuntime.id: codex, the auth profile store was left empty because pluginHarnessOwnsTransport short- circuited initializeAuthProfile(). This caused 'No API key found for openai-codex' at runtime even though the OAuth profile existed in OpenClaw's store. - Add pluginHarnessNeedsOpenClawAuthBootstrap flag when harness owns transport but the provider is openai-codex and the API is openai-codex- responses - Populate authStore and attemptAuthProfileStore from OpenClaw's profile store in this case - Run initializeAuthProfile() to forward the OAuth token into the harness - Update overflow-compaction tests to expect 'openai-codex' provider and add dedicated test for OAuth bootstrap path * fix(agents): refresh Codex OAuth credentials on profile rotation --------- Co-authored-by: PsiClawOps <267826480+PsiClawOps@users.noreply.github.com> Co-authored-by: Peter Steinberger <steipete@gmail.com>

…claw#82864)

* fix: route Codex OpenAI runtime through Codex provider * docs: add Codex routing evidence collection * fix(agents): bootstrap OAuth credentials for Codex harness with openai/* model refs When a plugin harness (e.g. Codex) owns its transport but the runtime plan resolved to openai-codex via agentRuntime.id: codex, the auth profile store was left empty because pluginHarnessOwnsTransport short- circuited initializeAuthProfile(). This caused 'No API key found for openai-codex' at runtime even though the OAuth profile existed in OpenClaw's store. - Add pluginHarnessNeedsOpenClawAuthBootstrap flag when harness owns transport but the provider is openai-codex and the API is openai-codex- responses - Populate authStore and attemptAuthProfileStore from OpenClaw's profile store in this case - Run initializeAuthProfile() to forward the OAuth token into the harness - Update overflow-compaction tests to expect 'openai-codex' provider and add dedicated test for OAuth bootstrap path * fix(agents): refresh Codex OAuth credentials on profile rotation --------- Co-authored-by: PsiClawOps <267826480+PsiClawOps@users.noreply.github.com> Co-authored-by: Peter Steinberger <steipete@gmail.com>

…claw#82864)

* fix: route Codex OpenAI runtime through Codex provider * docs: add Codex routing evidence collection * fix(agents): bootstrap OAuth credentials for Codex harness with openai/* model refs When a plugin harness (e.g. Codex) owns its transport but the runtime plan resolved to openai-codex via agentRuntime.id: codex, the auth profile store was left empty because pluginHarnessOwnsTransport short- circuited initializeAuthProfile(). This caused 'No API key found for openai-codex' at runtime even though the OAuth profile existed in OpenClaw's store. - Add pluginHarnessNeedsOpenClawAuthBootstrap flag when harness owns transport but the provider is openai-codex and the API is openai-codex- responses - Populate authStore and attemptAuthProfileStore from OpenClaw's profile store in this case - Run initializeAuthProfile() to forward the OAuth token into the harness - Update overflow-compaction tests to expect 'openai-codex' provider and add dedicated test for OAuth bootstrap path * fix(agents): refresh Codex OAuth credentials on profile rotation --------- Co-authored-by: PsiClawOps <267826480+PsiClawOps@users.noreply.github.com> Co-authored-by: Peter Steinberger <steipete@gmail.com>

…claw#82864)

* fix: route Codex OpenAI runtime through Codex provider * docs: add Codex routing evidence collection * fix(agents): bootstrap OAuth credentials for Codex harness with openai/* model refs When a plugin harness (e.g. Codex) owns its transport but the runtime plan resolved to openai-codex via agentRuntime.id: codex, the auth profile store was left empty because pluginHarnessOwnsTransport short- circuited initializeAuthProfile(). This caused 'No API key found for openai-codex' at runtime even though the OAuth profile existed in OpenClaw's store. - Add pluginHarnessNeedsOpenClawAuthBootstrap flag when harness owns transport but the provider is openai-codex and the API is openai-codex- responses - Populate authStore and attemptAuthProfileStore from OpenClaw's profile store in this case - Run initializeAuthProfile() to forward the OAuth token into the harness - Update overflow-compaction tests to expect 'openai-codex' provider and add dedicated test for OAuth bootstrap path * fix(agents): refresh Codex OAuth credentials on profile rotation --------- Co-authored-by: PsiClawOps <267826480+PsiClawOps@users.noreply.github.com> Co-authored-by: Peter Steinberger <steipete@gmail.com>

…claw#82864)

fix: route Codex OpenAI runtime through Codex provider

c46f0e5

openclaw-barnacle Bot added agents Agent runtime and tooling size: XS triage: needs-real-behavior-proof Candidate: external PR needs after-fix proof from a real setup. labels May 17, 2026

clawsweeper Bot added P2 Normal backlog priority with limited blast radius. impact:auth-provider Auth, provider routing, model choice, or SecretRef resolution may break. labels May 17, 2026

openclaw-barnacle Bot added proof: supplied External PR includes structured after-fix real behavior proof. and removed triage: needs-real-behavior-proof Candidate: external PR needs after-fix proof from a real setup. labels May 17, 2026

docs: add Codex routing evidence collection

2e3c316

openclaw-barnacle Bot added the docs Improvements or additions to documentation label May 17, 2026

clawsweeper Bot added the proof: sufficient ClawSweeper judged the real behavior proof convincing. label May 17, 2026

openclaw-barnacle Bot added size: S and removed size: XS proof: sufficient ClawSweeper judged the real behavior proof convincing. labels May 17, 2026

fix(agents): refresh Codex OAuth credentials on profile rotation

e40d8cc

openclaw-barnacle Bot added size: M and removed size: S labels May 17, 2026

steipete marked this pull request as ready for review May 17, 2026 06:06

steipete merged commit 58f1db1 into openclaw:main May 17, 2026
75 of 77 checks passed

vincentkoc added a commit that referenced this pull request May 17, 2026

changelog: add OpenAI Codex runtime routing and OAuth bootstrap (#82864)

684a630

github-actions Bot mentioned this pull request May 17, 2026

📡 Upstream Digest — 2026-05-17 06:39 UTC curtismercier/openclaw-mods#878

Open

clawsweeper Bot mentioned this pull request May 17, 2026

agents: include allow-list hint in disallowed model override error #82979

Closed

crhan mentioned this pull request May 17, 2026

[Bug] Docs and onboarding silently route users to the PI path instead of the Codex app-server runtime, causing chatgpt.com 403 in Cloudflare-sensitive environments #82978

Closed

clawsweeper Bot mentioned this pull request May 19, 2026

fix(codex): preserve plugin tool auth profiles #83845

Merged

github-actions Bot mentioned this pull request May 19, 2026

Track OpenClaw native Codex auth mismatch claytono/infra#2061

Open

Calderein mentioned this pull request May 19, 2026

[Bug]: Codex harness treats local agent auth-profiles (populated + empty) as unusable and bootstraps from binary, breaking documented main-to-agent auth inheritance #84114

Closed

reboost-openclaw-team Bot mentioned this pull request May 19, 2026

memory-lancedb memory_store is registered but not exposed as callable agent tool #84242

Open

galiniliev pushed a commit to galiniliev/openclaw that referenced this pull request May 20, 2026

changelog: add OpenAI Codex runtime routing and OAuth bootstrap (open…

2f5884f

…claw#82864)

SebTardif pushed a commit to SebTardif/openclaw that referenced this pull request May 24, 2026

changelog: add OpenAI Codex runtime routing and OAuth bootstrap (open…

3cfc29a

…claw#82864)

SebTardif pushed a commit to SebTardif/openclaw that referenced this pull request May 24, 2026

changelog: add OpenAI Codex runtime routing and OAuth bootstrap (open…

af5211d

…claw#82864)

SebTardif pushed a commit to SebTardif/openclaw that referenced this pull request May 24, 2026

changelog: add OpenAI Codex runtime routing and OAuth bootstrap (open…

1186a7f

…claw#82864)

github-actions Bot pushed a commit to Desicool/openclaw that referenced this pull request May 24, 2026

changelog: add OpenAI Codex runtime routing and OAuth bootstrap (open…

3e4b054

…claw#82864)

galiniliev pushed a commit to galiniliev/openclaw that referenced this pull request May 25, 2026

changelog: add OpenAI Codex runtime routing and OAuth bootstrap (open…

2ebf8ba

…claw#82864)

SebTardif pushed a commit to SebTardif/openclaw that referenced this pull request May 26, 2026

changelog: add OpenAI Codex runtime routing and OAuth bootstrap (open…

eae92a9

…claw#82864)

SebTardif pushed a commit to SebTardif/openclaw that referenced this pull request May 26, 2026

changelog: add OpenAI Codex runtime routing and OAuth bootstrap (open…

083113b

…claw#82864)

SebTardif pushed a commit to SebTardif/openclaw that referenced this pull request May 26, 2026

changelog: add OpenAI Codex runtime routing and OAuth bootstrap (open…

3798882

…claw#82864)

jameslcowan pushed a commit to jameslcowan/openclaw that referenced this pull request Jun 2, 2026

changelog: add OpenAI Codex runtime routing and OAuth bootstrap (open…

a246c9f

…claw#82864)

SYU8384 pushed a commit to SYU8384/openclaw that referenced this pull request Jun 3, 2026

changelog: add OpenAI Codex runtime routing and OAuth bootstrap (open…

cbe202f

…claw#82864)

ragesaq deleted the fix/openai-codex-runtime-routing branch June 7, 2026 21:33

sablehead pushed a commit to sablehead/openclaw that referenced this pull request Jun 10, 2026

changelog: add OpenAI Codex runtime routing and OAuth bootstrap (open…

4e6ca0c

…claw#82864)

clawsweeper Bot mentioned this pull request Jun 12, 2026

Feature request — scope-bound gateway auth tokens (gateway.auth.tokens[]) + per-agent dispatch-lane primitive #92367

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Fix OpenAI Codex runtime provider routing#82864

Fix OpenAI Codex runtime provider routing#82864
steipete merged 4 commits into
openclaw:mainfrom
ragesaq:fix/openai-codex-runtime-routing

ragesaq commented May 17, 2026 •

edited

Loading

Uh oh!

clawsweeper Bot commented May 17, 2026 •

edited

Loading

Uh oh!

PsiClawOps commented May 17, 2026 •

edited

Loading

Uh oh!

ragesaq commented May 17, 2026

Uh oh!

ragesaq commented May 17, 2026

Uh oh!

steipete commented May 17, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

ragesaq commented May 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Root Cause

Real behavior proof

Verification

AI-assisted disclosure

Uh oh!

clawsweeper Bot commented May 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

PsiClawOps commented May 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ragesaq commented May 17, 2026

Uh oh!

ragesaq commented May 17, 2026

Uh oh!

steipete commented May 17, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

ragesaq commented May 17, 2026 •

edited

Loading

clawsweeper Bot commented May 17, 2026 •

edited

Loading

PsiClawOps commented May 17, 2026 •

edited

Loading