Skip to content

refactor(openai): centralize Codex OAuth flow#87411

Merged
RomneyDa merged 1 commit into
mainfrom
codex/cleanup-openai-codex-oauth
May 28, 2026
Merged

refactor(openai): centralize Codex OAuth flow#87411
RomneyDa merged 1 commit into
mainfrom
codex/cleanup-openai-codex-oauth

Conversation

@RomneyDa

@RomneyDa RomneyDa commented May 27, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

Summary

  • Refactor OpenAI Codex OAuth to remove duplicated browser/token flow code; no user-visible OAuth behavior change is intended.
  • Keep the existing OpenAI plugin OAuth runtime as the single implementation used by plugin auth and legacy compatibility wrappers.
  • Preserve legacy src/llm login/refresh behavior, including abort propagation, immediate manual-code input, callback handling, credential refresh shape, provider-hook-unavailable fallback, and disabled-plugin failure behavior.
  • Provenance: duplicated OpenAI Codex OAuth flow was introduced by bb46b79d3c14 (refactor: internalize OpenClaw agent runtime, refactor: internalize OpenClaw agent runtime #85341).

Compatibility Review

  • Deprecated src/llm OpenAI Codex OAuth login/refresh entry points are preserved and covered by focused compatibility tests. The login wrapper still reports browser auth through onAuth, still routes fallback prompts through onPrompt, still starts onManualCodeInput in parallel with browser auth when supplied, and passes the caller signal into the provider-owned OAuth hook.
  • If the provider runtime hook is temporarily unavailable, legacy login/refresh fall back to the OpenAI plugin public facade. The fallback uses the activated facade loader, so operator plugin disablement still fails closed instead of bypassing plugin activation policy.
  • No plugin SDK ProviderAuthContext fields are added. Legacy-only cancellation and manual-code hooks are carried through a private OpenAI Codex bridge context, so external provider auth consumers do not get a new API surface.
  • Current-main token behavior remains plugin-owned: bounded token request timeout, SSRF-guarded fetch, cancellation, TLS/proxy preflight, callback handling, proxy dispatcher setup, and error rewriting stay in extensions/openai/openai-codex-oauth*.runtime.ts / extensions/openai/openai-codex-provider.runtime.ts instead of being copied back into core.
  • Live OpenAI browser OAuth with real credentials was run after the final branch update in an isolated temp OpenClaw home. The login completed through the local callback flow and saved an openai-codex OAuth profile with an expiresAt value. Raw auth URLs, temp paths, email/profile id, and credential material are intentionally omitted.

Live Fix Proof Repro Matrix

Remote proof was rerun on pre-rebase head f2829ef7f4 with the same patch content through Crabbox using delegated Blacksmith Testbox. The branch was then rebased cleanly onto origin/main; current head is edf12deb57.

  • Provider: blacksmith-testbox via Crabbox
  • Testbox id: tbx_01kspehjhah22npkb47p5g5tkg
  • Actions run: https://github.com/openclaw/openclaw/actions/runs/26555293890
  • Result: exit 0

Matrix covered:

Phase Proof
oauth-runtime extensions/openai/openai-codex-oauth-flow.runtime.test.ts passed: callback, manual-code, token exchange/refresh, timeout, cancellation coverage
openai-provider extensions/openai/openai-codex-provider.test.ts, extensions/openai/provider-auth.contract.test.ts, and extensions/openai/index.test.ts passed, including proxy dispatcher setup before Codex OAuth refresh
legacy-compat src/llm/utils/oauth/openai-codex.test.ts passed: legacy callback routing, immediate manual-code input, cancellation propagation, refresh shape, provider-runtime-unavailable fallback, and disabled-plugin failure path
provider-bridge src/plugins/provider-openai-codex-oauth.test.ts passed: bridge delegates to OpenAI provider auth hook, falls back through the activated OpenAI plugin facade when the hook is unavailable, and preserves disabled-plugin failure behavior
refresh-fallback src/agents/auth-profiles/oauth.openai-codex-refresh-fallback.test.ts passed in both agents-core and agents-support projects
lint Focused node scripts/run-oxlint.mjs ... and git diff --check passed
build pnpm build passed on remote Linux/Testbox

Credentialed OpenAI browser OAuth was also run locally against pre-rebase head f2829ef with the same patch content using an isolated temporary HOME, OPENCLAW_HOME, and OPENCLAW_STATE_DIR. The browser login completed through the localhost callback path and models auth list --provider openai-codex --json showed one redacted openai-codex OAuth profile with expiresAt present. The remote matrix above still covers mocked refresh/fallback/proxy/activation paths on Linux.

Verification

  • node scripts/run-vitest.mjs run extensions/openai/openai-codex-oauth-flow.runtime.test.ts
  • node scripts/run-vitest.mjs run extensions/openai/openai-codex-provider.test.ts
  • node scripts/run-vitest.mjs run extensions/openai/provider-auth.contract.test.ts
  • node scripts/run-vitest.mjs run extensions/openai/index.test.ts --reporter=verbose --testTimeout=5000
  • node scripts/run-vitest.mjs run src/plugins/provider-openai-codex-oauth.test.ts --reporter=verbose --testTimeout=5000
  • node scripts/run-vitest.mjs run src/llm/utils/oauth/openai-codex.test.ts --reporter=verbose --testTimeout=5000
  • node scripts/run-vitest.mjs run src/agents/auth-profiles/oauth.openai-codex-refresh-fallback.test.ts
  • node scripts/run-oxlint.mjs extensions/openai/api.ts src/plugins/provider-openai-codex-oauth.ts src/plugins/provider-openai-codex-oauth.test.ts src/llm/utils/oauth/openai-codex.ts src/llm/utils/oauth/openai-codex.test.ts extensions/openai/openai-codex-oauth.runtime.ts extensions/openai/openai-codex-provider.ts
  • git diff --check
  • pnpm build
  • .agents/skills/autoreview/scripts/autoreview --mode local initially found proxy/activation fallback issues; after fixes, rerun was clean: no accepted/actionable findings.
  • node scripts/crabbox-wrapper.mjs run --provider blacksmith-testbox --blacksmith-org openclaw --blacksmith-workflow .github/workflows/ci-check-testbox.yml --blacksmith-job check --blacksmith-ref main --idle-timeout 90m --ttl 240m --timing-json --shell -- "...matrix..." passed on tbx_01kspehjhah22npkb47p5g5tkg.
  • Live credentialed OAuth smoke, run locally on pre-rebase head f2829ef with the same patch content in an isolated temp OpenClaw home: pnpm openclaw models auth login --provider openai-codex --method oauth, followed by node scripts/run-node.mjs models auth list --provider openai-codex --json. Login completed and auth list showed one redacted openai-codex OAuth profile with expiresAt present. Manual redirect paste: no.

Real behavior proof

Behavior addressed: OpenAI Codex OAuth implementation duplication between the bundled OpenAI plugin and legacy core OAuth helpers; no user-visible OAuth behavior change is intended.
Real environment tested: Local macOS worktree with installed repo dependencies and live OpenAI browser OAuth, plus remote Linux Blacksmith Testbox through Crabbox.
Exact steps or command run after this patch: The commands listed in Verification were run after the final code changes.
Evidence after fix: Focused OpenAI Codex OAuth, provider auth, provider runtime, compatibility, refresh fallback tests passed locally and in Crabbox/Testbox remote proof; focused oxlint and git diff --check passed; pnpm build passed locally and remotely; autoreview reported no accepted/actionable findings after the compatibility fallback fixes; live OpenAI browser OAuth login completed locally and saved a redacted openai-codex OAuth profile with expiresAt present.
Observed result after fix: Legacy compatibility surfaces now delegate to the existing provider-owned OpenAI Codex OAuth implementation while preserving cancellation, parallel manual-code input, provider-hook-unavailable fallback, proxy-aware refresh, and disabled-plugin failure behavior. The duplicated core browser/token implementation is removed without adding exported provider-auth context fields.
What was not tested: A real token refresh after expiry and a real OpenAI Codex model request were not run; refresh/fallback/proxy paths are covered by focused tests and Testbox proof.

@openclaw-barnacle openclaw-barnacle Bot added size: XL maintainer Maintainer-authored PR labels May 27, 2026
@RomneyDa RomneyDa closed this May 27, 2026
@RomneyDa

RomneyDa commented May 27, 2026

Copy link
Copy Markdown
Member Author

@codex re-review

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented May 27, 2026

Copy link
Copy Markdown

Codex Review: Didn't find any major issues. 🎉

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

@RomneyDa RomneyDa reopened this May 27, 2026
@RomneyDa RomneyDa marked this pull request as draft May 27, 2026 21:34
@clawsweeper

clawsweeper Bot commented May 27, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Codex review: needs maintainer review before merge. Reviewed May 28, 2026, 1:30 AM ET / 05:30 UTC.

Summary
This PR removes the duplicated legacy core OpenAI Codex OAuth implementation and routes legacy login/refresh through the OpenAI plugin runtime or activated facade with focused compatibility tests.

PR surface: Source -619, Tests -345. Total -964 across 7 files.

Reproducibility: not applicable. this is a refactor PR rather than a standalone bug report. The review path is source inspection plus compatibility and proof evidence for the affected login/refresh surfaces.

Review metrics: 1 noteworthy metric.

  • OpenAI facade exports: 2 added. extensions/openai/api.ts now exports OAuth login and refresh runtime helpers, which is a small but compatibility-sensitive bundled plugin facade expansion.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🦞 diamond lobster
Patch quality: 🐚 platinum hermit
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

  • [P2] Let the remaining exact-head checks finish green before merge.
  • Confirm the new OpenAI plugin facade exports and disabled-plugin behavior are the intended compatibility contract.

Risk before merge

  • [P1] The deprecated legacy login/refresh wrappers now depend on provider runtime resolution or the activated OpenAI plugin facade; maintainers need to accept the disabled-plugin and unavailable-hook behavior as the intended upgrade contract.
  • [P1] The PR adds two OpenAI plugin facade exports for OAuth login and refresh runtime helpers, so that surface should be treated as an intentional bundled-facade compatibility expansion.
  • [P1] Exact-head CI still had guard/network-runtime jobs in progress during review, so merge should wait for the required checks to finish green.

Maintainer options:

  1. Accept the provider-owned compatibility contract (recommended)
    Maintainers can land this after exact-head checks pass if they explicitly accept the activated-facade fallback and disabled-plugin fail-closed behavior as the intended legacy contract.
  2. Preserve direct legacy independence
    If legacy src/llm OAuth must keep working when the OpenAI plugin is disabled or unavailable, the branch should retain a narrow direct helper or a different migration path before merge.
  3. Pause until auth ownership is settled
    If the new OpenAI plugin api.ts OAuth exports should not become a bundled facade surface, pause this PR and decide the permanent auth bridge seam first.

Next step before merge

  • [P2] Protected maintainer auth/provider refactor should stay open for maintainer merge decision and exact-head checks; there is no narrow ClawSweeper repair to queue.

Security
Cleared: The diff touches OAuth routing but adds no dependency, workflow, lockfile, or secret-handling surface, and it keeps token exchange/refresh in the existing guarded plugin runtime.

Review details

Best possible solution:

Keep one plugin-owned OpenAI Codex OAuth implementation, with legacy wrappers delegating through a documented and owner-accepted bundled facade/activation contract after exact-head checks pass.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this is a refactor PR rather than a standalone bug report. The review path is source inspection plus compatibility and proof evidence for the affected login/refresh surfaces.

Is this the best way to solve the issue?

Yes, with owner acceptance: centralizing on the plugin-owned OAuth runtime is the right boundary, but the plugin activation and facade-export behavior must be an intentional compatibility decision.

AGENTS.md: found and applied where relevant.

Codex review notes: model gpt-5.5, reasoning high; reviewed against 44027e72d07e.

Label changes

Label changes:

  • add proof: sufficient: Contributor real behavior proof is sufficient. The PR body includes after-patch live credentialed OpenAI browser OAuth proof with redacted details plus remote Linux Testbox coverage for the mocked refresh/fallback/proxy/activation paths.

Label justifications:

  • P2: This is a normal-priority auth/provider refactor with limited surface area but meaningful compatibility impact.
  • merge-risk: 🚨 compatibility: Legacy OpenAI Codex OAuth wrappers now route through provider runtime or the activated plugin facade, changing the compatibility contract for disabled or unavailable plugin states.
  • merge-risk: 🚨 auth-provider: The diff changes OpenAI Codex OAuth login and refresh routing, cancellation, manual-code handling, and token refresh delegation.
  • rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🦞 diamond lobster and patch quality is 🐚 platinum hermit.
  • status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (terminal): The PR body includes after-patch live credentialed OpenAI browser OAuth proof with redacted details plus remote Linux Testbox coverage for the mocked refresh/fallback/proxy/activation paths.
  • proof: sufficient: Contributor real behavior proof is sufficient. The PR body includes after-patch live credentialed OpenAI browser OAuth proof with redacted details plus remote Linux Testbox coverage for the mocked refresh/fallback/proxy/activation paths.
Evidence reviewed

PR surface:

Source -619, Tests -345. Total -964 across 7 files.

View PR surface stats
Area Files Added Removed Net
Source 5 183 802 -619
Tests 2 269 614 -345
Docs 0 0 0 0
Config 0 0 0 0
Generated 0 0 0 0
Other 0 0 0 0
Total 7 452 1416 -964

What I checked:

  • Repository policy applied: The root and scoped plugin/extension policies were read and applied; they treat plugin APIs, provider routing, auth state, fallback behavior, and runtime facade surfaces as compatibility-sensitive review areas. (AGENTS.md:1, 44027e72d07e)
  • Legacy bridge delegates to provider auth: The PR head resolves the OpenAI Codex provider auth hook and calls its OAuth method; only when that hook is unavailable does it load the activated bundled OpenAI facade. (src/plugins/provider-openai-codex-oauth.ts:54, edf12deb575f)
  • Plugin OAuth runtime preserves legacy hooks: The PR head passes legacy cancellation and manual-code hooks into the plugin-owned OAuth runtime while retaining the existing provider OAuth handler path. (extensions/openai/openai-codex-oauth.runtime.ts:254, edf12deb575f)
  • Compatibility tests cover the moved legacy behavior: The PR head adds focused tests for legacy callback routing, parallel manual input, cancellation propagation, provider-runtime refresh, facade fallback, and disabled-plugin failure behavior. (src/llm/utils/oauth/openai-codex.test.ts:47, edf12deb575f)
  • Token path stays in guarded plugin runtime: Current main's plugin-owned token request helper uses the SSRF-guarded fetch path with timeout, signal, audit context, and release cleanup; the PR reuses this path instead of duplicating token exchange in core. (extensions/openai/openai-codex-oauth-flow.runtime.ts:190, 44027e72d07e)
  • Live PR state: The live PR is open, not draft, mergeable but unstable, has maintainer approval from kevinslin on the current head, and still had exact-head check runs in progress during review. (edf12deb575f)

Likely related people:

  • vincentkoc: Recent commits on the legacy OpenAI Codex OAuth helper added cancellation and bounded token-request behavior that this PR preserves through the bridge. (role: recent auth contributor; confidence: high; commits: 5846878924b5, 67277088ebeb; files: src/llm/utils/oauth/openai-codex.ts, src/plugins/provider-openai-codex-oauth.ts)
  • steipete: The related internalization commit introduced the duplicated current-main surface, and recent history shows repeated OpenAI provider/auth touches in the same area. (role: major refactor and OpenAI provider contributor; confidence: high; commits: bb46b79d3c14, 77d9ac30bb8d, 49e9382cc05a; files: src/plugins/provider-openai-codex-oauth.ts, extensions/openai/openai-codex-oauth.runtime.ts, extensions/openai/openai-codex-provider.ts)
  • kevinslin: Live PR review data shows kevinslin approved the current head and is assigned to the PR, so they are the immediate routing candidate for the remaining merge decision. (role: current reviewer; confidence: medium; files: src/plugins/provider-openai-codex-oauth.ts, src/llm/utils/oauth/openai-codex.ts, extensions/openai/api.ts)
What the crustacean ranks mean
  • 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
  • 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
  • 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
  • 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
  • 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
  • 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
  • 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works
  • ClawSweeper keeps one durable marker-backed review comment per issue or PR.
  • Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
  • A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
  • PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
  • Maintainers can also comment @clawsweeper review to request a fresh review only.
  • Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
  • Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
  • Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

@clawsweeper clawsweeper Bot added rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. P2 Normal backlog priority with limited blast radius. merge-risk: 🚨 compatibility 🚨 May break existing users, config, migrations, defaults, or upgrade paths. merge-risk: 🚨 auth-provider 🚨 May break OAuth, tokens, provider routing, model choice, or credentials. labels May 27, 2026
@clawsweeper

clawsweeper Bot commented May 27, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ClawSweeper PR egg: ✨ hatched 🥚 common Brave Crabkin. Rarity: 🥚 common. Trait: sleeps inside passing CI.

Details

Share on X: post this hatch
Copy: My PR egg hatched a 🥚 common Brave Crabkin in ClawSweeper.
Hatchability:

  • Merged PRs are hatchable.
  • Open PRs are hatchable when they are status: 👀 ready for maintainer look, status: 🚀 automerge armed, or labeled clawsweeper:automerge.
  • Closed unmerged PRs are hatchable only when one of those hatchable labels is still present in the durable record.

About:

  • Eggs appear after real-behavior proof passes. They are collectible flavor only.
  • Review momentum changes the shell state: follow-up work warms it, re-review makes it wobble, and a clean final review lets it hatch.
  • The hatch is seeded from this repository and PR number, so the same PR keeps the same creature; the reviewed head SHA can only change safe visual details.
  • Rarity is just collectible sparkle: 🥚 common, 🌱 uncommon, 💎 rare, ✨ glimmer, and 🌈 legendary.

@clawsweeper clawsweeper Bot added rating: 🦐 gold shrimp Decent PR readiness signal, but merge confidence is limited. and removed rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. labels May 27, 2026
@RomneyDa RomneyDa force-pushed the codex/cleanup-openai-codex-oauth branch from 9b2f5d7 to 7066e38 Compare May 28, 2026 02:40
@clawsweeper clawsweeper Bot added rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. and removed rating: 🦐 gold shrimp Decent PR readiness signal, but merge confidence is limited. labels May 28, 2026
@RomneyDa

RomneyDa commented May 28, 2026

Copy link
Copy Markdown
Member Author

@clawsweeper re-review

@clawsweeper

clawsweeper Bot commented May 28, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

@RomneyDa RomneyDa force-pushed the codex/cleanup-openai-codex-oauth branch from 7066e38 to e1ee393 Compare May 28, 2026 03:42
@RomneyDa

RomneyDa commented May 28, 2026

Copy link
Copy Markdown
Member Author

@clawsweeper re-review

@clawsweeper

clawsweeper Bot commented May 28, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

@RomneyDa

RomneyDa commented May 28, 2026

Copy link
Copy Markdown
Member Author

@clawsweeper re-review

@clawsweeper

clawsweeper Bot commented May 28, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

🦞👀
ClawSweeper picked this up.

Command router queued. I will update this comment with the next step.

Re-review progress:

@RomneyDa RomneyDa marked this pull request as ready for review May 28, 2026 03:59
@clawsweeper clawsweeper Bot added rating: 🧂 unranked krab Not merge-ready due to missing proof or serious correctness/safety concerns. and removed rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. labels May 28, 2026
@clawsweeper clawsweeper Bot added status: ⏳ waiting on author ClawSweeper has contributor-facing work open and is waiting for author action. and removed status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. labels May 28, 2026
@RomneyDa RomneyDa force-pushed the codex/cleanup-openai-codex-oauth branch from e1ee393 to f2829ef Compare May 28, 2026 04:46
@clawsweeper clawsweeper Bot added rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. and removed rating: 🧂 unranked krab Not merge-ready due to missing proof or serious correctness/safety concerns. status: ⏳ waiting on author ClawSweeper has contributor-facing work open and is waiting for author action. labels May 28, 2026
@kevinslin kevinslin self-assigned this May 28, 2026
@RomneyDa

RomneyDa commented May 28, 2026

Copy link
Copy Markdown
Member Author

@clawsweeper re-review

@clawsweeper

clawsweeper Bot commented May 28, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

@RomneyDa RomneyDa force-pushed the codex/cleanup-openai-codex-oauth branch from f2829ef to edf12de Compare May 28, 2026 05:23
@clawsweeper clawsweeper Bot added the proof: sufficient ClawSweeper judged the real behavior proof convincing. label May 28, 2026
@RomneyDa RomneyDa merged commit e805ffd into main May 28, 2026
175 of 176 checks passed
@RomneyDa RomneyDa deleted the codex/cleanup-openai-codex-oauth branch May 28, 2026 05:32
@github-actions github-actions Bot mentioned this pull request May 28, 2026
Open
github-actions Bot pushed a commit to Desicool/openclaw that referenced this pull request May 29, 2026
@RomneyDa
refactor(openai): centralize codex oauth flow (openclaw#87411)
aeff863
SYU8384 pushed a commit to SYU8384/openclaw that referenced this pull request Jun 3, 2026
@RomneyDa
refactor(openai): centralize codex oauth flow (openclaw#87411)
0cc5620
sablehead pushed a commit to sablehead/openclaw that referenced this pull request Jun 10, 2026
@RomneyDa
refactor(openai): centralize codex oauth flow (openclaw#87411)
6fd313b
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@kevinslin kevinslin kevinslin approved these changes

Assignees

@kevinslin kevinslin

Labels

extensions: openai maintainer Maintainer-authored PR merge-risk: 🚨 auth-provider 🚨 May break OAuth, tokens, provider routing, model choice, or credentials. merge-risk: 🚨 compatibility 🚨 May break existing users, config, migrations, defaults, or upgrade paths. P2 Normal backlog priority with limited blast radius. proof: sufficient ClawSweeper judged the real behavior proof convincing. rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. size: XL status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@RomneyDa @kevinslin