Summary

After upgrading to OpenClaw 2026.3.8, openclaw models auth login --provider openai-codex can fail behind proxy or TUN setups even when the browser portion of OAuth succeeds.

The browser completes authentication and shows Authentication successful. Return to your terminal to continue., but the terminal then fails during the OAuth token exchange or refresh step against https://auth.openai.com/oauth/token.

Symptoms

• code->token failed: 403 {"error":{"code":"unsupported_country_region_territory"...}}
• Token refresh error: getaddrinfo ENOTFOUND auth.openai.com
• stale processes can also surface connect ECONNREFUSED 127.0.0.1:7890 if an old proxy port was cached

Reproduction

1. Upgrade to OpenClaw 2026.3.8.
2. Run OpenClaw behind HTTP_PROXY / HTTPS_PROXY or a TUN-based proxy setup.
3. Run openclaw models auth login --provider openai-codex.
4. Complete the browser sign-in.
5. Watch the CLI fail during the post-browser token exchange.

Expected

The OpenAI Codex OAuth token exchange and refresh requests should respect the same proxy environment as the rest of OpenClaw's network stack.

Actual

The openai-codex OAuth path can fall back to direct transport for auth.openai.com/oauth/token, which breaks token exchange in proxy-only environments.

Likely cause

openai-codex login delegates into @mariozechner/pi-ai, whose OAuth token exchange/refresh path uses fetch() internally. OpenClaw already has proxy-aware undici infrastructure, but that dispatcher was not being installed around the Codex OAuth call, so those internal requests could miss env proxy routing.

Proposed fix

Wrap the loginOpenAICodex() call with a temporary EnvHttpProxyAgent-backed global undici dispatcher whenever proxy env vars are present, then restore the previous dispatcher afterward.