OpenClaw Bug Report — Codex ACP Subagents Fail With ACP_TURN_FAILED

Date: 2026-04-22
Reporter: Lon Obers (@Lon1337)
OpenClaw version affected: 2026.4.15, 2026.4.20, 2026.4.21 (likely all recent)
Codex CLI version: 0.98.0 (@openai/codex)
OS: macOS 25.4.0 (arm64)
Node: 22.22.0

Summary

Codex ACP subagents spawned via sessions_spawn(runtime: "acp", agentId: "codex") fail within 2-3 seconds with AcpRuntimeError: Internal error: code=ACP_TURN_FAILED, even though the underlying Codex CLI works perfectly with OAuth (ChatGPT Pro sub) when invoked directly.

Reproduction

1. Fresh codex login via OAuth (ChatGPT Pro plan)
2. Verify codex exec --model gpt-5.4 --skip-git-repo-check - works via CLI → returns text successfully
3. Spawn ACP subagent through OpenClaw: sessions_spawn(runtime: "acp", agentId: "codex", task: "say hi")
4. → Fails in ~2s with ACP_TURN_FAILED and no child output

Observed Behavior

• CLI direct (with OAuth): works (codex exec returns "Hi Lon")
• CLI with CODEX_HOME=<harness-auth-bridge-dir>: works
• ACP subagent via OpenClaw: fails (ACP_TURN_FAILED, 2s, 0 tokens)

Gateway Log

{"subsystem":"gateway/ws"} ⇄ res ✗ agent errorCode=UNAVAILABLE 
errorMessage=AcpRuntimeError: Internal error 
runId=63c55141-4409-492a-b25b-ddbca2939a2c 
error=AcpRuntimeError: Internal error: code=ACP_TURN_FAILED

Repeated pattern: resolving authentication... followed by ACP_TURN_FAILED within 2s. No codex rollout file is created in the harness-auth sessions directory, implying codex never actually starts.

Related Findings (during debugging)

1. OpenClaw overwrites ~/.codex/auth.json: After codex login stores valid OAuth tokens, gateway start/restart reverts ~/.codex/auth.json to auth_mode: "apikey" with empty tokens. This may be unintentional tamper on an already-valid user auth file.

2. Agent auth-profiles store had expired tokens: agents/elon/agent/auth-profiles.json contained an openai-codex:default profile expired since 2026-03-28. The openai-codex:[email protected] profile was valid until 2026-05-12. Manually updating the default profile with fresh msn.com tokens did not fix ACP.

3. Refresh token flow works but tokens unusable by codex CLI: Calling OpenAI's /oauth/token endpoint with grant_type=refresh_token returns new access/id/refresh tokens, but writing them to ~/.codex/auth.json manually results in ERROR: Token data is not available. Only the CLI's own OAuth redirect flow (codex login) produces tokens the CLI can use. This suggests codex CLI does something extra during login (keychain storage?) that the refresh endpoint doesn't replicate.

4. Bridge architecture: Files openai-codex-cli-bridge-iSYIlfzO.js and openai-codex-cli-auth-BZb3H5Ww.js prepare a per-agent CODEX_HOME with isolated auth.json. The bridge file at agents/main/agent/harness-auth/codex/<hash>/auth.json is created with auth_mode: "chatgpt" but the tokens written don't work when passed via CODEX_HOME.

5. openclaw.json clobbering: Removing the providers.openai.apiKey field from openclaw.json results in OpenClaw restoring it and saving the edit as openclaw.json.clobbered.<timestamp> backup. Not sure if this is related but unusual behavior.

Environment

• ChatGPT Pro sub active (plan: pro, [email protected], org Redux org-ryrstoifv9CzmiK7OJ7GLmk2, sub until 2026-05-07)
• OpenAI API key sk-proj-Mn0yZrL7... has insufficient_quota
• Both Pro sub and API key configured in OpenClaw

What We Need

• How should codex ACP harness auth be set up when user has ChatGPT Pro sub?
• Is there a supported way to point codex ACP at the user's ~/.codex/auth.json?
• Why does the bridge-prepared auth.json fail even with fresh OAuth tokens including id_token + account_id?
• Is ACP_TURN_FAILED auth-related or something else in the ACP turn initialization?

Tested Versions

Version-independent issue.

Files Referenced

• ~/.codex/auth.json (overwritten by gateway)
• ~/.openclaw/agents/elon/agent/auth-profiles.json (had expired default profile)
• ~/.openclaw/agents/main/agent/harness-auth/codex/06bfb5171eff0241/auth.json (bridge)
• /tmp/openclaw/openclaw-2026-04-22.log (gateway log)
• /opt/homebrew/lib/node_modules/openclaw/dist/openai-codex-cli-bridge-iSYIlfzO.js
• /opt/homebrew/lib/node_modules/openclaw/dist/openai-codex-cli-auth-BZb3H5Ww.js
• /opt/homebrew/lib/node_modules/openclaw/dist/provider-auth-runtime-BOA0fEzs.js

Workaround

Using Opus 4.7 as orchestrator without subagents. Long-running work that would benefit from GPT-5.4 delegation is on hold.