Bug

Upgrading to OpenClaw 2026.4.26 (verified node[…]: 2026.4.26) on a stack that never had OpenAI configured introduces:

1. A codex provider in the agent's models.json catalog with gpt-5.5, gpt-5.4-mini, gpt-5.2
2. A new bundled skill coding-agent (eligible by default because claude, codex, opencode, pi are on PATH) that delegates to Codex unless explicitly disabled
3. A model-fallback/decision runtime that attempts openai/gpt-5.5 as a candidate

Result on a stack with no OPENAI_API_KEY:

[diagnostic] lane task error: error="No API key found for provider \"openai\". Auth store: …/auth-profiles.json (agentDir: …). Configure auth for this agent (openclaw agents add <id>) or copy auth-profiles.json from the main agentDir."
[model-fallback/decision] requested=openai/gpt-5.5 candidate=openai/gpt-5.5 reason=auth next=none
Embedded agent failed before reply: No API key found for provider "openai".

Every chat lane fails before reply with no obvious upgrade-time prompt that an OpenAI key is now required.

Stack details (no OpenAI ever configured)

• models.json providers in use: deepseek, anthropic, ollama (all keys configured)
• Agents.defaults.model.primary: deepseek/deepseek-v4-flash
• Agents.defaults.model.fallbacks: deepseek/deepseek-v4-pro, ollama/qwen3.6:27b-heretic
• No auth-profiles.json for OpenAI; user has stated repeatedly they do not use ChatGPT/Codex.

Expected

• Bundled coding-agent / codex provider should NOT be enabled by default on agents that have never configured an OpenAI auth profile.
• If a user has a primary + fallbacks chain that routes to non-OpenAI providers, the runtime should not synthesize an openai/gpt-5.5 candidate.
• Upgrade flow should warn ("This release adds a Codex coding-agent skill — needs OpenAI auth to use") and require explicit enable.

Workaround (what fixed it)

# 1. Strip codex provider from agent models.json
python3 -c "import json; p='~/.openclaw/agents/main/agent/models.json'; ..." # remove 'codex' provider key

# 2. Remove openai/* from huggingface catalog
# (3 entries: openai/gpt-oss-120b, openai/gpt-oss-20b, openai/gpt-oss-safeguard-20b)

# 3. Disable coding-agent skill (per docs at /tools/skills-config)
#    Set skills.entries.coding-agent.enabled = false in BOTH ~/.openclaw/openclaw.json
#    AND $OPENCLAW_STATE_DIR/openclaw.json

# 4. Restart gateway
openclaw gateway restart

After this, openclaw skills check shows Disabled: 1 and the auth-failure spam stops.

Reproducibility

100% on any v2026.4.26 install where the user does not have an OpenAI key.

Related

• Control UI device token mismatch loop after scope upgrade causes rate-limit lockout #71609 (device_token_mismatch rate-limit loop) — adjacent, also occurred in same session but separate root cause
• [Bug]: openai-codex/gpt-5.5 hangs silently on 2026.4.25 — no tokens streamed, no error logged, legacy OAuth path #72966 ([Bug] openai-codex/gpt-5.5 hangs silently on 2026.4.25) — that issue is about Codex usage failing when invoked; this issue is about Codex being enabled silently as default even when the user has no OpenAI

Suggestion

Either (a) gate the coding-agent skill behind explicit OpenAI auth presence, (b) make Codex one peer of many in the routing decision rather than the default, or (c) require an opt-in flag during upgrade.