Bug type

Behavior bug (incorrect output/state without crash)

Beta release blocker

No

Summary

In 2026.5.14-beta.1, a Codex-authenticated session can route OpenClaw compaction summarization through the public openai-responses provider path and fail with 401 Missing scopes: api.responses.write.

Steps to reproduce

NOT_ENOUGH_INFO

Observed setup and trigger:

1. Run OpenClaw 2026.5.14-beta.1 with a session using Codex OAuth auth.
2. Effective session metadata shows provider=openai, modelId=gpt-5.5, modelApi=openai-responses, and authProfileId=openai-codex:<account>.
3. Trigger session compaction.
4. Observe OpenClaw compaction summarization fail with the log shown below.

Expected behavior

A Codex OAuth-backed session should not attempt public OpenAI Responses API summarization with the Codex OAuth token. Compaction should either use the Codex-compatible transport/native Codex compaction path, drop incompatible Codex auth when switching to public openai/*, or fail early with a clear routing/auth configuration error.

Actual behavior

OpenClaw logs a full summarization failure during compaction:

2026-05-15T11:31:54.587+10:00 [compaction] Full summarization failed: Summarization failed: 401 You have insufficient permissions for this operation. Missing scopes: api.responses.write. Check that you have the correct role in your organization (Reader, Writer, Owner) and project (Member, Owner), and if you're using a restricted API key, that it has the necessary scopes.

Local session evidence from 2026.5.14-beta.1:

OpenClaw 2026.5.14-beta.1
Model: openai/gpt-5.5
Auth: oauth (openai-codex:<redacted account>)
Runtime: OpenAI Codex

Trajectory metadata for the affected session showed:

provider=openai
modelId=gpt-5.5
modelApi=openai-responses
authProfileId=openai-codex:<redacted account>

OpenClaw version

2026.5.14-beta.1

Operating system

Linux container in OpenShift/Kubernetes; exact base OS NOT_ENOUGH_INFO

Install method

Prebuilt OpenClaw container image running in OpenShift/Kubernetes

Model

openai/gpt-5.5

Provider / routing chain

OpenClaw session metadata: provider=openai / modelApi=openai-responses; auth profile: openai-codex OAuth; runtime shown as OpenAI Codex.

Additional provider/model setup details

Relevant local config shape:

{
  "agents": {
    "defaults": {
      "model": {
        "primary": "openai/gpt-5.5",
        "fallbacks": ["anthropic/claude-sonnet-4-6", "minimax/MiniMax-M2.7", "zai/glm-5"]
      },
      "compaction": {
        "mode": "safeguard",
        "memoryFlush": { "enabled": true }
      }
    }
  }
}

No explicit agents.defaults.compaction.model override was set in the observed config.

Logs, screenshots, and evidence

Observed log:
2026-05-15T11:31:54.587+10:00 [compaction] Full summarization failed: Summarization failed: 401 You have insufficient permissions for this operation. Missing scopes: api.responses.write. Check that you have the correct role in your organization (Reader, Writer, Owner) and project (Member, Owner), and if you're using a restricted API key, that it has the necessary scopes.

Installed package:
/app/package.json version = 2026.5.14-beta.1

Live session status:
OpenClaw 2026.5.14-beta.1
Model: openai/gpt-5.5
Auth: oauth (openai-codex:<redacted account>)
Runtime: OpenAI Codex

Trajectory metadata:
provider=openai
modelId=gpt-5.5
modelApi=openai-responses
authProfileId=openai-codex:<redacted account>

Source-code trace in tag v2026.5.14-beta.1 (cef414562d6844f68c875a8771abc801c11b15a5):

src/agents/compaction.ts
- summarizeChunks() calls generateSummary(...)
- summarizeWithFallback() logs `Full summarization failed: ...` when that call throws

src/agents/pi-embedded-runner/compaction-runtime-context.ts
- resolveEmbeddedCompactionTarget() preserves the current provider/model/authProfileId when no compaction.model override is configured

src/agents/pi-embedded-runner/compact.ts
- compactEmbeddedPiSessionDirectOnce() resolves auth via getApiKeyForModel()
- prepareProviderRuntimeAuth() can then prepare runtime auth for the resolved provider/model

src/agents/openai-transport-stream.ts
- openai-responses path calls client.responses.create(...), which requires public OpenAI API scope api.responses.write

extensions/openai/openai-codex-provider.ts and extensions/openai/openclaw.plugin.json
- openai-codex provider is a distinct transport using api=openai-codex-responses and chatgpt.com/backend-api/codex

Impact and severity

Affected: at least one Codex OAuth-backed OpenClaw session on 2026.5.14-beta.1 using openai/gpt-5.5 with compaction enabled.

Severity: Medium to high. The main turn can continue, but compaction loses summarization and therefore risks degraded session continuity near context limits.

Frequency: NOT_ENOUGH_INFO

Consequence: compaction summary generation fails, producing a fallback/no-summary compaction path instead of a useful recovery summary.

Additional information

This appears to be a routing/auth mismatch more than a raw upstream Codex CLI failure. The logged prefix Full summarization failed is emitted by OpenClaw's compaction wrapper, while the missing scope comes from the public OpenAI Responses API call attempted with Codex OAuth credentials.

Potential fix directions:

1. If a session is authenticated with an openai-codex:* profile, compaction should prefer openai-codex/* / openai-codex-responses unless explicitly configured otherwise.
2. If compaction resolves to public openai/*, do not carry an openai-codex:* auth profile into that request.
3. Add an early validation/error message when provider/model/auth profile families are incompatible.
4. Consider documenting or auto-setting agents.defaults.compaction.model for Codex OAuth sessions.