fix(onboard): honor openai-codex auth-choice by setting primary model (#33290) by mwfj · Pull Request #33298 · openclaw/openclaw

mwfj · 2026-03-03T17:07:52Z

Summary

When onboarding explicitly chooses --auth-choice openai-codex, we should align runtime model selection with that choice. Previously, Codex OAuth credentials were stored but model primary could remain on Anthropic due to conservative default-rewrite rules, causing silent provider-intent mismatch.

What changed

src/commands/auth-choice.apply.openai.ts
- In the openai-codex path with setDefaultModel=true, set primary directly via applyPrimaryModel(..., OPENAI_CODEX_DEFAULT_MODEL)
- Keep user note only when the primary actually changed
src/commands/auth-choice.test.ts
- Add regression test: starting from anthropic/claude-sonnet-4-6, choosing openai-codex with setDefaultModel=true now switches primary to openai-codex/gpt-5.3-codex

Notes

This change is scoped to explicit onboarding auth choice behavior, not generic model-default heuristics.
Existing applyOpenAICodexModelDefault behavior remains unchanged for other callsites.

When onboarding explicitly chooses openai-codex, apply the codex primary model directly instead of using the conservative helper that only rewrites openai/* or empty defaults. This avoids silent intent mismatch where auth profile is codex but primary remains anthropic. Also add regression test covering anthropic->openai-codex switch when setDefaultModel=true.

WinnCook

Clean fix — using applyPrimaryModel directly instead of the wrapper is more explicit and avoids the silent no-op that caused the original bug. The before/after comparison via resolveAgentModelPrimaryValue is a nice pattern for gating the "Model configured" note.

Test coverage looks solid — confirms the primary actually changes when setDefaultModel: true is passed with the codex auth choice.

One minor observation: the import reordering in the test file is cosmetic but keeps things tidy. LGTM overall.

mwfj · 2026-03-03T17:10:36Z

Thanks @WinnCook — appreciate the detailed review and LGTM.\n\nAgree on the explicit path: this keeps onboarding intent deterministic for , and the note gating via before/after primary comparison avoids noisy messaging.\n\nI also re-checked against project style conventions (existing helper usage, import order, and test structure) and kept the change scoped to the explicit auth-choice path only.

greptile-apps · 2026-03-03T17:12:03Z

Greptile Summary

This PR fixes a silent provider mismatch during openai-codex onboarding by replacing the conservative applyOpenAICodexModelDefault helper with an unconditional applyPrimaryModel call. The core fix is correct: when the user explicitly picks openai-codex during onboarding with setDefaultModel: true, the primary model is now properly set to openai-codex/gpt-5.3-codex, and the "model configured" note is only shown if the primary actually changed.

Key changes:

auth-choice.apply.openai.ts: replaces applyOpenAICodexModelDefault with applyPrimaryModel for explicit model setting.
auth-choice.test.ts: adds a regression test starting from anthropic/claude-sonnet-4-6 and verifying the switch to openai-codex/gpt-5.3-codex.
Unmentioned side effect: applyPrimaryModel also injects the model into cfg.agents.defaults.models (the model allowlist), which the old helper never did. Whether this is intentional or an undesired side effect should be clarified and tested.

Confidence Score: 4/5

Safe to merge; the core fix is correct and well-tested, with one minor unresolved question about an allowlist side effect.
The fix correctly addresses the stated issue with a targeted, unconditional model-setting approach and solid regression test. The primary-model switch logic is correct, and the note is properly gated on actual change. The only concern is that applyPrimaryModel silently adds the model to the allowlist as a side effect, differing from the old helper—this is not tested, not mentioned in the PR, and its intentionality is unclear. However, this side effect is unlikely to cause breakage in practice and may even be desirable (making the model available in the picker). A clarification and optional test assertion would be prudent but not blocking.
src/commands/auth-choice.apply.openai.ts — verify whether the models-allowlist side effect from applyPrimaryModel is intentional; if so, add a test assertion.

_{Last reviewed commit: dd08097}

greptile-apps

_{2 files reviewed, 1 comment}

_{Edit Code Review Agent Settings | Greptile}

src/commands/auth-choice.apply.openai.ts

Address review feedback: avoid applyPrimaryModel side effect that injects openai-codex into agents.defaults.models. Keep behavior aligned with prior path (primary-only update) while still honoring explicit openai-codex onboarding intent. Add regression assertion that allowlist entry is unchanged.

mwfj · 2026-03-04T01:43:27Z

Reviewer note:

This PR intentionally updates extension peer dependency specifiers from "openclaw >=2026.3.1" to ">=2026.3.2" in:

extensions/googlechat/package.json
extensions/memory-core/package.json

and refreshes pnpm-lock.yaml accordingly.

Reason: CI secrets job runs pnpm-audit-prod, which was resolving [email protected] via extension peer resolution and failing on advisories patched in 2026.3.2.

So this is a deliberate minimum-version floor bump to keep dependency-audit CI green.

…olve conflicts

mwfj · 2026-03-05T03:08:48Z

Ready for review ✅ (fixes #33290)

Fixes onboarding auth-choice so selecting openai-codex is actually applied as the primary/default model.
Added/updated auth-choice tests (src/commands/auth-choice.test.ts) for regression coverage.
CI is green on latest commit.
Included required audit fix (tar bumped to 7.5.10, lockfile refreshed).

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 0789a29d3a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

src/commands/auth-choice.test.ts

…tion

mwfj · 2026-03-07T02:23:53Z

Update on the recurring secrets CI failure:

This failure is not caused by the auth-choice code change in this PR.
Root cause is in shared workflow logic on main (.github/workflows/ci.yml): PR secrets scan diffs against github.event.pull_request.base.sha while checkout is shallow (fetch-depth: 1). When the base SHA is missing locally, it falls back to full-repo detect-secrets scan.

Tracking + fix are now split out as requested:

Issue: CI secrets PR fast-path can fallback to full scan when base SHA missing in shallow checkout #38481
Dedicated CI fix PR: fix(ci): ensure PR base commit before secrets diff; avoid full-scan fallback #38482

Expect the wait the secrets CI failure fixed by upstream

mwfj · 2026-03-07T02:38:16Z

Ready for review ✅ (fixes #33290)

…ve pnpm-lock conflict

mwfj · 2026-03-09T02:35:25Z

CI follow-up after conflict resolution:\n\nTwo checks are currently failing, and they appear to be upstream/baseline issues rather than specific to this PR's changes:

Fails on src/cli/daemon-cli/lifecycle.test.ts formatting drift.
- Already tracked by open PRs: fix: format daemon lifecycle test #40450 and fix(ci): Fix checkstyle error in lifecycle.test.ts #40417.\n\n2) checks-windows shard 6\n- Fails in src/secrets/runtime.test.ts with Windows ACL verification errors:
- keeps active secrets runtime snapshots resolved after config writes
- clears active secrets runtime state and throws when refresh fails after a write
Error signature: SecretProviderResolutionError ... path ACL verification unavailable on Windows ...`
- I couldn't find a clear dedicated tracking PR/issue for this exact failure yet and wait for upstream fixed.

Given this, the issue is not introduced by this PR, and we are ready to review

mwfj · 2026-03-24T05:31:15Z

Closing this as stale/superseded by upstream changes.

I re-checked main and the underlying onboarding behavior is already covered there in the newer provider-plugin flow:

extensions/openai/openai-codex-provider.ts returns defaultModel: OPENAI_CODEX_DEFAULT_MODEL for the openai-codex OAuth path
src/plugins/provider-auth-choice.ts applies that default when setDefaultModel=true

So the original intent of this PR (making explicit openai-codex onboarding select the Codex primary/default model) is already handled upstream, just in the refactored implementation rather than the old src/commands/auth-choice.apply.openai.ts path.

Since this branch is now conflicted and no longer needed to land the fix, closing it.

openclaw-barnacle bot added commands Command implementations size: S labels Mar 3, 2026

mwfj mentioned this pull request Mar 3, 2026

[Bug]: onboard --auth-choice openai-codex does not set agents.defaults.model.primary #33290

Closed

WinnCook reviewed Mar 3, 2026

View reviewed changes

greptile-apps bot reviewed Mar 3, 2026

View reviewed changes

src/commands/auth-choice.apply.openai.ts Outdated Show resolved Hide resolved

mwfj added 4 commits March 4, 2026 01:16

Merge branch 'main' into fix/onboard-auth-choice-sets-primary

689f08b

fix: resolve PR 33298 check CI failure

ddfa246

fix(ci): resolve secrets audit by bumping extension peer floor

1d5ffc7

openclaw-barnacle bot added channel: googlechat Channel integration: googlechat extensions: memory-core Extension: memory-core labels Mar 4, 2026

mwfj added 2 commits March 4, 2026 09:47

Merge branch 'main' into fix/onboard-auth-choice-sets-primary

8745e0a

Merge upstream/main into fix/onboard-auth-choice-sets-primary and res…

97e20e2

…olve conflicts

openclaw-barnacle bot removed channel: googlechat Channel integration: googlechat extensions: memory-core Extension: memory-core labels Mar 5, 2026

mwfj added 2 commits March 5, 2026 10:05

fix(deps): bump tar to 7.5.10 to satisfy audit

363454f

Merge branch 'main' into fix/onboard-auth-choice-sets-primary

c3bfc60

Merge branch 'main' into fix/onboard-auth-choice-sets-primary

0789a29

chatgpt-codex-connector bot reviewed Mar 7, 2026

View reviewed changes

src/commands/auth-choice.test.ts Outdated Show resolved Hide resolved

mwfj added 3 commits March 7, 2026 09:57

test(auth-choice): use OPENAI_CODEX_DEFAULT_MODEL in regression asser…

056ae27

…tion

fix(ci): stabilize secrets PR scan and format auth-choice test

df15f94

chore: keep PR scoped; move secrets workflow fix to dedicated track

a585472

mwfj mentioned this pull request Mar 7, 2026

CI secrets PR fast-path can fallback to full scan when base SHA missing in shallow checkout #38481

Closed

style(auth-choice): apply oxfmt formatting

1a20034

mwfj added 2 commits March 7, 2026 10:59

Merge branch 'main' into fix/onboard-auth-choice-sets-primary

5fea447

Merge origin/main into fix/onboard-auth-choice-sets-primary and resol…

beb51ff

…ve pnpm-lock conflict

Merge branch 'main' into fix/onboard-auth-choice-sets-primary

04d84ac

mwfj closed this Mar 24, 2026

mwfj deleted the fix/onboard-auth-choice-sets-primary branch March 24, 2026 05:33

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(onboard): honor openai-codex auth-choice by setting primary model (#33290)#33298

fix(onboard): honor openai-codex auth-choice by setting primary model (#33290)#33298
mwfj wants to merge 17 commits intoopenclaw:mainfrom
mwfj:fix/onboard-auth-choice-sets-primary

mwfj commented Mar 3, 2026 •

edited

Loading

Uh oh!

WinnCook left a comment

Uh oh!

mwfj commented Mar 3, 2026

Uh oh!

greptile-apps bot commented Mar 3, 2026

Uh oh!

greptile-apps bot left a comment

Uh oh!

Uh oh!

mwfj commented Mar 4, 2026

Uh oh!

mwfj commented Mar 5, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector bot left a comment

Uh oh!

Uh oh!

mwfj commented Mar 7, 2026 •

edited

Loading

Uh oh!

mwfj commented Mar 7, 2026

Uh oh!

mwfj commented Mar 9, 2026 •

edited

Loading

Uh oh!

mwfj commented Mar 24, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

mwfj commented Mar 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

What changed

Notes

Uh oh!

WinnCook left a comment

Choose a reason for hiding this comment

Uh oh!

mwfj commented Mar 3, 2026

Uh oh!

greptile-apps bot commented Mar 3, 2026

Greptile Summary

Confidence Score: 4/5

Uh oh!

greptile-apps bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

mwfj commented Mar 4, 2026

Uh oh!

mwfj commented Mar 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

mwfj commented Mar 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

mwfj commented Mar 7, 2026

Uh oh!

mwfj commented Mar 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

mwfj commented Mar 24, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

mwfj commented Mar 3, 2026 •

edited

Loading

mwfj commented Mar 5, 2026 •

edited

Loading

mwfj commented Mar 7, 2026 •

edited

Loading

mwfj commented Mar 9, 2026 •

edited

Loading