Skip to content

fix: install Codex for OpenAI onboarding#79709

Merged
pashpashpash merged 2 commits into
mainfrom
fix/openai-onboarding-codex-runtime
May 9, 2026
Merged

fix: install Codex for OpenAI onboarding#79709
pashpashpash merged 2 commits into
mainfrom
fix/openai-onboarding-codex-runtime

Conversation

@steipete

@steipete steipete commented May 9, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Summary

  • install the Codex runtime plugin from npm when OpenAI model selection requires the Codex harness
  • include bundled Codex in gateway startup planning for implicit OpenAI routes unless the user explicitly disables/denies it or manually pins the model to PI
  • run the same Codex install helper from noninteractive provider onboarding after an OpenAI default model is applied

Fixes #79358.

Real behavior proof

  • Behavior or issue addressed: OpenAI onboarding should automatically install/load the Codex runtime for official openai/* model routes so API-key profiles work without a manual harness override.
  • Real environment tested: Crabbox Blacksmith Testbox Linux Docker E2E using OpenClaw npm tarballs built from this PR checkout; live-key proof used the Testbox .profile OpenAI key mounted into Docker with secret output redacted.
  • Exact steps or command run after this patch: env CI=1 OPENCLAW_NPM_ONBOARD_CHANNEL=telegram OPENCLAW_VITEST_NO_OUTPUT_TIMEOUT_MS=900000 pnpm test:docker:npm-onboard-channel-agent; env CI=1 OPENCLAW_CODEX_NPM_PLUGIN_MODEL=openai/gpt-5.5 OPENCLAW_CODEX_NPM_PLUGIN_ALLOW_BETA_COMPAT_DIAGNOSTICS=1 OPENCLAW_VITEST_NO_OUTPUT_TIMEOUT_MS=900000 bash scripts/e2e/codex-npm-plugin-live-docker.sh.
  • Evidence after fix: copied live output from Testbox: npm tarball onboard/channel/agent Docker E2E passed (telegram) from tbx_01kr5sh9aqw6k6yn2jw12vdywy; copied live output from Testbox: Codex npm plugin live Docker E2E passed from tbx_01kr5sqhcb4sjx0m1rzp5aabpn.
  • Observed result after fix: the packaged Docker onboarding flow completed a Telegram/OpenAI agent turn, and the live Codex npm plugin flow installed @openclaw/codex, logged in with the .profile OpenAI key, ran Codex preflight, and completed an OpenClaw agent turn through openai/gpt-5.5.
  • What was not tested: I could not reproduce the exact original Missing bearer or basic authentication in header message after the fix; the issue comment asks for redacted config snippets if that symptom remains.

Verification

  • pnpm test src/commands/onboard-non-interactive/local/auth-choice.plugin-providers.test.ts src/plugins/channel-plugin-ids.test.ts src/commands/auth-choice.test.ts
  • env -u OPENCLAW_TESTBOX pnpm check:changed --staged

@openclaw-barnacle openclaw-barnacle Bot added commands Command implementations size: M maintainer Maintainer-authored PR labels May 9, 2026
@steipete steipete mentioned this pull request May 9, 2026
Closed
@clawsweeper

clawsweeper Bot commented May 9, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Codex review: needs changes before merge.

Summary
The branch installs and starts the Codex runtime plugin for implicit OpenAI onboarding routes, prefers npm for that official install, adds startup/noninteractive coverage, updates the changelog, and adds Crabbox proof guidance.

Reproducibility: yes. at source level. Current main lacks the noninteractive Codex install call, the linked Docker onboarding report shows the user-visible failure, and this PR's body provides after-fix Testbox live output, though this read-only review did not rerun the Docker lane.

Real behavior proof
Sufficient (live_output): The PR body includes after-fix Testbox/Docker live output for packaged onboarding and live Codex npm plugin flows, with command lines and redaction notes.

Next step before merge
A single narrow repair can gate the new noninteractive install call on resolved runtime policy and add PI regression coverage.

Security
Cleared: The diff touches npm plugin installation, but it uses the existing official @openclaw/codex onboarding path and I found no concrete supply-chain regression beyond the PI correctness blocker.

Review findings

  • [P2] Respect explicit PI before installing Codex — src/commands/onboard-non-interactive/local/auth-choice.plugin-providers.ts:205-211
Review details

Best possible solution:

Share or extend the Codex-install decision so it resolves provider/model runtime policy and skips explicit PI before invoking the noninteractive installer, while keeping automatic Codex install/load for implicit OpenAI routes.

Do we have a high-confidence way to reproduce the issue?

Yes, at source level. Current main lacks the noninteractive Codex install call, the linked Docker onboarding report shows the user-visible failure, and this PR's body provides after-fix Testbox live output, though this read-only review did not rerun the Docker lane.

Is this the best way to solve the issue?

No as written. The startup-planning direction is narrow and matches the documented runtime policy, but the noninteractive installer needs the same explicit-PI guard before merge.

Full review comments:

  • [P2] Respect explicit PI before installing Codex — src/commands/onboard-non-interactive/local/auth-choice.plugin-providers.ts:205-211
    For configs that pin the selected openai/* model to agentRuntime.id: "pi", this new noninteractive path still calls the Codex install helper because that helper only checks provider/base URL. That can download and enable @openclaw/codex for the documented direct API-key-through-PI route and can fail offline setup even though Codex is not required. Gate this call on resolved runtime policy, matching the startup planner's PI skip behavior.
    Confidence: 0.83

Overall correctness: patch is incorrect
Overall confidence: 0.83

Acceptance criteria:

  • pnpm test src/commands/onboard-non-interactive/local/auth-choice.plugin-providers.test.ts src/plugins/channel-plugin-ids.test.ts src/commands/auth-choice.test.ts src/agents/openai-codex-routing.test.ts
  • env -u OPENCLAW_TESTBOX pnpm check:changed --staged

What I checked:

Likely related people:

  • @pashpashpash: GitHub path history shows the current OpenAI-through-Codex default routing and runtime-policy work landed in merged commits affecting the central Codex routing surfaces. (role: introduced behavior; confidence: high; commits: 1c3399010815, 02fe0d8978db; files: src/agents/harness-runtimes.ts, src/commands/codex-runtime-plugin-install.ts, src/agents/model-runtime-policy.ts)
  • @steipete: Recent current-main history and the PR branch touch onboarding, plugin setup, and gateway startup planning around this exact change. (role: recent maintainer; confidence: high; commits: 0eb06caae380, d655a8bc7654, bed8f49b8dd8; files: src/plugins/gateway-startup-plugin-ids.ts, src/commands/onboarding-plugin-install.ts, src/commands/onboard-non-interactive/local/auth-choice.plugin-providers.ts)
  • @vincentkoc: History shows adjacent plugin startup/type extraction work and co-authorship on the earlier install-on-selection routing effort that this PR revisits. (role: adjacent owner; confidence: medium; commits: c8f3fecad6fe, 74e7b8d47b18, 1d34564de9ba; files: src/plugins/gateway-startup-plugin-ids.ts, src/commands/onboarding-plugin-install.ts)

Remaining risk / open question:

  • Explicit PI OpenAI setups in offline or locked-down noninteractive onboarding can fail by attempting an unnecessary Codex npm install.

Codex review notes: model gpt-5.5, reasoning high; reviewed against 602c59a092fd.

@clawsweeper clawsweeper Bot added the proof: sufficient ClawSweeper judged the real behavior proof convincing. label May 9, 2026
@pashpashpash
pashpashpash merged commit 5849c32 into main May 9, 2026
111 checks passed
@pashpashpash
pashpashpash deleted the fix/openai-onboarding-codex-runtime branch May 9, 2026 07:57
This was referenced May 9, 2026
Merged
Closed
lykeion-dev pushed a commit to lykeion-dev/openclaw--rev that referenced this pull request May 14, 2026
@steipete @lykeion-dev
fix: install Codex for OpenAI onboarding (openclaw#79709)
8ae3ad1 
* fix: install codex for openai onboarding

* docs: require crabbox e2e bug proof
github-actions Bot pushed a commit to Desicool/openclaw that referenced this pull request May 24, 2026
@steipete
fix: install Codex for OpenAI onboarding (openclaw#79709)
67ff5d5 
* fix: install codex for openai onboarding

* docs: require crabbox e2e bug proof
jameslcowan pushed a commit to jameslcowan/openclaw that referenced this pull request Jun 2, 2026
@steipete
fix: install Codex for OpenAI onboarding (openclaw#79709)
cfb5796 
* fix: install codex for openai onboarding

* docs: require crabbox e2e bug proof
sablehead pushed a commit to sablehead/openclaw that referenced this pull request Jun 10, 2026
@steipete
fix: install Codex for OpenAI onboarding (openclaw#79709)
d15d615 
* fix: install codex for openai onboarding

* docs: require crabbox e2e bug proof
@clawsweeper clawsweeper Bot mentioned this pull request Jun 20, 2026
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

commands Command implementations maintainer Maintainer-authored PR proof: sufficient ClawSweeper judged the real behavior proof convincing. size: M

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

OpenAI requests sent without Authorization header — wizard-saved openai:default (type: api_key) profile is ignored at request time

2 participants

@steipete @pashpashpash