fix(provider-usage): honor proxy env for usage fetch by TurboTheTurtle · Pull Request #93943 · openclaw/openclaw

TurboTheTurtle · 2026-06-17T04:50:42Z

Summary:

Prefer an explicit provider-usage fetch when supplied.
Otherwise use the existing env proxy fetch helper before falling back to global fetch, so Codex usage snapshots inherit HTTP(S)_PROXY.
Add plugin-boundary coverage that executes the usage context fetch through a local EnvHttpProxyAgent path and verifies explicit fetch still wins.
Remove one unused Claude permission helper type that currently fails prod lint/types on latest main.

Real behavior proof

Behavior addressed: Codex provider usage fetch selection now honors HTTP(S)_PROXY when no explicit fetch is supplied, while an explicit fetch still takes precedence.
Real environment tested: Local macOS source checkout at 6b04ad0bb7, Node v24.15.0, with a local HTTP proxy server. A fake token was used and no real ChatGPT/OAuth request completed.
Exact steps or command run after this patch: Ran a node --import tsx --input-type=module source-runtime probe that called resolveProxyFetchFromEnv({ HTTPS_PROXY: localProxy }) for https://chatgpt.com/backend-api/wham/usage; the local proxy returned 502 after recording the tunnel request.
Evidence after fix: Terminal output from the local proxy probe:

{
  "proof": "env proxy fetch routes Codex usage URL through local HTTPS_PROXY",
  "proxyUrl": "http://127.0.0.1:<local-port>",
  "result": {
    "error": "fetch failed"
  },
  "proxyRequests": [
    {
      "method": "CONNECT",
      "url": "chatgpt.com:443",
      "host": "chatgpt.com"
    }
  ]
}

Observed result after fix: The local proxy recorded CONNECT chatgpt.com:443, showing the Codex usage URL was routed through the env proxy path instead of direct Node fetch.
What was not tested: No live ChatGPT/OAuth usage request was sent; the local proof proxy intentionally returned 502 after capturing the tunnel.

TurboTheTurtle · 2026-06-17T19:28:27Z

@clawsweeper re-review

clawsweeper · 2026-06-17T19:28:30Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

State: Failed
Detail: The targeted re-review did not finish cleanly. Check the workflow run for details.
Run: https://github.com/openclaw/clawsweeper/actions/runs/27752703406
Updated: 2026-06-18T10:27:59.025Z

clawsweeper · 2026-06-17T21:45:12Z

Codex review: needs maintainer review before merge. Reviewed June 20, 2026, 10:54 PM ET / 02:54 UTC.

Summary
The PR changes provider-usage loading to prefer explicit fetch, then env-proxy fetch, then global fetch, adds focused provider-usage tests, and removes one unused MCP type.

PR surface: Source -4, Tests +136. Total +132 across 4 files.

Reproducibility: yes. Current main still resolves provider-usage fetch with plain resolveFetch(opts.fetch) and passes that into the OpenAI/Codex usage hook, while the linked issue provides a proxy-only failure and local fix confirmation.

Review metrics: 1 noteworthy metric.

Provider usage fetch precedence: 1 fallback path changed. When no explicit fetch is supplied, provider usage will try env proxy fetch before global fetch, which affects upgrade behavior for users with proxy env set.

Root-cause cluster
Relationship: fixed_by_candidate
Canonical: #78714
Summary: This PR is the active fix candidate for the canonical provider-usage proxy env bug; the earlier same-shape PR is closed unmerged.

Members:

canonical: [Bug]: Codex provider usage ignores proxy env and reports fetch failed #78714 - The issue reports the proxy-only Codex provider usage failure, and this PR uses closing syntax for it.
superseded: fix(provider-usage): prefer proxy-aware fetch for Codex usage loads #78753 - The earlier PR proposed the same loader-level env proxy precedence but is closed unmerged, while this PR is open with stronger proof and current tests.

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🐚 platinum hermit
Patch quality: 🐚 platinum hermit
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

none.

Risk before merge

[P1] Changing provider usage to honor inherited proxy env can make usage fetch fail in environments with stale or broken HTTP(S)_PROXY where direct fetch previously worked.
[P1] The supplied proof validates the proxy-routing path with a fake token and local proxy, but no live authenticated openclaw status --usage --json OAuth request through a proxy was run.

Maintainer options:

Accept env-proxy precedence (recommended)
Land this if maintainers agree provider usage should honor HTTP(S)_PROXY consistently with other OpenClaw network paths even when stale proxy env can break usage fetches.
Add a diagnostic fallback policy first
Before merge, add maintainer-chosen diagnostic or fallback behavior if provider usage should not fail solely because inherited proxy env is broken.

Next step before merge

[P2] The open PR already contains the focused fix candidate; the remaining action is maintainer review of env-proxy precedence, not an automated repair.

Security
Cleared: No concrete security or supply-chain issue was found; the diff reuses an existing proxy helper and does not touch dependencies, workflows, secrets, lockfiles, or package execution paths.

Review details

Best possible solution:

Land this loader-level fix, or an equivalent narrow replacement, after maintainers accept env-proxy precedence for provider usage.

Do we have a high-confidence way to reproduce the issue?

Yes. Current main still resolves provider-usage fetch with plain resolveFetch(opts.fetch) and passes that into the OpenAI/Codex usage hook, while the linked issue provides a proxy-only failure and local fix confirmation.

Is this the best way to solve the issue?

Yes. The provider-usage loader is the narrow owner of the injected fetch function; preserving explicit fetch first and then using the existing env-proxy helper avoids a new config knob or duplicated Codex-specific proxy logic.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against cbbb466852e1.

Label changes

Label justifications:

P2: The PR fixes Codex/OpenAI usage and quota retrieval in proxy-only environments, with limited blast radius to status and usage surfaces.
merge-risk: 🚨 compatibility: The diff intentionally changes the default provider-usage network route when proxy env is configured, which can affect existing setups with stale or broken proxy variables.
rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (terminal): The PR body includes after-fix terminal proof showing CONNECT chatgpt.com:443 through HTTPS_PROXY with a fake token, and tests cover loader selection and explicit fetch precedence.
proof: sufficient: Contributor real behavior proof is sufficient. The PR body includes after-fix terminal proof showing CONNECT chatgpt.com:443 through HTTPS_PROXY with a fake token, and tests cover loader selection and explicit fetch precedence.

Evidence reviewed

PR surface:

Source -4, Tests +136. Total +132 across 4 files.

View PR surface stats

Area	Files	Added	Removed	Net
Source	2	4	8	-4
Tests	2	136	0	+136
Docs	0	0	0	0
Config	0	0	0	0
Generated	0	0	0	0
Other	0	0	0	0
Total	4	140	8	+132

Acceptance criteria:

[P1] node scripts/run-vitest.mjs src/infra/provider-usage.load.test.ts src/infra/provider-usage.load.plugin.test.ts.
[P1] Optional live proof: run a redacted openclaw status --usage --json in a proxy-only OAuth setup.

What I checked:

Repository policy read: Root AGENTS.md was read fully; its provider-routing, dependency-inspection, compatibility, and PR-review guidance apply because this touches provider usage, Codex, proxy fetch, and fallback behavior. (AGENTS.md:1, cbbb466852e1)
Current main bypasses env proxy: Current main resolves provider usage fetch with resolveFetch(opts.fetch), so a no-explicit-fetch usage call receives global fetch rather than the env-proxy helper. (src/infra/provider-usage.load.ts:93, cbbb466852e1)
PR head changes only the fetch precedence: The PR preserves explicit fetch first, then tries resolveProxyFetchFromEnv(env), then falls back to resolveFetch(). (src/infra/provider-usage.load.ts:94, 6b04ad0bb7bf)
Provider usage hook receives loader fetch: The loader passes fetchFn into resolveProviderUsageSnapshotWithPlugin, and the provider runtime calls the plugin fetchUsageSnapshot hook with that context. (src/plugins/provider-runtime.ts:646, cbbb466852e1)
Codex usage consumes injected fetch: The OpenAI/Codex hook passes ctx.fetchFn into fetchCodexUsage, and fetchCodexUsage uses that fetch function for https://chatgpt.com/backend-api/wham/usage. (extensions/openai/openai-chatgpt-provider.ts:633, cbbb466852e1)
Existing proxy helper is the shared seam: resolveProxyFetchFromEnv builds an Undici EnvHttpProxyAgent-backed fetch from env proxy options and returns undefined when no proxy is configured or agent creation fails. (src/infra/net/proxy-fetch.ts:124, cbbb466852e1)

Likely related people:

vincentkoc: Current blame attributes the loader, proxy helper, Codex usage hook, and MCP cleanup-adjacent lines to a recent current-main commit; history also shows recent Codex usage/status work nearby. (role: recent current-path contributor; confidence: high; commits: 9826619e22b7, 20ef410d6432, 1893a0727a37; files: src/infra/provider-usage.load.ts, src/infra/net/proxy-fetch.ts, extensions/openai/openai-chatgpt-provider.ts)
steipete: History shows provider usage runtime hooks and OpenAI provider identity unification on the central loader/hook boundary. (role: provider usage hook introducer; confidence: high; commits: e7555724af15, 4c33aaa86c16; files: src/infra/provider-usage.load.ts, src/plugins/provider-runtime.ts, extensions/openai/openai-chatgpt-provider.ts)
Marcus Castro: History ties the shared proxy-fetch utility reused by this PR to the extraction commit. (role: proxy helper introducer; confidence: medium; commits: ba3fa44c5b34; files: src/infra/net/proxy-fetch.ts, src/infra/net/proxy-env.ts)
brokemac79: Recent history restored Codex synthetic usage through the same status/provider-usage surface, making them useful review routing context. (role: recent Codex usage status contributor; confidence: medium; commits: 1893a0727a37; files: src/infra/provider-usage.load.ts, src/status/status-text.ts)

What the crustacean ranks mean

🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

ClawSweeper keeps one durable marker-backed review comment per issue or PR.
Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
Maintainers can also comment @clawsweeper review to request a fresh review only.
Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

TurboTheTurtle · 2026-06-18T06:47:53Z

@clawsweeper re-review

* fix(provider-usage): honor proxy env for usage fetch * refactor(mcp): remove unused Claude permission type

openclaw-barnacle Bot added size: S triage: needs-real-behavior-proof Candidate: external PR needs after-fix proof from a real setup. labels Jun 17, 2026

TurboTheTurtle force-pushed the issue-78714-provider-usage-proxy branch from da8de69 to bf8935f Compare June 17, 2026 04:51

fix(provider-usage): honor proxy env for usage fetch

28cc429

openclaw-barnacle Bot added proof: supplied External PR includes structured after-fix real behavior proof. and removed triage: needs-real-behavior-proof Candidate: external PR needs after-fix proof from a real setup. labels Jun 17, 2026

refactor(mcp): remove unused Claude permission type

6b04ad0

TurboTheTurtle force-pushed the issue-78714-provider-usage-proxy branch from bf8935f to 6b04ad0 Compare June 17, 2026 05:06

clawsweeper Bot mentioned this pull request Jun 18, 2026

[Bug]: Codex provider usage ignores proxy env and reports fetch failed #78714

Closed

openclaw-clownfish Bot merged commit 0a9b152 into openclaw:main Jun 22, 2026
239 of 251 checks passed

TurboTheTurtle deleted the issue-78714-provider-usage-proxy branch June 23, 2026 02:42

github-actions Bot pushed a commit to Desicool/openclaw that referenced this pull request Jun 23, 2026

fix(provider-usage): honor proxy env for usage fetch (openclaw#93943)

075b879

* fix(provider-usage): honor proxy env for usage fetch * refactor(mcp): remove unused Claude permission type

github-actions Bot mentioned this pull request Jul 1, 2026

chore: bump openclaw/openclaw version from v2026.6.10 to v2026.6.11 Docker-Hub-sirmark/docker-openclaw#35

Merged

clawsweeper Bot mentioned this pull request Jul 3, 2026

fix(infra): wrap provider auth resolution in timeout for status --usage --json #74185

Closed

github-actions Bot mentioned this pull request Jul 6, 2026

chore(openclaw): bump pinned version v2026.5.28 → v2026.6.11 Evans-Software-Solutions-Limited/axel-saas#121

Open

clawsweeper Bot mentioned this pull request Jul 11, 2026

fix(clawrouter): guard usage snapshot fetch against SSRF redirects #104592

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

fix(provider-usage): honor proxy env for usage fetch#93943

fix(provider-usage): honor proxy env for usage fetch#93943
openclaw-clownfish[bot] merged 2 commits into
openclaw:mainfrom
TurboTheTurtle:issue-78714-provider-usage-proxy

TurboTheTurtle commented Jun 17, 2026 •

edited

Loading

Uh oh!

TurboTheTurtle commented Jun 17, 2026

Uh oh!

clawsweeper Bot commented Jun 17, 2026 •

edited

Loading

Uh oh!

clawsweeper Bot commented Jun 17, 2026 •

edited

Loading

Uh oh!

TurboTheTurtle commented Jun 18, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Uh oh!

Conversation

TurboTheTurtle commented Jun 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Real behavior proof

Uh oh!

TurboTheTurtle commented Jun 17, 2026

Uh oh!

clawsweeper Bot commented Jun 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

clawsweeper Bot commented Jun 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

TurboTheTurtle commented Jun 18, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

TurboTheTurtle commented Jun 17, 2026 •

edited

Loading

clawsweeper Bot commented Jun 17, 2026 •

edited

Loading

clawsweeper Bot commented Jun 17, 2026 •

edited

Loading