Best possible solution:

Land the manifest-owned SecretInput expansion only after wildcard header assignment preserves literal map keys, dotted-header regression coverage is added, and redacted real app-server proof shows a SecretRef-backed token or header connects.

Do we have a high-confidence way to reproduce the issue?

Yes for the review finding: source inspection shows appServer.headers.* wildcard matches return a dotted path string and the assignment writer later splits that path on dots. The feature itself still lacks real app-server runtime proof.

Is this the best way to solve the issue?

No. The manifest-owned SecretInput expansion is the right layer, but this implementation still needs segment-safe wildcard assignment and real Codex app-server proof before it is the best fix.

Full review comments:

• [P2] Preserve dotted header keys during SecretRef assignment — extensions/codex/openclaw.plugin.json:261
appServer.headers.* opts arbitrary header names into SecretRef resolution, but wildcard matches are serialized as dotted paths and the assignment helper later splits on dots. A valid header key like X.Api.Key is treated as nested object traversal instead of replacing headers["X.Api.Key"], leaving the SecretRef unresolved for the WebSocket auth path. Preserve concrete wildcard segments or escape map keys, and add a dotted-header regression test.
  Confidence: 0.9

Overall correctness: patch is incorrect
Overall confidence: 0.88

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 2ef0589b760d.

Label justifications:

• P2: This is a normal-priority Codex app-server credential feature with bounded blast radius and one source-reproducible correctness issue.
• merge-risk: 🚨 auth-provider: The PR changes Codex app-server token/header credential parsing, SecretRef resolution, and shared-client keying before remote WebSocket auth.
• rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🦐 gold shrimp.
• status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: The PR body and comments provide tests only; add redacted terminal output, logs, copied live output, or a short recording from a real SecretRef-backed Codex app-server connection, then update the PR body so ClawSweeper re-reviews or ask a maintainer to comment @clawsweeper re-review.

PR surface:

Source +66, Tests +289, Docs +20. Total +375 across 12 files.

What I checked:

• Current main lacks the feature: Current main still types and parses Codex app-server authToken and headers as strings, so the requested SecretInput support is not already implemented. (extensions/codex/src/app-server/config.ts:214, 2ef0589b760d)
• Latest release lacks the feature: Release v2026.6.8 also has string-only authToken and headers fields in Codex app-server config. (extensions/codex/src/app-server/config.ts:177, 844f405ac1be)
• PR credential surface: The PR head changes Codex app-server authToken and headers to SecretInput-compatible types and schemas. (extensions/codex/src/app-server/config.ts:219, 8ed092ea1a62)
• Header wildcard assignment bug: Wildcard matches preserve raw record keys, but the assignment writer later splits the serialized path on dots, so a header key like X.Api.Key is treated as nested traversal rather than a literal header key. (src/secrets/runtime-config-collectors-plugins.ts:177, 2ef0589b760d)
• PR test gap: The new bundled collector test covers x-codex-client-session-token but not a dotted header name, so it misses the wildcard assignment failure. (src/secrets/runtime-config-collectors-plugins.bundled.test.ts:36, 8ed092ea1a62)
• Codex dependency contract: Upstream Codex app-server authorizes WebSocket upgrades from the Authorization: Bearer ... header and rejects missing or invalid bearer auth, so this credential path can block remote sessions when wrong. (../codex/codex-rs/app-server-transport/src/transport/auth.rs:368, 38c96866f021)

Likely related people:

• steipete: Introduced Codex app-server controls and then split/hardened the app-server lifecycle around the config and runtime surface this PR extends. (role: original app-server contributor; confidence: high; commits: 31a0b7bd42a5, 3b65e2302a55, 659bcc5e5b59; files: extensions/codex/src/app-server/config.ts, extensions/codex/openclaw.plugin.json, extensions/codex/src/app-server/transport-websocket.ts)
• vincentkoc: Recent history touches Codex app-server auth/profile startup and the manifest config-contract collector paths used by this PR. (role: recent app-server and config-contract contributor; confidence: high; commits: 2c7fe6a39c0f, f1cc8f0cfc7c, e6117618095c; files: extensions/codex/src/app-server/config.ts, src/plugins/config-contracts.ts, src/secrets/runtime-config-collectors-plugins.ts)
• joshavant: Prior SecretRef runtime, strict/inspect, and target-registry work established the generic credential machinery this PR builds on. (role: related SecretRef feature contributor; confidence: medium; commits: 806803b7efe2, 1769fb2aa1d6, 788f56f30fd9; files: src/config/types.secrets.ts, src/plugin-sdk/secret-input.ts, src/secrets/target-registry-data.ts)

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.