openclaw - 💡(How to fix) Fix [Bug]: Codex harness receives openai:default auth profile while status shows openai-codex OAuth

Bug type

Regression (worked before, now fails)

Beta release blocker

No

Summary

After switching between PI/API-key, Codex OAuth, and native Codex harness on OpenClaw 2026.5.7, native Codex harness started failing because the harness receives openai:default even though /status resolves openai-codex OAuth; switching back to PI + Codex OAuth works around it.

Steps to reproduce

1. Start from a working OpenClaw setup using PI with an OpenAI API key (openai:default).
2. Add Codex OAuth profiles with openclaw models auth login --provider openai-codex.
3. Try native Codex harness by enabling the Codex plugin and setting Codex runtime (agents.defaults.agentRuntime.id=codex and/or OPENCLAW_AGENT_RUNTIME=codex).
4. Observe native Codex harness failing with Codex app-server auth profile "openai:default" must belong to provider "openai-codex" or a supported alias.
5. Switch back to PI + Codex OAuth; it works again.
6. Later, without intentionally switching back to native Codex harness, the same Codex app-server auth-profile error reappeared in agent/cron lanes until switching back to PI again.

Expected behavior

When /status resolves the active auth profile as openai-codex OAuth, native Codex harness should receive an openai-codex:* auth profile. When configured for PI, the native Codex app-server harness should not be used.

Actual behavior

/status showed Runtime: OpenAI Codex and oauth (openai-codex:[email protected]), but the Codex harness failed before reply because app-server startup/resume received openai:default. Switching back to PI + Codex OAuth worked around the issue.

OpenClaw version

2026.5.7 (eeef486)

Operating system

ubuntu 25.04

Install method

docker (coollabsio/openclaw via Coolify)

Model

openai/gpt-5.5 for native Codex harness testing; openai-codex/gpt-5.5 or PI + Codex OAuth as workaround

Provider / routing chain

OpenClaw Telegram/cron agent -> OpenAI/Codex routing. Native Codex harness path unexpectedly receives openai:default; PI + Codex OAuth path works.

Additional provider/model setup details

Observed auth profiles from openclaw models status included:

• openai:default from OPENAI_API_KEY / API key profile
• openai-codex:[email protected] OAuth
• openai-codex:[email protected] OAuth

/status during the failure showed: Model: openai/gpt-5.5 · oauth (openai-codex:[email protected] (...)) Execution: direct · Runtime: OpenAI Codex

agents.defaults.agentRuntime was set to:

{ "id": "codex" }

Later workaround was switching back to PI and Codex OAuth, which is now working again.

Logs, screenshots, and evidence

2026-05-14T15:26:14.164+00:00 [agents/harness] Codex agent harness failed; not falling back to embedded PI backend
2026-05-14T15:26:14.166+00:00 [diagnostic] lane task error: lane=main durationMs=3021 error="Error: Codex app-server auth profile \"openai:default\" must belong to provider \"openai-codex\" or a supported alias."
Embedded agent failed before reply: Codex app-server auth profile "openai:default" must belong to provider "openai-codex" or a supported alias.
2026-05-14T15:33:42.441+00:00 [diagnostic] lane task error: lane=cron-nested durationMs=4418 error="Error: Codex app-server auth profile \"openai:default\" must belong to provider \"openai-codex\" or a supported alias."

Impact and severity

Affected: OpenClaw container deployment using Telegram direct sessions and cron/nested lanes. Severity: High when native Codex harness is selected, because agent turns fail before reply. Frequency: Reproduced repeatedly while native Codex harness was active; later reappeared unexpectedly after previously switching back. Consequence: Native Codex harness cannot be used reliably; workaround is PI + Codex OAuth.

Additional information

I started with OpenClaw using an OpenAI API key and PI. Later I switched to Codex OAuth and tried native Codex harness, but hit the openai:default vs openai-codex auth-profile error. I switched back and it worked for a while. Later, without making intentional Codex harness changes, the same error returned in main and cron/nested lanes. After switching back to PI + Codex OAuth again, it is working.

Troubleshooting already tried:

• Verified OPENCLAW_AGENT_RUNTIME=codex inside the container while testing Codex runtime.
• Verified /status showed Runtime: OpenAI Codex and oauth (openai-codex:[email protected]).
• Removed Codex app-server sidecar bindings: rm -f /data/.openclaw/agents/main/sessions/.codex-app-server.json
• Checked for stale sidecars containing openai:default: grep -RIl 'openai:default' /data/.openclaw/agents/main/sessions/.codex-app-server.json This returned no matches.