openclaw - 💡(How to fix) Fix [Bug] Codex OAuth token fails in isolated cron/heartbeat sessions — atob URL-safe base64 issue [1 comments, 2 participants]

Bug Description

OpenAI Codex (codex/gpt-5.5) fails with Failed to extract accountId from token when used in isolated cron or heartbeat sessions, despite working correctly in the main interactive session.

Environment

• OpenClaw: 2026.4.29 (a448042)
• Platform: macOS (Darwin 25.2.0, Apple Silicon)
• Node.js: v22.22.1
• Auth: OAuth via ChatGPT account

Steps to Reproduce

1. Authenticate Codex via openclaw models auth login (interactive browser flow)
2. Create a cron job using codex/gpt-5.5
3. Wait for cron to fire — job fails with Failed to extract accountId from token

Actual Behavior

[codex] agent run error: FailoverError: Failed to extract accountId from token
    at extractAccountId (pi-ai/dist/providers/openai-codex-responses.js)
    at streamOpenAICodexResponses

Root Cause Analysis

1. The Codex access token is a valid JWT containing chatgpt_account_id
2. In the main interactive session, extractAccountId() correctly decodes the JWT
3. In isolated cron/heartbeat sessions, the same token fails to decode
4. Root cause: The JWT payload uses URL-safe base64 characters (- and _) which are standard for JWT but break when atob() is called directly in the browser-like isolated session runtime
5. The main session apparently has a different code path that handles URL-safe base64, while the isolated session uses raw atob() which doesn't handle -/_ characters

Related Issues

• #36604 (closed, Mar 2026) — Cron jobs fail with Codex fallback
• #57275 (closed, Apr 2026) — OAuth login fails in TUI with same error
• #70201 (closed, Apr 2026) — codex/gpt-5.4 imageModel fails with same error

Suggested Fix

The extractAccountId() function in openai-codex-responses.js should use a base64 decoder that handles URL-safe characters (replacing - with + and _ with /) instead of relying on atob() directly. For example:

// Replace raw atob() with:
const base64 = payload.replace(/-/g, '+').replace(/_/g, '/');
const json = JSON.parse(atob(base64));

Alternatively, add a session option to pass the main session's authenticated OAuth context to isolated cron/heartbeat sessions.

Impact

All cron jobs must use minimax/MiniMax-M2.7 as a workaround since Codex cannot run in isolated sessions. Users who prefer Codex for flat-rate pricing cannot use it for automated jobs.