openclaw - 💡(How to fix) Fix [Bug]: OpenAI Codex OAuth can fail JSON parsing on compressed-looking response and hang after success

Summary

OpenAI Codex OAuth re-auth can fail on the token exchange path with a JSON parse error where the response body appears to be binary/compressed data, and a successful retry can leave the CLI process alive after printing OpenAI OAuth complete.

This looks related to the broader compressed-response parsing class in #79752, but this report is for the openai-codex OAuth login path specifically.

Environment

• OpenClaw: 2026.5.12-beta.8
• Source branch tested: release/2026.5.12
• macOS host
• Node: v26.0.0
• Provider: openai-codex
• Command family: openclaw models auth login --provider openai-codex

Symptoms

First re-auth attempt failed after the browser OAuth flow:

◇  OpenAI OAuth failed
SyntaxError: Unexpected token '�', "�wd�����"... is not valid JSON
│
◇  OAuth help ─────────────────────────────────────────────────╮
│  Trouble with OAuth? See https://docs.openclaw.ai/start/faq  │
╰──────────────────────────────────────────────────────────────╯

Local logs showed the same failure class with binary-looking data at the beginning of the JSON parse input. In one log sample the data shape looked gzip-like (\u001f\u008b...).

A later retry completed the OAuth flow and printed success:

◇  OpenAI OAuth complete
Config overwrite: ~/.openclaw/openclaw.json (... changedPaths=34)
Updated ~/.openclaw/openclaw.json
Auth profile: openai-codex:<email> (openai-codex/oauth)
Default model available: openai/gpt-5.5 (use --set-default to apply)

But the CLI did not exit. Process inspection showed the openclaw-models child idle in Node's event loop with an established loopback socket involving the OAuth callback server port (127.0.0.1:1455). The listener was gone, but the accepted callback socket remained open, keeping the process alive.

Expected behavior

1. OAuth token exchange should parse a decoded JSON response, or surface a structured non-JSON response error without trying to parse compressed/binary bytes as JSON.
2. After OpenAI OAuth complete, the auth CLI should exit cleanly without needing manual process termination.

Actual behavior

1. The OpenAI Codex OAuth success/token path can throw SyntaxError: Unexpected token '�' ... is not valid JSON from binary-looking response content.
2. A successful OAuth run can hang after printing success due to a lingering localhost callback socket.

Evidence / local isolation

A local release-branch hotfix was enough to unblock the agents:

• Force Accept-Encoding: identity around OpenAI OAuth login/refresh fetches for auth.openai.com / chatgpt.com.
• After loginOpenAICodex(...) returns, close/destroy lingering callback handles involving port 1455.

After that mitigation:

• openclaw models auth login --provider openai-codex completed without the binary JSON parse error.
• The CLI exited instead of hanging.
• Native Codex model probe succeeded with openai/gpt-5.5.
• ACP Codex model probe also succeeded.

Suspected root causes

There may be two separate defects:

1. Compressed/binary body reaching JSON parsing: likely same general class as #79752, but on the OpenAI Codex OAuth path.
2. OAuth callback server cleanup: the login flow appears to leave an accepted localhost callback socket open after success, keeping the Node event loop alive.

Notes

This issue intentionally avoids including OAuth token material or full auth-profile contents. The failure was observed without printing secrets.

I am not opening a PR yet because main appears to be in active refactor and the local mitigation is release-branch-oriented. A proper upstream fix likely should handle the JSON decoding problem in the shared HTTP/OAuth layer, while the callback socket cleanup can probably be fixed narrowly in the OpenAI Codex OAuth runtime.