openclaw - 💡(How to fix) Fix Bug: openai-codex provider drops read/write/edit tools from isolated cron sessions

Bug Report

Summary

Isolated cron sessions using the openai/gpt-5.3-codex model (provider openai-codex, API openai-codex-responses) do not receive local filesystem tools (read, write, edit) even when toolsAllow explicitly lists them. This is a regression — read was previously available (though write/edit were always missing), and as of v2026.5.22, read is also dropped.

Environment

• OpenClaw version: 2026.5.22
• Model: openai/gpt-5.3-codex (provider: openai-codex, api: openai-codex-responses)
• Session type: isolated cron session (sessionTarget: "isolated", lightContext: true)
• toolsAllow: ["message", "web_search", "web_fetch", "read", "write", "edit"]

Expected behavior

When toolsAllow includes "read", "write", and "edit", the tool construction pipeline should:

1. Set includeBaseCodingTools = true (via resolveCodingToolConstructionPlanForAllowlist)
2. Create read, write, and edit tool definitions via createCodingTools
3. Include them in the final filtered tool set

Actual behavior

The session only receives 3 tools: message, web_search, web_fetch. The read, write, and edit tools are completely absent from the compiled tool set.

Timeline (from cron run logs)

• April-May (working): Codex sessions got read but NOT write/edit. Model worked around by reading history and logging "blocked: no file-write tool"
• May 24 07:31 ET (broke): Codex sessions get NEITHER read NOR write/edit. Model aborts with PREFLIGHT_UNAVAILABLE / TOOL_UNAVAILABLE

Root cause analysis

The resolveCodingToolConstructionPlanForAllowlist function in attempt-tool-construction-plan.ts correctly identifies includeBaseCodingTools = true when "read" is in toolsAllow. However, the openai-codex-responses API provider appears to filter out or not receive these local coding tool definitions during the embedded runner's tool construction for isolated cron sessions.

Key code paths investigated:

• src/agents/pi-embedded-runner/run/attempt-tool-construction-plan.ts: BASE_CODING_TOOL_FACTORY_NAMES = Set(["edit", "read", "write"]) — correct
• src/agents/pi-tools.ts: Lines 668-730 create read, write, edit tools when includeBaseCodingTools = true — correct
• src/agents/pi-embedded-runner/run/attempt.ts: Line 1410 creates all tools, then filters by applyEmbeddedAttemptToolsAllow — correct in theory

The trajectory comparison shows:

• Working session (May 17): tools = [message, read, web_fetch, web_search] (4 tools, read present)
• Failed session (May 24): tools = [message, web_fetch, web_search] (3 tools, read missing)

Both sessions use the same toolsAllow, same model, same cron config. The only difference is the OpenClaw version (upgraded to 2026.5.22).

Workaround considered

Switching to xai/grok-4.3 model works (all tools available), but this degrades content quality and is not a viable long-term fix for a production content pipeline.

Impact

• Content pipeline cron jobs that depend on file I/O fail at preflight
• Topic diversity history cannot be read or written
• Any isolated cron session using openai-codex provider cannot access local filesystem

Proposed fix areas to investigate

1. Check if the v2026.5.22 release changed how openai-codex-responses API sessions construct their tool set
2. Verify whether createOpenClawCodingTools is called for openai-codex provider sessions
3. Check if the Codex Responses API has a different tool format that conflicts with local filesystem tool definitions
4. Investigate whether codeModeConfig or codeModeControlsEnabledForRun affects tool availability for Codex sessions