openclaw - ✅(Solved) Fix OpenAI Codex OAuth in 2026.3.13 does not honor env proxy during code-to-token exchange [1 pull requests, 3 comments, 3 participants]

openclaw2026-03-21 11:26:49

ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

GitHub issue URL

Helpful · Quick feedback

GitHub stats

openclaw/openclaw#51569•Fetched 2026-04-08 01:09:31

View on GitHub

Comments

Participants

Timeline

Reactions

Author

Participants

Timeline (top)

commented ×3cross-referenced ×2labeled ×2referenced ×2

On macOS, OpenClaw 2026.3.13 completes the browser auth step for OpenAI Codex OAuth but fails at code-to-token exchange, while 2026.2.6-3 succeeds under the same proxy setup.

Error Message

[openai-codex] code->token failed: 403 {"error":{"code":"unsupported_country_region_territory","message":"Country, region, or territory not supported","param":null,"type":"request_forbidden"}} OpenAI OAuth failed Error: Token exchange failed

OpenClaw version

2026.3.13 (failing), 2026.2.6-3 (last known good)

Operating system

macOS 26.3.2

Install method

npm global

Model

openai-codex/gpt-5.4

Provider / routing chain

openclaw -> local HTTP proxy via HTTP_PROXY/HTTPS_PROXY -> auth.openai.com OAuth token exchange

Additional provider/model setup details

The failing flow uses OpenAI Codex OAuth in [email protected].

Observed code path:

[email protected] imports loginOpenAICodex from @mariozechner/pi-ai/oauth
[email protected] dist/oauth.js re-exports ./utils/oauth/index.js
new dist/utils/oauth/index.js no longer imports ../http-proxy.js
dist/utils/oauth/openai-codex.js still uses plain fetch(TOKEN_URL, ...)

Observed older working path:

[email protected] imports loginOpenAICodex from @mariozechner/pi-ai
old pi-ai OAuth entry imported ../http-proxy.js
that proxy init called `setGlobalDispatcher(new EnvHttpProxyAgent())

Logs, screenshots, and evidence

Root Cause

This looks like a regression caused by the move from @mariozechner/pi-ai to @mariozechner/pi-ai/oauth without preserving the previous proxy-init side effect.

Fix Action

Fix / Workaround

On macOS, set HTTP_PROXY and HTTPS_PROXY to a local HTTP proxy.
Run [email protected].
Start OpenAI Codex OAuth onboarding.
Complete the browser sign-in successfully.
Observe OpenClaw fail at the token exchange step with unsupported_country_region_territory.
Downgrade to [email protected] and repeat the same flow.
Observe the OAuth flow complete successfully.

Observed older working path:

[email protected] imports loginOpenAICodex from @mariozechner/pi-ai
old pi-ai OAuth entry imported ../http-proxy.js
that proxy init called `setGlobalDispatcher(new EnvHttpProxyAgent())

before=Agent after=EnvHttpProxyAgent Observed runtime verification after local patching of 2026.3.13 to import a proxy init shim before the OpenAI OAuth flow:

PR fix notes

PR #52228: fix: ensure env proxy dispatcher before MiniMax and OpenAI Codex OAuth flows

Repository: openclaw/openclaw
Author: openperf
State: closed | merged: True
Link: https://github.com/openclaw/openclaw/pull/52228

Description (problem / solution / changelog)

Summary

This PR fixes a regression where the environment-based proxy (HTTP_PROXY/HTTPS_PROXY) is ignored during the MiniMax and OpenAI Codex OAuth flows, causing them to fail in environments that require a proxy (e.g., mitmproxy debugging or corporate networks).

This addresses both #51619 and #51569.

Root Cause

The root cause was identified in #51569: The import path change from @mariozechner/pi-ai to @mariozechner/pi-ai/oauth dropped the implicit http-proxy.js side-effect import that previously called setGlobalDispatcher(new EnvHttpProxyAgent( )).

Since loginMiniMaxPortalOAuth and loginOpenAICodex execute outside the runEmbeddedAttempt lifecycle (which handles proxy initialization for normal LLM requests), the global fetch falls back to the default dispatcher, ignoring proxy environment variables.

Changes

src/plugin-sdk/infra-runtime.ts: Exported undici-global-dispatcher.js so extension plugins can access it.
extensions/minimax/oauth.ts: Added ensureGlobalUndiciEnvProxyDispatcher() before loginMiniMaxPortalOAuth makes any outbound fetch calls.
src/plugins/provider-openai-codex-oauth.ts: Added the same initialization before loginOpenAICodex.
src/agents/minimax-vlm.ts: Added defensive proxy initialization before the VLM fetch call.

Note: While investigating #51619, I also noticed that the MiniMax plugin currently lacks a refreshOAuth implementation (unlike OpenAI Codex). When a MiniMax token expires, the refresh silently fails, which might also manifest as an "LLM ERROR" to the user. I've kept this PR strictly focused on the proxy initialization regression, but the missing refresh hook should probably be addressed in a follow-up PR.

Fixes

Fixes #51619 Fixes #51569

Changed files

CHANGELOG.md (modified, +1/-0)
extensions/minimax/oauth.ts (modified, +4/-0)
src/agents/minimax-vlm.ts (modified, +5/-0)
src/plugin-sdk/infra-runtime.ts (modified, +1/-0)
src/plugins/provider-openai-codex-oauth.ts (modified, +6/-0)

Code Example

[openai-codex] code->token failed: 403 {"error":{"code":"unsupported_country_region_territory","message":"Country, region, or territory not supported","param":null,"type":"request_forbidden"}}
OpenAI OAuth failed
Error: Token exchange failed


### OpenClaw version

2026.3.13 (failing), 2026.2.6-3 (last known good)

### Operating system

macOS 26.3.2

### Install method

npm global

### Model

openai-codex/gpt-5.4

### Provider / routing chain

openclaw -> local  HTTP proxy via HTTP_PROXY/HTTPS_PROXY -> auth.openai.com OAuth token exchange

### Additional provider/model setup details

The failing flow uses OpenAI Codex OAuth in `[email protected]`.

Observed code path:
- `[email protected]` imports `loginOpenAICodex` from `@mariozechner/pi-ai/oauth`
- `[email protected]` `dist/oauth.js` re-exports `./utils/oauth/index.js`
- new `dist/utils/oauth/index.js` no longer imports `../http-proxy.js`
- `dist/utils/oauth/openai-codex.js` still uses plain `fetch(TOKEN_URL, ...)`

Observed older working path:
- `[email protected]` imports `loginOpenAICodex` from `@mariozechner/pi-ai`
- old `pi-ai` OAuth entry imported `../http-proxy.js`
- that proxy init called `setGlobalDispatcher(new EnvHttpProxyAgent())

### Logs, screenshots, and evidence

RAW_BUFFERClick to expand / collapse

Bug type

Regression (worked before, now fails)

Summary

On macOS, OpenClaw 2026.3.13 completes the browser auth step for OpenAI Codex OAuth but fails at code-to-token exchange, while 2026.2.6-3 succeeds under the same proxy setup.

Steps to reproduce

On macOS, set HTTP_PROXY and HTTPS_PROXY to a local HTTP proxy.
Run [email protected].
Start OpenAI Codex OAuth onboarding.
Complete the browser sign-in successfully.
Observe OpenClaw fail at the token exchange step with unsupported_country_region_territory.
Downgrade to [email protected] and repeat the same flow.
Observe the OAuth flow complete successfully.

Expected behavior

Under the same proxy setup, the OpenAI Codex OAuth flow should complete in 2026.3.13, as observed in 2026.2.6-3.

Actual behavior

The browser auth step succeeds, but OpenClaw 2026.3.13 fails during code-to-token exchange with:

[openai-codex] code->token failed: 403 {"error":{"code":"unsupported_country_region_territory","message":"Country, region, or territory not supported","param":null,"type":"request_forbidden"}}
OpenAI OAuth failed
Error: Token exchange failed


### OpenClaw version

2026.3.13 (failing), 2026.2.6-3 (last known good)

### Operating system

macOS 26.3.2

### Install method

npm global

### Model

openai-codex/gpt-5.4

### Provider / routing chain

openclaw -> local  HTTP proxy via HTTP_PROXY/HTTPS_PROXY -> auth.openai.com OAuth token exchange

### Additional provider/model setup details

The failing flow uses OpenAI Codex OAuth in `[email protected]`.

Observed code path:
- `[email protected]` imports `loginOpenAICodex` from `@mariozechner/pi-ai/oauth`
- `[email protected]` `dist/oauth.js` re-exports `./utils/oauth/index.js`
- new `dist/utils/oauth/index.js` no longer imports `../http-proxy.js`
- `dist/utils/oauth/openai-codex.js` still uses plain `fetch(TOKEN_URL, ...)`

Observed older working path:
- `[email protected]` imports `loginOpenAICodex` from `@mariozechner/pi-ai`
- old `pi-ai` OAuth entry imported `../http-proxy.js`
- that proxy init called `setGlobalDispatcher(new EnvHttpProxyAgent())

### Logs, screenshots, and evidence

```shell
Observed failure in `2026.3.13`:


[openai-codex] code->token failed: 403 {"error":{"code":"unsupported_country_region_territory","message":"Country, region, or territory not supported","param":null,"type":"request_forbidden"}}
OpenAI OAuth failed
Error: Token exchange failed
Observed success in 2026.2.6-3 under the same local proxy workflow.

Observed code comparison:

old @mariozechner/pi-ai OAuth entry imported ../http-proxy.js
new @mariozechner/pi-ai/oauth path does not import that proxy init
openai-codex.js remained on plain fetch(...)
Observed runtime verification on the old path:

before=Agent
after=EnvHttpProxyAgent
Observed runtime verification after local patching of 2026.3.13 to import a proxy init shim before the OpenAI OAuth flow:

before=Agent
after=EnvHttpProxyAgent

Impact and severity

Affected users/systems/channels: macOS users using OpenAI Codex OAuth behind env-based local proxies Severity: High (blocks OpenAI Codex onboarding) Frequency: Observed consistently in 2026.3.13 and resolved after downgrade to 2026.2.6-3 Consequence: OpenAI Codex OAuth cannot complete, so onboarding is blocked

Additional information

Last known good version: 2026.2.6-3 Observed bad version: 2026.3.13

Observed local workaround: import a proxy-init shim before the OpenAI OAuth flow so the global undici dispatcher becomes EnvHttpProxyAgent.

This looks like a regression caused by the move from @mariozechner/pi-ai to @mariozechner/pi-ai/oauth without preserving the previous proxy-init side effect.

extent analysis

Fix Plan

To resolve the OpenAI Codex OAuth issue in OpenClaw 2026.3.13, we need to ensure that the EnvHttpProxyAgent is used for the token exchange request.

Import and initialize the proxy: Before calling the OpenAI OAuth flow, import and initialize the proxy using the http-proxy module.
Set the global dispatcher: Set the global dispatcher to EnvHttpProxyAgent to ensure that all requests, including the token exchange, are routed through the proxy.

Example code:

const { setGlobalDispatcher } = require('undici');
const { EnvHttpProxyAgent } = require('../http-proxy');

// Initialize the proxy before the OpenAI OAuth flow
setGlobalDispatcher(new EnvHttpProxyAgent());

// Now call the OpenAI OAuth flow
loginOpenAICodex();

Alternatively, you can modify the openai-codex.js file to use the EnvHttpProxyAgent directly:

const { EnvHttpProxyAgent } = require('../http-proxy');

// Use the EnvHttpProxyAgent for the token exchange request
const tokenUrl = 'https://auth.openai.com/token';
const agent = new EnvHttpProxyAgent();
fetch(tokenUrl, { agent });

Verification

To verify that the fix worked, repeat the steps to reproduce the issue and check that the OpenAI Codex OAuth flow completes successfully.

Extra Tips

Ensure that the http-proxy module is properly installed and imported in your project.
If you're using a local proxy, make sure it's configured correctly and running before attempting the OpenAI Codex OAuth flow.
Consider adding error handling and logging to help diagnose any issues that may arise during the OAuth flow.

Vote matrix · Quick signals

Works

Did the solution work? Tap to confirm.

Easy Fix

Was it a quick fix?

Time Saver

Did it save you time?

Blocking

Was it severely blocking?

Common Issue

Are others likely hitting this too?

Flaky / Intermittent

Is it intermittent?

Verified / Reproducible

Can you reproduce it reliably?

FAQ

Expected behavior

Under the same proxy setup, the OpenAI Codex OAuth flow should complete in 2026.3.13, as observed in 2026.2.6-3.

#api #ssr #installation #tensor shape #autograd error #file not found #serialization error #model compatibility #GPU setup #container setup

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

openclaw - ✅(Solved) Fix OpenAI Codex OAuth in 2026.3.13 does not honor env proxy during code-to-token exchange [1 pull requests, 3 comments, 3 participants]

Recommended Tools

GitHub issue graph ai analysis

Error Message

OpenClaw version

Operating system

Install method

Model

Provider / routing chain

Additional provider/model setup details

Logs, screenshots, and evidence

Root Cause

Fix Action

Fix / Workaround

PR fix notes

PR #52228: fix: ensure env proxy dispatcher before MiniMax and OpenAI Codex OAuth flows

Description (problem / solution / changelog)

Summary

Root Cause

Changes

Fixes

Changed files

Code Example

Bug type

Summary

Steps to reproduce

Expected behavior

Actual behavior

Impact and severity

Additional information

extent analysis

Fix Plan

Verification

Extra Tips

FAQ

Expected behavior

Still need to ship something?

RELATED_DISCOVERY

TRENDING