openclaw - 💡(How to fix) Fix openai/gpt-5.5-pro unreachable when openai-codex OAuth profile is present, even with agentRuntime.id: "pi" pinned

Summary

If a workspace has an openai-codex:default OAuth profile registered (ChatGPT Pro account) and also configures openai/gpt-5.5-pro (a paid-API-only model) in the provider catalog, the runtime selector silently routes requests to the openai-codex OAuth profile instead of the paid OpenAI API. The ChatGPT account then rejects the request server-side:

{"type":"invalid_request_error","message":"The 'gpt-5.5-pro' model is not supported when using Codex with a ChatGPT account."}

Net result: gpt-5.5-pro (and gpt-5.4-nano, which requires OPENAI_API_KEY) cannot be used at all in any workspace that also uses Codex OAuth for the free gpt-5.5 route.

Version

OpenClaw 2026.5.20 (e510042)

Expected

When a model entry has agentRuntime: { id: "pi" } AND lives under the openai provider (with apiKey: "OPENAI_API_KEY"), the gateway should route through the OpenAI API key, not the openai-codex OAuth profile.

Actual

Even with the pin in place at all three levels:

• models.providers.openai.models[*].agentRuntime.id = "pi"
• agents.defaults.models["openai/gpt-5.5-pro"].agentRuntime.id = "pi"
• agents.list[N].models["openai/gpt-5.5-pro"].agentRuntime.id = "pi"

…the selected auth profile is openai-codex:default and the request goes out as openai-codex/gpt-5.5-pro.

Gateway log excerpt:

[agent/embedded] unsupported thinking level for openai-codex/gpt-5.5-pro; retrying with off
[agent/embedded] embedded run failover decision: stage=prompt decision=surface_error
  from=openai-codex/gpt-5.5-pro profile=sha256:06bfb5171eff
  rawError={"status":400,"message":"The 'gpt-5.5-pro' model is not supported when using Codex with a ChatGPT account."}

/status output in the failing session confirms:

Session selected: openai/gpt-5.5-pro · 🔑 oauth (openai-codex:default ([email protected]))
Execution: direct · Runtime: OpenAI Codex

Note the mismatch: the picker selection is openai/gpt-5.5-pro, but the auth profile is openai-codex:default and the runtime is OpenAI Codex — not pi.

Repro

1. Register an openai-codex:default OAuth profile (ChatGPT Pro account).
2. In openclaw.json, declare models.providers.openai with apiKey: "OPENAI_API_KEY" and add a model gpt-5.5-pro with agentRuntime.id: "pi".
3. Apply the same pin in agents.defaults.models and in the per-agent models block.
4. Restart the gateway. Send any prompt with model openai/gpt-5.5-pro.
5. Observe: routed via openai-codex, rejected by ChatGPT with the error above.

Root cause hypothesis

The auth-profile selector resolves OpenAI-family lookups to the first registered profile in the OpenAI namespace (which is openai-codex:default here), ignoring the pi runtime hint on the model entry. There appears to be no way to register a separate openai:default API-key profile that the gateway will prefer when the provider key is literally openai (not openai-codex).

Asks

1. Honor agentRuntime.id: "pi" as a hard override for auth-profile selection on openai/* models.
2. Or: support an explicit openai:default apiKey profile that the gateway selects when the provider key is openai (not openai-codex). Today only openai-codex OAuth profiles seem to be honored.
3. Picker UI (related but separate): allow displayName / group on providers so openai and openai-codex render as distinct groups in /models. Currently the picker collapses them under a single "openai" group, which makes the misrouting harder to diagnose because the user sees what looks like the paid-API entry but the gateway resolves to the OAuth one.

Impact

For users on ChatGPT Pro who also want to call paid-only OpenAI models (gpt-5.5-pro, gpt-5.4-nano, future API-only releases), there is currently no working path inside OpenClaw — the OAuth profile always wins. The only workaround is to remove the openai-codex OAuth profile entirely, which sacrifices the free gpt-5.5 route used by default routing and crons.