openclaw - 💡(How to fix) Fix `openclaw doctor --fix` on 2026.5.7 still rewrites `openai-codex/*` → `openai/* + agentRuntime.id="codex"` on Codex-OAuth-only hosts (post-#78407 closure) [2 pull requests]

TL;DR

On a Codex-OAuth-only host running OpenClaw 2026.5.7 (the host version #78407 was closed against), openclaw doctor --fix --yes still performs the unsafe migration: rewrites all seven active openai-codex/gpt-5.5 routes to openai/gpt-5.5 + agentRuntime.id="codex". Same bug class as #79306 (filed today by a separate user on 5.7) and #79440 (ours, also today on 5.7).

Filing fresh per @100yenadmin's recommendation on #78407 since closed issues don't get monitored, and the post-closure comment on #78407 + follow-up on #79440 haven't surfaced movement.

Why this is a fresh issue rather than a #78407 reopen

#78407 was closed 2026-05-07 by @steipete with the proof:

CHANGELOG.md:195 says doctor now repairs legacy openai-codex/* model refs and stale OpenAI PI session pins to openai/* with the Codex runtime while preserving existing openai-codex auth profiles. Fixes #78407.

That description is the rewrite users were reporting as unsafe. The closing proof shows doctor preserves the auth-profile entry but does not preserve the working PI route — and the working PI route is the actual user-visible breakage.

@100yenadmin recommended on #78407 that closed issues don't get reopened or monitored, and to refile fresh evidence. This is that refile.

Live 2026.5.7 evidence on a Codex-OAuth-only host

Environment:

• OpenClaw 2026.5.7 (eeef486)
• plugins.entries.codex.enabled = true, plugins.allow includes codex
• openai-codex:<account> OAuth is the only usable provider for gpt-5.5 chat on this host
• No direct openai API-key provider configured for the affected agent lanes
• Working desired route for active agents: openai-codex/gpt-5.5, fallbacks=[], agentRuntime=null

Pre-doctor state (Trent + 6 active Dev/Sec agents, all healthy):

trent         openai-codex/gpt-5.5  []  null
evelyn-cross  openai-codex/gpt-5.5  []  null
victor-kane   openai-codex/gpt-5.5  []  null
rowan-hale    openai-codex/gpt-5.5  []  null
iris-quinn    openai-codex/gpt-5.5  []  null
noah-wren     openai-codex/gpt-5.5  []  null
sierra-knox   openai-codex/gpt-5.5  []  null

Command run:

/home/openclawops/.npm-global/bin/openclaw doctor --fix --yes

Doctor output (verbatim):

Repaired Codex model routes:
- agents.list.trent.model.primary: openai-codex/gpt-5.5 -> openai/gpt-5.5; set agentRuntime.id to "codex".
- agents.list.evelyn-cross.model.primary: openai-codex/gpt-5.5 -> openai/gpt-5.5; set agentRuntime.id to "codex".
- agents.list.victor-kane.model.primary: openai-codex/gpt-5.5 -> openai/gpt-5.5; set agentRuntime.id to "codex".
- agents.list.rowan-hale.model.primary: openai-codex/gpt-5.5 -> openai/gpt-5.5; set agentRuntime.id to "codex".
- agents.list.iris-quinn.model.primary: openai-codex/gpt-5.5 -> openai/gpt-5.5; set agentRuntime.id to "codex".
- agents.list.noah-wren.model.primary: openai-codex/gpt-5.5 -> openai/gpt-5.5; set agentRuntime.id to "codex".
- agents.list.sierra-knox.model.primary: openai-codex/gpt-5.5 -> openai/gpt-5.5; set agentRuntime.id to "codex".

Recovered Codex OAuth model routes:
- agents.defaults.model.primary: openai/gpt-5.5 -> openai-codex/gpt-5.5.
- agents.defaults.models.openai/gpt-5.5: openai/gpt-5.5 -> openai-codex/gpt-5.5.
- agents.defaults.models.openai/gpt-5.4: openai/gpt-5.4 -> openai-codex/gpt-5.4.

Post-doctor active state:

trent         openai/gpt-5.5  []  {"id":"codex"}
evelyn-cross  openai/gpt-5.5  []  {"id":"codex"}
victor-kane   openai/gpt-5.5  []  {"id":"codex"}
rowan-hale    openai/gpt-5.5  []  {"id":"codex"}
iris-quinn    openai/gpt-5.5  []  {"id":"codex"}
noah-wren     openai/gpt-5.5  []  {"id":"codex"}
sierra-knox   openai/gpt-5.5  []  {"id":"codex"}

openai/gpt-5.5 ref count: 18 → 25

The defaults.model.primary was helpfully recovered toward openai-codex/*, but all seven active agents.list[].model.primary routes were rewritten the wrong direction. On a host with only Codex OAuth available, the new openai/gpt-5.5 + agentRuntime.id="codex" route is not proven safe and is already implicated by #78491.

Recovery (since broken state was unrunnable)

We recovered with bare native openclaw config set / config unset per agent — no scripts, no doctor. Restored state matches pre-doctor:

trent         openai-codex/gpt-5.5  []  null
evelyn-cross  openai-codex/gpt-5.5  []  null
victor-kane   openai-codex/gpt-5.5  []  null
rowan-hale    openai-codex/gpt-5.5  []  null
iris-quinn    openai-codex/gpt-5.5  []  null
noah-wren     openai-codex/gpt-5.5  []  null
sierra-knox   openai-codex/gpt-5.5  []  null

openai/gpt-5.5 ref count: 18 (correctly back to dormant-only refs)

Smoke pings post-recovery — banked PASS: TRENT_REPAIR_OK, EVELYN_REPAIR_OK, VICTOR_REPAIR_OK.

Independent corroboration on 5.7

This is not a single-host issue:

• #79306 (open, 2026-05-08, by @AnakinDang on 2026.5.7) — same bug shape: doctor rewrote openai-codex/gpt-5.5 to openai/gpt-5.5 and globally changed agents.defaults.agentRuntime to {"id":"codex"}. Reporter explicitly notes Codex runtime should be opt-in per Codex worker/agent.
• #79440 (open, ours, 2026-05-08, on 2026.5.7) — reproduced live the same day. Comment thread cross-references this issue.

Two independent operators reproduced the same rewrite class on the supposedly-fixed host within the same 24h window. That's enough signal to indicate the closing proof's "preserves existing openai-codex auth profiles" guarantee does not actually preserve the working openai-codex/* route.

Other related reports the closure left unresolved

• #78491 (closed, 2026-05-06) — even with agentRuntime.id="codex", Codex app-server can fail by selecting/forwarding the wrong auth profile shape (openai:default instead of openai-codex:*). Closed without fix. The "preserve existing openai-codex auth profiles" wording in #78407's closure does not address this — it preserves the entry, not the selection path.
• #78519 (open) — mixed-auth user (OAuth + API key both present) reported doctor switched their route from ChatGPT/Codex subscription billing to direct API billing, costing real money before they caught it ($7 in ~10 minutes). This is the dangerous non-failing variant: the rewrite "succeeds" but bills the user wrongly.

Suggested fix shape (preserved from @solosage1 in #78407)

The fix users have been asking for is auth-profile preconditioned, not an unconditional openai-codex/* → openai/* rewrite:

1. Auth-profile precondition: before rewriting any openai-codex/* route to openai/*, prove both the provider selection and the auth-profile selection for the target route — not merely that an openai-codex:* profile exists somewhere in config. If the proof is not available, leave the existing openai-codex/* route alone.
2. Fail closed on billing/auth-semantic changes: never rewrite a subscription/OAuth route into an API-key-billed route or an ambiguous mixed-auth route without explicit operator confirmation.
3. Defer rewrite when Codex runtime auth binding is uncertain: if the native Codex runtime cannot prove it will choose the openai-codex:* profile, preserve the PI openai-codex/* route.
4. Operator opt-out / hold flag: expose a config flag or doctor flag to disable this migration class until the operator opts in.
5. Doctor warning instead of mutation: when doctor sees openai-codex/* and cannot prove a safe migration, emit a warning with affected paths rather than mutating.

Operational impact for affected hosts

doctor --fix is currently banned on our setup until an upstream fix lands that doesn't reverse the working state. Any agent route repair has to be bare native openclaw config set / config unset per explicit agent path. That's manual work scaling linearly with agent count, and it leaves us unable to use the standard maintenance command on a 27-agent fleet.

What would close this

A doctor --fix pass on 2026.5.x where, given a host with:

• Codex plugin installed/enabled,
• openai-codex:* OAuth profile present and usable for gpt-5.5,
• No direct openai API key configured for the affected lanes,
• Working pre-state of openai-codex/gpt-5.5, fallbacks=[], agentRuntime=null on active agents,

does NOT rewrite those active routes to openai/gpt-5.5 + agentRuntime.id="codex". Either preserve the openai-codex/* PI route, or warn-instead-of-mutate.

cc @steipete @vincentkoc @100yenadmin @solosage1 @AnakinDang