Post-update/restart should either: - run the same stale Codex route/session repair that `doctor` applies before sessions resume, or - detect this specific stale `openai-codex` auth-route state and point directly at `openclaw doctor --fix` / auto-repair, instead of generic API-key setup guidance.

openclaw - ✅(Solved) Fix Post-update sessions can surface stale openai-codex missing-key errors until doctor runs [1 pull requests, 4 comments, 2 participants]

pfrederiksen · 2026-05-19T02:45:30Z

[openclaw] After updating OpenClaw from 2026.5.12 to 2026.5.18 , the Telegram main session failed twice with: ⚠️ Missing API key for provider "openai-codex". C… After updating OpenClaw from `2026.5.12` to `2026.5.18`, the Telegram main session failed twice with: ``` ⚠️ Missing API key for provider "openai-codex". Configure the gateway auth for that provider, then try again. ``` Running `openclaw doctor` restored the session. After that: ``` openclaw --version # OpenClaw 2026.5.18 (50a2481) openclaw models list # openai/gpt-5.5 ... Auth yes # codex/gpt-5.5 ... Auth yes ``` Gateway and dashboard health were also fine: ``` systemctl --user is-active openclaw-gateway # active curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1:4000/ # 200 ``` # PR #83937: Improve stale Codex auth recovery guidance - Repository: openclaw/openclaw - Author: pfrederiksen - State: open | merged: False - Link: https://github.com/openclaw/openclaw/pull/83937 ## Description (problem / solution / changelog) ## Summary - Clear stale auto-created legacy `openai-codex/gpt-*` session route pins when the configured primary has migrated to canonical `openai/gpt-*` - Preserve explicit user-selected `openai-codex` overrides while cleaning up stale automatic session state - Add targeted recovery guidance when an agent run still fails with `No API key found for provider "openai-codex"` - Keep `openclaw doctor --fix` as the first stale-route repair, with `openclaw models auth login --provider openai-codex` / `openclaw configure` as fallback guidance - Cover both the stale session-pin prevention and the missing-key recovery text in regression tests Fixes #83935. ## Real behavior proof **Behavior or issue addressed:** A live Telegram group session on a real OpenClaw install failed after an update with the stale provider-auth message `Missing API key for provider "openai-codex"`. The working recovery was `openclaw doctor`, not configuring a new API key. This PR now does two things for that path: it prevents stale auto-created `openai-codex/gpt-*` session pins from being reused after migration to `openai/gpt-*`, and it improves the fallback user-facing error if a missing-key failure still gets through. **Real environment tested:** OpenClaw gateway on Linux/systemd user service, Telegram group session, updated from `2026.5.12` to `2026.5.18`. **Exact steps or command run after fix:** 1. Updated the live OpenClaw install. 2. Sent a Telegram group message to the existing main session. 3. Observed two failed assistant replies with `Missing API key for provider "openai-codex"`. 4. Ran `openclaw doctor`. 5. Verified the same live install had healthy model auth, active gateway, and responsive dashboard. **Evidence after fix:** ``` Before repair, live Telegram session reply: ⚠️ Missing API key for provider "openai-codex". Configure the gateway auth for that provider, then try again. After running doctor: $ openclaw --version OpenClaw 2026.5.18 (50a2481) $ openclaw models list | grep -E '^(openai/gpt-5.5|codex/gpt-5.5)' openai/gpt-5.5 text 195k no yes default,fallback#1,configured codex/gpt-5.5 text+image 266k no yes $ systemctl --user is-active openclaw-gateway active $ curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1:4000/ 200 ``` **After-patch safe runtime proof from the PR checkout:** ``` $ node --import tsx tmp-proof-stale-codex-message.mjs ⚠️ The session is pointing at a stale OpenAI Codex auth route. Run `openclaw doctor --fix` to repair Codex model/session routes, restart the gateway if doctor asks, then try again. If doctor has nothing to repair or the error persists, re-auth with `openclaw models auth login --provider openai-codex` or run `openclaw configure`. ``` The proof script imports the patched `buildKnownAgentRunFailureReplyPayload` and feeds it the exact real failure signature: `No API key found for provider "openai-codex"`. **Observed result after fix:** The real setup recovered after doctor, confirming stale `openai-codex` route state should direct users to doctor repair. The source patch additionally clears matching stale automatic session pins before they can keep routing future turns through the legacy provider. **What was not tested:** I did not install this branch into the live gateway and intentionally re-break the active Telegram session, because doing that would interrupt the working production assistant session again. ## Validation - `node scripts/run-vitest.mjs src/auto-reply/reply/model-selection.test.ts` - `node scripts/run-vitest.mjs src/auto-reply/reply/agent-runner-execution.test.ts -t "points stale openai-codex missing-key failures at doctor repair"` - `git diff --check` - GitHub PR checks passed on head `4eaf34e3f5d71679b9d766e249c34a7b27447efa` ## Changed files - `src/auto-reply/reply/agent-runner-execution.test.ts` (modified, +38/-0) - `src/auto-reply/reply/agent-runner-execution.ts` (modified, +3/-0) - `src/auto-reply/reply/model-selection.test.ts` (modified, +73/-0) - `src/auto-reply/reply/model-selection.ts

openclaw2026-05-19 02:45:30

ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

GitHub issue URL

Helpful · Quick feedback

GitHub stats

openclaw/openclaw#83935•Fetched 2026-05-20 03:46:20

View on GitHub

Comments

Participants

Timeline

Reactions

Author

pfrederiksen

Participants

clawsweeper[bot]

pfrederiksen

Timeline (top)

labeled ×7commented ×4mentioned ×3subscribed ×3

After updating OpenClaw from 2026.5.12 to 2026.5.18, the Telegram main session failed twice with:

⚠️ Missing API key for provider "openai-codex". Configure the gateway auth for that provider, then try again.

Running openclaw doctor restored the session. After that:

openclaw --version
# OpenClaw 2026.5.18 (50a2481)

openclaw models list
# openai/gpt-5.5 ... Auth yes
# codex/gpt-5.5 ... Auth yes

Gateway and dashboard health were also fine:

systemctl --user is-active openclaw-gateway
# active

curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1:4000/
# 200

Error Message

Update completed.
Session replies failed with generic missing API key guidance for openai-codex.
Manual openclaw doctor fixed the session.
Model auth was healthy afterward.

Root Cause

The installed model auth was healthy, but the live session surfaced a stale openai-codex missing-key error until doctor ran. For users updating via package manager or gateway restart flows, this looks like a broken auth setup even when doctor can repair it immediately.

Fix Action

Fixed

Fixed by PR: Improve stale Codex auth recovery guidance (https://github.com/openclaw/openclaw/pull/83937)

PR fix notes

PR #83937: Improve stale Codex auth recovery guidance

Repository: openclaw/openclaw
Author: pfrederiksen
State: open | merged: False
Link: https://github.com/openclaw/openclaw/pull/83937

Description (problem / solution / changelog)

Summary

Clear stale auto-created legacy openai-codex/gpt-* session route pins when the configured primary has migrated to canonical openai/gpt-*
Preserve explicit user-selected openai-codex overrides while cleaning up stale automatic session state
Add targeted recovery guidance when an agent run still fails with No API key found for provider "openai-codex"
Keep openclaw doctor --fix as the first stale-route repair, with openclaw models auth login --provider openai-codex / openclaw configure as fallback guidance
Cover both the stale session-pin prevention and the missing-key recovery text in regression tests

Fixes #83935.

Real behavior proof

Behavior or issue addressed: A live Telegram group session on a real OpenClaw install failed after an update with the stale provider-auth message Missing API key for provider "openai-codex". The working recovery was openclaw doctor, not configuring a new API key. This PR now does two things for that path: it prevents stale auto-created openai-codex/gpt-* session pins from being reused after migration to openai/gpt-*, and it improves the fallback user-facing error if a missing-key failure still gets through.

Real environment tested: OpenClaw gateway on Linux/systemd user service, Telegram group session, updated from 2026.5.12 to 2026.5.18.

Exact steps or command run after fix:

Updated the live OpenClaw install.
Sent a Telegram group message to the existing main session.
Observed two failed assistant replies with Missing API key for provider "openai-codex".
Ran openclaw doctor.
Verified the same live install had healthy model auth, active gateway, and responsive dashboard.

Evidence after fix:

Before repair, live Telegram session reply:
⚠️ Missing API key for provider "openai-codex". Configure the gateway auth for that provider, then try again.

After running doctor:

$ openclaw --version
OpenClaw 2026.5.18 (50a2481)

$ openclaw models list | grep -E '^(openai/gpt-5.5|codex/gpt-5.5)'
openai/gpt-5.5   text        195k  no  yes  default,fallback#1,configured
codex/gpt-5.5    text+image  266k  no  yes

$ systemctl --user is-active openclaw-gateway
active

$ curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1:4000/
200

After-patch safe runtime proof from the PR checkout:

$ node --import tsx tmp-proof-stale-codex-message.mjs
⚠️ The session is pointing at a stale OpenAI Codex auth route. Run `openclaw doctor --fix` to repair Codex model/session routes, restart the gateway if doctor asks, then try again. If doctor has nothing to repair or the error persists, re-auth with `openclaw models auth login --provider openai-codex` or run `openclaw configure`.

The proof script imports the patched buildKnownAgentRunFailureReplyPayload and feeds it the exact real failure signature: No API key found for provider "openai-codex".

Observed result after fix: The real setup recovered after doctor, confirming stale openai-codex route state should direct users to doctor repair. The source patch additionally clears matching stale automatic session pins before they can keep routing future turns through the legacy provider.

What was not tested: I did not install this branch into the live gateway and intentionally re-break the active Telegram session, because doing that would interrupt the working production assistant session again.

Validation

node scripts/run-vitest.mjs src/auto-reply/reply/model-selection.test.ts
node scripts/run-vitest.mjs src/auto-reply/reply/agent-runner-execution.test.ts -t "points stale openai-codex missing-key failures at doctor repair"
git diff --check
GitHub PR checks passed on head 4eaf34e3f5d71679b9d766e249c34a7b27447efa

Changed files

src/auto-reply/reply/agent-runner-execution.test.ts (modified, +38/-0)
src/auto-reply/reply/agent-runner-execution.ts (modified, +3/-0)
src/auto-reply/reply/model-selection.test.ts (modified, +73/-0)
src/auto-reply/reply/model-selection.ts (modified, +38/-4)

Code Example

⚠️ Missing API key for provider "openai-codex". Configure the gateway auth for that provider, then try again.

---

openclaw --version
# OpenClaw 2026.5.18 (50a2481)

openclaw models list
# openai/gpt-5.5 ... Auth yes
# codex/gpt-5.5 ... Auth yes

---

systemctl --user is-active openclaw-gateway
# active

curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1:4000/
# 200

RAW_BUFFERClick to expand / collapse

Summary

After updating OpenClaw from 2026.5.12 to 2026.5.18, the Telegram main session failed twice with:

⚠️ Missing API key for provider "openai-codex". Configure the gateway auth for that provider, then try again.

Running openclaw doctor restored the session. After that:

openclaw --version
# OpenClaw 2026.5.18 (50a2481)

openclaw models list
# openai/gpt-5.5 ... Auth yes
# codex/gpt-5.5 ... Auth yes

Gateway and dashboard health were also fine:

systemctl --user is-active openclaw-gateway
# active

curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1:4000/
# 200

Why this matters

Expected behavior

Post-update/restart should either:

run the same stale Codex route/session repair that doctor applies before sessions resume, or
detect this specific stale openai-codex auth-route state and point directly at openclaw doctor --fix / auto-repair, instead of generic API-key setup guidance.

Observed behavior

Update completed.
Session replies failed with generic missing API key guidance for openai-codex.
Manual openclaw doctor fixed the session.
Model auth was healthy afterward.

Notes

This may be related to the existing Codex route repair path in src/commands/doctor/shared/codex-route-warnings.ts, especially stale session entries with providerOverride / modelProvider set to openai-codex.

Vote matrix · Quick signals

Works

Did the solution work? Tap to confirm.

Easy Fix

Was it a quick fix?

Time Saver

Did it save you time?

Blocking

Was it severely blocking?

Common Issue

Are others likely hitting this too?

Flaky / Intermittent

Is it intermittent?

Verified / Reproducible

Can you reproduce it reliably?

FAQ

Expected behavior

Post-update/restart should either:

run the same stale Codex route/session repair that doctor applies before sessions resume, or
detect this specific stale openai-codex auth-route state and point directly at openclaw doctor --fix / auto-repair, instead of generic API-key setup guidance.

#api #request error #file not found #serialization error #model compatibility

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Data

Security

Network

Code

UI/UX

Text

System

Multimedia

Protocol

API

Engineering

openclaw - ✅(Solved) Fix Post-update sessions can surface stale openai-codex missing-key errors until doctor runs [1 pull requests, 4 comments, 2 participants]

Recommended Tools

GitHub issue graph ai analysis

Error Message

Root Cause

Fix Action

Fixed

PR fix notes

PR #83937: Improve stale Codex auth recovery guidance

Description (problem / solution / changelog)

Summary

Real behavior proof

Validation

Changed files

Code Example

Summary

Why this matters

Expected behavior

Observed behavior

Notes

FAQ

Expected behavior

Still need to ship something?

TRENDING

openclaw - ✅(Solved) Fix Post-update sessions can surface stale openai-codex missing-key errors until doctor runs [1 pull requests, 4 comments, 2 participants]

Recommended Tools

GitHub issue graph ai analysis

Error Message

Root Cause

Fix Action

Fixed

PR fix notes

PR #83937: Improve stale Codex auth recovery guidance

Description (problem / solution / changelog)

Summary

Real behavior proof

Validation

Changed files

Code Example

Summary

Why this matters

Expected behavior

Observed behavior

Notes

FAQ

Expected behavior

Still need to ship something?

RELATED_DISCOVERY

TRENDING