fix(codex): route ChatGPT OAuth via CODEX_HOME env, bump OpenClaw to 2026.4.25

[prez2307]

Summary

The chatgpt_oauth provisioning path has been broken since it shipped. Two compounding bugs:

1. We wrote {"openai-codex": {"codexHome": "..."}} to openclaw.json. codexHome is not an OpenClaw config field in any version, on any branch — we invented it. OpenClaw rejected the config and crashed the container. (Verified by reading upstream src + git log -S.)
2. Even with valid config, our pinned v2026.4.5 has no pre-staged-auth.json support at all — Codex auth in 4.5 was interactive-browser-only, broken in headless ECS regardless. Pre-staged-auth.json reading first landed in v2026.4.7 (commit 7e0e2f81e5 added extensions/openai/openai-codex-cli-auth.ts).

What this PR does

• OpenClaw bump: openclaw-version.json + apps/infra/openclaw/Dockerfile → alpine/openclaw:2026.4.25 (current stable, includes hardened OAuth refresh on top of the 4.7 base feature). Per-env tags set to <upstream>-bootstrap so build-openclaw-image.yml rebuilds the extended image.
• Drop fake config knob: core/containers/config.py no longer emits the openai-codex provider block. Omitted entirely — the bundled provider plugin's defaults apply (and an empty {} would still fail the base schema's baseUrl/models validator).
• Use the real one: core/containers/ecs_manager.py injects CODEX_HOME=/home/node/.openclaw/codex as an environment: entry on the per-user task. The path is the in-container view of <EFS>/users/{user_id}/codex/ after the access-point chroot — exactly where pre_stage_codex_auth already writes auth.json.

Verification

Upstream source-grounded confirmation of the fix shape:

// extensions/openai/openai-codex-cli-auth.ts (HEAD)
function resolveCodexCliHome(env) {
  const configured = trimNonEmptyString(env.CODEX_HOME);
  if (!configured) return path.join(resolveRequiredHomeDir(), ".codex");
  return path.resolve(configured);
}
function readCodexCliAuthFile(env) {
  const authPath = path.join(resolveCodexCliHome(env), "auth.json");
  ...
}

Test plan

• pytest tests/unit — 1085 pass
• test_config_provider_routing.test_chatgpt_oauth_branch updated to assert the openai-codex block is absent
• test_provision_chatgpt_oauth_pre_stages_auth_before_service_create extended to assert CODEX_HOME env var lands on the per-user task
• Watch deploy + smoke-test on dev with a fresh ChatGPT OAuth flow
• Follow-up PR to bump per-env tags from <upstream>-bootstrap → <upstream>-<sha> once build-openclaw-image finishes

Caveats

• The bootstrap tag intentionally won't resolve. CDK deploy on this PR's main-merge will fail to pull the image until the follow-up tag-bump PR lands. That's the project's documented two-PR flow for OpenClaw image bumps; not a regression.
• Once the new image is in ECR, existing dev containers need to be re-provisioned to pick up the new openclaw.json shape and CODEX_HOME env. We'll do that as part of the dev clean test.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ecfb9a6d15

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Keep CODEX_HOME when cloning task defs outside provisioning

chatgpt_oauth now depends on CODEX_HOME being present in the task definition, but this env merge only happens when environment_for_task is explicitly passed. Paths like resize_user_container still call _build_register_kwargs_from_base(...) without environment_for_task (see resize_user_container around lines 561-567), so a resize/re-register drops CODEX_HOME from the new revision. After that, OAuth users fall back to ~/.codex/auth.json and lose access to the EFS-staged credentials, so inference fails after a resize/redeploy cycle.

Useful? React with 👍 / 👎.